@rigour-labs/core 6.8.0 → 6.8.1-rc.1

package/dist/storage/fix-lessons.test.js

@@ -1,61 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest';
-/** An in-memory lessons table, enough for the reads and writes fix lessons make. */
-const db = vi.hoisted(() => ({ rows: new Map(), reset() { this.rows = new Map(); } }));
-vi.mock('./db.js', () => {
-    const store = {
-        run: async (sql, ...p) => {
-            if (sql.includes('INSERT INTO lessons'))
-                db.rows.set(p[0], { id: p[0], state: p[4], subject: p[5], evidence_json: p[6], confidence: p[7] });
-            if (sql.includes('UPDATE lessons')) {
-                const row = db.rows.get(p[4]);
-                if (!['promoted', 'rejected'].includes(row.state))
-                    row.state = p[0];
-                Object.assign(row, { evidence_json: p[1], confidence: Math.max(row.confidence, p[2]) });
-            }
-            return { changes: 1, lastID: 0 };
-        },
-        get: async (sql, ...p) => (sql.includes("kind = 'fix'") ? [...db.rows.values()].find(r => r.subject.slice(0, p[1]) === p[2]) : undefined),
-        all: async () => [],
-        exec: async () => undefined,
-        close: async () => undefined,
-    };
-    return { openDatabase: async () => store };
-});
-vi.mock('./local-encryption.js', () => ({ encryptLocalPayload: async (v) => JSON.stringify(v), decryptLocalPayload: async (v) => JSON.parse(v) }));
-vi.mock('./team-store.js', () => ({ loadTeamConfiguration: async () => null }));
-const { recordFixLessons, fixLessonSubject } = await import('./fix-lessons.js');
-const fix = (id, file) => ({
-    id, file, rule: 'semantic-bugs', title: 'Unbounded read without paging', details: 'Rows read without a limit.', before: 'a', after: 'b', resolvedAt: '2026-10-02T00:00:00Z',
-});
-const lessons = () => [...db.rows.values()];
-beforeEach(() => db.reset());
-describe('recordFixLessons', () => {
-    it('turns a fix into a candidate lesson named after the defect it removed', async () => {
-        await recordFixLessons(process.cwd(), [fix('f1', 'src/orders.ts')]);
-        expect(lessons().map(l => [l.subject, l.state])).toEqual([['Fixed before: Unbounded read without paging (semantic-bugs). Rows read without a limit.', 'candidate']]);
-    });
-    it('validates the lesson once fixes of that kind reach a second file, and counts the same fix once', async () => {
-        await recordFixLessons(process.cwd(), [fix('f1', 'src/orders.ts')]);
-        await recordFixLessons(process.cwd(), [fix('f1', 'src/orders.ts'), fix('f2', 'src/orders.ts')]);
-        expect(lessons()[0].state).toBe('candidate');
-        await recordFixLessons(process.cwd(), [fix('f3', 'src/invoices.ts')]);
-        expect(lessons()).toHaveLength(1);
-        expect(lessons()[0].state).toBe('validated');
-        expect(JSON.parse(lessons()[0].evidence_json).files).toEqual(['src/orders.ts', 'src/invoices.ts']);
-    });
-    it("never overrides a person's decision to promote or reject", async () => {
-        await recordFixLessons(process.cwd(), [fix('f1', 'src/orders.ts')]);
-        lessons()[0].state = 'rejected';
-        await recordFixLessons(process.cwd(), [fix('f2', 'src/invoices.ts')]);
-        expect(lessons()[0].state).toBe('rejected');
-    });
-    it('names a fix whose finding had no title after its rule', () => {
-        expect(fixLessonSubject({ rule: 'hallucinated-imports' })).toBe('Fixed before: hallucinated-imports (hallucinated-imports).');
-    });
-    it('groups fixes of one kind even when their details differ', async () => {
-        await recordFixLessons(process.cwd(), [fix('f1', 'src/orders.ts')]);
-        await recordFixLessons(process.cwd(), [{ ...fix('f2', 'src/invoices.ts'), details: 'Invoices read in full to count them.' }]);
-        expect(lessons()).toHaveLength(1);
-        expect(lessons()[0].state).toBe('validated');
-    });
-});

package/dist/storage/lessons.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/storage/lessons.test.js

