@zxyycom/vibe-check 0.0.1 → 0.0.3

package/dist/esm/package-checks/secret-detection/options-validation.mjs

@@ -0,0 +1,22 @@
+import { snapshotExactClosedRecord } from "../../data-boundary/closed-values.mjs";
+import { isPositiveSafeInteger } from "../../data-boundary/value-shapes.mjs";
+import { validResolvedFindingWaivers } from "../code-quality-findings/finding-waiver-authoring.mjs";
+import { validProjectFileSelection } from "../project-files/configuration.mjs";
+import { resolveSecretDetectionFindingIdentity } from "./finding-waiver-identity.mjs";
+/** Guards prepared options before a Run invokes a detector. */
+export function validSecretDetectionOptions(value) {
+    const options = snapshotExactClosedRecord(value, [
+        "files",
+        "findingWaivers",
+        "maximumFileBytes",
+        "maximumFileCount",
+        "maximumTotalBytes"
+    ]);
+    return (options !== undefined &&
+        validProjectFileSelection(options.files) &&
+        validResolvedFindingWaivers(options.findingWaivers, resolveSecretDetectionFindingIdentity) &&
+        isPositiveSafeInteger(options.maximumFileBytes) &&
+        isPositiveSafeInteger(options.maximumFileCount) &&
+        isPositiveSafeInteger(options.maximumTotalBytes));
+}
+//# sourceMappingURL=options-validation.mjs.map

package/dist/esm/package-checks/secret-detection/options-validation.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"options-validation.mjs","sourceRoot":"","sources":["../../../../src/package-checks/secret-detection/options-validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,MAAM,sDAAsD,CAAC;AACnG,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,qCAAqC,EAAE,MAAM,8BAA8B,CAAC;AAGrF,+DAA+D;AAC/D,MAAM,UAAU,2BAA2B,CACzC,KAAc;IAEd,MAAM,OAAO,GAAG,yBAAyB,CAAC,KAAK,EAAE;QAC/C,OAAO;QACP,gBAAgB;QAChB,kBAAkB;QAClB,kBAAkB;QAClB,mBAAmB;KACpB,CAAC,CAAC;IACH,OAAO,CACL,OAAO,KAAK,SAAS;QACrB,yBAAyB,CAAC,OAAO,CAAC,KAAK,CAAC;QACxC,2BAA2B,CAAC,OAAO,CAAC,cAAc,EAAE,qCAAqC,CAAC;QAC1F,qBAAqB,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAC/C,qBAAqB,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAC/C,qBAAqB,CAAC,OAAO,CAAC,iBAAiB,CAAC,CACjD,CAAC;AACJ,CAAC","sourcesContent":["import { snapshotExactClosedRecord } from \"../../data-boundary/closed-values.ts\";\nimport { isPositiveSafeInteger } from \"../../data-boundary/value-shapes.ts\";\nimport { validResolvedFindingWaivers } from \"../code-quality-findings/finding-waiver-authoring.ts\";\nimport { validProjectFileSelection } from \"../project-files/configuration.ts\";\nimport { resolveSecretDetectionFindingIdentity } from \"./finding-waiver-identity.ts\";\nimport type { ResolvedSecretDetectionOptions } from \"./options.ts\";\n\n/** Guards prepared options before a Run invokes a detector. */\nexport function validSecretDetectionOptions(\n  value: unknown\n): value is ResolvedSecretDetectionOptions {\n  const options = snapshotExactClosedRecord(value, [\n    \"files\",\n    \"findingWaivers\",\n    \"maximumFileBytes\",\n    \"maximumFileCount\",\n    \"maximumTotalBytes\"\n  ]);\n  return (\n    options !== undefined &&\n    validProjectFileSelection(options.files) &&\n    validResolvedFindingWaivers(options.findingWaivers, resolveSecretDetectionFindingIdentity) &&\n    isPositiveSafeInteger(options.maximumFileBytes) &&\n    isPositiveSafeInteger(options.maximumFileCount) &&\n    isPositiveSafeInteger(options.maximumTotalBytes)\n  );\n}\n"]}

package/dist/esm/package-checks/secret-detection/options.mjs

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=options.mjs.map

package/dist/esm/package-checks/secret-detection/options.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.mjs","sourceRoot":"","sources":["../../../../src/package-checks/secret-detection/options.ts"],"names":[],"mappings":"","sourcesContent":["import type { PackageCheckAuthoringOptions } from \"../check-authoring.ts\";\nimport type { FindingWaiver } from \"../../package-tools/finding-waivers/reconciliation.ts\";\nimport type { ProjectFileSelection } from \"../project-files/configuration.ts\";\n\n/** `secretDetection(options)` 的明确 authoring policy。 */\nexport interface SecretDetectionOptions<\n  Id extends string = string\n> extends PackageCheckAuthoringOptions<Id> {\n  /** 必填的完整 project-file policy；只有它选中的 path 可以被读取或传给 detector。 */\n  readonly files: ProjectFileSelection;\n  /** 单个输入允许的最大 raw byte 数；超过时形成不可豁免的 coverage gap。 */\n  readonly maximumFileBytes?: number;\n  /** 一次 invocation 中允许读取和检测的累计 raw byte 数；超过时形成 coverage gap。 */\n  readonly maximumTotalBytes?: number;\n  /** 一次 invocation 中允许处理的 selected file 数；超过时形成 coverage gap。 */\n  readonly maximumFileCount?: number;\n  /** 对安全 finding identity 的精确、可审计误报豁免。 */\n  readonly findingWaivers?: readonly FindingWaiver<SecretDetectionFindingIdentity>[];\n}\n\n/** 不含 raw value、message、hash 或 location 的 secret finding 身份。 */\nexport interface SecretDetectionFindingIdentity {\n  readonly ordinal: number;\n  readonly path: string;\n  readonly ruleId: \"@secretlint/secretlint-rule-privatekey\";\n  readonly structuralClass: \"text-document\";\n}\n\n/** `secretDetection` execution 消费的完整冻结 options。 */\nexport interface ResolvedSecretDetectionOptions {\n  readonly files: ProjectFileSelection;\n  readonly findingWaivers: readonly FindingWaiver<SecretDetectionFindingIdentity>[];\n  readonly maximumFileBytes: number;\n  readonly maximumFileCount: number;\n  readonly maximumTotalBytes: number;\n}\n\n/** `findingWaivers` 的 public authoring alias。 */\nexport type SecretDetectionFindingWaiver = FindingWaiver<SecretDetectionFindingIdentity>;\n"]}

package/dist/esm/package-checks/secret-detection/records.mjs

@@ -0,0 +1,31 @@
+import { buildFindingWaiverAuditRecordData } from "../code-quality-findings/finding-waiver-evidence.mjs";
+import { resolveSecretDetectionFindingIdentity } from "./finding-waiver-identity.mjs";
+export function secretFindingIdentity(issue) {
+    return Object.freeze({
+        ordinal: issue.ordinal,
+        path: issue.path,
+        ruleId: issue.ruleId,
+        structuralClass: issue.structuralClass
+    });
+}
+export function secretFindingRecordId(identity) {
+    return `/secret-finding/${identity.path}/${identity.ordinal}`;
+}
+export function secretCoverageGapRecordId(path) {
+    return `/coverage-gap/${path}`;
+}
+export function secretDetectionWaiverAuditRecord(audit) {
+    const identity = secretDetectionWaiverIdentity(audit.waiver);
+    return Object.freeze({
+        data: buildFindingWaiverAuditRecordData(identity, audit),
+        id: `/finding-waiver-audit/${identity.path}/${identity.ordinal}`
+    });
+}
+function secretDetectionWaiverIdentity(waiver) {
+    const identity = resolveSecretDetectionFindingIdentity(waiver.identity);
+    if (identity === undefined) {
+        throw new TypeError("secretDetection waiver identity must be a safe finding identity");
+    }
+    return identity;
+}
+//# sourceMappingURL=records.mjs.map

