@promptci/core 0.2.1 → 0.2.2

package/dist/repo-tree.d.ts

@@ -0,0 +1,127 @@
+/**
+ * A containment-safe view of the scanned repository, for detectors that check
+ * whether a path an instruction file names exists (pcic-xhzb, pcic-x1vl).
+ *
+ * Instruction files are untrusted input. In the hosted product the scan root
+ * is a server temp directory, so an existence check on a path the text names
+ * (`../../etc/x`, `/etc/x`, `C:\x`, or a committed link out of the tree) would
+ * tell whoever wrote the scanned repository whether a server path exists.
+ * Every such check goes through {@link RepoTree}, which never touches a path
+ * outside the root.
+ */
+import * as fs from 'node:fs';
+import type fg from 'fast-glob';
+import type { IssueCategory, PromptCiIssue } from './types.js';
+/**
+ * True for a path that is absolute on ANY platform: POSIX (`/x`), Windows drive
+ * or UNC (`C:\x`, `\\host\share`), or drive-relative (`C:x`, which Windows
+ * resolves against that drive's working directory and Linux reads as a file
+ * name). Detectors skip these before any lookup, so a Windows and a Linux scan
+ * agree, the verdict never depends on where the repository is checked out, and
+ * a Windows scan never opens an SMB connection for `\\host\…`.
+ */
+export declare function isAbsoluteAnywhere(p: string): boolean;
+/** What the repository holds at a path. */
+export type Lookup = {
+    state: 'found';
+    path: string;
+    isDir: boolean;
+} | {
+    state: 'missing';
+}
+/** The path, or a link on the way to it, leads outside the scan root. */
+ | {
+    state: 'outside';
+}
+/** A directory on the way could not be listed: neither present nor absent. */
+ | {
+    state: 'unreadable';
+};
+/** The `code` of a filesystem error (`EACCES`, `ENOENT`, …), when it has one. */
+export declare function errorCode(err: unknown): string | undefined;
+/**
+ * pcic-xhzb: the only way a detector asks the filesystem about a path an
+ * instruction file names (dead references; command validity since pcic-x1vl).
+ *
+ * - Contained. A path is looked up by listing the directories from the scan
+ *   root down to it, so nothing outside the root is ever listed, stat'ed or
+ *   opened. A committed link is read (`readlink`, a property of the link,
+ *   which lives in the tree) and followed only while its target stays inside
+ *   the root; a link out of the tree makes the lookup `outside` without
+ *   touching what it points at. A hosted scan runs against a server temp
+ *   directory, and an existence check outside it would tell whoever wrote the
+ *   scanned repository whether a server path exists.
+ * - Exact case. A segment matches a directory entry of exactly that name, so
+ *   `Deploy_PR.yml` does not resolve to `deploy_pr.yml` on a case-insensitive
+ *   filesystem (Windows, macOS). The result is the same on every platform, and
+ *   the same as on Linux and GitHub, where the reference is broken.
+ * - Honest about failure. A directory that cannot be listed makes the lookup
+ *   `unreadable`, never `missing`, and is recorded so the scan can say so.
+ *
+ * Listings are cached for the scan, so each directory is read at most once.
+ */
+export declare class RepoTree {
+    readonly root: string;
+    /** The root's real path, when it differs (a root under a symlink, like macOS `/var`). */
+    private readonly realRoot;
+    private readonly listings;
+    /** What could not be read, as shown in the report (`dir/` or a link's path) → why. */
+    readonly unreadable: Map<string, string>;
+    constructor(repoRoot: string);
+    /** Forward-slash path relative to the root (`.` for the root itself); never absolute. */
+    relative(abs: string): string;
+    /** Record what could not be read: a directory (shown as `dir/`) or a link (shown as its path). */
+    noteUnreadable(p: string, reason: string, kind?: 'dir' | 'link'): void;
+    /** The entries of an in-root directory, by exact name. */
+    private list;
+    /** In-root equivalent of a link target written against the root's real path. */
+    private fromRealRoot;
+    lookup(candidate: string): Lookup;
+    isDir(candidate: string): boolean;
+    /**
+     * An extension-less module path names the file that carries the extension:
+     * `src/lib/db` is `src/lib/db.ts`. True when the directory holds `<name>.*`.