@@ -1,81 +0,0 @@
-import fs from 'fs-extra';
-import os from 'os';
-import path from 'path';
-import { afterEach, describe, expect, it, vi } from 'vitest';
-import { openDatabase } from './db.js';
-import { decryptLocalPayload, encryptLocalPayload } from './local-encryption.js';
-import { getRepositoryId } from './lessons.js';
-import { queueLocalLessonsForTeam } from './team-import.js';
-const roots = [];
-afterEach(async () => {
-    vi.unstubAllEnvs();
-    await Promise.all(roots.splice(0).map((root) => fs.remove(root)));
-});
-describe('getRepositoryId', () => {
-    it('uses normalized origin identity instead of a basename', async () => {
-        const root = await fs.mkdtemp(path.join(os.tmpdir(), 'rigour-repo-id-'));
-        roots.push(root);
-        await fs.ensureDir(path.join(root, '.git'));
-        await fs.writeFile(path.join(root, '.git', 'config'), '[remote "origin"]\nurl = git@github.com:Rigour-Labs/Rigour.git\n');
-        const first = await getRepositoryId(root);
-        const second = await getRepositoryId(path.join(root, '..', path.basename(root)));
-        expect(first).toBe(second);
-        expect(first).toHaveLength(64);
-    });
-    it('uses the shared origin identity from a linked worktree', async () => {
-        const root = await fs.mkdtemp(path.join(os.tmpdir(), 'rigour-worktree-id-'));
-        roots.push(root);
-        const common = path.join(root, 'common');
-        const linkedGit = path.join(common, 'worktrees', 'feature');
-        const worktree = path.join(root, 'checkout');
-        await fs.ensureDir(linkedGit);
-        await fs.ensureDir(worktree);
-        await fs.writeFile(path.join(worktree, '.git'), `gitdir: ${linkedGit}\n`);
-        await fs.writeFile(path.join(linkedGit, 'commondir'), '../..\n');
-        await fs.writeFile(path.join(common, 'config'), '[remote "origin"]\nurl = https://github.com/rigour-labs/rigour.git\n');
-        const regular = path.join(root, 'regular');
-        await fs.ensureDir(path.join(regular, '.git'));
-        await fs.writeFile(path.join(regular, '.git', 'config'), '[remote "origin"]\nurl = git@github.com:Rigour-Labs/Rigour.git\n');
-        expect(await getRepositoryId(worktree)).toBe(await getRepositoryId(regular));
-        expect(await getRepositoryId(worktree)).toHaveLength(64);
-    });
-});
-describe('local lesson team import', () => {
-    it('dry-runs, assigns legacy ownership, and queues each lesson version once', async () => {
-        const root = await fs.mkdtemp(path.join(os.tmpdir(), 'rigour-team-import-'));
-        roots.push(root);
-        await fs.ensureDir(path.join(root, '.git'));
-        await fs.writeFile(path.join(root, '.git', 'config'), '[remote "origin"]\nurl = https://github.com/acme/service.git\n');
-        vi.stubEnv('RIGOUR_ORGANIZATION_ID', 'acme');
-        vi.stubEnv('RIGOUR_TEAM_ID', 'platform');
-        vi.stubEnv('RIGOUR_ACTOR_ID', 'alice');
-        vi.stubEnv('RIGOUR_TEAM_DATABASE_URL', 'postgresql://alice@127.0.0.1/rigour');
-        vi.stubEnv('RIGOUR_LOCAL_CACHE_KEY', Buffer.alloc(32, 7).toString('base64'));
-        const repositoryId = await getRepositoryId(root);
-        const databasePath = path.join(root, 'rigour.db');
-        const db = await openDatabase(databasePath);
-        expect(db).not.toBeNull();
-        const now = Date.now();
-        await db.run(`INSERT INTO lessons (
-                id, repository_id, actor_id, team_id, visibility, state, kind, subject,
-                evidence_json, confidence, source, created_at, updated_at
-            ) VALUES (?, ?, NULL, NULL, 'personal', 'candidate', 'interaction', ?, ?, 0.3, 'mcp', ?, ?)`, 'lesson-legacy', repositoryId, 'Prefer scoped retrieval.', await encryptLocalPayload({ requestId: 'legacy-request' }), now, now);
-        await db.close();
-        const preview = await queueLocalLessonsForTeam([root], { databasePath, dryRun: true });
-        expect(preview).toMatchObject({ matched: 1, eligible: 1, wouldQueue: 1, queued: 0 });
-        const queued = await queueLocalLessonsForTeam([root], { databasePath });
-        expect(queued).toMatchObject({ matched: 1, eligible: 1, wouldQueue: 1, queued: 1 });
-        const existingOutbox = await openDatabase(databasePath);
-        await existingOutbox.run('UPDATE sync_outbox SET id = ? WHERE entity_id = ?', 'outbox-created-by-normal-learning', 'lesson-legacy');
-        await existingOutbox.close();
-        const repeated = await queueLocalLessonsForTeam([root], { databasePath });
-        expect(repeated).toMatchObject({ matched: 1, eligible: 1, wouldQueue: 0, queued: 0, alreadyQueued: 1 });
-        const verified = await openDatabase(databasePath);
-        const lesson = await verified.get('SELECT actor_id, team_id, visibility, state FROM lessons WHERE id = ?', 'lesson-legacy');
-        expect(lesson).toMatchObject({ actor_id: 'alice', team_id: 'platform', visibility: 'personal', state: 'candidate' });
-        const outbox = await verified.get('SELECT payload_json FROM sync_outbox WHERE entity_id = ?', 'lesson-legacy');
-        const payload = await decryptLocalPayload(outbox.payload_json);
-        expect(payload).toMatchObject({ id: 'lesson-legacy', actorId: 'alice', teamId: 'platform', visibility: 'personal', state: 'candidate' });
-        await verified.close();
-    });
-});

