canary-test-cli 7.2.0 → 8.0.0

package/dist/engine/core/migrator.js

@@ -37,7 +37,7 @@
  *   - Python truthiness (`""`/`None`/`{}`/`[]` falsy) via {@link pyTruthy}.
  */
 import { createHash } from 'node:crypto';
-import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync, } from 'node:fs';
+import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, rmSync, writeFileSync, } from 'node:fs';
 import { homedir } from 'node:os';
 import { basename, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { readJsonWithWarning } from './config-validation.js';
@@ -236,12 +236,34 @@ function parseWorkflowEntry(entry) {
 function resolveTemplatePath(skillDir, rel) {
     if (!rel || isAbsolute(rel) || /^[A-Za-z]:/.test(rel))
         return null;
-    const base = resolve(skillDir);
+    const base = realPathIfPresent(resolve(skillDir));
     const full = resolve(base, rel);
-    if (full !== base && !full.startsWith(base + sep))
+    // Containment is judged on the REAL path: `resolve` normalizes `..` but
+    // never follows a symlink, so a lexically-contained `templates/x.yml` that
+    // is a link to /etc/passwd would otherwise pass and have its target's bytes
+    // written into the consumer's `.github/workflows/`. This mirrors
+    // `SkillRegistry.resolveCliPath`, which guards the same class the same way.
+    const real = realPathIfPresent(full);
+    if (real !== base && !real.startsWith(base + sep))
         return null;
+    // The declared path (resolved against the real skill dir) is returned rather
+    // than its own realpath: an intra-skill symlink is legitimate, and
+    // `basename(src)` is what names the installed workflow file.
     return full;
 }
+/**
+ * *path* with symlinks resolved, or *path* itself when it does not exist --
+ * `realpathSync` throws on a missing path, and a declared-but-unshipped
+ * template must still reach the `missing` report rather than `invalid`.
+ */
+function realPathIfPresent(path) {
+    try {
+        return realpathSync(path);
+    }
+    catch {
+        return path;
+    }
+}
 /**
  * Is the deployed copy of a skill the consumer's rather than the overlay's?
  *
@@ -330,6 +352,77 @@ function findWorkspaceSuites(root, framework) {
     }
     return suites;
 }
+/**
+ * The distinct `framework/shape` pairs the workspace packages declare, in the
+ * order the (path-sorted) findings first mention them.
+ *
+ * The scalar resolution collapses more than one pair to `unknown` (see
+ * `resolveFromWorkspace`). Reporting that bare `unknown` without also
+ * reporting *what* was found is the residue of #504 part 1: the walk observed
+ * two real suites and the report claimed nothing matched.
+ */
+function workspacePairs(ws) {
+    return [...new Set(ws.findings.map((f) => `${f.framework}/${f.shape}`))];
+}
+/** How many distinct package directories carry at least one finding. */
+function packagesWithFindings(ws) {
+    return new Set(ws.findings.map((f) => f.dir)).size;
+}
+/** The suites a workspace walk found, rendered as `` `dir/` (framework) ``. */
+function namedWorkspaceSuites(ws) {
+    return ws.findings.map((f) => `\`${f.dir}/\` (${f.framework})`).join(', ');
+}
+/**
+ * The follow-ups for a run that resolved no framework: the uncertain-detection
+ * message, plus -- only when the walk actually found suites -- the per-package
+ * route, which needs no override at all (#504 part 1).
+ */
+function unresolvedFrameworkFollowups(ws) {
+    const out = [
+        uncertainDetectionMessage('test framework', {
+            reason: unresolvedFrameworkReason(ws),
+            candidates: KNOWN_FRAMEWORKS,
+            overrideHint: '`canary migrate --framework <name>`',
+        }),
+    ];
+    if (ws !== null && ws.findings.length > 0) {
+        out.push(`Or re-run \`canary migrate\` from inside a package ${EMDASH} ` +
+            `${namedWorkspaceSuites(ws)}.`);
+    }
+    return out;
+}
+/**
+ * Why no single framework resolved, in the terms of what was actually probed.
+ *
+ * A workspace whose packages disagree is a different failure from a repo where
+ * nothing matched, and telling the user "no config file, dependency, or
+ * language marker matched" when two package configs *did* match is a claim the
+ * run's own evidence contradicts (#504 part 1).