+     */
+    hasStemSibling(candidate: string): boolean;
+    /**
+     * pcic-x1vl: the entries of the in-root directory at `candidate`, by exact
+     * name, or why there are none to give (a file counts as `missing`).
+     */
+    entries(candidate: string): ReadonlyMap<string, fs.Dirent> | 'missing' | 'outside' | 'unreadable';
+    /**
+     * fast-glob's directory reads, routed through node:fs here so a directory the
+     * walk cannot list is recorded instead of silently dropping out of the result.
+     * The walk itself (`cwd` = root, links not followed) never leaves the root.
+     */
+    walkFs(onError: () => void): Partial<fg.FileSystemAdapter>;
+}
+/** A reference left unchecked because part of the tree could not be read, aggregated per evidence line. */
+export type UncheckedRef = {
+    filePaths: Set<string>;
+    fileLines: Map<string, number>;
+    evidence: string;
+};
+/**
+ * pcic-xhzb: a directory the scan could not list is named, never turned into
+ * findings. Without this, an unreadable directory emptied the name index (or
+ * part of it) and every bare name filed there was reported as broken, with no
+ * sign the scan had failed. The gap is a `warning`, the severity of the
+ * findings it stands in for, so a `--fail-on warning` gate that a broken
+ * reference would have tripped is not passed silently by a scan that could
+ * not look (the supply-chain scan's `unscanned-files` likewise warns about
+ * content it could not read). Paths are repo-relative, so a hosted scan never
+ * shows its temp dir. Shared by the detectors that use {@link RepoTree}
+ * (pcic-x1vl), each with its own wording.
+ */
+export declare function incompleteCheckIssue(tree: RepoTree, refs: UncheckedRef[], text: {
+    id: string;
+    category: IssueCategory;
+    title: string;
+    /** What was left unchecked, singular (`reference`, `command`). */
+    unit: string;
+    /** Sentence saying the outcome is unknown, without the final period. */
+    unknown: string;
+    /** The finding kind that was not reported (`broken-reference`). */
+    finding: string;
+}): PromptCiIssue;
+//# sourceMappingURL=repo-tree.d.ts.map

package/dist/repo-tree.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-tree.d.ts","sourceRoot":"","sources":["../src/repo-tree.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,OAAO,KAAK,EAAE,MAAM,WAAW,CAAC;AAChC,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAG/D;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAErD;AAED,2CAA2C;AAC3C,MAAM,MAAM,MAAM,GACd;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAChD;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE;AACtB,yEAAyE;GACvE;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE;AACtB,8EAA8E;GAC5E;IAAE,KAAK,EAAE,YAAY,CAAA;CAAE,CAAC;AAI5B,iFAAiF;AACjF,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAG1D;AAKD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,QAAQ;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,yFAAyF;IACzF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAC9C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA8B;IACvD,sFAAsF;IACtF,QAAQ,CAAC,UAAU,sBAA6B;gBAEpC,QAAQ,EAAE,MAAM;IAM5B,yFAAyF;IACzF,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAI7B,kGAAkG;IAClG,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,KAAK,GAAG,MAAc,GAAG,IAAI;IAS7E,0DAA0D;IAC1D,OAAO,CAAC,IAAI;IAmBZ,gFAAgF;IAChF,OAAO,CAAC,YAAY;IAKpB,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IA6CjC,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAKjC;;;OAGG;IACH,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAU1C;;;OAGG;IACH,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,SAAS,GAAG,SAAS,GAAG,YAAY;IAOjG;;;;OAIG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,CAAC,iBAAiB,CAAC;CAgB3D;AAED,2GAA2G;AAC3G,MAAM,MAAM,YAAY,GAAG;IAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAKxG;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,QAAQ,EACd,IAAI,EAAE,YAAY,EAAE,EACpB,IAAI,EAAE;IACJ,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,aAAa,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;CACjB,GACA,aAAa,CAmCf"}

package/dist/repo-tree.js

@@ -0,0 +1,263 @@
+/**
+ * A containment-safe view of the scanned repository, for detectors that check
+ * whether a path an instruction file names exists (pcic-xhzb, pcic-x1vl).
+ *
+ * Instruction files are untrusted input. In the hosted product the scan root
+ * is a server temp directory, so an existence check on a path the text names
+ * (`../../etc/x`, `/etc/x`, `C:\x`, or a committed link out of the tree) would
+ * tell whoever wrote the scanned repository whether a server path exists.
