@nifrajs/cli 2.1.0 → 2.3.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nifrajs/cli",
-  "version": "2.1.0",
-  "description": "The nifra CLI — zero-config dev/build/start for a nifra app (`nifra dev`, `nifra build`, `nifra start`).",
+  "version": "2.3.0",
+  "description": "The nifra CLI - zero-config dev/build/start for a nifra app (`nifra dev`, `nifra build`, `nifra start`).",
   "keywords": [
     "bun",
     "typescript",
@@ -41,14 +41,14 @@
     "access": "public"
   },
   "dependencies": {
-    "@nifrajs/client": "2.1.0",
-    "@nifrajs/core": "2.1.0",
-    "@nifrajs/mcp": "2.1.0",
-    "@nifrajs/runner": "2.1.0",
-    "@nifrajs/schema": "2.1.0",
-    "@nifrajs/testing": "2.1.0",
-    "@nifrajs/web": "2.1.0",
-    "create-nifra": "2.1.0"
+    "@nifrajs/client": "2.3.0",
+    "@nifrajs/core": "2.3.0",
+    "@nifrajs/mcp": "2.3.0",
+    "@nifrajs/runner": "2.3.0",
+    "@nifrajs/schema": "2.3.0",
+    "@nifrajs/testing": "2.3.0",
+    "@nifrajs/web": "2.3.0",
+    "create-nifra": "2.3.0"
   },
   "repository": {
     "type": "git",
@@ -58,5 +58,16 @@
   "bugs": {
     "url": "https://github.com/nifrajs/nifra/issues"
   },
-  "homepage": "https://github.com/nifrajs/nifra#readme"
+  "homepage": "https://github.com/nifrajs/nifra#readme",
+  "peerDependencies": {
+    "typescript": "^5.0.0 || ^6.0.0"
+  },
+  "peerDependenciesMeta": {
+    "typescript": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "typescript": "^6.0.3"
+  }
 }

package/src/assure.ts

@@ -1,13 +1,9 @@
-/** `nifra assure` — evaluate a project's reflected routes against `nifra.assurance.ts`. */
+/** `nifra assure` - evaluate a project's reflected routes against `nifra.assurance.ts`. */
 
 import { existsSync } from "node:fs"
 import { resolve } from "node:path"
 import { pathToFileURL } from "node:url"
-import {
-  type AssuranceConfig,
-  type AssuranceReport,
-  evaluateRouteAssurance,
-} from "@nifrajs/core/assurance"
+import type { AssuranceConfig, AssuranceReport } from "@nifrajs/core/assurance"
 
 export const DEFAULT_ASSURANCE_CONFIG = "nifra.assurance.ts"
 
@@ -28,7 +24,7 @@ export async function loadAssuranceConfig(
   const path = resolve(cwd, configPath)
   if (!existsSync(path)) {
     throw new Error(
-      `[nifra] route assurance config not found: ${path} — create ${DEFAULT_ASSURANCE_CONFIG} with a default defineAssuranceConfig({ source, policy }) export.`,
+      `[nifra] route assurance config not found: ${path} - create ${DEFAULT_ASSURANCE_CONFIG} with a default defineAssuranceConfig({ source, policy }) export.`,
     )
   }
   const specifier = pathToFileURL(path)
@@ -60,19 +56,22 @@ export async function collectAssuranceReport(
   cwd: string,
   configPath?: string,
 ): Promise<AssuranceReport> {
-  const config = await loadAssuranceConfig(cwd, configPath)
-  const routeReport = evaluateRouteAssurance(config.source, config.policy)
-  if (config.capabilities === undefined) return routeReport
-  const { collectCapabilityProjectReport } = await import("./capabilities-tool.ts")
-  const capabilityProject = await collectCapabilityProjectReport(
-    cwd,
-    config.source,
-    config.capabilities,
-  )
+  // The route-assurance view over the one project verification. The config load, route reflection, and
+  // capability walk it needs are exactly what `collectProjectVerification` already ran.
+  const { collectProjectVerification } = await import("./verification.ts")
+  const verification = await collectProjectVerification(cwd, {
+    ...(configPath !== undefined ? { config: configPath } : {}),
+  })
+  // A missing/broken config threw here before; re-throw the same error to keep that contract.
+  if (verification.configError !== undefined) throw verification.configError
+  // A present config means routeAssurance is computed; capability is set exactly when the config
+  // declares a capabilities policy.
+  const routeReport = verification.routeAssurance as AssuranceReport
+  if (verification.capability === undefined) return routeReport
   return Object.freeze({
     ...routeReport,
-    ok: routeReport.ok && capabilityProject.report.ok,
-    capabilities: capabilityProject.report,
+    ok: routeReport.ok && verification.capability.report.ok,
+    capabilities: verification.capability.report,
   })
 }
 