package/dist/storage/local-encryption.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/storage/local-encryption.test.js

@@ -1,34 +0,0 @@
-import fs from 'fs-extra';
-import os from 'os';
-import path from 'path';
-import { afterEach, describe, expect, it } from 'vitest';
-import { loadOrCreateFileKey } from './local-encryption.js';
-const temporaryDirectories = [];
-afterEach(async () => {
-    await Promise.all(temporaryDirectories.splice(0).map(directory => fs.remove(directory)));
-});
-async function temporaryKeyPath() {
-    const directory = await fs.mkdtemp(path.join(os.tmpdir(), 'rigour-key-test-'));
-    temporaryDirectories.push(directory);
-    return path.join(directory, 'team-cache.key');
-}
-describe('local encryption key storage', () => {
-    it('returns one key when concurrent processes initialize the same path', async () => {
-        const keyPath = await temporaryKeyPath();
-        const keys = await Promise.all(Array.from({ length: 32 }, () => loadOrCreateFileKey(keyPath)));
-        expect(new Set(keys.map(key => key.toString('base64')))).toHaveLength(1);
-        expect(await fs.readFile(keyPath, 'utf8')).toBe(keys[0].toString('base64'));
-    });
-    it('rejects an invalid existing key without replacing it', async () => {
-        const keyPath = await temporaryKeyPath();
-        await fs.writeFile(keyPath, 'not-a-valid-key', 'utf8');
-        await expect(loadOrCreateFileKey(keyPath)).rejects.toThrow('must contain a base64-encoded 32-byte key');
-        expect(await fs.readFile(keyPath, 'utf8')).toBe('not-a-valid-key');
-    });
-    it('accepts an existing key without base64 padding for backward compatibility', async () => {
-        const keyPath = await temporaryKeyPath();
-        const encodedKey = Buffer.alloc(32, 7).toString('base64').replace(/=+$/, '');
-        await fs.writeFile(keyPath, encodedKey, 'utf8');
-        expect((await loadOrCreateFileKey(keyPath)).equals(Buffer.alloc(32, 7))).toBe(true);
-    });
-});

package/dist/storage/local-memory.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/storage/local-memory.test.js