+ * Every such check goes through {@link RepoTree}, which never touches a path
+ * outside the root.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { isWithinRoot, realPath } from './path-containment.js';
+/**
+ * True for a path that is absolute on ANY platform: POSIX (`/x`), Windows drive
+ * or UNC (`C:\x`, `\\host\share`), or drive-relative (`C:x`, which Windows
+ * resolves against that drive's working directory and Linux reads as a file
+ * name). Detectors skip these before any lookup, so a Windows and a Linux scan
+ * agree, the verdict never depends on where the repository is checked out, and
+ * a Windows scan never opens an SMB connection for `\\host\…`.
+ */
+export function isAbsoluteAnywhere(p) {
+    return path.posix.isAbsolute(p) || path.win32.isAbsolute(p) || /^[A-Za-z]:/.test(p);
+}
+/** The `code` of a filesystem error (`EACCES`, `ENOENT`, …), when it has one. */
+export function errorCode(err) {
+    const code = err?.code;
+    return typeof code === 'string' ? code : undefined;
+}
+/** Links followed for one lookup before it gives up (a cycle, or a chain no real tree has). */
+const MAX_LINK_HOPS = 40;
+/**
+ * pcic-xhzb: the only way a detector asks the filesystem about a path an
+ * instruction file names (dead references; command validity since pcic-x1vl).
+ *
+ * - Contained. A path is looked up by listing the directories from the scan
+ *   root down to it, so nothing outside the root is ever listed, stat'ed or
+ *   opened. A committed link is read (`readlink`, a property of the link,
+ *   which lives in the tree) and followed only while its target stays inside
+ *   the root; a link out of the tree makes the lookup `outside` without
+ *   touching what it points at. A hosted scan runs against a server temp
+ *   directory, and an existence check outside it would tell whoever wrote the
+ *   scanned repository whether a server path exists.
+ * - Exact case. A segment matches a directory entry of exactly that name, so
+ *   `Deploy_PR.yml` does not resolve to `deploy_pr.yml` on a case-insensitive
+ *   filesystem (Windows, macOS). The result is the same on every platform, and
+ *   the same as on Linux and GitHub, where the reference is broken.
+ * - Honest about failure. A directory that cannot be listed makes the lookup
+ *   `unreadable`, never `missing`, and is recorded so the scan can say so.
+ *
+ * Listings are cached for the scan, so each directory is read at most once.
+ */
+export class RepoTree {
+    root;
+    /** The root's real path, when it differs (a root under a symlink, like macOS `/var`). */
+    realRoot;
+    listings = new Map();
+    /** What could not be read, as shown in the report (`dir/` or a link's path) → why. */
+    unreadable = new Map();
+    constructor(repoRoot) {
+        this.root = path.resolve(repoRoot);
+        const real = realPath(this.root);
+        this.realRoot = real !== null && real !== this.root ? real : undefined;
+    }
+    /** Forward-slash path relative to the root (`.` for the root itself); never absolute. */
+    relative(abs) {
+        return path.relative(this.root, abs).split(path.sep).join('/') || '.';
+    }
+    /** Record what could not be read: a directory (shown as `dir/`) or a link (shown as its path). */
+    noteUnreadable(p, reason, kind = 'dir') {
+        const abs = path.resolve(this.root, p);
+        // Only in-root names are ever recorded: the report must not carry a server path.
+        if (!isWithinRoot(this.root, abs))
+            return;
+        const rel = this.relative(abs);
+        const shown = kind === 'link' ? rel : rel === '.' ? './' : `${rel}/`;
+        if (!this.unreadable.has(shown))
+            this.unreadable.set(shown, reason);
+    }
+    /** The entries of an in-root directory, by exact name. */
+    list(dir) {
+        let listing = this.listings.get(dir);
+        if (listing === undefined) {
+            try {
+                listing = new Map(fs.readdirSync(dir, { withFileTypes: true }).map((d) => [d.name, d]));
+            }
+            catch (err) {
+                const code = errorCode(err);
+                if (code === 'ENOENT' || code === 'ENOTDIR') {
+                    listing = 'missing';
+                }
+                else {
+                    listing = 'unreadable';
+                    this.noteUnreadable(dir, code ?? 'error');
+                }
+            }
+            this.listings.set(dir, listing);
+        }
+        return listing;
+    }
+    /** In-root equivalent of a link target written against the root's real path. */
+    fromRealRoot(p) {
+        if (this.realRoot === undefined || isWithinRoot(this.root, p) || !isWithinRoot(this.realRoot, p))
+            return p;
+        return path.join(this.root, path.relative(this.realRoot, p));
+    }
+    lookup(candidate) {
+        let target = path.resolve(this.root, candidate);
+        let lastLink = '';
+        for (let hop = 0; hop <= MAX_LINK_HOPS; hop++) {
+            // Lexical containment first: `..`, absolute, other-drive and UNC paths stop here.
