canary-test-cli 6.8.0 → 7.0.0

package/dist/engine/guardian/diff-coverage/graph-tier.js

@@ -0,0 +1,223 @@
+/**
+ * Tier 2 — coverage derived from the harness knowledge graph
+ * (`GRAPH_VERIFIED`). Reads the NDJSON `.harness/graph/graph.json` directly;
+ * no agent/LLM module and no `analyze_diff`/`get_impact` MCP tool is involved
+ * (SC-11 boundary).
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { isTestPath } from './paths.js';
+import { isRecord, makeResult, pathBoundaryMatch, splitLines, Fidelity, } from './types.js';
+// Edge types that indicate a test exercises a source unit. The live graph
+// carries no explicit `tests`/`covers` edge, so coverage is *derived* from
+// calls/imports reach.
+const REACH_EDGE_TYPES = new Set(['calls', 'imports']);
+/**
+ * Tier 2: derive coverage from the harness knowledge graph (`GRAPH_VERIFIED`).
+ *
+ * The graph has no explicit `tests`/`covers` edge, so coverage is **derived**:
+ * a changed file is graph-covered iff some **test-path node** reaches the
+ * file's node (or a symbol node it `contains`) via a `calls`/`imports` edge.
+ * Conservative by design (edge present → covered).
+ *
+ * `maxDepth` bounds the reverse-BFS hop distance from the changed unit's
+ * node(s) to the covering test node (#320). The changed unit's nodes are depth
+ * 0; their direct predecessors are depth 1; one hop of indirection is depth 2;
+ * and so on. `maxDepth=1` requires a DIRECT test→source edge; `maxDepth=null`
+ * is unbounded (today's behavior, byte-for-byte unchanged).
+ *
+ * Reads the NDJSON `graph.json` directly. Missing/empty graph → `null` (never
+ * blocks).
+ */
+export function resolveFromGraph(units, graphPath = '.harness/graph/graph.json', maxDepth = null) {
+    const graph = readGraph(graphPath);
+    if (graph === null)
+        return null;
+    // Index file/symbol node ids by path (exact + suffix match support).
+    const pathToIds = new Map();
+    for (const [nodeId, nodePath] of graph.idToPath) {
+        if (nodePath)
+            push(pathToIds, nodePath, nodeId);
+    }
+    const results = [];
+    for (const unit of units) {
+        // Target set: the file node(s) for this unit + all symbols they contain.
+        const seedIds = idsForPath(pathToIds, unit.path);
+        if (seedIds.length === 0) {
+            // Unit has no node in the graph → no graph signal. Emit nothing so the
+            // orchestrator falls through to the heuristic tier (FIX 2).
+            continue;
+        }
+        const targets = containedClosure(graph.containsFwd, seedIds);
+        const coveringTest = findCoveringTest(graph, targets, maxDepth);
+        const covered = coveringTest !== null;
+        const evidence = covered
+            ? `reached by test ${coveringTest}`
+            : `no test node reaches ${unit.path} via calls/imports`;
+        results.push(makeResult({
+            unit,
+            covered,
+            fidelity: Fidelity.GraphVerified,
+            evidence,
+        }));
+    }
+    return results;
+}
+/** Read the NDJSON graph into its adjacency views; `null` if unusable. */
+function readGraph(graphPath) {
+    let text;
+    try {
+        if (!existsSync(graphPath))
+            return null;
+        // ACCEPTED DIVERGENCE: Python's `read_text(encoding="utf-8")` here can raise
+        // an UNCAUGHT `UnicodeDecodeError` on a non-UTF-8 graph (the Python only
+        // catches `OSError`) — a latent crash that violates the guardian's "absence
+        // never blocks" contract. Node's `readFileSync(path, 'utf-8')` substitutes
+        // U+FFFD instead of throwing; a replacement char inside a line just fails
+        // that line's `JSON.parse` and is skipped. We intentionally KEEP the safe
+        // degrade rather than reproduce the crash.