@@ -1,55 +0,0 @@
-import fs from 'fs';
-import os from 'os';
-import path from 'path';
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-/** An in-memory stand-in for the local SQLite store: records writes, answers the two reads under test. */
-const db = vi.hoisted(() => ({
-    writes: [],
-    patterns: [],
-    findings: [],
-    reset() { this.writes = []; this.patterns = []; this.findings = []; },
-}));
-vi.mock('./db.js', () => {
-    const store = {
-        run: async (sql) => { db.writes.push(sql.trim().split(/\s+/).slice(0, 3).join(' ')); return { changes: 1, lastID: 0 }; },
-        get: async () => undefined,
-        all: async (sql) => (sql.includes('FROM patterns') ? db.patterns : sql.includes('FROM findings') ? db.findings : []),
-        exec: async () => undefined,
-        transaction: async (work) => work(store),
-        close: async () => undefined,
-    };
-    return { openDatabase: async () => store };
-});
-const { checkLocalPatterns, persistAndReinforce } = await import('./local-memory.js');
-let repo;
-beforeEach(() => {
-    db.reset();
-    repo = fs.mkdtempSync(path.join(os.tmpdir(), 'local-memory-'));
-    fs.mkdirSync(path.join(repo, 'src'));
-});
-afterEach(() => fs.rmSync(repo, { recursive: true, force: true }));
-const failure = (id, line) => ({ id, title: id, details: 'x', severity: 'medium', provenance: 'traditional', files: ['src/a.ts'], line });
-describe('persistAndReinforce', () => {
-    it('reinforces each category once per scan, however many findings it has', async () => {
-        await persistAndReinforce(repo, { status: 'FAIL', failures: [failure('content-check', 1), failure('content-check', 2), failure('content-check', 3), failure('ast', 4)], stats: {} });
-        expect(db.writes.filter(w => w.startsWith('INSERT INTO patterns'))).toHaveLength(2);
-    });
-});
-describe('checkLocalPatterns', () => {
-    const remembered = (scanTime) => ({ file: 'src/a.ts', line: 3, category: 'security', description: 'token logged', confidence: 0.9, scan_time: scanTime });
-    it('replays a remembered finding while its file is unchanged since that scan, once', async () => {
-        fs.writeFileSync(path.join(repo, 'src/a.ts'), 'log(token)\n');
-        const after = fs.statSync(path.join(repo, 'src/a.ts')).mtimeMs + 1000;
-        db.patterns = [{ pattern: 'security', strength: 0.9 }];
-        db.findings = [remembered(after), remembered(after)];
-        const findings = await checkLocalPatterns(repo, ['src/a.ts']);
-        expect(findings.map(f => f.description)).toEqual(['[Local Memory] token logged']);
-    });
-    it('never replays a finding for a file edited since, which may be the fix', async () => {
-        fs.writeFileSync(path.join(repo, 'src/a.ts'), 'log(redact(token))\n');
-        const before = fs.statSync(path.join(repo, 'src/a.ts')).mtimeMs - 1000;
-        db.patterns = [{ pattern: 'security', strength: 0.9 }];
-        db.findings = [remembered(before)];
-        expect(await checkLocalPatterns(repo, ['src/a.ts'])).toEqual([]);
-    });
-});

package/dist/storage/share-memory.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/storage/share-memory.test.js

@@ -1,34 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest';
-const db = vi.hoisted(() => ({ rows: [], outbox: 0, reset() { this.rows = []; this.outbox = 0; } }));
-vi.mock('./db.js', () => {
-    const store = {
-        run: async (sql, ...params) => {
-            if (sql.includes('INSERT INTO lessons'))
-                db.rows.push({ id: params[0], visibility: 'team', state: 'candidate', kind: 'memory', subject: params[4] });
-            if (sql.includes('INSERT INTO sync_outbox'))
-                db.outbox++;
-            return { changes: 1, lastID: 0 };
-        },
-        get: async (sql, ...params) => (sql.includes("kind = 'memory'") ? db.rows.find(r => r.subject === params[1]) : undefined),
-        all: async () => [],
-        exec: async () => undefined,
-        close: async () => undefined,
-    };
-    return { openDatabase: async () => store };
-});
-vi.mock('./local-encryption.js', () => ({ encryptLocalPayload: async (v) => JSON.stringify(v), decryptLocalPayload: async (v) => JSON.parse(v) }));
-vi.mock('./team-store.js', () => ({ loadTeamConfiguration: async () => null }));
-const { shareMemoryLesson } = await import('./lessons.js');
-beforeEach(() => db.reset());
-describe('shareMemoryLesson', () => {
-    it('stores a team candidate of kind memory, once per memory', async () => {
-        const first = await shareMemoryLesson(process.cwd(), 'retries', 'Use withRetry from lib/net.');
-        const again = await shareMemoryLesson(process.cwd(), 'retries', 'Use withRetry from lib/net.');
-        expect(first).toBe(again);
-        expect(db.rows).toEqual([{ id: first, visibility: 'team', state: 'candidate', kind: 'memory', subject: 'retries: Use withRetry from lib/net.' }]);
-    });
-    it('queues nothing for sync until team mode is configured', async () => {
-        await shareMemoryLesson(process.cwd(), 'naming', 'Hooks are named useX.');
-        expect(db.outbox).toBe(0);
-    });
-});

package/dist/storage/team-diagnostics.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/storage/team-diagnostics.test.js