+ */
+function unresolvedFrameworkReason(ws) {
+    const nothingMatched = 'no config file, dependency, or language marker matched a known framework';
+    if (ws === null || ws.findings.length === 0)
+        return nothingMatched;
+    const pairs = workspacePairs(ws);
+    const n = packagesWithFindings(ws);
+    const combos = pairs.length === 1 ? 'combination' : 'combinations';
+    return (`this workspace's packages declare ${pairs.length} different ` +
+        `framework/shape ${combos} across ${n} ` +
+        `package${n === 1 ? '' : 's'} (${pairs.join(', ')}), ` +
+        'so no single framework applies at the root');
+}
+/**
+ * The shape the workspace packages already resolved for *framework*, when they
+ * agree on one. Null when no package declares it, or when they disagree --
+ * either way the caller falls back to the root-only probe rather than picking
+ * a winner out of a tie (#504).
+ */
+function workspaceShapeForFramework(ws, framework) {
+    if (ws === null)
+        return null;
+    const shapes = new Set(ws.findings.filter((f) => f.framework === framework).map((f) => f.shape));
+    return shapes.size === 1 ? [...shapes][0] : null;
+}
 /**
  * The shape implied by an explicit `--framework` override (#504 (2)).
  *
@@ -753,11 +846,51 @@ export class MigrationReport {
             const p = ws.scanned === 1 ? '1 package' : `${ws.scanned} packages`;
             notes.push(`${p} scanned, none carries a recognizable test config.`);
         }
+        else if (ws.findings.length > 0) {
+            // The other half of the denominator: what the walk *did* observe. The
+            // scalar above collapses disagreeing packages to `unknown`, so without
+            // these lines a repo with two real suites reads as a repo with none
+            // (#504 part 1).
+            const withFindings = packagesWithFindings(ws);
+            const p = ws.scanned === 1 ? '1 package' : `${ws.scanned} packages`;
+            notes.push(`${ws.manager} workspace ${EMDASH} ${p} scanned, ` +
+                `${withFindings} carrying a test config.`);
+            for (const f of ws.findings) {
+                notes.push(`\`${f.dir}/\` ${EMDASH} ${f.framework} / ${f.shape} ` +
+                    `(\`${f.source}\`)`);
+            }
+        }
         for (const dir of ws.unreadable) {
             notes.push(`\`${dir}/\` could not be read and was not scanned.`);
         }
         return notes;
     }
+    /**
+     * Why a dry run proposes nothing. Three different situations reach this
+     * line and they are not interchangeable: a suite already exists for this
+     * framework, the workspace packages disagree so no root framework applies,
+     * or the project genuinely carries everything already. Rendering the third
+     * sentence for the second case tells a monorepo with no Canary config that
+     * it has all of it (#504 parts 1 and 3).
+     */
+    nothingToCreateNote() {
+        if (this.existing_suites.length > 0) {
+            const names = this.existing_suites.map((s) => `\`${s.dir}/\``);
+            return (`_Nothing ${EMDASH} ${names.join(', ')} already ` +
+                `carries a ${this.framework} suite. To scaffold a second one, ` +
+                're-run `canary migrate` from inside that package._');
+        }
+        const ws = this.workspace;
+        if (this.framework === 'unknown' && ws !== null && ws.findings.length > 0) {
+            return (`_Nothing ${EMDASH} this workspace's packages declare more than ` +
+                `one framework: ${namedWorkspaceSuites(ws)}. Re-run ` +
+                '`canary migrate` from inside a package, or pass ' +
+                '`--framework <name>` to pick one._');
+        }
+        return ('_Nothing new ' +
+            EMDASH +
+            ' project already has all Canary config files._');
+    }
     /**
      * The dry run's denominator (#504): config files that would be created,
      * skills that would deploy, workflows that would install. Zero means the
@@ -819,23 +952,15 @@ export class MigrationReport {
                     lines.push(`- \`${f}\``);
                 lines.push('');
             }
+            lines.push('## Would Create', '');
             if (this.would_create.length > 0) {
-                lines.push('## Would Create', '');
                 for (const f of this.would_create)
                     lines.push(`- \`${f}\``);
-                lines.push('');
-            }
-            else if (this.existing_suites.length > 0) {
-                const names = this.existing_suites.map((s) => `\`${s.dir}/\``);
-                lines.push('## Would Create', '', `_Nothing ${EMDASH} ${names.join(', ')} already ` +
-                    `carries a ${this.framework} suite. To scaffold a second one, ` +
-                    're-run `canary migrate` from inside that package._', '');
             }
             else {
-                lines.push('## Would Create', '', '_Nothing new ' +
-                    EMDASH +
-                    ' project already has all Canary config files._', '');
+                lines.push(this.nothingToCreateNote());
             }
+            lines.push('');
             if (this.skipped_configs.length > 0) {
                 lines.push('## Already Present (will not be touched)', '');
                 for (const f of this.skipped_configs)
@@ -1027,7 +1152,13 @@ export class HarnessMigrator {
             .trim()
             .toLowerCase();
         const overrideShape = pyTruthy(framework) && explicitShape === ''
-            ? shapeForFrameworkOverride(framework, projectRoot)
+            ? // A workspace package that already declares this framework has
+                // already had its shape refined against its OWN spec files. The
+                // root-only refinement cannot see them -- in the reported repo the
+                // specs live in `apps/web-e2e/tests/`, so refining at the root reads
+                // zero spec files and falls back to the table default (#504).
