@nifrajs/cli 2.1.0 → 2.3.0

package/dist/upgrade.d.ts

@@ -1,20 +1,20 @@
 /**
- * `nifra upgrade <version>` — an executable, per-release upgrade runner. Framework and shared-package
+ * `nifra upgrade <version>` - an executable, per-release upgrade runner. Framework and shared-package
  * bumps otherwise spread the same mechanical edits across every consuming app by hand; a recipe turns
  * them into `detect → transform → verify`:
  *
- *   1. **pin sweep** — set every matching dependency to the target version across the workspace's
+ *   1. **pin sweep** - set every matching dependency to the target version across the workspace's
  *      package.json files, preserving the caret/tilde/exact style and skipping `workspace:`/`link:` specs.
- *   2. **dependency moves** — replace removed packages with their supported successor without
+ *   2. **dependency moves** - replace removed packages with their supported successor without
  *      reserializing package.json or leaving duplicate dependency keys.
- *   3. **import moves** — rewrite exact import specifiers to their updated module paths.
- *   4. **verify** — reuse the existing `nifra check` gate; no new verification surface.
+ *   3. **import moves** - rewrite exact import specifiers to their updated module paths.
+ *   4. **verify** - reuse the existing `nifra check` gate; no new verification surface.
  *
  * Dry-run by default (prints the plan, writes nothing); `--write` applies. Fail-closed on an unknown
  * target version or a missing package.json, and deterministic (same repo + target → same edits).
  *
  * Deliberately NOT a codemod engine: transforms are string/specifier-level only. Structural (AST)
- * transforms are a future addition — a recipe that needs one is the signal to add the engine, not before.
+ * transforms are a future addition - a recipe that needs one is the signal to add the engine, not before.
  */
 import { type UpgradeRecipe } from "./recipes/index.js";
 export interface UpgradeOptions {
@@ -64,7 +64,7 @@ export interface UpgradePlan {
  */
 export declare function rewriteVersionSpec(spec: string, toVersion: string): string | null;
 /**
- * Apply pin rules to one package.json's TEXT (format-preserving — targeted string replaces, never a
+ * Apply pin rules to one package.json's TEXT (format-preserving - targeted string replaces, never a
  * JSON re-serialize that would reorder keys or drop comments-as-formatting). Returns the new text and
  * the changes made.
  */

