codictator 0.0.0 → 0.1.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +9 -0
- package/README.md +5 -0
- package/dist/builtin-packs/core/fixtures/agent-assets-present/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/agent-assets-present/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/arch-boundaries/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/arch-boundaries/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/arch-module-mapped/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/arch-module-mapped/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/arch-module-size/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/arch-module-size/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/arch-no-cycles/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/arch-no-cycles/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/arch-profile-declared/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/arch-profile-declared/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/arch-public-entry/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/arch-public-entry/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/branch-protection/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/branch-protection/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/bug-registry/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/bug-registry/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/bug-rows-immutable/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/bug-rows-immutable/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/ci-actions-pinned/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/ci-actions-pinned/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/ci-present/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/ci-present/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/ci-required-check/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/ci-required-check/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/compiler-strict/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/compiler-strict/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/complexity/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/complexity/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/context-hard-band/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/context-hard-band/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/context-soft-band/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/context-soft-band/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/conventional-commit/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/conventional-commit/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/coverage-floor/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/coverage-floor/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/custom-pack-selftest/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/custom-pack-selftest/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/dangerous-shell/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/dangerous-shell/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/dead-code/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/dead-code/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/dep-exact-pin/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/dep-exact-pin/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/dep-latest-stable/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/dep-latest-stable/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/dep-license/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/dep-license/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/dep-lockfile/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/dep-lockfile/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/dep-new-needs-reason/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/dep-new-needs-reason/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/dep-no-deprecated/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/dep-no-deprecated/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/dep-no-vulnerable/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/dep-no-vulnerable/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/dep-one-per-capability/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/dep-one-per-capability/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/diagnose-before-fix/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/diagnose-before-fix/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/doc-breadth/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/doc-breadth/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/doc-density/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/doc-density/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/doc-links-valid/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/doc-links-valid/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/doc-no-corpus-counts/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/doc-no-corpus-counts/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/doc-no-inline-changelog/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/doc-no-inline-changelog/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/doc-one-level/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/doc-one-level/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/doc-placement/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/doc-placement/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/doc-router-leaf/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/doc-router-leaf/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/doc-single-owner/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/doc-single-owner/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/doc-size/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/doc-size/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/duplication/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/duplication/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/engine-version-match/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/engine-version-match/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/file-naming/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/file-naming/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/file-size/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/file-size/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/function-size/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/function-size/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/graph-before-scan/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/graph-before-scan/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/guardrail-manifest/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/guardrail-manifest/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/history-append-only/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/history-append-only/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/history-entry/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/history-entry/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/history-entry-complete/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/history-entry-complete/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/hooks-active/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/hooks-active/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/loop-breaker/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/loop-breaker/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/max-file-bytes/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/max-file-bytes/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/mcp-declared/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/mcp-declared/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/no-assertion-loss/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/no-assertion-loss/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