@zxyycom/vibe-check 0.0.1 → 0.0.3

package/src/package-checks/function-metrics/measurement.ts

@@ -1,57 +1,244 @@
-import { acceptExactInputMeasurements } from "../project-files/exact-input-measurement.ts";
-import { checkLizard } from "./lizard/availability.ts";
-import { scanWithLizard } from "./lizard/scanner.ts";
+import { closeSync, openSync, readSync } from "node:fs";
+import { resolve } from "node:path";
+
+import type { FunctionMetricsAnalysisWorkerRequest } from "./analyzer-worker-contract.ts";
+import {
+  analyzeAdmittedSources,
+  createNodeFunctionMetricsWorker,
+  type FunctionMetricsWorkerPort
+} from "./analyzer-worker-port.ts";
 import type { FunctionMetric, FunctionMetricsExactInputSet } from "./measurement-model.ts";
-import type { ResolvedFunctionMetricsScannerOptions } from "./options.ts";
+
+const MAXIMUM_FILE_BYTES = 8 * 1024 * 1024;
+const MAXIMUM_AGGREGATE_BYTES = 64 * 1024 * 1024;
+const READ_CHUNK_BYTES = 32 * 1024;
 
 export type FunctionMeasurementResult = Readonly<
+  | { kind: "analysis-failed" }
   | { kind: "cancelled" }
   | { kind: "complete"; metrics: readonly FunctionMetric[] }
-  | { kind: "execution-failed" }
-  | { kind: "invalid-result" }
-  | { kind: "unavailable" }
+  | { kind: "resource-limit-exceeded" }
+  | { kind: "source-unavailable" }
 >;
 
 interface FunctionMeasurementInput {
-  readonly dependency: ResolvedFunctionMetricsScannerOptions;
   readonly input: FunctionMetricsExactInputSet;
   readonly signal: AbortSignal;
 }
 
-export async function measureFunctionMetrics({
-  dependency,
-  input,
-  signal
-}: FunctionMeasurementInput): Promise<FunctionMeasurementResult> {
-  if (signal.aborted) return Object.freeze({ kind: "cancelled" });
-  if (input.approvedExactPaths.length === 0) {
-    return Object.freeze({ kind: "complete", metrics: Object.freeze([]) });
-  }
-  const availability = await checkLizard(input.rootDir, dependency);
+export interface FunctionMeasurementDependencies {
+  readonly createWorker: () => FunctionMetricsWorkerPort;
+  readonly yieldAdmission: () => Promise<void>;
+}
+
+const DEFAULT_FUNCTION_MEASUREMENT_DEPENDENCIES: FunctionMeasurementDependencies = Object.freeze({
+  createWorker: createNodeFunctionMetricsWorker,
+  yieldAdmission: yieldAdmissionToTimer
+});
+
+/**
+ * The Check parent admits exactly its selected sources and bounds their bytes;
+ * one Worker only analyzes those source texts and never discovers or reads paths.
+ */
+export async function measureFunctionMetrics(
+  { input, signal }: FunctionMeasurementInput,
+  dependencies: Partial<FunctionMeasurementDependencies> = {}
+): Promise<FunctionMeasurementResult> {
+  const createWorker =
+    dependencies.createWorker ?? DEFAULT_FUNCTION_MEASUREMENT_DEPENDENCIES.createWorker;
+  const yieldAdmission =
+    dependencies.yieldAdmission ?? DEFAULT_FUNCTION_MEASUREMENT_DEPENDENCIES.yieldAdmission;
+  const admitted = await readExactFunctionSources(input, signal, yieldAdmission);
+  if (admitted.kind !== "complete") return admitted;
   if (signal.aborted) return Object.freeze({ kind: "cancelled" });
-  if (!availability.available) {
-    return Object.freeze({ kind: "unavailable" });
-  }
-  const measurement = runFunctionScanner(input, dependency);
-  return signal.aborted ? Object.freeze({ kind: "cancelled" }) : measurement;
+  return analyzeAdmittedSources(admitted.request, input.approvedExactPaths, signal, createWorker);
 }
 
