npm - @zxyycom/vibe-check - Versions diffs - 0.0.2 → 0.0.3 - Mend

@zxyycom/vibe-check 0.0.2 → 0.0.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (670) hide show

package/dist/esm/package-checks/secret-detection/execution.mjs CHANGED Viewed

@@ -1,5 +1,5 @@
-import { appendCheckMessages } from "../../check/finding-presentation.mjs";
-import { reconcileFindingWaivers } from "../../finding-waivers/reconciliation.mjs";
+import { appendCheckMessages } from "../../package-tools/finding-presentation/finding-presentation.mjs";
+import { reconcileFindingWaivers } from "../../package-tools/finding-waivers/reconciliation.mjs";
 import { reportFindingWaiverAudits } from "../code-quality-findings/finding-waiver-evidence.mjs";
 import { collectProjectFiles } from "../project-files/collection.mjs";
 import { prepareSecretDetectionInputs } from "./input-preparation.mjs";

package/dist/esm/package-checks/secret-detection/execution.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"execution.mjs","sourceRoot":"","sources":["../../../../src/package-checks/secret-detection/execution.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAErE,OAAO,EACL,4BAA4B,EAG7B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,qBAAqB,EACrB,qBAAqB,EAGtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,sBAAsB,EAA6B,MAAM,yBAAyB,CAAC;AAC5F,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAEtE,MAAM,CAAC,MAAM,iCAAiC,GAAG;IAC/C,OAAO,EAAE,kBAAkB;IAC3B,WAAW,EAAE,kBAAkB;CACvB,CAAC;AAWX,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAA8D;IAE9D,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,WAAW,CAAC,iBAAiB,CAAC,CAAC;IACzF,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,WAAW,CAAC,qBAAqB,CAAC,CAAC;IAEtE,IAAI,aAAgC,CAAC;IACrC,IAAI,CAAC;QACH,aAAa,GAAG,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC,wBAAwB,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,WAAW,CAAC,qBAAqB,CAAC,CAAC;IACtE,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAC5B,OAAO,6BAA6B,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAE9E,MAAM,QAAQ,GAAG,4BAA4B,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACtE,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa;QAAE,OAAO,WAAW,CAAC,oBAAoB,CAAC,CAAC;IAC9E,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,WAAW,CAAC,qBAAqB,CAAC,CAAC;IAE7E,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtE,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa;QAAE,OAAO,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACvE,OAAO,6BAA6B,CAClC,OAAO,EACP,aAAa,CAAC,MAAM,EACpB,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,YAAY,CACtB,CAAC;AACJ,CAAC;AAOD,KAAK,UAAU,oBAAoB,CACjC,OAA8D,EAC9D,MAAoC;IAEpC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;YACxB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QAC7E,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACzE,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;YACxB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QAC7E,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACpC,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACxC,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,OAA8D,EAC9D,iBAAyB,EACzB,MAAuC,EACvC,YAA0C;IAE1C,MAAM,cAAc,GAAG,uBAAuB,CAAC;QAC7C,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,qBAAqB;QAC/B,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc;KACxC,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,cAAc,CAAC,QAAQ,CAAC,MAAM,CACvD,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,KAAK,QAAQ,CAC9C,CAAC,MAAM,CAAC;IACT,KAAK,MAAM,OAAO,IAAI,cAAc,CAAC,QAAQ,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,IAAI,GAAqC,MAAM,CAAC,MAAM,CAAC;YAC3D,QAAQ,EAAE,OAAO,CAAC,WAAW,KAAK,QAAQ;YAC1C,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ;YAClC,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,eAAe,EAAE,QAAQ,CAAC,eAAe;YACzC,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,QAAQ;gBAClC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;gBAC9D,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,qBAAqB,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACxE,CAAC;IACD,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,MAAM,IAAI,GAAyC,MAAM,CAAC,MAAM,CAAC;YAC/D,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,cAAc;YACpB,IAAI,EAAE,WAAW,CAAC,IAAI;YACtB,MAAM,EAAE,WAAW,CAAC,MAAM;SAC3B,CAAC,CAAC;QACH,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,yBAAyB,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACpF,CAAC;IACD,yBAAyB,CAAC,OAAO,EAAE,cAAc,EAAE,gCAAgC,CAAC,CAAC;IAErF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC;QACzB,gBAAgB,EAAE,YAAY,CAAC,MAAM;QACrC,YAAY,EAAE,MAAM,CAAC,MAAM;QAC3B,gBAAgB,EAAE,iBAAiB,GAAG,YAAY,CAAC,MAAM;QACzD,iBAAiB;QACjB,kBAAkB;KACnB,CAAC,CAAC;IACH,IAAI,iBAAiB,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,mBAAmB,CACxB,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,EAClF,cAAc,CAAC,cAAc,CAAC,YAAY,CAAC,CAC5C,CAAC;IACJ,CAAC;IACD,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,GAAG,kBAAkB,CAAC;IAClE,MAAM,MAAM,GAA0C,MAAM,CAAC,MAAM,CAAC;QAClE,IAAI;QACJ,MAAM,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,sBAAsB,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;KACpF,CAAC,CAAC;IACH,OAAO,mBAAmB,CACxB,mBAAmB,CAAC,MAAM,EAAE,eAAe,CAAC,sBAAsB,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,EACzF,cAAc,CAAC,cAAc,CAAC,YAAY,CAAC,CAC5C,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,sBAA8B,EAC9B,gBAAwB;IAExB,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,IAAI,sBAAsB,GAAG,CAAC,EAAE,CAAC;QAC/B,QAAQ,CAAC,IAAI,CACX,MAAM,CAAC,MAAM,CAAC;YACZ,IAAI,EAAE,iBAAiB;YACvB,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,GAAG,sBAAsB,kJAAkJ;SACrL,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,gBAAgB,GAAG,CAAC,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CACX,MAAM,CAAC,MAAM,CAAC;YACZ,IAAI,EAAE,qBAAqB;YAC3B,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,GAAG,gBAAgB,yIAAyI;SACtK,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,cAAc,CACrB,MAII;IAEJ,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CACX,MAAM,CAAC,MAAM,CAAC;gBACZ,IAAI,EAAE,gBAAgB;gBACtB,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,gCAAgC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE;aAC/D,CAAC,CACH,CAAC;YACF,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,IAAI,CACX,MAAM,CAAC,MAAM,CAAC;YACZ,IAAI,EAAE,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,4BAA4B;YACxF,KAAK,EAAE,SAAS;YAChB,OAAO,EACL,KAAK,CAAC,MAAM,KAAK,QAAQ;gBACvB,CAAC,CAAC,uFAAuF,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE;gBAC9G,CAAC,CAAC,8CAA8C,KAAK,CAAC,UAAU,qDAAqD,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE;SAC/I,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,WAAW,CAClB,IAA0C;IAE1C,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;YACtB,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAgB,EAAE,OAAO,EAAE,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;SACpF,CAAC;QACF,MAAM,EAAE,EAAE,IAAI,EAAE;QAChB,MAAM,EAAE,aAAa;KACtB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,IAA0C;IACpE,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,iBAAiB;YACpB,OAAO,oGAAoG,CAAC;QAC9G,KAAK,wBAAwB;YAC3B,OAAO,iIAAiI,CAAC;QAC3I,KAAK,oBAAoB;YACvB,OAAO,2IAA2I,CAAC;QACrJ,KAAK,sBAAsB;YACzB,OAAO,6HAA6H,CAAC;QACvI,KAAK,0BAA0B;YAC7B,OAAO,sIAAsI,CAAC;QAChJ,KAAK,qBAAqB;YACxB,OAAO,2IAA2I,CAAC;IACvJ,CAAC;AACH,CAAC","sourcesContent":["import type { CheckExecutionContext, CheckMessage, CheckResult } from \"../../check/check.ts\";\nimport { appendCheckMessages } from \"../../check/finding-presentation.ts\";\nimport { reconcileFindingWaivers } from \"../../finding-waivers/reconciliation.ts\";\nimport { reportFindingWaiverAudits } from \"../code-quality-findings/finding-waiver-evidence.ts\";\nimport { collectProjectFiles } from \"../project-files/collection.ts\";\nimport type { SecretDetectionFinalData } from \"./final-data.ts\";\nimport {\n prepareSecretDetectionInputs,\n type ApprovedTextInput,\n type SecretCoverageGap\n} from \"./input-preparation.ts\";\nimport type { ResolvedSecretDetectionOptions } from \"./options.ts\";\nimport {\n secretCoverageGapRecordId,\n secretDetectionWaiverAuditRecord,\n secretFindingIdentity,\n secretFindingRecordId,\n type SecretDetectionCoverageGapRecordData,\n type SecretDetectionFindingRecordData\n} from \"./records.ts\";\nimport { detectSecretlintIssues, type SecretDetectionIssue } from \"./secretlint/adapter.ts\";\nimport { validSecretDetectionOptions } from \"./options-validation.ts\";\n\nexport const SECRET_DETECTION_CHECK_DEFINITION = {\n checkId: \"secret-detection\",\n displayName: \"Secret detection\"\n} as const;\n\n/** `secretDetection` 的 whole-Check unavailable reason；不携带 detector 或 file-system 原始详情。 /\nexport type SecretDetectionUnavailableReasonCode =\n \| \"detector-protocol-failed\"\n \| \"detector-unavailable\"\n \| \"execution-cancelled\"\n \| \"invalid-options\"\n \| \"scan-input-unavailable\"\n \| \"source-unavailable\";\n\n/* Executes the fixed in-process detector only for this Check's exact explicit input selection. */\nexport async function executeSecretDetection(\n context: CheckExecutionContext<ResolvedSecretDetectionOptions>\n): Promise<CheckResult<SecretDetectionFinalData>> {\n if (!validSecretDetectionOptions(context.options)) return unavailable(\"invalid-options\");\n if (context.signal.aborted) return unavailable(\"execution-cancelled\");\n\n let selectedPaths: readonly string[];\n try {\n selectedPaths = collectProjectFiles(context.project.root, context.options.files);\n } catch {\n return unavailable(\"scan-input-unavailable\");\n }\n if (context.signal.aborted) return unavailable(\"execution-cancelled\");\n if (selectedPaths.length === 0)\n return settleSecretDetectionFindings(context, selectedPaths.length, [], []);\n\n const prepared = prepareSecretDetectionInputs(context, selectedPaths);\n if (prepared.kind === \"unavailable\") return unavailable(\"source-unavailable\");\n if (prepared.kind === \"cancelled\") return unavailable(\"execution-cancelled\");\n\n const detected = await detectApprovedInputs(context, prepared.inputs);\n if (detected.kind === \"unavailable\") return unavailable(detected.code);\n return settleSecretDetectionFindings(\n context,\n selectedPaths.length,\n detected.issues,\n prepared.coverageGaps\n );\n}\n\ntype DetectedIssues = Readonly<\n \| { readonly code: SecretDetectionUnavailableReasonCode; readonly kind: \"unavailable\" }\n \| { readonly issues: readonly SecretDetectionIssue[]; readonly kind: \"complete\" }\n>;\n\nasync function detectApprovedInputs(\n context: CheckExecutionContext<ResolvedSecretDetectionOptions>,\n inputs: readonly ApprovedTextInput[]\n): Promise<DetectedIssues> {\n const issues: SecretDetectionIssue[] = [];\n for (const input of inputs) {\n if (context.signal.aborted)\n return Object.freeze({ code: \"execution-cancelled\", kind: \"unavailable\" });\n const detected = await detectSecretlintIssues(input.content, input.path);\n if (context.signal.aborted)\n return Object.freeze({ code: \"execution-cancelled\", kind: \"unavailable\" });\n if (detected.kind === \"unavailable\") {\n return Object.freeze({ code: \"detector-unavailable\", kind: \"unavailable\" });\n }\n if (detected.kind === \"protocol-failed\") {\n return Object.freeze({ code: \"detector-protocol-failed\", kind: \"unavailable\" });\n }\n issues.push(...detected.issues);\n }\n return Object.freeze({ issues: Object.freeze(issues), kind: \"complete\" });\n}\n\nexport function settleSecretDetectionFindings(\n context: CheckExecutionContext<ResolvedSecretDetectionOptions>,\n selectedFileCount: number,\n issues: readonly SecretDetectionIssue[],\n coverageGaps: readonly SecretCoverageGap[]\n): CheckResult<SecretDetectionFinalData> {\n const reconciliation = reconcileFindingWaivers({\n findings: issues,\n identify: secretFindingIdentity,\n waivers: context.options.findingWaivers\n });\n const waivedFindingCount = reconciliation.findings.filter(\n (finding) => finding.disposition === \"waived\"\n ).length;\n for (const finding of reconciliation.findings) {\n const identity = secretFindingIdentity(finding.finding);\n const data: SecretDetectionFindingRecordData = Object.freeze({\n blocking: finding.disposition !== \"waived\",\n kind: \"secret-finding\",\n location: finding.finding.location,\n ordinal: identity.ordinal,\n path: identity.path,\n ruleId: identity.ruleId,\n structuralClass: identity.structuralClass,\n ...(finding.disposition === \"waived\"\n ? { waiver: Object.freeze({ reason: finding.waiver.reason }) }\n : {})\n });\n context.records.report({ id: secretFindingRecordId(identity) }, data);\n }\n for (const coverageGap of coverageGaps) {\n const data: SecretDetectionCoverageGapRecordData = Object.freeze({\n blocking: true,\n kind: \"coverage-gap\",\n path: coverageGap.path,\n reason: coverageGap.reason\n });\n context.records.report({ id: secretCoverageGapRecordId(coverageGap.path) }, data);\n }\n reportFindingWaiverAudits(context, reconciliation, secretDetectionWaiverAuditRecord);\n\n const data = Object.freeze({\n coverageGapCount: coverageGaps.length,\n findingCount: issues.length,\n scannedFileCount: selectedFileCount - coverageGaps.length,\n selectedFileCount,\n waivedFindingCount\n });\n if (selectedFileCount === 0) {\n return appendCheckMessages(\n Object.freeze({ status: \"not-applicable\", reason: { code: \"no-eligible-input\" } }),\n waiverMessages(reconciliation.waiverAudits)\n );\n }\n const actionableFindingCount = issues.length - waivedFindingCount;\n const result: CheckResult<SecretDetectionFinalData> = Object.freeze({\n data,\n status: coverageGaps.length > 0 \|\| actionableFindingCount > 0 ? \"failed\" : \"passed\"\n });\n return appendCheckMessages(\n appendCheckMessages(result, findingMessages(actionableFindingCount, coverageGaps.length)),\n waiverMessages(reconciliation.waiverAudits)\n );\n}\n\nfunction findingMessages(\n actionableFindingCount: number,\n coverageGapCount: number\n): readonly CheckMessage[] {\n const messages: CheckMessage[] = [];\n if (actionableFindingCount > 0) {\n messages.push(\n Object.freeze({\n code: \"secret-findings\",\n level: \"error\",\n message: `${actionableFindingCount} high-confidence secret finding(s) require attention; inspect this Check's safe Records, remove the material, or author an exact finding waiver.`\n })\n );\n }\n if (coverageGapCount > 0) {\n messages.push(\n Object.freeze({\n code: \"incomplete-coverage\",\n level: \"error\",\n message: `${coverageGapCount} selected input(s) could not receive bounded secret detection coverage; narrow files or increase this Check's explicit resource limits.`\n })\n );\n }\n return Object.freeze(messages);\n}\n\nfunction waiverMessages(\n audits: readonly Readonly<{\n readonly matchCount: number;\n readonly status: \"applied\" \| \"overmatched\" \| \"unused\";\n readonly waiver: Readonly<{ readonly reason: string }>;\n }>[]\n): readonly CheckMessage[] {\n const messages: CheckMessage[] = [];\n for (const audit of audits) {\n if (audit.status === \"applied\") {\n messages.push(\n Object.freeze({\n code: \"finding-waived\",\n level: \"info\",\n message: `A secret finding was waived: ${audit.waiver.reason}`\n })\n );\n continue;\n }\n messages.push(\n Object.freeze({\n code: audit.status === \"unused\" ? \"unused-finding-waiver\" : \"overmatched-finding-waiver\",\n level: \"warning\",\n message:\n audit.status === \"unused\"\n ? `A configured secret finding waiver matched no finding; remove or update it. Reason: ${audit.waiver.reason}`\n : `A configured secret finding waiver matched ${audit.matchCount} findings and was not applied; narrow it. Reason: ${audit.waiver.reason}`\n })\n );\n }\n return Object.freeze(messages);\n}\n\nfunction unavailable(\n code: SecretDetectionUnavailableReasonCode\n): CheckResult<SecretDetectionFinalData> {\n return Object.freeze({\n messages: Object.freeze([\n Object.freeze({ code, level: \"error\" as const, message: unavailableMessage(code) })\n ]),\n reason: { code },\n status: \"unavailable\"\n });\n}\n\nfunction unavailableMessage(code: SecretDetectionUnavailableReasonCode): string {\n switch (code) {\n case \"invalid-options\":\n return \"secretDetection options are invalid; recreate the Check with its documented explicit files policy.\";\n case \"scan-input-unavailable\":\n return \"Secret detection could not collect its configured project files; check the project root, permissions, and selected file source.\";\n case \"source-unavailable\":\n return \"A selected secret detection input could not be read safely; check that it still exists, is readable, and was not replaced during the Run.\";\n case \"detector-unavailable\":\n return \"The private secret detector did not complete; retry after restoring the package runtime without treating this Run as clean.\";\n case \"detector-protocol-failed\":\n return \"The private secret detector returned an unsupported result shape; update the package dependency only with a reviewed adapter change.\";\n case \"execution-cancelled\":\n return \"Secret detection was cancelled before it could form a complete result; inspect the caller's cancellation reason and retry if appropriate.\";\n }\n}\n"]}
