@starci/hfs 4.7.32 → 4.7.34

package/upgrade/index.mjs

@@ -1,35 +1,17 @@
-// starci app upgrade --edition full: the additive edition migration from a lite app to the full HFS tree. On a full app,
-// `starci app upgrade` completes it instead: it adds the test world (scaffold/test-world.mjs) the app lacks, with the world's
-// devDependencies at canon pins, and never rewrites a file the app already has.
+// starci app upgrade: completes an existing FULL app. It adds the test world (scaffold/test-world.mjs) the app lacks, with the world's
+// devDependencies at canon pins, and never rewrites a file the app already has. Editions are fixed at scaffold: a lite app is refused
+// (HFS_UPGRADE_EDITION_FIXED), there is no lite to full migration.
 //
-// The upgrade is deliberately assembled from the same full-edition render and scaffold templates as a new full app. It never
-// rewrites an existing product source file. A dry run returns the exact ordered operations; apply performs those operations and
-// resolves the lockfile once when it added dependencies. If that resolution fails, every file touched by this invocation is
-// restored before the refusal is returned.
+// A dry run returns the exact ordered operations; apply performs those operations and resolves the lockfile once when it added
+// dependencies. If that resolution fails, every file touched by this invocation is restored before the refusal is returned.
 import fs from "node:fs";
 import path from "node:path";
-import { authoredAdditionReasons, remember, ensureParent, writeFile, restore } from "./file-state.mjs";
+import { remember, ensureParent, writeFile, restore } from "./file-state.mjs";
 import { parseYaml } from "../runtime/engine/yaml.mjs";
-import {
-  loadSlotManifest,
-  resolveRepoDeclaration,
-} from "../runtime/scripts/hfs/slots.mjs";
-import { managedScriptNames } from "../runtime/scripts/hfs/architecture/managed-scripts.mjs";
-import { LOCK_STEP, npmLock, scaffoldWorkSeeds } from "../scaffold/app.mjs";
+import { loadSlotManifest } from "../runtime/scripts/hfs/slots.mjs";
+import { LOCK_STEP, npmLock } from "../scaffold/app.mjs";
 import { WORLD_MARKER, testWorldFiles } from "../scaffold/test-world.mjs";
-import { byCodeUnit } from "../report/order.mjs";
-import {
-  TEMPLATES_DIR,
-  appSource,
-  bundledPresets,
-  checkTargets,
-  imageFiles,
-  loadHfs,
-  render,
-  renderTargets,
-  writeTargets,
-} from "../sync/index.mjs";
-import { readDeclaredStack } from "../sync/stack-images.mjs";
+import { loadHfs } from "../sync/index.mjs";
 
 const PACKAGE_ROOT = path.join(import.meta.dirname, "..");
 const PINS_FILE = path.join(
@@ -48,21 +30,6 @@ const FULL_DEV_DEPENDENCIES = Object.freeze([
   "ts-jest",
 ]);
 const FULL_DEPENDENCIES = Object.freeze(["nest-commander"]);
-// Upgrade must render the full managed files before it can add/install the Jest preset a lite app scaffolded before the 2026-10-12
-// ruling lacks (a current lite app already has it, and the e2e world's @starci/test-world is what full adds). These are the preset's two
-// public sync inputs; once apply resolves the new dependency, normal full sync reads them from @starci/jest-preset again.
-export const UPGRADE_PRESETS = Object.freeze({
-  sonarExclusions: bundledPresets().sonarExclusions,
-  coverageSources: Object.freeze([
-    "src/**/*.service.ts",
-    "src/features/cli/**/*.cli.ts",
-  ]),
-});
-const STANDARD_CLI_FILES = Object.freeze([
-  "src/features/cli/index.ts",
-  "src/features/cli/migrate/migrate.cli.ts",
-  "src/features/cli/migrate/migrate.module.ts",
-]);
 
 export class UpgradeError extends Error {
   constructor(code, message) {
@@ -71,7 +38,6 @@ export class UpgradeError extends Error {
   }
 }
 