package/dist/esm/package-checks/secret-detection/records.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"records.mjs","sourceRoot":"","sources":["../../../../src/package-checks/secret-detection/records.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,iCAAiC,EAAE,MAAM,qDAAqD,CAAC;AAIxG,OAAO,EAAE,qCAAqC,EAAE,MAAM,8BAA8B,CAAC;AAgCrF,MAAM,UAAU,qBAAqB,CAAC,KAA2B;IAC/D,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAwC;IAC5E,OAAO,mBAAmB,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,OAAO,iBAAiB,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,KAA+B;IAE/B,MAAM,QAAQ,GAAG,6BAA6B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7D,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,iCAAiC,CAAC,QAAQ,EAAE,KAAK,CAAC;QACxD,EAAE,EAAE,yBAAyB,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,EAAE;KACjE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,6BAA6B,CACpC,MAAiC;IAEjC,MAAM,QAAQ,GAAG,qCAAqC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,SAAS,CAAC,iEAAiE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import type { MaterializedFindingWaiver } from \"../../package-tools/finding-waivers/reconciliation.ts\";\nimport type {\n  FindingWaiverRecordAudit,\n  FindingWaiverAuditRecordData\n} from \"../code-quality-findings/finding-waiver-evidence.ts\";\nimport { buildFindingWaiverAuditRecordData } from \"../code-quality-findings/finding-waiver-evidence.ts\";\nimport type { SecretDetectionCoverageGapReason } from \"./classification.ts\";\nimport type { SecretDetectionIssue } from \"./secretlint/adapter.ts\";\nimport type { SecretDetectionFindingIdentity } from \"./options.ts\";\nimport { resolveSecretDetectionFindingIdentity } from \"./finding-waiver-identity.ts\";\n\n/** An actionable or waived high-confidence secret finding. No detector value or message is retained. */\nexport interface SecretDetectionFindingRecordData {\n  readonly blocking: boolean;\n  readonly kind: \"secret-finding\";\n  readonly location: SecretDetectionIssue[\"location\"];\n  readonly ordinal: number;\n  readonly path: string;\n  readonly ruleId: \"@secretlint/secretlint-rule-privatekey\";\n  readonly structuralClass: \"text-document\";\n  readonly waiver?: Readonly<{ readonly reason: string }>;\n}\n\n/** A deterministic exact-input coverage gap. It is never reconciled through finding waiver policy. */\nexport interface SecretDetectionCoverageGapRecordData {\n  readonly blocking: true;\n  readonly kind: \"coverage-gap\";\n  readonly path: string;\n  readonly reason: SecretDetectionCoverageGapReason;\n}\n\n/** Unused or overmatched safe secret finding waiver evidence. */\nexport type SecretDetectionFindingWaiverAuditRecordData =\n  FindingWaiverAuditRecordData<SecretDetectionFindingIdentity>;\n\n/** `secretDetection` 发布的全部补充 Record data。 */\nexport type SecretDetectionRecordData =\n  | SecretDetectionCoverageGapRecordData\n  | SecretDetectionFindingRecordData\n  | SecretDetectionFindingWaiverAuditRecordData;\n\nexport function secretFindingIdentity(issue: SecretDetectionIssue): SecretDetectionFindingIdentity {\n  return Object.freeze({\n    ordinal: issue.ordinal,\n    path: issue.path,\n    ruleId: issue.ruleId,\n    structuralClass: issue.structuralClass\n  });\n}\n\nexport function secretFindingRecordId(identity: SecretDetectionFindingIdentity): string {\n  return `/secret-finding/${identity.path}/${identity.ordinal}`;\n}\n\nexport function secretCoverageGapRecordId(path: string): string {\n  return `/coverage-gap/${path}`;\n}\n\nexport function secretDetectionWaiverAuditRecord(\n  audit: FindingWaiverRecordAudit\n): Readonly<{ readonly data: SecretDetectionFindingWaiverAuditRecordData; readonly id: string }> {\n  const identity = secretDetectionWaiverIdentity(audit.waiver);\n  return Object.freeze({\n    data: buildFindingWaiverAuditRecordData(identity, audit),\n    id: `/finding-waiver-audit/${identity.path}/${identity.ordinal}`\n  });\n}\n\nfunction secretDetectionWaiverIdentity(\n  waiver: MaterializedFindingWaiver\n): SecretDetectionFindingIdentity {\n  const identity = resolveSecretDetectionFindingIdentity(waiver.identity);\n  if (identity === undefined) {\n    throw new TypeError(\"secretDetection waiver identity must be a safe finding identity\");\n  }\n  return identity;\n}\n"]}

package/dist/esm/package-checks/secret-detection/secretlint/adapter.mjs

@@ -0,0 +1,84 @@
+import { snapshotClosedRecord } from "../../../data-boundary/closed-values.mjs";
+import { lintSource } from "@secretlint/core";
+import { creator as privateKeyRule } from "@secretlint/secretlint-rule-privatekey";
+import { secretDetectionPrivateKeyRuleId, secretDetectionTextDocumentStructuralClass } from "../finding-waiver-identity.mjs";
+/**
+ * Runs the fixed local Secretlint rule set against already-approved in-memory text.
+ * Third-party result, message text, data, error, and source content never leave this module.
+ */
+export async function detectSecretlintIssues(content, projectRelativePath) {
+    try {
+        const result = await lintSource({
+            source: { content, contentType: "text", filePath: projectRelativePath },
+            options: {
+                config: {
+                    rules: [{ id: secretDetectionPrivateKeyRuleId, rule: privateKeyRule, severity: "error" }]
+                },
+                maskSecrets: true,
+                noPhysicFilePath: true
+            }
+        });
+        return adaptSecretlintMessages(result.messages, projectRelativePath);
+    }
+    catch {
+        return Object.freeze({ kind: "unavailable" });
+    }
+}
+/** Converts only allowlisted Secretlint message fields to the safe Check-local issue DTO. */
+export function adaptSecretlintMessages(messages, projectRelativePath) {
+    if (!Array.isArray(messages))
+        return Object.freeze({ kind: "protocol-failed" });
+    const issues = [];
+    for (const message of messages) {
+        const location = safeLocation(message);
+        if (location === undefined || !isPrivateKeyMessage(message)) {
+            return Object.freeze({ kind: "protocol-failed" });
+        }
+        issues.push(Object.freeze({
+            location,
+            ordinal: issues.length + 1,
+            path: projectRelativePath,
+            ruleId: secretDetectionPrivateKeyRuleId,
+            structuralClass: secretDetectionTextDocumentStructuralClass
+        }));
+    }
+    return Object.freeze({ issues: Object.freeze(issues), kind: "complete" });
+}
+function isPrivateKeyMessage(value) {
+    const message = snapshotClosedRecord(value);
+    return (message?.type === "message" &&
+        message?.ruleId === secretDetectionPrivateKeyRuleId &&
+        message?.severity === "error");
+}
+function safeLocation(value) {
+    const message = snapshotClosedRecord(value);
+    if (message === undefined)
+        return undefined;
+    const loc = snapshotClosedRecord(message.loc);
+    if (loc === undefined)
+        return undefined;
+    const start = loc.start;
+    const end = loc.end;
+    if (!isPosition(start) || !isPosition(end))
+        return undefined;
+    if (end.line < start.line || (end.line === start.line && end.column < start.column)) {
+        return undefined;
+    }
+    return Object.freeze({
+        endColumn: end.column + 1,
+        endLine: end.line,
+        startColumn: start.column + 1,
+        startLine: start.line
+    });
+}
+function isPosition(value) {
+    const position = snapshotClosedRecord(value);
+    return (position !== undefined &&
+        typeof position.column === "number" &&
+        Number.isSafeInteger(position.column) &&
+        position.column >= 0 &&
+        typeof position.line === "number" &&
+        Number.isSafeInteger(position.line) &&
+        position.line >= 1);
+}
+//# sourceMappingURL=adapter.mjs.map