1	+ {"version":3,"file":"execution.mjs","sourceRoot":"","sources":["../../../../src/package-checks/secret-detection/execution.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AACvG,OAAO,EAAE,uBAAuB,EAAE,MAAM,uDAAuD,CAAC;AAChG,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAErE,OAAO,EACL,4BAA4B,EAG7B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,qBAAqB,EACrB,qBAAqB,EAGtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,sBAAsB,EAA6B,MAAM,yBAAyB,CAAC;AAC5F,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAEtE,MAAM,CAAC,MAAM,iCAAiC,GAAG;IAC/C,OAAO,EAAE,kBAAkB;IAC3B,WAAW,EAAE,kBAAkB;CACvB,CAAC;AAWX,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAA8D;IAE9D,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,WAAW,CAAC,iBAAiB,CAAC,CAAC;IACzF,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,WAAW,CAAC,qBAAqB,CAAC,CAAC;IAEtE,IAAI,aAAgC,CAAC;IACrC,IAAI,CAAC;QACH,aAAa,GAAG,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC,wBAAwB,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,WAAW,CAAC,qBAAqB,CAAC,CAAC;IACtE,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAC5B,OAAO,6BAA6B,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAE9E,MAAM,QAAQ,GAAG,4BAA4B,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACtE,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa;QAAE,OAAO,WAAW,CAAC,oBAAoB,CAAC,CAAC;IAC9E,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,WAAW,CAAC,qBAAqB,CAAC,CAAC;IAE7E,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtE,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa;QAAE,OAAO,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACvE,OAAO,6BAA6B,CAClC,OAAO,EACP,aAAa,CAAC,MAAM,EACpB,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,YAAY,CACtB,CAAC;AACJ,CAAC;AAOD,KAAK,UAAU,oBAAoB,CACjC,OAA8D,EAC9D,MAAoC;IAEpC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;YACxB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QAC7E,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACzE,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;YACxB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QAC7E,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACpC,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACxC,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,OAA8D,EAC9D,iBAAyB,EACzB,MAAuC,EACvC,YAA0C;IAE1C,MAAM,cAAc,GAAG,uBAAuB,CAAC;QAC7C,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,qBAAqB;QAC/B,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc;KACxC,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,cAAc,CAAC,QAAQ,CAAC,MAAM,CACvD,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,KAAK,QAAQ,CAC9C,CAAC,MAAM,CAAC;IACT,KAAK,MAAM,OAAO,IAAI,cAAc,CAAC,QAAQ,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,IAAI,GAAqC,MAAM,CAAC,MAAM,CAAC;YAC3D,QAAQ,EAAE,OAAO,CAAC,WAAW,KAAK,QAAQ;YAC1C,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ;YAClC,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,eAAe,EAAE,QAAQ,CAAC,eAAe;YACzC,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,QAAQ;gBAClC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;gBAC9D,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,qBAAqB,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACxE,CAAC;IACD,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,MAAM,IAAI,GAAyC,MAAM,CAAC,MAAM,CAAC;YAC/D,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,cAAc;YACpB,IAAI,EAAE,WAAW,CAAC,IAAI;YACtB,MAAM,EAAE,WAAW,CAAC,MAAM;SAC3B,CAAC,CAAC;QACH,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,yBAAyB,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACpF,CAAC;IACD,yBAAyB,CAAC,OAAO,EAAE,cAAc,EAAE,gCAAgC,CAAC,CAAC;IAErF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC;QACzB,gBAAgB,EAAE,YAAY,CAAC,MAAM;QACrC,YAAY,EAAE,MAAM,CAAC,MAAM;QAC3B,gBAAgB,EAAE,iBAAiB,GAAG,YAAY,CAAC,MAAM;QACzD,iBAAiB;QACjB,kBAAkB;KACnB,CAAC,CAAC;IACH,IAAI,iBAAiB,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,mBAAmB,CACxB,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,EAClF,cAAc,CAAC,cAAc,CAAC,YAAY,CAAC,CAC5C,CAAC;IACJ,CAAC;IACD,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,GAAG,kBAAkB,CAAC;IAClE,MAAM,MAAM,GAA0C,MAAM,CAAC,MAAM,CAAC;QAClE,IAAI;QACJ,MAAM,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,sBAAsB,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;KACpF,CAAC,CAAC;IACH,OAAO,mBAAmB,CACxB,mBAAmB,CAAC,MAAM,EAAE,eAAe,CAAC,sBAAsB,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,EACzF,cAAc,CAAC,cAAc,CAAC,YAAY,CAAC,CAC5C,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,sBAA8B,EAC9B,gBAAwB;IAExB,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,IAAI,sBAAsB,GAAG,CAAC,EAAE,CAAC;QAC/B,QAAQ,CAAC,IAAI,CACX,MAAM,CAAC,MAAM,CAAC;YACZ,IAAI,EAAE,iBAAiB;YACvB,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,GAAG,sBAAsB,kJAAkJ;SACrL,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,gBAAgB,GAAG,CAAC,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CACX,MAAM,CAAC,MAAM,CAAC;YACZ,IAAI,EAAE,qBAAqB;YAC3B,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,GAAG,gBAAgB,yIAAyI;SACtK,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,cAAc,CACrB,MAII;IAEJ,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CACX,MAAM,CAAC,MAAM,CAAC;gBACZ,IAAI,EAAE,gBAAgB;gBACtB,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,gCAAgC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE;aAC/D,CAAC,CACH,CAAC;YACF,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,IAAI,CACX,MAAM,CAAC,MAAM,CAAC;YACZ,IAAI,EAAE,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,4BAA4B;YACxF,KAAK,EAAE,SAAS;YAChB,OAAO,EACL,KAAK,CAAC,MAAM,KAAK,QAAQ;gBACvB,CAAC,CAAC,uFAAuF,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE;gBAC9G,CAAC,CAAC,8CAA8C,KAAK,CAAC,UAAU,qDAAqD,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE;SAC/I,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,WAAW,CAClB,IAA0C;IAE1C,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;YACtB,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAgB,EAAE,OAAO,EAAE,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;SACpF,CAAC;QACF,MAAM,EAAE,EAAE,IAAI,EAAE;QAChB,MAAM,EAAE,aAAa;KACtB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,IAA0C;IACpE,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,iBAAiB;YACpB,OAAO,oGAAoG,CAAC;QAC9G,KAAK,wBAAwB;YAC3B,OAAO,iIAAiI,CAAC;QAC3I,KAAK,oBAAoB;YACvB,OAAO,2IAA2I,CAAC;QACrJ,KAAK,sBAAsB;YACzB,OAAO,6HAA6H,CAAC;QACvI,KAAK,0BAA0B;YAC7B,OAAO,sIAAsI,CAAC;QAChJ,KAAK,qBAAqB;YACxB,OAAO,2IAA2I,CAAC;IACvJ,CAAC;AACH,CAAC","sourcesContent":["import type { CheckExecutionContext, CheckMessage, CheckResult } from \"../../check/check.ts\";\nimport { appendCheckMessages } from \"../../package-tools/finding-presentation/finding-presentation.ts\";\nimport { reconcileFindingWaivers } from \"../../package-tools/finding-waivers/reconciliation.ts\";\nimport { reportFindingWaiverAudits } from \"../code-quality-findings/finding-waiver-evidence.ts\";\nimport { collectProjectFiles } from \"../project-files/collection.ts\";\nimport type { SecretDetectionFinalData } from \"./final-data.ts\";\nimport {\n prepareSecretDetectionInputs,\n type ApprovedTextInput,\n type SecretCoverageGap\n} from \"./input-preparation.ts\";\nimport type { ResolvedSecretDetectionOptions } from \"./options.ts\";\nimport {\n secretCoverageGapRecordId,\n secretDetectionWaiverAuditRecord,\n secretFindingIdentity,\n secretFindingRecordId,\n type SecretDetectionCoverageGapRecordData,\n type SecretDetectionFindingRecordData\n} from \"./records.ts\";\nimport { detectSecretlintIssues, type SecretDetectionIssue } from \"./secretlint/adapter.ts\";\nimport { validSecretDetectionOptions } from \"./options-validation.ts\";\n\nexport const SECRET_DETECTION_CHECK_DEFINITION = {\n checkId: \"secret-detection\",\n displayName: \"Secret detection\"\n} as const;\n\n/** `secretDetection` 的 whole-Check unavailable reason；不携带 detector 或 file-system 原始详情。 /\nexport type SecretDetectionUnavailableReasonCode =\n \| \"detector-protocol-failed\"\n \| \"detector-unavailable\"\n \| \"execution-cancelled\"\n \| \"invalid-options\"\n \| \"scan-input-unavailable\"\n \| \"source-unavailable\";\n\n/* Executes the fixed in-process detector only for this Check's exact explicit input selection. */\nexport async function executeSecretDetection(\n context: CheckExecutionContext<ResolvedSecretDetectionOptions>\n): Promise<CheckResult<SecretDetectionFinalData>> {\n if (!validSecretDetectionOptions(context.options)) return unavailable(\"invalid-options\");\n if (context.signal.aborted) return unavailable(\"execution-cancelled\");\n\n let selectedPaths: readonly string[];\n try {\n selectedPaths = collectProjectFiles(context.project.root, context.options.files);\n } catch {\n return unavailable(\"scan-input-unavailable\");\n }\n if (context.signal.aborted) return unavailable(\"execution-cancelled\");\n if (selectedPaths.length === 0)\n return settleSecretDetectionFindings(context, selectedPaths.length, [], []);\n\n const prepared = prepareSecretDetectionInputs(context, selectedPaths);\n if (prepared.kind === \"unavailable\") return unavailable(\"source-unavailable\");\n if (prepared.kind === \"cancelled\") return unavailable(\"execution-cancelled\");\n\n const detected = await detectApprovedInputs(context, prepared.inputs);\n if (detected.kind === \"unavailable\") return unavailable(detected.code);\n return settleSecretDetectionFindings(\n context,\n selectedPaths.length,\n detected.issues,\n prepared.coverageGaps\n );\n}\n\ntype DetectedIssues = Readonly<\n \| { readonly code: SecretDetectionUnavailableReasonCode; readonly kind: \"unavailable\" }\n \| { readonly issues: readonly SecretDetectionIssue[]; readonly kind: \"complete\" }\n>;\n\nasync function detectApprovedInputs(\n context: CheckExecutionContext<ResolvedSecretDetectionOptions>,\n inputs: readonly ApprovedTextInput[]\n): Promise<DetectedIssues> {\n const issues: SecretDetectionIssue[] = [];\n for (const input of inputs) {\n if (context.signal.aborted)\n return Object.freeze({ code: \"execution-cancelled\", kind: \"unavailable\" });\n const detected = await detectSecretlintIssues(input.content, input.path);\n if (context.signal.aborted)\n return Object.freeze({ code: \"execution-cancelled\", kind: \"unavailable\" });\n if (detected.kind === \"unavailable\") {\n return Object.freeze({ code: \"detector-unavailable\", kind: \"unavailable\" });\n }\n if (detected.kind === \"protocol-failed\") {\n return Object.freeze({ code: \"detector-protocol-failed\", kind: \"unavailable\" });\n }\n issues.push(...detected.issues);\n }\n return Object.freeze({ issues: Object.freeze(issues), kind: \"complete\" });\n}\n\nexport function settleSecretDetectionFindings(\n context: CheckExecutionContext<ResolvedSecretDetectionOptions>,\n selectedFileCount: number,\n issues: readonly SecretDetectionIssue[],\n coverageGaps: readonly SecretCoverageGap[]\n): CheckResult<SecretDetectionFinalData> {\n const reconciliation = reconcileFindingWaivers({\n findings: issues,\n identify: secretFindingIdentity,\n waivers: context.options.findingWaivers\n });\n const waivedFindingCount = reconciliation.findings.filter(\n (finding) => finding.disposition === \"waived\"\n ).length;\n for (const finding of reconciliation.findings) {\n const identity = secretFindingIdentity(finding.finding);\n const data: SecretDetectionFindingRecordData = Object.freeze({\n blocking: finding.disposition !== \"waived\",\n kind: \"secret-finding\",\n location: finding.finding.location,\n ordinal: identity.ordinal,\n path: identity.path,\n ruleId: identity.ruleId,\n structuralClass: identity.structuralClass,\n ...(finding.disposition === \"waived\"\n ? { waiver: Object.freeze({ reason: finding.waiver.reason }) }\n : {})\n });\n context.records.report({ id: secretFindingRecordId(identity) }, data);\n }\n for (const coverageGap of coverageGaps) {\n const data: SecretDetectionCoverageGapRecordData = Object.freeze({\n blocking: true,\n kind: \"coverage-gap\",\n path: coverageGap.path,\n reason: coverageGap.reason\n });\n context.records.report({ id: secretCoverageGapRecordId(coverageGap.path) }, data);\n }\n reportFindingWaiverAudits(context, reconciliation, secretDetectionWaiverAuditRecord);\n\n const data = Object.freeze({\n coverageGapCount: coverageGaps.length,\n findingCount: issues.length,\n scannedFileCount: selectedFileCount - coverageGaps.length,\n selectedFileCount,\n waivedFindingCount\n });\n if (selectedFileCount === 0) {\n return appendCheckMessages(\n Object.freeze({ status: \"not-applicable\", reason: { code: \"no-eligible-input\" } }),\n waiverMessages(reconciliation.waiverAudits)\n );\n }\n const actionableFindingCount = issues.length - waivedFindingCount;\n const result: CheckResult<SecretDetectionFinalData> = Object.freeze({\n data,\n status: coverageGaps.length > 0 \|\| actionableFindingCount > 0 ? \"failed\" : \"passed\"\n });\n return appendCheckMessages(\n appendCheckMessages(result, findingMessages(actionableFindingCount, coverageGaps.length)),\n waiverMessages(reconciliation.waiverAudits)\n );\n}\n\nfunction findingMessages(\n actionableFindingCount: number,\n coverageGapCount: number\n): readonly CheckMessage[] {\n const messages: CheckMessage[] = [];\n if (actionableFindingCount > 0) {\n messages.push(\n Object.freeze({\n code: \"secret-findings\",\n level: \"error\",\n message: `${actionableFindingCount} high-confidence secret finding(s) require attention; inspect this Check's safe Records, remove the material, or author an exact finding waiver.`\n })\n );\n }\n if (coverageGapCount > 0) {\n messages.push(\n Object.freeze({\n code: \"incomplete-coverage\",\n level: \"error\",\n message: `${coverageGapCount} selected input(s) could not receive bounded secret detection coverage; narrow files or increase this Check's explicit resource limits.`\n })\n );\n }\n return Object.freeze(messages);\n}\n\nfunction waiverMessages(\n audits: readonly Readonly<{\n readonly matchCount: number;\n readonly status: \"applied\" \| \"overmatched\" \| \"unused\";\n readonly waiver: Readonly<{ readonly reason: string }>;\n }>[]\n): readonly CheckMessage[] {\n const messages: CheckMessage[] = [];\n for (const audit of audits) {\n if (audit.status === \"applied\") {\n messages.push(\n Object.freeze({\n code: \"finding-waived\",\n level: \"info\",\n message: `A secret finding was waived: ${audit.waiver.reason}`\n })\n );\n continue;\n }\n messages.push(\n Object.freeze({\n code: audit.status === \"unused\" ? \"unused-finding-waiver\" : \"overmatched-finding-waiver\",\n level: \"warning\",\n message:\n audit.status === \"unused\"\n ? `A configured secret finding waiver matched no finding; remove or update it. Reason: ${audit.waiver.reason}`\n : `A configured secret finding waiver matched ${audit.matchCount} findings and was not applied; narrow it. Reason: ${audit.waiver.reason}`\n })\n );\n }\n return Object.freeze(messages);\n}\n\nfunction unavailable(\n code: SecretDetectionUnavailableReasonCode\n): CheckResult<SecretDetectionFinalData> {\n return Object.freeze({\n messages: Object.freeze([\n Object.freeze({ code, level: \"error\" as const, message: unavailableMessage(code) })\n ]),\n reason: { code },\n status: \"unavailable\"\n });\n}\n\nfunction unavailableMessage(code: SecretDetectionUnavailableReasonCode): string {\n switch (code) {\n case \"invalid-options\":\n return \"secretDetection options are invalid; recreate the Check with its documented explicit files policy.\";\n case \"scan-input-unavailable\":\n return \"Secret detection could not collect its configured project files; check the project root, permissions, and selected file source.\";\n case \"source-unavailable\":\n return \"A selected secret detection input could not be read safely; check that it still exists, is readable, and was not replaced during the Run.\";\n case \"detector-unavailable\":\n return \"The private secret detector did not complete; retry after restoring the package runtime without treating this Run as clean.\";\n case \"detector-protocol-failed\":\n return \"The private secret detector returned an unsupported result shape; update the package dependency only with a reviewed adapter change.\";\n case \"execution-cancelled\":\n return \"Secret detection was cancelled before it could form a complete result; inspect the caller's cancellation reason and retry if appropriate.\";\n }\n}\n"]}

package/dist/esm/package-checks/secret-detection/input-preparation.mjs CHANGED Viewed