-const posix = (value) => value.split(path.sep).join("/");
 const jsonText = (value) => `${JSON.stringify(value, null, 2)}\n`;
 const fileText = (root, file) =>
   fs
@@ -81,44 +47,6 @@ const sameText = (root, file, content) =>
   fs.existsSync(path.join(root, ...file.split("/"))) &&
     fileText(root, file) === content.replace(/\r\n/g, "\n");
 
-const readmeCommand = (name) =>
-  name === "test" ? "npm test" : `npm run ${name}`;
-
-function listsCommand(section, command) {
-  const escaped = command.replace(/[.*+?^${}()|[\]\\]/gu, String.raw`\$&`);
-  return new RegExp(String.raw`^\s*${escaped}\s*$`, "mu").test(section);
-}
-
-/** Add only the top-level commands that the full managed scripts introduce, preserving every existing README byte around them. */
-function upgradedReadme(root) {
-  const file = path.join(root, "README.md");
-  if (!fs.existsSync(file)) return null;
-  const source = fs.readFileSync(file, "utf8");
-  const newline = source.includes("\r\n") ? "\r\n" : "\n";
-  const lines = source.split(/\r?\n/u);
-  const start = lines.findIndex((line) => /^## Development\s*$/u.test(line));
-  if (start < 0) return null;
-  const end = lines.findIndex(
-    (line, index) => index > start && /^## /u.test(line),
-  );
-  const stop = end < 0 ? lines.length : end;
-  const addedNames = [...managedScriptNames("app", "full")].filter(
-    (name) =>
-      !name.includes(":") && !managedScriptNames("app", "lite").has(name),
-  );
-  const section = lines.slice(start + 1, stop).join("\n");
-  const commands = addedNames
-    .map(readmeCommand)
-    .filter((command) => !listsCommand(section, command));
-  if (commands.length === 0) return null;
-  let insert = -1;
-  for (let index = start + 1; index < stop; index += 1)
-    if (/^\s*npm run\s+/u.test(lines[index])) insert = index + 1;
-  if (insert < 0) return null;
-  lines.splice(insert, 0, ...commands);
-  return lines.join(newline);
-}
-
 function readJson(root, file) {
   try {
     return JSON.parse(fileText(root, file));
@@ -130,45 +58,6 @@ function readJson(root, file) {
   }
 }
 
-function listFiles(dir, base = dir) {
-  if (!fs.existsSync(dir)) return [];
-  return fs.readdirSync(dir, { withFileTypes: true }).flatMap((entry) => {
-    const target = path.join(dir, entry.name);
-    return entry.isDirectory()
-      ? listFiles(target, base)
-      : [posix(path.relative(base, target))];
-  });
-}
-
-/** The full declaration produced from a lite declaration. The edition field disappears and the one cli app becomes required. */
-export function fullEditionDeclaration(
-  declaration,
-  manifest = loadSlotManifest(),
-) {
-  if (declaration?.edition !== "lite") {
-    const actual = declaration?.edition ?? "full";
-    throw new UpgradeError(
-      "HFS_UPGRADE_ALREADY_FULL",
-      `hfs.json edition is ${actual}; upgrade accepts only an edition lite app`,
-    );
-  }
-  const next = structuredClone(declaration);
-  delete next.edition;
-  const cliApps =
-    next.sides?.be?.apps?.filter((app) => app.kind === "cli") ?? [];
-  if (cliApps.some((app) => app.name !== "cli") || cliApps.length > 1) {
-    throw new UpgradeError(
-      "HFS_UPGRADE_CLI_CONFLICT",
-      "the lite declaration has a cli app that is not the one be/apps/cli; rename it before upgrading",
-    );
-  }
-  if (cliApps.length === 0)
-    next.sides.be.apps.push({ name: "cli", kind: "cli" });
-  next.sides.be.kinds = [...new Set([...(next.sides.be.kinds ?? []), "cli"])];
-  resolveRepoDeclaration(manifest, next);
-  return next;
-}
-
 function pinnedPackage(root, pins) {
   const current = readJson(root, "package.json");
   const section = (name, dependencies) => {
@@ -193,115 +82,11 @@ function pinnedPackage(root, pins) {
   };
 }
 