package/dist/esm/package-checks/secret-detection/secretlint/adapter.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.mjs","sourceRoot":"","sources":["../../../../../src/package-checks/secret-detection/secretlint/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAC/E,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAEnF,OAAO,EACL,+BAA+B,EAC/B,0CAA0C,EAC3C,MAAM,+BAA+B,CAAC;AAsBvC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAe,EACf,mBAA2B;IAE3B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;YAC9B,MAAM,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,EAAE;YACvE,OAAO,EAAE;gBACP,MAAM,EAAE;oBACN,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,+BAA+B,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;iBAC1F;gBACD,WAAW,EAAE,IAAI;gBACjB,gBAAgB,EAAE,IAAI;aACvB;SACF,CAAC,CAAC;QACH,OAAO,uBAAuB,CAAC,MAAM,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,uBAAuB,CACrC,QAAiB,EACjB,mBAA2B;IAE3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAEhF,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5D,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,MAAM,CAAC;YACZ,QAAQ;YACR,OAAO,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC;YAC1B,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,+BAA+B;YACvC,eAAe,EAAE,0CAA0C;SAC5D,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC5C,OAAO,CACL,OAAO,EAAE,IAAI,KAAK,SAAS;QAC3B,OAAO,EAAE,MAAM,KAAK,+BAA+B;QACnD,OAAO,EAAE,QAAQ,KAAK,OAAO,CAC9B,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IACxB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IACpB,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7D,IAAI,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACpF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC;QACzB,OAAO,EAAE,GAAG,CAAC,IAAI;QACjB,WAAW,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC;QAC7B,SAAS,EAAE,KAAK,CAAC,IAAI;KACtB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CACjB,KAAc;IAEd,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO,CACL,QAAQ,KAAK,SAAS;QACtB,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ;QACnC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC;QACrC,QAAQ,CAAC,MAAM,IAAI,CAAC;QACpB,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;QACjC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC;QACnC,QAAQ,CAAC,IAAI,IAAI,CAAC,CACnB,CAAC;AACJ,CAAC","sourcesContent":["import { snapshotClosedRecord } from \"../../../data-boundary/closed-values.ts\";\nimport { lintSource } from \"@secretlint/core\";\nimport { creator as privateKeyRule } from \"@secretlint/secretlint-rule-privatekey\";\n\nimport {\n  secretDetectionPrivateKeyRuleId,\n  secretDetectionTextDocumentStructuralClass\n} from \"../finding-waiver-identity.ts\";\n\n/** The only detector result shape allowed to leave this private adapter. */\nexport interface SecretDetectionIssue {\n  readonly location: Readonly<{\n    readonly endColumn: number;\n    readonly endLine: number;\n    readonly startColumn: number;\n    readonly startLine: number;\n  }>;\n  readonly ordinal: number;\n  readonly path: string;\n  readonly ruleId: \"@secretlint/secretlint-rule-privatekey\";\n  readonly structuralClass: \"text-document\";\n}\n\nexport type SecretlintDetectionResult = Readonly<\n  | { readonly issues: readonly SecretDetectionIssue[]; readonly kind: \"complete\" }\n  | { readonly kind: \"protocol-failed\" }\n  | { readonly kind: \"unavailable\" }\n>;\n\n/**\n * Runs the fixed local Secretlint rule set against already-approved in-memory text.\n * Third-party result, message text, data, error, and source content never leave this module.\n */\nexport async function detectSecretlintIssues(\n  content: string,\n  projectRelativePath: string\n): Promise<SecretlintDetectionResult> {\n  try {\n    const result = await lintSource({\n      source: { content, contentType: \"text\", filePath: projectRelativePath },\n      options: {\n        config: {\n          rules: [{ id: secretDetectionPrivateKeyRuleId, rule: privateKeyRule, severity: \"error\" }]\n        },\n        maskSecrets: true,\n        noPhysicFilePath: true\n      }\n    });\n    return adaptSecretlintMessages(result.messages, projectRelativePath);\n  } catch {\n    return Object.freeze({ kind: \"unavailable\" });\n  }\n}\n\n/** Converts only allowlisted Secretlint message fields to the safe Check-local issue DTO. */\nexport function adaptSecretlintMessages(\n  messages: unknown,\n  projectRelativePath: string\n): SecretlintDetectionResult {\n  if (!Array.isArray(messages)) return Object.freeze({ kind: \"protocol-failed\" });\n\n  const issues: SecretDetectionIssue[] = [];\n  for (const message of messages) {\n    const location = safeLocation(message);\n    if (location === undefined || !isPrivateKeyMessage(message)) {\n      return Object.freeze({ kind: \"protocol-failed\" });\n    }\n    issues.push(\n      Object.freeze({\n        location,\n        ordinal: issues.length + 1,\n        path: projectRelativePath,\n        ruleId: secretDetectionPrivateKeyRuleId,\n        structuralClass: secretDetectionTextDocumentStructuralClass\n      })\n    );\n  }\n  return Object.freeze({ issues: Object.freeze(issues), kind: \"complete\" });\n}\n\nfunction isPrivateKeyMessage(value: unknown): boolean {\n  const message = snapshotClosedRecord(value);\n  return (\n    message?.type === \"message\" &&\n    message?.ruleId === secretDetectionPrivateKeyRuleId &&\n    message?.severity === \"error\"\n  );\n}\n\nfunction safeLocation(value: unknown): SecretDetectionIssue[\"location\"] | undefined {\n  const message = snapshotClosedRecord(value);\n  if (message === undefined) return undefined;\n  const loc = snapshotClosedRecord(message.loc);\n  if (loc === undefined) return undefined;\n  const start = loc.start;\n  const end = loc.end;\n  if (!isPosition(start) || !isPosition(end)) return undefined;\n  if (end.line < start.line || (end.line === start.line && end.column < start.column)) {\n    return undefined;\n  }\n  return Object.freeze({\n    endColumn: end.column + 1,\n    endLine: end.line,\n    startColumn: start.column + 1,\n    startLine: start.line\n  });\n}\n\nfunction isPosition(\n  value: unknown\n): value is Readonly<{ readonly column: number; readonly line: number }> {\n  const position = snapshotClosedRecord(value);\n  return (\n    position !== undefined &&\n    typeof position.column === \"number\" &&\n    Number.isSafeInteger(position.column) &&\n    position.column >= 0 &&\n    typeof position.line === \"number\" &&\n    Number.isSafeInteger(position.line) &&\n    position.line >= 1\n  );\n}\n"]}

package/dist/esm/package-tools/admission-policy/define-admission-policy.mjs

@@ -0,0 +1,10 @@
+/**
+ * 保留 closed admission policy literal 的 TypeScript inference，不创建额外运行语义。
+ *
+ * @remarks inline policy 与此 helper 的结果完全等价。custom simple `decide` 同步运行；prepared
+ * strategy 为每个 graph-ready Run 解析独立 closure，调用方负责其 trusted host callback 的可重入性。
+ */
+export function defineAdmissionPolicy(policy) {
+    return policy;
+}
+//# sourceMappingURL=define-admission-policy.mjs.map

package/dist/esm/package-tools/admission-policy/define-admission-policy.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"define-admission-policy.mjs","sourceRoot":"","sources":["../../../../src/package-tools/admission-policy/define-admission-policy.ts"],"names":[],"mappings":"AA2CA;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAA+B;IAE/B,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type {\n  AdmissionPolicy,\n  CustomAdmissionPreparationContext,\n  CustomAdmissionStrategy,\n  PreparedCustomAdmissionStrategy\n} from \"../../project-definition/scheduler-policy.ts\";\n\ntype ExactAdmissionPolicy<T extends AdmissionPolicy> =\n  T extends Readonly<{ readonly kind: \"static\" }>\n    ? T & Record<Exclude<keyof T, \"kind\">, never>\n    : T extends Readonly<{ readonly kind: \"custom\" }>\n      ? T &\n          Record<Exclude<keyof T, \"kind\" | \"strategy\">, never> &\n          Readonly<{\n            readonly strategy: ExactCustomAdmissionStrategy<T[\"strategy\"]>;\n          }>\n      : never;\n\ntype ExactCustomAdmissionStrategy<T extends CustomAdmissionStrategy> =\n  T extends Readonly<{ readonly kind: \"simple\" }>\n    ? T & Record<Exclude<keyof T, \"kind\" | \"decide\">, never>\n    : T extends Readonly<{ readonly kind: \"prepared\" }>\n      ? T &\n          Record<Exclude<keyof T, \"kind\" | \"prepare\">, never> &\n          Readonly<{ readonly prepare: ExactCustomPreparation<T[\"prepare\"]> }>\n      : never;\n\ntype ExactCustomPreparation<T> = T extends (\n  this: void,\n  context: CustomAdmissionPreparationContext\n) => infer Result\n  ? (this: void, context: CustomAdmissionPreparationContext) => ExactCustomPreparationResult<Result>\n  : never;\n\ntype ExactCustomPreparationResult<T> =\n  T extends Promise<unknown>\n    ? Promise<ExactPreparedCustomAdmissionStrategy<Awaited<T>>>\n    : ExactPreparedCustomAdmissionStrategy<T>;\n\ntype ExactPreparedCustomAdmissionStrategy<T> = T extends PreparedCustomAdmissionStrategy\n  ? T & Record<Exclude<keyof T, \"decide\" | \"terminalEffect\">, never>\n  : never;\n\n/**\n * 保留 closed admission policy literal 的 TypeScript inference，不创建额外运行语义。\n *\n * @remarks inline policy 与此 helper 的结果完全等价。custom simple `decide` 同步运行；prepared\n * strategy 为每个 graph-ready Run 解析独立 closure，调用方负责其 trusted host callback 的可重入性。\n */\nexport function defineAdmissionPolicy<const T extends AdmissionPolicy>(\n  policy: ExactAdmissionPolicy<T>\n): T {\n  return policy;\n}\n"]}