/no-baseline-raise/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/no-baseline-raise/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/no-bypass/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/no-bypass/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/no-fixture-shrink/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/no-fixture-shrink/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/no-guard-removal/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/no-guard-removal/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/no-new-suppressions/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/no-new-suppressions/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/no-secret-reads/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/no-secret-reads/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/no-secrets/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/no-secrets/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/no-skipped-tests/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/no-skipped-tests/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/no-speculative-abstraction/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/no-speculative-abstraction/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/no-threshold-lowering/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/no-threshold-lowering/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/perf-budgets/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/perf-budgets/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/ratchet-touched-improves/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/ratchet-touched-improves/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/read-dedupe/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/read-dedupe/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/red-before-green/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/red-before-green/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/regression-test-for-fix/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/regression-test-for-fix/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/remediation-step-size/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/remediation-step-size/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/repo-hygiene/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/repo-hygiene/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/review-gate/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/review-gate/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/review-round-cap/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/review-round-cap/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/session-tool-call-limit/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/session-tool-call-limit/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/spec-trace/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/spec-trace/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/test-command-intact/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/test-command-intact/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/test-kinds-by-scenario/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/test-kinds-by-scenario/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/waivers-valid/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/waivers-valid/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/workflow-gates/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/workflow-gates/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/write-confinement/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/write-confinement/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/writes-within-plan/passing/basic/case.json +10 -0
- package/dist/builtin-packs/core/fixtures/writes-within-plan/violating/basic/case.json +10 -0
- package/dist/builtin-packs/core/index.ts +8 -0
- package/dist/builtin-packs/core/pack.json +2057 -0
- package/dist/builtin-packs/dotnet/index.ts +47 -0
- package/dist/builtin-packs/python/extract.ts +245 -0
- package/dist/builtin-packs/python/fixtures/lint/passing/basic/case.json +10 -0
- package/dist/builtin-packs/python/fixtures/lint/violating/basic/case.json +10 -0
- package/dist/builtin-packs/python/fixtures/no-phantom-import/passing/basic/case.json +12 -0
- package/dist/builtin-packs/python/fixtures/no-phantom-import/violating/basic/case.json +11 -0
- package/dist/builtin-packs/python/fixtures/security-patterns/passing/basic/case.json +10 -0
- package/dist/builtin-packs/python/fixtures/security-patterns/violating/basic/case.json +10 -0
- package/dist/builtin-packs/python/fixtures/typecheck/passing/basic/case.json +10 -0
- package/dist/builtin-packs/python/fixtures/typecheck/violating/basic/case.json +10 -0
- package/dist/builtin-packs/python/index.ts +57 -0
- package/dist/builtin-packs/python/pack.json +116 -0
- package/dist/builtin-packs/typescript/extract-clauses.ts +153 -0
- package/dist/builtin-packs/typescript/extract-literals.ts +111 -0
- package/dist/builtin-packs/typescript/extract-words.ts +79 -0
- package/dist/builtin-packs/typescript/extract.ts +77 -0
- package/dist/builtin-packs/typescript/fixtures/lint/passing/basic/case.json +10 -0
- package/dist/builtin-packs/typescript/fixtures/lint/violating/basic/case.json +10 -0
- package/dist/builtin-packs/typescript/fixtures/no-phantom-import/passing/basic/case.json +10 -0
- package/dist/builtin-packs/typescript/fixtures/no-phantom-import/passing/host-provided/case.json +10 -0
- package/dist/builtin-packs/typescript/fixtures/no-phantom-import/violating/basic/case.json +10 -0
- package/dist/builtin-packs/typescript/fixtures/no-phantom-import/violating/host-provided/case.json +10 -0
- package/dist/builtin-packs/typescript/fixtures/security-patterns/passing/basic/case.json +10 -0
- package/dist/builtin-packs/typescript/fixtures/security-patterns/violating/basic/case.json +10 -0
- package/dist/builtin-packs/typescript/fixtures/typecheck/passing/basic/case.json +10 -0
- package/dist/builtin-packs/typescript/fixtures/typecheck/violating/basic/case.json +10 -0
- package/dist/builtin-packs/typescript/index.ts +85 -0
- package/dist/builtin-packs/typescript/lex.ts +199 -0
- package/dist/builtin-packs/typescript/measures-exports.ts +173 -0
- package/dist/builtin-packs/typescript/measures-functions.ts +138 -0
- package/dist/builtin-packs/typescript/measures.ts +10 -0
- package/dist/builtin-packs/typescript/naming.ts +47 -0
- package/dist/builtin-packs/typescript/pack.json +169 -0
- package/dist/builtin-packs/typescript/patterns.ts +93 -0
- package/dist/builtin-packs/typescript/resolve.ts +224 -0
- package/dist/builtin-packs/typescript/strict.ts +177 -0
- package/dist/builtin-packs/typescript/titles.ts +184 -0
- package/dist/cli/baseline.d.ts +3 -0
- package/dist/cli/baseline.js +67 -0
- package/dist/cli/ci-bot-change.d.ts +3 -0
- package/dist/cli/ci-bot-change.js +54 -0
- package/dist/cli/ci-range.d.ts +18 -0
- package/dist/cli/ci-range.js +228 -0
- package/dist/cli/ci-summary.d.ts +3 -0
- package/dist/cli/ci-summary.js +45 -0
- package/dist/cli/ci.d.ts +4 -0
- package/dist/cli/ci.js +195 -0
- package/dist/cli/commands.d.ts +5 -0
- package/dist/cli/commands.js +39 -0
- package/dist/cli/deps.d.ts +3 -0
- package/dist/cli/deps.js +115 -0
- package/dist/cli/drift.d.ts +11 -0
- package/dist/cli/drift.js +91 -0
- package/dist/cli/evaluate.d.ts +20 -0
- package/dist/cli/evaluate.js +213 -0
- package/dist/cli/gate-scope.d.ts +10 -0
- package/dist/cli/gate-scope.js +82 -0
- package/dist/cli/git-hook.d.ts +3 -0
- package/dist/cli/git-hook.js +179 -0
- package/dist/cli/guardrail.d.ts +5 -0
- package/dist/cli/guardrail.js +190 -0
- package/dist/cli/index.d.ts +12 -0
- package/dist/cli/index.js +198 -0
- package/dist/cli/init-plan.d.ts +23 -0
- package/dist/cli/init-plan.js +135 -0
- package/dist/cli/init.d.ts +3 -0
- package/dist/cli/init.js +122 -0
- package/dist/cli/inspect-status.d.ts +8 -0
- package/dist/cli/inspect-status.js +164 -0