+        text = readFileSync(graphPath, 'utf-8');
+    }
+    catch {
+        return null;
+    }
+    if (text.trim() === '')
+        return null;
+    const graph = {
+        idToPath: new Map(),
+        containsFwd: new Map(),
+        reachRev: new Map(),
+    };
+    for (const raw of splitLines(text)) {
+        const record = parseRecord(raw);
+        if (record === null)
+            continue;
+        if (record['kind'] === 'node')
+            addNode(graph, record);
+        else if (record['kind'] === 'edge')
+            addEdge(graph, record);
+    }
+    return graph.idToPath.size === 0 ? null : graph;
+}
+/** One NDJSON line as an object record, or `null` if it is neither. */
+function parseRecord(raw) {
+    const line = raw.trim();
+    if (!line)
+        return null;
+    let record;
+    try {
+        record = JSON.parse(line);
+    }
+    catch {
+        return null;
+    }
+    // Valid JSON but not an object (e.g. `null`, `5`, `[1,2]`, `"x"`) → not a
+    // node/edge record; skip it rather than crash on `.get` (FIX 3).
+    return isRecord(record) ? record : null;
+}
+function addNode(graph, record) {
+    const nodeId = record['id'];
+    if (nodeId === undefined || nodeId === null)
+        return;
+    const p = record['path'];
+    graph.idToPath.set(String(nodeId), typeof p === 'string' ? p : '');
+}
+function addEdge(graph, record) {
+    const etype = record['type'];
+    const src = record['from'];
+    const dst = record['to'];
+    if (src === undefined || src === null || dst === undefined || dst === null) {
+        return;
+    }
+    const from = String(src);
+    const to = String(dst);
+    if (etype === 'contains')
+        push(graph.containsFwd, from, to);
+    else if (typeof etype === 'string' && REACH_EDGE_TYPES.has(etype)) {
+        push(graph.reachRev, to, from);
+    }
+}
+/** Node ids for `path`; ambiguous suffix matches deliberately resolve to none. */
+function idsForPath(pathToIds, path) {
+    const exact = pathToIds.get(path);
+    if (exact !== undefined)
+        return exact;
+    // Boundary suffix match only; on a unique matched path use its ids. On
+    // multiple distinct matched paths (duplicate basenames) treat as ambiguous
+    // and return no ids — do NOT union unrelated nodes (FIX 6).
+    const matchedPaths = [];
+    for (const nodePath of pathToIds.keys()) {
+        if (pathBoundaryMatch(nodePath, path))
+            matchedPaths.push(nodePath);
+    }
+    return matchedPaths.length === 1 ? pathToIds.get(matchedPaths[0]) : [];
+}
+/** The seed nodes plus everything they transitively `contains`. */
+function containedClosure(containsFwd, seedIds) {
+    const targets = new Set(seedIds);
+    const frontier = [...targets];
+    while (frontier.length > 0) {
+        const node = frontier.pop();
+        for (const child of containsFwd.get(node) ?? []) {
+            if (!targets.has(child)) {
+                targets.add(child);
+                frontier.push(child);
+            }
+        }
+    }
+    return targets;
+}
+/**
+ * Reverse-BFS over calls/imports; the first reached test-path node wins.
+ *
+ * FIX 1 (#320): a genuine FIFO BFS so first-discovery depth is the minimum;
+ * a LIFO stack could stamp an intermediate node at a non-minimal depth and
+ * prune it before a shorter path arrives, under-crediting coverage at
+ * maxDepth >= 3.
+ */
+function findCoveringTest(graph, targets, maxDepth) {
+    const walk = {
+        graph,
+        targets,
+        seen: new Set(targets),
+        queue: [...targets].map((t) => [t, 0]),
+    };
+    let head = 0;
+    while (head < walk.queue.length) {
+        const [node, depth] = walk.queue[head++];
+        if (maxDepth !== null && depth >= maxDepth) {
+            continue; // cannot expand deeper — predecessors would exceed bound
+        }
+        const found = enqueuePredecessors(walk, node, depth);
+        if (found !== null)
+            return found;
+    }
+    return null;
+}
+/**
+ * Enqueue every unseen predecessor of `node`, returning the path of the first
+ * one that is a test (which ends the walk).
+ */
+function enqueuePredecessors(walk, node, depth) {
+    const predecessors = walk.graph.reachRev.get(node);
+    if (predecessors === undefined)
+        return null;
+    for (const source of predecessors) {
+        if (walk.seen.has(source))
+            continue;
+        walk.seen.add(source);
+        const sourcePath = walk.graph.idToPath.get(source) ?? '';
+        if (sourcePath && isTestPath(sourcePath) && !walk.targets.has(source)) {
+            return sourcePath; // test reached within maxDepth
+        }
+        walk.queue.push([source, depth + 1]);
+    }
+    return null;
+}
+function push(map, key, value) {
+    const existing = map.get(key);
+    if (existing === undefined)
+        map.set(key, [value]);
+    else
+        existing.push(value);
+}
+//# sourceMappingURL=graph-tier.js.map

package/dist/engine/guardian/diff-coverage/heuristic-tier.js

@@ -0,0 +1,150 @@
+/**
+ * Tier 3 — the last-resort naming/AST heuristic (`HEURISTIC`, never `null`).