package/dist/esm/package-tools/cache/cache-json-by-key.mjs

@@ -0,0 +1,188 @@
+/** caller-keyed canonical JSON cache 的公开存储边界。 */
+import { createHash, randomUUID } from "node:crypto";
+import { promises as fs } from "node:fs";
+import { isAbsolute, join } from "node:path";
+import { canonicalizeJsonObject, canonicalJsonBytes } from "../../data-boundary/canonical-data.mjs";
+import { snapshotExactClosedRecord } from "../../data-boundary/closed-values.mjs";
+const CACHE_API_VERSION = "caller-keyed-json-v1";
+const CACHE_ENVELOPE_KEYS = ["cacheFormatVersion", "identityDigest", "payload"];
+/**
+ * 按 caller 提供的完整 semantic key 复用本地 canonical JSON object。
+ *
+ * cache hit 不会跳过或重放 Check settlement、Records、messages、duration 或 side effects。读取或写入失败
+ * 只通过返回的 observation 可见；只要 `compute` 与 `parse` 成功，就仍返回本次 computation 的 value。
+ * 不提供依赖发现、默认目录、lock/single-flight、TTL/LRU、cleanup、remote cache 或 tamper protection。
+ */
+export async function cacheJsonByKey(authoredOptions) {
+    const options = parseOptions(authoredOptions);
+    const identityDigest = cacheIdentityDigest(options);
+    const targetPath = join(options.directory, `${identityDigest}.json`);
+    const cached = await readCacheEntry({ identityDigest, parse: options.parse, targetPath });
+    if (cached.hit) {
+        return Object.freeze({
+            read: "hit",
+            source: "cache",
+            value: cached.value,
+            write: "not-attempted"
+        });
+    }
+    const payload = canonicalizeJsonObject(await options.compute());
+    if (payload === undefined) {
+        throw new TypeError("cacheJsonByKey compute must return a canonical JSON object");
+    }
+    const value = parseSynchronously(options.parse, payload, "computed value");
+    const stored = await publishCacheEntry({
+        directory: options.directory,
+        identityDigest,
+        parse: options.parse,
+        payload,
+        targetPath
+    });
+    return Object.freeze({
+        read: cached.read,
+        source: "computed",
+        value,
+        write: stored ? "stored" : "failed"
+    });
+}
+function parseOptions(value) {
+    const record = snapshotExactClosedRecord(value, [
+        "compute",
+        "directory",
+        "key",
+        "namespace",
+        "parse",
+        "version"
+    ]);
+    if (record === undefined) {
+        throw new TypeError("cacheJsonByKey options must be a closed object");
+    }
+    const { compute, directory, key, namespace, parse, version } = record;
+    if (typeof compute !== "function" || typeof parse !== "function") {
+        throw new TypeError("cacheJsonByKey compute and parse must be functions");
+    }
+    if (typeof directory !== "string" ||
+        directory.length === 0 ||
+        directory.includes("\0") ||
+        !isAbsolute(directory)) {
+        throw new TypeError("cacheJsonByKey directory must be a non-empty absolute path without U+0000");
+    }
+    if (typeof namespace !== "string" || namespace.length === 0) {
+        throw new TypeError("cacheJsonByKey namespace must be a non-empty string");
+    }
+    if (typeof version !== "string" || version.length === 0) {
+        throw new TypeError("cacheJsonByKey version must be a non-empty string");
+    }
+    if (typeof key !== "string" || key.length === 0) {
+        throw new TypeError("cacheJsonByKey key must be a non-empty string");
+    }
+    const typedOptions = {
+        compute: value.compute,
+        directory: value.directory,
+        key: value.key,
+        namespace: value.namespace,
+        parse: value.parse,
+        version: value.version
+    };
+    if (typedOptions.compute !== compute ||
+        typedOptions.directory !== directory ||
+        typedOptions.key !== key ||
+        typedOptions.namespace !== namespace ||
+        typedOptions.parse !== parse ||
+        typedOptions.version !== version) {
+        throw new TypeError("cacheJsonByKey options changed during validation");
+    }
+    return Object.freeze(typedOptions);
+}
+function cacheIdentityDigest(options) {
+    return createHash("sha256")
+        .update(canonicalJsonBytes({
+        cacheApiVersion: CACHE_API_VERSION,
+        key: options.key,
+        namespace: options.namespace,
+        payloadVersion: options.version
+    }))
+        .digest("hex");
+}
+async function readCacheEntry(input) {
+    let source;
+    try {
+        source = await fs.readFile(input.targetPath, "utf8");
+    }
+    catch (error) {
+        return isMissingPath(error)
+            ? Object.freeze({ hit: false, read: "miss" })
+            : Object.freeze({ hit: false, read: "failed" });
+    }
+    try {
+        const envelope = parseEnvelope(JSON.parse(source), input.identityDigest);
+        if (envelope === undefined)
+            return Object.freeze({ hit: false, read: "invalid" });
+        return Object.freeze({
+            hit: true,
+            value: parseSynchronously(input.parse, envelope.payload, "cached payload")
+        });
+    }
+    catch {
+        return Object.freeze({ hit: false, read: "invalid" });
+    }
+}
+function parseEnvelope(value, identityDigest) {
+    const record = snapshotExactClosedRecord(value, CACHE_ENVELOPE_KEYS);
+    if (record === undefined)
+        return undefined;
+    if (record.cacheFormatVersion !== CACHE_API_VERSION || record.identityDigest !== identityDigest) {
+        return undefined;
+    }
+    const payload = canonicalizeJsonObject(record.payload);
+    return payload === undefined ? undefined : Object.freeze({ payload });
+}
+function parseSynchronously(parse, payload, subject) {
+    const value = parse(payload);
+    if (isThenable(value))
+        throw new TypeError(`cacheJsonByKey parse must synchronously return ${subject}`);
+    return value;
+}
+function isThenable(value) {
+    return (((typeof value === "object" && value !== null) || typeof value === "function") &&
+        typeof value.then === "function");
+}
+async function publishCacheEntry(input) {
+    const temporaryPath = join(input.directory, `.vibe-check-cache-${randomUUID()}.tmp`);
+    try {
+        await fs.mkdir(input.directory, { recursive: true });
+        await fs.writeFile(temporaryPath, JSON.stringify({
+            cacheFormatVersion: CACHE_API_VERSION,
+            identityDigest: input.identityDigest,
+            payload: input.payload
+        }), { encoding: "utf8", flag: "wx" });
+    }
+    catch {
+        await fs.rm(temporaryPath, { force: true }).catch(() => undefined);
+        return false;
+    }
+    try {
+        await fs.rename(temporaryPath, input.targetPath);
+        return true;
+    }
+    catch (error) {
+        if (isConcurrentTargetConflict(error)) {
+            const concurrent = await readCacheEntry({
+                identityDigest: input.identityDigest,
+                parse: input.parse,
+                targetPath: input.targetPath
+            });
+            await fs.rm(temporaryPath, { force: true }).catch(() => undefined);
+            return concurrent.hit;
+        }
+        await fs.rm(temporaryPath, { force: true }).catch(() => undefined);
+        return false;
+    }
+}
+function isConcurrentTargetConflict(error) {
+    return (typeof error === "object" && error !== null && error.code === "EEXIST");
+}
+function isMissingPath(error) {
+    return (typeof error === "object" && error !== null && error.code === "ENOENT");
+}
+//# sourceMappingURL=cache-json-by-key.mjs.map