-function runFunctionScanner(
+async function readExactFunctionSources(
   input: FunctionMetricsExactInputSet,
-  dependency: ResolvedFunctionMetricsScannerOptions
-): FunctionMeasurementResult {
-  const result = scanWithLizard({
-    cwd: input.rootDir,
-    dependency,
-    files: input.approvedExactPaths
+  signal: AbortSignal,
+  yieldAdmission: () => Promise<void>
+): Promise<
+  | Readonly<{ readonly kind: "cancelled" }>
+  | Readonly<{ readonly kind: "complete"; readonly request: FunctionMetricsAnalysisWorkerRequest }>
+  | Readonly<{ readonly kind: "resource-limit-exceeded" }>
+  | Readonly<{ readonly kind: "source-unavailable" }>
+> {
+  let aggregateBytes = 0;
+  const files: FunctionMetricsAnalysisWorkerRequest["files"][number][] = [];
+  for (const path of input.approvedExactPaths) {
+    if (signal.aborted) return Object.freeze({ kind: "cancelled" });
+    const source = await readBoundedSource(
+      resolve(input.rootDir, path),
+      aggregateBytes,
+      signal,
+      yieldAdmission
+    );
+    if (source.kind !== "complete") return source;
+    aggregateBytes += source.byteLength;
+    files.push(Object.freeze({ path, source: source.source }));
+  }
+  return Object.freeze({
+    kind: "complete",
+    request: Object.freeze({ files: Object.freeze(files) })
   });
-  if (!result.ok) {
+}
+
+async function readBoundedSource(
+  absolutePath: string,
+  aggregateBytes: number,
+  signal: AbortSignal,
+  yieldAdmission: () => Promise<void>
+): Promise<
+  | Readonly<{ readonly kind: "cancelled" }>
+  | Readonly<{ readonly kind: "complete"; readonly byteLength: number; readonly source: string }>
+  | Readonly<{ readonly kind: "resource-limit-exceeded" }>
+  | Readonly<{ readonly kind: "source-unavailable" }>
+> {
+  let descriptor: number;
+  try {
+    descriptor = openSync(absolutePath, "r");
+  } catch {
+    return Object.freeze({ kind: "source-unavailable" });
+  }
+  try {
+    const chunks: Buffer[] = [];
+    const chunk = Buffer.allocUnsafe(READ_CHUNK_BYTES);
+    let fileBytes = 0;
+    while (true) {
+      if (signal.aborted) return Object.freeze({ kind: "cancelled" });
+      const bytesRead = readSync(descriptor, chunk, 0, chunk.length, null);
+      if (bytesRead === 0) break;
+      fileBytes += bytesRead;
+      if (fileBytes > MAXIMUM_FILE_BYTES || aggregateBytes + fileBytes > MAXIMUM_AGGREGATE_BYTES) {
+        return Object.freeze({ kind: "resource-limit-exceeded" });
+      }
+      chunks.push(Buffer.from(chunk.subarray(0, bytesRead)));
+      if (signal.aborted) return Object.freeze({ kind: "cancelled" });
+      await yieldAdmission();
+    }
     return Object.freeze({
-      kind: result.reason === "execution" ? "execution-failed" : "invalid-result"
+      kind: "complete",
+      byteLength: fileBytes,
+      source: decodeLizardAutoRead(Buffer.concat(chunks, fileBytes))
     });
+  } catch {
+    return Object.freeze({ kind: "source-unavailable" });
+  } finally {
+    closeSync(descriptor);
+  }
+}
+
+function yieldAdmissionToTimer(): Promise<void> {
+  return new Promise<void>((resolveYield) => {
+    setTimeout(resolveYield, 0);
+  });
+}
+
+/**
+ * Product-owned replacement for Lizard 1.24 `auto_open.auto_read` at the
+ * admitted-source boundary. A valid initial UTF-8 BOM is `utf-8-sig` and text
+ * newlines are universal; a decoding failure retries the complete byte sequence
+ * with Python's `errors="ignore"`, which deliberately retains an initial BOM