+ */
+import { readFileSync, readdirSync } from 'node:fs';
+import { basename, join, posix } from 'node:path';
+import { isTestPath } from './paths.js';
+import { makeResult, stem, Fidelity, } from './types.js';
+/**
+ * Derive candidate symbol names for a unit: the file stem plus top-level
+ * `def`/`class` names. Python uses `ast` for `.py`; here a column-0 line scan
+ * approximates top-level extraction (indented, nested defs are excluded, just
+ * as `ast.parse(...).body` would exclude them). A cheap regex covers other
+ * languages.
+ *
+ * KNOWN HEURISTIC-TIER LIMITATION: unlike a real AST, this lexical scan can pick
+ * up a phantom `def ghost()`/`class Phantom` sitting at column 0 inside a
+ * triple-quoted string or in a syntactically-broken file, yielding a false
+ * heuristic-covered verdict if a test happens to mention that name. Full `ast`
+ * parity is not portable to Node; this is accepted as a lowest-fidelity-tier
+ * (HEURISTIC) imprecision — the report and graph tiers, which outrank it, are
+ * exact. (A cheap mitigation would be to blank string literals before the scan,
+ * omitted here to avoid any risk of dropping a real top-level symbol.)
+ */
+function extractSymbols(unitPath, repoRoot) {
+    const symbols = new Set([stem(unitPath)]);
+    let source;
+    try {
+        source = readFileSync(join(repoRoot, unitPath), 'utf-8');
+    }
+    catch {
+        return symbols;
+    }
+    const decl = unitPath.endsWith('.py')
+        ? /^(?:async\s+def|def|class)\s+([A-Za-z_]\w*)/gm
+        : /\b(?:function|class|def|const|let|var)\s+([A-Za-z_]\w*)/g;
+    for (let m = decl.exec(source); m !== null; m = decl.exec(source)) {
+        symbols.add(m[1]);
+    }
+    return symbols;
+}
+/** Recursively list every file under `root` (sorted for determinism). */
+function walkFiles(root) {
+    const out = [];
+    const walk = (dir) => {
+        let entries;
+        try {
+            entries = readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+            const full = join(dir, entry.name);
+            if (entry.isDirectory())
+                walk(full);
+            else if (entry.isFile())
+                out.push(full);
+        }
+    };
+    walk(root);
+    return out;
+}
+/** Relative POSIX path of `full` under `root`. */
+function relPosix(root, full) {
+    const rel = full.slice(root.length).replace(/^[/\\]/, '');
+    return rel.split(/[/\\]/).join(posix.sep);
+}
+/** Yield `[relPath, text]` for every test-looking file under `repoRoot`. */
+function iterTestFiles(repoRoot) {
+    const all = walkFiles(repoRoot);
+    const seen = new Set();
+    const out = [];
+    const emit = (full) => {
+        if (seen.has(full))
+            return;
+        seen.add(full);
+        let text;
+        try {
+            text = readFileSync(full, 'utf-8');
+        }
+        catch {
+            return;
+        }
+        out.push([relPosix(repoRoot, full), text]);
+    };
+    const matchers = [
+        (b) => /^test_.*\.py$/.test(b),
+        (b) => b.includes('.test.'),
+        (b) => b.includes('.spec.'),
+    ];
+    for (const matches of matchers) {
+        for (const full of all) {
+            if (matches(basename(full)))
+                emit(full);
+        }
+    }
+    // Also any file living under a tests/ directory (broader net).
+    for (const full of all) {
+        if (!full.endsWith('.py'))
+            continue;
+        if (isTestPath(relPosix(repoRoot, full)))
+            emit(full);
+    }
+    return out;
+}
+/**
+ * Tier 3: last-resort naming/AST heuristic (`HEURISTIC`, never `null`).
+ *
+ * A unit is heuristic-covered iff some test file under `repoRoot` references
+ * the unit's file stem or a top-level symbol name (word-boundary scan).
+ */
+export function resolveHeuristic(units, repoRoot = '.') {
+    const testFiles = iterTestFiles(repoRoot);
+    const results = [];
+    for (const unit of units) {
+        const symbols = extractSymbols(unit.path, repoRoot);
+        // Avoid pathological single-letter stems matching everything.