package/dist/esm/package-tools/cache/cache-json-by-key.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-json-by-key.mjs","sourceRoot":"","sources":["../../../../src/package-tools/cache/cache-json-by-key.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAEnB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AAEjF,MAAM,iBAAiB,GAAG,sBAAsB,CAAC;AACjD,MAAM,mBAAmB,GAAG,CAAC,oBAAoB,EAAE,gBAAgB,EAAE,SAAS,CAAU,CAAC;AAiDzF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,eAAyC;IAEzC,MAAM,OAAO,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;IAC9C,MAAM,cAAc,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,cAAc,OAAO,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IAC1F,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;QACf,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,OAAO;YACf,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,eAAe;SACvB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAChE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,SAAS,CAAC,4DAA4D,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;QACrC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,cAAc;QACd,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO;QACP,UAAU;KACX,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE,UAAU;QAClB,KAAK;QACL,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;KACpC,CAAC,CAAC;AACL,CAAC;AAWD,SAAS,YAAY,CAAmB,KAA+B;IACrE,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,EAAE;QAC9C,SAAS;QACT,WAAW;QACX,KAAK;QACL,WAAW;QACX,OAAO;QACP,SAAS;KACV,CAAC,CAAC;IACH,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IACtE,IAAI,OAAO,OAAO,KAAK,UAAU,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;QACjE,MAAM,IAAI,SAAS,CAAC,oDAAoD,CAAC,CAAC;IAC5E,CAAC;IACD,IACE,OAAO,SAAS,KAAK,QAAQ;QAC7B,SAAS,CAAC,MAAM,KAAK,CAAC;QACtB,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;QACxB,CAAC,UAAU,CAAC,SAAS,CAAC,EACtB,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,SAAS,CAAC,qDAAqD,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,SAAS,CAAC,mDAAmD,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,SAAS,CAAC,+CAA+C,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,YAAY,GAAqB;QACrC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;IACF,IACE,YAAY,CAAC,OAAO,KAAK,OAAO;QAChC,YAAY,CAAC,SAAS,KAAK,SAAS;QACpC,YAAY,CAAC,GAAG,KAAK,GAAG;QACxB,YAAY,CAAC,SAAS,KAAK,SAAS;QACpC,YAAY,CAAC,KAAK,KAAK,KAAK;QAC5B,YAAY,CAAC,OAAO,KAAK,OAAO,EAChC,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,mBAAmB,CAAC,OAA8B;IACzD,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CACL,kBAAkB,CAAC;QACjB,eAAe,EAAE,iBAAiB;QAClC,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,cAAc,EAAE,OAAO,CAAC,OAAO;KAChC,CAAC,CACH;SACA,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAMD,KAAK,UAAU,cAAc,CAC3B,KAIE;IAEF,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,OAAO,aAAa,CAAC,KAAK,CAAC;YACzB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC7C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QACzE,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAClF,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,GAAG,EAAE,IAAI;YACT,KAAK,EAAE,kBAAkB,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;SAC3E,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,KAAc,EACd,cAAsB;IAEtB,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;IACrE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,IAAI,MAAM,CAAC,kBAAkB,KAAK,iBAAiB,IAAI,MAAM,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;QAChG,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvD,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,kBAAkB,CACzB,KAA4B,EAC5B,OAA4B,EAC5B,OAAe;IAEf,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,UAAU,CAAC,KAAK,CAAC;QACnB,MAAM,IAAI,SAAS,CAAC,kDAAkD,OAAO,EAAE,CAAC,CAAC;IACnF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,CACL,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,IAAI,OAAO,KAAK,KAAK,UAAU,CAAC;QAC9E,OAAQ,KAA4B,CAAC,IAAI,KAAK,UAAU,CACzD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAME;IAEF,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,qBAAqB,UAAU,EAAE,MAAM,CAAC,CAAC;IACrF,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,MAAM,EAAE,CAAC,SAAS,CAChB,aAAa,EACb,IAAI,CAAC,SAAS,CAAC;YACb,kBAAkB,EAAE,iBAAiB;YACrC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,EACF,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CACjC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,EAAE,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACnE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;YACtC,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC;gBACtC,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC,CAAC;YACH,MAAM,EAAE,CAAC,EAAE,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACnE,OAAO,UAAU,CAAC,GAAG,CAAC;QACxB,CAAC;QACD,MAAM,EAAE,CAAC,EAAE,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACnE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAc;IAChD,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAK,KAA4B,CAAC,IAAI,KAAK,QAAQ,CAC/F,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAK,KAA4B,CAAC,IAAI,KAAK,QAAQ,CAC/F,CAAC;AACJ,CAAC","sourcesContent":["/** caller-keyed canonical JSON cache 的公开存储边界。 */\nimport { createHash, randomUUID } from \"node:crypto\";\nimport { promises as fs } from \"node:fs\";\nimport { isAbsolute, join } from \"node:path\";\n\nimport {\n  canonicalizeJsonObject,\n  canonicalJsonBytes,\n  type CanonicalJsonObject\n} from \"../../data-boundary/canonical-data.ts\";\nimport { snapshotExactClosedRecord } from \"../../data-boundary/closed-values.ts\";\n\nconst CACHE_API_VERSION = \"caller-keyed-json-v1\";\nconst CACHE_ENVELOPE_KEYS = [\"cacheFormatVersion\", \"identityDigest\", \"payload\"] as const;\n\n/**\n * `cacheJsonByKey` 的 caller-owned identity、payload parser 与 computation。\n *\n * `key` 必须覆盖所有会改变 computation 结果的输入、实现、options、toolchain 与声明的外部状态；\n * 不能放入 secret 或低熵敏感值。`directory` 是调用方信任、可自行删除的本地状态空间。\n */\ntype NonThenable<T extends object> = T & Readonly<{ readonly then?: undefined }>;\n\n/** Caller-keyed JSON cache 的 options。 */\nexport interface CacheJsonByKeyOptions<T extends object> {\n  /** cache miss、读取失败或 payload 无效时执行的 sync/async computation。 */\n  readonly compute: () => unknown;\n  /** 调用方信任、可自行清理的 absolute local directory。 */\n  readonly directory: string;\n  /** 覆盖所有影响 computation 结果的完整 semantic key；不得包含 secret 或低熵敏感值。 */\n  readonly key: string;\n  /** 调用方为这一类缓存选择的非空 identity namespace。 */\n  readonly namespace: string;\n  /** 同步验证 cached/computed canonical JSON object，并返回调用方的 typed value。 */\n  readonly parse: (value: unknown) => NonThenable<T>;\n  /** 调用方控制、在 payload 或 computation contract 改变时更新的非空版本。 */\n  readonly version: string;\n}\n\n/** `cacheJsonByKey` 返回的闭合 cache observation 与本次 parser value。 */\nexport type CacheJsonByKeyResult<T extends object> =\n  | Readonly<{\n      /** 已读取并通过 parser 验证现有 payload。 */\n      readonly read: \"hit\";\n      /** 本次 value 来自 cache，不调用 `compute`。 */\n      readonly source: \"cache\";\n      /** `parse` 返回的调用方 typed value。 */\n      readonly value: T;\n      /** cache hit 不尝试重新写入。 */\n      readonly write: \"not-attempted\";\n    }>\n  | Readonly<{\n      /** 没有 entry、读取失败，或已有 payload 未通过 identity/parser 验证。 */\n      readonly read: \"failed\" | \"invalid\" | \"miss\";\n      /** 本次 value 来自成功的 `compute` 与 `parse`。 */\n      readonly source: \"computed\";\n      /** `parse` 返回的调用方 typed value。 */\n      readonly value: T;\n      /** 新 payload 已存储，或存储失败但 typed value 仍可使用。 */\n      readonly write: \"failed\" | \"stored\";\n    }>;\n\n/**\n * 按 caller 提供的完整 semantic key 复用本地 canonical JSON object。\n *\n * cache hit 不会跳过或重放 Check settlement、Records、messages、duration 或 side effects。读取或写入失败\n * 只通过返回的 observation 可见；只要 `compute` 与 `parse` 成功，就仍返回本次 computation 的 value。\n * 不提供依赖发现、默认目录、lock/single-flight、TTL/LRU、cleanup、remote cache 或 tamper protection。\n */\nexport async function cacheJsonByKey<T extends object>(\n  authoredOptions: CacheJsonByKeyOptions<T>\n): Promise<CacheJsonByKeyResult<T>> {\n  const options = parseOptions(authoredOptions);\n  const identityDigest = cacheIdentityDigest(options);\n  const targetPath = join(options.directory, `${identityDigest}.json`);\n  const cached = await readCacheEntry({ identityDigest, parse: options.parse, targetPath });\n  if (cached.hit) {\n    return Object.freeze({\n      read: \"hit\",\n      source: \"cache\",\n      value: cached.value,\n      write: \"not-attempted\"\n    });\n  }\n\n  const payload = canonicalizeJsonObject(await options.compute());\n  if (payload === undefined) {\n    throw new TypeError(\"cacheJsonByKey compute must return a canonical JSON object\");\n  }\n  const value = parseSynchronously(options.parse, payload, \"computed value\");\n  const stored = await publishCacheEntry({\n    directory: options.directory,\n    identityDigest,\n    parse: options.parse,\n    payload,\n    targetPath\n  });\n  return Object.freeze({\n    read: cached.read,\n    source: \"computed\",\n    value,\n    write: stored ? \"stored\" : \"failed\"\n  });\n}\n\ntype ParsedOptions<T extends object> = Readonly<{\n  readonly compute: () => unknown;\n  readonly directory: string;\n  readonly key: string;\n  readonly namespace: string;\n  readonly parse: (value: unknown) => T;\n  readonly version: string;\n}>;\n\nfunction parseOptions<T extends object>(value: CacheJsonByKeyOptions<T>): ParsedOptions<T> {\n  const record = snapshotExactClosedRecord(value, [\n    \"compute\",\n    \"directory\",\n    \"key\",\n    \"namespace\",\n    \"parse\",\n    \"version\"\n  ]);\n  if (record === undefined) {\n    throw new TypeError(\"cacheJsonByKey options must be a closed object\");\n  }\n  const { compute, directory, key, namespace, parse, version } = record;\n  if (typeof compute !== \"function\" || typeof parse !== \"function\") {\n    throw new TypeError(\"cacheJsonByKey compute and parse must be functions\");\n  }\n  if (\n    typeof directory !== \"string\" ||\n    directory.length === 0 ||\n    directory.includes(\"\\0\") ||\n    !isAbsolute(directory)\n  ) {\n    throw new TypeError(\n      \"cacheJsonByKey directory must be a non-empty absolute path without U+0000\"\n    );\n  }\n  if (typeof namespace !== \"string\" || namespace.length === 0) {\n    throw new TypeError(\"cacheJsonByKey namespace must be a non-empty string\");\n  }\n  if (typeof version !== \"string\" || version.length === 0) {\n    throw new TypeError(\"cacheJsonByKey version must be a non-empty string\");\n  }\n  if (typeof key !== \"string\" || key.length === 0) {\n    throw new TypeError(\"cacheJsonByKey key must be a non-empty string\");\n  }\n  const typedOptions: ParsedOptions<T> = {\n    compute: value.compute,\n    directory: value.directory,\n    key: value.key,\n    namespace: value.namespace,\n    parse: value.parse,\n    version: value.version\n  };\n  if (\n    typedOptions.compute !== compute ||\n    typedOptions.directory !== directory ||\n    typedOptions.key !== key ||\n    typedOptions.namespace !== namespace ||\n    typedOptions.parse !== parse ||\n    typedOptions.version !== version\n  ) {\n    throw new TypeError(\"cacheJsonByKey options changed during validation\");\n  }\n  return Object.freeze(typedOptions);\n}\n\nfunction cacheIdentityDigest(options: ParsedOptions<object>): string {\n  return createHash(\"sha256\")\n    .update(\n      canonicalJsonBytes({\n        cacheApiVersion: CACHE_API_VERSION,\n        key: options.key,\n        namespace: options.namespace,\n        payloadVersion: options.version\n      })\n    )\n    .digest(\"hex\");\n}\n\ntype CacheRead<T extends object> =\n  | Readonly<{ readonly hit: true; readonly value: T }>\n  | Readonly<{ readonly hit: false; readonly read: \"failed\" | \"invalid\" | \"miss\" }>;\n\nasync function readCacheEntry<T extends object>(\n  input: Readonly<{\n    readonly identityDigest: string;\n    readonly parse: (value: unknown) => T;\n    readonly targetPath: string;\n  }>\n): Promise<CacheRead<T>> {\n  let source: string;\n  try {\n    source = await fs.readFile(input.targetPath, \"utf8\");\n  } catch (error: unknown) {\n    return isMissingPath(error)\n      ? Object.freeze({ hit: false, read: \"miss\" })\n      : Object.freeze({ hit: false, read: \"failed\" });\n  }\n  try {\n    const envelope = parseEnvelope(JSON.parse(source), input.identityDigest);\n    if (envelope === undefined) return Object.freeze({ hit: false, read: \"invalid\" });\n    return Object.freeze({\n      hit: true,\n      value: parseSynchronously(input.parse, envelope.payload, \"cached payload\")\n    });\n  } catch {\n    return Object.freeze({ hit: false, read: \"invalid\" });\n  }\n}\n\nfunction parseEnvelope(\n  value: unknown,\n  identityDigest: string\n): Readonly<{ readonly payload: CanonicalJsonObject }> | undefined {\n  const record = snapshotExactClosedRecord(value, CACHE_ENVELOPE_KEYS);\n  if (record === undefined) return undefined;\n  if (record.cacheFormatVersion !== CACHE_API_VERSION || record.identityDigest !== identityDigest) {\n    return undefined;\n  }\n  const payload = canonicalizeJsonObject(record.payload);\n  return payload === undefined ? undefined : Object.freeze({ payload });\n}\n\nfunction parseSynchronously<T extends object>(\n  parse: (value: unknown) => T,\n  payload: CanonicalJsonObject,\n  subject: string\n): T {\n  const value = parse(payload);\n  if (isThenable(value))\n    throw new TypeError(`cacheJsonByKey parse must synchronously return ${subject}`);\n  return value;\n}\n\nfunction isThenable(value: unknown): boolean {\n  return (\n    ((typeof value === \"object\" && value !== null) || typeof value === \"function\") &&\n    typeof (value as { then?: unknown }).then === \"function\"\n  );\n}\n\nasync function publishCacheEntry<T extends object>(\n  input: Readonly<{\n    readonly directory: string;\n    readonly identityDigest: string;\n    readonly parse: (value: unknown) => T;\n    readonly payload: CanonicalJsonObject;\n    readonly targetPath: string;\n  }>\n): Promise<boolean> {\n  const temporaryPath = join(input.directory, `.vibe-check-cache-${randomUUID()}.tmp`);\n  try {\n    await fs.mkdir(input.directory, { recursive: true });\n    await fs.writeFile(\n      temporaryPath,\n      JSON.stringify({\n        cacheFormatVersion: CACHE_API_VERSION,\n        identityDigest: input.identityDigest,\n        payload: input.payload\n      }),\n      { encoding: \"utf8\", flag: \"wx\" }\n    );\n  } catch {\n    await fs.rm(temporaryPath, { force: true }).catch(() => undefined);\n    return false;\n  }\n\n  try {\n    await fs.rename(temporaryPath, input.targetPath);\n    return true;\n  } catch (error: unknown) {\n    if (isConcurrentTargetConflict(error)) {\n      const concurrent = await readCacheEntry({\n        identityDigest: input.identityDigest,\n        parse: input.parse,\n        targetPath: input.targetPath\n      });\n      await fs.rm(temporaryPath, { force: true }).catch(() => undefined);\n      return concurrent.hit;\n    }\n    await fs.rm(temporaryPath, { force: true }).catch(() => undefined);\n    return false;\n  }\n}\n\nfunction isConcurrentTargetConflict(error: unknown): boolean {\n  return (\n    typeof error === \"object\" && error !== null && (error as { code?: unknown }).code === \"EEXIST\"\n  );\n}\n\nfunction isMissingPath(error: unknown): boolean {\n  return (\n    typeof error === \"object\" && error !== null && (error as { code?: unknown }).code === \"ENOENT\"\n  );\n}\n"]}