+ * and raw newlines on that retry.
+ */
+export function decodeLizardAutoRead(bytes: Uint8Array): string {
+  try {
+    return new TextDecoder("utf-8", { fatal: true }).decode(bytes).replace(/\r\n?/gu, "\n");
+  } catch {
+    return decodeUtf8IgnoringInvalidBytes(bytes);
+  }
+}
+
+function decodeUtf8IgnoringInvalidBytes(bytes: Uint8Array): string {
+  let decoded = "";
+  for (let index = 0; index < bytes.length;) {
+    const codePoint = decodeUtf8CodePoint(bytes, index);
+    if (codePoint === undefined) {
+      index += 1;
+      continue;
+    }
+    decoded += String.fromCodePoint(codePoint);
+    index += utf8SequenceByteLength(codePoint);
   }
-  const accepted = acceptExactInputMeasurements(result.measurements, input.approvedExactPaths);
-  return accepted.ok
-    ? Object.freeze({ kind: "complete", metrics: Object.freeze([...accepted.payloads]) })
-    : Object.freeze({ kind: "invalid-result" });
+  return decoded;
+}
+
+function decodeUtf8CodePoint(bytes: Uint8Array, index: number): number | undefined {
+  const first = bytes[index];
+  if (first === undefined) return undefined;
+  if (first <= 0x7f) return first;
+  if (first >= 0xc2 && first <= 0xdf) return decodeTwoByteUtf8Sequence(first, bytes[index + 1]);
+  if (first >= 0xe0 && first <= 0xef) {
+    return decodeThreeByteUtf8Sequence(first, bytes[index + 1], bytes[index + 2]);
+  }
+  if (first >= 0xf0 && first <= 0xf4) {
+    return decodeFourByteUtf8Sequence(first, bytes[index + 1], bytes[index + 2], bytes[index + 3]);
+  }
+  return undefined;
+}
+
+function decodeTwoByteUtf8Sequence(first: number, second: number | undefined): number | undefined {
+  if (!isUtf8Continuation(second)) return undefined;
+  return ((first & 0x1f) << 6) | (second & 0x3f);
+}
+
+function decodeThreeByteUtf8Sequence(
+  first: number,
+  second: number | undefined,
+  third: number | undefined
+): number | undefined {
+  if (!isUtf8SecondByteForThreeByteSequence(first, second) || !isUtf8Continuation(third)) {
+    return undefined;
+  }
+  return ((first & 0x0f) << 12) | ((second & 0x3f) << 6) | (third & 0x3f);
+}
+
+function decodeFourByteUtf8Sequence(
+  first: number,
+  second: number | undefined,
+  third: number | undefined,
+  fourth: number | undefined
+): number | undefined {
+  if (
+    !isUtf8SecondByteForFourByteSequence(first, second) ||
+    !isUtf8Continuation(third) ||
+    !isUtf8Continuation(fourth)
+  ) {
+    return undefined;
+  }
+  return ((first & 0x07) << 18) | ((second & 0x3f) << 12) | ((third & 0x3f) << 6) | (fourth & 0x3f);
+}
+
+function utf8SequenceByteLength(codePoint: number): number {
+  if (codePoint <= 0x7f) return 1;
+  if (codePoint <= 0x7ff) return 2;
+  if (codePoint <= 0xffff) return 3;
+  return 4;
+}
+
+function isUtf8Continuation(value: number | undefined): value is number {
+  return value !== undefined && value >= 0x80 && value <= 0xbf;
+}
+
+function isUtf8SecondByteForThreeByteSequence(
+  first: number,
+  second: number | undefined
+): second is number {
+  return (
+    isUtf8Continuation(second) &&
+    !(first === 0xe0 && second < 0xa0) &&
+    !(first === 0xed && second > 0x9f)
+  );
+}
+
+function isUtf8SecondByteForFourByteSequence(
+  first: number,
+  second: number | undefined
+): second is number {
+  return (
+    isUtf8Continuation(second) &&
+    !(first === 0xf0 && second < 0x90) &&
+    !(first === 0xf4 && second > 0x8f)
+  );
 }