+        const patterns = [];
+        for (const sym of symbols) {
+            if (sym.length >= 2)
+                patterns.push(new RegExp(`\\b${escapeRe(sym)}\\b`));
+        }
+        let covering = null;
+        for (const [rel, text] of testFiles) {
+            // A file never counts as covering itself.
+            if (rel === unit.path)
+                continue;
+            if (patterns.some((pat) => pat.test(text))) {
+                covering = rel;
+                break;
+            }
+        }
+        const covered = covering !== null;
+        const evidence = covered
+            ? `referenced by ${covering}`
+            : `no test file references ${stem(unit.path)}`;
+        results.push(makeResult({
+            unit,
+            covered,
+            fidelity: Fidelity.Heuristic,
+            evidence,
+        }));
+    }
+    return results;
+}
+/** Escape a string for literal use inside a RegExp (Python's `re.escape`). */
+function escapeRe(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+//# sourceMappingURL=heuristic-tier.js.map

package/dist/engine/guardian/diff-coverage/orchestrator.js

@@ -0,0 +1,125 @@
+/**
+ * The SC-3 fidelity ladder itself, plus the record of what the coverage input
+ * actually was on this run (#554) — the denominator that separates "checked and
+ * clean" from "never checked".
+ */
+import { resolveFromGraph } from './graph-tier.js';
+import { resolveHeuristic } from './heuristic-tier.js';
+import { matchUnitsToIndex, readReportIndex } from './report-tier.js';
+/**
+ * SC-3 orchestrator: resolve each unit at the highest available fidelity.
+ *
+ * The ladder is applied **per unit**, not per batch. For each unit the first
+ * tier that has a signal for *that* unit wins:
+ *
+ *   1. `coveragePath` lists the unit's path → `COVERAGE_VERIFIED`
+ *   2. else a graph node for the unit exists → `GRAPH_VERIFIED`
+ *   3. else the naming heuristic             → `HEURISTIC` (always returns)
+ *
+ * A unit absent from the report is NOT judged COVERAGE_VERIFIED-uncovered; it
+ * falls through to the graph then heuristic tier (FIX 2). Returns exactly one
+ * {@link CoverageResult} per input unit, in input order, fidelity-labeled.
+ *
+ * `graphMaxDepth` bounds the graph tier's reverse-BFS hop distance (#320) and
+ * is forwarded verbatim to `resolveFromGraph`.
+ */
+export function resolveCoverage(units, options = {}) {
+    return resolveCoverageWithInput(units, options).results;
+}
+/** Classify a {@link CoverageInputState}. Zero matched is never `verified`. */
+export function coverageStatus(state) {
+    if (state.unitsTotal > 0 && state.unitsMatched === state.unitsTotal) {
+        return 'verified';
+    }
+    return state.unitsMatched > 0 ? 'partial' : 'unavailable';
+}
+const COVERAGE_EM_DASH = '\u{2014}';
+const FALLBACK_TIER = 'judged at graph/heuristic tier only';
+/**
+ * The human-readable degradation notice for a coverage run, or `null` when the
+ * report covered every changed unit (nothing was degraded, so nothing is said).
+ *
+ * A run that judged nothing (`unitsTotal === 0`) also returns `null` — it makes
+ * no coverage claim in either direction, and the abstention path reports it.
+ */
+export function coverageDegradedNotice(state) {
+    const { requested, found, parsed, filesInReport } = state;
+    const { unitsMatched: matched, unitsTotal: total } = state;
+    if (total === 0)
+        return null;
+    const status = coverageStatus(state);
+    if (status === 'verified')
+        return null;
+    const dash = ` ${COVERAGE_EM_DASH} `;
+    if (status === 'partial') {
+        return (`coverage partial${dash}report at '${requested}' matched ` +
+            `${matched} of ${total} changed file(s); the other ${total - matched} ` +
+            FALLBACK_TIER);
+    }
+    const head = `coverage unavailable${dash}`;
+    if (requested === null) {
+        return `${head}no coverage report was supplied; ${total} changed file(s) ${FALLBACK_TIER}`;
+    }
+    if (!found) {
+        return `${head}report not found at '${requested}'; ${total} changed file(s) ${FALLBACK_TIER}`;
+    }
+    if (!parsed) {
+        return (`${head}report at '${requested}' yielded no usable records; ` +
+            `${total} changed file(s) ${FALLBACK_TIER}`);
+    }
+    return (`${head}report at '${requested}' covers ${filesInReport} file(s) but ` +
+        `matched 0 of ${total} changed file(s); ${FALLBACK_TIER}`);
+}
+/**
+ * {@link resolveCoverage}, additionally reporting which mode the run was in.