@@ -1,51 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { diagnoseMissingMembership, explainTeamConnectionError } from './team-diagnostics.js';
-import { TEAM_SCHEMA } from './team-schema.js';
-function pool(rows) {
-    return {
-        query: async () => {
-            if (rows instanceof Error)
-                throw rows;
-            return { rows, rowCount: rows.length };
-        },
-    };
-}
-describe('explainTeamConnectionError', () => {
-    it('explains an untrusted certificate chain with the CA fix', () => {
-        const message = explainTeamConnectionError(Object.assign(new Error('self-signed certificate in certificate chain'), { code: 'SELF_SIGNED_CERT_IN_CHAIN' }));
-        expect(message).toContain('NODE_EXTRA_CA_CERTS');
-        expect(message).toContain('sslmode=verify-full');
-    });
-    it('points a missing schema at init-schema', () => {
-        expect(explainTeamConnectionError({ code: '42P01', message: 'relation "rigour.memberships" does not exist' })).toContain('rigour team init-schema');
-    });
-    it('explains a rejected login and an unreachable host', () => {
-        expect(explainTeamConnectionError({ code: '28P01', message: 'password authentication failed' })).toContain('rejected the login');
-        expect(explainTeamConnectionError({ code: 'ECONNREFUSED', message: 'connect ECONNREFUSED' })).toContain('Cannot reach');
-    });
-    it('passes other errors through', () => {
-        expect(explainTeamConnectionError(new Error('something else'))).toBe('something else');
-    });
-});
-describe('diagnoseMissingMembership', () => {
-    it('names row-level security without a policy as the cause', async () => {
-        const message = await diagnoseMissingMembership(pool([{ table_name: 'memberships' }, { table_name: 'meta' }]));
-        expect(message).toContain('rigour.memberships and rigour.meta');
-        expect(message).toContain('init-schema');
-    });
-    it('reports a missing membership when nothing hides it', async () => {
-        expect(await diagnoseMissingMembership(pool([]))).toContain('no membership');
-    });
-    it('falls back to the membership message when the catalog cannot be read', async () => {
-        expect(await diagnoseMissingMembership(pool(new Error('permission denied')))).toContain('no membership');
-    });
-});
-describe('team schema', () => {
-    it('protects every team table with row-level security and a read policy', () => {
-        for (const table of ['lessons', 'memberships', 'meta']) {
-            expect(TEAM_SCHEMA).toContain(`ALTER TABLE rigour.${table} ENABLE ROW LEVEL SECURITY;`);
-        }
-        expect(TEAM_SCHEMA).toContain('CREATE POLICY memberships_read_own ON rigour.memberships FOR SELECT USING (db_role = current_user);');
-        expect(TEAM_SCHEMA).toContain('CREATE POLICY meta_read ON rigour.meta FOR SELECT USING (true);');
-    });
-});

package/dist/storage/team-scope.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/storage/team-scope.test.js

@@ -1,22 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { repositoryAllowed, withheldReason } from './team-scope.js';
-const scope = { organizationId: 'acme', repositories: ['github.com/acme/*', 'https://GitLab.com/Acme/api'] };
-describe('team scope', () => {
-    it('sends lessons only from the repositories the team lists', () => {
-        expect(repositoryAllowed('https://github.com/acme/web', scope)).toBe(true);
-        expect(repositoryAllowed('https://gitlab.com/acme/api', scope)).toBe(true);
-        expect(repositoryAllowed('https://gitlab.com/acme/api-internal', scope)).toBe(false);
-        expect(repositoryAllowed('https://github.com/other-org/web', scope)).toBe(false);
-        expect(repositoryAllowed('https://github.com/acme-evil/web', scope)).toBe(false);
-    });
-    it('sends nothing when the team lists no repositories', () => {
-        expect(repositoryAllowed('https://github.com/acme/web', { organizationId: 'acme' })).toBe(false);
-    });
-    it('keeps personal lessons and unknown repositories on the machine, and says why', () => {
-        expect(withheldReason('personal', 'https://github.com/acme/web', scope)).toBe('personal lesson');
-        expect(withheldReason('personal', 'https://github.com/acme/web', { ...scope, syncPersonal: true })).toBeNull();
-        expect(withheldReason('team', undefined, scope)).toBe('repository unknown on this machine');
-        expect(withheldReason('team', 'https://github.com/other-org/web', scope)).toContain('github.com/other-org/web');
-        expect(withheldReason('team', 'https://github.com/acme/web', scope)).toBeNull();
-    });
-});

package/dist/storage/team-store.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/storage/team-store.test.js

