canary-test-cli 7.2.0 → 8.0.0

package/dist/engine/guardian/pr-comment.js

@@ -1,42 +1,13 @@
 /**
- * Deterministic GitHub PR comment poster (Tier 0, agent-free).
- *
- * Faithful TypeScript port of `agent/guardian/pr_comment.py`.
- *
- * This module posts/updates the single sticky guardian findings comment on a
- * pull request. It is **deterministic HTTP behind an interface seam** — it
- * imports no agent/LLM module (SC-11).
- *
- * Design:
- *
- * - {@link GitHubClient} is the seam every consumer talks to
- *   (`listComments` / `createComment` / `updateComment`).
- * - {@link FakeGitHubClient} is the in-memory implementation used by every unit
- *   test — **no network**. It can simulate a fork read-only token via
- *   `deny_writes=true` (writes reject with {@link GitHubPermissionError}).
- * - {@link RestGitHubClient} (Python's private `_RestGitHubClient`) is the thin
- *   real client. Network lives **only** here; `guardian-rest-clients.test.ts`
- *   drives it through a stubbed global `fetch`, so the URL, headers, error
- *   mapping, and #528 pagination are covered without a socket.
- *
- * Python→TS nuances:
- *   - **async**: Python's `urllib` client is synchronous; Node's global `fetch`
- *     is async. The seam methods are therefore `Promise`-returning, so the
- *     real client can `await fetch`. The fakes satisfy the async interface by
- *     being `async` (returning already-resolved values), and
- *     {@link upsertStickyComment} becomes `async`. The pure helpers
- *     ({@link findSticky}, {@link degradationAnnotation}) stay synchronous.
- *   - **error mapping**: `fetch` resolves (does not throw) on a 4xx/5xx status,
- *     so the 403→{@link GitHubPermissionError} mapping is done off `resp.status`
- *     rather than off a raised `HTTPError`. As in the oracle, ONLY 403 maps to a
- *     permission error here; any other non-2xx propagates as a generic error.
+ * Deterministic poster of the single sticky guardian PR comment (Tier 0; no
+ * agent/LLM import, SC-11). {@link GitHubClient} is the seam;
+ * {@link FakeGitHubClient} is the in-memory test double (`deny_writes` models a
+ * 403); {@link RestGitHubClient} is the only code that touches the network.
  */
 import { readAllPages, restPageReader } from './github-paging.js';
-// Single source of truth for the sticky-comment marker.
-// `pr_check.renderFindings` emits the identical literal at the head of a
-// `comment`-format body so `findSticky` can locate the guardian comment for
-// in-place upsert.
+// `renderFindings` writes this literal on a comment body's first line.
 export const STICKY_MARKER = '<!-- canary-pr-guardian -->';
+const DEFAULT_IDENTITY = { login: 'github-actions[bot]' };
 /**
  * A client cannot write (fork read-only token → HTTP 403).
  *
@@ -49,12 +20,7 @@ export class GitHubPermissionError extends Error {
         this.name = 'GitHubPermissionError';
     }
 }
-/**
- * Map a non-2xx status to an error. As in the Python reference, ONLY 403 is a
- * permission error; every other non-2xx propagates (the analog of urllib's
- * HTTPError re-raise). Shared by the write path and the paged read path so the
- * two cannot drift.
- */
+/** Map a non-2xx status to an error; ONLY 403 is a permission error. */
 function toGitHubError(status, url) {
     return status === 403
         ? new GitHubPermissionError(`GitHub API 403 (read-only token / fork PR?): ${url}`)
@@ -84,7 +50,11 @@ export class FakeGitHubClient {
             throw new GitHubPermissionError('read-only token: cannot create comment');
         }
         this.nextId += 1;
-        const row = { id: this.nextId, body };
+        const row = {
+            id: this.nextId,
+            body,
+            user: { login: DEFAULT_IDENTITY.login, type: 'Bot' },
+        };
         this.comments.push(row);
         return row;
     }
@@ -101,21 +71,31 @@ export class FakeGitHubClient {
         throw new Error(`no comment with id ${commentId}`);
     }
 }
-/** Return the first comment whose body contains `marker`, else `null`. */
-export function findSticky(comments, marker = STICKY_MARKER) {
-    for (const comment of comments) {
-        if ((comment.body ?? '').includes(marker)) {
-            return comment;
-        }
+/**
+ * Return guardian's sticky comment, else `null` (#931). A comment qualifies
+ * only when its body STARTS WITH `marker` and `identity` wrote it, so a human
+ * who pasted guardian's output is never overwritten. Newest qualifier wins.