-function nestCliText(declaration) {
-  const apps = declaration.sides.be.apps;
-  const projects = Object.fromEntries(
-    apps.map((app) => [
-      app.name,
-      {
-        type: "application",
-        root: `apps/${app.name}`,
-        entryFile: "main",
-        sourceRoot: `apps/${app.name}/src`,
-      },
-    ]),
-  );
-  const api = apps.find((app) => app.kind === "api");
-  return jsonText({
-    $schema: "https://json.schemastore.org/nest-cli",
-    collection: "@nestjs/schematics",
-    monorepo: true,
-    root: `apps/${api.name}`,
-    sourceRoot: `apps/${api.name}/src`,
-    projects,
-  });
-}
-
-function templateFiles(group, prefix, variables) {
-  const dir = path.join(TEMPLATES_DIR, group);
-  return listFiles(dir).map((file) => ({
-    path: `${prefix}${file}`,
-    content: render(
-      fs
-        .readFileSync(path.join(dir, ...file.split("/")), "utf8")
-        .replace(/\r\n/g, "\n"),
-      variables,
-    ),
-  }));
-}
-
-/** Keep an existing topology and its runbooks together; the fallback stack is only for apps without a declaration. */
-function stackAdditions(root, variables) {
-  const declaration = ".starcistacks/application-stacks.yaml";
-  const hasStacks = fs.existsSync(path.join(root, declaration));
-  return templateFiles("app/upgrade-full", "", variables).filter((file) =>
-    !hasStacks || file.path === declaration || !file.path.startsWith(".starcistacks/"));
-}
-
-function additions(root, full, hadCli, manifest) {
-  const variables = { project: full.project, app: "cli", appPascal: "Cli" };
-  const files = [
-    ...stackAdditions(root, variables),
-    ...scaffoldWorkSeeds(full.project).filter((file) =>
-      !fs.existsSync(path.join(root, file.path))
-      && (file.path === ".starciwork/workspace.yaml" || !fs.existsSync(path.join(root, ".starciwork", "index.yaml")))),
-    ...(!hadCli
-      ? [
-          ...STANDARD_CLI_FILES.map((file) => ({
-            path: `be/${file}`,
-            content: fs
-              .readFileSync(
-                path.join(TEMPLATES_DIR, "be", "skeleton", ...file.split("/")),
-                "utf8",
-              )
-              .replace(/\r\n/g, "\n"),
-          })),
-          ...templateFiles("be/upgrade-full", "be/", variables),
-        ]
-      : []),
-  ];
-  const requiredImages = imageFiles(
-    resolveRepoDeclaration(manifest, full),
-  ).filter((file) => !file.path.startsWith("be/apps/api/"));
-  for (const file of requiredImages) files.push(file);
-  return files;
-}
-
-/** The post-upgrade back-end source view used by the managed coverage render before those additions exist on disk. */
-function sourceWithAdditions(root, additions) {
-  const current = appSource(root);
-  const added = new Map(
-    additions
-      .filter(
-        (file) => file.path.startsWith("be/") && /\.[cm]?ts$/u.test(file.path),
-      )
-      .map((file) => [file.path.slice("be/".length), file.content]),
-  );
-  return {
-    files: [...new Set([...current.files, ...added.keys()])].sort(byCodeUnit),
-    read: (file) => added.get(file) ?? current.read(file),
-    // The declared images and pass-through variables render the managed stack-deploy.yml exactly as `app sync` will.
-    stack: readDeclaredStack(root, { parseYaml }),
-  };
-}
-
 const publicStep = ({ op, path: file, why }) => ({ op, path: file, why });
 
