canary-test-cli 7.1.0 → 8.0.0

package/dist/engine/core/vacuity-scanner.js

@@ -34,6 +34,15 @@
  * - neither -- the target cannot be resolved. That is "cannot verify", which is
  *   a finding about the SCAN, so it lands in `skipped` with its reason.
  *
+ * The inference reads four binding forms, because #705 measured what happens
+ * when it reads one: 65 of 99 findings on canary's own tree were the namespace
+ * import, the dynamic import, and the subprocess launch -- tests invoking
+ * exactly what they claimed, through a construct the target set could not see.
+ * The issue rules out every quiet answer (a threshold, a mute, a widened blanket
+ * skip) on the grounds that a suppressed inference and a passing check must not
+ * look alike, so the fix is to WIDEN WHAT THE INFERENCE CAN SEE and leave the
+ * rule's authority untouched.
+ *
  * A skip is PER RULE, not per test: `VAC-001` needs no target and always runs,
  * so a test whose target is unresolvable is still genuinely `checked` and stays
  * in the denominator. Saying otherwise would understate what was verified. What
@@ -59,9 +68,47 @@ import { blankStringContent } from './string-literals.js';
  * annotation above the declaration.
  */
 const COVERS_PRAGMA = /@covers\s+([A-Za-z_$][\w$]*)/g;
-/** An import whose specifier is relative: the local code a test can target. */
-const JS_RELATIVE_IMPORT = /import\s+(?:type\s+)?(?:\{([^}]*)\}|(\w+))[^'"]*from\s*['"](\.[^'"]*)['"]/g;
+/**
+ * An import whose specifier is relative: the local code a test can target.
+ *
+ * The namespace form (`import * as ns from './x.js'`) needs its own alternative
+ * rather than falling out of `(\w+)`: `*` is not a word character, so a file
+ * written entirely in namespace imports resolved to an EMPTY target set and
+ * every test in it drew a `VAC-002` (#705). On canary's own `agents/skills/test`
+ * tree that single omission was the largest share of the 65 findings the issue
+ * counted -- `import * as diffscan from '../.../diffscan.mjs'` is the house
+ * style there, and `diffscan.findDeletions(...)` is unmistakably an invocation
+ * of the target.
+ */
+const JS_RELATIVE_IMPORT = /import\s+(?:type\s+)?(?:\*\s+as\s+(\w+)|\{([^}]*)\}|(\w+))[^'"]*from\s*['"](\.[^'"]*)['"]/g;
 const JS_RELATIVE_REQUIRE = /(?:const|let|var)\s+(?:\{([^}]*)\}|(\w+))\s*=\s*require\s*\(\s*['"](\.[^'"]*)['"]/g;
+/**
+ * `const x = await import('./y.js')` / `const { a } = await import('./y.js')`.
+ *
+ * A dynamic import leaves no static import statement, so a suite that loads its
+ * subject this way -- to control module state per test, or to import a module
+ * only after an env var is set -- resolved to no target at all (#705).
+ */
+const JS_DYNAMIC_IMPORT = /(?:const|let|var)\s+(?:\{([^}]*)\}|(\w+))\s*=\s*(?:await\s+)?import\s*\(\s*['"](\.[^'"]*)['"]\s*\)/g;
+/** A bare `await import('./y.js')` -- no binding, so it names no symbol. */
+const JS_BARE_DYNAMIC_IMPORT = /(?<![\w$.])import\s*\(\s*['"]\.[^'"]*['"]\s*\)/;
+/**
+ * A string literal naming a first-party script -- something a subprocess can be
+ * pointed at and that lives in this repo.
+ *
+ * The discriminator is deliberately the EXTENSION, not the path shape: it is
+ * what separates `spawnSync(cli, ...)` where `cli` is
+ * `path.join(SCRIPTS, 'cli.mjs')` from `spawnSync('git', args)`. A bare command
+ * name is not a repo path and must not make a test look covered.
+ */
+const SCRIPT_PATH_LITERAL = /['"`][^'"`\n]*[\w$)/.-]\.(?:mjs|cjs|jsx?|tsx?|py|sh)['"`]/;
+/**
+ * A declaration binding one name to an expression -- the statement-bounded form
+ * used to spot a handle on a first-party script.