package/src/capabilities-tool.ts

@@ -14,7 +14,6 @@ import {
   validCapabilityId,
 } from "@nifrajs/core/capabilities"
 import { reflectRoutes } from "@nifrajs/core/reflection"
-import { loadAssuranceConfig } from "./assure.ts"
 import { scanStaticRouteText, stripComments, walkSource } from "./check.ts"
 
 const EFFECT_IMPORT =
@@ -61,6 +60,14 @@ export interface CapabilityImportViolation {
 export interface CapabilityProjectReport {
   readonly report: CapabilityAssuranceReport
   readonly violations: readonly CapabilityImportViolation[]
+  readonly truncations: readonly CapabilityProvenanceTruncation[]
+}
+
+export interface CapabilityProvenanceTruncation {
+  readonly method: string
+  readonly path: string
+  readonly reason: "depth-limit" | "module-limit"
+  readonly chain: readonly string[]
 }
 
 function resolveLocalModule(
@@ -113,8 +120,12 @@ interface WalkResult {
   readonly covered: boolean
   readonly evidence: Array<{ id: string; kind: "static"; source: string }>
   readonly violations: CapabilityImportViolation[]
+  readonly truncations: CapabilityProvenanceTruncation[]
 }
 
+const MAX_PROVENANCE_MODULES = 500
+const MAX_PROVENANCE_CHAIN = 16
+
 async function walkRouteModules(
   cwd: string,
   modules: readonly string[],
@@ -127,11 +138,34 @@ async function walkRouteModules(
   const visited = new Set<string>()
   const evidence: Array<{ id: string; kind: "static"; source: string }> = []
   const violations: CapabilityImportViolation[] = []
+  const truncations: CapabilityProvenanceTruncation[] = []
   let covered = false
 
-  while (queue.length > 0 && visited.size < 500) {
+  while (queue.length > 0) {
+    if (visited.size >= MAX_PROVENANCE_MODULES) {
+      const pending = queue[0]
+      truncations.push({
+        method,
+        path,
+        reason: "module-limit",
+        chain: Object.freeze([
+          ...(pending?.chain ?? []),
+          `<${MAX_PROVENANCE_MODULES}-module limit>`,
+        ]),
+      })
+      break
+    }
     const current = queue.shift()
-    if (current === undefined || visited.has(current.module) || current.chain.length > 16) continue
+    if (current === undefined || visited.has(current.module)) continue
+    if (current.chain.length > MAX_PROVENANCE_CHAIN) {
+      truncations.push({
+        method,
+        path,
+        reason: "depth-limit",
+        chain: Object.freeze([...current.chain, `<${MAX_PROVENANCE_CHAIN}-hop limit>`]),
+      })
+      continue
+    }
     visited.add(current.module)
     let content = sources.get(current.module)
     if (content === undefined) {
@@ -174,7 +208,7 @@ async function walkRouteModules(
       }
     }
   }
-  return { covered, evidence, violations }
+  return { covered, evidence, violations, truncations }
 }
 
 /** Build coverage-qualified static evidence for every reflected route. */
@@ -196,6 +230,7 @@ export async function collectCapabilityProjectReport(
 