package/dist/esm/package-tools/finding-presentation/finding-presentation.mjs

@@ -0,0 +1,40 @@
+/**
+ * 将调用方已经稳定排序的 Finding 投影为有界 Check messages。
+ *
+ * `limit`、安全字段和超限后的深入查看说明都由 producing Check 决定。Product 不读取 Finding
+ * shape，也不猜测完整明细位于 Records、artifact、transcript 或其它位置。
+ */
+export function presentCheckFindings(input) {
+    assertFindingLimit(input.limit);
+    if (input.findings.length === 0)
+        return Object.freeze([]);
+    const presentedFindings = input.findings.slice(0, input.limit);
+    const messages = presentedFindings.map((finding, index) => Object.freeze({ ...input.message(finding, index) }));
+    const omittedFindings = Object.freeze(input.findings.slice(input.limit));
+    if (omittedFindings.length > 0) {
+        messages.push(Object.freeze({
+            ...input.omittedMessage(Object.freeze({
+                omittedFindings,
+                omittedCount: omittedFindings.length,
+                presentedCount: presentedFindings.length,
+                totalCount: input.findings.length
+            }))
+        }));
+    }
+    return Object.freeze(messages);
+}
+/** Appends presentation-only messages without changing the owning terminal result. */
+export function appendCheckMessages(result, messages) {
+    if (messages.length === 0)
+        return result;
+    return Object.freeze({
+        ...result,
+        messages: Object.freeze([...(result.messages ?? []), ...messages])
+    });
+}
+function assertFindingLimit(limit) {
+    if (!Number.isSafeInteger(limit) || limit < 0) {
+        throw new TypeError("Finding presentation limit must be a non-negative safe integer");
+    }
+}
+//# sourceMappingURL=finding-presentation.mjs.map

package/dist/esm/package-tools/finding-presentation/finding-presentation.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding-presentation.mjs","sourceRoot":"","sources":["../../../../src/package-tools/finding-presentation/finding-presentation.ts"],"names":[],"mappings":"AAeA;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAU,KAK7C;IACC,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAE1D,MAAM,iBAAiB,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CACxD,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,CACpD,CAAC;IACF,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACzE,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,QAAQ,CAAC,IAAI,CACX,MAAM,CAAC,MAAM,CAAC;YACZ,GAAG,KAAK,CAAC,cAAc,CACrB,MAAM,CAAC,MAAM,CAAC;gBACZ,eAAe;gBACf,YAAY,EAAE,eAAe,CAAC,MAAM;gBACpC,cAAc,EAAE,iBAAiB,CAAC,MAAM;gBACxC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;aAClC,CAAC,CACH;SACF,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,mBAAmB,CACjC,MAAyB,EACzB,QAAiC;IAEjC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACzC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,MAAM;QACT,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC;KACnE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,SAAS,CAAC,gEAAgE,CAAC,CAAC;IACxF,CAAC;AACH,CAAC","sourcesContent":["import type { CheckResult } from \"../../check/check.ts\";\n\ntype CheckMessage = NonNullable<CheckResult[\"messages\"]>[number];\n\n/**\n * 将 Check-owned Finding 投影为有界 terminal messages 所需的超限上下文。\n * 完整 Finding facts 与深入查看位置继续由调用方拥有。\n */\nexport interface FindingOverflowContext<Finding> {\n  readonly omittedFindings: readonly Finding[];\n  readonly omittedCount: number;\n  readonly presentedCount: number;\n  readonly totalCount: number;\n}\n\n/**\n * 将调用方已经稳定排序的 Finding 投影为有界 Check messages。\n *\n * `limit`、安全字段和超限后的深入查看说明都由 producing Check 决定。Product 不读取 Finding\n * shape，也不猜测完整明细位于 Records、artifact、transcript 或其它位置。\n */\nexport function presentCheckFindings<Finding>(input: {\n  readonly findings: readonly Finding[];\n  readonly limit: number;\n  readonly message: (finding: Finding, index: number) => CheckMessage;\n  readonly omittedMessage: (context: FindingOverflowContext<Finding>) => CheckMessage;\n}): readonly CheckMessage[] {\n  assertFindingLimit(input.limit);\n  if (input.findings.length === 0) return Object.freeze([]);\n\n  const presentedFindings = input.findings.slice(0, input.limit);\n  const messages = presentedFindings.map((finding, index) =>\n    Object.freeze({ ...input.message(finding, index) })\n  );\n  const omittedFindings = Object.freeze(input.findings.slice(input.limit));\n  if (omittedFindings.length > 0) {\n    messages.push(\n      Object.freeze({\n        ...input.omittedMessage(\n          Object.freeze({\n            omittedFindings,\n            omittedCount: omittedFindings.length,\n            presentedCount: presentedFindings.length,\n            totalCount: input.findings.length\n          })\n        )\n      })\n    );\n  }\n  return Object.freeze(messages);\n}\n\n/** Appends presentation-only messages without changing the owning terminal result. */\nexport function appendCheckMessages<Data extends object>(\n  result: CheckResult<Data>,\n  messages: readonly CheckMessage[]\n): CheckResult<Data> {\n  if (messages.length === 0) return result;\n  return Object.freeze({\n    ...result,\n    messages: Object.freeze([...(result.messages ?? []), ...messages])\n  });\n}\n\nfunction assertFindingLimit(limit: number): void {\n  if (!Number.isSafeInteger(limit) || limit < 0) {\n    throw new TypeError(\"Finding presentation limit must be a non-negative safe integer\");\n  }\n}\n"]}

package/dist/esm/{finding-waivers → package-tools/finding-waivers}/reconciliation.mjs