@@ -1,4 +1,4 @@
-import { closeSync, constants, fstatSync, openSync, readSync } from "node:fs";
+import { closeSync, constants, fstatSync, lstatSync, openSync, readSync } from "node:fs";
 import { resolve } from "node:path";
 import { classifySecretDetectionBytes } from "./classification.mjs";
 /** Reads and classifies the already-selected paths before the detector can receive text. */
@@ -76,7 +76,7 @@ function prepareSelectedInput(context, path, consumedBytes) {
     });
 }
 function readBoundedRegularFile(input) {
-    const descriptor = openRegularFileWithoutFollowingSymlink(input.filePath);
+    const descriptor = openIdentityCheckedRegularFile(input.filePath);
     if (descriptor === undefined)
         return Object.freeze({ kind: "unavailable" });
     try {
@@ -107,18 +107,57 @@ function closeDescriptor(descriptor) {
         // The descriptor cannot carry source bytes into a public result; preserve the completed read fact.
     }
 }
-function openRegularFileWithoutFollowingSymlink(filePath) {
-    if (!supportsNoFollowDescriptorOpen())
+function openIdentityCheckedRegularFile(filePath) {
+    const expectedIdentity = regularFileIdentityAtPath(filePath);
+    if (expectedIdentity === undefined)
         return undefined;
+    const openFlags = finalLeafOpenFlags();
+    if (openFlags === undefined)
+        return undefined;
+    let descriptor;
+    try {
+        descriptor = openSync(filePath, openFlags);
+    }
+    catch {
+        return undefined;
+    }
+    const openedIdentity = regularFileIdentityOnDescriptor(descriptor);
+    if (openedIdentity !== undefined && sameRegularFileIdentity(expectedIdentity, openedIdentity)) {
+        return descriptor;
+    }
+    closeDescriptor(descriptor);
+    return undefined;
+}
+function finalLeafOpenFlags() {
+    if (process.platform === "win32")
+        return constants.O_RDONLY;
+    return typeof constants.O_NOFOLLOW === "number" && constants.O_NOFOLLOW !== 0
+        ? constants.O_RDONLY | constants.O_NOFOLLOW
+        : undefined;
+}
+function regularFileIdentityAtPath(filePath) {
+    try {
+        return regularFileIdentity(lstatSync(filePath, { bigint: true }));
+    }
+    catch {
+        return undefined;
+    }
+}
+function regularFileIdentityOnDescriptor(descriptor) {
     try {
-        return openSync(filePath, constants.O_RDONLY | constants.O_NOFOLLOW);
+        return regularFileIdentity(fstatSync(descriptor, { bigint: true }));
     }
     catch {
         return undefined;
     }
 }
-function supportsNoFollowDescriptorOpen() {
-    return process.platform !== "win32" && constants.O_NOFOLLOW !== 0;
+function regularFileIdentity(details) {
+    return details.isFile() && details.dev > 0n && details.ino > 0n
+        ? Object.freeze({ device: details.dev, inode: details.ino })
+        : undefined;
+}
+function sameRegularFileIdentity(expected, opened) {
+    return expected.device === opened.device && expected.inode === opened.inode;
 }
 function regularFileByteLength(descriptor) {
     try {

package/dist/esm/package-checks/secret-detection/input-preparation.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"input-preparation.mjs","sourceRoot":"","sources":["../../../../src/package-checks/secret-detection/input-preparation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC9E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,OAAO,EACL,4BAA4B,EAE7B,MAAM,qBAAqB,CAAC;AAyB7B,4FAA4F;AAC5F,MAAM,UAAU,4BAA4B,CAC1C,OAA8D,EAC9D,aAAgC;IAEhC,MAAM,YAAY,GAAwB,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;QACpD,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACxE,MAAM,cAAc,GAAG,kBAAkB,CACvC,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAChC,aAAa,EACb,KAAK,CACN,CAAC;QACF,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,YAAY,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;YACrC,MAAM;QACR,CAAC;QACD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;QACpE,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa;YAAE,OAAO,QAAQ,CAAC;QACtF,IAAI,QAAQ,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACrC,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC;YACxC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACpE,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAClB,YAAY,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC;gBAC1F,MAAM;YACR,CAAC;YACD,SAAS;QACX,CAAC;QACD,aAAa,IAAI,QAAQ,CAAC,UAAU,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;QACzC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7B,IAAI,EAAE,UAAU;KACjB,CAAC,CAAC;AACL,CAAC;AA0BD,SAAS,kBAAkB,CACzB,gBAAwB,EACxB,aAAgC,EAChC,KAAa;IAEb,IAAI,KAAK,GAAG,gBAAgB;QAAE,OAAO,SAAS,CAAC;IAC/C,OAAO,eAAe,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,oBAAoB,CAC3B,OAA8D,EAC9D,IAAY,EACZ,aAAqB;IAErB,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,sBAAsB,CAAC;QAClC,aAAa;QACb,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC;QAC7C,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,aAAa,EAAE,CAAC;YAChB,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,IAAI,CAAC,MAAM,KAAK,kBAAkB;SACzC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IAExE,MAAM,cAAc,GAAG,4BAA4B,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAClG,IAAI,cAAc,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QAC3C,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU;YACpC,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,cAAc,CAAC,MAAM;YAC7B,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU;QACjC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;QAC/D,IAAI,EAAE,UAAU;KACjB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAAC,KAI/B;IACC,MAAM,UAAU,GAAG,sCAAsC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1E,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;IAC5E,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAClF,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAEvF,MAAM,KAAK,GAAG,qBAAqB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAC5D,IAAI,KAAK,KAAK,SAAS,IAAI,qBAAqB,CAAC,UAAU,CAAC,KAAK,UAAU,EAAE,CAAC;YAC5E,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;IAChD,CAAC;YAAS,CAAC;QACT,eAAe,CAAC,UAAU,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB;IACzC,IAAI,CAAC;QACH,SAAS,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,mGAAmG;IACrG,CAAC;AACH,CAAC;AAED,SAAS,sCAAsC,CAAC,QAAgB;IAC9D,IAAI,CAAC,8BAA8B,EAAE;QAAE,OAAO,SAAS,CAAC;IACxD,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,8BAA8B;IACrC,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,SAAS,CAAC,UAAU,KAAK,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,qBAAqB,CAAC,UAAkB;IAC/C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QACtC,OAAO,OAAO,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC;YAChF,CAAC,CAAC,OAAO,CAAC,IAAI;YACd,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,UAAkB,EAAE,UAAkB;IACnE,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,MAAM,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,QAAQ,CACnB,UAAU,EACV,KAAK,EACL,MAAM,EACN,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,EAC3C,IAAI,CACL,CAAC;QACF,IAAI,IAAI,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAChC,MAAM,IAAI,IAAI,CAAC;IACjB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAuC,EACvC,UAAkB,EAClB,aAAqB;IAErB,IAAI,UAAU,GAAG,OAAO,CAAC,gBAAgB;QAAE,OAAO,iBAAiB,CAAC;IACpE,OAAO,aAAa,GAAG,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC;AACjG,CAAC;AAED,SAAS,eAAe,CACtB,KAAwB,EACxB,MAAwC;IAExC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC","sourcesContent":["import { closeSync, constants, fstatSync, openSync, readSync } from \"node:fs\";\nimport { resolve } from \"node:path\";\n\nimport type { CheckExecutionContext } from \"../../check/check.ts\";\nimport {\n classifySecretDetectionBytes,\n type SecretDetectionCoverageGapReason\n} from \"./classification.ts\";\nimport type { ResolvedSecretDetectionOptions } from \"./options.ts\";\n\n/** Private, already-classified text passed to this Check's private detector adapter. /\nexport interface ApprovedTextInput {\n readonly content: string;\n readonly path: string;\n}\n\n/* A safe explanation for an exact selected input that did not receive detector coverage. /\nexport interface SecretCoverageGap {\n readonly path: string;\n readonly reason: SecretDetectionCoverageGapReason;\n}\n\nexport type PreparedSecretDetectionInputs = Readonly<\n \| { readonly kind: \"cancelled\" }\n \| { readonly kind: \"unavailable\" }\n \| {\n readonly coverageGaps: readonly SecretCoverageGap[];\n readonly inputs: readonly ApprovedTextInput[];\n readonly kind: \"complete\";\n }\n>;\n\n/* Reads and classifies the already-selected paths before the detector can receive text. */\nexport function prepareSecretDetectionInputs(\n context: CheckExecutionContext<ResolvedSecretDetectionOptions>,\n selectedPaths: readonly string[]\n): PreparedSecretDetectionInputs {\n const coverageGaps: SecretCoverageGap[] = [];\n const inputs: ApprovedTextInput[] = [];\n let consumedBytes = 0;\n\n for (const [index, path] of selectedPaths.entries()) {\n if (context.signal.aborted) return Object.freeze({ kind: \"cancelled\" });\n const selectionLimit = selectionLimitGaps(\n context.options.maximumFileCount,\n selectedPaths,\n index\n );\n if (selectionLimit !== undefined) {\n coverageGaps.push(...selectionLimit);\n break;\n }\n const prepared = prepareSelectedInput(context, path, consumedBytes);\n if (prepared.kind === \"cancelled\" \|\| prepared.kind === \"unavailable\") return prepared;\n if (prepared.kind === \"coverage-gap\") {\n consumedBytes += prepared.consumedBytes;\n coverageGaps.push(Object.freeze({ path, reason: prepared.reason }));\n if (prepared.stop) {\n coverageGaps.push(...coverageGapsFor(selectedPaths.slice(index + 1), \"total-byte-limit\"));\n break;\n }\n continue;\n }\n consumedBytes += prepared.byteLength;\n inputs.push(prepared.input);\n }\n return Object.freeze({\n coverageGaps: Object.freeze(coverageGaps),\n inputs: Object.freeze(inputs),\n kind: \"complete\"\n });\n}\n\ntype PreparedSelectedInput = Readonly<\n \| { readonly kind: \"cancelled\" }\n \| { readonly kind: \"unavailable\" }\n \| {\n readonly consumedBytes: number;\n readonly kind: \"coverage-gap\";\n readonly reason: SecretDetectionCoverageGapReason;\n readonly stop: boolean;\n }\n \| { readonly byteLength: number; readonly input: ApprovedTextInput; readonly kind: \"approved\" }\n>;\n\ntype BoundedRegularFileRead = Readonly<\n \| { readonly kind: \"unavailable\" }\n \| {\n readonly kind: \"coverage-gap\";\n readonly reason: Extract<\n SecretDetectionCoverageGapReason,\n \"file-byte-limit\" \| \"total-byte-limit\"\n >;\n }\n \| { readonly bytes: Uint8Array; readonly kind: \"complete\" }\n>;\n\nfunction selectionLimitGaps(\n maximumFileCount: number,\n selectedPaths: readonly string[],\n index: number\n): readonly SecretCoverageGap[] \| undefined {\n if (index < maximumFileCount) return undefined;\n return coverageGapsFor(selectedPaths.slice(index), \"file-count-limit\");\n}\n\nfunction prepareSelectedInput(\n context: CheckExecutionContext<ResolvedSecretDetectionOptions>,\n path: string,\n consumedBytes: number\n): PreparedSelectedInput {\n if (context.signal.aborted) return Object.freeze({ kind: \"cancelled\" });\n const read = readBoundedRegularFile({\n consumedBytes,\n filePath: resolve(context.project.root, path),\n options: context.options\n });\n if (read.kind === \"unavailable\") return read;\n if (read.kind === \"coverage-gap\") {\n return Object.freeze({\n consumedBytes: 0,\n kind: \"coverage-gap\",\n reason: read.reason,\n stop: read.reason === \"total-byte-limit\"\n });\n }\n if (context.signal.aborted) return Object.freeze({ kind: \"cancelled\" });\n\n const classification = classifySecretDetectionBytes(read.bytes, context.options.maximumFileBytes);\n if (classification.kind === \"coverage-gap\") {\n return Object.freeze({\n consumedBytes: read.bytes.byteLength,\n kind: \"coverage-gap\",\n reason: classification.reason,\n stop: false\n });\n }\n return Object.freeze({\n byteLength: read.bytes.byteLength,\n input: Object.freeze({ content: classification.content, path }),\n kind: \"approved\"\n });\n}\n\nfunction readBoundedRegularFile(input: {\n readonly consumedBytes: number;\n readonly filePath: string;\n readonly options: ResolvedSecretDetectionOptions;\n}): BoundedRegularFileRead {\n const descriptor = openRegularFileWithoutFollowingSymlink(input.filePath);\n if (descriptor === undefined) return Object.freeze({ kind: \"unavailable\" });\n try {\n const byteLength = regularFileByteLength(descriptor);\n if (byteLength === undefined) return Object.freeze({ kind: \"unavailable\" });\n const limit = resourceLimitReason(input.options, byteLength, input.consumedBytes);\n if (limit !== undefined) return Object.freeze({ kind: \"coverage-gap\", reason: limit });\n\n const bytes = readExactBoundedBytes(descriptor, byteLength);\n if (bytes === undefined \|\| regularFileByteLength(descriptor) !== byteLength) {\n return Object.freeze({ kind: \"unavailable\" });\n }\n return Object.freeze({ bytes, kind: \"complete\" });\n } catch {\n return Object.freeze({ kind: \"unavailable\" });\n } finally {\n closeDescriptor(descriptor);\n }\n}\n\nfunction closeDescriptor(descriptor: number): void {\n try {\n closeSync(descriptor);\n } catch {\n // The descriptor cannot carry source bytes into a public result; preserve the completed read fact.\n }\n}\n\nfunction openRegularFileWithoutFollowingSymlink(filePath: string): number \| undefined {\n if (!supportsNoFollowDescriptorOpen()) return undefined;\n try {\n return openSync(filePath, constants.O_RDONLY \| constants.O_NOFOLLOW);\n } catch {\n return undefined;\n }\n}\n\nfunction supportsNoFollowDescriptorOpen(): boolean {\n return process.platform !== \"win32\" && constants.O_NOFOLLOW !== 0;\n}\n\nfunction regularFileByteLength(descriptor: number): number \| undefined {\n try {\n const details = fstatSync(descriptor);\n return details.isFile() && Number.isSafeInteger(details.size) && details.size >= 0\n ? details.size\n : undefined;\n } catch {\n return undefined;\n }\n}\n\nfunction readExactBoundedBytes(descriptor: number, byteLength: number): Uint8Array \| undefined {\n const bytes = new Uint8Array(byteLength);\n let offset = 0;\n while (offset < bytes.byteLength) {\n const read = readSync(\n descriptor,\n bytes,\n offset,\n Math.min(65_536, bytes.byteLength - offset),\n null\n );\n if (read <= 0) return undefined;\n offset += read;\n }\n return bytes;\n}\n\nfunction resourceLimitReason(\n options: ResolvedSecretDetectionOptions,\n byteLength: number,\n consumedBytes: number\n): Extract<SecretDetectionCoverageGapReason, \"file-byte-limit\" \| \"total-byte-limit\"> \| undefined {\n if (byteLength > options.maximumFileBytes) return \"file-byte-limit\";\n return consumedBytes + byteLength > options.maximumTotalBytes ? \"total-byte-limit\" : undefined;\n}\n\nfunction coverageGapsFor(\n paths: readonly string[],\n reason: SecretDetectionCoverageGapReason\n): readonly SecretCoverageGap[] {\n return Object.freeze(paths.map((path) => Object.freeze({ path, reason })));\n}\n"]}
1	+ {"version":3,"file":"input-preparation.mjs","sourceRoot":"","sources":["../../../../src/package-checks/secret-detection/input-preparation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,SAAS,EACT,QAAQ,EACR,QAAQ,EAET,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,OAAO,EACL,4BAA4B,EAE7B,MAAM,qBAAqB,CAAC;AAyB7B,4FAA4F;AAC5F,MAAM,UAAU,4BAA4B,CAC1C,OAA8D,EAC9D,aAAgC;IAEhC,MAAM,YAAY,GAAwB,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;QACpD,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACxE,MAAM,cAAc,GAAG,kBAAkB,CACvC,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAChC,aAAa,EACb,KAAK,CACN,CAAC;QACF,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,YAAY,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;YACrC,MAAM;QACR,CAAC;QACD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;QACpE,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa;YAAE,OAAO,QAAQ,CAAC;QACtF,IAAI,QAAQ,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACrC,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC;YACxC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACpE,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAClB,YAAY,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC;gBAC1F,MAAM;YACR,CAAC;YACD,SAAS;QACX,CAAC;QACD,aAAa,IAAI,QAAQ,CAAC,UAAU,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;QACzC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7B,IAAI,EAAE,UAAU;KACjB,CAAC,CAAC;AACL,CAAC;AA0BD,SAAS,kBAAkB,CACzB,gBAAwB,EACxB,aAAgC,EAChC,KAAa;IAEb,IAAI,KAAK,GAAG,gBAAgB;QAAE,OAAO,SAAS,CAAC;IAC/C,OAAO,eAAe,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,oBAAoB,CAC3B,OAA8D,EAC9D,IAAY,EACZ,aAAqB;IAErB,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,sBAAsB,CAAC;QAClC,aAAa;QACb,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC;QAC7C,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,aAAa,EAAE,CAAC;YAChB,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,IAAI,CAAC,MAAM,KAAK,kBAAkB;SACzC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IAExE,MAAM,cAAc,GAAG,4BAA4B,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAClG,IAAI,cAAc,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QAC3C,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU;YACpC,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,cAAc,CAAC,MAAM;YAC7B,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU;QACjC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;QAC/D,IAAI,EAAE,UAAU;KACjB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAAC,KAI/B;IACC,MAAM,UAAU,GAAG,8BAA8B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAClE,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;IAC5E,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAClF,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAEvF,MAAM,KAAK,GAAG,qBAAqB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAC5D,IAAI,KAAK,KAAK,SAAS,IAAI,qBAAqB,CAAC,UAAU,CAAC,KAAK,UAAU,EAAE,CAAC;YAC5E,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;IAChD,CAAC;YAAS,CAAC;QACT,eAAe,CAAC,UAAU,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB;IACzC,IAAI,CAAC;QACH,SAAS,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,mGAAmG;IACrG,CAAC;AACH,CAAC;AAOD,SAAS,8BAA8B,CAAC,QAAgB;IACtD,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,gBAAgB,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACrD,MAAM,SAAS,GAAG,kBAAkB,EAAE,CAAC;IACvC,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE9C,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,cAAc,GAAG,+BAA+B,CAAC,UAAU,CAAC,CAAC;IACnE,IAAI,cAAc,KAAK,SAAS,IAAI,uBAAuB,CAAC,gBAAgB,EAAE,cAAc,CAAC,EAAE,CAAC;QAC9F,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,eAAe,CAAC,UAAU,CAAC,CAAC;IAC5B,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB;IACzB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC,QAAQ,CAAC;IAC5D,OAAO,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,IAAI,SAAS,CAAC,UAAU,KAAK,CAAC;QAC3E,CAAC,CAAC,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU;QAC3C,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,yBAAyB,CAAC,QAAgB;IACjD,IAAI,CAAC;QACH,OAAO,mBAAmB,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,+BAA+B,CAAC,UAAkB;IACzD,IAAI,CAAC;QACH,OAAO,mBAAmB,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAoB;IAC/C,OAAO,OAAO,CAAC,MAAM,EAAE,IAAI,OAAO,CAAC,GAAG,GAAG,EAAE,IAAI,OAAO,CAAC,GAAG,GAAG,EAAE;QAC7D,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QAC5D,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,uBAAuB,CAC9B,QAA6B,EAC7B,MAA2B;IAE3B,OAAO,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC;AAC9E,CAAC;AAED,SAAS,qBAAqB,CAAC,UAAkB;IAC/C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QACtC,OAAO,OAAO,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC;YAChF,CAAC,CAAC,OAAO,CAAC,IAAI;YACd,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,UAAkB,EAAE,UAAkB;IACnE,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,MAAM,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,QAAQ,CACnB,UAAU,EACV,KAAK,EACL,MAAM,EACN,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,EAC3C,IAAI,CACL,CAAC;QACF,IAAI,IAAI,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAChC,MAAM,IAAI,IAAI,CAAC;IACjB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAuC,EACvC,UAAkB,EAClB,aAAqB;IAErB,IAAI,UAAU,GAAG,OAAO,CAAC,gBAAgB;QAAE,OAAO,iBAAiB,CAAC;IACpE,OAAO,aAAa,GAAG,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC;AACjG,CAAC;AAED,SAAS,eAAe,CACtB,KAAwB,EACxB,MAAwC;IAExC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC","sourcesContent":["import {\n closeSync,\n constants,\n fstatSync,\n lstatSync,\n openSync,\n readSync,\n type BigIntStats\n} from \"node:fs\";\nimport { resolve } from \"node:path\";\n\nimport type { CheckExecutionContext } from \"../../check/check.ts\";\nimport {\n classifySecretDetectionBytes,\n type SecretDetectionCoverageGapReason\n} from \"./classification.ts\";\nimport type { ResolvedSecretDetectionOptions } from \"./options.ts\";\n\n/** Private, already-classified text passed to this Check's private detector adapter. /\nexport interface ApprovedTextInput {\n readonly content: string;\n readonly path: string;\n}\n\n/* A safe explanation for an exact selected input that did not receive detector coverage. /\nexport interface SecretCoverageGap {\n readonly path: string;\n readonly reason: SecretDetectionCoverageGapReason;\n}\n\nexport type PreparedSecretDetectionInputs = Readonly<\n \| { readonly kind: \"cancelled\" }\n \| { readonly kind: \"unavailable\" }\n \| {\n readonly coverageGaps: readonly SecretCoverageGap[];\n readonly inputs: readonly ApprovedTextInput[];\n readonly kind: \"complete\";\n }\n>;\n\n/* Reads and classifies the already-selected paths before the detector can receive text. */\nexport function prepareSecretDetectionInputs(\n context: CheckExecutionContext<ResolvedSecretDetectionOptions>,\n selectedPaths: readonly string[]\n): PreparedSecretDetectionInputs {\n const coverageGaps: SecretCoverageGap[] = [];\n const inputs: ApprovedTextInput[] = [];\n let consumedBytes = 0;\n\n for (const [index, path] of selectedPaths.entries()) {\n if (context.signal.aborted) return Object.freeze({ kind: \"cancelled\" });\n const selectionLimit = selectionLimitGaps(\n context.options.maximumFileCount,\n selectedPaths,\n index\n );\n if (selectionLimit !== undefined) {\n coverageGaps.push(...selectionLimit);\n break;\n }\n const prepared = prepareSelectedInput(context, path, consumedBytes);\n if (prepared.kind === \"cancelled\" \|\| prepared.kind === \"unavailable\") return prepared;\n if (prepared.kind === \"coverage-gap\") {\n consumedBytes += prepared.consumedBytes;\n coverageGaps.push(Object.freeze({ path, reason: prepared.reason }));\n if (prepared.stop) {\n coverageGaps.push(...coverageGapsFor(selectedPaths.slice(index + 1), \"total-byte-limit\"));\n break;\n }\n continue;\n }\n consumedBytes += prepared.byteLength;\n inputs.push(prepared.input);\n }\n return Object.freeze({\n coverageGaps: Object.freeze(coverageGaps),\n inputs: Object.freeze(inputs),\n kind: \"complete\"\n });\n}\n\ntype PreparedSelectedInput = Readonly<\n \| { readonly kind: \"cancelled\" }\n \| { readonly kind: \"unavailable\" }\n \| {\n readonly consumedBytes: number;\n readonly kind: \"coverage-gap\";\n readonly reason: SecretDetectionCoverageGapReason;\n readonly stop: boolean;\n }\n \| { readonly byteLength: number; readonly input: ApprovedTextInput; readonly kind: \"approved\" }\n>;\n\ntype BoundedRegularFileRead = Readonly<\n \| { readonly kind: \"unavailable\" }\n \| {\n readonly kind: \"coverage-gap\";\n readonly reason: Extract<\n SecretDetectionCoverageGapReason,\n \"file-byte-limit\" \| \"total-byte-limit\"\n >;\n }\n \| { readonly bytes: Uint8Array; readonly kind: \"complete\" }\n>;\n\nfunction selectionLimitGaps(\n maximumFileCount: number,\n selectedPaths: readonly string[],\n index: number\n): readonly SecretCoverageGap[] \| undefined {\n if (index < maximumFileCount) return undefined;\n return coverageGapsFor(selectedPaths.slice(index), \"file-count-limit\");\n}\n\nfunction prepareSelectedInput(\n context: CheckExecutionContext<ResolvedSecretDetectionOptions>,\n path: string,\n consumedBytes: number\n): PreparedSelectedInput {\n if (context.signal.aborted) return Object.freeze({ kind: \"cancelled\" });\n const read = readBoundedRegularFile({\n consumedBytes,\n filePath: resolve(context.project.root, path),\n options: context.options\n });\n if (read.kind === \"unavailable\") return read;\n if (read.kind === \"coverage-gap\") {\n return Object.freeze({\n consumedBytes: 0,\n kind: \"coverage-gap\",\n reason: read.reason,\n stop: read.reason === \"total-byte-limit\"\n });\n }\n if (context.signal.aborted) return Object.freeze({ kind: \"cancelled\" });\n\n const classification = classifySecretDetectionBytes(read.bytes, context.options.maximumFileBytes);\n if (classification.kind === \"coverage-gap\") {\n return Object.freeze({\n consumedBytes: read.bytes.byteLength,\n kind: \"coverage-gap\",\n reason: classification.reason,\n stop: false\n });\n }\n return Object.freeze({\n byteLength: read.bytes.byteLength,\n input: Object.freeze({ content: classification.content, path }),\n kind: \"approved\"\n });\n}\n\nfunction readBoundedRegularFile(input: {\n readonly consumedBytes: number;\n readonly filePath: string;\n readonly options: ResolvedSecretDetectionOptions;\n}): BoundedRegularFileRead {\n const descriptor = openIdentityCheckedRegularFile(input.filePath);\n if (descriptor === undefined) return Object.freeze({ kind: \"unavailable\" });\n try {\n const byteLength = regularFileByteLength(descriptor);\n if (byteLength === undefined) return Object.freeze({ kind: \"unavailable\" });\n const limit = resourceLimitReason(input.options, byteLength, input.consumedBytes);\n if (limit !== undefined) return Object.freeze({ kind: \"coverage-gap\", reason: limit });\n\n const bytes = readExactBoundedBytes(descriptor, byteLength);\n if (bytes === undefined \|\| regularFileByteLength(descriptor) !== byteLength) {\n return Object.freeze({ kind: \"unavailable\" });\n }\n return Object.freeze({ bytes, kind: \"complete\" });\n } catch {\n return Object.freeze({ kind: \"unavailable\" });\n } finally {\n closeDescriptor(descriptor);\n }\n}\n\nfunction closeDescriptor(descriptor: number): void {\n try {\n closeSync(descriptor);\n } catch {\n // The descriptor cannot carry source bytes into a public result; preserve the completed read fact.\n }\n}\n\ninterface RegularFileIdentity {\n readonly device: bigint;\n readonly inode: bigint;\n}\n\nfunction openIdentityCheckedRegularFile(filePath: string): number \| undefined {\n const expectedIdentity = regularFileIdentityAtPath(filePath);\n if (expectedIdentity === undefined) return undefined;\n const openFlags = finalLeafOpenFlags();\n if (openFlags === undefined) return undefined;\n\n let descriptor: number;\n try {\n descriptor = openSync(filePath, openFlags);\n } catch {\n return undefined;\n }\n\n const openedIdentity = regularFileIdentityOnDescriptor(descriptor);\n if (openedIdentity !== undefined && sameRegularFileIdentity(expectedIdentity, openedIdentity)) {\n return descriptor;\n }\n closeDescriptor(descriptor);\n return undefined;\n}\n\nfunction finalLeafOpenFlags(): number \| undefined {\n if (process.platform === \"win32\") return constants.O_RDONLY;\n return typeof constants.O_NOFOLLOW === \"number\" && constants.O_NOFOLLOW !== 0\n ? constants.O_RDONLY \| constants.O_NOFOLLOW\n : undefined;\n}\n\nfunction regularFileIdentityAtPath(filePath: string): RegularFileIdentity \| undefined {\n try {\n return regularFileIdentity(lstatSync(filePath, { bigint: true }));\n } catch {\n return undefined;\n }\n}\n\nfunction regularFileIdentityOnDescriptor(descriptor: number): RegularFileIdentity \| undefined {\n try {\n return regularFileIdentity(fstatSync(descriptor, { bigint: true }));\n } catch {\n return undefined;\n }\n}\n\nfunction regularFileIdentity(details: BigIntStats): RegularFileIdentity \| undefined {\n return details.isFile() && details.dev > 0n && details.ino > 0n\n ? Object.freeze({ device: details.dev, inode: details.ino })\n : undefined;\n}\n\nfunction sameRegularFileIdentity(\n expected: RegularFileIdentity,\n opened: RegularFileIdentity\n): boolean {\n return expected.device === opened.device && expected.inode === opened.inode;\n}\n\nfunction regularFileByteLength(descriptor: number): number \| undefined {\n try {\n const details = fstatSync(descriptor);\n return details.isFile() && Number.isSafeInteger(details.size) && details.size >= 0\n ? details.size\n : undefined;\n } catch {\n return undefined;\n }\n}\n\nfunction readExactBoundedBytes(descriptor: number, byteLength: number): Uint8Array \| undefined {\n const bytes = new Uint8Array(byteLength);\n let offset = 0;\n while (offset < bytes.byteLength) {\n const read = readSync(\n descriptor,\n bytes,\n offset,\n Math.min(65_536, bytes.byteLength - offset),\n null\n );\n if (read <= 0) return undefined;\n offset += read;\n }\n return bytes;\n}\n\nfunction resourceLimitReason(\n options: ResolvedSecretDetectionOptions,\n byteLength: number,\n consumedBytes: number\n): Extract<SecretDetectionCoverageGapReason, \"file-byte-limit\" \| \"total-byte-limit\"> \| undefined {\n if (byteLength > options.maximumFileBytes) return \"file-byte-limit\";\n return consumedBytes + byteLength > options.maximumTotalBytes ? \"total-byte-limit\" : undefined;\n}\n\nfunction coverageGapsFor(\n paths: readonly string[],\n reason: SecretDetectionCoverageGapReason\n): readonly SecretCoverageGap[] {\n return Object.freeze(paths.map((path) => Object.freeze({ path, reason })));\n}\n"]}