+ */
+const JS_SIMPLE_DECL = /(?:^|\n)\s*(?:const|let|var)\s+(\w+)\s*=\s*([^;\n]+)/g;
+/** The child-process launchers whose first argument is an executable target. */
+const SUBPROCESS_LAUNCH = /(?<![\w$.])(?:execFileSync|execSync|spawnSync|execFile|spawn|fork)\s*\(/;
 /**
  * Python has no `.`-prefix requirement for a first-party import, so `from x
  * import y` counts. `import os` and the stdlib are excluded by name below --
@@ -210,26 +257,150 @@ function pythonImportedTargets(code) {
     }
     return names;
 }
+/**
+ * One binding form: which capture holds the `{...}` clause, and which the single
+ * name (default import, namespace alias, or `const x = ...`).
+ */
+const JS_BINDING_FORMS = [
+    { re: JS_RELATIVE_IMPORT, clause: 2, singles: [1, 3] },
+    { re: JS_RELATIVE_REQUIRE, clause: 1, singles: [2] },
+    { re: JS_DYNAMIC_IMPORT, clause: 1, singles: [2] },
+];
 /** JS/TS first-party imports: any `import`/`require` with a relative specifier. */
 function jsImportedTargets(code) {
     const names = new Set();
-    for (const re of [JS_RELATIVE_IMPORT, JS_RELATIVE_REQUIRE]) {
+    for (const { re, clause, singles } of JS_BINDING_FORMS) {
         // Reset explicitly: these are module-level `/g` patterns, so a leftover
         // `lastIndex` from an earlier file would silently skip the head of this one.
         re.lastIndex = 0;
         for (const m of code.matchAll(re)) {
-            for (const n of clauseNames(m[1]))
+            for (const n of clauseNames(m[clause]))
                 names.add(n);
-            if (m[2])
-                names.add(m[2]);
+            for (const g of singles)
+                if (m[g])
+                    names.add(m[g]);
         }
     }
+    for (const n of subprocessScriptHandles(code))
+        names.add(n);
+    return names;
+}
+/**
+ * Names bound to a first-party SCRIPT PATH -- the target of a subprocess test.
+ *
+ * `agents/skills/test` drives most skill CLIs the way a user does, by spawning
+ * them: `const cli = path.join(SCRIPTS, 'cli.mjs'); spawnSync(cli, ['--help'])`.
+ * No symbol crosses that boundary, so import-inferred fidelity saw a test that
+ * referenced none of its file's imports and reported `VAC-002` on a test that is
+ * in fact exercising exactly what it claims (#705).
+ *
+ * The handle -- `cli` -- is the symbol that stands in for the target, so binding
+ * it is what lets the existing machinery work unchanged, `closeOverLocals`
+ * included. A launch site must be present in the file: a path literal on its own
+ * is data (a fixture, an expected value), not an invocation.
+ */
+function subprocessScriptHandles(code) {
+    const names = new Set();
+    if (!SUBPROCESS_LAUNCH.test(code))
+        return names;
+    JS_SIMPLE_DECL.lastIndex = 0;
+    for (const m of code.matchAll(JS_SIMPLE_DECL)) {
+        if (SCRIPT_PATH_LITERAL.test(m[2] ?? ''))
+            names.add(m[1]);
+    }
     return names;
 }
+/**
+ * Does this test body itself reach first-party code the target set cannot name?
+ *
+ * Two shapes, both of which leave no identifier to match: a subprocess launched
+ * at a script path written inline (`spawnSync(path.join(D, 'cli.mjs'), ...)`),
+ * and a bare `await import('./x.js')` whose result is never bound. Read from the
+ * ORIGINAL source rather than the blanked copy, because the evidence in both
+ * cases IS the string literal.
+ *
+ * `SUBPROCESS_LAUNCH` and `SCRIPT_PATH_LITERAL` are required together: a test
+ * that spawns `git` and separately mentions a `.py` fixture path is not covered
+ * by either half alone.
+ */
+function reachesOutOfBandTarget(rawBody) {
+    if (SUBPROCESS_LAUNCH.test(rawBody) && SCRIPT_PATH_LITERAL.test(rawBody))
+        return true;
+    return JS_BARE_DYNAMIC_IMPORT.test(rawBody);
+}
 /** Names imported from first-party (relative) modules. */
 function importedTargets(code, python) {
     return python ? pythonImportedTargets(code) : jsImportedTargets(code);
 }
+/**
+ * Brace depth immediately BEFORE each character, over already-blanked code.