@@ -1,4 +1,4 @@
-import { canonicalizeJsonValue, canonicalJsonText } from "../data-boundary/canonical-data.mjs";
+import { canonicalizeJsonValue, canonicalJsonText } from "../../data-boundary/canonical-data.mjs";
 /**
  * 按调用方定义的语义身份对完整 finding 集合和 waiver 配置做 canonical structural reconciliation。
  *
@@ -19,8 +19,13 @@ export function reconcileFindingWaivers(options) {
     const matchedWaiverIndexes = options.findings.map((finding) => {
         const identity = canonicalIdentity(options.identify(finding), "finding identity");
         const waiverIndex = waiverIndexesByIdentity.get(identity);
-        if (waiverIndex !== undefined)
-            matchCounts[waiverIndex] += 1;
+        if (waiverIndex !== undefined) {
+            const matchCount = matchCounts[waiverIndex];
+            if (matchCount === undefined) {
+                throw new Error(`Finding waiver match index is out of range: ${waiverIndex}`);
+            }
+            matchCounts[waiverIndex] = matchCount + 1;
+        }
         return waiverIndex;
     });
     const waiverAudits = Object.freeze(waivers.map((waiver, index) => Object.freeze({
@@ -35,7 +40,7 @@ export function reconcileFindingWaivers(options) {
     }));
     return Object.freeze({ findings, waiverAudits });
 }
-function materializeWaivers(waivers) {
+function materializeWaivers(waivers = []) {
     const canonicalWaivers = canonicalizeJsonValue(waivers);
     if (canonicalWaivers === undefined || !isCanonicalArray(canonicalWaivers)) {
         throw new TypeError("Finding waivers must be canonical JSON arrays");
@@ -52,7 +57,11 @@ function materializeWaiver(value) {
     if (typeof reason !== "string" || reason.length === 0) {
         throw new TypeError("Finding waiver reasons must be non-empty strings");
     }
-    return Object.freeze({ identity: value.identity, reason });
+    const identity = value.identity;
+    if (identity === undefined) {
+        throw new TypeError("Finding waiver identity must be present");
+    }
+    return Object.freeze({ identity, reason });
 }
 function isCanonicalObject(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);

package/dist/esm/package-tools/finding-waivers/reconciliation.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconciliation.mjs","sourceRoot":"","sources":["../../../../src/package-tools/finding-waivers/reconciliation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EAGlB,MAAM,uCAAuC,CAAC;AAsE/C;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAA0D;IAE1D,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,WAAW,GAAG,IAAI,KAAK,CAAS,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9D,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1D,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QACvE,IAAI,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,SAAS,CAAC,iEAAiE,CAAC,CAAC;QACzF,CAAC;QACD,uBAAuB,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,oBAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC5D,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC,CAAC;QAClF,MAAM,WAAW,GAAG,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1D,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,UAAU,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;YAC5C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,+CAA+C,WAAW,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,WAAW,CAAC,WAAW,CAAC,GAAG,UAAU,GAAG,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAChC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAC5B,MAAM,CAAC,MAAM,CAAC;QACZ,UAAU,EAAE,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC;QACnC,MAAM,EAAE,iBAAiB,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM;KACP,CAAC,CACH,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAC5B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;QACtC,MAAM,WAAW,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QAChF,OAAO,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC,CAAC,CACH,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAO,GAAY,EAAE;IAC/C,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,gBAAgB,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,SAAS,CAAC,+CAA+C,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAyB;IAClD,IACE,CAAC,iBAAiB,CAAC,KAAK,CAAC;QACzB,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC;QACjC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,EAC/B,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,mEAAmE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAChC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAyB;IAClD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAyB;IACjD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAiB,EAAE,IAAY;IACxD,IAAI,CAAC;QACH,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,SAAS,CAAC,WAAW,IAAI,yBAAyB,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,UAAkB;IAC3C,IAAI,UAAU,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACtC,OAAO,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC;AACtD,CAAC;AAED,SAAS,iBAAiB,CACxB,OAAgB,EAChB,KAAqC;IAErC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;IACtF,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC;AAChE,CAAC","sourcesContent":["import {\n  canonicalizeJsonValue,\n  canonicalJsonText,\n  type CanonicalJsonObject,\n  type CanonicalJsonValue\n} from \"../../data-boundary/canonical-data.ts\";\n\n/** 由采用方声明、用于匹配一个 finding 的语义身份与豁免理由。 */\nexport interface FindingWaiver<Identity> {\n  /** 调用方定义的稳定 finding 身份；匹配时按 canonical JSON 结构比较。 */\n  readonly identity: Identity;\n  /** 解释该 finding 在当前范围内可被豁免的非空理由。 */\n  readonly reason: string;\n}\n\n/** helper 安全 materialize 后保留的 waiver evidence；identity 是 detached canonical JSON。 */\nexport interface MaterializedFindingWaiver {\n  /** 从 authored identity materialize 的 detached、deep-frozen canonical JSON。 */\n  readonly identity: CanonicalJsonValue;\n  /** 从 authored reason materialize 的非空理由。 */\n  readonly reason: string;\n}\n\n/** 一项 finding waiver 的配置与匹配次数审计。 */\nexport interface FindingWaiverAudit {\n  /** 被审计的 materialized authored waiver evidence，而非调用方可变输入引用。 */\n  readonly waiver: MaterializedFindingWaiver;\n  /** 该 waiver identity 在完整 finding 集合中匹配到的数量。 */\n  readonly matchCount: number;\n  /** 未使用、正常应用，或因过宽而没有应用。 */\n  readonly status: \"unused\" | \"applied\" | \"overmatched\";\n}\n\n/** reconciliation 后单个 finding 的可执行处置；只有 `waived` branch 携带 matched waiver。 */\nexport type ReconciledFinding<Finding> = Readonly<\n  | {\n      /** 原始 finding；helper 不解释或改写它的领域字段。 */\n      readonly finding: Finding;\n      /** 没有匹配 waiver 的正常待处理 finding。 */\n      readonly disposition: \"actionable\";\n    }\n  | {\n      /** 原始 finding；helper 不解释或改写它的领域字段。 */\n      readonly finding: Finding;\n      /** 恰好匹配一项 waiver 的 finding。 */\n      readonly disposition: \"waived\";\n      /** applied waiver 的身份和理由。 */\n      readonly waiver: MaterializedFindingWaiver;\n    }\n  | {\n      /** 原始 finding；helper 不解释或改写它的领域字段。 */\n      readonly finding: Finding;\n      /** `overmatched` 保持为待处理，避免宽泛 waiver 静默覆盖多个 finding。 */\n      readonly disposition: \"overmatched\";\n    }\n>;\n\n/** 调用方提供完整候选集、身份识别器和 waiver 配置的输入。 */\nexport interface ReconcileFindingWaiversOptions<Finding, Identity> {\n  /** 必须是完整 finding 候选集合，helper 才能审计每项 waiver 的匹配次数。 */\n  readonly findings: readonly Finding[];\n  /** 从完整 finding 提取调用方选择的稳定语义身份。 */\n  readonly identify: (finding: Finding) => Identity;\n  /** 要对账的 waiver；省略或 undefined 等同于空数组，仍验证全部 finding identity。 */\n  readonly waivers?: readonly FindingWaiver<Identity>[] | undefined;\n}\n\n/** 独立 waiver reconciliation 的完整输出，保留 finding 处置和每项配置审计。 */\nexport interface FindingWaiverReconciliation<Finding> {\n  /** 与 input finding 顺序相同的 reconciliation 结果。 */\n  readonly findings: readonly ReconciledFinding<Finding>[];\n  /** 与 input waiver 顺序相同的完整配置审计。 */\n  readonly waiverAudits: readonly FindingWaiverAudit[];\n}\n\n/**\n * 按调用方定义的语义身份对完整 finding 集合和 waiver 配置做 canonical structural reconciliation。\n *\n * 每项 waiver 必须有唯一、可 canonicalize 的 identity 和非空 reason。匹配零项时产生 `unused` 审计；\n * 匹配一项时该 finding 为 `waived`；匹配多项时产生 `overmatched` 审计，相关 finding 保持待处理。\n */\nexport function reconcileFindingWaivers<Finding, Identity>(\n  options: ReconcileFindingWaiversOptions<Finding, Identity>\n): FindingWaiverReconciliation<Finding> {\n  const waivers = materializeWaivers(options.waivers);\n  const matchCounts = new Array<number>(waivers.length).fill(0);\n  const waiverIndexesByIdentity = new Map<string, number>();\n  for (const [index, waiver] of waivers.entries()) {\n    const identity = canonicalIdentity(waiver.identity, \"waiver identity\");\n    if (waiverIndexesByIdentity.has(identity)) {\n      throw new TypeError(\"Finding waivers must not declare duplicate canonical identities\");\n    }\n    waiverIndexesByIdentity.set(identity, index);\n  }\n\n  const matchedWaiverIndexes = options.findings.map((finding) => {\n    const identity = canonicalIdentity(options.identify(finding), \"finding identity\");\n    const waiverIndex = waiverIndexesByIdentity.get(identity);\n    if (waiverIndex !== undefined) {\n      const matchCount = matchCounts[waiverIndex];\n      if (matchCount === undefined) {\n        throw new Error(`Finding waiver match index is out of range: ${waiverIndex}`);\n      }\n      matchCounts[waiverIndex] = matchCount + 1;\n    }\n    return waiverIndex;\n  });\n  const waiverAudits = Object.freeze(\n    waivers.map((waiver, index) =>\n      Object.freeze({\n        matchCount: matchCounts[index] ?? 0,\n        status: waiverAuditStatus(matchCounts[index] ?? 0),\n        waiver\n      })\n    )\n  );\n  const findings = Object.freeze(\n    options.findings.map((finding, index) => {\n      const waiverIndex = matchedWaiverIndexes[index];\n      const audit = waiverIndex === undefined ? undefined : waiverAudits[waiverIndex];\n      return reconciledFinding(finding, audit);\n    })\n  );\n  return Object.freeze({ findings, waiverAudits });\n}\n\nfunction materializeWaivers(waivers: unknown = []): readonly MaterializedFindingWaiver[] {\n  const canonicalWaivers = canonicalizeJsonValue(waivers);\n  if (canonicalWaivers === undefined || !isCanonicalArray(canonicalWaivers)) {\n    throw new TypeError(\"Finding waivers must be canonical JSON arrays\");\n  }\n  return Object.freeze(canonicalWaivers.map(materializeWaiver));\n}\n\nfunction materializeWaiver(value: CanonicalJsonValue): MaterializedFindingWaiver {\n  if (\n    !isCanonicalObject(value) ||\n    !Object.hasOwn(value, \"identity\") ||\n    !Object.hasOwn(value, \"reason\")\n  ) {\n    throw new TypeError(\"Finding waivers must declare canonical identity and reason fields\");\n  }\n  const reason = value.reason;\n  if (typeof reason !== \"string\" || reason.length === 0) {\n    throw new TypeError(\"Finding waiver reasons must be non-empty strings\");\n  }\n  const identity = value.identity;\n  if (identity === undefined) {\n    throw new TypeError(\"Finding waiver identity must be present\");\n  }\n  return Object.freeze({ identity, reason });\n}\n\nfunction isCanonicalObject(value: CanonicalJsonValue): value is CanonicalJsonObject {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction isCanonicalArray(value: CanonicalJsonValue): value is readonly CanonicalJsonValue[] {\n  return Array.isArray(value);\n}\n\nfunction canonicalIdentity(identity: unknown, kind: string): string {\n  try {\n    return canonicalJsonText(identity);\n  } catch {\n    throw new TypeError(`Finding ${kind} must be canonical JSON`);\n  }\n}\n\nfunction waiverAuditStatus(matchCount: number): FindingWaiverAudit[\"status\"] {\n  if (matchCount === 0) return \"unused\";\n  return matchCount === 1 ? \"applied\" : \"overmatched\";\n}\n\nfunction reconciledFinding<Finding>(\n  finding: Finding,\n  audit: FindingWaiverAudit | undefined\n): ReconciledFinding<Finding> {\n  if (audit === undefined) return Object.freeze({ disposition: \"actionable\", finding });\n  if (audit.status === \"applied\") {\n    return Object.freeze({ disposition: \"waived\", finding, waiver: audit.waiver });\n  }\n  return Object.freeze({ disposition: \"overmatched\", finding });\n}\n"]}