package/dist/upgrade.js

@@ -1,20 +1,20 @@
 /**
- * `nifra upgrade <version>` — an executable, per-release upgrade runner. Framework and shared-package
+ * `nifra upgrade <version>` - an executable, per-release upgrade runner. Framework and shared-package
  * bumps otherwise spread the same mechanical edits across every consuming app by hand; a recipe turns
  * them into `detect → transform → verify`:
  *
- *   1. **pin sweep** — set every matching dependency to the target version across the workspace's
+ *   1. **pin sweep** - set every matching dependency to the target version across the workspace's
  *      package.json files, preserving the caret/tilde/exact style and skipping `workspace:`/`link:` specs.
- *   2. **dependency moves** — replace removed packages with their supported successor without
+ *   2. **dependency moves** - replace removed packages with their supported successor without
  *      reserializing package.json or leaving duplicate dependency keys.
- *   3. **import moves** — rewrite exact import specifiers to their updated module paths.
- *   4. **verify** — reuse the existing `nifra check` gate; no new verification surface.
+ *   3. **import moves** - rewrite exact import specifiers to their updated module paths.
+ *   4. **verify** - reuse the existing `nifra check` gate; no new verification surface.
  *
  * Dry-run by default (prints the plan, writes nothing); `--write` applies. Fail-closed on an unknown
  * target version or a missing package.json, and deterministic (same repo + target → same edits).
  *
  * Deliberately NOT a codemod engine: transforms are string/specifier-level only. Structural (AST)
- * transforms are a future addition — a recipe that needs one is the signal to add the engine, not before.
+ * transforms are a future addition - a recipe that needs one is the signal to add the engine, not before.
  */
 import { readFileSync, writeFileSync } from "node:fs";
 import { join, relative } from "node:path";
@@ -26,8 +26,8 @@ const DEP_FIELDS = [
     "peerDependencies",
     "optionalDependencies",
 ];
-// Only a bare semver spec is rewritten. Anything else — workspace:*, link:/file:, npm: aliases, git
-// urls, "*", "latest", or a multi-part range — is intentionally left untouched (skipped, not guessed).
+// Only a bare semver spec is rewritten. Anything else - workspace:*, link:/file:, npm: aliases, git
+// urls, "*", "latest", or a multi-part range - is intentionally left untouched (skipped, not guessed).
 const SEMVER_SPEC = /^([\^~]|>=|<=|>|<|=)?\s*(\d+)\.(\d+)\.(\d+)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
 /**
  * Rewrite a dependency version spec to `toVersion`, preserving the range operator (`^`, `~`, …).
@@ -43,7 +43,7 @@ export function rewriteVersionSpec(spec, toVersion) {
 }
 const escapeRegExp = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 /**
- * Apply pin rules to one package.json's TEXT (format-preserving — targeted string replaces, never a
+ * Apply pin rules to one package.json's TEXT (format-preserving - targeted string replaces, never a
  * JSON re-serialize that would reorder keys or drop comments-as-formatting). Returns the new text and
  * the changes made.
  */
@@ -268,7 +268,7 @@ function renderPlan(plan, write) {
     if (plan.pins.length === 0 &&
         plan.dependencyMoves.length === 0 &&
         plan.importMoves.length === 0) {
-        lines.push("Already up to date — no changes.");
+        lines.push("Already up to date - no changes.");
         return lines.join("\n");
     }
     if (plan.dependencyMoves.length > 0) {
@@ -325,7 +325,7 @@ export async function runUpgrade(cwd, options) {
         readFileSync(join(cwd, "package.json"), "utf8");
     }
     catch {
-        console.error(`[nifra] no package.json in ${relative(process.cwd(), cwd) || "."} — run from a project root`);