+ */
+export function findSticky(comments, marker = STICKY_MARKER, identity = DEFAULT_IDENTITY) {
+    let best = null;
+    for (const c of comments.filter((x) => isSticky(x, marker, identity))) {
+        if (!best || (c.created_at ?? '') >= (best.created_at ?? ''))
+            best = c;
     }
-    return null;
+    return best;
+}
+function isSticky(c, marker, id) {
+    return isAuthoredBy(c, id) && (c.body ?? '').trimStart().startsWith(marker);
+}
+function isAuthoredBy(c, identity) {
+    if (c.user?.login === identity.login)
+        return true;
+    const slug = c.performed_via_github_app?.slug;
+    return c.user?.type === 'Bot' && !!slug && slug === identity.appSlug;
 }
 /**
- * Post or update the single sticky guardian comment (SC-9).
- *
- * Locates the existing comment by `marker`; updates it in place when present,
- * otherwise creates a new one. Never stacks duplicates. A read-only token (fork
- * PR?) degrades loudly to a `degraded` result rather than crashing (OT-4).
+ * Update guardian's own sticky in place, else create one (SC-9: never stacks).
+ * A 403 degrades to a `degraded` result instead of crashing the job (OT-4).
  */
 export async function upsertStickyComment(client, body, marker = STICKY_MARKER) {
     const existing = findSticky(await client.listComments(), marker);
@@ -129,13 +109,10 @@ export async function upsertStickyComment(client, body, marker = STICKY_MARKER)
     }
     catch (err) {
         if (err instanceof GitHubPermissionError) {
-            // OT-4 / SC-1+D6: a read-only token (fork PR?) must degrade loudly, not
-            // crash the job. The caller emits `notice` as a `::warning::` annotation.
             return {
                 action: 'degraded',
                 comment_id: null,
-                notice: 'guardian: read-only token (fork PR?) — findings not posted as ' +
-                    'a comment',
+                notice: `guardian: token lacks write permission on PR comments (HTTP 403) — findings not posted as a comment`,
             };
         }
         throw err;

package/dist/engine/guardian/weak-test.js

@@ -0,0 +1,236 @@
+/**
+ * The advisory `weak-test` finding: an ADDED test that asserts nothing (#747).
+ *
+ * Split out of `pr-check.ts` as a self-contained judgement — test declarations,
+ * block spans, assertion presence. The dependency runs one way (this module
+ * reads `pr-check`, never the reverse); `guardian/cli.ts` calls into here.
+ */
+import { readFileSync } from 'node:fs';
+import { Fidelity } from './coverage.js';
+import { Severity } from './impact-mapper.js';
+import { GuardianFinding, addedContentByPath, linesInRanges, walkDiff, } from './pr-check.js';
+import { hasAssertion, isAssertionFreeTest } from '../core/quality-scorer.js';
+// Test-file extension -> the quality scorer's framework. Unknown -> pytest.
+const TEST_FRAMEWORK_BY_EXT = {
+    '.py': 'pytest',
+    '.ts': 'vitest',
+    '.tsx': 'vitest',
+    '.js': 'vitest',
+    '.jsx': 'vitest',
+    '.mjs': 'vitest',
+    '.cjs': 'vitest',
+};
+function frameworkForTestPath(path) {
+    const ext = /\.[^./\\]+$/.exec(path)?.[0] ?? '';
+    return TEST_FRAMEWORK_BY_EXT[ext.toLowerCase()] ?? 'pytest';
+}
+// A signature / decorator / block-close / comment — not a test *body*. A rename
+// that adds only `def test_new():` over an unchanged body has nothing to judge.