-function additionReason(file) {
-  if (file.startsWith(".starcistacks/")) return "Add the pinned Supabase/Postgres and api full-stack skeleton.";
-  if (file.startsWith(".starciwork/")) return "Add the canonical product catalog and existing liveness feature overview.";
-  if (file.includes("/tests/")) return "Open the full test layer without inventing a spec.";
-  return "Add the full-only cli or image scaffold.";
-}
-
-function additionStep(root, file, authored) {
+function additionStep(root, file) {
   const target = path.join(root, ...file.path.split("/"));
-  if (!fs.existsSync(target)) return {
-    op: "add", path: file.path, why: additionReason(file.path), content: file.content, kind: "file",
-  };
-  if (authored.has(file.path)) return {
-    op: "keep", path: file.path, why: authored.get(file.path), kind: "keep",
-  };
+  if (!fs.existsSync(target)) return { op: "add", path: file.path, why: "Open the full test layer without inventing a spec.", content: file.content, kind: "file" };
   if (!sameText(root, file.path, file.content)) throw new UpgradeError(
     "HFS_UPGRADE_FILE_CONFLICT",
     `${file.path} already exists and is not the upgrade scaffold; no file was overwritten`,
@@ -317,7 +102,7 @@ function fullCompletion(root, declaration) {
   const steps = [];
   if (!fs.existsSync(path.join(root, ...WORLD_MARKER.split("/")))) {
     for (const file of testWorldFiles(declaration)) {
-      const step = additionStep(root, file, new Map());
+      const step = additionStep(root, file);
       if (step) steps.push({ ...step, why: "Add the full test world and its baseline integration and e2e specs." });
     }
   }
@@ -344,147 +129,36 @@ function fullCompletion(root, declaration) {
   return { managed: [], steps, dependenciesChanged: missing.length > 0 };
 }
 
-async function model({ root, to, presets, manifest }) {
-  if (to !== undefined && to !== "full")
-    throw new UpgradeError(
-      "HFS_UPGRADE_TARGET_INVALID",
-      "upgrade supports only --edition full",
-    );
+function model({ root, manifest }) {
   const declaration = loadHfs(root, manifest);
-  if (declaration?.edition !== "lite") return fullCompletion(root, declaration);
-  if (to === undefined)
-    throw new UpgradeError(
-      "HFS_UPGRADE_USAGE",
-      "a lite app upgrades with starci app upgrade --edition full",
-    );
-  const hadCli = declaration.sides.be.apps.some(
-    (app) => app.kind === "cli" && app.name === "cli",
-  );
-  const full = fullEditionDeclaration(declaration, manifest);
-  const desired = additions(root, full, hadCli, manifest);
-  const authored = authoredAdditionReasons(declaration, appSource(root));
-  const pins = parseYaml(fs.readFileSync(PINS_FILE, "utf8")).pins;
-  const upgradedPackage = pinnedPackage(root, pins);
-  const resolvedPresets = presets ?? UPGRADE_PRESETS;
-  const managed = renderTargets(full, resolvedPresets, {
-    manifest,
-    source: sourceWithAdditions(root, desired),
-  });
-  const packageTarget = managed.find(
-    (target) => target.path === "package.json",
-  );
-  if (!packageTarget)
+  if (declaration?.edition === "lite")
     throw new UpgradeError(
-      "HFS_UPGRADE_RENDER_INVALID",
-      "the full sync render has no managed package.json scripts target",
+      "HFS_UPGRADE_EDITION_FIXED",
+      "editions are fixed at scaffold: a lite app stays lite and a full app stays full; there is no lite to full upgrade",
     );
-  const nextPackage = { ...upgradedPackage, scripts: packageTarget.scripts };
-  const packageChanged =
-    jsonText(nextPackage) !== fileText(root, "package.json");
-  const dependenciesChanged =
-    [...FULL_DEPENDENCIES].some(
-      (name) =>
-        readJson(root, "package.json").dependencies?.[name] !==
-        nextPackage.dependencies[name],
-    ) ||
-    [...FULL_DEV_DEPENDENCIES].some(
-      (name) =>
-        readJson(root, "package.json").devDependencies?.[name] !==
-        nextPackage.devDependencies[name],
-    );
-  const managedWithoutPackage = managed.filter(
-    (target) => target.path !== "package.json",
-  );
-  const targetResults = checkTargets(root, managedWithoutPackage);
-  const steps = [
-    {
-      op: "remove-field",
-      path: "hfs.json",
-      why: "Full is the default edition; declare the required cli app without changing the HFS major.",
-      content: jsonText(full),
-      kind: "file",
-    },
-  ];
-  const readme = upgradedReadme(root);
-  if (readme !== null)
-    steps.push({
-      op: "rewrite-readme",
-      path: "README.md",
-      why: "List the full edition's newly managed top-level scripts in Development without changing other README text.",
-      content: readme,
-      kind: "file",
-    });
-  for (const result of targetResults) {
-    if (result.status === "ok") continue;
-    steps.push({
-      op: result.status === "missing" ? "add" : "rewrite-managed",
-      path: result.path,
-      why: "Render the full-edition managed file through the normal sync renderer.",
-      kind: "managed",
-    });
-  }
-  if (packageChanged)
-    steps.push({
-      op: "rewrite-managed",
-      path: "package.json",
-      why: "Add the full test toolchain (the e2e world and any unit tooling a lite app lacks) at canon pins and render the full root scripts.",
-      content: jsonText(nextPackage),
-      kind: "file",
-    });
-  for (const file of desired) {
-    const step = additionStep(root, file, authored);
-    if (step) steps.push(step);
-  }
-  if (!sameText(root, "be/nest-cli.json", nestCliText(full)))
-    steps.push({
-      op: "rewrite-managed",
-      path: "be/nest-cli.json",
-      why: "Register the required cli app in the Nest monorepo map.",
-      content: nestCliText(full),
-      kind: "file",
-    });
-  if (dependenciesChanged)
-    steps.push({
-      op: "rewrite-managed",
-      path: "package-lock.json",
-      why: `Resolve the added pinned dependencies with ${LOCK_STEP}.`,
-      kind: "lock",
-    });
-  return { full, managed: managedWithoutPackage, steps, dependenciesChanged };
+  return fullCompletion(root, declaration);
 }
 