+ *
+ * Identical ladder, identical results — the only addition is the
+ * {@link CoverageInputState} record, so a later reader can tell a clean result
+ * from a blind one (#554).
+ */
+export function resolveCoverageWithInput(units, options = {}) {
+    const { coveragePath = null, graphPath = '.harness/graph/graph.json', repoRoot = '.', graphMaxDepth = null, } = options;
+    // Reference-keyed map mirrors the Python `id(unit)` bookkeeping, so distinct
+    // units that happen to share a path are still tracked independently.
+    const resolved = new Map();
+    let remaining = [...units];
+    const coverage = {
+        requested: coveragePath,
+        found: false,
+        parsed: false,
+        filesInReport: 0,
+        unitsMatched: 0,
+        unitsTotal: units.length,
+    };
+    if (coveragePath !== null) {
+        const read = readReportIndex(coveragePath);
+        coverage.found = read.found;
+        coverage.parsed = read.index !== null;
+        coverage.filesInReport =
+            read.index === null ? 0 : Object.keys(read.index).length;
+        const report = read.index === null ? null : matchUnitsToIndex(remaining, read.index);
+        // An empty array (no unit matched the report) is falsy-equivalent in the
+        // Python `if report:` guard — fall through rather than lock in nothing.
+        if (report !== null && report.length > 0) {
+            for (const r of report)
+                resolved.set(r.unit, r);
+            coverage.unitsMatched = report.length;
+            remaining = remaining.filter((u) => !resolved.has(u));
+        }
+    }
+    if (remaining.length > 0) {
+        const graph = resolveFromGraph(remaining, graphPath, graphMaxDepth);
+        if (graph !== null && graph.length > 0) {
+            for (const r of graph)
+                resolved.set(r.unit, r);
+            remaining = remaining.filter((u) => !resolved.has(u));
+        }
+    }
+    if (remaining.length > 0) {
+        for (const r of resolveHeuristic(remaining, repoRoot)) {
+            resolved.set(r.unit, r);
+        }
+    }
+    return { results: units.map((unit) => resolved.get(unit)), coverage };
+}
+//# sourceMappingURL=orchestrator.js.map

package/dist/engine/guardian/diff-coverage/paths.js

@@ -0,0 +1,164 @@
+/**
+ * Path predicates shared by the graph and heuristic tiers, and by the finding
+ * filters downstream: what is a test, what is test *support*, and what is
+ * hand-authored program source at all.
+ */
+import { basename, extname } from 'node:path';
+const TEST_PATH_RE = /(^|\/)tests?\/|(^|\/)test_[^/]*\.py$|\.test\.[^/]+$|\.spec\.[^/]+$/;
+/**
+ * True if `path` looks like a test file (`tests/**`, `test_*.py`, `*.test.*`,
+ * `*.spec.*`).
+ */
+export function isTestPath(path) {
+    return TEST_PATH_RE.test(path);
+}
+/**
+ * Split a basename's stem into `-`/`_`/`.`-separated components (#565).
+ *
+ * `playwright-fixture.ts` → `['playwright', 'fixture']`;
+ * `user.fixtures.ts` → `['user', 'fixtures']`. The final extension is dropped
+ * first so it never appears as a component.
+ */
+function basenameComponents(path) {
+    const base = path.slice(path.lastIndexOf('/') + 1);
+    const dot = base.lastIndexOf('.');
+    const stem = dot > 0 ? base.slice(0, dot) : base;
+    return stem.split(/[-_.]/).filter((part) => part.length > 0);
+}
+/** Basename components that mark a file as test *support* rather than source. */
+const FIXTURE_COMPONENTS = new Set([
+    'fixture',
+    'fixtures',
+]);
+/**
+ * True if `path` is test *infrastructure* identified by filename idiom (#565).
+ *
+ * {@link isTestPath} recognises tests by directory (`tests/**`) or by the
+ * `*.test.*` / `*.spec.*` / `test_*.py` naming rules, and the skip layer
+ * recognises fixtures by the `fixtures/` *directory* convention. Neither
+ * catches a file that is test support by **name** while sitting in an ordinary
+ * source directory — the measured cases being a pytest `conftest_otel.py` and a
+ * Playwright `playwright-fixture.ts`, both under `scripts/otel_bootstrap/`.