+const TEST_SIGNATURE_RE = /^\s*(?:async\s+)?def\s+test\w*\s*\(|^\s*(?:it|test|describe)\s*\(/;
+const BLOCK_DELIMITERS = new Set(['})', '});', '}', ')', '{']);
+const NON_BODY_PREFIXES = ['#', '//', '@', '*', '/*'];
+/** True iff `added` holds a real body line, not just signature/comment/brace. */
+function hasAddedTestBody(added) {
+    return added.some((line) => {
+        const stripped = line.trim();
+        if (!stripped || BLOCK_DELIMITERS.has(stripped))
+            return false;
+        if (NON_BODY_PREFIXES.some((p) => stripped.startsWith(p)))
+            return false;
+        return !TEST_SIGNATURE_RE.test(line);
+    });
+}
+// The declaration of a single test. Narrower than TEST_SIGNATURE_RE on purpose:
+// `describe(` opens a group, and judging a whole group would let an asserting
+// sibling excuse an empty test. `it.only` / `test.each` still open one test.
+const TEST_DECL_PY = /^\s*(?:async\s+)?def\s+test\w*\s*\(/;
+const TEST_DECL_JS = /^\s*(?:async\s+)?(?:it|test)(?:\.\w+)*\s*\(/;
+// A same-file helper definition (#929): `function f(`, `const f = (` / `=
+// function` / `= x =>`, or Python `def f(`.
+const HELPER_DEF_PY = /^\s*(?:async\s+)?def\s+(\w+)\s*\(/;
+const HELPER_DEF_JS = /^\s*(?:export\s+)?(?:async\s+)?(?:function\s*\*?\s*(\w+)\s*\(|(?:const|let|var)\s+(\w+)\s*=\s*(?:async\s+)?(?:function\b|\(|\w+\s*=>))/;
+const TEST_TITLE_RE = /\(\s*(['"`])((?:\\.|(?!\1).)*)\1|def\s+(\w+)/;
+function indentWidth(line) {
+    return line.length - line.trimStart().length;
+}
+// Strings and comments are blanked before delimiter counting.
+const JS_STRING_OR_COMMENT = /(['"`])(?:\\.|(?!\1).)*?\1|\/\/.*$|\/\*[\s\S]*?\*\//g;
+const NEW_FILE_RE = /^--- \/dev\/null\r?\n\+\+\+ b\/(.+?)\r?$/gm;
+function visibleLinesByPath(diffText) {
+    const files = new Map();
+    walkDiff(diffText, (line) => {
+        let file = files.get(line.path);
+        if (!file) {
+            file = { text: new Map(), added: new Set(), eof: null };
+            files.set(line.path, file);
+        }
+        file.text.set(line.lineno, line.text);
+        if (line.added)
+            file.added.add(line.lineno);
+    });
+    for (const m of diffText.matchAll(NEW_FILE_RE)) {
+        const file = files.get(m[1]);
+        if (file)
+            file.eof = Math.max(...file.text.keys());
+    }
+    return files;
+}
+/** The file's own text under `root`, or `null` when it cannot be read. */
+function fileAtRoot(root, path) {
+    try {
+        const lines = readFileSync(`${root}/${path}`, 'utf-8').split(/\r?\n/);
+        const text = new Map(lines.map((t, i) => [i + 1, t]));
+        return { text, added: new Set(), eof: lines.length };
+    }
+    catch {
+        return null;
+    }
+}
+/** The enclosing test's declaration line in the contiguous visible run, or null. */
+function enclosingTestDecl(file, lineNo, declRe) {
+    for (let n = lineNo; file.text.has(n); n--) {
+        if (declRe.test(file.text.get(n)))
+            return n;
+    }
+    return null;
+}
+/** Python: a block closes before the first non-blank line dedented to `def`. */
+function pythonBlockEnd(file, start) {
+    const declIndent = indentWidth(file.text.get(start));
+    let n = start + 1;
+    for (; file.text.has(n); n++) {
+        const text = file.text.get(n);
+        if (text.trim() && indentWidth(text) <= declIndent)
+            return n - 1;
+    }
+    return n - 1 === file.eof ? n - 1 : null;
+}
+/**
+ * The last line of the block opened at `start`, or `null` when its end is not
+ * inside the visible run (#929). JS/TS closes when delimiter depth returns to
+ * zero. An unknown end means the assertion may be exactly what is out of view
+ * — the dominant case, since a test's setup is edited far more than its
+ * `expect` — so the caller abstains rather than scoring half a block.