-
 /**
- * Plans or applies the lite -> full migration. Returns the ordered public plan (`{op,path,why}[]`) in both modes.
- * `presets` and `lock` are test seams for the full managed render and npm lock resolution.
+ * Plans or applies the completion of a full app. Returns the ordered public plan (`{op,path,why}[]`) in both modes.
+ * `lock` is the test seam for the npm lock resolution.
  */
 async function upgradeEdition({
   root,
-  to,
   plan = false,
-  presets,
   manifest = loadSlotManifest(),
   lock = npmLock,
 }) {
   const repoRoot = path.resolve(root);
-  const built = await model({ root: repoRoot, to, presets, manifest });
+  const built = model({ root: repoRoot, manifest });
   const result = built.steps.map(publicStep);
   if (plan) return result;
   const snapshot = new Map();
   const directories = [];
   try {
     for (const step of built.steps) {
-      if (step.kind === "lock" || step.kind === "keep") continue;
-      if (step.kind === "managed") {
-        const target = built.managed.find(
-          (candidate) => candidate.path === step.path,
-        );
-        const file = path.join(repoRoot, ...step.path.split("/"));
-        remember(snapshot, file);
-        ensureParent(repoRoot, file, directories);
-        writeTargets(repoRoot, [target]);
-      } else
-        writeFile(repoRoot, step.path, step.content, snapshot, directories);
+      if (step.kind === "lock") continue;
+      writeFile(repoRoot, step.path, step.content, snapshot, directories);
     }
     if (built.dependenciesChanged) {
       const lockFile = path.join(repoRoot, "package-lock.json");
@@ -504,33 +178,32 @@ async function upgradeEdition({
 }
 