- package/dist/cli/inspect.d.ts +5 -0
- package/dist/cli/inspect.js +98 -0
- package/dist/cli/main.d.ts +2 -0
- package/dist/cli/main.js +60 -0
- package/dist/cli/pack-adapters.d.ts +3 -0
- package/dist/cli/pack-adapters.js +81 -0
- package/dist/cli/packs.d.ts +6 -0
- package/dist/cli/packs.js +131 -0
- package/dist/cli/plan-launcher.d.ts +1 -0
- package/dist/cli/plan-launcher.js +222 -0
- package/dist/cli/plan.d.ts +25 -0
- package/dist/cli/plan.js +121 -0
- package/dist/cli/proofs-test.d.ts +3 -0
- package/dist/cli/proofs-test.js +77 -0
- package/dist/cli/proofs.d.ts +3 -0
- package/dist/cli/proofs.js +168 -0
- package/dist/cli/remediation.d.ts +3 -0
- package/dist/cli/remediation.js +107 -0
- package/dist/cli/report.d.ts +4 -0
- package/dist/cli/report.js +93 -0
- package/dist/cli/serve-eval.d.ts +2 -0
- package/dist/cli/serve-eval.js +165 -0
- package/dist/cli/serve-log.d.ts +2 -0
- package/dist/cli/serve-log.js +150 -0
- package/dist/cli/serve-methods.d.ts +2 -0
- package/dist/cli/serve-methods.js +181 -0
- package/dist/cli/serve-protocol.d.ts +35 -0
- package/dist/cli/serve-protocol.js +97 -0
- package/dist/cli/serve-run.d.ts +9 -0
- package/dist/cli/serve-run.js +135 -0
- package/dist/cli/serve-server.d.ts +5 -0
- package/dist/cli/serve-server.js +120 -0
- package/dist/cli/serve-shared.d.ts +34 -0
- package/dist/cli/serve-shared.js +20 -0
- package/dist/cli/serve-status.d.ts +2 -0
- package/dist/cli/serve-status.js +130 -0
- package/dist/cli/serve-transport.d.ts +2 -0
- package/dist/cli/serve-transport.js +114 -0
- package/dist/cli/shared.d.ts +35 -0
- package/dist/cli/shared.js +181 -0
- package/dist/cli/task-advance.d.ts +3 -0
- package/dist/cli/task-advance.js +144 -0
- package/dist/cli/task-phases.d.ts +3 -0
- package/dist/cli/task-phases.js +77 -0
- package/dist/cli/tasks.d.ts +12 -0
- package/dist/cli/tasks.js +176 -0
- package/dist/cli/transparency.d.ts +4 -0
- package/dist/cli/transparency.js +197 -0
- package/dist/cli/waivers.d.ts +3 -0
- package/dist/cli/waivers.js +195 -0
- package/dist/features/adapters/claude-code.d.ts +8 -0
- package/dist/features/adapters/claude-code.js +198 -0
- package/dist/features/adapters/claude-shaped.d.ts +3 -0
- package/dist/features/adapters/claude-shaped.js +176 -0
- package/dist/features/adapters/codex-cli.d.ts +8 -0
- package/dist/features/adapters/codex-cli.js +180 -0
- package/dist/features/adapters/contract.d.ts +104 -0
- package/dist/features/adapters/contract.js +17 -0
- package/dist/features/adapters/copilot-capabilities.d.ts +2 -0
- package/dist/features/adapters/copilot-capabilities.js +46 -0
- package/dist/features/adapters/copilot.d.ts +8 -0
- package/dist/features/adapters/copilot.js +207 -0
- package/dist/features/adapters/cursor.d.ts +8 -0
- package/dist/features/adapters/cursor.js +245 -0
- package/dist/features/adapters/custom-event.d.ts +3 -0
- package/dist/features/adapters/custom-event.js +180 -0
- package/dist/features/adapters/custom-load.d.ts +3 -0
- package/dist/features/adapters/custom-load.js +185 -0
- package/dist/features/adapters/custom-shape.d.ts +21 -0
- package/dist/features/adapters/custom-shape.js +87 -0
- package/dist/features/adapters/custom.d.ts +9 -0
- package/dist/features/adapters/custom.js +130 -0
- package/dist/features/adapters/effective-cache.d.ts +5 -0
- package/dist/features/adapters/effective-cache.js +45 -0
- package/dist/features/adapters/gemini-cli.d.ts +6 -0
- package/dist/features/adapters/gemini-cli.js +160 -0
- package/dist/features/adapters/gemini-tables.d.ts +7 -0
- package/dist/features/adapters/gemini-tables.js +104 -0
- package/dist/features/adapters/hook-dispatch.d.ts +7 -0
- package/dist/features/adapters/hook-dispatch.js +97 -0
- package/dist/features/adapters/hook-injection.d.ts +12 -0
- package/dist/features/adapters/hook-injection.js +75 -0
- package/dist/features/adapters/hook-load.d.ts +15 -0
- package/dist/features/adapters/hook-load.js +152 -0
- package/dist/features/adapters/hook-scope.d.ts +3 -0
- package/dist/features/adapters/hook-scope.js +54 -0
- package/dist/features/adapters/index.d.ts +22 -0
- package/dist/features/adapters/index.js +86 -0
- package/dist/features/adapters/muse-code.d.ts +8 -0
- package/dist/features/adapters/muse-code.js +223 -0
- package/dist/features/adapters/opencode-bridge.d.ts +1 -0
- package/dist/features/adapters/opencode-bridge.js +230 -0
- package/dist/features/adapters/opencode-capabilities.d.ts +2 -0
- package/dist/features/adapters/opencode-capabilities.js +47 -0
- package/dist/features/adapters/opencode-parse.d.ts +3 -0
- package/dist/features/adapters/opencode-parse.js +137 -0
- package/dist/features/adapters/opencode-tables.d.ts +5 -0
- package/dist/features/adapters/opencode-tables.js +63 -0
- package/dist/features/adapters/opencode.d.ts +10 -0
- package/dist/features/adapters/opencode.js +97 -0
- package/dist/features/adapters/runtime.d.ts +25 -0
- package/dist/features/adapters/runtime.js +148 -0
- package/dist/features/adapters/universal.d.ts +7 -0
- package/dist/features/adapters/universal.js +89 -0
- package/dist/features/arch/arch-profiles.d.ts +3 -0
- package/dist/features/arch/arch-profiles.js +5 -0
- package/dist/features/arch/checks.d.ts +25 -0
- package/dist/features/arch/checks.js +173 -0
- package/dist/features/arch/codictator-modules.d.ts +4 -0
- package/dist/features/arch/codictator-modules.js +180 -0
- package/dist/features/arch/cycle-walk.d.ts +1 -0
- package/dist/features/arch/cycle-walk.js +36 -0
- package/dist/features/arch/edge-checks.d.ts +13 -0
- package/dist/features/arch/edge-checks.js +186 -0
- package/dist/features/arch/graph.d.ts +32 -0
- package/dist/features/arch/graph.js +202 -0
- package/dist/features/arch/index.d.ts +29 -0
- package/dist/features/arch/index.js +16 -0
- package/dist/features/arch/layer-rules.d.ts +3 -0
- package/dist/features/arch/layer-rules.js +38 -0
- package/dist/features/arch/module-map-validation.d.ts +3 -0
- package/dist/features/arch/module-map-validation.js +30 -0
- package/dist/features/arch/module-mapping.d.ts +15 -0
- package/dist/features/arch/module-mapping.js +184 -0
- package/dist/features/arch/profiles.d.ts +4 -0
- package/dist/features/arch/profiles.js +8 -0
- package/dist/features/audit/append.d.ts +26 -0
- package/dist/features/audit/append.js +205 -0
- package/dist/features/audit/explain-table-tail.d.ts +2 -0
- package/dist/features/audit/explain-table-tail.js +29 -0
- package/dist/features/audit/explain-table.d.ts +8 -0
- package/dist/features/audit/explain-table.js +48 -0
- package/dist/features/audit/explain.d.ts +7 -0
- package/dist/features/audit/explain.js +87 -0
- package/dist/features/audit/index.d.ts +37 -0
- package/dist/features/audit/index.js +17 -0
- package/dist/features/audit/injection-event.d.ts +11 -0
- package/dist/features/audit/injection-event.js +17 -0
- package/dist/features/audit/read.d.ts +8 -0
- package/dist/features/audit/read.js +62 -0
- package/dist/features/audit/summarize.d.ts +1 -0
- package/dist/features/audit/summarize.js +41 -0
- package/dist/features/audit/surfaces.d.ts +47 -0
- package/dist/features/audit/surfaces.js +165 -0
- package/dist/features/audit/token-saver-evidence.d.ts +14 -0
- package/dist/features/audit/token-saver-evidence.js +85 -0
- package/dist/features/ci/changes.d.ts +28 -0
- package/dist/features/ci/changes.js +88 -0
- package/dist/features/ci/index.d.ts +22 -0
- package/dist/features/ci/index.js +75 -0
- package/dist/features/ci/protection-read.d.ts +3 -0
- package/dist/features/ci/protection-read.js +264 -0
- package/dist/features/ci/protection.d.ts +25 -0
- package/dist/features/ci/protection.js +77 -0
- package/dist/features/ci/workflow.d.ts +23 -0
- package/dist/features/ci/workflow.js +261 -0
- package/dist/features/config/human.d.ts +4 -0
- package/dist/features/config/human.js +31 -0
- package/dist/features/config/index.d.ts +37 -0
- package/dist/features/config/index.js +129 -0
- package/dist/features/config/pack-data.d.ts +18 -0
- package/dist/features/config/pack-data.js +116 -0