+ */
+function blockEnd(file, start, isPython) {
+    if (isPython)
+        return pythonBlockEnd(file, start);
+    let depth = 0;
+    let opened = false;
+    let n = start;
+    for (; file.text.has(n); n++) {
+        const code = file.text.get(n).replace(JS_STRING_OR_COMMENT, '');
+        const opens = code.replace(/[^{(]/g, '').length;
+        depth += opens - code.replace(/[^})]/g, '').length;
+        opened ||= opens > 0;
+        if (opened && depth <= 0)
+            return n;
+    }
+    return n - 1 === file.eof ? n - 1 : null;
+}
+function linesOf(file, start, end) {
+    const out = [];
+    for (let n = start; n <= end; n++) {
+        const text = file.text.get(n);
+        if (text !== undefined)
+            out.push(text);
+    }
+    return out;
+}
+/** Same-file helpers whose CLOSED body asserts, from diff and disk text (#929). */
+function assertingHelpers(sources, framework) {
+    const names = new Set();
+    for (const src of sources) {
+        for (const n of src.text.keys()) {
+            const name = assertingHelperAt(src, n, framework);
+            if (name)
+                names.add(name);
+        }
+    }
+    return [...names];
+}
+/** The helper defined at line `n` when its closed body asserts, else null. */
+function assertingHelperAt(src, n, framework) {
+    const isPython = framework === 'pytest';
+    const m = (isPython ? HELPER_DEF_PY : HELPER_DEF_JS).exec(src.text.get(n));
+    const name = m?.[1] ?? m?.[2];
+    const end = name ? blockEnd(src, n, isPython) : null;
+    if (end === null)
+        return null;
+    return hasAssertion(linesOf(src, n, end).join('\n'), framework)
+        ? name
+        : null;
+}
+/** True iff the block asserts nothing and has an added body to judge. */
+function isWeakBlock(file, [start, end], framework, helpers) {
+    const span = linesOf(file, start, end);
+    const added = linesOf(file, start, end).filter((_, i) => file.added.has(start + i));
+    // FP-3: only a signature was added over an unchanged body. A wholly added
+    // block (e.g. `it('x', () => {})` on one line) is still judged.
+    if (!hasAddedTestBody(added) && added.length < span.length)
+        return false;
+    const code = span.join('\n');
+    if (!isAssertionFreeTest(code, framework))
+        return false;
+    return !helpers.some((h) => new RegExp(`\\b${h}\\s*\\(`).test(code));
+}
+/** The weak test blocks touched by `unit`'s added lines, each visited once. */
+function weakBlocksIn(file, unit, framework, helpers) {
+    const declRe = framework === 'pytest' ? TEST_DECL_PY : TEST_DECL_JS;
+    const seen = new Set();
+    const weak = [];
+    for (const lineNo of linesInRanges(unit.added_ranges)) {
+        const start = enclosingTestDecl(file, lineNo, declRe);
+        if (start === null || seen.has(start))
+            continue;
+        seen.add(start);
+        const end = blockEnd(file, start, framework === 'pytest');
+        if (end === null)
+            continue;
+        if (isWeakBlock(file, [start, end], framework, helpers)) {
+            weak.push([start, end]);
+        }
+    }
+    return weak;
+}
+function testTitle(decl) {
+    const m = TEST_TITLE_RE.exec(decl);
+    return m?.[2] ?? m?.[3] ?? decl.trim();
+}
+/**
+ * Advisory `weak-test` findings for ADDED tests that assert nothing — one per
+ * weak test block, naming its title and line span (#929).