 function upgradeArguments(argv) {
-  let to;
   let plan = false;
   let root = process.cwd();
   for (let index = 0; index < argv.length; index += 1) {
     const arg = argv[index];
-    if (arg === "--edition" || arg === "--repo") {
+    if (arg === "--repo") {
       if (argv[index + 1] === undefined)
         throw new UpgradeError("HFS_UPGRADE_USAGE", `${arg} needs a value`);
-      if (arg === "--edition") to = argv[index + 1];
-      else root = path.resolve(argv[index + 1]);
+      root = path.resolve(argv[index + 1]);
       index += 1;
     } else if (arg === "--plan") plan = true;
+    else if (arg === "--edition")
+      throw new UpgradeError("HFS_UPGRADE_USAGE", "upgrade takes no --edition: editions are fixed at scaffold");
     else throw new UpgradeError("HFS_UPGRADE_USAGE", `unknown argument ${arg}`);
   }
-  return { root, to, plan };
+  return { root, plan };
 }
 
 /** CLI adapter kept outside the CLI entry so that verb wiring remains one line. */
-export async function upgradeMain(
-  argv,
-  { stdout = (value) => process.stdout.write(value), presets } = {},
-) {
-  const { root, to, plan } = upgradeArguments(argv);
-  const steps = await upgradeEdition({ root, to, plan, presets });
-  for (const step of steps) stdout(`${step.op} ${step.path}: ${step.why}\n`);
+export async function upgradeMain(argv, { stdout = (value) => process.stdout.write(value) } = {}) {
+  const { root, plan } = upgradeArguments(argv);
+  const steps = await upgradeEdition({ root, plan });
+  for (const step of steps) stdout(`${step.op} ${step.path}: ${step.why}
+`);
   stdout(
-    `starci app upgrade${to ? ` --edition ${to}` : ""}${plan ? " --plan" : ""}: ${steps.length} step${steps.length === 1 ? "" : "s"} ${plan ? "planned; no file written" : "applied"}${steps.length === 0 ? " (the full app is complete)" : ""}\n`,
+    `starci app upgrade${plan ? " --plan" : ""}: ${steps.length} step${steps.length === 1 ? "" : "s"} ${plan ? "planned; no file written" : "applied"}${steps.length === 0 ? " (the full app is complete)" : ""}
+`,
   );
   return 0;
 }