+                (workspaceShapeForFramework(ctx.workspace, framework) ??
+                    shapeForFrameworkOverride(framework, projectRoot))
             : null;
         const shape = overrideShape ?? ctx.detected_shape;
         // The set that actually drives deployment. Re-derived from the *effective*
@@ -1036,11 +1167,7 @@ export class HarnessMigrator {
         const deployShapes = unionShapes(shape, ctx.workspace);
         const followups = [];
         if (effectiveFramework === null) {
-            followups.push(uncertainDetectionMessage('test framework', {
-                reason: 'no config file, dependency, or language marker matched a known framework',
-                candidates: KNOWN_FRAMEWORKS,
-                overrideHint: '`canary migrate --framework <name>`',
-            }));
+            followups.push(...unresolvedFrameworkFollowups(ctx.workspace));
             // Issue #295 point 3: a detection miss must not block skill deployment --
             // nor, for the same reason, the workflow install (#459). The guardian
             // workflow is exactly what an unrecognised repo most needs.

package/dist/engine/core/permission-matrix.js

@@ -0,0 +1,219 @@
+/**
+ * Permission matrix (#857): a human-declared allow/deny grid, expanded across
+ * every acting tenant x target tenant, rendered as server-direct API tests.
+ *
+ * The grid is declared, never inferred. Inferring expectations from current
+ * behaviour would encode today's authz bugs as "expected". So a cell with no
+ * declaration is `undeclared` -- counted and named, never allowed or denied by
+ * default -- because a default is exactly where the cells nobody thought about
+ * would hide.
+ */
+import { load } from 'js-yaml';
+const VALUES = ['allow', 'deny', 'own-tenant'];
+// Backtick, `$` and backslash are excluded from paths because the path is
+// spliced into a generated template literal.
+const ENDPOINT = /^([A-Z]+)\s+(\/[^\s`$\\]*)$/;
+function stringList(v, key) {
+    if (!Array.isArray(v) ||
+        v.length === 0 ||
+        !v.every((x) => typeof x === 'string')) {
+        throw new Error(`model needs a non-empty "${key}" list of names`);
+    }
+    return v;
+}
+export function parseMatrix(text) {
+    const raw = (load(text) ?? {});
+    const roles = stringList(raw['roles'], 'roles');
+    const tenants = stringList(raw['tenants'], 'tenants');
+    const endpoints = raw['endpoints'];
+    if (endpoints === null ||
+        typeof endpoints !== 'object' ||
+        Array.isArray(endpoints)) {
+        throw new Error('model needs an "endpoints" map of "METHOD /path" -> cells');
+    }
+    for (const key of Object.keys(endpoints)) {
+        if (!ENDPOINT.test(key)) {
+            throw new Error(`endpoint "${key}" must be written as "METHOD /path"`);
+        }
+    }
+    return {
+        roles,
+        tenants,
+        endpoints: endpoints,
+        existenceProbes: probeList(raw['existence_probes'], endpoints),
+    };
+}
+/**
+ * A probe on an undeclared endpoint is a model error, not a skip: the author
+ * asked for a check, and quietly not running it would read as "no oracle".