@@ -1,11 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { validateTeamDatabaseUrl } from './team-store.js';
-describe('team database configuration', () => {
-    it('requires TLS for remote PostgreSQL URLs', () => {
-        expect(() => validateTeamDatabaseUrl('postgresql://user:pass@db.example.com/rigour')).toThrow(/sslmode/);
-        expect(() => validateTeamDatabaseUrl('postgresql://user:pass@db.example.com/rigour?sslmode=verify-full')).not.toThrow();
-    });
-    it('rejects non-PostgreSQL URLs', () => {
-        expect(() => validateTeamDatabaseUrl('mysql://localhost/rigour')).toThrow(/postgres/);
-    });
-});

package/dist/storage/team-sync-scope.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/storage/team-sync-scope.test.js

@@ -1,100 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-/** The outbox and repositories a machine holds, and what reached the team database. */
-const state = vi.hoisted(() => ({ outbox: [], repos: new Map(), sent: [], refuse: new Set(), meta: new Map(), remote: [], since: [] }));
-vi.mock('./db.js', () => ({
-    openDatabase: async () => ({
-        all: async () => state.outbox.filter(o => o.synced_at == null),
-        get: async (sql, id) => sql.includes('FROM meta')
-            ? (state.meta.has(id) ? { value: state.meta.get(id) } : undefined)
-            : (state.repos.has(id) ? { canonical_uri: state.repos.get(id) } : undefined),
-        run: async (sql, ...p) => {
-            if (sql.startsWith('INSERT INTO meta'))
-                state.meta.set(p[0], p[1]);
-            if (sql.startsWith('UPDATE sync_outbox SET synced_at')) {
-                const id = p.at(-1);
-                Object.assign(state.outbox.find(o => o.id === id) ?? {}, { synced_at: p[0], last_error: p.length === 3 ? p[1] : null });
-            }
-            return { changes: 1 };
-        },
-        close: async () => undefined,
-    }),
-}));
-vi.mock('./local-encryption.js', () => ({ encryptLocalPayload: async (v) => JSON.stringify(v), decryptLocalPayload: async (v) => JSON.parse(v) }));
-vi.mock('pg', () => ({
-    Pool: class {
-        async query(sql, params) {
-            if (sql.includes('INSERT INTO rigour.lessons')) {
-                if (state.refuse.has(params[0]))
-                    throw Object.assign(new Error('new row violates row-level security policy for table "lessons"'), { code: '42501' });
-                state.sent.push(params[0]);
-                return { rowCount: 1, rows: [] };
-            }
-            if (sql.includes('FROM rigour.lessons')) {
-                state.since.push(params[3]);
-                return { rowCount: 0, rows: state.remote.filter(row => row.updated_at > params[3]) };
-            }
-            return { rowCount: 1, rows: [] };
-        }
-        async end() { }
-    },
-}));
-const { syncTeamOutbox } = await import('./team-store.js');
-const queue = (id, repositoryId, visibility) => state.outbox.push({ id: `outbox-${id}`, payload_json: JSON.stringify({ id, repositoryId, visibility, evidence: {} }), synced_at: null });
-const TEAM_ENV = {
-    RIGOUR_ORGANIZATION_ID: 'acme', RIGOUR_TEAM_ID: 'web', RIGOUR_ACTOR_ID: 'dev-1',
-    RIGOUR_TEAM_DATABASE_URL: 'postgresql://localhost/rigour', RIGOUR_TEAM_REPOSITORIES: 'github.com/acme/*',
-};
-const saved = { ...process.env };
-beforeEach(() => {
-    Object.assign(process.env, TEAM_ENV);
