@okfit/profiles 0.4.0 → 0.5.0

package/Derivation.js

@@ -50,10 +50,23 @@ const localPartOf = (email) => {
 	const local = at === -1 ? email : email.slice(0, at);
 	return local.length > 0 && !/\s/.test(local) ? local : void 0;
 };
+/**
+* `value` without leading and trailing `-`. An index walk rather than
+* `/^-+|-+$/`: the `-+$` alternative backtracks from every position of a
+* long dash run (CodeQL js/polynomial-redos, okfit alert #1), and the input
+* here is a git author name nobody vetted.
+*/
+const trimDashes = (value) => {
+	let start = 0;
+	let end = value.length;
+	while (start < end && value.charCodeAt(start) === 45) start++;
+	while (end > start && value.charCodeAt(end - 1) === 45) end--;
+	return value.slice(start, end);
+};
 /** P-13 step 3: lower-case, runs outside `[a-z0-9._-]` to `-`, leading and trailing `-` trimmed. */
 const slugOf = (name) => {
 	if (name === void 0) return void 0;
-	const slug = name.toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "");
+	const slug = trimDashes(name.toLowerCase().replace(/[^a-z0-9._-]+/g, "-"));
 	return slug.length > 0 ? slug : void 0;
 };
 const humanActorId = (identity, humans) => {

package/README.md

@@ -116,6 +116,29 @@ guidance = "Describe what a reader sees, what they will wrongly conclude, and wh
 description = "A path relative to this concept file to the code, script, or config that produces the misleading signal."
 kind = "path"
 
+[types.Consumer]
+description = "An external application that consumes this repository and thereby scopes it."
+guidance = "Name the surfaces it exercises, where the edge between the two repositories sits, and the open questions it raises, so the boundary of this repository is read from its consumers rather than inferred. Deprecate it when the consumer stops consuming."
+required = ["repository"]
+
+[types.Consumer.fields.repository]
+description = "Where the consumer lives, as a URL or an owner/name pair, since it is outside this repository."
+
+[types.Roadmap]
+description = "A gate and the forward-looking work behind it, held as intent rather than as a Decision."
+guidance = "List the phases and what remains in each, and give it a staleness window so queued work is re-examined instead of read as settled. Deprecate it when the gate holds and write the Decisions the work produced."
+
+[types.Roadmap.fields.gate]
+description = "The observable condition that closes this roadmap, for example a release shipped or a benchmark met."
+
+[types.Measurement]
+description = "A dated empirical result: what was measured, how, and what the numbers ruled in or out."
+guidance = "Record the inputs, the method, and the numbers so a reader can judge whether they still hold, and give it a staleness window because numbers rot. A Decision links to the Measurement that justified it instead of embedding the result in its body."
+
+[types.Measurement.fields.justifies]
+description = "Paths to the Decisions this measurement supports, one entry per Decision."
+kind = "path"
+
 [tags.architecture]
 description = "Concerns the shape of the system rather than one module."
 
@@ -139,6 +162,15 @@ description = "Concerns the unattended path: what runs without a human present,
 
 [tags.compat]
 description = "Concerns compatibility across versions of the runtime, the package manager, or a dependency."
+
+[tags.bundle]
+description = "Concerns install weight and reachability: tree-shaking, subpath entrypoints, and dependency edges declined for their cost."
+
+[tags.observability]
+description = "Concerns how the system reports on itself: events, metrics, logs, sinks, and artifacts."
+
+[tags.deps]
+description = "Concerns how third-party dependencies are declared, pinned, and distributed."
 ```
 
 Only `concepts`, `types`, and `tags` carry real vocabulary; the literal's `extensions: {}` is `OkfitConfig`'s one required key and never appears on disk, since the codec folds unknown top-level keys into it (P-24: `fields.<k>.kind = "path"` and the `tags` table are vocabulary only — core enforces none of it yet). `Reference.required = ["sources"]` checks presence only: `sources = []` passes, and each entry's shape is core's `family-invalid` (P-23).
@@ -166,6 +198,9 @@ directories:
   limitations/   -> Limitation
   models/        -> DataModel
   gotchas/       -> Gotcha
+  consumers/     -> Consumer
+  roadmaps/      -> Roadmap
+  measurements/  -> Measurement
 ```
 