package/src/package-checks/function-metrics/options-resolution.ts

@@ -1,7 +1,5 @@
-import {
-  hasRequiredAndOptionalRecordKeys,
-  snapshotClosedRecord
-} from "../../data-boundary/closed-values.ts";
+import { snapshotClosedPolicyRecord } from "../../data-boundary/closed-values.ts";
+import { isPositiveSafeInteger } from "../../data-boundary/value-shapes.ts";
 import {
   defaultProjectFileSelection,
   resolveProjectFileSelection,
@@ -9,50 +7,51 @@ import {
 } from "../project-files/configuration.ts";
 import {
   DEFAULT_FINDING_POLICY,
+  resolveCodeAreaPolicyMap,
   resolveFindingPolicy,
   type FindingPolicy
 } from "../code-quality-findings/policy.ts";
+import { resolveFindingWaiverAuthoring } from "../code-quality-findings/finding-waiver-authoring.ts";
+import { resolveFunctionMetricsFindingIdentity } from "./finding-waiver-identity.ts";
 import {
   type ResolvedFunctionMetricsCodeAreaOptions,
   type ResolvedFunctionMetricsLimits,
   type ResolvedFunctionMetricsOptions
 } from "./options.ts";
 import { validResolvedFunctionMetricsOptions } from "./options-validation.ts";
-import { LIZARD_SUPPORTED_FILE_GLOBS } from "./target-files.ts";
+import { FUNCTION_METRICS_SUPPORTED_FILE_GLOBS } from "./target-files.ts";
 
-const DEFAULT_LIZARD_EXECUTABLE = "lizard";
 const DEFAULT_CODE_LINE_MAXIMUM = 60;
 const DEFAULT_LOW_COMPLEXITY_CODE_LINE_MAXIMUM = 180;
 const DEFAULT_LOW_COMPLEXITY_BELOW = 6;
 const DEFAULT_CYCLOMATIC_COMPLEXITY_MAXIMUM = 12;
+const DEFAULT_NESTING_DEPTH_MAXIMUM = 7;
 const DEFAULT_PARAMETER_MAXIMUM = 6;
 const DEFAULT_FILES = Object.freeze({
   exclude: defaultProjectFileSelection.exclude,
-  include: LIZARD_SUPPORTED_FILE_GLOBS,
+  include: FUNCTION_METRICS_SUPPORTED_FILE_GLOBS,
   source: defaultProjectFileSelection.source
 });
 
-interface PolicyRecordKeys {
-  readonly optional?: readonly string[];
-  readonly required?: readonly string[];
-}
-
 /** 校验 constructor input，并物化完整、冻结的 function-metrics options。 */
 export function resolveFunctionMetricsOptions(
   value: unknown
 ): ResolvedFunctionMetricsOptions | undefined {
-  const input = snapshotPolicyRecord(value, {
-    optional: ["codeAreas", "findingPolicy", "scanner"]
+  const input = snapshotClosedPolicyRecord(value, {
+    optional: ["codeAreas", "findingPolicy", "findingWaivers"]
   });
   if (input === undefined) return undefined;
 
   const findingPolicy = resolveFindingPolicy(input.findingPolicy, DEFAULT_FINDING_POLICY);
   if (findingPolicy === undefined) return undefined;
   const codeAreas = resolveCodeAreas(input.codeAreas, findingPolicy);
-  const scanner = resolveScanner(input.scanner);
-  if (codeAreas === undefined || scanner === undefined) return undefined;
+  const findingWaivers = resolveFindingWaiverAuthoring(
+    input.findingWaivers,
+    resolveFunctionMetricsFindingIdentity
+  );
+  if (codeAreas === undefined || findingWaivers === undefined) return undefined;
 
-  const options = Object.freeze({ codeAreas, scanner });
+  const options = Object.freeze({ codeAreas, findingWaivers });
   return validResolvedFunctionMetricsOptions(options) ? options : undefined;
 }
 
@@ -60,20 +59,11 @@ function resolveCodeAreas(
   value: unknown,
   defaultFindingPolicy: FindingPolicy
 ): ResolvedFunctionMetricsOptions["codeAreas"] | undefined {
-  if (value === undefined) {
-    return Object.freeze({ project: defaultCodeArea(defaultFindingPolicy) });
-  }
-  const areas = snapshotClosedRecord(value);
-  if (areas === undefined || Object.keys(areas).length === 0) return undefined;
-
-  const resolvedEntries: Array<readonly [string, ResolvedFunctionMetricsCodeAreaOptions]> = [];
-  for (const [areaId, candidate] of Object.entries(areas)) {
-    if (!nonEmptyString(areaId)) return undefined;
-    const area = resolveCodeArea(candidate, defaultFindingPolicy);
-    if (area === undefined) return undefined;
-    resolvedEntries.push([areaId, area]);
-  }
-  return Object.freeze(Object.fromEntries(resolvedEntries));
+  return resolveCodeAreaPolicyMap(
+    value,
+    () => defaultCodeArea(defaultFindingPolicy),
+    (candidate) => resolveCodeArea(candidate, defaultFindingPolicy)
+  );
 }
 