package/dist/esm/package-checks/secret-detection/options.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"options.mjs","sourceRoot":"","sources":["../../../../src/package-checks/secret-detection/options.ts"],"names":[],"mappings":"","sourcesContent":["import type { FindingWaiver } from \"../../finding-waivers/reconciliation.ts\";\nimport type { ProjectFileSelection } from \"../project-files/configuration.ts\";\n\n/** `secretDetection(options)` 的明确 authoring policy。 /\nexport interface SecretDetectionOptions {\n /* 必填的完整 project-file policy；只有它选中的 path 可以被读取或传给 detector。 /\n readonly files: ProjectFileSelection;\n /* 单个输入允许的最大 raw byte 数；超过时形成不可豁免的 coverage gap。 /\n readonly maximumFileBytes?: number;\n /* 一次 invocation 中允许读取和检测的累计 raw byte 数；超过时形成 coverage gap。 /\n readonly maximumTotalBytes?: number;\n /* 一次 invocation 中允许处理的 selected file 数；超过时形成 coverage gap。 /\n readonly maximumFileCount?: number;\n /* 对安全 finding identity 的精确、可审计误报豁免。 /\n readonly findingWaivers?: readonly FindingWaiver<SecretDetectionFindingIdentity>[];\n}\n\n/* 不含 raw value、message、hash 或 location 的 secret finding 身份。 /\nexport interface SecretDetectionFindingIdentity {\n readonly ordinal: number;\n readonly path: string;\n readonly ruleId: \"@secretlint/secretlint-rule-privatekey\";\n readonly structuralClass: \"text-document\";\n}\n\n/* `secretDetection` execution 消费的完整冻结 options。 /\nexport interface ResolvedSecretDetectionOptions {\n readonly files: ProjectFileSelection;\n readonly findingWaivers: readonly FindingWaiver<SecretDetectionFindingIdentity>[];\n readonly maximumFileBytes: number;\n readonly maximumFileCount: number;\n readonly maximumTotalBytes: number;\n}\n\n/* `findingWaivers` 的 public authoring alias。 */\nexport type SecretDetectionFindingWaiver = FindingWaiver<SecretDetectionFindingIdentity>;\n"]}
1	+ {"version":3,"file":"options.mjs","sourceRoot":"","sources":["../../../../src/package-checks/secret-detection/options.ts"],"names":[],"mappings":"","sourcesContent":["import type { PackageCheckAuthoringOptions } from \"../check-authoring.ts\";\nimport type { FindingWaiver } from \"../../package-tools/finding-waivers/reconciliation.ts\";\nimport type { ProjectFileSelection } from \"../project-files/configuration.ts\";\n\n/** `secretDetection(options)` 的明确 authoring policy。 /\nexport interface SecretDetectionOptions<\n Id extends string = string\n> extends PackageCheckAuthoringOptions<Id> {\n /* 必填的完整 project-file policy；只有它选中的 path 可以被读取或传给 detector。 /\n readonly files: ProjectFileSelection;\n /* 单个输入允许的最大 raw byte 数；超过时形成不可豁免的 coverage gap。 /\n readonly maximumFileBytes?: number;\n /* 一次 invocation 中允许读取和检测的累计 raw byte 数；超过时形成 coverage gap。 /\n readonly maximumTotalBytes?: number;\n /* 一次 invocation 中允许处理的 selected file 数；超过时形成 coverage gap。 /\n readonly maximumFileCount?: number;\n /* 对安全 finding identity 的精确、可审计误报豁免。 /\n readonly findingWaivers?: readonly FindingWaiver<SecretDetectionFindingIdentity>[];\n}\n\n/* 不含 raw value、message、hash 或 location 的 secret finding 身份。 /\nexport interface SecretDetectionFindingIdentity {\n readonly ordinal: number;\n readonly path: string;\n readonly ruleId: \"@secretlint/secretlint-rule-privatekey\";\n readonly structuralClass: \"text-document\";\n}\n\n/* `secretDetection` execution 消费的完整冻结 options。 /\nexport interface ResolvedSecretDetectionOptions {\n readonly files: ProjectFileSelection;\n readonly findingWaivers: readonly FindingWaiver<SecretDetectionFindingIdentity>[];\n readonly maximumFileBytes: number;\n readonly maximumFileCount: number;\n readonly maximumTotalBytes: number;\n}\n\n/* `findingWaivers` 的 public authoring alias。 */\nexport type SecretDetectionFindingWaiver = FindingWaiver<SecretDetectionFindingIdentity>;\n"]}