+ *
+ * The span scored is the ENCLOSING TEST BLOCK (#747); a block that cannot be
+ * resolved, or whose end is out of view, is abstained on. `repoRoot` is where
+ * the file's own text is read for helper resolution (`.`, the CLI's repoRoot
+ * convention). Findings are `LOW` and never gated (see computeExitCode).
+ */
+export function buildWeakTestFindings(testUnits, diffText, repoRoot = '.') {
+    const addedByPath = addedContentByPath(diffText);
+    const visibleByPath = visibleLinesByPath(diffText);
+    const findings = [];
+    for (const unit of testUnits) {
+        const file = visibleByPath.get(unit.path);
+        if (!file || !addedByPath.get(unit.path)?.length)
+            continue;
+        const framework = frameworkForTestPath(unit.path);
+        const disk = fileAtRoot(repoRoot, unit.path);
+        const helpers = assertingHelpers(disk ? [file, disk] : [file], framework);
+        for (const [start, end] of weakBlocksIn(file, unit, framework, helpers)) {
+            const title = testTitle(file.text.get(start));
+            findings.push(new GuardianFinding({
+                path: unit.path,
+                unit: unit.path,
+                kind: 'weak-test',
+                fidelity: Fidelity.Heuristic,
+                severity: Severity.LOW,
+                evidence: `added test "${title}" (L${start}–L${end}) asserts nothing (advisory — never blocks the gate)`,
+                suggestion: 'add at least one assertion, or delete the test if it is a placeholder.',
+                added_ranges: [[start, end]],
+            }));
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=weak-test.js.map

package/dist/engine/mcp-server.js

@@ -40,8 +40,8 @@
  *     a single trailing-newline empty tail exactly as `str.splitlines()` does.
  *   - File writes are LF + UTF-8 on every platform (matches the sibling ports).
  */
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { basename, dirname, extname, join, relative, resolve } from 'node:path';
+import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync, } from 'node:fs';
+import { basename, dirname, extname, isAbsolute, join, relative, resolve, } from 'node:path';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import * as z from 'zod';
@@ -476,8 +476,60 @@ export function analyzeFileImpl(filePath) {
         persona,
     };
 }
+/**
+ * Resolve `candidate` against `root` and return it only if it stays inside.
+ *
+ * A tool argument arrives from the MCP host, so a path is untrusted input: an
+ * absolute path, a `..` climb, or a symlinked parent directory would otherwise
+ * let a caller reach outside the served project. Containment is therefore
+ * checked *after* symlink resolution -- a textual `..`-and-absolute test looks
+ * like a guard but cannot see a symlink, which is the gap this exists to close.
+ *
+ * `realpathSync` throws on a missing path, so the nearest existing ancestor is
+ * resolved and the not-yet-created tail re-joined onto it. That is what lets a
+ * write to a new file still be checked against the real location of the
+ * directory it would be created in. Mirrors `resolveCliPath`
+ * (`core/skill-registry.ts`), the guard already proven in this codebase.
+ *
+ * @returns the resolved absolute path, or `null` when it escapes `root`.
+ */
+export function resolveInsideRoot(candidate, root) {
+    let realRoot;
+    try {
+        realRoot = realpathSync(resolve(root));
+    }
+    catch {
+        return null;
+    }
+    const target = resolve(realRoot, candidate);
+    // Walk up to the nearest ancestor that exists, remembering the tail.