-    delete process.env.RIGOUR_TEAM_SYNC_PERSONAL;
-    state.outbox = [];
-    state.sent = [];
-    state.refuse = new Set();
-    state.meta = new Map();
-    state.remote = [];
-    state.since = [];
-    state.repos = new Map([['r-team', 'https://github.com/acme/web'], ['r-other', 'https://github.com/other-org/app']]);
-    queue('l-team', 'r-team', 'team');
-    queue('l-other', 'r-other', 'team');
-    queue('l-personal', 'r-team', 'personal');
-    queue('l-unknown', 'r-gone', 'team');
-});
-afterEach(() => { process.env = { ...saved }; });
-describe('team sync scope', () => {
-    it("sends only the team's own shared lessons and says what it kept back", async () => {
-        expect(await syncTeamOutbox({ dryRun: true })).toMatchObject({ pending: 1, withheld: 3 });
-        expect(state.sent).toEqual([]);
-        const result = await syncTeamOutbox();
-        expect(result).toMatchObject({ synced: 1, withheld: 3 });
-        expect(state.sent).toEqual(['l-team']);
-        const reasons = Object.fromEntries(state.outbox.map(o => [o.id, o.last_error]));
-        expect(reasons['outbox-l-other']).toContain('github.com/other-org/app');
-        expect(reasons['outbox-l-personal']).toContain('personal lesson');
-        expect(reasons['outbox-l-unknown']).toContain('repository unknown');
-        expect(await syncTeamOutbox({ dryRun: true })).toMatchObject({ pending: 0, withheld: 0 }); // never retried
-    });
-    it('sets aside a lesson the database refuses and sends the rest of the queue', async () => {
-        state.outbox = [];
-        queue('l-refused', 'r-team', 'team'); // queued first: it must not hold back what comes after
-        queue('l-team', 'r-team', 'team');
-        state.refuse.add('l-refused');
-        expect(await syncTeamOutbox()).toMatchObject({ synced: 1 });
-        expect(state.sent).toEqual(['l-team']);
-        expect(state.outbox.find(o => o.id === 'outbox-l-refused').last_error).toContain('refused by the team database: new row violates row-level security');
-        expect(await syncTeamOutbox({ dryRun: true })).toMatchObject({ pending: 0 }); // not tried again
-    });
-    it('pulls only what changed since the last pull, re-reading a margin for slow clocks', async () => {
-        const lesson = (id, updated) => ({ id, repository_id: 'r-team', actor_id: 'dev-2', team_id: 'web', visibility: 'team', state: 'promoted', kind: 'k', subject: 's', evidence_json: {}, confidence: 1, source: 'x', supersedes_id: null, created_at: updated, updated_at: updated });
-        const HOUR = 3_600_000;
-        state.remote = [lesson('a', 10 * HOUR), lesson('b', 20 * HOUR)];
-        expect(await syncTeamOutbox()).toMatchObject({ pulled: 2 });
-        expect(state.since).toEqual([0]); // the first pull reads everything
-        expect(await syncTeamOutbox()).toMatchObject({ pulled: 1 }); // only b, inside the 15-minute margin
-        expect(state.since[1]).toBe(20 * HOUR - 15 * 60_000);
-    });
-    it('sends nothing when the team lists no repositories', async () => {
-        delete process.env.RIGOUR_TEAM_REPOSITORIES;
-        expect(await syncTeamOutbox({ dryRun: true })).toMatchObject({ pending: 0, withheld: 4 });
-    });
-});

package/dist/storage/team-vector-store.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/storage/team-vector-store.test.js