package/runtime/scripts/lib/check-code-loosening.mjs

@@ -1,128 +0,0 @@
-// check-code-loosening.mjs - what loosens a gate when the gate is CODE: a check script, a canon template, a lint package, a workflow or a hook.
-// gate-loosening.mjs judges the lists and numbers of the listed gate files; a bypass done by editing the check itself (a skip, an inline disable,
-// a swallowed failure, a ban or an assertion deleted, an exemption widened) is judged here, over the same unified diff, rename-aware (a line
-// that moves keeps its text, so it is paired off against its removal anywhere in the change). The kinds it reports:
-//   bypass-added     a bypass marker added to a file of checkCode (scripts/lib/bypass-markers.mjs)
-//   check-weakened   the change removes more enforcement lines from the files of checkCode than it adds back to them
-//   check-removed    a pattern-table row or quoted list entry removed from a check script and added nowhere in the change (a quoted
-//                    operand of a string concatenation, the text of a message, is no row)
-//   scope-widened    an exemption added: an ignore / exclude / exclusion key gaining an entry, a line more in an ignore file, an item added
-//                    under codecov.yml `ignore:`, or skipLibCheck turned on
-// A deleted file is not counted for check-weakened or check-removed: a registered check is judged by its entry in a gate file
-// (knowledge/hfs/runtime-slots.yaml), and an unregistered script deleted is dead code (scripts/checks/check-dead-scripts.mjs).
-import { bypassFileKind, bypassLabelsOf } from './bypass-markers.mjs';
-
-const SPEC_NAME = /\.spec\.[cm]?[jt]sx?$/;
-const FIXTURE_NAME = /\.fixture(?:\.\w+)?$/;
-const CODE_NAME = /\.[cm]?[jt]sx?$/;
-const COMMENT_LINE = /^\s*(?:\/\/|\/\*|\*|#)/;
-const NOT_TEXT = /^\s*(?:#|\/\/|$)/;
-
-const trimmed = (line) => line.trim();
-const clip = (text) => (text.length > 90 ? `${text.slice(0, 89)}…` : text);
-
-/** Whether `file` is one of the entries: a folder (the entry ends in a slash) or one file. */
-const listed = (file, entries = []) => entries.some((entry) => (entry.endsWith('/') ? file.startsWith(entry) : file === entry));
-
-/** Whether `file` is a check, a canon template, a lint package, a workflow or a hook (checkCode); its specs and fixtures spell markers on purpose and are not. */
-export const isCheckCode = (file, rules) => listed(file, rules.checkCode) && !listed(file, rules.capabilityFiles) && !SPEC_NAME.test(file) && !FIXTURE_NAME.test(file);
-
-const WORD = String.raw`\b(?:findings|violations|failures|errors|problems|issues|found|flag|fail)\s*(?:\.push\(|\()`;
-const EXIT = String.raw`process\.exit(?:Code)?\b|\bassert[.(]|\bexpect\(|\bok\s*:\s*false\b`;
-/** The lines that make a check fail: a finding pushed, a failing exit, an assertion. */
-const ENFORCEMENT = new RegExp(`${WORD}|${EXIT}`);
-const enforcementCount = (lines) => lines.filter((line) => !COMMENT_LINE.test(line) && ENFORCEMENT.test(line)).length;
-
-const LITERAL = '/.+/[a-z]*|\'[^\']*\'|"[^"]*"|`[^`]*`';
-/** A pattern-table row or a quoted list entry of a check script: the shape of a ban list or a rule table. */
-const LIST_ENTRY = new RegExp(String.raw`^\s*(?:\[\s*(?:${LITERAL})\s*,.*\]|${LITERAL})\s*,?\s*(?://.*)?$`);
-
-const countOf = (lines) => lines.reduce((counts, line) => counts.set(trimmed(line), (counts.get(trimmed(line)) ?? 0) + 1), new Map());
-
-/** Each file's added lines once every line that also appears removed somewhere in the change (it only moved) is paired off: Map(entry -> {added, removed}). */
-function unmovedOf(files) {
-  const added = countOf(files.flatMap((entry) => entry.added));
-  const removed = countOf(files.flatMap((entry) => entry.removed));
-  const keep = (line) => {
-    const key = trimmed(line);
-    if ((added.get(key) ?? 0) <= 0 || (removed.get(key) ?? 0) <= 0) return true;
-    added.set(key, added.get(key) - 1);
-    removed.set(key, removed.get(key) - 1);
-    return false;
-  };
-  return new Map(files.map((entry) => [entry, { added: entry.added.filter(keep), removed: entry.removed }]));
-}
-
-function bypassesAdded(entry, unmoved) {
-  const kind = bypassFileKind(entry.file);
-  if (!kind || entry.deleted) return [];
-  return unmoved.added.flatMap((line) => bypassLabelsOf(kind, line, { pending: true })