- package/dist/features/config/validate-sections.d.ts +6 -0
- package/dist/features/config/validate-sections.js +198 -0
- package/dist/features/config/validate-shared.d.ts +8 -0
- package/dist/features/config/validate-shared.js +69 -0
- package/dist/features/config/validate-tunables.d.ts +1 -0
- package/dist/features/config/validate-tunables.js +89 -0
- package/dist/features/config/validate.d.ts +2 -0
- package/dist/features/config/validate.js +57 -0
- package/dist/features/deps/bots.d.ts +5 -0
- package/dist/features/deps/bots.js +39 -0
- package/dist/features/deps/capabilities.d.ts +3 -0
- package/dist/features/deps/capabilities.js +91 -0
- package/dist/features/deps/check.d.ts +18 -0
- package/dist/features/deps/check.js +70 -0
- package/dist/features/deps/dependabot.d.ts +10 -0
- package/dist/features/deps/dependabot.js +154 -0
- package/dist/features/deps/eval.d.ts +41 -0
- package/dist/features/deps/eval.js +24 -0
- package/dist/features/deps/fields.d.ts +4 -0
- package/dist/features/deps/fields.js +18 -0
- package/dist/features/deps/index.d.ts +67 -0
- package/dist/features/deps/index.js +27 -0
- package/dist/features/deps/lockfile.d.ts +8 -0
- package/dist/features/deps/lockfile.js +87 -0
- package/dist/features/deps/npm.d.ts +22 -0
- package/dist/features/deps/npm.js +172 -0
- package/dist/features/deps/npmrc.d.ts +12 -0
- package/dist/features/deps/npmrc.js +50 -0
- package/dist/features/deps/nuget.d.ts +25 -0
- package/dist/features/deps/nuget.js +112 -0
- package/dist/features/deps/osv-ranges.d.ts +12 -0
- package/dist/features/deps/osv-ranges.js +83 -0
- package/dist/features/deps/osv.d.ts +16 -0
- package/dist/features/deps/osv.js +144 -0
- package/dist/features/deps/pypi-pyproject.d.ts +7 -0
- package/dist/features/deps/pypi-pyproject.js +118 -0
- package/dist/features/deps/pypi.d.ts +29 -0
- package/dist/features/deps/pypi.js +137 -0
- package/dist/features/deps/registry.d.ts +29 -0
- package/dist/features/deps/registry.js +147 -0
- package/dist/features/deps/renovate.d.ts +15 -0
- package/dist/features/deps/renovate.js +98 -0
- package/dist/features/deps/selection.d.ts +20 -0
- package/dist/features/deps/selection.js +150 -0
- package/dist/features/deps/snapshot-verdicts.d.ts +16 -0
- package/dist/features/deps/snapshot-verdicts.js +184 -0
- package/dist/features/deps/stable.d.ts +19 -0
- package/dist/features/deps/stable.js +106 -0
- package/dist/features/deps/step-size.d.ts +7 -0
- package/dist/features/deps/step-size.js +24 -0
- package/dist/features/deps/upgrade.d.ts +35 -0
- package/dist/features/deps/upgrade.js +114 -0
- package/dist/features/deps/verdicts.d.ts +21 -0
- package/dist/features/deps/verdicts.js +219 -0
- package/dist/features/engine/evaluate.d.ts +12 -0
- package/dist/features/engine/evaluate.js +165 -0
- package/dist/features/engine/index.d.ts +21 -0
- package/dist/features/engine/index.js +24 -0
- package/dist/features/engine/message.d.ts +3 -0
- package/dist/features/engine/message.js +69 -0
- package/dist/features/engine/ratchet.d.ts +1 -0
- package/dist/features/engine/ratchet.js +63 -0
- package/dist/features/engine/run-enforcer.d.ts +4 -0
- package/dist/features/engine/run-enforcer.js +82 -0
- package/dist/features/engine/waivers.d.ts +23 -0
- package/dist/features/engine/waivers.js +169 -0
- package/dist/features/generator/draft.d.ts +7 -0
- package/dist/features/generator/draft.js +148 -0
- package/dist/features/generator/index.d.ts +22 -0
- package/dist/features/generator/index.js +8 -0
- package/dist/features/generator/llm-draft.d.ts +3 -0
- package/dist/features/generator/llm-draft.js +93 -0
- package/dist/features/generator/prompt.d.ts +25 -0
- package/dist/features/generator/prompt.js +105 -0
- package/dist/features/generator/self-test.d.ts +12 -0
- package/dist/features/generator/self-test.js +65 -0
- package/dist/features/generator/templates.d.ts +26 -0
- package/dist/features/generator/templates.js +177 -0
- package/dist/features/integrity/drift.d.ts +19 -0
- package/dist/features/integrity/drift.js +168 -0
- package/dist/features/integrity/hooks.d.ts +19 -0
- package/dist/features/integrity/hooks.js +54 -0
- package/dist/features/integrity/index.d.ts +10 -0
- package/dist/features/integrity/index.js +14 -0
- package/dist/features/integrity/manifest.d.ts +15 -0
- package/dist/features/integrity/manifest.js +26 -0
- package/dist/features/integrity/self-protection.d.ts +12 -0
- package/dist/features/integrity/self-protection.js +144 -0
- package/dist/features/llm/attempt.d.ts +17 -0
- package/dist/features/llm/attempt.js +99 -0
- package/dist/features/llm/errors.d.ts +5 -0
- package/dist/features/llm/errors.js +18 -0
- package/dist/features/llm/index.d.ts +23 -0
- package/dist/features/llm/index.js +46 -0
- package/dist/features/llm/presets.d.ts +25 -0
- package/dist/features/llm/presets.js +159 -0
- package/dist/features/llm/wire.d.ts +17 -0
- package/dist/features/llm/wire.js +163 -0
- package/dist/features/packs/accept.d.ts +7 -0
- package/dist/features/packs/accept.js +73 -0
- package/dist/features/packs/enforcers/arch-guards.d.ts +12 -0
- package/dist/features/packs/enforcers/arch-guards.js +193 -0
- package/dist/features/packs/enforcers/binding.d.ts +31 -0
- package/dist/features/packs/enforcers/binding.js +157 -0
- package/dist/features/packs/enforcers/ci-guards.d.ts +10 -0
- package/dist/features/packs/enforcers/ci-guards.js +128 -0
- package/dist/features/packs/enforcers/code-health.d.ts +9 -0
- package/dist/features/packs/enforcers/code-health.js +180 -0
- package/dist/features/packs/enforcers/code.d.ts +5 -0
- package/dist/features/packs/enforcers/code.js +128 -0
- package/dist/features/packs/enforcers/command-forbid.d.ts +8 -0
- package/dist/features/packs/enforcers/command-forbid.js +61 -0
- package/dist/features/packs/enforcers/deps-guards.d.ts +15 -0
- package/dist/features/packs/enforcers/deps-guards.js +235 -0
- package/dist/features/packs/enforcers/deps-policy-guards.d.ts +9 -0
- package/dist/features/packs/enforcers/deps-policy-guards.js +135 -0
- package/dist/features/packs/enforcers/docs-guards-measures.d.ts +9 -0
- package/dist/features/packs/enforcers/docs-guards-measures.js +117 -0
- package/dist/features/packs/enforcers/docs-guards.d.ts +11 -0
- package/dist/features/packs/enforcers/docs-guards.js +180 -0
- package/dist/features/packs/enforcers/external-attribute.d.ts +18 -0
- package/dist/features/packs/enforcers/external-attribute.js +122 -0
- package/dist/features/packs/enforcers/external-bind.d.ts +4 -0
- package/dist/features/packs/enforcers/external-bind.js +172 -0
- package/dist/features/packs/enforcers/external-check.d.ts +7 -0
- package/dist/features/packs/enforcers/external-check.js +131 -0
- package/dist/features/packs/enforcers/external-output.d.ts +30 -0
- package/dist/features/packs/enforcers/external-output.js +144 -0
- package/dist/features/packs/enforcers/external-probe.d.ts +4 -0
- package/dist/features/packs/enforcers/external-probe.js +65 -0
- package/dist/features/packs/enforcers/external-runs.d.ts +33 -0
- package/dist/features/packs/enforcers/external-runs.js +162 -0
- package/dist/features/packs/enforcers/external-sarif.d.ts +3 -0
- package/dist/features/packs/enforcers/external-sarif.js +103 -0
- package/dist/features/packs/enforcers/external.d.ts +39 -0
- package/dist/features/packs/enforcers/external.js +11 -0
- package/dist/features/packs/enforcers/gate-guards.d.ts +12 -0
- package/dist/features/packs/enforcers/gate-guards.js +170 -0
- package/dist/features/packs/enforcers/health-abstraction.d.ts +5 -0
- package/dist/features/packs/enforcers/health-abstraction.js +126 -0
- package/dist/features/packs/enforcers/health-duplication.d.ts +5 -0
- package/dist/features/packs/enforcers/health-duplication.js +197 -0
- package/dist/features/packs/enforcers/health-lex-imports.d.ts +5 -0
- package/dist/features/packs/enforcers/health-lex-imports.js +225 -0
- package/dist/features/packs/enforcers/health-lex-template.d.ts +10 -0
- package/dist/features/packs/enforcers/health-lex-template.js +67 -0