+            if (!isWithinRoot(this.root, target))
+                return { state: 'outside' };
+            const parts = path.relative(this.root, target).split(path.sep).filter(Boolean);
+            let dir = this.root;
+            let isDir = true;
+            let next;
+            for (let i = 0; i < parts.length; i++) {
+                if (!isDir)
+                    return { state: 'missing' }; // a file in the middle of a path
+                const listing = this.list(dir);
+                if (listing === 'missing')
+                    return { state: 'missing' };
+                if (listing === 'unreadable')
+                    return { state: 'unreadable' };
+                const name = parts[i];
+                const entry = listing.get(name);
+                if (!entry)
+                    return { state: 'missing' };
+                const entryPath = path.join(dir, name);
+                if (entry.isSymbolicLink()) {
+                    let link;
+                    try {
+                        link = fs.readlinkSync(entryPath);
+                    }
+                    catch (err) {
+                        this.noteUnreadable(entryPath, errorCode(err) ?? 'unreadable link', 'link');
+                        return { state: 'unreadable' };
+                    }
+                    lastLink = entryPath;
+                    // Resolved lexically against the link's own directory, then re-walked
+                    // from the root: the containment check above runs before anything
+                    // under the target is touched.
+                    next = path.join(this.fromRealRoot(path.resolve(dir, link)), ...parts.slice(i + 1));
+                    break;
+                }
+                isDir = entry.isDirectory();
+                dir = entryPath;
+            }
+            if (next === undefined)
+                return { state: 'found', path: dir, isDir };
+            target = next;
+        }
+        // More links than the kernel itself follows (Linux MAXSYMLINKS): a cycle.
+        this.noteUnreadable(lastLink, 'symlink loop', 'link');
+        return { state: 'unreadable' };
+    }
+    isDir(candidate) {
+        const found = this.lookup(candidate);
+        return found.state === 'found' && found.isDir;
+    }
+    /**
+     * An extension-less module path names the file that carries the extension:
+     * `src/lib/db` is `src/lib/db.ts`. True when the directory holds `<name>.*`.
+     */
+    hasStemSibling(candidate) {
+        const dir = this.lookup(path.dirname(candidate));
+        if (dir.state !== 'found' || !dir.isDir)
+            return false;
+        const listing = this.list(dir.path);
+        if (typeof listing === 'string')
+            return false;
+        const prefix = `${path.basename(candidate)}.`;
+        for (const name of listing.keys())
+            if (name.startsWith(prefix))
+                return true;
+        return false;
+    }
+    /**
+     * pcic-x1vl: the entries of the in-root directory at `candidate`, by exact
+     * name, or why there are none to give (a file counts as `missing`).
+     */
+    entries(candidate) {
+        const dir = this.lookup(candidate);
+        if (dir.state !== 'found')
+            return dir.state;
+        if (!dir.isDir)
+            return 'missing';
+        return this.list(dir.path);
+    }
+    /**
+     * fast-glob's directory reads, routed through node:fs here so a directory the
+     * walk cannot list is recorded instead of silently dropping out of the result.
+     * The walk itself (`cwd` = root, links not followed) never leaves the root.
+     */
+    walkFs(onError) {
+        const readdirSync = (dir, options) => {
+            try {
+                return options ? fs.readdirSync(dir, options) : fs.readdirSync(dir);
+            }
+            catch (err) {
+                const code = errorCode(err);
+                // A directory deleted mid-walk has nothing left to miss.