 function defaultCodeArea(findingPolicy: FindingPolicy): ResolvedFunctionMetricsCodeAreaOptions {
@@ -88,7 +78,7 @@ function resolveCodeArea(
   value: unknown,
   defaultFindingPolicy: FindingPolicy
 ): ResolvedFunctionMetricsCodeAreaOptions | undefined {
-  const area = snapshotPolicyRecord(value, {
+  const area = snapshotClosedPolicyRecord(value, {
     optional: ["findingPolicy", "limits"],
     required: ["files"]
   });
@@ -103,8 +93,8 @@ function resolveCodeArea(
 
 function resolveLimits(value: unknown): ResolvedFunctionMetricsLimits | undefined {
   if (value === undefined) return defaultLimits();
-  const limits = snapshotPolicyRecord(value, {
-    optional: ["codeLines", "cyclomaticComplexity", "parameters"]
+  const limits = snapshotClosedPolicyRecord(value, {
+    optional: ["codeLines", "cyclomaticComplexity", "nestingDepth", "parameters"]
   });
   if (limits === undefined) return undefined;
   const codeLines = resolveCodeLineLimits(limits.codeLines);
@@ -112,24 +102,30 @@ function resolveLimits(value: unknown): ResolvedFunctionMetricsLimits | undefine
     limits.cyclomaticComplexity,
     DEFAULT_CYCLOMATIC_COMPLEXITY_MAXIMUM
   );
+  const nestingDepth = resolveMaximum(limits.nestingDepth, DEFAULT_NESTING_DEPTH_MAXIMUM);
   const parameters = resolveMaximum(limits.parameters, DEFAULT_PARAMETER_MAXIMUM);
-  if (codeLines === undefined || cyclomaticComplexity === undefined || parameters === undefined) {
+  if (
+    codeLines === undefined ||
+    cyclomaticComplexity === undefined ||
+    nestingDepth === undefined ||
+    parameters === undefined
+  ) {
     return undefined;
   }
-  return Object.freeze({ codeLines, cyclomaticComplexity, parameters });
+  return Object.freeze({ codeLines, cyclomaticComplexity, nestingDepth, parameters });
 }
 
 function resolveCodeLineLimits(
   value: unknown
 ): ResolvedFunctionMetricsLimits["codeLines"] | undefined {
   if (value === undefined) return defaultLimits().codeLines;
-  const codeLines = snapshotPolicyRecord(value, {
+  const codeLines = snapshotClosedPolicyRecord(value, {
     optional: ["lowComplexityAllowance", "maximum"]
   });
   if (codeLines === undefined) return undefined;
   const maximum = codeLines.maximum ?? DEFAULT_CODE_LINE_MAXIMUM;
   const allowance = resolveLowComplexityAllowance(codeLines.lowComplexityAllowance);
-  if (!positiveSafeInteger(maximum) || allowance === undefined || allowance.maximum < maximum) {
+  if (!isPositiveSafeInteger(maximum) || allowance === undefined || allowance.maximum < maximum) {
     return undefined;
   }
   return Object.freeze({ lowComplexityAllowance: allowance, maximum });
@@ -144,14 +140,14 @@ function resolveLowComplexityAllowance(
       maximum: DEFAULT_LOW_COMPLEXITY_CODE_LINE_MAXIMUM
     });
   }
-  const allowance = snapshotPolicyRecord(value, {
+  const allowance = snapshotClosedPolicyRecord(value, {
     optional: ["cyclomaticComplexityBelow", "maximum"]
   });
   if (allowance === undefined) return undefined;
   const cyclomaticComplexityBelow =
     allowance.cyclomaticComplexityBelow ?? DEFAULT_LOW_COMPLEXITY_BELOW;
   const maximum = allowance.maximum ?? DEFAULT_LOW_COMPLEXITY_CODE_LINE_MAXIMUM;
-  return positiveSafeInteger(cyclomaticComplexityBelow) && positiveSafeInteger(maximum)
+  return isPositiveSafeInteger(cyclomaticComplexityBelow) && isPositiveSafeInteger(maximum)
     ? Object.freeze({ cyclomaticComplexityBelow, maximum })
     : undefined;
 }
@@ -161,10 +157,10 @@ function resolveMaximum(
   fallback: number
 ): Readonly<{ readonly maximum: number }> | undefined {
   if (value === undefined) return Object.freeze({ maximum: fallback });
-  const input = snapshotPolicyRecord(value, { optional: ["maximum"] });
+  const input = snapshotClosedPolicyRecord(value, { optional: ["maximum"] });
   if (input === undefined) return undefined;
   const maximum = input.maximum ?? fallback;
-  return positiveSafeInteger(maximum) ? Object.freeze({ maximum }) : undefined;
+  return isPositiveSafeInteger(maximum) ? Object.freeze({ maximum }) : undefined;
 }
 