+ *
+ * Cheap and approximate on purpose: string content is blanked before this runs,
+ * so the only braces it can see are real ones (a `{` inside a comment is the
+ * residual inaccuracy, and it can only widen a body, never narrow one).
+ */
+function braceDepths(code) {
+    const depths = new Int32Array(code.length);
+    let d = 0;
+    for (let i = 0; i < code.length; i += 1) {
+        depths[i] = d;
+        const c = code[i];
+        if (c === '{')
+            d += 1;
+        else if (c === '}')
+            d -= 1;
+    }
+    return depths;
+}
+/**
+ * Where declaration `i`'s body ends.
+ *
+ * Bounding it at the NEXT declaration is wrong for any helper that declares
+ * something inside itself, and that is the common shape for the subprocess
+ * helper #705 is about:
+ *
+ * ```ts
+ * const SCRIPT = join(REPO_ROOT, 'scripts', 'entropy-ratchet.mjs');
+ * function run() {
+ *   const r = spawnSync(process.execPath, [SCRIPT, ...]);   // <- next decl
+ *   ...
+ * }
+ * ```
+ *
+ * `run`'s body stopped at `const r`, so it never saw `SCRIPT`, so `run()` did
+ * not reach the target and every test calling it read as vacuous. Nesting is the
+ * discriminator: the body runs to the next declaration at the same or shallower
+ * brace depth, which is the first one that is genuinely a SIBLING.
+ */
+function declEnd(code, matches, i, depth) {
+    if (depth === null)
+        return matches[i + 1]?.index ?? code.length;
+    const m = matches[i];
+    const own = depth[m.index] ?? 0;
+    let sibling = code.length;
+    for (let j = i + 1; j < matches.length; j += 1) {
+        const at = matches[j].index;
+        if ((depth[at] ?? 0) <= own) {
+            sibling = at;
+            break;
+        }
+    }
+    // A `function` owns the text up to its next sibling. A `const`/`let`/`var`
+    // owns only its initializer (#871): inside a test body there is usually no
+    // later sibling, so bounding a bystander at one let it absorb the target
+    // call below it and read as reaching the target, silencing VAC-003. The
+    // statement ends at the first `;` or line break at the declaration's own
+    // brace depth, so an arrow helper's braced body still belongs to it.
+    if (m[1])
+        return sibling;
+    const from = m.index + m[0].length;
+    for (let k = from; k < sibling; k += 1) {
+        const ch = code[k];
+        if ((ch === ';' || ch === '\n') && (depth[k] ?? 0) <= own)
+            return k;
+    }
+    return sibling;
+}
 /**
  * Grow `targets` with local declarations that themselves reach a target, to a
  * fixpoint.
@@ -245,13 +416,14 @@ function closeOverLocals(code, targets, python) {
     const re = python ? PY_LOCAL_DECL : JS_LOCAL_DECL;
     re.lastIndex = 0;
     const matches = [...code.matchAll(re)];
+    const depth = python ? null : braceDepths(code);
     for (let i = 0; i < matches.length; i += 1) {
         const m = matches[i];
         const names = boundNames(m, python);
         if (names.length === 0)
             continue;
         const start = m.index + m[0].length;
-        const end = matches[i + 1]?.index ?? code.length;
+        const end = declEnd(code, matches, i, depth);
         decls.push({ names, body: code.slice(start, end) });
     }
     if (!python) {
@@ -352,13 +524,14 @@ function pyTautology(line) {
         return false;
     return normalize(cmp[1]) === normalize(cmp[2]);
 }
-function scanBlock(code, block, file, python, reaching, annotated, skipped) {
+function scanBlock(code, block, file, python, reaching, annotated, skipped, outOfBand) {
     const lines = bodyLines(code, block).filter((l) => !isComment(l.text));
     const targets = annotated !== null ? new Set([annotated]) : reaching;
     return [
         ...tautologies(lines, block, file, python),
-        ...targetNeverInvoked(block, file, reaching, annotated),
+        ...targetNeverInvoked(block, file, reaching, annotated, outOfBand),
         ...absenceOnly(lines, block, file, python, targets, skipped),
+        ...presenceOnBystander(lines, block, file, python, targets),
     ];
 }
 /**
@@ -394,7 +567,7 @@ function tautologies(lines, block, file, python) {
         .map((l) => mk(file, l.line, 'VAC-001', 'critical', block.name, 'Assertion compares a value with itself; no implementation can fail it.', 'Assert the value the code under test should have produced, not the input.'));
 }
 /** VAC-002 -- the target is never referenced anywhere in the body. */
-function targetNeverInvoked(block, file, reaching, annotated) {
+function targetNeverInvoked(block, file, reaching, annotated, outOfBand) {
     if (annotated !== null) {
         if (mentionsAny(block.body, new Set([annotated])))
             return [];
@@ -402,6 +575,10 @@ function targetNeverInvoked(block, file, reaching, annotated) {
             mk(file, block.line, 'VAC-002', 'warning', block.name, `Declared target \`${annotated}\` is never referenced in this test.`, 'Invoke the target, or correct the @covers annotation to name what the test actually exercises.', 'annotated'),
         ];
     }
+    // The subprocess / bare-dynamic-import shapes reach first-party code without
+    // naming a symbol, so no target set can ever match them (#705).