+                if (code !== 'ENOENT') {
+                    this.noteUnreadable(dir, code ?? 'error');
+                    onError();
+                }
+                throw err;
+            }
+        };
+        return { readdirSync: readdirSync };
+    }
+}
+/** Evidence lines listed per kind before the rest is summarised. */
+const MAX_INCOMPLETE_EVIDENCE = 10;
+/**
+ * pcic-xhzb: a directory the scan could not list is named, never turned into
+ * findings. Without this, an unreadable directory emptied the name index (or
+ * part of it) and every bare name filed there was reported as broken, with no
+ * sign the scan had failed. The gap is a `warning`, the severity of the
+ * findings it stands in for, so a `--fail-on warning` gate that a broken
+ * reference would have tripped is not passed silently by a scan that could
+ * not look (the supply-chain scan's `unscanned-files` likewise warns about
+ * content it could not read). Paths are repo-relative, so a hosted scan never
+ * shows its temp dir. Shared by the detectors that use {@link RepoTree}
+ * (pcic-x1vl), each with its own wording.
+ */
+export function incompleteCheckIssue(tree, refs, text) {
+    const capped = (lines, noun) => lines.length > MAX_INCOMPLETE_EVIDENCE
+        ? [...lines.slice(0, MAX_INCOMPLETE_EVIDENCE), `…and ${lines.length - MAX_INCOMPLETE_EVIDENCE} more ${noun}`]
+        : lines;
+    const dirs = [...tree.unreadable].sort(([a], [b]) => a.localeCompare(b));
+    const dirLines = dirs.map(([shown, reason]) => `Could not read: ${shown} (${reason})`);
+    const filePaths = [...new Set(refs.flatMap((r) => [...r.filePaths]))];
+    const firstLine = new Map();
+    for (const r of refs) {
+        for (const [fp, line] of r.fileLines) {
+            const seen = firstLine.get(fp);
+            if (seen === undefined || line < seen)
+                firstLine.set(fp, line);
+        }
+    }
+    return {
+        id: text.id,
+        severity: 'warning',
+        category: text.category,
+        title: text.title,
+        summary: `${refs.length} ${text.unit}(s) were not checked because part of the repository could not be read ` +
+            `(${dirs.length} location${dirs.length === 1 ? '' : 's'}). ${text.unknown}; ` +
+            `no ${text.finding} finding was reported for them.`,
+        filePaths,
+        locations: filePaths.map((fp) => {
+            const startLine = firstLine.get(fp);
+            return startLine !== undefined ? { filePath: fp, startLine } : { filePath: fp };
+        }),
+        evidence: [...capped(dirLines, 'locations'), ...capped(refs.map((r) => r.evidence), `${text.unit}s`)],
+        recommendation: 'Make the listed locations readable by the user running the scan (or fix the symlink), then scan again to ' +
+            `check these ${text.unit}s.`,
+        confidence: 0.8,
+    };
+}
+//# sourceMappingURL=repo-tree.js.map

package/dist/repo-tree.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-tree.js","sourceRoot":"","sources":["../src/repo-tree.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAE/D;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,CAAS;IAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACtF,CAAC;AAaD,iFAAiF;AACjF,MAAM,UAAU,SAAS,CAAC,GAAY;IACpC,MAAM,IAAI,GAAI,GAAiC,EAAE,IAAI,CAAC;IACtD,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED,+FAA+F;AAC/F,MAAM,aAAa,GAAG,EAAE,CAAC;AAEzB;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,QAAQ;IACV,IAAI,CAAS;IACtB,yFAAyF;IACxE,QAAQ,CAAqB;IAC7B,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;IACvD,sFAAsF;IAC7E,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEhD,YAAY,QAAgB;QAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,QAAQ,GAAG,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,CAAC;IAED,yFAAyF;IACzF,QAAQ,CAAC,GAAW;QAClB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;IACxE,CAAC;IAED,kGAAkG;IAClG,cAAc,CAAC,CAAS,EAAE,MAAc,EAAE,OAAuB,KAAK;QACpE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACvC,iFAAiF;QACjF,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC;YAAE,OAAO;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC;QACrE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACtE,CAAC;IAED,0DAA0D;IAClD,IAAI,CAAC,GAAW;QACtB,IAAI,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1F,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;gBAC5B,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBAC5C,OAAO,GAAG,SAAS,CAAC;gBACtB,CAAC;qBAAM,CAAC;oBACN,OAAO,GAAG,YAAY,CAAC;oBACvB,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,IAAI,OAAO,CAAC,CAAC;gBAC5C,CAAC;YACH,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,gFAAgF;IACxE,YAAY,CAAC,CAAS;QAC5B,