+ */
+function probeList(v, endpoints) {
+    if (v === undefined || v === null)
+        return [];
+    if (!Array.isArray(v) || !v.every((x) => typeof x === 'string')) {
+        throw new Error('"existence_probes" must be a list of "METHOD /path"');
+    }
+    for (const p of v) {
+        if (!Object.hasOwn(endpoints, p)) {
+            throw new Error(`existence probe "${p}" is not in endpoints`);
+        }
+    }
+    return v;
+}
+/** The declared value for one cell, or `null` (recorded in `undeclared`). */
+function declaredValue(row, endpoint, role, undeclared) {
+    const declared = (row ?? {})[role];
+    if (declared === undefined) {
+        undeclared.push(`${endpoint} × ${role}`);
+        return null;
+    }
+    if (typeof declared !== 'string' || !VALUES.includes(declared)) {
+        undeclared.push(`${endpoint} × ${role} (unknown value "${String(declared)}")`);
+        return null;
+    }
+    return declared;
+}
+function expectFor(value, actingTenant, targetTenant) {
+    if (value === null)
+        return 'undeclared';
+    if (value !== 'own-tenant')
+        return value;
+    return actingTenant === targetTenant ? 'allow' : 'deny';
+}
+export function expandMatrix(model) {
+    const cells = [];
+    const undeclared = [];
+    const pairs = model.tenants.flatMap((a) => model.tenants.map((t) => [a, t]));
+    for (const [endpoint, row] of Object.entries(model.endpoints)) {
+        const [, method, path] = ENDPOINT.exec(endpoint);
+        for (const role of model.roles) {
+            const value = declaredValue(row, endpoint, role, undeclared);
+            for (const [actingTenant, targetTenant] of pairs) {
+                cells.push({
+                    endpoint,
+                    method: method,
+                    path: path,
+                    role,
+                    actingTenant,
+                    targetTenant,
+                    expect: expectFor(value, actingTenant, targetTenant),
+                });
+            }
+        }
+    }
+    return { cells, undeclared };
+}
+/** Env-var-safe form of a role or tenant name. */
+function envName(s) {
+    return s.toUpperCase().replace(/[^A-Z0-9]/g, '_');
+}
+const HEADER = [
+    '// Generated by `canary permission-matrix` (#857). Do not edit by hand:',
+    '// change the declared model and regenerate.',
+    '//',
+    '// Credentials and fixtures come from the environment, never this file:',
+    '//   CANARY_TOKEN_<ROLE>_<TENANT>  bearer token for that role in that tenant',
+    '//   CANARY_ID_<TENANT>            a synthetic record owned by that tenant',
+    "import { test, expect } from '@playwright/test';",
+    '',
+    'function env(name: string): string {',
+    '  const v = process.env[name];',
+    '  // A missing credential must fail, not skip: a skipped deny cell reads as',
+    '  // "no leak" in the report.',
+    '  if (!v) throw new Error(`${name} is not set`);',
+    '  return v;',
+    '}',
+    '',
+    'const DENIED = [401, 403, 404];',
+    '',
+];
+const VERB = {
+    allow: 'allowed',
+    deny: 'denied',
+    undeclared: 'UNDECLARED',
+};
+function renderCell(c) {
+    const title = JSON.stringify(`${c.role}@${c.actingTenant} -> ${c.targetTenant}: ${c.endpoint} is ${VERB[c.expect]}`);
+    if (c.expect === 'undeclared') {
+        return [
+            `test.fixme(${title}, () => {`,
+            '  // UNDECLARED: the model has no expectation for this cell. Declare it.',
+            '});',
+            '',
+        ];
+    }
+    return [
+        `test(${title}, async ({ request }) => {`,
+        `  const res = await request.fetch(\`${urlFor(c, targetId(c))}\`, {`,
+        `    method: '${c.method}',`,
+        `    headers: ${authHeader(c)},`,
+        '  });',
+        c.expect === 'allow'
+            ? '  expect(res.status()).toBeLessThan(400);'
+            : '  expect(DENIED).toContain(res.status());',
+        '});',
+        '',
+    ];
+}
+function targetId(c) {
+    return `\${env('CANARY_ID_${envName(c.targetTenant)}')}`;
+}
+function urlFor(c, idExpr) {
+    return c.path.replace(/\{[^}]+\}/g, idExpr);
+}
+function authHeader(c) {
+    return `{ Authorization: \`Bearer \${env('CANARY_TOKEN_${envName(c.role)}_${envName(c.actingTenant)}')}\` }`;
+}
+// Emitted only when a probe exists, so a model without probes generates the
+// same file it always did.