package/dist/esm/package-checks/secret-detection/records.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"records.mjs","sourceRoot":"","sources":["../../../../src/package-checks/secret-detection/records.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,iCAAiC,EAAE,MAAM,qDAAqD,CAAC;AAIxG,OAAO,EAAE,qCAAqC,EAAE,MAAM,8BAA8B,CAAC;AAgCrF,MAAM,UAAU,qBAAqB,CAAC,KAA2B;IAC/D,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAwC;IAC5E,OAAO,mBAAmB,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,OAAO,iBAAiB,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,KAA+B;IAE/B,MAAM,QAAQ,GAAG,6BAA6B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7D,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,iCAAiC,CAAC,QAAQ,EAAE,KAAK,CAAC;QACxD,EAAE,EAAE,yBAAyB,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,EAAE;KACjE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,6BAA6B,CACpC,MAAiC;IAEjC,MAAM,QAAQ,GAAG,qCAAqC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,SAAS,CAAC,iEAAiE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import type { MaterializedFindingWaiver } from \"../../finding-waivers/reconciliation.ts\";\nimport type {\n FindingWaiverRecordAudit,\n FindingWaiverAuditRecordData\n} from \"../code-quality-findings/finding-waiver-evidence.ts\";\nimport { buildFindingWaiverAuditRecordData } from \"../code-quality-findings/finding-waiver-evidence.ts\";\nimport type { SecretDetectionCoverageGapReason } from \"./classification.ts\";\nimport type { SecretDetectionIssue } from \"./secretlint/adapter.ts\";\nimport type { SecretDetectionFindingIdentity } from \"./options.ts\";\nimport { resolveSecretDetectionFindingIdentity } from \"./finding-waiver-identity.ts\";\n\n/** An actionable or waived high-confidence secret finding. No detector value or message is retained. /\nexport interface SecretDetectionFindingRecordData {\n readonly blocking: boolean;\n readonly kind: \"secret-finding\";\n readonly location: SecretDetectionIssue[\"location\"];\n readonly ordinal: number;\n readonly path: string;\n readonly ruleId: \"@secretlint/secretlint-rule-privatekey\";\n readonly structuralClass: \"text-document\";\n readonly waiver?: Readonly<{ readonly reason: string }>;\n}\n\n/* A deterministic exact-input coverage gap. It is never reconciled through finding waiver policy. /\nexport interface SecretDetectionCoverageGapRecordData {\n readonly blocking: true;\n readonly kind: \"coverage-gap\";\n readonly path: string;\n readonly reason: SecretDetectionCoverageGapReason;\n}\n\n/* Unused or overmatched safe secret finding waiver evidence. /\nexport type SecretDetectionFindingWaiverAuditRecordData =\n FindingWaiverAuditRecordData<SecretDetectionFindingIdentity>;\n\n/* `secretDetection` 发布的全部补充 Record data。 */\nexport type SecretDetectionRecordData =\n \| SecretDetectionCoverageGapRecordData\n \| SecretDetectionFindingRecordData\n \| SecretDetectionFindingWaiverAuditRecordData;\n\nexport function secretFindingIdentity(issue: SecretDetectionIssue): SecretDetectionFindingIdentity {\n return Object.freeze({\n ordinal: issue.ordinal,\n path: issue.path,\n ruleId: issue.ruleId,\n structuralClass: issue.structuralClass\n });\n}\n\nexport function secretFindingRecordId(identity: SecretDetectionFindingIdentity): string {\n return `/secret-finding/${identity.path}/${identity.ordinal}`;\n}\n\nexport function secretCoverageGapRecordId(path: string): string {\n return `/coverage-gap/${path}`;\n}\n\nexport function secretDetectionWaiverAuditRecord(\n audit: FindingWaiverRecordAudit\n): Readonly<{ readonly data: SecretDetectionFindingWaiverAuditRecordData; readonly id: string }> {\n const identity = secretDetectionWaiverIdentity(audit.waiver);\n return Object.freeze({\n data: buildFindingWaiverAuditRecordData(identity, audit),\n id: `/finding-waiver-audit/${identity.path}/${identity.ordinal}`\n });\n}\n\nfunction secretDetectionWaiverIdentity(\n waiver: MaterializedFindingWaiver\n): SecretDetectionFindingIdentity {\n const identity = resolveSecretDetectionFindingIdentity(waiver.identity);\n if (identity === undefined) {\n throw new TypeError(\"secretDetection waiver identity must be a safe finding identity\");\n }\n return identity;\n}\n"]}
1	+ {"version":3,"file":"records.mjs","sourceRoot":"","sources":["../../../../src/package-checks/secret-detection/records.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,iCAAiC,EAAE,MAAM,qDAAqD,CAAC;AAIxG,OAAO,EAAE,qCAAqC,EAAE,MAAM,8BAA8B,CAAC;AAgCrF,MAAM,UAAU,qBAAqB,CAAC,KAA2B;IAC/D,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAwC;IAC5E,OAAO,mBAAmB,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,OAAO,iBAAiB,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,KAA+B;IAE/B,MAAM,QAAQ,GAAG,6BAA6B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7D,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,iCAAiC,CAAC,QAAQ,EAAE,KAAK,CAAC;QACxD,EAAE,EAAE,yBAAyB,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,EAAE;KACjE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,6BAA6B,CACpC,MAAiC;IAEjC,MAAM,QAAQ,GAAG,qCAAqC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,SAAS,CAAC,iEAAiE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import type { MaterializedFindingWaiver } from \"../../package-tools/finding-waivers/reconciliation.ts\";\nimport type {\n FindingWaiverRecordAudit,\n FindingWaiverAuditRecordData\n} from \"../code-quality-findings/finding-waiver-evidence.ts\";\nimport { buildFindingWaiverAuditRecordData } from \"../code-quality-findings/finding-waiver-evidence.ts\";\nimport type { SecretDetectionCoverageGapReason } from \"./classification.ts\";\nimport type { SecretDetectionIssue } from \"./secretlint/adapter.ts\";\nimport type { SecretDetectionFindingIdentity } from \"./options.ts\";\nimport { resolveSecretDetectionFindingIdentity } from \"./finding-waiver-identity.ts\";\n\n/** An actionable or waived high-confidence secret finding. No detector value or message is retained. /\nexport interface SecretDetectionFindingRecordData {\n readonly blocking: boolean;\n readonly kind: \"secret-finding\";\n readonly location: SecretDetectionIssue[\"location\"];\n readonly ordinal: number;\n readonly path: string;\n readonly ruleId: \"@secretlint/secretlint-rule-privatekey\";\n readonly structuralClass: \"text-document\";\n readonly waiver?: Readonly<{ readonly reason: string }>;\n}\n\n/* A deterministic exact-input coverage gap. It is never reconciled through finding waiver policy. /\nexport interface SecretDetectionCoverageGapRecordData {\n readonly blocking: true;\n readonly kind: \"coverage-gap\";\n readonly path: string;\n readonly reason: SecretDetectionCoverageGapReason;\n}\n\n/* Unused or overmatched safe secret finding waiver evidence. /\nexport type SecretDetectionFindingWaiverAuditRecordData =\n FindingWaiverAuditRecordData<SecretDetectionFindingIdentity>;\n\n/* `secretDetection` 发布的全部补充 Record data。 */\nexport type SecretDetectionRecordData =\n \| SecretDetectionCoverageGapRecordData\n \| SecretDetectionFindingRecordData\n \| SecretDetectionFindingWaiverAuditRecordData;\n\nexport function secretFindingIdentity(issue: SecretDetectionIssue): SecretDetectionFindingIdentity {\n return Object.freeze({\n ordinal: issue.ordinal,\n path: issue.path,\n ruleId: issue.ruleId,\n structuralClass: issue.structuralClass\n });\n}\n\nexport function secretFindingRecordId(identity: SecretDetectionFindingIdentity): string {\n return `/secret-finding/${identity.path}/${identity.ordinal}`;\n}\n\nexport function secretCoverageGapRecordId(path: string): string {\n return `/coverage-gap/${path}`;\n}\n\nexport function secretDetectionWaiverAuditRecord(\n audit: FindingWaiverRecordAudit\n): Readonly<{ readonly data: SecretDetectionFindingWaiverAuditRecordData; readonly id: string }> {\n const identity = secretDetectionWaiverIdentity(audit.waiver);\n return Object.freeze({\n data: buildFindingWaiverAuditRecordData(identity, audit),\n id: `/finding-waiver-audit/${identity.path}/${identity.ordinal}`\n });\n}\n\nfunction secretDetectionWaiverIdentity(\n waiver: MaterializedFindingWaiver\n): SecretDetectionFindingIdentity {\n const identity = resolveSecretDetectionFindingIdentity(waiver.identity);\n if (identity === undefined) {\n throw new TypeError(\"secretDetection waiver identity must be a safe finding identity\");\n }\n return identity;\n}\n"]}

package/dist/esm/package-checks/secret-detection/secretlint/adapter.mjs CHANGED Viewed

@@ -46,10 +46,9 @@ export function adaptSecretlintMessages(messages, projectRelativePath) {
 }
 function isPrivateKeyMessage(value) {
     const message = snapshotClosedRecord(value);
-    return (message !== undefined &&
-        message.type === "message" &&
-        message.ruleId === secretDetectionPrivateKeyRuleId &&
-        message.severity === "error");
+    return (message?.type === "message" &&
+        message?.ruleId === secretDetectionPrivateKeyRuleId &&
+        message?.severity === "error");
 }
 function safeLocation(value) {
     const message = snapshotClosedRecord(value);

package/dist/esm/package-checks/secret-detection/secretlint/adapter.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"adapter.mjs","sourceRoot":"","sources":["../../../../../src/package-checks/secret-detection/secretlint/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAC/E,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAEnF,OAAO,EACL,+BAA+B,EAC/B,0CAA0C,EAC3C,MAAM,+BAA+B,CAAC;AAsBvC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAe,EACf,mBAA2B;IAE3B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;YAC9B,MAAM,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,EAAE;YACvE,OAAO,EAAE;gBACP,MAAM,EAAE;oBACN,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,+BAA+B,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;iBAC1F;gBACD,WAAW,EAAE,IAAI;gBACjB,gBAAgB,EAAE,IAAI;aACvB;SACF,CAAC,CAAC;QACH,OAAO,uBAAuB,CAAC,MAAM,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,uBAAuB,CACrC,QAAiB,EACjB,mBAA2B;IAE3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAEhF,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5D,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,MAAM,CAAC;YACZ,QAAQ;YACR,OAAO,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC;YAC1B,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,+BAA+B;YACvC,eAAe,EAAE,0CAA0C;SAC5D,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC5C,OAAO,CACL,OAAO,~~KAAK~~,~~SAAS;QACrB,OAAO,CAAC,~~IAAI,KAAK,SAAS;~~QAC1B~~,OAAO,~~CAAC~~,MAAM,KAAK,+BAA+B;~~QAClD~~,OAAO,~~CAAC~~,QAAQ,KAAK,OAAO,~~CAC7B~~,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IACxB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IACpB,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7D,IAAI,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACpF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC;QACzB,OAAO,EAAE,GAAG,CAAC,IAAI;QACjB,WAAW,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC;QAC7B,SAAS,EAAE,KAAK,CAAC,IAAI;KACtB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CACjB,KAAc;IAEd,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO,CACL,QAAQ,KAAK,SAAS;QACtB,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ;QACnC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC;QACrC,QAAQ,CAAC,MAAM,IAAI,CAAC;QACpB,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;QACjC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC;QACnC,QAAQ,CAAC,IAAI,IAAI,CAAC,CACnB,CAAC;AACJ,CAAC","sourcesContent":["import { snapshotClosedRecord } from \"../../../data-boundary/closed-values.ts\";\nimport { lintSource } from \"@secretlint/core\";\nimport { creator as privateKeyRule } from \"@secretlint/secretlint-rule-privatekey\";\n\nimport {\n secretDetectionPrivateKeyRuleId,\n secretDetectionTextDocumentStructuralClass\n} from \"../finding-waiver-identity.ts\";\n\n/** The only detector result shape allowed to leave this private adapter. /\nexport interface SecretDetectionIssue {\n readonly location: Readonly<{\n readonly endColumn: number;\n readonly endLine: number;\n readonly startColumn: number;\n readonly startLine: number;\n }>;\n readonly ordinal: number;\n readonly path: string;\n readonly ruleId: \"@secretlint/secretlint-rule-privatekey\";\n readonly structuralClass: \"text-document\";\n}\n\nexport type SecretlintDetectionResult = Readonly<\n \| { readonly issues: readonly SecretDetectionIssue[]; readonly kind: \"complete\" }\n \| { readonly kind: \"protocol-failed\" }\n \| { readonly kind: \"unavailable\" }\n>;\n\n/\n Runs the fixed local Secretlint rule set against already-approved in-memory text.\n * Third-party result, message text, data, error, and source content never leave this module.\n /\nexport async function detectSecretlintIssues(\n content: string,\n projectRelativePath: string\n): Promise<SecretlintDetectionResult> {\n try {\n const result = await lintSource({\n source: { content, contentType: \"text\", filePath: projectRelativePath },\n options: {\n config: {\n rules: [{ id: secretDetectionPrivateKeyRuleId, rule: privateKeyRule, severity: \"error\" }]\n },\n maskSecrets: true,\n noPhysicFilePath: true\n }\n });\n return adaptSecretlintMessages(result.messages, projectRelativePath);\n } catch {\n return Object.freeze({ kind: \"unavailable\" });\n }\n}\n\n/* Converts only allowlisted Secretlint message fields to the safe Check-local issue DTO. */\nexport function adaptSecretlintMessages(\n messages: unknown,\n projectRelativePath: string\n): SecretlintDetectionResult {\n if (!Array.isArray(messages)) return Object.freeze({ kind: \"protocol-failed\" });\n\n const issues: SecretDetectionIssue[] = [];\n for (const message of messages) {\n const location = safeLocation(message);\n if (location === undefined \|\| !isPrivateKeyMessage(message)) {\n return Object.freeze({ kind: \"protocol-failed\" });\n }\n issues.push(\n Object.freeze({\n location,\n ordinal: issues.length + 1,\n path: projectRelativePath,\n ruleId: secretDetectionPrivateKeyRuleId,\n structuralClass: secretDetectionTextDocumentStructuralClass\n })\n );\n }\n return Object.freeze({ issues: Object.freeze(issues), kind: \"complete\" });\n}\n\nfunction isPrivateKeyMessage(value: unknown): boolean {\n const message = snapshotClosedRecord(value);\n return (\n message ~~!== undefined &&\n message.~~type === \"message\" &&\n message.ruleId === secretDetectionPrivateKeyRuleId &&\n message.severity === \"error\"\n );\n}\n\nfunction safeLocation(value: unknown): SecretDetectionIssue[\"location\"] \| undefined {\n const message = snapshotClosedRecord(value);\n if (message === undefined) return undefined;\n const loc = snapshotClosedRecord(message.loc);\n if (loc === undefined) return undefined;\n const start = loc.start;\n const end = loc.end;\n if (!isPosition(start) \|\| !isPosition(end)) return undefined;\n if (end.line < start.line \|\| (end.line === start.line && end.column < start.column)) {\n return undefined;\n }\n return Object.freeze({\n endColumn: end.column + 1,\n endLine: end.line,\n startColumn: start.column + 1,\n startLine: start.line\n });\n}\n\nfunction isPosition(\n value: unknown\n): value is Readonly<{ readonly column: number; readonly line: number }> {\n const position = snapshotClosedRecord(value);\n return (\n position !== undefined &&\n typeof position.column === \"number\" &&\n Number.isSafeInteger(position.column) &&\n position.column >= 0 &&\n typeof position.line === \"number\" &&\n Number.isSafeInteger(position.line) &&\n position.line >= 1\n );\n}\n"]}
1	+ {"version":3,"file":"adapter.mjs","sourceRoot":"","sources":["../../../../../src/package-checks/secret-detection/secretlint/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAC/E,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAEnF,OAAO,EACL,+BAA+B,EAC/B,0CAA0C,EAC3C,MAAM,+BAA+B,CAAC;AAsBvC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAe,EACf,mBAA2B;IAE3B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;YAC9B,MAAM,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,EAAE;YACvE,OAAO,EAAE;gBACP,MAAM,EAAE;oBACN,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,+BAA+B,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;iBAC1F;gBACD,WAAW,EAAE,IAAI;gBACjB,gBAAgB,EAAE,IAAI;aACvB;SACF,CAAC,CAAC;QACH,OAAO,uBAAuB,CAAC,MAAM,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,uBAAuB,CACrC,QAAiB,EACjB,mBAA2B;IAE3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAEhF,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5D,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,MAAM,CAAC;YACZ,QAAQ;YACR,OAAO,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC;YAC1B,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,+BAA+B;YACvC,eAAe,EAAE,0CAA0C;SAC5D,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC5C,OAAO,CACL,OAAO,EAAE,IAAI,KAAK,SAAS;QAC3B,OAAO,EAAE,MAAM,KAAK,+BAA+B;QACnD,OAAO,EAAE,QAAQ,KAAK,OAAO,CAC9B,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IACxB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IACpB,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7D,IAAI,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACpF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC;QACzB,OAAO,EAAE,GAAG,CAAC,IAAI;QACjB,WAAW,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC;QAC7B,SAAS,EAAE,KAAK,CAAC,IAAI;KACtB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CACjB,KAAc;IAEd,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO,CACL,QAAQ,KAAK,SAAS;QACtB,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ;QACnC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC;QACrC,QAAQ,CAAC,MAAM,IAAI,CAAC;QACpB,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;QACjC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC;QACnC,QAAQ,CAAC,IAAI,IAAI,CAAC,CACnB,CAAC;AACJ,CAAC","sourcesContent":["import { snapshotClosedRecord } from \"../../../data-boundary/closed-values.ts\";\nimport { lintSource } from \"@secretlint/core\";\nimport { creator as privateKeyRule } from \"@secretlint/secretlint-rule-privatekey\";\n\nimport {\n secretDetectionPrivateKeyRuleId,\n secretDetectionTextDocumentStructuralClass\n} from \"../finding-waiver-identity.ts\";\n\n/** The only detector result shape allowed to leave this private adapter. /\nexport interface SecretDetectionIssue {\n readonly location: Readonly<{\n readonly endColumn: number;\n readonly endLine: number;\n readonly startColumn: number;\n readonly startLine: number;\n }>;\n readonly ordinal: number;\n readonly path: string;\n readonly ruleId: \"@secretlint/secretlint-rule-privatekey\";\n readonly structuralClass: \"text-document\";\n}\n\nexport type SecretlintDetectionResult = Readonly<\n \| { readonly issues: readonly SecretDetectionIssue[]; readonly kind: \"complete\" }\n \| { readonly kind: \"protocol-failed\" }\n \| { readonly kind: \"unavailable\" }\n>;\n\n/\n Runs the fixed local Secretlint rule set against already-approved in-memory text.\n * Third-party result, message text, data, error, and source content never leave this module.\n /\nexport async function detectSecretlintIssues(\n content: string,\n projectRelativePath: string\n): Promise<SecretlintDetectionResult> {\n try {\n const result = await lintSource({\n source: { content, contentType: \"text\", filePath: projectRelativePath },\n options: {\n config: {\n rules: [{ id: secretDetectionPrivateKeyRuleId, rule: privateKeyRule, severity: \"error\" }]\n },\n maskSecrets: true,\n noPhysicFilePath: true\n }\n });\n return adaptSecretlintMessages(result.messages, projectRelativePath);\n } catch {\n return Object.freeze({ kind: \"unavailable\" });\n }\n}\n\n/* Converts only allowlisted Secretlint message fields to the safe Check-local issue DTO. */\nexport function adaptSecretlintMessages(\n messages: unknown,\n projectRelativePath: string\n): SecretlintDetectionResult {\n if (!Array.isArray(messages)) return Object.freeze({ kind: \"protocol-failed\" });\n\n const issues: SecretDetectionIssue[] = [];\n for (const message of messages) {\n const location = safeLocation(message);\n if (location === undefined \|\| !isPrivateKeyMessage(message)) {\n return Object.freeze({ kind: \"protocol-failed\" });\n }\n issues.push(\n Object.freeze({\n location,\n ordinal: issues.length + 1,\n path: projectRelativePath,\n ruleId: secretDetectionPrivateKeyRuleId,\n structuralClass: secretDetectionTextDocumentStructuralClass\n })\n );\n }\n return Object.freeze({ issues: Object.freeze(issues), kind: \"complete\" });\n}\n\nfunction isPrivateKeyMessage(value: unknown): boolean {\n const message = snapshotClosedRecord(value);\n return (\n message?.type === \"message\" &&\n message?.ruleId === secretDetectionPrivateKeyRuleId &&\n message?.severity === \"error\"\n );\n}\n\nfunction safeLocation(value: unknown): SecretDetectionIssue[\"location\"] \| undefined {\n const message = snapshotClosedRecord(value);\n if (message === undefined) return undefined;\n const loc = snapshotClosedRecord(message.loc);\n if (loc === undefined) return undefined;\n const start = loc.start;\n const end = loc.end;\n if (!isPosition(start) \|\| !isPosition(end)) return undefined;\n if (end.line < start.line \|\| (end.line === start.line && end.column < start.column)) {\n return undefined;\n }\n return Object.freeze({\n endColumn: end.column + 1,\n endLine: end.line,\n startColumn: start.column + 1,\n startLine: start.line\n });\n}\n\nfunction isPosition(\n value: unknown\n): value is Readonly<{ readonly column: number; readonly line: number }> {\n const position = snapshotClosedRecord(value);\n return (\n position !== undefined &&\n typeof position.column === \"number\" &&\n Number.isSafeInteger(position.column) &&\n position.column >= 0 &&\n typeof position.line === \"number\" &&\n Number.isSafeInteger(position.line) &&\n position.line >= 1\n );\n}\n"]}