- package/dist/features/packs/enforcers/health-lex.d.ts +8 -0
- package/dist/features/packs/enforcers/health-lex.js +227 -0
- package/dist/features/packs/enforcers/health-markers.d.ts +3 -0
- package/dist/features/packs/enforcers/health-markers.js +31 -0
- package/dist/features/packs/enforcers/health-measures.d.ts +24 -0
- package/dist/features/packs/enforcers/health-measures.js +214 -0
- package/dist/features/packs/enforcers/health-refs.d.ts +6 -0
- package/dist/features/packs/enforcers/health-refs.js +61 -0
- package/dist/features/packs/enforcers/integrity-guards-repo.d.ts +6 -0
- package/dist/features/packs/enforcers/integrity-guards-repo.js +189 -0
- package/dist/features/packs/enforcers/integrity-guards.d.ts +12 -0
- package/dist/features/packs/enforcers/integrity-guards.js +202 -0
- package/dist/features/packs/enforcers/jsonkey.d.ts +13 -0
- package/dist/features/packs/enforcers/jsonkey.js +95 -0
- package/dist/features/packs/enforcers/parametric.d.ts +7 -0
- package/dist/features/packs/enforcers/parametric.js +138 -0
- package/dist/features/packs/enforcers/pattern.d.ts +11 -0
- package/dist/features/packs/enforcers/pattern.js +88 -0
- package/dist/features/packs/enforcers/placement.d.ts +10 -0
- package/dist/features/packs/enforcers/placement.js +54 -0
- package/dist/features/packs/enforcers/py-checks.d.ts +7 -0
- package/dist/features/packs/enforcers/py-checks.js +131 -0
- package/dist/features/packs/enforcers/py-lex.d.ts +10 -0
- package/dist/features/packs/enforcers/py-lex.js +271 -0
- package/dist/features/packs/enforcers/py-phantom.d.ts +6 -0
- package/dist/features/packs/enforcers/py-phantom.js +163 -0
- package/dist/features/packs/enforcers/py-pins.d.ts +16 -0
- package/dist/features/packs/enforcers/py-pins.js +184 -0
- package/dist/features/packs/enforcers/py-security-patterns.d.ts +18 -0
- package/dist/features/packs/enforcers/py-security-patterns.js +70 -0
- package/dist/features/packs/enforcers/records-guards.d.ts +12 -0
- package/dist/features/packs/enforcers/records-guards.js +178 -0
- package/dist/features/packs/enforcers/remediation-guards.d.ts +6 -0
- package/dist/features/packs/enforcers/remediation-guards.js +42 -0
- package/dist/features/packs/enforcers/required.d.ts +10 -0
- package/dist/features/packs/enforcers/required.js +65 -0
- package/dist/features/packs/enforcers/secret-scan.d.ts +22 -0
- package/dist/features/packs/enforcers/secret-scan.js +179 -0
- package/dist/features/packs/enforcers/shell-analyse.d.ts +14 -0
- package/dist/features/packs/enforcers/shell-analyse.js +105 -0
- package/dist/features/packs/enforcers/sizes.d.ts +10 -0
- package/dist/features/packs/enforcers/sizes.js +82 -0
- package/dist/features/packs/enforcers/steering-guards.d.ts +11 -0
- package/dist/features/packs/enforcers/steering-guards.js +162 -0
- package/dist/features/packs/enforcers/testing-guards.d.ts +10 -0
- package/dist/features/packs/enforcers/testing-guards.js +118 -0
- package/dist/features/packs/enforcers/ts-checks.d.ts +7 -0
- package/dist/features/packs/enforcers/ts-checks.js +101 -0
- package/dist/features/packs/enforcers/ts-phantom-host.d.ts +11 -0
- package/dist/features/packs/enforcers/ts-phantom-host.js +155 -0
- package/dist/features/packs/enforcers/ts-phantom.d.ts +6 -0
- package/dist/features/packs/enforcers/ts-phantom.js +117 -0
- package/dist/features/packs/enforcers/ts-security-patterns.d.ts +18 -0
- package/dist/features/packs/enforcers/ts-security-patterns.js +93 -0
- package/dist/features/packs/enforcers/workflow-guards.d.ts +10 -0
- package/dist/features/packs/enforcers/workflow-guards.js +117 -0
- package/dist/features/packs/enforcers/write-confine.d.ts +13 -0
- package/dist/features/packs/enforcers/write-confine.js +131 -0
- package/dist/features/packs/hashes.d.ts +6 -0
- package/dist/features/packs/hashes.js +84 -0
- package/dist/features/packs/index.d.ts +22 -0
- package/dist/features/packs/index.js +15 -0
- package/dist/features/packs/loader.d.ts +13 -0
- package/dist/features/packs/loader.js +205 -0
- package/dist/features/packs/manifest.d.ts +17 -0
- package/dist/features/packs/manifest.js +180 -0
- package/dist/features/packs/params.d.ts +2 -0
- package/dist/features/packs/params.js +90 -0
- package/dist/features/packs/registry.d.ts +11 -0
- package/dist/features/packs/registry.js +136 -0
- package/dist/features/packs/selftest.d.ts +3 -0
- package/dist/features/packs/selftest.js +127 -0
- package/dist/features/records/bug-grammar.d.ts +17 -0
- package/dist/features/records/bug-grammar.js +128 -0
- package/dist/features/records/bug-registry.d.ts +9 -0
- package/dist/features/records/bug-registry.js +67 -0
- package/dist/features/records/bug-rows-immutable.d.ts +3 -0
- package/dist/features/records/bug-rows-immutable.js +52 -0
- package/dist/features/records/bugs.d.ts +2 -0
- package/dist/features/records/bugs.js +24 -0
- package/dist/features/records/docs-lines.d.ts +16 -0
- package/dist/features/records/docs-lines.js +36 -0
- package/dist/features/records/docs-prose.d.ts +14 -0
- package/dist/features/records/docs-prose.js +252 -0
- package/dist/features/records/docs-structure.d.ts +17 -0
- package/dist/features/records/docs-structure.js +223 -0
- package/dist/features/records/docs.d.ts +9 -0
- package/dist/features/records/docs.js +238 -0
- package/dist/features/records/history-checks.d.ts +6 -0
- package/dist/features/records/history-checks.js +94 -0
- package/dist/features/records/history-parse.d.ts +16 -0
- package/dist/features/records/history-parse.js +101 -0
- package/dist/features/records/history-scope.d.ts +5 -0
- package/dist/features/records/history-scope.js +86 -0
- package/dist/features/records/history.d.ts +3 -0
- package/dist/features/records/history.js +5 -0
- package/dist/features/records/index.d.ts +8 -0
- package/dist/features/records/index.js +11 -0
- package/dist/features/remediation/adoption.d.ts +32 -0
- package/dist/features/remediation/adoption.js +131 -0
- package/dist/features/remediation/index.d.ts +12 -0
- package/dist/features/remediation/index.js +21 -0
- package/dist/features/remediation/plan-chains.d.ts +3 -0
- package/dist/features/remediation/plan-chains.js +111 -0
- package/dist/features/remediation/plan-generate.d.ts +3 -0
- package/dist/features/remediation/plan-generate.js +129 -0
- package/dist/features/remediation/plan-kinds.d.ts +32 -0
- package/dist/features/remediation/plan-kinds.js +42 -0
- package/dist/features/remediation/plan-markers.d.ts +2 -0
- package/dist/features/remediation/plan-markers.js +155 -0
- package/dist/features/remediation/plan-merge.d.ts +6 -0
- package/dist/features/remediation/plan-merge.js +33 -0
- package/dist/features/remediation/plan.d.ts +4 -0
- package/dist/features/remediation/plan.js +7 -0
- package/dist/features/remediation/step-floor.d.ts +5 -0
- package/dist/features/remediation/step-floor.js +76 -0
- package/dist/features/remediation/step-gates.d.ts +18 -0
- package/dist/features/remediation/step-gates.js +77 -0
- package/dist/features/remediation/step-split.d.ts +12 -0
- package/dist/features/remediation/step-split.js +75 -0
- package/dist/features/remediation/steps.d.ts +3 -0
- package/dist/features/remediation/steps.js +6 -0
- package/dist/features/remediation/types.d.ts +37 -0
- package/dist/features/remediation/types.js +1 -0
- package/dist/features/security/index.d.ts +12 -0
- package/dist/features/security/index.js +142 -0
- package/dist/features/steering/agent-assets.d.ts +7 -0
- package/dist/features/steering/agent-assets.js +75 -0
- package/dist/features/steering/budgets.d.ts +20 -0
- package/dist/features/steering/budgets.js +86 -0
- package/dist/features/steering/checks.d.ts +7 -0
- package/dist/features/steering/checks.js +67 -0
- package/dist/features/steering/context-file.d.ts +11 -0
- package/dist/features/steering/context-file.js +107 -0
- package/dist/features/steering/graph-scan.d.ts +7 -0
- package/dist/features/steering/graph-scan.js +17 -0
- package/dist/features/steering/index.d.ts +30 -0
- package/dist/features/steering/index.js +45 -0