+    const tail = [];
+    let probe = target;
+    while (!existsSync(probe)) {
+        const parent = dirname(probe);
+        if (parent === probe)
+            return null;
+        tail.unshift(basename(probe));
+        probe = parent;
+    }
+    let resolved;
+    try {
+        resolved = join(realpathSync(probe), ...tail);
+    }
+    catch {
+        return null;
+    }
+    const rel = relative(realRoot, resolved);
+    if (rel !== '' && (rel.startsWith('..') || isAbsolute(rel)))
+        return null;
+    return resolved;
+}
+/** The refusal an MCP tool returns when a path argument escapes its root. */
+function escapeError(path) {
+    return { error: `path escapes the project root: ${path}` };
+}
 /** Python: `_write_test_file_impl`. */
-export function writeTestFileImpl(filePath, content, framework) {
+export function writeTestFileImpl(filePath, content, framework, root = WORKING_DIR) {
     let outPath = filePath;
     if (pySuffix(basename(filePath)) === '') {
         const extMap = {
@@ -490,12 +542,23 @@ export function writeTestFileImpl(filePath, content, framework) {
         // with no existing suffix to strip, that is a plain concatenation.
         outPath = filePath + (extMap[framework] ?? '.ts');
     }
+    // Checked on the FINAL path, after the extension is inferred, and before the
+    // first filesystem mutation -- `mkdirSync` below would otherwise create
+    // directories outside the root even when the write itself were refused.
+    if (resolveInsideRoot(outPath, root) === null)
+        return escapeError(outPath);
     mkdirSync(dirname(outPath), { recursive: true });
     writeFileSync(outPath, content, 'utf-8');
     return { written_path: outPath };
 }
 /** Python: `_run_tests_impl`. */
-export function runTestsImpl(testFile) {
+export function runTestsImpl(testFile, root = WORKING_DIR) {
+    // The same containment the write path gets: this spawns a test runner over
+    // the named file, so an unconfined path is arbitrary code execution, not
+    // merely an arbitrary read. Refused before the executor is constructed.
+    if (resolveInsideRoot(testFile, root) === null) {
+        return { passed: 0, failed: 1, exit_code: 1, ...escapeError(testFile) };
+    }
     const suffix = extname(testFile).toLowerCase();
     const framework = suffix === '.py' ? 'pytest' : 'playwright';
     const executor = new CanaryTestExecutor();

package/dist/engine/permission-matrix-cli.js

@@ -0,0 +1,51 @@
+/**
+ * `canary permission-matrix <model.yaml>` (#857).
+ *
+ * Writes the generated Playwright suite even when cells are undeclared (as
+ * `test.fixme`, so they are counted), then exits 3: a matrix with holes cannot
+ * verify the boundary it describes, and must not read as a clean generation.
+ */
+import { readFileSync, writeFileSync } from 'node:fs';
+import { Command } from 'commander';
+import pc from 'picocolors';
+import { CliExitError, jsonIndent2 } from './cli-common.js';
+import { EXIT_ABSTAINED } from './core/gate-result.js';
+import { expandMatrix, parseMatrix, probedCells, renderPlaywright, } from './core/permission-matrix.js';
+import { WARN } from './main-deps.js';
+function writeSuite(parsed, cells, undeclared, opts, deps) {
+    writeFileSync(opts.out, renderPlaywright(cells, parsed.existenceProbes), 'utf-8');
+    const cross = cells.filter((c) => c.actingTenant !== c.targetTenant).length;
+    const probes = probedCells(cells, parsed.existenceProbes).length;
+    deps.out(`Wrote ${cells.length} cell test(s)` +
+        (probes > 0 ? ` + ${probes} existence probe(s)` : '') +
+        ` to ${opts.out} ` +
+        pc.dim(`(${cross} cross-tenant)`));
+    if (undeclared.length === 0)
+        return;
+    deps.out(pc.bold(pc.yellow(`${WARN} ${undeclared.length} UNDECLARED cell(s) -- emitted as ` +
+        'test.fixme; this matrix cannot verify them:')));
+    for (const u of undeclared)
+        deps.out(`  - ${u}`);
+}
+export function buildPermissionMatrixCommand(deps) {
+    return new Command('permission-matrix')
+        .description('Generate server-direct authz tests from a declared role x endpoint ' +
+        'grid, across every acting x target tenant. Undeclared cells exit 3.')