package/dist/esm/package-tools/admission-policy/define-admission-policy.mjs ADDED Viewed

@@ -0,0 +1,10 @@
+/**
+ * 保留 closed admission policy literal 的 TypeScript inference，不创建额外运行语义。
+ *
+ * @remarks inline policy 与此 helper 的结果完全等价。custom simple `decide` 同步运行；prepared
+ * strategy 为每个 graph-ready Run 解析独立 closure，调用方负责其 trusted host callback 的可重入性。
+ */
+export function defineAdmissionPolicy(policy) {
+    return policy;
+}
+//# sourceMappingURL=define-admission-policy.mjs.map

package/dist/esm/package-tools/admission-policy/define-admission-policy.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"define-admission-policy.mjs","sourceRoot":"","sources":["../../../../src/package-tools/admission-policy/define-admission-policy.ts"],"names":[],"mappings":"AA2CA;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAA+B;IAE/B,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type {\n AdmissionPolicy,\n CustomAdmissionPreparationContext,\n CustomAdmissionStrategy,\n PreparedCustomAdmissionStrategy\n} from \"../../project-definition/scheduler-policy.ts\";\n\ntype ExactAdmissionPolicy<T extends AdmissionPolicy> =\n T extends Readonly<{ readonly kind: \"static\" }>\n ? T & Record<Exclude<keyof T, \"kind\">, never>\n : T extends Readonly<{ readonly kind: \"custom\" }>\n ? T &\n Record<Exclude<keyof T, \"kind\" | \"strategy\">, never> &\n Readonly<{\n readonly strategy: ExactCustomAdmissionStrategy<T[\"strategy\"]>;\n }>\n : never;\n\ntype ExactCustomAdmissionStrategy<T extends CustomAdmissionStrategy> =\n T extends Readonly<{ readonly kind: \"simple\" }>\n ? T & Record<Exclude<keyof T, \"kind\" | \"decide\">, never>\n : T extends Readonly<{ readonly kind: \"prepared\" }>\n ? T &\n Record<Exclude<keyof T, \"kind\" | \"prepare\">, never> &\n Readonly<{ readonly prepare: ExactCustomPreparation<T[\"prepare\"]> }>\n : never;\n\ntype ExactCustomPreparation<T> = T extends (\n this: void,\n context: CustomAdmissionPreparationContext\n) => infer Result\n ? (this: void, context: CustomAdmissionPreparationContext) => ExactCustomPreparationResult<Result>\n : never;\n\ntype ExactCustomPreparationResult<T> =\n T extends Promise<unknown>\n ? Promise<ExactPreparedCustomAdmissionStrategy<Awaited<T>>>\n : ExactPreparedCustomAdmissionStrategy<T>;\n\ntype ExactPreparedCustomAdmissionStrategy<T> = T extends PreparedCustomAdmissionStrategy\n ? T & Record<Exclude<keyof T, \"decide\" | \"terminalEffect\">, never>\n : never;\n\n/**\n * 保留 closed admission policy literal 的 TypeScript inference，不创建额外运行语义。\n *\n * @remarks inline policy 与此 helper 的结果完全等价。custom simple `decide` 同步运行；prepared\n * strategy 为每个 graph-ready Run 解析独立 closure，调用方负责其 trusted host callback 的可重入性。\n */\nexport function defineAdmissionPolicy<const T extends AdmissionPolicy>(\n policy: ExactAdmissionPolicy<T>\n): T {\n return policy;\n}\n"]}

package/dist/esm/{cache → package-tools/cache}/cache-json-by-key.mjs RENAMED Viewed

@@ -2,8 +2,8 @@
 import { createHash, randomUUID } from "node:crypto";
 import { promises as fs } from "node:fs";
 import { isAbsolute, join } from "node:path";
-import { canonicalizeJsonObject, canonicalJsonBytes } from "../data-boundary/canonical-data.mjs";
-import { hasExactPlainRecordKeys, snapshotClosedRecord } from "../data-boundary/closed-values.mjs";
+import { canonicalizeJsonObject, canonicalJsonBytes } from "../../data-boundary/canonical-data.mjs";
+import { snapshotExactClosedRecord } from "../../data-boundary/closed-values.mjs";
 const CACHE_API_VERSION = "caller-keyed-json-v1";
 const CACHE_ENVELOPE_KEYS = ["cacheFormatVersion", "identityDigest", "payload"];
 /**
@@ -46,16 +46,15 @@ export async function cacheJsonByKey(authoredOptions) {
     });
 }
 function parseOptions(value) {
-    const record = snapshotClosedRecord(value);
-    if (record === undefined ||
-        !hasExactPlainRecordKeys(record, [
-            "compute",
-            "directory",
-            "key",
-            "namespace",
-            "parse",
-            "version"
-        ])) {
+    const record = snapshotExactClosedRecord(value, [
+        "compute",
+        "directory",
+        "key",
+        "namespace",
+        "parse",
+        "version"
+    ]);
+    if (record === undefined) {
         throw new TypeError("cacheJsonByKey options must be a closed object");
     }
     const { compute, directory, key, namespace, parse, version } = record;
@@ -129,8 +128,8 @@ async function readCacheEntry(input) {
     }
 }
 function parseEnvelope(value, identityDigest) {
-    const record = snapshotClosedRecord(value);
-    if (record === undefined || !hasExactPlainRecordKeys(record, CACHE_ENVELOPE_KEYS))
+    const record = snapshotExactClosedRecord(value, CACHE_ENVELOPE_KEYS);
+    if (record === undefined)
         return undefined;
     if (record.cacheFormatVersion !== CACHE_API_VERSION || record.identityDigest !== identityDigest) {
         return undefined;

package/dist/esm/package-tools/cache/cache-json-by-key.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"cache-json-by-key.mjs","sourceRoot":"","sources":["../../../../src/package-tools/cache/cache-json-by-key.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAEnB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AAEjF,MAAM,iBAAiB,GAAG,sBAAsB,CAAC;AACjD,MAAM,mBAAmB,GAAG,CAAC,oBAAoB,EAAE,gBAAgB,EAAE,SAAS,CAAU,CAAC;AAiDzF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,eAAyC;IAEzC,MAAM,OAAO,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;IAC9C,MAAM,cAAc,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,cAAc,OAAO,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IAC1F,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;QACf,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,OAAO;YACf,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,eAAe;SACvB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAChE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,SAAS,CAAC,4DAA4D,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;QACrC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,cAAc;QACd,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO;QACP,UAAU;KACX,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE,UAAU;QAClB,KAAK;QACL,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;KACpC,CAAC,CAAC;AACL,CAAC;AAWD,SAAS,YAAY,CAAmB,KAA+B;IACrE,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,EAAE;QAC9C,SAAS;QACT,WAAW;QACX,KAAK;QACL,WAAW;QACX,OAAO;QACP,SAAS;KACV,CAAC,CAAC;IACH,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IACtE,IAAI,OAAO,OAAO,KAAK,UAAU,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;QACjE,MAAM,IAAI,SAAS,CAAC,oDAAoD,CAAC,CAAC;IAC5E,CAAC;IACD,IACE,OAAO,SAAS,KAAK,QAAQ;QAC7B,SAAS,CAAC,MAAM,KAAK,CAAC;QACtB,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;QACxB,CAAC,UAAU,CAAC,SAAS,CAAC,EACtB,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,SAAS,CAAC,qDAAqD,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,SAAS,CAAC,mDAAmD,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,SAAS,CAAC,+CAA+C,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,YAAY,GAAqB;QACrC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;IACF,IACE,YAAY,CAAC,OAAO,KAAK,OAAO;QAChC,YAAY,CAAC,SAAS,KAAK,SAAS;QACpC,YAAY,CAAC,GAAG,KAAK,GAAG;QACxB,YAAY,CAAC,SAAS,KAAK,SAAS;QACpC,YAAY,CAAC,KAAK,KAAK,KAAK;QAC5B,YAAY,CAAC,OAAO,KAAK,OAAO,EAChC,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,mBAAmB,CAAC,OAA8B;IACzD,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CACL,kBAAkB,CAAC;QACjB,eAAe,EAAE,iBAAiB;QAClC,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,cAAc,EAAE,OAAO,CAAC,OAAO;KAChC,CAAC,CACH;SACA,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAMD,KAAK,UAAU,cAAc,CAC3B,KAIE;IAEF,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,OAAO,aAAa,CAAC,KAAK,CAAC;YACzB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC7C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QACzE,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAClF,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,GAAG,EAAE,IAAI;YACT,KAAK,EAAE,kBAAkB,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;SAC3E,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,KAAc,EACd,cAAsB;IAEtB,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;IACrE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,IAAI,MAAM,CAAC,kBAAkB,KAAK,iBAAiB,IAAI,MAAM,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;QAChG,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvD,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,kBAAkB,CACzB,KAA4B,EAC5B,OAA4B,EAC5B,OAAe;IAEf,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,UAAU,CAAC,KAAK,CAAC;QACnB,MAAM,IAAI,SAAS,CAAC,kDAAkD,OAAO,EAAE,CAAC,CAAC;IACnF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,CACL,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,IAAI,OAAO,KAAK,KAAK,UAAU,CAAC;QAC9E,OAAQ,KAA4B,CAAC,IAAI,KAAK,UAAU,CACzD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAME;IAEF,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,qBAAqB,UAAU,EAAE,MAAM,CAAC,CAAC;IACrF,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,MAAM,EAAE,CAAC,SAAS,CAChB,aAAa,EACb,IAAI,CAAC,SAAS,CAAC;YACb,kBAAkB,EAAE,iBAAiB;YACrC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,EACF,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CACjC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,EAAE,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACnE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;YACtC,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC;gBACtC,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC,CAAC;YACH,MAAM,EAAE,CAAC,EAAE,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACnE,OAAO,UAAU,CAAC,GAAG,CAAC;QACxB,CAAC;QACD,MAAM,EAAE,CAAC,EAAE,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACnE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAc;IAChD,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAK,KAA4B,CAAC,IAAI,KAAK,QAAQ,CAC/F,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAK,KAA4B,CAAC,IAAI,KAAK,QAAQ,CAC/F,CAAC;AACJ,CAAC","sourcesContent":["/** caller-keyed canonical JSON cache 的公开存储边界。 */\nimport { createHash, randomUUID } from \"node:crypto\";\nimport { promises as fs } from \"node:fs\";\nimport { isAbsolute, join } from \"node:path\";\n\nimport {\n canonicalizeJsonObject,\n canonicalJsonBytes,\n type CanonicalJsonObject\n} from \"../../data-boundary/canonical-data.ts\";\nimport { snapshotExactClosedRecord } from \"../../data-boundary/closed-values.ts\";\n\nconst CACHE_API_VERSION = \"caller-keyed-json-v1\";\nconst CACHE_ENVELOPE_KEYS = [\"cacheFormatVersion\", \"identityDigest\", \"payload\"] as const;\n\n/**\n * `cacheJsonByKey` 的 caller-owned identity、payload parser 与 computation。\n *\n * `key` 必须覆盖所有会改变 computation 结果的输入、实现、options、toolchain 与声明的外部状态；\n * 不能放入 secret 或低熵敏感值。`directory` 是调用方信任、可自行删除的本地状态空间。\n */\ntype NonThenable<T extends object> = T & Readonly<{ readonly then?: undefined }>;\n\n/** Caller-keyed JSON cache 的 options。 */\nexport interface CacheJsonByKeyOptions<T extends object> {\n /** cache miss、读取失败或 payload 无效时执行的 sync/async computation。 */\n readonly compute: () => unknown;\n /** 调用方信任、可自行清理的 absolute local directory。 */\n readonly directory: string;\n /** 覆盖所有影响 computation 结果的完整 semantic key；不得包含 secret 或低熵敏感值。 */\n readonly key: string;\n /** 调用方为这一类缓存选择的非空 identity namespace。 */\n readonly namespace: string;\n /** 同步验证 cached/computed canonical JSON object，并返回调用方的 typed value。 */\n readonly parse: (value: unknown) => NonThenable<T>;\n /** 调用方控制、在 payload 或 computation contract 改变时更新的非空版本。 */\n readonly version: string;\n}\n\n/** `cacheJsonByKey` 返回的闭合 cache observation 与本次 parser value。 */\nexport type CacheJsonByKeyResult<T extends object> =\n | Readonly<{\n /** 已读取并通过 parser 验证现有 payload。 */\n readonly read: \"hit\";\n /** 本次 value 来自 cache，不调用 `compute`。 */\n readonly source: \"cache\";\n /** `parse` 返回的调用方 typed value。 */\n readonly value: T;\n /** cache hit 不尝试重新写入。 */\n readonly write: \"not-attempted\";\n }>\n | Readonly<{\n /** 没有 entry、读取失败，或已有 payload 未通过 identity/parser 验证。 */\n readonly read: \"failed\" | \"invalid\" | \"miss\";\n /** 本次 value 来自成功的 `compute` 与 `parse`。 */\n readonly source: \"computed\";\n /** `parse` 返回的调用方 typed value。 */\n readonly value: T;\n /** 新 payload 已存储，或存储失败但 typed value 仍可使用。 */\n readonly write: \"failed\" | \"stored\";\n }>;\n\n/**\n * 按 caller 提供的完整 semantic key 复用本地 canonical JSON object。\n *\n * cache hit 不会跳过或重放 Check settlement、Records、messages、duration 或 side effects。读取或写入失败\n * 只通过返回的 observation 可见；只要 `compute` 与 `parse` 成功，就仍返回本次 computation 的 value。\n * 不提供依赖发现、默认目录、lock/single-flight、TTL/LRU、cleanup、remote cache 或 tamper protection。\n */\nexport async function cacheJsonByKey<T extends object>(\n authoredOptions: CacheJsonByKeyOptions<T>\n): Promise<CacheJsonByKeyResult<T>> {\n const options = parseOptions(authoredOptions);\n const identityDigest = cacheIdentityDigest(options);\n const targetPath = join(options.directory, `${identityDigest}.json`);\n const cached = await readCacheEntry({ identityDigest, parse: options.parse, targetPath });\n if (cached.hit) {\n return Object.freeze({\n read: \"hit\",\n source: \"cache\",\n value: cached.value,\n write: \"not-attempted\"\n });\n }\n\n const payload = canonicalizeJsonObject(await options.compute());\n if (payload === undefined) {\n throw new TypeError(\"cacheJsonByKey compute must return a canonical JSON object\");\n }\n const value = parseSynchronously(options.parse, payload, \"computed value\");\n const stored = await publishCacheEntry({\n directory: options.directory,\n identityDigest,\n parse: options.parse,\n payload,\n targetPath\n });\n return Object.freeze({\n read: cached.read,\n source: \"computed\",\n value,\n write: stored ? \"stored\" : \"failed\"\n });\n}\n\ntype ParsedOptions<T extends object> = Readonly<{\n readonly compute: () => unknown;\n readonly directory: string;\n readonly key: string;\n readonly namespace: string;\n readonly parse: (value: unknown) => T;\n readonly version: string;\n}>;\n\nfunction parseOptions<T extends object>(value: CacheJsonByKeyOptions<T>): ParsedOptions<T> {\n const record = snapshotExactClosedRecord(value, [\n \"compute\",\n \"directory\",\n \"key\",\n \"namespace\",\n \"parse\",\n \"version\"\n ]);\n if (record === undefined) {\n throw new TypeError(\"cacheJsonByKey options must be a closed object\");\n }\n const { compute, directory, key, namespace, parse, version } = record;\n if (typeof compute !== \"function\" || typeof parse !== \"function\") {\n throw new TypeError(\"cacheJsonByKey compute and parse must be functions\");\n }\n if (\n typeof directory !== \"string\" ||\n directory.length === 0 ||\n directory.includes(\"\\0\") ||\n !isAbsolute(directory)\n ) {\n throw new TypeError(\n \"cacheJsonByKey directory must be a non-empty absolute path without U+0000\"\n );\n }\n if (typeof namespace !== \"string\" || namespace.length === 0) {\n throw new TypeError(\"cacheJsonByKey namespace must be a non-empty string\");\n }\n if (typeof version !== \"string\" || version.length === 0) {\n throw new TypeError(\"cacheJsonByKey version must be a non-empty string\");\n }\n if (typeof key !== \"string\" || key.length === 0) {\n throw new TypeError(\"cacheJsonByKey key must be a non-empty string\");\n }\n const typedOptions: ParsedOptions<T> = {\n compute: value.compute,\n directory: value.directory,\n key: value.key,\n namespace: value.namespace,\n parse: value.parse,\n version: value.version\n };\n if (\n typedOptions.compute !== compute ||\n typedOptions.directory !== directory ||\n typedOptions.key !== key ||\n typedOptions.namespace !== namespace ||\n typedOptions.parse !== parse ||\n typedOptions.version !== version\n ) {\n throw new TypeError(\"cacheJsonByKey options changed during validation\");\n }\n return Object.freeze(typedOptions);\n}\n\nfunction cacheIdentityDigest(options: ParsedOptions<object>): string {\n return createHash(\"sha256\")\n .update(\n canonicalJsonBytes({\n cacheApiVersion: CACHE_API_VERSION,\n key: options.key,\n namespace: options.namespace,\n payloadVersion: options.version\n })\n )\n .digest(\"hex\");\n}\n\ntype CacheRead<T extends object> =\n | Readonly<{ readonly hit: true; readonly value: T }>\n | Readonly<{ readonly hit: false; readonly read: \"failed\" | \"invalid\" | \"miss\" }>;\n\nasync function readCacheEntry<T extends object>(\n input: Readonly<{\n readonly identityDigest: string;\n readonly parse: (value: unknown) => T;\n readonly targetPath: string;\n }>\n): Promise<CacheRead<T>> {\n let source: string;\n try {\n source = await fs.readFile(input.targetPath, \"utf8\");\n } catch (error: unknown) {\n return isMissingPath(error)\n ? Object.freeze({ hit: false, read: \"miss\" })\n : Object.freeze({ hit: false, read: \"failed\" });\n }\n try {\n const envelope = parseEnvelope(JSON.parse(source), input.identityDigest);\n if (envelope === undefined) return Object.freeze({ hit: false, read: \"invalid\" });\n return Object.freeze({\n hit: true,\n value: parseSynchronously(input.parse, envelope.payload, \"cached payload\")\n });\n } catch {\n return Object.freeze({ hit: false, read: \"invalid\" });\n }\n}\n\nfunction parseEnvelope(\n value: unknown,\n identityDigest: string\n): Readonly<{ readonly payload: CanonicalJsonObject }> | undefined {\n const record = snapshotExactClosedRecord(value, CACHE_ENVELOPE_KEYS);\n if (record === undefined) return undefined;\n if (record.cacheFormatVersion !== CACHE_API_VERSION || record.identityDigest !== identityDigest) {\n return undefined;\n }\n const payload = canonicalizeJsonObject(record.payload);\n return payload === undefined ? undefined : Object.freeze({ payload });\n}\n\nfunction parseSynchronously<T extends object>(\n parse: (value: unknown) => T,\n payload: CanonicalJsonObject,\n subject: string\n): T {\n const value = parse(payload);\n if (isThenable(value))\n throw new TypeError(`cacheJsonByKey parse must synchronously return ${subject}`);\n return value;\n}\n\nfunction isThenable(value: unknown): boolean {\n return (\n ((typeof value === \"object\" && value !== null) || typeof value === \"function\") &&\n typeof (value as { then?: unknown }).then === \"function\"\n );\n}\n\nasync function publishCacheEntry<T extends object>(\n input: Readonly<{\n readonly directory: string;\n readonly identityDigest: string;\n readonly parse: (value: unknown) => T;\n readonly payload: CanonicalJsonObject;\n readonly targetPath: string;\n }>\n): Promise<boolean> {\n const temporaryPath = join(input.directory, `.vibe-check-cache-${randomUUID()}.tmp`);\n try {\n await fs.mkdir(input.directory, { recursive: true });\n await fs.writeFile(\n temporaryPath,\n JSON.stringify({\n cacheFormatVersion: CACHE_API_VERSION,\n identityDigest: input.identityDigest,\n payload: input.payload\n }),\n { encoding: \"utf8\", flag: \"wx\" }\n );\n } catch {\n await fs.rm(temporaryPath, { force: true }).catch(() => undefined);\n return false;\n }\n\n try {\n await fs.rename(temporaryPath, input.targetPath);\n return true;\n } catch (error: unknown) {\n if (isConcurrentTargetConflict(error)) {\n const concurrent = await readCacheEntry({\n identityDigest: input.identityDigest,\n parse: input.parse,\n targetPath: input.targetPath\n });\n await fs.rm(temporaryPath, { force: true }).catch(() => undefined);\n return concurrent.hit;\n }\n await fs.rm(temporaryPath, { force: true }).catch(() => undefined);\n return false;\n }\n}\n\nfunction isConcurrentTargetConflict(error: unknown): boolean {\n return (\n typeof error === \"object\" && error !== null && (error as { code?: unknown }).code === \"EEXIST\"\n );\n}\n\nfunction isMissingPath(error: unknown): boolean {\n return (\n typeof error === \"object\" && error !== null && (error as { code?: unknown }).code === \"ENOENT\"\n );\n}\n"]}

