@volter/world-runtime 2.0.0

package/dist/src/process-groups.js

@@ -0,0 +1,49 @@
+import { spawnSync } from 'node:child_process';
+/** Inspect only groups already owned by the lifecycle. A dead leader does not prove that its
+ * descendants exited. Zombies hold no resources; unknown inspection remains live. This is
+ * retirement evidence, never an ownership token or a way to discover processes to kill. */
+export function survivingOwnedGroups(pids) {
+    const candidates = pids.filter(pid => {
+        try {
+            process.kill(process.platform === 'win32' ? pid : -pid, 0);
+            return true;
+        }
+        catch (error) {
+            if (error.code !== 'ESRCH')
+                return true;
+            try {
+                process.kill(pid, 0);
+                return true;
+            }
+            catch (cause) {
+                return cause.code !== 'ESRCH';
+            }
+        }
+    });
+    if (!candidates.length || process.platform === 'win32')
+        return candidates;
+    const result = spawnSync('ps', ['-axo', 'pid=,pgid=,stat='], {
+        encoding: 'utf8', timeout: 1000, killSignal: 'SIGKILL', maxBuffer: 4 * 1024 * 1024,
+    });
+    if (result.status !== 0 || result.error)
+        return candidates;
+    const rows = result.stdout.trim().split('\n').map(line => line.trim().split(/\s+/));
+    return candidates.filter(pid => {
+        const members = rows.filter(([id, group]) => Number(group) === pid || Number(id) === pid);
+        // Visibility restrictions can omit a live group. Only ESRCH proves absence.
+        if (!members.length) {
+            for (const target of [-pid, pid]) {
+                try {
+                    process.kill(target, 0);
+                    return true;
+                }
+                catch (error) {
+                    if (error.code !== 'ESRCH')
+                        return true;
+                }
+            }
+            return false;
+        }
+        return members.some(([, , state]) => !state || !state.startsWith('Z'));
+    });
+}