 function defaultLimits(): ResolvedFunctionMetricsLimits {
@@ -177,39 +173,7 @@ function defaultLimits(): ResolvedFunctionMetricsLimits {
       maximum: DEFAULT_CODE_LINE_MAXIMUM
     }),
     cyclomaticComplexity: Object.freeze({ maximum: DEFAULT_CYCLOMATIC_COMPLEXITY_MAXIMUM }),
+    nestingDepth: Object.freeze({ maximum: DEFAULT_NESTING_DEPTH_MAXIMUM }),
     parameters: Object.freeze({ maximum: DEFAULT_PARAMETER_MAXIMUM })
   });
 }
-
-function resolveScanner(value: unknown): ResolvedFunctionMetricsOptions["scanner"] | undefined {
-  if (value === undefined) return Object.freeze({ executable: DEFAULT_LIZARD_EXECUTABLE });
-  const scanner = snapshotPolicyRecord(value, { optional: ["executable"] });
-  if (scanner === undefined) return undefined;
-  const executable = scanner.executable ?? DEFAULT_LIZARD_EXECUTABLE;
-  return nonEmptyString(executable) ? Object.freeze({ executable }) : undefined;
-}
-
-function snapshotPolicyRecord(
-  value: unknown,
-  keys: PolicyRecordKeys
-): Readonly<Record<string, unknown>> | undefined {
-  const record = snapshotClosedRecord(value);
-  if (
-    record === undefined ||
-    !hasRequiredAndOptionalRecordKeys(record, {
-      optional: keys.optional ?? [],
-      required: keys.required ?? []
-    })
-  ) {
-    return undefined;
-  }
-  return record;
-}
-
-function positiveSafeInteger(value: unknown): value is number {
-  return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
-}
-
-function nonEmptyString(value: unknown): value is string {
-  return typeof value === "string" && value.length > 0;
-}

package/src/package-checks/function-metrics/options-validation.ts

@@ -1,15 +1,23 @@
-import { snapshotClosedRecord } from "../../data-boundary/closed-values.ts";
+import {
+  snapshotClosedRecord,
+  snapshotExactClosedRecord
+} from "../../data-boundary/closed-values.ts";
+import { isNonEmptyString, isPositiveSafeInteger } from "../../data-boundary/value-shapes.ts";
 import { validProjectFileSelection } from "../project-files/configuration.ts";
 import { validFindingPolicy } from "../code-quality-findings/policy.ts";
+import { validResolvedFindingWaivers } from "../code-quality-findings/finding-waiver-authoring.ts";
+import { resolveFunctionMetricsFindingIdentity } from "./finding-waiver-identity.ts";
 import type { ResolvedFunctionMetricsOptions } from "./options.ts";
 
 /** 验证 constructor 已物化的完整 function-metrics options。 */
 export function validResolvedFunctionMetricsOptions(
   value: unknown
 ): value is ResolvedFunctionMetricsOptions {
-  const options = exactRecord(value, ["codeAreas", "scanner"]);
+  const options = snapshotExactClosedRecord(value, ["codeAreas", "findingWaivers"]);
   return (
-    options !== undefined && validCodeAreas(options.codeAreas) && validScanner(options.scanner)
+    options !== undefined &&
+    validCodeAreas(options.codeAreas) &&
+    validResolvedFindingWaivers(options.findingWaivers, resolveFunctionMetricsFindingIdentity)
   );
 }
 