+    if (outOfBand)
+        return [];
     if (reaching === null || mentionsAny(block.body, reaching))
         return [];
     return [
@@ -422,6 +599,20 @@ function targetNeverInvoked(block, file, reaching, annotated) {
  * the write. Reported at the first absence assertion, the line an author adds a
  * precondition next to.
  */
+/**
+ * A test title safe to put in a skip label: its first line, capped at 80.
+ *
+ * The title parser can mis-read a declaration and hand back the source after
+ * it (#860 -- whole `describe` bodies reached the summary line). Bounding the
+ * label here means a parser slip degrades to a truncated name, never a flood.
+ */
+export function boundedTitle(name) {
+    const first = name.split('\n', 1)[0].trim();
+    return first.length > 80 ? `${first.slice(0, 80)}…` : first;
+}
+function skipLabel(rules, file, block) {
+    return `${file}:${block.line} ${rules} (${boundedTitle(block.name)})`;
+}
 function absenceOnly(lines, block, file, python, targets, skipped) {
     if (targets === null)
         return [];
@@ -434,7 +625,7 @@ function absenceOnly(lines, block, file, python, targets, skipped) {
         // assertion style is one the vocabulary does not know. Both are "cannot
         // verify", so both are recorded rather than passed over in silence.
         skipped.push({
-            name: `VAC-003 (${block.name})`,
+            name: skipLabel('VAC-003', file, block),
             reason: 'no recognised assertion, so absence-only could not be judged -- the test may assert nothing (LINT-006) or use an unrecognised assertion style',
         });
         return [];
@@ -447,6 +638,118 @@ function absenceOnly(lines, block, file, python, targets, skipped) {
         mk(file, assertions[0].line, 'VAC-003', 'warning', block.name, 'Every assertion in this test asserts an absence, and none of them observes the target.', 'Add one assertion proving the operation actually ran (exit code, returned value, a positive existence) -- otherwise the test passes identically when the code crashed before doing anything.'),
     ];
 }
+/**
+ * Presence matchers that a value the test built for itself satisfies before the
+ * target ever runs. The negated-null forms belong here too, but on their own they
+ * also match `ABSENCE_ASSERTION` (via `.not.to*`), so an all-negated test stays
+ * VAC-003's -- see {@link presenceOnBystander}.
+ */
+const TRIVIAL_PRESENCE_JS = /\.toBeDefined\s*\(\s*\)|\.toBeTruthy\s*\(\s*\)|\.not\s*\.\s*(?:toBeNull|toBeUndefined|toBeFalsy)\s*\(\s*\)/;
+const TRIVIAL_PRESENCE_PY = /^assert\s+([A-Za-z_][\w.]*?)(?:\s+is\s+not\s+None)?\s*(?:,|$)/;
+const SUBJECT_ROOT = /^([A-Za-z_$][\w$]*)(?:\.[A-Za-z_$][\w$]*)*$/;
+function subjectRoot(expr) {
+    return expr ? (SUBJECT_ROOT.exec(normalize(expr))?.[1] ?? null) : null;
+}
+/** The root identifier a trivial presence assertion observes, or null. */
+function presenceSubject(text, python) {
+    const t = text.trim();
+    if (python)
+        return subjectRoot(TRIVIAL_PRESENCE_PY.exec(t)?.[1]);
+    return TRIVIAL_PRESENCE_JS.test(t) ? subjectRoot(expectArgument(t)) : null;
+}
+/**
+ * Every binding of a name inside the body: `const x = rhs` / `x = rhs` (JS) or
+ * `x = rhs` (pytest), with the RHS bounded to its own line.