+        .argument('<model>', 'YAML model: roles, tenants, endpoints grid')
+        .option('--out <file>', 'where to write the Playwright suite', 'permission-matrix.spec.ts')
+        .option('--json', 'Print the expanded cells as JSON instead of writing.')
+        .action((model, opts) => {
+        const parsed = parseMatrix(readFileSync(model, 'utf-8'));
+        const { cells, undeclared } = expandMatrix(parsed);
+        if (opts.json) {
+            const { existenceProbes } = parsed;
+            deps.out(jsonIndent2({ cells, undeclared, existenceProbes }));
+        }
+        else {
+            writeSuite(parsed, cells, undeclared, opts, deps);
+        }
+        if (undeclared.length > 0)
+            throw new CliExitError(EXIT_ABSTAINED);
+    });
+}
+//# sourceMappingURL=permission-matrix-cli.js.map

package/dist/engine/scaling-curve-cli.js

@@ -0,0 +1,147 @@
+/**
+ * `canary scaling-curve <points-file>` (#856).
+ *
+ * Advisory: a verdict exits 0 whatever the exponent, because this is a planning
+ * signal, not a gate. An abstention exits 3 (ADR 0009) -- "not enough data to
+ * say" must never look like "linear".
+ */
+import { spawnSync } from 'node:child_process';
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { Command, InvalidArgumentError } from 'commander';
+import pc from 'picocolors';
+import { CliExitError, jsonIndent2 } from './cli-common.js';
+import { EXIT_ABSTAINED } from './core/gate-result.js';
+import { fitScaling, parsePoints } from './core/scaling-curve.js';
+import { WARN } from './main-deps.js';
+const MEANING = {
+    LINEAR_OR_BETTER: 'cost grows no faster than input',
+    SUPERLINEAR: 'cost grows faster than input (n log n territory)',
+    STRONGLY_SUPERLINEAR: 'cost grows much faster than input (quadratic territory) -- will buckle at peak',
+};
+function positive(raw) {
+    const n = Number(raw);
+    if (!(Number.isFinite(n) && n > 0)) {
+        throw new InvalidArgumentError(`must be a positive number, got "${raw}"`);
+    }
+    return n;
+}
+/** `trend:stat`, e.g. `http_req_duration:p(95)`, read from k6's summary export. */
+const defaultK6Runner = (script, size, metric) => {
+    const [trend, stat = 'p(95)'] = metric.split(':');
+    const dir = mkdtempSync(join(tmpdir(), 'canary-scaling-'));
+    try {
+        const summary = join(dir, 'summary.json');
+        const res = spawnSync('k6', [
+            'run',
+            '--quiet',
+            '--summary-export',
+            summary,
+            '-e',
+            `SIZE=${size}`,
+            script,
+        ], 
+        // k6's own end summary would bury the verdict; its errors still show.
+        { stdio: ['ignore', 'ignore', 'inherit'] });
+        if (res.error)
+            throw res.error;
+        const j = JSON.parse(readFileSync(summary, 'utf-8'));
+        const v = j.metrics?.[trend]?.[stat];
+        return typeof v === 'number' ? v : null;
+    }
+    catch (e) {
+        if (e.code === 'ENOENT')
+            return null;
+        throw e;
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+};
+function sizeList(raw) {
+    const sizes = raw.split(',').map((s) => positive(s.trim()));
+    return sizes;
+}
+export function buildScalingCurveCommand(deps, runner = defaultK6Runner) {
+    return new Command('scaling-curve')
+        .description('Fit how a cost metric grows with input size; flag superlinear growth. ' +
+        'Advisory; abstains (exit 3) when the data cannot support a verdict.')