@@ -17,9 +25,9 @@ function validCodeAreas(value: unknown): boolean {
   const areas = snapshotClosedRecord(value);
   if (areas === undefined || Object.keys(areas).length === 0) return false;
   return Object.entries(areas).every(([areaId, candidate]) => {
-    const area = exactRecord(candidate, ["files", "findingPolicy", "limits"]);
+    const area = snapshotExactClosedRecord(candidate, ["files", "findingPolicy", "limits"]);
     return (
-      nonEmptyString(areaId) &&
+      isNonEmptyString(areaId) &&
       area !== undefined &&
       validProjectFileSelection(area.files) &&
       validFindingPolicy(area.findingPolicy) &&
@@ -29,61 +37,44 @@ function validCodeAreas(value: unknown): boolean {
 }
 
 function validLimits(value: unknown): boolean {
-  const limits = exactRecord(value, ["codeLines", "cyclomaticComplexity", "parameters"]);
+  const limits = snapshotExactClosedRecord(value, [
+    "codeLines",
+    "cyclomaticComplexity",
+    "nestingDepth",
+    "parameters"
+  ]);
   if (limits === undefined) return false;
   const codeLineLimits = codeLineLimitsFrom(limits.codeLines);
   const cyclomaticComplexity = maximumLimitFrom(limits.cyclomaticComplexity);
+  const nestingDepth = maximumLimitFrom(limits.nestingDepth);
   const parameters = maximumLimitFrom(limits.parameters);
   return (
     codeLineLimits !== undefined &&
     cyclomaticComplexity !== undefined &&
+    nestingDepth !== undefined &&
     parameters !== undefined &&
-    positiveSafeInteger(cyclomaticComplexity.maximum) &&
-    positiveSafeInteger(parameters.maximum)
+    isPositiveSafeInteger(cyclomaticComplexity.maximum) &&
+    isPositiveSafeInteger(nestingDepth.maximum) &&
+    isPositiveSafeInteger(parameters.maximum)
   );
 }
 
 function codeLineLimitsFrom(value: unknown): Readonly<Record<string, unknown>> | undefined {
-  const codeLines = exactRecord(value, ["lowComplexityAllowance", "maximum"]);
-  const allowance = exactRecord(codeLines?.lowComplexityAllowance, [
+  const codeLines = snapshotExactClosedRecord(value, ["lowComplexityAllowance", "maximum"]);
+  const allowance = snapshotExactClosedRecord(codeLines?.lowComplexityAllowance, [
     "cyclomaticComplexityBelow",
     "maximum"
   ]);
   return codeLines !== undefined &&
     allowance !== undefined &&
-    positiveSafeInteger(codeLines.maximum) &&
-    positiveSafeInteger(allowance.maximum) &&
+    isPositiveSafeInteger(codeLines.maximum) &&
+    isPositiveSafeInteger(allowance.maximum) &&
     allowance.maximum >= codeLines.maximum &&
-    positiveSafeInteger(allowance.cyclomaticComplexityBelow)
+    isPositiveSafeInteger(allowance.cyclomaticComplexityBelow)
     ? codeLines
     : undefined;
 }
 
 function maximumLimitFrom(value: unknown): Readonly<Record<string, unknown>> | undefined {
-  return exactRecord(value, ["maximum"]);
-}
-
-function validScanner(value: unknown): boolean {
-  const scanner = exactRecord(value, ["executable"]);
-  return scanner !== undefined && nonEmptyString(scanner.executable);
-}
-
-function exactRecord(
-  value: unknown,
-  keys: readonly string[]
-): Readonly<Record<string, unknown>> | undefined {
-  const record = snapshotClosedRecord(value);
-  return record !== undefined &&
-    Object.keys(record).length === keys.length &&
-    keys.every((key) => Object.hasOwn(record, key))
-    ? record
-    : undefined;
-}
-
-function positiveSafeInteger(value: unknown): value is number {
-  return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
-}
-
-function nonEmptyString(value: unknown): value is string {
-  return typeof value === "string" && value.length > 0;
+  return snapshotExactClosedRecord(value, ["maximum"]);
 }