- package/dist/features/steering/injection.d.ts +23 -0
- package/dist/features/steering/injection.js +124 -0
- package/dist/features/steering/mcp.d.ts +2 -0
- package/dist/features/steering/mcp.js +18 -0
- package/dist/features/steering/precedence.d.ts +10 -0
- package/dist/features/steering/precedence.js +28 -0
- package/dist/features/steering/read-cache.d.ts +13 -0
- package/dist/features/steering/read-cache.js +51 -0
- package/dist/features/testing/base.d.ts +1 -0
- package/dist/features/testing/base.js +8 -0
- package/dist/features/testing/covers.d.ts +8 -0
- package/dist/features/testing/covers.js +50 -0
- package/dist/features/testing/evaluate.d.ts +19 -0
- package/dist/features/testing/evaluate.js +47 -0
- package/dist/features/testing/index.d.ts +10 -0
- package/dist/features/testing/index.js +13 -0
- package/dist/features/testing/integrity.d.ts +28 -0
- package/dist/features/testing/integrity.js +140 -0
- package/dist/features/testing/ledger.d.ts +11 -0
- package/dist/features/testing/ledger.js +51 -0
- package/dist/features/testing/proofs.d.ts +26 -0
- package/dist/features/testing/proofs.js +88 -0
- package/dist/features/testing/report.d.ts +6 -0
- package/dist/features/testing/report.js +16 -0
- package/dist/features/testing/scenarios.d.ts +34 -0
- package/dist/features/testing/scenarios.js +90 -0
- package/dist/features/testing/tap-parser.d.ts +9 -0
- package/dist/features/testing/tap-parser.js +84 -0
- package/dist/features/testing/trace.d.ts +23 -0
- package/dist/features/testing/trace.js +110 -0
- package/dist/features/workflow/index.d.ts +14 -0
- package/dist/features/workflow/index.js +19 -0
- package/dist/features/workflow/loop.d.ts +5 -0
- package/dist/features/workflow/loop.js +36 -0
- package/dist/features/workflow/phases.d.ts +10 -0
- package/dist/features/workflow/phases.js +181 -0
- package/dist/features/workflow/review.d.ts +25 -0
- package/dist/features/workflow/review.js +112 -0
- package/dist/features/workflow/tasks.d.ts +73 -0
- package/dist/features/workflow/tasks.js +80 -0
- package/dist/features/workflow/writes.d.ts +8 -0
- package/dist/features/workflow/writes.js +96 -0
- package/dist/kernel/clock.d.ts +4 -0
- package/dist/kernel/clock.js +5 -0
- package/dist/kernel/config-keys.d.ts +2 -0
- package/dist/kernel/config-keys.js +5 -0
- package/dist/kernel/config-toml-keys.d.ts +2 -0
- package/dist/kernel/config-toml-keys.js +237 -0
- package/dist/kernel/config-yaml-keys.d.ts +2 -0
- package/dist/kernel/config-yaml-keys.js +177 -0
- package/dist/kernel/contracts.d.ts +76 -0
- package/dist/kernel/contracts.js +9 -0
- package/dist/kernel/entry.d.ts +1 -0
- package/dist/kernel/entry.js +31 -0
- package/dist/kernel/env.d.ts +4 -0
- package/dist/kernel/env.js +5 -0
- package/dist/kernel/errors.d.ts +7 -0
- package/dist/kernel/errors.js +6 -0
- package/dist/kernel/fs-confine.d.ts +14 -0
- package/dist/kernel/fs-confine.js +129 -0
- package/dist/kernel/fs-errors.d.ts +8 -0
- package/dist/kernel/fs-errors.js +37 -0
- package/dist/kernel/fs.d.ts +28 -0
- package/dist/kernel/fs.js +245 -0
- package/dist/kernel/git.d.ts +16 -0
- package/dist/kernel/git.js +125 -0
- package/dist/kernel/glob.d.ts +1 -0
- package/dist/kernel/glob.js +178 -0
- package/dist/kernel/hash.d.ts +3 -0
- package/dist/kernel/hash.js +12 -0
- package/dist/kernel/host.d.ts +3 -0
- package/dist/kernel/host.js +48 -0
- package/dist/kernel/index.d.ts +115 -0
- package/dist/kernel/index.js +33 -0
- package/dist/kernel/json.d.ts +4 -0
- package/dist/kernel/json.js +68 -0
- package/dist/kernel/net-allow.d.ts +8 -0
- package/dist/kernel/net-allow.js +45 -0
- package/dist/kernel/net-fetch.d.ts +5 -0
- package/dist/kernel/net-fetch.js +135 -0
- package/dist/kernel/net.d.ts +10 -0
- package/dist/kernel/net.js +24 -0
- package/dist/kernel/path.d.ts +3 -0
- package/dist/kernel/path.js +40 -0
- package/dist/kernel/pattern.d.ts +2 -0
- package/dist/kernel/pattern.js +116 -0
- package/dist/kernel/proc.d.ts +6 -0
- package/dist/kernel/proc.js +207 -0
- package/dist/kernel/read-cache.d.ts +6 -0
- package/dist/kernel/read-cache.js +27 -0
- package/dist/kernel/redact.d.ts +1 -0
- package/dist/kernel/redact.js +206 -0
- package/dist/kernel/repo-root.d.ts +3 -0
- package/dist/kernel/repo-root.js +29 -0
- package/dist/kernel/result.d.ts +10 -0
- package/dist/kernel/result.js +6 -0
- package/dist/kernel/schema-helpers.d.ts +11 -0
- package/dist/kernel/schema-helpers.js +101 -0
- package/dist/kernel/schema.d.ts +2 -0
- package/dist/kernel/schema.js +203 -0
- package/dist/kernel/secret-paths.d.ts +3 -0
- package/dist/kernel/secret-paths.js +56 -0
- package/dist/kernel/shell-bypass.d.ts +4 -0
- package/dist/kernel/shell-bypass.js +151 -0
- package/dist/kernel/shell-cmd.d.ts +6 -0
- package/dist/kernel/shell-cmd.js +196 -0
- package/dist/kernel/shell-deny-cmd.d.ts +7 -0
- package/dist/kernel/shell-deny-cmd.js +35 -0
- package/dist/kernel/shell-deny-destroy.d.ts +7 -0
- package/dist/kernel/shell-deny-destroy.js +71 -0
- package/dist/kernel/shell-deny-escalate.d.ts +7 -0
- package/dist/kernel/shell-deny-escalate.js +96 -0
- package/dist/kernel/shell-deny-target.d.ts +4 -0
- package/dist/kernel/shell-deny-target.js +51 -0
- package/dist/kernel/shell-deny.d.ts +8 -0
- package/dist/kernel/shell-deny.js +171 -0
- package/dist/kernel/shell-scan.d.ts +3 -0
- package/dist/kernel/shell-scan.js +226 -0
- package/dist/kernel/shell-word.d.ts +15 -0
- package/dist/kernel/shell-word.js +216 -0
- package/dist/kernel/shell.d.ts +22 -0
- package/dist/kernel/shell.js +2 -0
- package/dist/kernel/stdin.d.ts +2 -0
- package/dist/kernel/stdin.js +59 -0
- package/dist/kernel/test-report.d.ts +7 -0
- package/dist/kernel/test-report.js +112 -0
- package/dist/kernel/version.d.ts +2 -0
- package/dist/kernel/version.js +46 -0
- package/dist/tsconfig.build.tsbuildinfo +1 -0
- package/package.json +19 -11
- package/schema/accepted.schema.json +20 -0
- package/schema/baseline.schema.json +17 -0
- package/schema/capability.schema.json +31 -0
- package/schema/cli/error.schema.json +15 -0
- package/schema/cli/explain.schema.json +19 -0
- package/schema/cli/report.schema.json +15 -0
- package/schema/cli/status.schema.json +51 -0
- package/schema/cli/verify.schema.json +15 -0
- package/schema/config.schema.json +43 -0
- package/schema/event-log.schema.json +52 -0
- package/schema/hook-decision.schema.json +13 -0
- package/schema/hook-event.schema.json +50 -0
- package/schema/manifest.schema.json +26 -0
- package/schema/pack-draft.schema.json +42 -0
- package/schema/pack.schema.json +70 -0
- package/schema/registry-snapshot.schema.json +41 -0
- package/schema/remediation-plan.schema.json +44 -0
- package/schema/review-findings.schema.json +25 -0
- package/schema/task-record.schema.json +49 -0
- package/schema/waivers.schema.json +29 -0
|
@@ -0,0 +1,180 @@
|
|
|
1
|
+
// SPEC §4.4.3 steps 2–4: manifest checks with the codes §8 owns. Reads the
|
|
2
|
+
// fields the checks need; the kernel schema check owns the full format.
|
|
3
|
+
import { err, makeError, ok } from "../../kernel/index.js";
|
|
4
|
+
// SPEC §4.4.2: built-in pack ids; a custom pack must not equal one (§4.4.3).
|
|
5
|
+
const BUILTIN_IDS = [
|
|
6
|
+
"core",
|
|
7
|
+
"typescript",
|
|
8
|
+
"dotnet",
|
|
9
|
+
"python",
|
|
10
|
+
];
|
|
11
|
+
export function isBuiltinPackId(id) {
|
|
12
|
+
return BUILTIN_IDS.includes(id);
|
|
13
|
+
}
|
|
14
|
+
// SPEC §4.4.6 plus code: every kind accepted in an enforcer declaration.
|
|
15
|
+
// Parametric kinds resolve deferred until step 5.4 wires them.
|
|
16
|
+
const KNOWN_ENFORCER_KINDS = [
|
|
17
|
+
"code",
|
|
18
|
+
"pattern-forbid",
|
|
19
|
+
"pattern-require",
|
|
20
|
+
"path-placement",
|
|
21
|
+
"file-size",
|
|
22
|
+
"file-required",
|
|
23
|
+
"import-forbid",
|
|
24
|
+
"command-forbid",
|
|
25
|
+
"json-key",
|
|
26
|
+
"external",
|
|
27
|
+
];
|
|
28
|
+
// SPEC §4.4.6: the budget a declaration carries when it names none. The
|
|
29
|
+
// self-test runs every fixture inside twice this budget (CDX-E215).