+        console.error(`[nifra] no package.json in ${relative(process.cwd(), cwd) || "."} - run from a project root`);
         return false;
     }
     const write = options.write === true;
@@ -342,7 +342,7 @@ export async function runUpgrade(cwd, options) {
         const ok = await runCheck(cwd, { json: false });
         if (!ok) {
             if (!options.json)
-                console.error("\n[nifra] upgrade applied but `nifra check` failed — review above.");
+                console.error("\n[nifra] upgrade applied but `nifra check` failed - review above.");
             return false;
         }
     }

package/dist/verification.d.ts

@@ -0,0 +1,51 @@
+/**
+ * One project verification, four commands. `nifra check`, `nifra assure`, `nifra levels`, and
+ * `nifra capabilities` are not separate audits - they are renderings of the same reflected project: the
+ * typed-contract scan, the route-assurance evaluation, and the static capability provenance. Historically
+ * each command re-derived the slice it needed, so a caller had to know which command ran which policy (and
+ * `levels` paid for the capability walk twice). `collectProjectVerification` runs each underlying policy
+ * exactly once and hands back a single value; the commands become thin formatters over subsets of it -
+ * `check`/`assure`/`levels` read their view directly, and `capabilities snapshot`/`check` read the same
+ * capability report before writing or diffing the lockfile.
+ *
+ * The typed-contract check is the one heavy pass (source walk + optional `tsc`), and `nifra assure`
+ * never needs it, so it is exposed as a lazily-invoked `check()` rather than computed up front.
+ */
+import { type AssuranceConfig, type AssuranceReport } from "@nifrajs/core/assurance";
+import { type CapabilityProjectReport } from "./capabilities-tool.js";
+import { type CheckResult } from "./check.js";
+export interface CollectProjectVerificationOptions {
+    /** Assurance config path, default `nifra.assurance.ts`. Honored by the assurance + levels views. */
+    readonly config?: string;
+    /** Skip the `tsc` pass in the check view (the agent inner-loop mode). */
+    readonly lintsOnly?: boolean;
+    /** Cancels the check view's typecheck. */
+    readonly signal?: AbortSignal;
+    /** Cap the check view's diagnostics (the `levels` L0 and MCP paths set this). */
+    readonly maxDiagnostics?: number;
+}
+export interface ProjectVerification {
+    readonly cwd: string;
+    /** Whether `nifra.assurance.ts` (or the requested `config` path) exists. */
+    readonly assuranceConfigPresent: boolean;
+    /** The loaded assurance config, when it loaded cleanly. */
+    readonly config?: AssuranceConfig;
+    /** The error from loading/evaluating the config, if any; the assurance views surface or throw it. */
+    readonly configError?: unknown;
+    /** `evaluateRouteAssurance` over the config's source + policy. Present whenever {@link config} is. */
+    readonly routeAssurance?: AssuranceReport;
+    /** Static capability provenance, when the config declares a capabilities policy. */
+    readonly capability?: CapabilityProjectReport;
+    /**
+     * The typed-contract check (scanners + typecheck + the assurance-fed capability/manifest diagnostics).
+     * Lazy and memoized: `nifra assure` never calls it, so that command pays nothing for the source walk.
+     */
+    check(): Promise<CheckResult>;
+}
+/**
+ * Run each verification policy once and return the unified value. The config is loaded (and reflected)
+ * a single time; the resulting route-assurance + capability evidence is both returned for the assurance
+ * views and fed into the check view, so nothing is computed twice.
+ */
+export declare function collectProjectVerification(cwd: string, options?: CollectProjectVerificationOptions): Promise<ProjectVerification>;
+//# sourceMappingURL=verification.d.ts.map