+        .argument('[points-file]', 'JSON {"metric","points":[{size,value}]} or CSV with a size,value header')
+        .option('--target <size>', 'extrapolate the fitted cost to this size', positive)
+        .option('--run <k6-script>', 'run the ladder: the script once per size with SIZE set')
+        .option('--sizes <list>', 'comma-separated sizes for --run', sizeList)
+        .option('--repeats <n>', 'runs per size for --run (noise rule)', positive, 3)
+        .option('--metric <trend:stat>', 'k6 metric for --run', 'http_req_duration:p(95)')
+        .option('--json', 'Output the verdict and its points as JSON.')
+        .action((file, opts) => {
+        const { metric, points, missing } = collect(file, opts, runner);
+        let r = fitScaling(points, opts.target === undefined ? {} : { target: opts.target });
+        // A run that never emitted the metric is an abstention even if the other
+        // runs would fit: the missing runs are a hole in the curve, not a zero.
+        if (missing > 0 && r.verdict === 'INSUFFICIENT_DATA') {
+            r.reasons.unshift(`metric ${metric} was not emitted by ${missing} run(s)`);
+        }
+        if (missing > 0 && r.verdict !== 'INSUFFICIENT_DATA') {
+            r = {
+                verdict: 'INSUFFICIENT_DATA',
+                reasons: [`metric ${metric} was not emitted by ${missing} run(s)`],
+                points: r.points,
+            };
+        }
+        const abstained = r.verdict === 'INSUFFICIENT_DATA';
+        if (opts.json) {
+            deps.out(jsonIndent2({ metric: metric ?? null, ...r }));
+        }
+        else {
+            const label = metric ?? 'value';
+            deps.out(pc.bold(`Scaling curve: ${label} vs size`));
+            for (const p of r.points) {
+                deps.out(`  ${String(p.size).padStart(10)}  ${Number(p.value.toPrecision(4))}  ${pc.dim(`(${p.samples} sample(s))`)}`);
+            }
+            if (r.verdict === 'INSUFFICIENT_DATA') {
+                deps.out(pc.bold(pc.yellow(`${WARN} INSUFFICIENT_DATA -- this is not a pass.`)));
+                for (const reason of r.reasons)
+                    deps.out(`  - ${reason}`);
+            }
+            else {
+                const color = r.verdict === 'LINEAR_OR_BETTER' ? pc.green : pc.yellow;
+                deps.out(`${color(pc.bold(r.verdict))}: exponent ${r.exponent.toFixed(2)} ` +
+                    `(R² ${r.r2.toFixed(3)}) -- ${MEANING[r.verdict]}`);
+                deps.out(r.knee === null
+                    ? '  no knee: the curve does not bend within the measured range'
+                    : `  knee at size ${r.knee}: growth steepens from here`);
+                if (r.extrapolation) {
+                    const e = r.extrapolation;
+                    deps.out(`  extrapolated ${label} at ${e.size}: ${e.value.toFixed(1)} ` +
+                        pc.dim(`(${e.multipleOfLargest}x the largest measured size -- an extrapolation, not a measurement)`));
+                }
+            }
+        }
+        if (abstained)
+            throw new CliExitError(EXIT_ABSTAINED);
+    });
+}
+function collect(file, opts, runner) {
+    if (opts.run === undefined) {
+        if (file === undefined) {
+            throw new InvalidArgumentError('give a points file, or --run with --sizes');
+        }
+        return { ...parsePoints(readFileSync(file, 'utf-8')), missing: 0 };
+    }
+    if (!opts.sizes)
+        throw new InvalidArgumentError('--run needs --sizes');
+    const points = [];
+    let missing = 0;
+    for (const size of opts.sizes) {
+        for (let i = 0; i < opts.repeats; i += 1) {
+            const value = runner(opts.run, size, opts.metric);
+            if (value === null)
+                missing += 1;
+            else
+                points.push({ size, value });
+        }
+    }
+    return { metric: opts.metric, points, missing };
+}
+//# sourceMappingURL=scaling-curve-cli.js.map