 Each directory carries its own `index.md`. What `okfit init` writes into these files is the CLI plan's concern, not this package's.

package/SoftwareProject.js

@@ -124,6 +124,25 @@ const config = {
 				description: "A path relative to this concept file to the code, script, or config that produces the misleading signal.",
 				kind: "path"
 			} }
+		},
+		Consumer: {
+			description: "An external application that consumes this repository and thereby scopes it.",
+			guidance: "Name the surfaces it exercises, where the edge between the two repositories sits, and the open questions it raises, so the boundary of this repository is read from its consumers rather than inferred. Deprecate it when the consumer stops consuming.",
+			required: ["repository"],
+			fields: { repository: { description: "Where the consumer lives, as a URL or an owner/name pair, since it is outside this repository." } }
+		},
+		Roadmap: {
+			description: "A gate and the forward-looking work behind it, held as intent rather than as a Decision.",
+			guidance: "List the phases and what remains in each, and give it a staleness window so queued work is re-examined instead of read as settled. Deprecate it when the gate holds and write the Decisions the work produced.",
+			fields: { gate: { description: "The observable condition that closes this roadmap, for example a release shipped or a benchmark met." } }
+		},
+		Measurement: {
+			description: "A dated empirical result: what was measured, how, and what the numbers ruled in or out.",
+			guidance: "Record the inputs, the method, and the numbers so a reader can judge whether they still hold, and give it a staleness window because numbers rot. A Decision links to the Measurement that justified it instead of embedding the result in its body.",
+			fields: { justifies: {
+				description: "Paths to the Decisions this measurement supports, one entry per Decision.",
+				kind: "path"
+			} }
 		}
 	},
 	tags: {
@@ -134,7 +153,10 @@ const config = {
 		performance: { description: "Concerns speed, memory, or resource cost and the trade-offs made for them." },
 		dx: { description: "Concerns the experience of the people and agents who author, build, and debug the code." },
 		ci: { description: "Concerns the unattended path: what runs without a human present, and how it fails." },
-		compat: { description: "Concerns compatibility across versions of the runtime, the package manager, or a dependency." }
+		compat: { description: "Concerns compatibility across versions of the runtime, the package manager, or a dependency." },
+		bundle: { description: "Concerns install weight and reachability: tree-shaking, subpath entrypoints, and dependency edges declined for their cost." },
+		observability: { description: "Concerns how the system reports on itself: events, metrics, logs, sinks, and artifacts." },
+		deps: { description: "Concerns how third-party dependencies are declared, pinned, and distributed." }
 	},
 	extensions: {}
 };
@@ -185,6 +207,18 @@ const layout = {
 		{
 			directory: "gotchas",
 			type: "Gotcha"
+		},
+		{
+			directory: "consumers",
+			type: "Consumer"
+		},
+		{
+			directory: "roadmaps",
+			type: "Roadmap"
+		},
+		{
+			directory: "measurements",
+			type: "Measurement"
 		}
 	]
 };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@okfit/profiles",
-	"version": "0.4.0",
+	"version": "0.5.0",
 	"private": false,
 	"description": "Named OKF configuration profiles for okfit, starting with the software-project profile.",
 	"keywords": [
@@ -37,7 +37,7 @@
 	"peerDependencies": {
 		"@effected/git": "^0.15.0",
 		"@effected/markdown": "^0.10.0",
-		"@okfit/core": "^0.4.0",
+		"@okfit/core": "^0.4.1",
 		"effect": "4.0.0-rc.115"
 	},
 	"engines": {