package/dist/esm/package-tools/finding-presentation/finding-presentation.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"finding-presentation.mjs","sourceRoot":"","sources":["../../../../src/package-tools/finding-presentation/finding-presentation.ts"],"names":[],"mappings":"AAeA;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAU,KAK7C;IACC,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAE1D,MAAM,iBAAiB,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CACxD,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,CACpD,CAAC;IACF,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACzE,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,QAAQ,CAAC,IAAI,CACX,MAAM,CAAC,MAAM,CAAC;YACZ,GAAG,KAAK,CAAC,cAAc,CACrB,MAAM,CAAC,MAAM,CAAC;gBACZ,eAAe;gBACf,YAAY,EAAE,eAAe,CAAC,MAAM;gBACpC,cAAc,EAAE,iBAAiB,CAAC,MAAM;gBACxC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;aAClC,CAAC,CACH;SACF,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,mBAAmB,CACjC,MAAyB,EACzB,QAAiC;IAEjC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACzC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,MAAM;QACT,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC;KACnE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,SAAS,CAAC,gEAAgE,CAAC,CAAC;IACxF,CAAC;AACH,CAAC","sourcesContent":["import type { CheckResult } from \"../../check/check.ts\";\n\ntype CheckMessage = NonNullable<CheckResult[\"messages\"]>[number];\n\n/**\n * 将 Check-owned Finding 投影为有界 terminal messages 所需的超限上下文。\n * 完整 Finding facts 与深入查看位置继续由调用方拥有。\n */\nexport interface FindingOverflowContext<Finding> {\n readonly omittedFindings: readonly Finding[];\n readonly omittedCount: number;\n readonly presentedCount: number;\n readonly totalCount: number;\n}\n\n/**\n * 将调用方已经稳定排序的 Finding 投影为有界 Check messages。\n *\n * `limit`、安全字段和超限后的深入查看说明都由 producing Check 决定。Product 不读取 Finding\n * shape，也不猜测完整明细位于 Records、artifact、transcript 或其它位置。\n */\nexport function presentCheckFindings<Finding>(input: {\n readonly findings: readonly Finding[];\n readonly limit: number;\n readonly message: (finding: Finding, index: number) => CheckMessage;\n readonly omittedMessage: (context: FindingOverflowContext<Finding>) => CheckMessage;\n}): readonly CheckMessage[] {\n assertFindingLimit(input.limit);\n if (input.findings.length === 0) return Object.freeze([]);\n\n const presentedFindings = input.findings.slice(0, input.limit);\n const messages = presentedFindings.map((finding, index) =>\n Object.freeze({ ...input.message(finding, index) })\n );\n const omittedFindings = Object.freeze(input.findings.slice(input.limit));\n if (omittedFindings.length > 0) {\n messages.push(\n Object.freeze({\n ...input.omittedMessage(\n Object.freeze({\n omittedFindings,\n omittedCount: omittedFindings.length,\n presentedCount: presentedFindings.length,\n totalCount: input.findings.length\n })\n )\n })\n );\n }\n return Object.freeze(messages);\n}\n\n/** Appends presentation-only messages without changing the owning terminal result. */\nexport function appendCheckMessages<Data extends object>(\n result: CheckResult<Data>,\n messages: readonly CheckMessage[]\n): CheckResult<Data> {\n if (messages.length === 0) return result;\n return Object.freeze({\n ...result,\n messages: Object.freeze([...(result.messages ?? []), ...messages])\n });\n}\n\nfunction assertFindingLimit(limit: number): void {\n if (!Number.isSafeInteger(limit) || limit < 0) {\n throw new TypeError(\"Finding presentation limit must be a non-negative safe integer\");\n }\n}\n"]}

package/dist/esm/{finding-waivers → package-tools/finding-waivers}/reconciliation.mjs RENAMED Viewed

@@ -1,4 +1,4 @@
-import { canonicalizeJsonValue, canonicalJsonText } from "../data-boundary/canonical-data.mjs";
+import { canonicalizeJsonValue, canonicalJsonText } from "../../data-boundary/canonical-data.mjs";
 /**
  * 按调用方定义的语义身份对完整 finding 集合和 waiver 配置做 canonical structural reconciliation。
  *
@@ -19,8 +19,13 @@ export function reconcileFindingWaivers(options) {
     const matchedWaiverIndexes = options.findings.map((finding) => {
         const identity = canonicalIdentity(options.identify(finding), "finding identity");
         const waiverIndex = waiverIndexesByIdentity.get(identity);
-        if (waiverIndex !== undefined)
-            matchCounts[waiverIndex] += 1;
+        if (waiverIndex !== undefined) {
+            const matchCount = matchCounts[waiverIndex];
+            if (matchCount === undefined) {
+                throw new Error(`Finding waiver match index is out of range: ${waiverIndex}`);
+            }
+            matchCounts[waiverIndex] = matchCount + 1;
+        }
         return waiverIndex;
     });
     const waiverAudits = Object.freeze(waivers.map((waiver, index) => Object.freeze({
@@ -35,7 +40,7 @@ export function reconcileFindingWaivers(options) {
     }));
     return Object.freeze({ findings, waiverAudits });
 }
-function materializeWaivers(waivers) {
+function materializeWaivers(waivers = []) {
     const canonicalWaivers = canonicalizeJsonValue(waivers);
     if (canonicalWaivers === undefined || !isCanonicalArray(canonicalWaivers)) {
         throw new TypeError("Finding waivers must be canonical JSON arrays");
@@ -52,7 +57,11 @@ function materializeWaiver(value) {
     if (typeof reason !== "string" || reason.length === 0) {
         throw new TypeError("Finding waiver reasons must be non-empty strings");
     }
-    return Object.freeze({ identity: value.identity, reason });
+    const identity = value.identity;
+    if (identity === undefined) {
+        throw new TypeError("Finding waiver identity must be present");
+    }
+    return Object.freeze({ identity, reason });
 }
 function isCanonicalObject(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);