+const SHAPE_HELPER = [
+    '// Existence probes also need CANARY_ABSENT_ID: an id that exists in no',
+    '// tenant, compared against each denied real record.',
+    '//',
+    '// What a caller can observe about a response body: sorted top-level keys',
+    '// for a JSON object, otherwise the raw text. Values are deliberately not',
+    '// compared -- two "not found" bodies may differ in a request id.',
+    'async function shape(res: { text(): Promise<string> }): Promise<unknown> {',
+    '  const text = await res.text();',
+    '  try {',
+    '    const body: unknown = JSON.parse(text);',
+    "    return body !== null && typeof body === 'object' && !Array.isArray(body)",
+    '      ? Object.keys(body).sort()',
+    '      : typeof body;',
+    '  } catch {',
+    '    return text;',
+    '  }',
+    '}',
+    '',
+];
+/**
+ * A denied caller must get the same answer for a real record as for a
+ * missing one; otherwise the endpoint confirms the record exists.
+ */
+function renderProbe(c) {
+    const title = JSON.stringify(`${c.role}@${c.actingTenant} -> ${c.targetTenant}: ${c.endpoint} existence is not revealed`);
+    const opts = `{ method: '${c.method}', headers: ${authHeader(c)} }`;
+    return [
+        `test(${title}, async ({ request }) => {`,
+        `  const present = await request.fetch(\`${urlFor(c, targetId(c))}\`, ${opts});`,
+        `  const absent = await request.fetch(\`${urlFor(c, "${env('CANARY_ABSENT_ID')}")}\`, ${opts});`,
+        '  expect(absent.status()).toBe(present.status());',
+        '  expect(await shape(absent)).toEqual(await shape(present));',
+        '});',
+        '',
+    ];
+}
+/** Denied cells of probed endpoints: allowed callers may know a record exists. */
+export function probedCells(cells, existenceProbes) {
+    return cells.filter((c) => c.expect === 'deny' && existenceProbes.includes(c.endpoint));
+}
+export function renderPlaywright(cells, existenceProbes = []) {
+    const probed = probedCells(cells, existenceProbes);
+    return [
+        ...HEADER,
+        ...(probed.length > 0 ? SHAPE_HELPER : []),
+        ...cells.flatMap(renderCell),
+        ...probed.flatMap(renderProbe),
+    ].join('\n');
+}
+//# sourceMappingURL=permission-matrix.js.map

package/dist/engine/core/quality-scorer.js

@@ -33,9 +33,9 @@ const ASSERTIONS = {
     // never gates — a false "asserts nothing" on a correct test is what teaches
     // a reader to ignore the finding.
     playwright: /\bexpect\w*\s*\(|\btoBeVisible\b|\btoHaveText\b|\btoHaveTitle\b|\btoHaveURL\b|\btoBeEnabled\b|\btoBeDisabled\b|\btoBeChecked\b|\btoHaveValue\b|\btoHaveCount\b/g,
-    // Plus non-`expect` assertion styles common in JS/TS: node:assert / vitest
-    // `assert(...)` / `assert.equal(...)`, and chai BDD `x.should.equal`.
-    vitest: /\bexpect\w*\s*\(|\btoBe\s*\(|\btoEqual\s*\(|\btoThrow\b|\btoContain\s*\(|\btoBeNull\b|\btoBeUndefined\b|\btoMatchObject\b|\bassert\s*\(|\bassert\.\w+|\.should\b/g,
+    // Plus node:assert / `assert.equal(...)`, chai `x.should`, and any
+    // `assert*(` helper call, matching the pytest pattern (#929).
+    vitest: /\bexpect\w*\s*\(|\btoBe\s*\(|\btoEqual\s*\(|\btoThrow\b|\btoContain\s*\(|\btoBeNull\b|\btoBeUndefined\b|\btoMatchObject\b|\bassert\w*\s*\(|\bassert\.\w+|\.should\b/g,
     k6: /\bcheck\s*\(|'[^']+'\s*:\s*\([^)]*\)\s*=>/g,
 };
 const NEGATIVE_KW = /\b(error|invalid|empty|null|undefined|throws|raises|exception|fail|missing|negative|reject|4\d{2}|5\d{2}|boundary|edge)\b/i;
@@ -178,24 +178,19 @@ function magicDetails(findings) {
         return ['No magic numbers detected'];
     return [`${findings.length} magic number(s) detected`, ...findings];
 }
+/** True iff `code` contains an assertion token for `framework`. */
+export function hasAssertion(code, framework) {
+    const fw = framework.toLowerCase();
+    return countMatches(ASSERTIONS[fw] ?? ASSERTIONS['pytest'], code) > 0;
+}
 /**
- * True iff `code` defines at least one test function but contains no assertions
- * — a test that asserts nothing.