   const evidenceRoutes = []
   const violations: CapabilityImportViolation[] = []
+  const truncations: CapabilityProvenanceTruncation[] = []
   for (const route of reflectRoutes(source)) {
     const modules = new Set(automatic.get(routeKey(route.method, route.path)) ?? [])
     for (const association of policy.provenance.routeModules ?? []) {
@@ -225,10 +260,11 @@ export async function collectCapabilityProjectReport(
       evidence: walked.evidence,
     })
     violations.push(...walked.violations)
+    truncations.push(...walked.truncations)
   }
   const evaluated = evaluateCapabilityAssurance(source, policy, { routes: evidenceRoutes })
   const report: CapabilityAssuranceReport =
-    violations.length === 0
+    violations.length === 0 && truncations.length === 0
       ? evaluated
       : Object.freeze({
           ...evaluated,
@@ -241,9 +277,19 @@ export async function collectCapabilityProjectReport(
               path: violation.path,
               message: `${violation.method} ${violation.path} reaches forbidden ${violation.specifier} via ${violation.chain.join(" → ")}: ${violation.reason}`,
             })),
+            ...truncations.map((truncation) => ({
+              code: "provenance-truncated" as const,
+              method: truncation.method,
+              path: truncation.path,
+              message: `${truncation.method} ${truncation.path} capability provenance hit the ${truncation.reason === "depth-limit" ? "import-depth" : "module-count"} safety limit via ${truncation.chain.join(" → ")}; assurance cannot prove the remaining graph`,
+            })),
           ]),
         })
-  return Object.freeze({ report, violations: Object.freeze(violations) })
+  return Object.freeze({
+    report,
+    violations: Object.freeze(violations),
+    truncations: Object.freeze(truncations),
+  })
 }
 
 export function parseCapabilityLockfile(content: string, sourcePath: string): CapabilitySnapshot {
@@ -261,7 +307,7 @@ export function parseCapabilityLockfile(content: string, sourcePath: string): Ca
     !Array.isArray(candidate.routes)
   ) {
     throw new Error(
-      `[nifra] ${sourcePath} is not a nifra capability lockfile — expected { "nifraCapabilities": 1, "routes": [...] }`,
+      `[nifra] ${sourcePath} is not a nifra capability lockfile - expected { "nifraCapabilities": 1, "routes": [...] }`,
     )
   }
   for (const route of candidate.routes) {
@@ -341,18 +387,28 @@ async function currentProject(
   readonly policy: CapabilityPolicy
   readonly project: CapabilityProjectReport
 }> {
-  const config = await loadAssuranceConfig(cwd, configPath)
-  if (config.capabilities === undefined) {
+  // Source the capability report from the one project verification that `check`/`assure`/`levels` also
+  // read, rather than loading the config and walking the module graph a second time here. `snapshot` and
+  // `check` are then thin faces over the shared core; the lockfile write/diff is the only work that stays
+  // capability-specific.
+  const { collectProjectVerification } = await import("./verification.ts")
+  const verification = await collectProjectVerification(
+    cwd,
+    configPath !== undefined ? { config: configPath } : {},
+  )
+  // A missing/broken config threw here before; re-throw the same error to keep that contract.
+  if (verification.configError !== undefined) throw verification.configError
+  const policy = verification.config?.capabilities
+  if (policy === undefined) {
     throw new Error("[nifra] assurance config does not define capabilities")
   }
-  return {
-    policy: config.capabilities,
-    project: await collectCapabilityProjectReport(cwd, config.source, config.capabilities),
-  }
+  // The core computes `capability` exactly when the config declares a capabilities policy, so it is
+  // present whenever `policy` is.
+  return { policy, project: verification.capability as CapabilityProjectReport }
 }
 
 function unsafeProject(project: CapabilityProjectReport): boolean {
-  return !project.report.ok || project.violations.length > 0
+  return !project.report.ok || project.violations.length > 0 || project.truncations.length > 0
 }
 
 /** Write a lockfile only from a clean, fully-covered project report. */
@@ -387,7 +443,13 @@ export async function runCapabilityCheck(
   if (options.json === true) {
     console.log(
       JSON.stringify(
-        { ok, report: project.report, violations: project.violations, changes },
+        {
+          ok,
+          report: project.report,
+          violations: project.violations,
+          truncations: project.truncations,
+          changes,
+        },
         null,
         2,
       ),
@@ -398,7 +460,11 @@ export async function runCapabilityCheck(
     for (const finding of project.report.findings) console.log(`✖ ${finding.message}`)
     for (const violation of project.violations)
       console.log(
-        `✖ ${violation.method} ${violation.path}: ${violation.chain.join(" → ")} — ${violation.reason}`,
+        `✖ ${violation.method} ${violation.path}: ${violation.chain.join(" → ")} - ${violation.reason}`,
+      )
+    for (const truncation of project.truncations)
+      console.log(
+        `✖ ${truncation.method} ${truncation.path}: ${truncation.chain.join(" → ")} - ${truncation.reason}`,
       )
     for (const change of changes) console.log(`✖ capability lock drift: ${change}`)
   }