+ *
+ * Deliberately NOT `closeOverLocals`: that bounds a declaration at its next
+ * sibling, so a `const subs = [...]` inside a test absorbs the rest of the test
+ * -- including the target call -- and `subs` reads as reaching the target. That
+ * is exactly the bystander this rule exists to see.
+ */
+function bodyBindings(lines, python) {
+    const re = python
+        ? /^\s*([A-Za-z_]\w*)\s*=(?!=)\s*(.*)$/
+        : /^\s*(const\s+|let\s+|var\s+)?([A-Za-z_$][\w$]*)\s*=(?!=)\s*(.*)$/;
+    const out = [];
+    for (const { text } of lines) {
+        const m = re.exec(text);
+        if (!m)
+            continue;
+        if (python)
+            out.push({ name: m[1], rhs: m[2], declared: true });
+        else
+            out.push({ name: m[2], rhs: m[3], declared: m[1] !== undefined });
+    }
+    return out;
+}
+/** Is `rhs` a whole statement on its line? A dangling bracket means it is not. */
+function balanced(rhs) {
+    let d = 0;
+    for (const c of rhs) {
+        if (c === '(' || c === '[' || c === '{')
+            d += 1;
+        else if (c === ')' || c === ']' || c === '}')
+            d -= 1;
+    }
+    return d === 0;
+}
+/**
+ * VAC-005 -- every assertion is a trivially true presence check, and its subject
+ * is a BYSTANDER: a name the test itself bound, never from anything reaching the
+ * target (#870). The mirror image of VAC-003:
+ *
+ * ```js
+ * const subs = [{ id: 's1' }];
+ * matchSubmissions([], subs);
+ * expect(subs).toBeDefined();   // true before the call, true after it
+ * ```
+ *
+ * The bystander clause is the rule, for the same reason VAC-003's is:
+ * `const r = target(); expect(r).toBeDefined()` DOES observe the target, and a
+ * throw from it would fail the test. Anything the rule cannot prove is a
+ * bystander -- a name bound in a hook or at module scope, a multi-line RHS --
+ * yields no finding, so the error direction is always a miss, never a false
+ * accusation.
+ */
+function presenceOnBystander(lines, block, file, python, targets) {
+    if (targets === null)
+        return [];
+    const anyAssertion = python ? PY_ASSERTION : JS_ASSERTION;
+    const absence = python ? PY_ABSENCE_ASSERTION : ABSENCE_ASSERTION;
+    const assertions = lines.filter((l) => anyAssertion.test(l.text));
+    if (assertions.length === 0)
+        return [];
+    // All-absence (the negated-null forms included) is VAC-003's to report.
+    if (assertions.every((l) => absence.test(l.text)))
+        return [];
+    const subjects = assertions.map((l) => presenceSubject(l.text, python));
+    if (subjects.some((s) => s === null))
+        return [];
+    const bindings = bodyBindings(lines, python);
+    if (bindings.some((b) => !balanced(b.rhs)))
+        return [];
+    // The body's own names are removed first -- `closeOverLocals` over-attributes
+    // them (see `bodyBindings`) -- then re-derived here from their real RHS, to a
+    // fixpoint so `const r = save(); const s = r;` still reaches.