package/dist/esm/package-tools/finding-waivers/reconciliation.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"reconciliation.mjs","sourceRoot":"","sources":["../../../../src/package-tools/finding-waivers/reconciliation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EAGlB,MAAM,uCAAuC,CAAC;AAsE/C;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAA0D;IAE1D,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,WAAW,GAAG,IAAI,KAAK,CAAS,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9D,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1D,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QACvE,IAAI,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,SAAS,CAAC,iEAAiE,CAAC,CAAC;QACzF,CAAC;QACD,uBAAuB,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,oBAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC5D,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC,CAAC;QAClF,MAAM,WAAW,GAAG,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1D,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,UAAU,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;YAC5C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,+CAA+C,WAAW,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,WAAW,CAAC,WAAW,CAAC,GAAG,UAAU,GAAG,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAChC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAC5B,MAAM,CAAC,MAAM,CAAC;QACZ,UAAU,EAAE,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC;QACnC,MAAM,EAAE,iBAAiB,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM;KACP,CAAC,CACH,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAC5B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;QACtC,MAAM,WAAW,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QAChF,OAAO,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC,CAAC,CACH,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAO,GAAY,EAAE;IAC/C,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,gBAAgB,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,SAAS,CAAC,+CAA+C,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAyB;IAClD,IACE,CAAC,iBAAiB,CAAC,KAAK,CAAC;QACzB,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC;QACjC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,EAC/B,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,mEAAmE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAChC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAyB;IAClD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAyB;IACjD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAiB,EAAE,IAAY;IACxD,IAAI,CAAC;QACH,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,SAAS,CAAC,WAAW,IAAI,yBAAyB,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,UAAkB;IAC3C,IAAI,UAAU,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACtC,OAAO,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC;AACtD,CAAC;AAED,SAAS,iBAAiB,CACxB,OAAgB,EAChB,KAAqC;IAErC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;IACtF,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC;AAChE,CAAC","sourcesContent":["import {\n canonicalizeJsonValue,\n canonicalJsonText,\n type CanonicalJsonObject,\n type CanonicalJsonValue\n} from \"../../data-boundary/canonical-data.ts\";\n\n/** 由采用方声明、用于匹配一个 finding 的语义身份与豁免理由。 */\nexport interface FindingWaiver<Identity> {\n /** 调用方定义的稳定 finding 身份；匹配时按 canonical JSON 结构比较。 */\n readonly identity: Identity;\n /** 解释该 finding 在当前范围内可被豁免的非空理由。 */\n readonly reason: string;\n}\n\n/** helper 安全 materialize 后保留的 waiver evidence；identity 是 detached canonical JSON。 */\nexport interface MaterializedFindingWaiver {\n /** 从 authored identity materialize 的 detached、deep-frozen canonical JSON。 */\n readonly identity: CanonicalJsonValue;\n /** 从 authored reason materialize 的非空理由。 */\n readonly reason: string;\n}\n\n/** 一项 finding waiver 的配置与匹配次数审计。 */\nexport interface FindingWaiverAudit {\n /** 被审计的 materialized authored waiver evidence，而非调用方可变输入引用。 */\n readonly waiver: MaterializedFindingWaiver;\n /** 该 waiver identity 在完整 finding 集合中匹配到的数量。 */\n readonly matchCount: number;\n /** 未使用、正常应用，或因过宽而没有应用。 */\n readonly status: \"unused\" | \"applied\" | \"overmatched\";\n}\n\n/** reconciliation 后单个 finding 的可执行处置；只有 `waived` branch 携带 matched waiver。 */\nexport type ReconciledFinding<Finding> = Readonly<\n | {\n /** 原始 finding；helper 不解释或改写它的领域字段。 */\n readonly finding: Finding;\n /** 没有匹配 waiver 的正常待处理 finding。 */\n readonly disposition: \"actionable\";\n }\n | {\n /** 原始 finding；helper 不解释或改写它的领域字段。 */\n readonly finding: Finding;\n /** 恰好匹配一项 waiver 的 finding。 */\n readonly disposition: \"waived\";\n /** applied waiver 的身份和理由。 */\n readonly waiver: MaterializedFindingWaiver;\n }\n | {\n /** 原始 finding；helper 不解释或改写它的领域字段。 */\n readonly finding: Finding;\n /** `overmatched` 保持为待处理，避免宽泛 waiver 静默覆盖多个 finding。 */\n readonly disposition: \"overmatched\";\n }\n>;\n\n/** 调用方提供完整候选集、身份识别器和 waiver 配置的输入。 */\nexport interface ReconcileFindingWaiversOptions<Finding, Identity> {\n /** 必须是完整 finding 候选集合，helper 才能审计每项 waiver 的匹配次数。 */\n readonly findings: readonly Finding[];\n /** 从完整 finding 提取调用方选择的稳定语义身份。 */\n readonly identify: (finding: Finding) => Identity;\n /** 要对账的 waiver；省略或 undefined 等同于空数组，仍验证全部 finding identity。 */\n readonly waivers?: readonly FindingWaiver<Identity>[] | undefined;\n}\n\n/** 独立 waiver reconciliation 的完整输出，保留 finding 处置和每项配置审计。 */\nexport interface FindingWaiverReconciliation<Finding> {\n /** 与 input finding 顺序相同的 reconciliation 结果。 */\n readonly findings: readonly ReconciledFinding<Finding>[];\n /** 与 input waiver 顺序相同的完整配置审计。 */\n readonly waiverAudits: readonly FindingWaiverAudit[];\n}\n\n/**\n * 按调用方定义的语义身份对完整 finding 集合和 waiver 配置做 canonical structural reconciliation。\n *\n * 每项 waiver 必须有唯一、可 canonicalize 的 identity 和非空 reason。匹配零项时产生 `unused` 审计；\n * 匹配一项时该 finding 为 `waived`；匹配多项时产生 `overmatched` 审计，相关 finding 保持待处理。\n */\nexport function reconcileFindingWaivers<Finding, Identity>(\n options: ReconcileFindingWaiversOptions<Finding, Identity>\n): FindingWaiverReconciliation<Finding> {\n const waivers = materializeWaivers(options.waivers);\n const matchCounts = new Array<number>(waivers.length).fill(0);\n const waiverIndexesByIdentity = new Map<string, number>();\n for (const [index, waiver] of waivers.entries()) {\n const identity = canonicalIdentity(waiver.identity, \"waiver identity\");\n if (waiverIndexesByIdentity.has(identity)) {\n throw new TypeError(\"Finding waivers must not declare duplicate canonical identities\");\n }\n waiverIndexesByIdentity.set(identity, index);\n }\n\n const matchedWaiverIndexes = options.findings.map((finding) => {\n const identity = canonicalIdentity(options.identify(finding), \"finding identity\");\n const waiverIndex = waiverIndexesByIdentity.get(identity);\n if (waiverIndex !== undefined) {\n const matchCount = matchCounts[waiverIndex];\n if (matchCount === undefined) {\n throw new Error(`Finding waiver match index is out of range: ${waiverIndex}`);\n }\n matchCounts[waiverIndex] = matchCount + 1;\n }\n return waiverIndex;\n });\n const waiverAudits = Object.freeze(\n waivers.map((waiver, index) =>\n Object.freeze({\n matchCount: matchCounts[index] ?? 0,\n status: waiverAuditStatus(matchCounts[index] ?? 0),\n waiver\n })\n )\n );\n const findings = Object.freeze(\n options.findings.map((finding, index) => {\n const waiverIndex = matchedWaiverIndexes[index];\n const audit = waiverIndex === undefined ? undefined : waiverAudits[waiverIndex];\n return reconciledFinding(finding, audit);\n })\n );\n return Object.freeze({ findings, waiverAudits });\n}\n\nfunction materializeWaivers(waivers: unknown = []): readonly MaterializedFindingWaiver[] {\n const canonicalWaivers = canonicalizeJsonValue(waivers);\n if (canonicalWaivers === undefined || !isCanonicalArray(canonicalWaivers)) {\n throw new TypeError(\"Finding waivers must be canonical JSON arrays\");\n }\n return Object.freeze(canonicalWaivers.map(materializeWaiver));\n}\n\nfunction materializeWaiver(value: CanonicalJsonValue): MaterializedFindingWaiver {\n if (\n !isCanonicalObject(value) ||\n !Object.hasOwn(value, \"identity\") ||\n !Object.hasOwn(value, \"reason\")\n ) {\n throw new TypeError(\"Finding waivers must declare canonical identity and reason fields\");\n }\n const reason = value.reason;\n if (typeof reason !== \"string\" || reason.length === 0) {\n throw new TypeError(\"Finding waiver reasons must be non-empty strings\");\n }\n const identity = value.identity;\n if (identity === undefined) {\n throw new TypeError(\"Finding waiver identity must be present\");\n }\n return Object.freeze({ identity, reason });\n}\n\nfunction isCanonicalObject(value: CanonicalJsonValue): value is CanonicalJsonObject {\n return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction isCanonicalArray(value: CanonicalJsonValue): value is readonly CanonicalJsonValue[] {\n return Array.isArray(value);\n}\n\nfunction canonicalIdentity(identity: unknown, kind: string): string {\n try {\n return canonicalJsonText(identity);\n } catch {\n throw new TypeError(`Finding ${kind} must be canonical JSON`);\n }\n}\n\nfunction waiverAuditStatus(matchCount: number): FindingWaiverAudit[\"status\"] {\n if (matchCount === 0) return \"unused\";\n return matchCount === 1 ? \"applied\" : \"overmatched\";\n}\n\nfunction reconciledFinding<Finding>(\n finding: Finding,\n audit: FindingWaiverAudit | undefined\n): ReconciledFinding<Finding> {\n if (audit === undefined) return Object.freeze({ disposition: \"actionable\", finding });\n if (audit.status === \"applied\") {\n return Object.freeze({ disposition: \"waived\", finding, waiver: audit.waiver });\n }\n return Object.freeze({ disposition: \"overmatched\", finding });\n}\n"]}

package/dist/esm/package-tools/learned-critical-path/critical-path-ranking.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"critical-path-ranking.mjs","sourceRoot":"","sources":["../../../../src/package-tools/learned-critical-path/critical-path-ranking.ts"],"names":[],"mappings":"AAoBA,gGAAgG;AAChG,MAAM,UAAU,mCAAmC,CACjD,KAA6B,EAC7B,UAAmD;IAEnD,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC1D,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK;QAAE,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,EAAU,CAAC,CAAC;IACvF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,KAAK,MAAM,cAAc,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnE,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAC1D,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,MAAM,IAAI,SAAS,CAAC,wCAAwC,cAAc,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAChD,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAU,EAAE;QAC1C,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;QAC5C,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAC;QAC5F,MAAM,cAAc,GAAG,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QACvF,IAAI,cAAc,KAAK,SAAS;YAC9B,MAAM,IAAI,SAAS,CAAC,yCAAyC,MAAM,EAAE,CAAC,CAAC;QACzE,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,uBAAuB,GAAG,CAAC,CAAC;QAChC,KAAK,MAAM,gBAAgB,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YACpE,uBAAuB,GAAG,IAAI,CAAC,GAAG,CAAC,uBAAuB,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAC1F,CAAC;QACD,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,aAAa,CAAC,cAAc,CAAC,mBAAmB,EAAE,uBAAuB,CAAC,CAAC;QACzF,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM,CACnB,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACvB,MAAM,CAAC,MAAM,CAAC,EAAE,iBAAiB,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CACjF,CACF;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,QAAuC,EACvC,MAAc;IAEd,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,iBAAiB,CAAC;AACrF,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,KAAa;IAChD,OAAO,IAAI,GAAG,MAAM,CAAC,gBAAgB,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;AACzF,CAAC","sourcesContent":["import type { SchedulerGraphSnapshot } from \"../../project-definition/project-definition.ts\";\n\n/** The pure ranking algorithm only needs immutable estimated durations keyed by Task ID. */\nexport interface SchedulerCriticalPathPredictionSnapshot {\n readonly predictions: readonly Readonly<{\n readonly estimatedDurationMs: number;\n readonly taskId: string;\n }>[];\n}\n\nexport interface SchedulerCriticalPathScore {\n readonly criticalPathScore: number;\n readonly taskId: string;\n}\n\n/** A graph-derived immutable score table; it retains no dependency or authored-input payload. */\nexport interface SchedulerCriticalPathSnapshot {\n readonly scores: readonly SchedulerCriticalPathScore[];\n}\n\n/** Computes directed dependsOn + observes downstream scores once before Scheduler admission. */\nexport function createSchedulerCriticalPathSnapshot(\n graph: SchedulerGraphSnapshot,\n prediction: SchedulerCriticalPathPredictionSnapshot\n): SchedulerCriticalPathSnapshot {\n const downstreamByTaskId = new Map<string, Set<string>>();\n for (const task of graph.tasks) downstreamByTaskId.set(task.taskId, new Set<string>());\n for (const task of graph.tasks) {\n for (const upstreamTaskId of [...task.dependsOn, ...task.observes]) {\n const downstream = downstreamByTaskId.get(upstreamTaskId);\n if (downstream === undefined) {\n throw new TypeError(`critical path graph has unknown task ${upstreamTaskId}`);\n }\n downstream.add(task.taskId);\n }\n }\n\n const scoreByTaskId = new Map<string, number>();\n const visitingTaskIds = new Set<string>();\n const scoreFor = (taskId: string): number => {\n const existing = scoreByTaskId.get(taskId);\n if (existing !== undefined) return existing;\n if (visitingTaskIds.has(taskId)) throw new TypeError(\"critical path graph must be acyclic\");\n const taskPrediction = prediction.predictions.find((entry) => entry.taskId === taskId);\n if (taskPrediction === undefined)\n throw new TypeError(`critical path prediction missing task ${taskId}`);\n visitingTaskIds.add(taskId);\n let greatestDownstreamScore = 0;\n for (const downstreamTaskId of downstreamByTaskId.get(taskId) ?? []) {\n greatestDownstreamScore = Math.max(greatestDownstreamScore, scoreFor(downstreamTaskId));\n }\n visitingTaskIds.delete(taskId);\n const score = saturatingSum(taskPrediction.estimatedDurationMs, greatestDownstreamScore);\n scoreByTaskId.set(taskId, score);\n return score;\n };\n\n return Object.freeze({\n scores: Object.freeze(\n graph.tasks.map((task) =>\n Object.freeze({ criticalPathScore: scoreFor(task.taskId), taskId: task.taskId })\n )\n )\n });\n}\n\nexport function criticalPathScoreForTask(\n snapshot: SchedulerCriticalPathSnapshot,\n taskId: string\n): number | undefined {\n return snapshot.scores.find((score) => score.taskId === taskId)?.criticalPathScore;\n}\n\nfunction saturatingSum(left: number, right: number): number {\n return left > Number.MAX_SAFE_INTEGER - right ? Number.MAX_SAFE_INTEGER : left + right;\n}\n"]}

package/dist/esm/package-tools/learned-critical-path/duration-model/bounded-history.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"bounded-history.mjs","sourceRoot":"","sources":["../../../../../src/package-tools/learned-critical-path/duration-model/bounded-history.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,kCAAkC,GAAG,+BAA+B,CAAC;AAClF,MAAM,CAAC,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AACpE,MAAM,CAAC,MAAM,+BAA+B,GAAG,6BAA6B,CAAC;AAC7E,MAAM,CAAC,MAAM,wCAAwC,GAAG,EAAE,CAAC;AAC3D,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAElD,sFAAsF;AACtF,MAAM,CAAC,MAAM,iCAAiC,GAAG,aAAa,CAAC;AA4B/D,MAAM,UAAU,qBAAqB;IACnC,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,yBAAyB,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,OAA8B,EAC9B,cAAsB;IAEtB,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,KAAK,cAAc,CAAC,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAG3C;IACC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,MAAM,EAAE,MAAM,CAAC,MAAM,CACnB,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;aACd,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;aAC7E,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACd,MAAM,CAAC,MAAM,CAAC;YACZ,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,yBAAyB,EAAE,MAAM,CAAC,yBAAyB;YAC3D,OAAO,EAAE,MAAM,CAAC,MAAM,CACpB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAC5B,MAAM,CAAC,MAAM,CAAC;gBACZ,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;gBAC/C,cAAc,EAAE,MAAM,CAAC,cAAc;aACtC,CAAC,CACH,CACF;SACF,CAAC,CACH,CACJ;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,KAAc;IAC7D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAAc;IAEd,OAAO,CACL,KAAK,KAAK,WAAW;QACrB,KAAK,KAAK,0BAA0B;QACpC,KAAK,KAAK,QAAQ;QAClB,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,wBAAwB,CACnC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtB,KAAK,IAAI,CAAC;QACV,KAAK,IAAI,iCAAiC,CAC3C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,KAAa;IAC9C,IAAI,IAAI,GAAG,KAAK;QAAE,OAAO,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,GAAG,KAAK;QAAE,OAAO,CAAC,CAAC;IAC3B,OAAO,CAAC,CAAC;AACX,CAAC","sourcesContent":["export const SCHEDULER_HISTORY_ENVELOPE_VERSION = \"scheduler-history-envelope-v1\";\nexport const SCHEDULER_HISTORY_FILE_NAME = \"scheduler-history.json\";\nexport const SCHEDULER_HISTORY_MODEL_VERSION = \"scheduler-duration-model-v1\";\nexport const MAX_SCHEDULER_HISTORY_SAMPLES_PER_SERIES = 32;\nexport const MAX_SCHEDULER_HISTORY_SERIES = 4_096;\n\n/** Bound persisted task-active durations so aggregates remain exact safe integers. */\nexport const MAX_SCHEDULER_HISTORY_DURATION_MS = 2_147_483_647;\n\n/** Persisted terminal kind vocabulary; duration storage does not depend on Scheduler ownership. */\nexport type SchedulerDurationSettlementKind =\n | \"completed\"\n | \"prerequisite-unsatisfied\"\n | \"failed\"\n | \"blocked\"\n | \"cancelled-before-start\";\n\nexport interface SchedulerHistorySample {\n readonly durationMs: number;\n readonly observationSequence: number;\n readonly settlementKind: SchedulerDurationSettlementKind;\n}\n\nexport interface SchedulerHistorySeries {\n readonly identityDigest: string;\n readonly latestObservationSequence: number;\n readonly samples: readonly SchedulerHistorySample[];\n}\n\n/** Immutable, Product-private local model; the only persisted state is its closed envelope. */\nexport interface SchedulerHistoryModel {\n readonly latestObservationSequence: number;\n readonly series: readonly SchedulerHistorySeries[];\n}\n\nexport function emptySchedulerHistory(): SchedulerHistoryModel {\n return Object.freeze({ latestObservationSequence: 0, series: Object.freeze([]) });\n}\n\nexport function schedulerHistorySeries(\n history: SchedulerHistoryModel,\n identityDigest: string\n): SchedulerHistorySeries | undefined {\n return history.series.find((series) => series.identityDigest === identityDigest);\n}\n\nexport function freezeSchedulerHistoryModel(input: {\n readonly latestObservationSequence: number;\n readonly series: readonly SchedulerHistorySeries[];\n}): SchedulerHistoryModel {\n return Object.freeze({\n latestObservationSequence: input.latestObservationSequence,\n series: Object.freeze(\n [...input.series]\n .sort((left, right) => compareText(left.identityDigest, right.identityDigest))\n .map((series) =>\n Object.freeze({\n identityDigest: series.identityDigest,\n latestObservationSequence: series.latestObservationSequence,\n samples: Object.freeze(\n series.samples.map((sample) =>\n Object.freeze({\n durationMs: sample.durationMs,\n observationSequence: sample.observationSequence,\n settlementKind: sample.settlementKind\n })\n )\n )\n })\n )\n )\n });\n}\n\nexport function isSchedulerHistoryIdentityDigest(value: unknown): value is string {\n return typeof value === \"string\" && /^sha256:[0-9a-f]{64}$/.test(value);\n}\n\nexport function isSchedulerSettlementKind(\n value: unknown\n): value is SchedulerDurationSettlementKind {\n return (\n value === \"completed\" ||\n value === \"prerequisite-unsatisfied\" ||\n value === \"failed\" ||\n value === \"blocked\" ||\n value === \"cancelled-before-start\"\n );\n}\n\nexport function isBoundedDurationMs(value: unknown): value is number {\n return (\n typeof value === \"number\" &&\n Number.isFinite(value) &&\n value >= 0 &&\n value <= MAX_SCHEDULER_HISTORY_DURATION_MS\n );\n}\n\nexport function isObservationSequence(value: unknown): value is number {\n return typeof value === \"number\" && Number.isSafeInteger(value) && value >= 0;\n}\n\nfunction compareText(left: string, right: string): number {\n if (left < right) return -1;\n if (left > right) return 1;\n return 0;\n}\n"]}

package/dist/esm/{learned-critical-path → package-tools/learned-critical-path}/duration-model/prediction.mjs RENAMED Viewed

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { canonicalJsonBytes } from "../../data-boundary/canonical-data.mjs";
+import { canonicalJsonBytes } from "../../../data-boundary/canonical-data.mjs";
 import { SCHEDULER_HISTORY_MODEL_VERSION, schedulerHistorySeries } from "./bounded-history.mjs";
 export function createSchedulerHistoryIdentity(input) {
     const authoredOptionsDigest = digestCanonicalValue(input.authoredOptions);
@@ -11,7 +11,7 @@ export function createSchedulerHistoryIdentity(input) {
         modelVersion: SCHEDULER_HISTORY_MODEL_VERSION
     });
 }
-/** Forms learned means first, then one project median prior, without invoking preflight. */
+/** Forms learned means first, then one project median prior, without invoking preparation. */
 export function createSchedulerPredictionSnapshot(history, inputs, coldStartDurationMs = 1) {
     const learned = inputs.map((input) => learnedPrediction(history, input));
     const projectPrior = median(learned.flatMap((prediction) => prediction.source === "learned" ? [prediction.estimatedDurationMs] : []));