package/dist/verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification.d.ts","sourceRoot":"","sources":["../src/verification.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,eAAe,EAErB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAA8B,KAAK,WAAW,EAAsB,MAAM,YAAY,CAAA;AAE7F,MAAM,WAAW,iCAAiC;IAChD,oGAAoG;IACpG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,yEAAyE;IACzE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;IAC5B,0CAA0C;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B,iFAAiF;IACjF,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CACjC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,4EAA4E;IAC5E,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAA;IACxC,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAA;IACjC,qGAAqG;IACrG,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAA;IAC9B,sGAAsG;IACtG,QAAQ,CAAC,cAAc,CAAC,EAAE,eAAe,CAAA;IACzC,oFAAoF;IACpF,QAAQ,CAAC,UAAU,CAAC,EAAE,uBAAuB,CAAA;IAC7C;;;OAGG;IACH,KAAK,IAAI,OAAO,CAAC,WAAW,CAAC,CAAA;CAC9B;AAED;;;;GAIG;AACH,wBAAsB,0BAA0B,CAC9C,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,iCAAsC,GAC9C,OAAO,CAAC,mBAAmB,CAAC,CAyD9B"}

package/dist/verification.js

@@ -0,0 +1,80 @@
+/**
+ * One project verification, four commands. `nifra check`, `nifra assure`, `nifra levels`, and
+ * `nifra capabilities` are not separate audits - they are renderings of the same reflected project: the
+ * typed-contract scan, the route-assurance evaluation, and the static capability provenance. Historically
+ * each command re-derived the slice it needed, so a caller had to know which command ran which policy (and
+ * `levels` paid for the capability walk twice). `collectProjectVerification` runs each underlying policy
+ * exactly once and hands back a single value; the commands become thin formatters over subsets of it -
+ * `check`/`assure`/`levels` read their view directly, and `capabilities snapshot`/`check` read the same
+ * capability report before writing or diffing the lockfile.
+ *
+ * The typed-contract check is the one heavy pass (source walk + optional `tsc`), and `nifra assure`
+ * never needs it, so it is exposed as a lazily-invoked `check()` rather than computed up front.
+ */
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+import { evaluateRouteAssurance, } from "@nifrajs/core/assurance";
+import { collectCapabilityProjectReport, } from "./capabilities-tool.js";
+import { collectCheckResult } from "./check.js";
+/**
+ * Run each verification policy once and return the unified value. The config is loaded (and reflected)
+ * a single time; the resulting route-assurance + capability evidence is both returned for the assurance
+ * views and fed into the check view, so nothing is computed twice.
+ */
+export async function collectProjectVerification(cwd, options = {}) {
+    const { loadAssuranceConfig, DEFAULT_ASSURANCE_CONFIG } = await import("./assure.js");
+    const configPath = resolve(cwd, options.config ?? DEFAULT_ASSURANCE_CONFIG);
+    const assuranceConfigPresent = existsSync(configPath);
+    let config;
+    let configError;
+    let routeAssurance;
+    let capability;
+    // One try mirrors `check`'s single catch: any failure to load or reflect the config becomes the
+    // `configError` each view then renders in its own idiom (a diagnostic, a throw, a failed rung).
+    try {
+        config = await loadAssuranceConfig(cwd, options.config);
+        routeAssurance = evaluateRouteAssurance(config.source, config.policy, {
+            ...(config.capabilities !== undefined
+                ? { definitions: config.capabilities.definitions }
+                : {}),
+        });
+        if (config.capabilities !== undefined) {
+            capability = await collectCapabilityProjectReport(cwd, config.source, config.capabilities);
+        }
+    }
+    catch (error) {
+        configError = error;
+        config = undefined;
+        routeAssurance = undefined;
+        capability = undefined;
+    }
+    // The check view's assurance inputs. Fed to `check()` only when no custom config path was requested,
+    // so `nifra check` (which always reads the default `nifra.assurance.ts`) and `levels` L0 keep reading
+    // exactly the config they read before; a `--config` override stays a route-assurance/levels concern.
+    const checkContext = {
+        present: assuranceConfigPresent,
+        ...(config !== undefined ? { config } : {}),
+        ...(configError !== undefined ? { error: configError } : {}),
+        ...(routeAssurance !== undefined ? { routeAssurance } : {}),
+        ...(capability !== undefined ? { capability } : {}),
+    };
+    let checkResult;
+    return Object.freeze({
+        cwd,
+        assuranceConfigPresent,
+        ...(config !== undefined ? { config } : {}),
+        ...(configError !== undefined ? { configError } : {}),
+        ...(routeAssurance !== undefined ? { routeAssurance } : {}),
+        ...(capability !== undefined ? { capability } : {}),
+        check() {
+            checkResult ??= collectCheckResult(cwd, {
+                lintsOnly: options.lintsOnly ?? false,
+                ...(options.signal !== undefined ? { signal: options.signal } : {}),
+                ...(options.maxDiagnostics !== undefined ? { maxDiagnostics: options.maxDiagnostics } : {}),
+                ...(options.config === undefined ? { assurance: checkContext } : {}),
+            });
+            return checkResult;
+        },
+    });
+}
+//# sourceMappingURL=verification.js.map

package/dist/verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification.js","sourceRoot":"","sources":["../src/verification.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAGL,sBAAsB,GACvB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAEL,8BAA8B,GAC/B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAgD,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAgC7F;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,GAAW,EACX,UAA6C,EAAE;IAE/C,MAAM,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAA;IACrF,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,IAAI,wBAAwB,CAAC,CAAA;IAC3E,MAAM,sBAAsB,GAAG,UAAU,CAAC,UAAU,CAAC,CAAA;IAErD,IAAI,MAAmC,CAAA;IACvC,IAAI,WAAoB,CAAA;IACxB,IAAI,cAA2C,CAAA;IAC/C,IAAI,UAA+C,CAAA;IACnD,gGAAgG;IAChG,gGAAgG;IAChG,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;QACvD,cAAc,GAAG,sBAAsB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;YACpE,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS;gBACnC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE;gBAClD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAA;QACF,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACtC,UAAU,GAAG,MAAM,8BAA8B,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,CAAA;QAC5F,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,GAAG,KAAK,CAAA;QACnB,MAAM,GAAG,SAAS,CAAA;QAClB,cAAc,GAAG,SAAS,CAAA;QAC1B,UAAU,GAAG,SAAS,CAAA;IACxB,CAAC;IAED,qGAAqG;IACrG,sGAAsG;IACtG,qGAAqG;IACrG,MAAM,YAAY,GAA0B;QAC1C,OAAO,EAAE,sBAAsB;QAC/B,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAA;IAED,IAAI,WAA6C,CAAA;IACjD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG;QACH,sBAAsB;QACtB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,KAAK;YACH,WAAW,KAAK,kBAAkB,CAAC,GAAG,EAAE;gBACtC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,KAAK;gBACrC,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3F,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrE,CAAC,CAAA;YACF,OAAO,WAAW,CAAA;QACpB,CAAC;KACF,CAAC,CAAA;AACJ,CAAC"}