package/dist/src/project-inspect.d.ts

@@ -0,0 +1,109 @@
+export type ProjectInspection = {
+    root: string;
+    runtimes: string[];
+    manifests: string[];
+    vendorSdks: Array<{
+        vendor: string;
+        packages: string[];
+        twin: string;
+    }>;
+    registryDestinations: Array<ProjectNpmRegistry & {
+        classification: 'npm-registry' | 'unknown';
+        twin?: '@volter/twin-npm-registry';
+    }>;
+    envNames: string[];
+    entrypoints: string[];
+    coverage: string[];
+    decisions: string[];
+};
+/** npm package → vendor/twin mapping — the shared vendor↔SDK knowledge used by both
+ * `inspect-project` (adoption discovery) and `covers` (room-setup coverage proof).
+ * The canonical entry for each pack is the real client package that pack's own tests
+ * prove the twin against (see each `packages/twin/<pack>/package.json` devDependencies);
+ * the extra aliases are the vendor's other official/first-party clients of the same
+ * API surface. */
+export declare const SDK_TWINS: Record<string, {
+    vendor: string;
+    twin: string;
+}>;
+/** PyPI distribution name (PEP 503) → twin. Built ENTIRELY from descriptors' `adoption.pypi`
+ *  (no hand table): the Python half of the same map SDK_TWINS is for npm. A Python dependency
+ *  detected here surfaces under the vendor's key, so covers/inspect treat both halves alike. */
+export declare const PYPI_TWINS: Record<string, {
+    vendor: string;
+    twin: string;
+}>;
+/** Python dependency names declared by a project — requirements*.txt (one requirement per line;
+ *  `-r` includes followed one level; comments, options and URLs skipped) and pyproject.toml
+ *  (`[project] dependencies`, every `[project.optional-dependencies.*]` list, and Poetry's
+ *  `[tool.poetry.dependencies]` / `[tool.poetry.group.*.dependencies]` tables) — across the
+ *  root and every manifest dir. Names are PEP 503 normalized; extras and version specs dropped. */
+export declare function projectPythonDependencies(input?: string): string[];
+/** Workspace member dirs of a JS monorepo: pnpm-workspace.yaml packages plus
+ * package.json "workspaces" (npm/yarn/bun form), glob patterns expanded via
+ * expandWorkspaceGlob above. A repo's vendor SDKs usually live in members, not
+ * the root manifest — the ponder blind-adoption test found inspect-project
+ * blind to exactly this. */
+export declare function workspaceDirs(root: string): string[];
+/** Nested JS project roots: subdirs (depth ≤ 2) holding a package.json or
+ * pnpm-workspace.yaml that the GIT root's own workspace declarations never reach.
+ * The 2026-08 battery scan (evals/battery) found the detector blind to exactly this
+ * shape — a Go/Rails/Python repo with its JS app in `web/` or `frontend/` (unkey's
+ * stripe lives in web/apps/dashboard, reachable only via web/'s OWN workspace file).
+ * Each nested root contributes itself plus ITS workspace members. Same class as the
+ * ponder workspace fix above, one level out. */
+export declare function nestedProjectRoots(root: string): string[];
+/** Every dir whose package.json should count toward the project's dependency /
+ * env-name census: the root, its declared workspace members, and nested project
+ * roots (plus THEIR members). Single source of truth for the walkers below. */
+export declare function projectManifestDirs(root: string): string[];
+/** Every dependency name declared anywhere in the repo — root manifest plus all
+ * workspace members, across dependencies/devDependencies/peerDependencies — plus
+ * the python manifest candidates. Exported raw for `covers`, which must also see
+ * the external-service-shaped deps that DON'T map to any twin. */
+export declare function projectDependencies(input?: string): string[];
+/** Env var names assigned in committed .env* files (root + workspace members) —
+ * the secondary vendor signal: a repo may hold a vendor key without declaring
+ * the vendor's SDK (raw fetch / CLI use). */
+export declare function projectEnvNames(input?: string): string[];
+export type ProjectNpmRegistry = {
+    url: string;
+    source: string;
+};
+/** Explicit npm registry destinations in root/workspace `.npmrc`, `bunfig.toml`, and publishConfig.
+ * npm/Bun are executables rather than SDK dependencies, so adoption must inspect their actual
+ * destination configuration: an NPM_TOKEN alone does not prove that traffic targets one of the
+ * two official hosts the npm-registry injector owns. */
+export declare function projectNpmRegistries(input?: string): ProjectNpmRegistry[];
+export type ProjectFetchUrl = {
+    /** Absolute URL passed directly as the first argument to fetch. */
+    url: string;
+    /** Repo-relative source location (`path:line`). */
+    source: string;
+};
+/** Connection facts contain names and source locations, never connection strings or credentials. */
+export type ProjectConnection = {
+    protocol: string | null;
+    env?: string;
+    sources: string[];
+};
+export declare function connectionProtocol(value: string): string | null;
+/** Native connections are independent of the vendor's HTTP SDK. Inspect ordinary URL schemes
+ * and Prisma datasource declarations; never infer a selected Prisma adapter from its presence
+ * in package.json. Dynamic/config-file-only datasources remain unknown, as do unbound drivers. */
+export declare function projectConnections(input?: string, attributedEnv?: Set<string>): ProjectConnection[];
+/** Literal HTTP(S) destinations passed directly to the platform fetch API in production source.
+ *
+ * This is the third vendor signal beside dependencies and env names: hand-written REST clients
+ * often declare no SDK, and an unconventional credential name can hide the same vendor from the
+ * env heuristic. Only direct `fetch("https://...")`, `window.fetch`, and `globalThis.fetch` calls
+ * count. Dynamic destinations remain intentionally unclaimed; guessing from arbitrary URL strings
+ * would turn docs, links, and webhook examples into false external-service dependencies. */
+export declare function projectFetchUrls(input?: string): ProjectFetchUrl[];
+/** Env names read directly by production JS/TS source, with repo-relative `path:line` evidence.
+ * This is intentionally evidence, not validator inference: seeing an empty example value read by
+ * the app is enough to rank it as a boot risk, but not enough to claim whether the app permits an
+ * empty string. Supports the standard runtime forms without guessing through arbitrary wrappers. */
+export declare function projectEnvReads(input?: string): Map<string, string[]>;
+export declare function inspectProject(input?: string): ProjectInspection;
+export declare function formatProjectInspection(report: ProjectInspection): string;