@@ -1,56 +0,0 @@
-import { describe, expect, it, vi } from 'vitest';
-import { getTeamSemanticHealth, upsertTeamLessonEmbedding } from './team-vector-store.js';
-const config = {
-    organizationId: 'acme',
-    teamId: 'platform',
-    actorId: 'alice',
-    databaseUrl: 'postgresql://localhost/rigour',
-    semantic: {
-        provider: 'pgvector',
-        model: 'Xenova/all-MiniLM-L6-v2',
-        dimensions: 384,
-    },
-};
-describe('pgvector team health', () => {
-    it('reports extension, model, and embedding coverage', async () => {
-        const pool = {
-            query: vi.fn(async () => ({ rows: [{
-                        extversion: '0.8.1',
-                        table_ready: true,
-                        indexed_lessons: 12,
-                        missing_lessons: 3,
-                    }] })),
-            end: async () => undefined,
-        };
-        await expect(getTeamSemanticHealth(pool, config)).resolves.toEqual({
-            provider: 'pgvector',
-            status: 'ready',
-            extensionVersion: '0.8.1',
-            model: 'Xenova/all-MiniLM-L6-v2',
-            dimensions: 384,
-            indexedLessons: 12,
-            missingLessons: 3,
-        });
-        expect(pool.query).toHaveBeenCalledWith(expect.stringContaining("lesson.state IN ('validated', 'promoted')"), ['acme', 'platform', 'Xenova/all-MiniLM-L6-v2', 'alice']);
-    });
-    it('fails health checks when vector storage is incomplete', async () => {
-        const pool = {
-            query: async () => ({ rows: [{ extversion: null, table_ready: false }] }),
-            end: async () => undefined,
-        };
-        await expect(getTeamSemanticHealth(pool, config)).rejects.toThrow(/vector extension/);
-    });
-    it('does not embed unvalidated candidate lessons', async () => {
-        const pool = { query: vi.fn(), end: async () => undefined };
-        await expect(upsertTeamLessonEmbedding(pool, config, {
-            id: 'candidate-1',
-            repositoryId: 'repo-1',
-            actorId: 'alice',
-            kind: 'interaction',
-            subject: 'Unverified suggestion',
-            source: 'mcp',
-            state: 'candidate',
-        })).resolves.toBe(false);
-        expect(pool.query).not.toHaveBeenCalled();
-    });
-});

package/dist/storage/telemetry-scope.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/storage/telemetry-scope.test.js

@@ -1,38 +0,0 @@
-import fs from 'fs';
-import os from 'os';
-import path from 'path';
-import { afterAll, describe, expect, it, vi } from 'vitest';
-/** Every open goes to a scratch database, never ~/.rigour/rigour.db. */
-const dbFile = vi.hoisted(() => require('path').join(require('os').tmpdir(), `rigour-telemetry-${process.pid}.db`));
-vi.mock('./db.js', async (importOriginal) => {
-    const real = await importOriginal();
-    return { ...real, openDatabase: (p) => real.openDatabase(p ?? dbFile) };
-});
-const { openDatabase, isSQLiteAvailable } = await import('./db.js');
-const { getCheckpointMetrics, getContextEvents, recordCheckpointMetric, recordContextEvent } = await import('./context-telemetry.js');
-const repoA = fs.mkdtempSync(path.join(os.tmpdir(), 'telemetry-a-'));
-const repoB = fs.mkdtempSync(path.join(os.tmpdir(), 'telemetry-b-'));
-afterAll(() => {
-    for (const p of [dbFile, `${dbFile}-wal`, `${dbFile}-shm`])
-        fs.rmSync(p, { force: true });
-    for (const dir of [repoA, repoB])
-        fs.rmSync(dir, { recursive: true, force: true });
-});
-describe.runIf(isSQLiteAvailable())('telemetry scoped to its repository', () => {
-    it('migrates idempotently when two processes open the database at once', async () => {
-        const [a, b] = await Promise.all([openDatabase(), openDatabase()]);
-        const columns = (await a.all('PRAGMA table_info(checkpoint_metrics)')).map((c) => c.name);
-        expect(columns).toContain('repository_id');
-        await a.close();
-        await b.close();
-    });
-    it("shows a repository its own checkpoints and context events, never another's", async () => {
-        await recordCheckpointMetric({ checkpointId: 'cp-a', taskId: 't', agentId: 'agent', checkpointTokens: 10, rawStateTokens: 0, replayTokensAvoided: 0 }, repoA);
-        await recordCheckpointMetric({ checkpointId: 'cp-b', taskId: 't', agentId: 'agent', checkpointTokens: 10, rawStateTokens: 0, replayTokensAvoided: 0 }, repoB);
-        await recordContextEvent({ toolName: 'rigour_recall', cacheStatus: 'miss', candidateTokens: 0, returnedTokens: 0 }, repoA);
-        expect((await getCheckpointMetrics(undefined, repoA)).map(m => m.checkpointId)).toEqual(['cp-a']);
-        expect((await getCheckpointMetrics(undefined, repoB)).map(m => m.checkpointId)).toEqual(['cp-b']);
-        expect(await getContextEvents(undefined, repoB)).toEqual([]);
-        expect((await getContextEvents(undefined, repoA)).map(e => e.toolName)).toEqual(['rigour_recall']);
-    });
-});

package/dist/task/thread.test.d.ts

@@ -1 +0,0 @@
-export {};