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;QAC3G,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,CAAC,SAAiB;QACtB,IAAI,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAChD,IAAI,QAAQ,GAAG,EAAE,CAAC;QAClB,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC;YAC9C,kFAAkF;YAClF,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;gBAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YAClE,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC/E,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC;YACpB,IAAI,KAAK,GAAG,IAAI,CAAC;YACjB,IAAI,IAAwB,CAAC;YAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,IAAI,CAAC,KAAK;oBAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,iCAAiC;gBAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC/B,IAAI,OAAO,KAAK,SAAS;oBAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;gBACvD,IAAI,OAAO,KAAK,YAAY;oBAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;gBAC7D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAChC,IAAI,CAAC,KAAK;oBAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;gBACxC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACvC,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;oBAC3B,IAAI,IAAY,CAAC;oBACjB,IAAI,CAAC;wBACH,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;oBACpC,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,iBAAiB,EAAE,MAAM,CAAC,CAAC;wBAC5E,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;oBACjC,CAAC;oBACD,QAAQ,GAAG,SAAS,CAAC;oBACrB,sEAAsE;oBACtE,kEAAkE;oBAClE,+BAA+B;oBAC/B,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBACpF,MAAM;gBACR,CAAC;gBACD,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;gBAC5B,GAAG,GAAG,SAAS,CAAC;YAClB,CAAC;YACD,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;YACpE,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;QACD,0EAA0E;QAC1E,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;QACtD,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,SAAiB;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACrC,OAAO,KAAK,CAAC,KAAK,KAAK,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC;IAChD,CAAC;IAED;;;OAGG;IACH,cAAc,CAAC,SAAiB;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QACjD,IAAI,GAAG,CAAC,KAAK,KAAK,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACtD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC9C,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC;QAC9C,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE;YAAE,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,SAAiB;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACnC,IAAI,GAAG,CAAC,KAAK,KAAK,OAAO;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC;QAC5C,IAAI,CAAC,GAAG,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QACjC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,OAAmB;QACxB,MAAM,WAAW,GAAG,CAAC,GAAW,EAAE,OAAiC,EAAW,EAAE;YAC9E,IAAI,CAAC;gBACH,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACtE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;gBAC5B,yDAAyD;gBACzD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACtB,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,IAAI,OAAO,CAAC,CAAC;oBAC1C,OAAO,EAAE,CAAC;gBACZ,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC,CAAC;QACF,OAAO,EAAE,WAAW,EAAE,WAAkD,EAAE,CAAC;IAC7E,CAAC;CACF;AAKD,oEAAoE;AACpE,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAEnC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAc,EACd,IAAoB,EACpB,IAUC;IAED,MAAM,MAAM,GAAG,CAAC,KAAe,EAAE,IAAY,EAAY,EAAE,CACzD,KAAK,CAAC,MAAM,GAAG,uBAAuB;QACpC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC,EAAE,QAAQ,KAAK,CAAC,MAAM,GAAG,uBAAuB,SAAS,IAAI,EAAE,CAAC;QAC7G,CAAC,CAAC,KAAK,CAAC;IACZ,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,mBAAmB,KAAK,KAAK,MAAM,GAAG,CAAC,CAAC;IACvF,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,GAAG,IAAI;gBAAE,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,OAAO,EACL,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,wEAAwE;YACnG,IAAI,IAAI,CAAC,MAAM,YAAY,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,IAAI;YAC7E,MAAM,IAAI,CAAC,OAAO,iCAAiC;QACrD,SAAS;QACT,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;YAC9B,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACpC,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAClF,CAAC,CAAC;QACF,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;QACrG,cAAc,EACZ,2GAA2G;YAC3G,eAAe,IAAI,CAAC,IAAI,IAAI;QAC9B,UAAU,EAAE,GAAG;KAChB,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@promptci/core",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Deterministic scanner for AI coding instruction files (CLAUDE.md, AGENTS.md, .cursorrules) — detectors, scoring, and report generation",
   "license": "Apache-2.0",
   "type": "module",