|
|
30
|
+
const DEFAULT_BUDGET_MS = 1000;
|
|
31
|
+
export function isRecord(value) {
|
|
32
|
+
return typeof value === "object" && value !== null && !Array.isArray(value);
|
|
33
|
+
}
|
|
34
|
+
// Bracket access through a variable keeps noPropertyAccessFromIndexSignature
|
|
35
|
+
// satisfied without tripping useLiteralKeys (kernel narrows the same way).
|
|
36
|
+
export function field(record, name) {
|
|
37
|
+
return record[name];
|
|
38
|
+
}
|
|
39
|
+
function declError(id, detail, fix) {
|
|
40
|
+
return err(makeError("CDX-E205", `pack enforcer "${id}" ${detail}`, `${fix}`));
|
|
41
|
+
}
|
|
42
|
+
// SPEC §4.4.3 step 4: the declaration must name a known kind and carry a
|
|
43
|
+
// usable id; anything else is unresolvable (CDX-E205). External bindings
|
|
44
|
+
// are shape-checked here, fully interpreted by step 5.5.
|
|
45
|
+
export function narrowEnforcerDecl(entry) {
|
|
46
|
+
if (!isRecord(entry)) {
|
|
47
|
+
return declError("unknown", "must be a JSON object", "Give the enforcer an id and a §4.4.6 kind, then reload the pack.");
|
|
48
|
+
}
|
|
49
|
+
const id = field(entry, "id");
|
|
50
|
+
const kind = field(entry, "kind");
|
|
51
|
+
if (typeof id !== "string" || id.length === 0) {
|
|
52
|
+
return declError("unknown", "needs a non-empty string id", "Give the enforcer an id matching the rule that names it, then reload.");
|
|
53
|
+
}
|
|
54
|
+
if (typeof kind !== "string" || !KNOWN_ENFORCER_KINDS.includes(kind)) {
|
|
55
|
+
return declError(id, "names an unknown kind", "Use a §4.4.6 kind or code, then reload the pack.");
|
|
56
|
+
}
|
|
57
|
+
const moduleValue = field(entry, "module");
|
|
58
|
+
if (moduleValue !== undefined && typeof moduleValue !== "string") {
|
|
59
|
+
return declError(id, "carries a non-string module", "Name the owning module as a string, then reload the pack.");
|
|
60
|
+
}
|
|
61
|
+
const budgetValue = field(entry, "budgetMs");
|
|
62
|
+
if (budgetValue !== undefined &&
|
|
63
|
+
(typeof budgetValue !== "number" ||
|
|
64
|
+
!Number.isInteger(budgetValue) ||
|
|
65
|
+
budgetValue <= 0)) {
|
|
66
|
+
return declError(id, "carries a budgetMs that is not a positive integer", "Give the enforcer a positive integer budgetMs, then reload the pack.");
|
|
67
|
+
}
|
|
68
|
+
const moduleDecl = typeof moduleValue === "string" ? { module: moduleValue } : {};
|
|
69
|
+
// SPEC §7.3: args ride along opaquely; the owning enforcer module
|
|
70
|
+
// narrows them (parametric kinds in step 5.4, external in step 5.5).
|
|
71
|
+
const argsDecl = "args" in entry ? { args: field(entry, "args") } : {};
|
|
72
|
+
if (kind !== "external") {
|
|
73
|
+
return ok({
|
|
74
|
+
id,
|
|
75
|
+
kind,
|
|
76
|
+
...moduleDecl,
|
|
77
|
+
...argsDecl,
|
|
78
|
+
budgetMs: typeof budgetValue === "number" ? budgetValue : DEFAULT_BUDGET_MS,
|
|
79
|
+
});
|
|
80
|
+
}
|
|
81
|
+
const tool = field(entry, "tool");
|
|
82
|
+
const ruleMap = field(entry, "ruleMap");
|
|
83
|
+
if (typeof tool !== "string" || tool.length === 0 || !isRecord(ruleMap)) {
|
|
84
|
+
return declError(id, "needs a tool id and a ruleMap object", "Bind the enforcer to a config.tools id with a ruleMap, then reload.");
|
|
85
|
+
}
|
|
86
|
+
const mapped = {};
|
|
87
|
+
for (const key of Object.keys(ruleMap)) {
|
|
88
|
+
const target = ruleMap[key];
|
|
89
|
+
if (typeof target !== "string" || target.length === 0) {
|
|
90
|
+
return declError(id, "carries a ruleMap value that is not a rule id", "Map every tool rule id to a rule id of the same pack, then reload.");
|
|
91
|
+
}
|
|
92
|
+
mapped[key] = target;
|
|
93
|
+
}
|
|
94
|
+
return ok({
|
|
95
|
+
id,
|
|
96
|
+
kind,
|
|
97
|
+
...moduleDecl,
|
|
98
|
+
...argsDecl,
|
|
99
|
+
budgetMs: typeof budgetValue === "number" ? budgetValue : DEFAULT_BUDGET_MS,
|
|
100
|
+
tool,
|
|
101
|
+
ruleMap: mapped,
|
|
102
|
+
});
|
|
103
|
+
}
|
|
104
|
+
function manifestError(detail) {
|
|
105
|
+
return err(makeError("CDX-E203", `pack manifest is invalid: ${detail}`, "Fix the pack.json so it matches schema/pack.schema.json, then reload the pack."));
|
|
106
|
+
}
|
|
107
|
+
// The kernel schema check owns the format; this narrows unknown to the
|
|
108
|
+
// manifest shape the checks below read (config narrows the same way).
|
|
109
|
+
export function narrowManifest(value) {
|
|
110
|
+
if (!isRecord(value)) {
|
|
111
|
+
return manifestError("the manifest must be a JSON object");
|
|
112
|
+
}
|
|
113
|
+
const id = field(value, "id");
|
|
114
|
+
if (typeof id !== "string" || id.length === 0) {
|
|
115
|
+
return manifestError('the manifest needs a non-empty string "id"');
|
|
116
|
+
}
|
|
117
|
+
const rules = field(value, "rules");
|
|
118
|
+
if (!Array.isArray(rules)) {
|
|
119
|
+
return manifestError('the manifest needs a "rules" array');
|
|
120
|
+
}
|
|
121
|
+
for (const rule of rules) {
|
|
122
|
+
if (!isRecord(rule)) {
|
|
123
|
+
return manifestError("every rule must be a JSON object");
|
|
124
|
+
}
|
|
125
|
+
if (typeof field(rule, "id") !== "string" ||
|
|
126
|
+
typeof field(rule, "enforcer") !== "string") {
|
|
127
|
+
return manifestError('every rule needs string "id" and "enforcer"');
|
|
128
|
+
}
|
|
129
|
+
}
|
|
130
|
+
const enforcers = field(value, "enforcers");
|
|
131
|
+
if (!Array.isArray(enforcers)) {
|
|
132
|
+
return manifestError('the manifest needs an "enforcers" array');
|
|
133
|
+
}
|
|
134
|
+
// Every field above is verified, and the kernel schema check verified
|
|
135
|
+
// the rest, so the unknown-to-manifest narrowing is exact.
|
|
136
|
+
return ok(value);
|
|
137
|
+
}
|
|
138
|
+
// SPEC §4.4.3 steps 2–4 plus the §4.4.5 ruleMap boundary (CDX-E210).