+    const bound = new Set(bindings.map((b) => b.name));
+    const reaching = new Set([...targets].filter((t) => !bound.has(t)));
+    let grew = true;
+    while (grew) {
+        grew = false;
+        for (const b of bindings) {
+            if (reaching.has(b.name) || !mentionsAny(b.rhs, reaching))
+                continue;
+            reaching.add(b.name);
+            grew = true;
+        }
+    }
+    const bystander = (name) => !reaching.has(name) && bindings.some((b) => b.name === name && b.declared);
+    if (!subjects.every((s) => bystander(s)))
+        return [];
+    return [
+        mk(file, assertions[0].line, 'VAC-005', 'warning', block.name, `Every assertion is a presence check on \`${subjects[0]}\`, a value the test built itself; it holds whether or not the target ran.`, 'Assert on what the target returns or changes -- e.g. `expect(target(input)).toEqual(expected)` -- so the test fails when the target is wrong.'),
+    ];
+}
 /** A zero-denominator result that names why it could not measure. */
 function unreadable(path, reason) {
     return { checked: 0, findings: [], skipped: [{ name: path, reason }] };
@@ -521,7 +824,7 @@ export function scanVacuity(path) {
     const blocks = enumerateTests(code, source, python);
     const reaching = resolveTargets(source, code, python);
     const skipped = [];
-    const findings = scanAllBlocks({ code, path, python, reaching }, blocks, skipped);
+    const findings = scanAllBlocks({ code, source, path, python, reaching }, blocks, skipped);
     const result = {
         checked: blocks.length,
         findings,
@@ -539,17 +842,29 @@ function scanAllBlocks(ctx, blocks, skipped) {
         const prev = blocks[i - 1];
         const floor = prev ? prev.bodyStart + prev.body.length : 0;
         const annotated = annotationFor(ctx.code, block, floor);
+        const outOfBand = !ctx.python &&
+            annotated === null &&
+            reachesOutOfBandTarget(ctx.source.slice(block.bodyStart, block.bodyStart + block.body.length));
         if (annotated === null && ctx.reaching === null) {
             // Both target-dependent rules go dark together, and both say so. VAC-003
             // asks "does any assertion observe the target", which is unanswerable
             // without a target -- so it abstains rather than falling back to the
             // 254-false-positive version of itself.
+            //
+            // An out-of-band reach answers VAC-002 (the test DOES invoke first-party
+            // code) but not VAC-003, which needs a SYMBOL to ask "did an assertion
+            // observe it". So the skip narrows rather than disappearing: reporting
+            // both as dark would overstate the gap, dropping it entirely would hide a
+            // real one, and #705 is explicit that a suppressed inference and a passing
+            // check must not look alike.
             skipped.push({
-                name: `VAC-002/VAC-003 (${block.name})`,
-                reason: 'target unresolvable: no @covers annotation and no first-party relative import to infer from',
+                name: skipLabel(outOfBand ? 'VAC-003' : 'VAC-002/VAC-003', ctx.path, block),
+                reason: outOfBand
+                    ? 'target reached out of band (subprocess or bare dynamic import), so VAC-002 is answered but no symbol exists for absence-only to observe'
+                    : 'target unresolvable: no @covers annotation and no first-party relative import to infer from',
             });
         }
-        findings.push(...scanBlock(ctx.code, block, ctx.path, ctx.python, ctx.reaching, annotated, skipped));
+        findings.push(...scanBlock(ctx.code, block, ctx.path, ctx.python, ctx.reaching, annotated, skipped, outOfBand));
     }
     return findings;
 }

package/dist/engine/core/workflow-discovery.js

@@ -305,6 +305,45 @@ export class WorkflowMapping {
 export class WorkflowDiscoveryError extends Error {
 }
 // ---------------------------------------------------------------------------
+// Jira request helpers
+// ---------------------------------------------------------------------------
+// Split out of `WorkflowDiscovery.fetchJira` to pay down its complexity. Kept
+// at module level so the class keeps the Python port's method set, and each
+// stays at or under the perf-ratchet warning threshold (10).
+/** Read the ATLASSIAN_* env vars, refusing when any is unset or empty. */
+function jiraCredentials() {
+    const baseUrl = rstripChar(process.env['ATLASSIAN_URL'] ?? '', '/');
+    const user = process.env['ATLASSIAN_USER'] ?? '';
+    const token = process.env['ATLASSIAN_TOKEN'] ?? '';
+    if (!pyTruthy(baseUrl) || !pyTruthy(user) || !pyTruthy(token)) {
+        throw new WorkflowDiscoveryError('Jira credentials not configured.  Set ATLASSIAN_URL, ' +
+            'ATLASSIAN_USER, and ATLASSIAN_TOKEN environment variables.\n' +
+            'Tip: add them to .canary/company.local.json or your shell profile.');
+    }
+    const auth = Buffer.from(`${user}:${token}`).toString('base64');
+    return {
+        baseUrl,
+        headers: { Authorization: `Basic ${auth}`, Accept: 'application/json' },
+    };
+}
+/**
+ * The issue-type list from the `issuetypes` response. An error object (Jira
+ * answers a missing project with `errorMessages` in a 200) is refused; any
+ * other non-list shape yields no issue types.