- *
- * Faithful port of `is_assertion_free_test`. The high-precision "weak test"
- * signal the PR guardian consumes: it requires BOTH a test function (so a
- * non-test helper added to a test file isn't flagged) AND zero assertions. A
- * snapshot or table-driven test still matches an assertion pattern (`expect(` /
- * `assert`), so it is not flagged — keeping false positives, and the trust cost
- * of them, low. Reuses the module's {@link TEST_FN}/{@link ASSERTIONS} maps.
+ * True iff `code` defines a test function but contains no assertions. Port of
+ * `is_assertion_free_test`: requiring BOTH keeps a non-test helper unflagged,
+ * and a snapshot or table-driven test still matches an assertion pattern.
  */
 export function isAssertionFreeTest(code, framework) {
-    const fw = framework.toLowerCase();
-    const fnPat = TEST_FN[fw] ?? TEST_FN['pytest'];
-    const assertPat = ASSERTIONS[fw] ?? ASSERTIONS['pytest'];
-    const hasTest = countMatches(fnPat, code) > 0;
-    const hasAssertion = countMatches(assertPat, code) > 0;
-    return hasTest && !hasAssertion;
+    const fnPat = TEST_FN[framework.toLowerCase()] ?? TEST_FN['pytest'];
+    return countMatches(fnPat, code) > 0 && !hasAssertion(code, framework);
 }
 export class QualityScorer {
     /** Score `code` (a source string) for the given framework. */

package/dist/engine/core/scaling-curve.js

@@ -0,0 +1,143 @@
+/**
+ * Scaling-curve probe (#856): how does cost grow as input grows?
+ *
+ * Fits the log-log slope of a cost metric against input size. A fixed-size load
+ * test cannot see an O(n·m) matcher; the exponent can, before the surge does.
+ *
+ * Pure: points in, verdict out. The Phase 2 runner only produces points, so it
+ * can never disagree with the abstention rules here.
+ *
+ * Every abstention rule is a way "linear ✓" could be printed off data that does
+ * not support it (ADR 0009): too few sizes, too narrow a span, noisy samples,
+ * or a curve the power law does not fit.
+ */
+const MIN_SIZES = 4;
+const MIN_SPAN = 8;
+const MAX_CV = 0.25;
+const MIN_R2 = 0.9;
+const KNEE_DELTA = 0.5;
+const LINEAR_MAX = 1.15;
+const SUPERLINEAR_MAX = 1.6;
+function median(xs) {
+    const s = [...xs].sort((a, b) => a - b);
+    const mid = s.length >> 1;
+    return s.length % 2 ? s[mid] : (s[mid - 1] + s[mid]) / 2;
+}
+function cv(xs) {
+    const mean = xs.reduce((a, b) => a + b, 0) / xs.length;
+    const sd = Math.sqrt(xs.reduce((a, x) => a + (x - mean) ** 2, 0) / xs.length);
+    return sd / mean;
+}
+/** Least-squares slope, intercept and R² of y on x. */
+function fit(xs, ys) {
+    const n = xs.length;
+    const mx = xs.reduce((a, b) => a + b, 0) / n;
+    const my = ys.reduce((a, b) => a + b, 0) / n;
+    let sxy = 0;
+    let sxx = 0;
+    let syy = 0;
+    for (let i = 0; i < n; i += 1) {
+        sxy += (xs[i] - mx) * (ys[i] - my);
+        sxx += (xs[i] - mx) ** 2;
+        syy += (ys[i] - my) ** 2;
+    }
+    const b = sxy / sxx;
+    // A perfectly flat curve is a perfect (b = 0) fit, not a 0/0.