+ *
+ * Such a file cannot host a test in the sense a coverage finding means: it *is*
+ * the harness the tests run inside. Asking it for a covering test inverts the
+ * relationship, so a reviewer's only correct response is 👎 — the precision
+ * cost #413 and #562 both describe.
+ *
+ * Two deliberate narrowings:
+ *
+ *   - **Components, not substrings.** `conftestimonial.py` and
+ *     `prefixtures.ts` are ordinary source and must survive. Matching on
+ *     `-`/`_`/`.`-separated components is what pytest's own name-based
+ *     resolution and the `*.fixtures.ts` idiom actually mean.
+ *   - **`conftest` is Python-only.** It is pytest's resolution rule
+ *     specifically; a `conftest.js` carries no framework meaning and is left as
+ *     source.
+ *
+ * Known over-match, accepted: a production module genuinely named
+ * `fixture-generator.ts` is suppressed. That trade is deliberate — a missed
+ * finding on a file named after fixtures costs far less than a finding no
+ * reviewer can ever act on, which is what drags `precision = TP / (TP + FP)`
+ * below the promotion bar.
+ *
+ * Kept separate from {@link isTestPath} on purpose: that predicate also decides
+ * what *confers* graph coverage, so widening it would let a conftest mark every
+ * module it imports as tested — a false negative in place of a false positive.
+ */
+export function isTestSupportPath(path) {
+    const components = basenameComponents(path);
+    if (path.endsWith('.py') && components.includes('conftest'))
+        return true;
+    return components.some((part) => FIXTURE_COMPONENTS.has(part));
+}
+/**
+ * Extensions that denote hand-authored, executable program source (#413).
+ *
+ * The membership rule is deliberately simple and defensible: **a programming
+ * language belongs; data, config, markup, and style do not.** `.sh` is in (it is
+ * executable logic — bats/shunit2 exist); `.json`, `.yaml`, `.sql`, `.css`, and
+ * `.html` are out (nothing a naming heuristic could meaningfully judge).
+ *
+ * A repo that disagrees at the margins tunes the glob layer
+ * (`canary.guardian.pr.heuristicExclude`) rather than this list.
+ */
+const SOURCE_EXTENSIONS = new Set([
+    // TS/JS + component dialects.
+    '.ts',
+    '.tsx',
+    '.mts',
+    '.cts',
+    '.js',
+    '.jsx',
+    '.mjs',
+    '.cjs',
+    '.vue',
+    '.svelte',
+    '.astro',
+    // Python / Ruby / PHP / Perl / Lua.
+    '.py',
+    '.pyi',
+    '.rb',
+    '.php',
+    '.pl',
+    '.pm',
+    '.lua',
+    // JVM + .NET.
+    '.java',
+    '.kt',
+    '.kts',
+    '.scala',
+    '.groovy',
+    '.clj',
+    '.cljs',
+    '.cs',
+    '.fs',
+    '.vb',
+    // Systems.
+    '.go',
+    '.rs',
+    '.c',
+    '.h',
+    '.cc',
+    '.cpp',
+    '.cxx',
+    '.hpp',
+    '.hh',
+    '.m',
+    '.mm',
+    '.swift',
+    // Functional / scientific / other.
+    '.ex',
+    '.exs',
+    '.erl',
+    '.dart',
+    '.r',
+    '.jl',
+    // Shell.
+    '.sh',
+    '.bash',
+    '.zsh',
+    '.ps1',
+    '.psm1',
+]);
+/**
+ * True if `path` looks like hand-authored program source (#413).
+ *
+ * Used to gate the Tier-3 naming heuristic. That heuristic asks "does any test
+ * file reference this file's stem or a top-level symbol?" — for a config
+ * dotfile, a lockfile, or a data blob there are no symbols and no test will
+ * ever name it, so the verdict is structurally always "uncovered": a guaranteed
+ * false positive rather than a signal. An extension-less file (`Makefile`,
+ * `Dockerfile`) and a bare dotfile (`.eslintrc`) are both non-source.
+ */
+export function isSourcePath(path) {
+    const base = basename(path);
+    // `.eslintrc` — `extname` calls this '' already, but a dotfile WITH a real
+    // extension (`.eslintrc.json`) must be judged on that extension, which the
+    // normal path handles.
+    const ext = extname(base).toLowerCase();
+    if (!ext)
+        return false;
+    return SOURCE_EXTENSIONS.has(ext);
+}
+//# sourceMappingURL=paths.js.map