+ */
+function jiraIssueTypeList(issueTypesRaw, projectKey) {
+    if (Array.isArray(issueTypesRaw)) {
+        return issueTypesRaw;
+    }
+    if (typeof issueTypesRaw === 'object' &&
+        issueTypesRaw !== null &&
+        'errorMessages' in issueTypesRaw) {
+        throw new WorkflowDiscoveryError(`Jira project ${pyRepr(projectKey)} not found or access denied: ` +
+            `${pyRepr(issueTypesRaw['errorMessages'])}`);
+    }
+    return [];
+}
+// ---------------------------------------------------------------------------
 // Main class
 // ---------------------------------------------------------------------------
 /** Discovers and caches per-project issue-workflow mappings. */
@@ -399,34 +438,13 @@ export class WorkflowDiscovery {
     // -- private: Jira ---------------------------------------------------------
     /** Python: `WorkflowDiscovery._fetch_jira`. */
     async fetchJira(projectKey) {
-        const baseUrl = rstripChar(process.env['ATLASSIAN_URL'] ?? '', '/');
-        const user = process.env['ATLASSIAN_USER'] ?? '';
-        const token = process.env['ATLASSIAN_TOKEN'] ?? '';
-        if (!pyTruthy(baseUrl) || !pyTruthy(user) || !pyTruthy(token)) {
-            throw new WorkflowDiscoveryError('Jira credentials not configured.  Set ATLASSIAN_URL, ' +
-                'ATLASSIAN_USER, and ATLASSIAN_TOKEN environment variables.\n' +
-                'Tip: add them to .canary/company.local.json or your shell profile.');
-        }
-        const auth = Buffer.from(`${user}:${token}`).toString('base64');
-        const headers = {
-            Authorization: `Basic ${auth}`,
-            Accept: 'application/json',
-        };
+        const { baseUrl, headers } = jiraCredentials();
         // Capture the URL so ticket_updater can use it without requiring the env var.
         const discoveredBaseUrl = baseUrl;
         // 1. Get issue types for this project.
         const issueTypesRaw = await this.jiraGet(`${baseUrl}/rest/api/3/project/${projectKey}/issuetypes`, headers);
-        if (!Array.isArray(issueTypesRaw) &&
-            typeof issueTypesRaw === 'object' &&
-            issueTypesRaw !== null &&
-            'errorMessages' in issueTypesRaw) {
-            throw new WorkflowDiscoveryError(`Jira project ${pyRepr(projectKey)} not found or access denied: ` +
-                `${pyRepr(issueTypesRaw['errorMessages'])}`);
-        }
+        const list = jiraIssueTypeList(issueTypesRaw, projectKey);
         const issueTypes = [];
-        const list = Array.isArray(issueTypesRaw)
-            ? issueTypesRaw
-            : [];
         for (const itRaw of list) {
             const itId = String(pyGet(itRaw, 'id', ''));
             const itName = String(pyGet(itRaw, 'name', ''));

package/dist/engine/guardian/adjudication-github.js

@@ -0,0 +1,136 @@
+/**
+ * GitHub evidence for derived adjudication (ADR 0025, #938).
+ *
+ * The network seam behind `adjudication.ts`: merged PRs in a window (GraphQL
+ * search), the guardian sticky's edit history (REST comments + GraphQL
+ * `userContentEdits`), and the merged file patches (REST). The sticky is found
+ * with the author-aware {@link findSticky} (#931), never by marker substring.
+ *
+ * Network lives ONLY in {@link GitHubAdjudicationSource}'s default seams;
+ * tests use {@link FakeAdjudicationSource} or inject `read` / `graphql`.
+ */
+import { readAllPages, restPageReader } from './github-paging.js';
+import { findSticky } from './pr-comment.js';
+const API = 'https://api.github.com';
+/** The most merged PRs one report walks (bounds API cost and rate limits). */
+const MERGED_PR_LIMIT = 300;
+/** In-memory {@link AdjudicationSource} for tests. */
+export class FakeAdjudicationSource {
+    init;
+    constructor(init) {
+        this.init = init;
+    }
+    async mergedPrs() {
+        return this.init.merged;
+    }
+    async stickyHistory(pr) {
+        const revisions = this.init.stickies?.[pr];
+        return revisions === undefined ? null : { revisions };
+    }
+    async prFiles(pr) {
+        return this.init.files?.[pr] ?? [];
+    }
+}
+/**
+ * Sticky bodies oldest to newest. GitHub returns edits newest first and each
+ * `diff` holds the whole body at that revision. A truncated or redacted
+ * history is `null` (disclosed as "no edit history"), never a shorter list.