-    .map((label) => ({ kind: 'bypass-added', file: entry.file, detail: `${label}: ${clip(trimmed(line))}`, text: trimmed(line) })));
-}
-
-function entriesRemoved(entry, addedBack) {
-  if (entry.deleted || !CODE_NAME.test(entry.file)) return [];
-  const operand = (line) => entry.operands?.has(line) === true;
-  return entry.removed.filter((line) => LIST_ENTRY.test(line) && !COMMENT_LINE.test(line) && !operand(line)).flatMap((line) => {
-    const left = addedBack.get(trimmed(line)) ?? 0;
-    if (left > 0) { addedBack.set(trimmed(line), left - 1); return []; }
-    return [{ kind: 'check-removed', file: entry.file, detail: clip(trimmed(line)) }];
-  });
-}
-
-const EXEMPT_WORDS = ['ignores?', 'excludes?', 'exclusions?', 'coverageExclusions', '(?:coverage|testPath|modulePath)(?:Path)?IgnorePatterns', 'globalIgnores', String.raw`sonar\.(?:coverage\.)?exclusions`];
-const EXEMPT_KEY = new RegExp(String.raw`["']?(?:${EXEMPT_WORDS.join('|')})["']?\s*[:=]`, 'i');
-const SKIP_LIB_CHECK = /skipLibCheck["']?\s*:\s*true/;
-const IGNORE_FILE = /(?:^|\/)[^/]*ignore$/;
-const CODECOV_FILE = /(?:^|\/)codecov\.ya?ml$/;
-
-const itemsOf = (line) => (line.match(/[^\s,"'[\]{}=:]+/g) ?? []).slice(1);
-
-function scopesWidened(entry, unmoved) {
-  if (entry.deleted) return [];
-  const widened = (line) => ({ kind: 'scope-widened', file: entry.file, detail: clip(trimmed(line)) });
-  // An ignore file that gains more lines than it loses (a line rewritten is not a line more); codecov.yml: a list item added under `ignore:`.
-  if (IGNORE_FILE.test(entry.file)) return unmoved.added.filter((line) => !NOT_TEXT.test(line)).slice(unmoved.removed.filter((line) => !NOT_TEXT.test(line)).length).map(widened);
-  if (CODECOV_FILE.test(entry.file)) return unmoved.added.filter((line) => (entry.under?.get(line) ?? []).some((section) => /^ignore\b/.test(section))).map(widened);
-  return unmoved.added.flatMap((line) => {
-    if (SKIP_LIB_CHECK.test(line)) return [widened(line)];
-    const key = EXEMPT_KEY.exec(line)?.[0];
-    if (!key) return [];
-    const before = unmoved.removed.find((value) => value.includes(key));
-    const known = new Set(before === undefined ? [] : itemsOf(before));
-    return before === undefined || itemsOf(line).some((item) => !known.has(item)) ? [widened(line)] : [];
-  });
-}
-
-/** An import of the runtime's one exception list (scripts/lib/allowlist.mjs). */
-const ALLOWLIST_IMPORT = /\bfrom\s+['"][./]*(?:scripts\/)?lib\/allowlist\.mjs['"]/;
-const NAMES_ALLOWLIST = /allowlist/i;
-
-/**
- * The removed lines of `entry` that count as enforcement lost. A check that stops reading the exception list (the change removes its import of
- * scripts/lib/allowlist.mjs and adds none back) loses the enforcement that policed that list's own entries (a stale entry, an entry code now
- * reads): those lines name the list, and with the list gone they police nothing. Every other removed enforcement line counts.
- */
-function enforcementRemoved(entry) {
-  const dropsList = entry.removed.some((line) => ALLOWLIST_IMPORT.test(line)) && !entry.added.some((line) => ALLOWLIST_IMPORT.test(line));
-  return dropsList ? entry.removed.filter((line) => !NAMES_ALLOWLIST.test(line)) : entry.removed;
-}
-
-/** Every finding the check files of the change `files` (parseDiff entries) add under `rules` (modules/kernel/gate-loosening.yaml): [{kind, file, detail}]. */
-export function checkCodeFindings(files, rules) {
-  const watched = files.filter((entry) => isCheckCode(entry.file, rules));
-  const unmoved = unmovedOf(watched);
-  const alive = watched.filter((entry) => !entry.deleted);
-  const fewerInChange = enforcementCount(alive.flatMap(enforcementRemoved)) - enforcementCount(alive.flatMap((entry) => entry.added));
-  const addedBack = countOf(watched.flatMap((entry) => entry.added));
-  return watched.flatMap((entry) => {
-    const own = unmoved.get(entry);
-    const fewer = enforcementCount(enforcementRemoved(entry)) - enforcementCount(entry.added);
-    return [
-      ...bypassesAdded(entry, own),
-      ...entriesRemoved(entry, addedBack),
-      ...scopesWidened(entry, own),
-      ...(fewerInChange > 0 && !entry.deleted && fewer > 0 ? [{ kind: 'check-weakened', file: entry.file, detail: `${fewer} enforcement line(s) fewer` }] : []),
-    ];
-  });
-}