package/dist/esm/package-tools/learned-critical-path/critical-path-ranking.mjs

@@ -0,0 +1,46 @@
+/** Computes directed dependsOn + observes downstream scores once before Scheduler admission. */
+export function createSchedulerCriticalPathSnapshot(graph, prediction) {
+    const downstreamByTaskId = new Map();
+    for (const task of graph.tasks)
+        downstreamByTaskId.set(task.taskId, new Set());
+    for (const task of graph.tasks) {
+        for (const upstreamTaskId of [...task.dependsOn, ...task.observes]) {
+            const downstream = downstreamByTaskId.get(upstreamTaskId);
+            if (downstream === undefined) {
+                throw new TypeError(`critical path graph has unknown task ${upstreamTaskId}`);
+            }
+            downstream.add(task.taskId);
+        }
+    }
+    const scoreByTaskId = new Map();
+    const visitingTaskIds = new Set();
+    const scoreFor = (taskId) => {
+        const existing = scoreByTaskId.get(taskId);
+        if (existing !== undefined)
+            return existing;
+        if (visitingTaskIds.has(taskId))
+            throw new TypeError("critical path graph must be acyclic");
+        const taskPrediction = prediction.predictions.find((entry) => entry.taskId === taskId);
+        if (taskPrediction === undefined)
+            throw new TypeError(`critical path prediction missing task ${taskId}`);
+        visitingTaskIds.add(taskId);
+        let greatestDownstreamScore = 0;
+        for (const downstreamTaskId of downstreamByTaskId.get(taskId) ?? []) {
+            greatestDownstreamScore = Math.max(greatestDownstreamScore, scoreFor(downstreamTaskId));
+        }
+        visitingTaskIds.delete(taskId);
+        const score = saturatingSum(taskPrediction.estimatedDurationMs, greatestDownstreamScore);
+        scoreByTaskId.set(taskId, score);
+        return score;
+    };
+    return Object.freeze({
+        scores: Object.freeze(graph.tasks.map((task) => Object.freeze({ criticalPathScore: scoreFor(task.taskId), taskId: task.taskId })))
+    });
+}
+export function criticalPathScoreForTask(snapshot, taskId) {
+    return snapshot.scores.find((score) => score.taskId === taskId)?.criticalPathScore;
+}
+function saturatingSum(left, right) {
+    return left > Number.MAX_SAFE_INTEGER - right ? Number.MAX_SAFE_INTEGER : left + right;
+}
+//# sourceMappingURL=critical-path-ranking.mjs.map

package/dist/esm/package-tools/learned-critical-path/critical-path-ranking.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"critical-path-ranking.mjs","sourceRoot":"","sources":["../../../../src/package-tools/learned-critical-path/critical-path-ranking.ts"],"names":[],"mappings":"AAoBA,gGAAgG;AAChG,MAAM,UAAU,mCAAmC,CACjD,KAA6B,EAC7B,UAAmD;IAEnD,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC1D,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK;QAAE,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,EAAU,CAAC,CAAC;IACvF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,KAAK,MAAM,cAAc,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnE,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAC1D,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,MAAM,IAAI,SAAS,CAAC,wCAAwC,cAAc,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAChD,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAU,EAAE;QAC1C,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;QAC5C,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAC;QAC5F,MAAM,cAAc,GAAG,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QACvF,IAAI,cAAc,KAAK,SAAS;YAC9B,MAAM,IAAI,SAAS,CAAC,yCAAyC,MAAM,EAAE,CAAC,CAAC;QACzE,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,uBAAuB,GAAG,CAAC,CAAC;QAChC,KAAK,MAAM,gBAAgB,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YACpE,uBAAuB,GAAG,IAAI,CAAC,GAAG,CAAC,uBAAuB,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAC1F,CAAC;QACD,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,aAAa,CAAC,cAAc,CAAC,mBAAmB,EAAE,uBAAuB,CAAC,CAAC;QACzF,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM,CACnB,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACvB,MAAM,CAAC,MAAM,CAAC,EAAE,iBAAiB,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CACjF,CACF;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,QAAuC,EACvC,MAAc;IAEd,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,iBAAiB,CAAC;AACrF,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,KAAa;IAChD,OAAO,IAAI,GAAG,MAAM,CAAC,gBAAgB,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;AACzF,CAAC","sourcesContent":["import type { SchedulerGraphSnapshot } from \"../../project-definition/project-definition.ts\";\n\n/** The pure ranking algorithm only needs immutable estimated durations keyed by Task ID. */\nexport interface SchedulerCriticalPathPredictionSnapshot {\n  readonly predictions: readonly Readonly<{\n    readonly estimatedDurationMs: number;\n    readonly taskId: string;\n  }>[];\n}\n\nexport interface SchedulerCriticalPathScore {\n  readonly criticalPathScore: number;\n  readonly taskId: string;\n}\n\n/** A graph-derived immutable score table; it retains no dependency or authored-input payload. */\nexport interface SchedulerCriticalPathSnapshot {\n  readonly scores: readonly SchedulerCriticalPathScore[];\n}\n\n/** Computes directed dependsOn + observes downstream scores once before Scheduler admission. */\nexport function createSchedulerCriticalPathSnapshot(\n  graph: SchedulerGraphSnapshot,\n  prediction: SchedulerCriticalPathPredictionSnapshot\n): SchedulerCriticalPathSnapshot {\n  const downstreamByTaskId = new Map<string, Set<string>>();\n  for (const task of graph.tasks) downstreamByTaskId.set(task.taskId, new Set<string>());\n  for (const task of graph.tasks) {\n    for (const upstreamTaskId of [...task.dependsOn, ...task.observes]) {\n      const downstream = downstreamByTaskId.get(upstreamTaskId);\n      if (downstream === undefined) {\n        throw new TypeError(`critical path graph has unknown task ${upstreamTaskId}`);\n      }\n      downstream.add(task.taskId);\n    }\n  }\n\n  const scoreByTaskId = new Map<string, number>();\n  const visitingTaskIds = new Set<string>();\n  const scoreFor = (taskId: string): number => {\n    const existing = scoreByTaskId.get(taskId);\n    if (existing !== undefined) return existing;\n    if (visitingTaskIds.has(taskId)) throw new TypeError(\"critical path graph must be acyclic\");\n    const taskPrediction = prediction.predictions.find((entry) => entry.taskId === taskId);\n    if (taskPrediction === undefined)\n      throw new TypeError(`critical path prediction missing task ${taskId}`);\n    visitingTaskIds.add(taskId);\n    let greatestDownstreamScore = 0;\n    for (const downstreamTaskId of downstreamByTaskId.get(taskId) ?? []) {\n      greatestDownstreamScore = Math.max(greatestDownstreamScore, scoreFor(downstreamTaskId));\n    }\n    visitingTaskIds.delete(taskId);\n    const score = saturatingSum(taskPrediction.estimatedDurationMs, greatestDownstreamScore);\n    scoreByTaskId.set(taskId, score);\n    return score;\n  };\n\n  return Object.freeze({\n    scores: Object.freeze(\n      graph.tasks.map((task) =>\n        Object.freeze({ criticalPathScore: scoreFor(task.taskId), taskId: task.taskId })\n      )\n    )\n  });\n}\n\nexport function criticalPathScoreForTask(\n  snapshot: SchedulerCriticalPathSnapshot,\n  taskId: string\n): number | undefined {\n  return snapshot.scores.find((score) => score.taskId === taskId)?.criticalPathScore;\n}\n\nfunction saturatingSum(left: number, right: number): number {\n  return left > Number.MAX_SAFE_INTEGER - right ? Number.MAX_SAFE_INTEGER : left + right;\n}\n"]}