+ */
+export function revisionsFrom(body, edits) {
+    if (!edits)
+        return null;
+    if (edits.totalCount === 0)
+        return [body];
+    const diffs = edits.nodes.map((n) => n.diff);
+    if (diffs.length < edits.totalCount || diffs.includes(null))
+        return null;
+    return [...diffs.reverse(), body];
+}
+const SEARCH_QUERY = `query($q: String!, $after: String) {
+  search(query: $q, type: ISSUE, first: 100, after: $after) {
+    issueCount pageInfo { hasNextPage endCursor }
+    nodes { ... on PullRequest { number } } } }`;
+const EDITS_QUERY = `query($id: ID!) { node(id: $id) { ... on IssueComment {
+  userContentEdits(first: 100) { totalCount nodes { diff } } } } }`;
+function defaultGraphql(token) {
+    return async (query, variables) => {
+        const resp = await fetch(`${API}/graphql`, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${token}`,
+                'User-Agent': 'canary-pr-guardian',
+            },
+            body: JSON.stringify({ query, variables }),
+        });
+        const json = (await resp.json());
+        if (!resp.ok || json.errors || !json.data) {
+            throw new Error(`GitHub GraphQL ${resp.status}: ${JSON.stringify(json)}`);
+        }
+        return json.data;
+    };
+}
+/** The real {@link AdjudicationSource} over GitHub REST + GraphQL. */
+export class GitHubAdjudicationSource {
+    repo;
+    read;
+    graphql;
+    constructor(repo, token, seams = {}) {
+        this.repo = repo;
+        this.read =
+            seams.read ??
+                restPageReader({
+                    Authorization: `Bearer ${token}`,
+                    Accept: 'application/vnd.github+json',
+                    'User-Agent': 'canary-pr-guardian',
+                }, (status, url) => new Error(`GitHub API ${status}: ${url}`));
+        this.graphql = seams.graphql ?? defaultGraphql(token);
+    }
+    /** Pages the search; refuses a window past {@link MERGED_PR_LIMIT} rather than truncating. */
+    async mergedPrs(since) {
+        const q = `repo:${this.repo} is:pr is:merged merged:>=${since}`;
+        const numbers = [];
+        let after = null;
+        do {
+            const data = await this.graphql(SEARCH_QUERY, { q, after });
+            const search = data['search'];
+            if (search.issueCount > MERGED_PR_LIMIT) {
+                throw new Error(`${search.issueCount} merged PRs since ${since} exceeds the ` +
+                    `${MERGED_PR_LIMIT}-PR bound; narrow --days`);
+            }
+            numbers.push(...search.nodes.map((n) => n.number));
+            after = search.pageInfo?.hasNextPage ? search.pageInfo.endCursor : null;
+        } while (after !== null);
+        return numbers;
+    }
+    async stickyHistory(pr) {
+        const url = `${API}/repos/${this.repo}/issues/${pr}/comments`;
+        const comments = (await readAllPages(url, this.read));
+        const sticky = findSticky(comments);
+        if (sticky === null)
+            return null;
+        const data = await this.graphql(EDITS_QUERY, { id: sticky.node_id });
+        const node = data['node'];
+        return { revisions: revisionsFrom(sticky.body, node?.userContentEdits) };
+    }
+    async prFiles(pr) {
+        const url = `${API}/repos/${this.repo}/pulls/${pr}/files`;
+        return (await readAllPages(url, this.read));
+    }
+}
+/** Walk the merged PRs; PRs without a sticky are scanned but carry no evidence. */
+export async function collectEvidence(source, since) {
+    const merged = await source.mergedPrs(since);
+    const evidence = [];
+    for (const number of merged) {
+        const history = await source.stickyHistory(number);
+        if (history === null)
+            continue;
+        evidence.push({
+            number,
+            revisions: history.revisions,
+            files: await source.prFiles(number),
+        });
+    }
+    return { evidence, scanned: merged.length };
+}
+//# sourceMappingURL=adjudication-github.js.map