+    const r2 = syy === 0 ? 1 : (sxy * sxy) / (sxx * syy);
+    return { b, a: my - b * mx, r2 };
+}
+export function fitScaling(raw, opts = {}) {
+    const reasons = [];
+    const bad = raw.filter((p) => !(Number.isFinite(p.size) && p.size > 0) ||
+        !(Number.isFinite(p.value) && p.value > 0));
+    if (bad.length > 0) {
+        reasons.push(`${bad.length} point(s) with a size or value that is not a positive finite number`);
+    }
+    const good = raw.filter((p) => !bad.includes(p));
+    const bySize = new Map();
+    for (const p of good) {
+        const vs = bySize.get(p.size);
+        if (vs)
+            vs.push(p.value);
+        else
+            bySize.set(p.size, [p.value]);
+    }
+    const points = [...bySize]
+        .sort(([a], [b]) => a - b)
+        .map(([size, vs]) => ({ size, value: median(vs), samples: vs.length }));
+    if (points.length < MIN_SIZES) {
+        reasons.push(`${points.length} distinct size(s); need at least ${MIN_SIZES} distinct sizes`);
+    }
+    else {
+        const span = points.at(-1).size / points[0].size;
+        if (span < MIN_SPAN) {
+            reasons.push(`size span is ${span.toFixed(1)}x; need at least ${MIN_SPAN}x`);
+        }
+    }
+    for (const [size, vs] of bySize) {
+        if (vs.length >= 3 && cv(vs) > MAX_CV) {
+            reasons.push(`size ${size} is noisy: coefficient of variation ${cv(vs).toFixed(2)} > ${MAX_CV}`);
+        }
+    }
+    let result = null;
+    if (points.length >= 2) {
+        result = fit(points.map((p) => Math.log(p.size)), points.map((p) => Math.log(p.value)));
+        if (result.r2 < MIN_R2) {
+            reasons.push(`power-law fit R² ${result.r2.toFixed(2)} < ${MIN_R2}: the curve is not one exponent`);
+        }
+    }
+    if (reasons.length > 0 || result === null) {
+        return { verdict: 'INSUFFICIENT_DATA', reasons, points };
+    }
+    const slopes = points
+        .slice(1)
+        .map((p, i) => Math.log(p.value / points[i].value) /
+        Math.log(p.size / points[i].size));
+    const kneeAt = slopes.findIndex((s) => s >= slopes[0] + KNEE_DELTA);
+    const verdict = result.b <= LINEAR_MAX
+        ? 'LINEAR_OR_BETTER'
+        : result.b <= SUPERLINEAR_MAX
+            ? 'SUPERLINEAR'
+            : 'STRONGLY_SUPERLINEAR';
+    const out = {
+        verdict,
+        exponent: result.b,
+        r2: result.r2,
+        knee: kneeAt === -1 ? null : points[kneeAt].size,
+        points,
+    };
+    if (opts.target !== undefined) {
+        out.extrapolation = {
+            size: opts.target,
+            value: Math.exp(result.a + result.b * Math.log(opts.target)),
+            multipleOfLargest: opts.target / points.at(-1).size,
+        };
+    }
+    return out;
+}
+/** Read `{metric, points}` JSON or a `size,value` CSV. Unreadable input throws. */
+export function parsePoints(text) {
+    const trimmed = text.trim();
+    if (trimmed.startsWith('{')) {
+        const j = JSON.parse(trimmed);
+        if (!Array.isArray(j.points)) {
+            throw new Error('JSON input needs a "points" array of {size, value}');
+        }
+        return j.metric === undefined
+            ? { points: j.points }
+            : { metric: j.metric, points: j.points };
+    }
+    const [header, ...rows] = trimmed.split(/\r?\n/);
+    if (header?.replace(/\s/g, '').toLowerCase() !== 'size,value') {
+        throw new Error('expected JSON {"points": [...]} or CSV with a size,value header');
+    }
+    return {
+        points: rows
+            .filter((r) => r.trim())
+            .map((r) => {
+            const [size, value] = r.split(',').map(Number);
+            return { size: size, value: value };
+        }),
+    };
+}
+//# sourceMappingURL=scaling-curve.js.map

package/dist/engine/core/string-literals.js

@@ -59,7 +59,9 @@ export function blankStringContent(code, options = {}) {
     const spans = literalContentSpans(code, options.python === true);
     if (spans.length === 0)
         return code;
-    const out = [...code];
+    // `split('')`, not `[...code]`: spans are UTF-16 offsets, and spreading by
+    // code point would collapse each surrogate pair and shift every offset (#861).
+    const out = code.split('');
     for (const [start, end] of spans) {
         for (let i = start; i < end; i += 1) {
             // Newlines survive so line numbering is unchanged; everything else goes.