|
|
139
|
+
export function checkPack(manifest, builtin) {
|
|
140
|
+
const seen = new Set();
|
|
141
|
+
for (const rule of manifest.rules) {
|
|
142
|
+
if (seen.has(rule.id)) {
|
|
143
|
+
return err(makeError("CDX-E202", `duplicate rule id "${rule.id}" in pack "${manifest.id}"`, "Give every rule a globally unique id, then reload the pack."));
|
|
144
|
+
}
|
|
145
|
+
seen.add(rule.id);
|
|
146
|
+
}
|
|
147
|
+
if (!builtin) {
|
|
148
|
+
if (BUILTIN_IDS.includes(manifest.id)) {
|
|
149
|
+
return err(makeError("CDX-E204", `custom pack id "${manifest.id}" collides with a built-in pack id`, "Rename the pack id so it is not core, typescript, dotnet or python, then reload."));
|
|
150
|
+
}
|
|
151
|
+
for (const rule of manifest.rules) {
|
|
152
|
+
if (!rule.id.startsWith(`${manifest.id}/`)) {
|
|
153
|
+
return err(makeError("CDX-E204", `custom pack "${manifest.id}" rule id "${rule.id}" must start with "${manifest.id}/"`, "Rename the rule id under the pack namespace, then reload."));
|
|
154
|
+
}
|
|
155
|
+
}
|
|
156
|
+
}
|
|
157
|
+
const declared = new Map();
|
|
158
|
+
for (const entry of manifest.enforcers) {
|
|
159
|
+
const narrowed = narrowEnforcerDecl(entry);
|
|
160
|
+
if (!narrowed.ok) {
|
|
161
|
+
return err(narrowed.error);
|
|
162
|
+
}
|
|
163
|
+
declared.set(narrowed.value.id, narrowed.value);
|
|
164
|
+
}
|
|
165
|
+
for (const rule of manifest.rules) {
|
|
166
|
+
if (!declared.has(rule.enforcer)) {
|
|
167
|
+
return err(makeError("CDX-E205", `rule "${rule.id}" names unknown enforcer "${rule.enforcer}"`, "Declare the enforcer in the pack or use a built-in parametric enforcer (§4.4.6), then reload."));
|
|
168
|
+
}
|
|
169
|
+
}
|
|
170
|
+
for (const decl of declared.values()) {
|
|
171
|
+
if (decl.kind === "external" && decl.ruleMap !== undefined) {
|
|
172
|
+
for (const target of Object.values(decl.ruleMap)) {
|
|
173
|
+
if (!seen.has(target)) {
|
|
174
|
+
return err(makeError("CDX-E210", `external enforcer "${decl.id}" maps to "${target}" outside pack "${manifest.id}"`, "Map the tool rule to a rule id of the same pack, then reload."));
|
|
175
|
+
}
|
|
176
|
+
}
|
|
177
|
+
}
|
|
178
|
+
}
|
|
179
|
+
return ok(undefined);
|
|
180
|
+
}
|
|
@@ -0,0 +1,90 @@
|
|
|
1
|
+
// SPEC §4.4.4: tunable params carry default within bound along a stricter
|
|
2
|
+
// direction. The loader stores params opaquely, so malformed entries fail
|
|
3
|
+
// here (CDX-E216), not at load.
|
|
4
|
+
import { err, makeError, ok } from "../../kernel/index.js";
|
|
5
|
+
import { field, isRecord } from "./manifest.js";
|
|
6
|
+
function paramError(ruleId, name, detail) {
|
|
7
|
+
return err(makeError("CDX-E216", `rule "${ruleId}" param "${name}" ${detail}`, "Keep every tunable default within its bound along the stricter direction, then re-run the self-test."));
|
|
8
|
+
}
|
|
9
|
+
function isFiniteNumber(value) {
|
|
10
|
+
return typeof value === "number" && Number.isFinite(value);
|
|
11
|
+
}
|
|
12
|
+
function checkNumeric(ruleId, name, integer, def, bound, stricter, rest) {
|
|
13
|
+
const defOk = integer ? Number.isInteger(def) : isFiniteNumber(def);
|
|
14
|
+
const boundOk = integer ? Number.isInteger(bound) : isFiniteNumber(bound);
|
|
15
|
+
if (!defOk || !boundOk) {
|
|
16
|
+
return paramError(ruleId, name, `needs numeric default and bound, got ${typeof def} and ${typeof bound}`);
|
|
17
|
+
}
|
|
18
|
+
const defValue = def;
|
|
19
|
+
const boundValue = bound;
|
|
20
|
+
for (const edge of ["min", "max"]) {
|
|
21
|
+
const limit = field(rest, edge);
|
|
22
|
+
const limitOk = limit === undefined ||
|
|
23
|
+
(integer ? Number.isInteger(limit) : isFiniteNumber(limit));
|
|
24
|
+
if (!limitOk) {
|
|
25
|
+
return paramError(ruleId, name, `carries a non-numeric ${edge}`);
|
|
26
|
+
}
|
|
27
|
+
}
|
|
28
|
+
const min = field(rest, "min");
|
|
29
|
+
const max = field(rest, "max");
|
|
30
|
+
if (typeof min === "number" && defValue < min) {
|
|
31
|
+
return paramError(ruleId, name, "sets a default below min");
|
|
32
|
+
}
|
|
33
|
+
if (typeof max === "number" && defValue > max) {
|
|
34
|
+
return paramError(ruleId, name, "sets a default above max");
|
|
35
|
+
}
|
|
36
|
+
if (stricter === "lower" && defValue > boundValue) {
|
|
37
|
+
return paramError(ruleId, name, "sets a default looser than bound");
|
|
38
|
+
}
|
|
39
|
+
if (stricter === "higher" && defValue < boundValue) {
|
|
40
|
+
return paramError(ruleId, name, "sets a default looser than bound");
|
|
41
|
+
}
|
|
42
|
+
return ok(undefined);
|
|
43
|
+
}
|
|
44
|
+
function checkStringList(ruleId, name, def, bound, stricter) {
|
|
45
|
+
if (!Array.isArray(def) || !def.every((entry) => typeof entry === "string")) {
|
|
46
|
+
return paramError(ruleId, name, "needs a string[] default");
|
|
47
|
+
}
|
|
48
|
+
if (!Array.isArray(bound) ||
|
|
49
|
+
!bound.every((entry) => typeof entry === "string")) {
|
|
50
|
+
return paramError(ruleId, name, "needs a string[] bound");
|
|
51
|
+
}
|
|
52
|
+
if (stricter === "subset") {
|
|
53
|
+
for (const entry of def) {
|
|
54
|
+
if (!bound.includes(entry)) {
|
|
55
|
+
return paramError(ruleId, name, `sets a default ${entry} outside bound`);
|
|
56
|
+
}
|
|
57
|
+
}
|
|
58
|
+
}
|
|
59
|
+
if (stricter === "superset") {
|
|
60
|
+
for (const entry of bound) {
|
|
61
|
+
if (!def.includes(entry)) {
|
|
62
|
+
return paramError(ruleId, name, `sets a bound ${entry} outside default`);
|
|
63
|
+
}
|
|
64
|
+
}
|
|
65
|
+
}
|
|
66
|
+
return ok(undefined);
|
|
67
|
+
}
|
|
68
|
+
// SPEC §4.4.4: every tunable param has default within bound and a stricter
|
|
69
|
+
// direction.
|
|
70
|
+
export function checkParam(ruleId, name, value) {
|
|
71
|
+
if (!isRecord(value)) {
|
|
72
|
+
return paramError(ruleId, name, "must be a param object");
|
|
73
|
+
}
|
|
74
|
+
const type = field(value, "type");
|
|
75
|
+
if (type !== "integer" && type !== "number" && type !== "string[]") {
|
|
76
|
+
return paramError(ruleId, name, "needs a type of integer, number or string[]");
|
|
77
|
+
}
|
|
78
|
+
const stricter = field(value, "stricter");
|
|
79
|
+
if (stricter !== "lower" &&
|
|
80
|
+
stricter !== "higher" &&
|
|
81
|
+
stricter !== "subset" &&
|
|
82
|
+
stricter !== "superset" &&
|
|
83
|
+
stricter !== "policy") {
|
|
84
|
+
return paramError(ruleId, name, "needs a stricter direction");
|
|
85
|
+
}
|
|
86
|
+
if (type === "string[]") {
|
|
87
|
+
return checkStringList(ruleId, name, field(value, "default"), field(value, "bound"), stricter);
|
|
88
|
+
}
|
|
89
|
+
return checkNumeric(ruleId, name, type === "integer", field(value, "default"), field(value, "bound"), stricter, value);
|
|
90
|
+
}
|
|
@@ -0,0 +1,11 @@
|
|
|
1
|
+
import type { Ports, Result } from "../../kernel/index.ts";
|
|
2
|
+
import type { Enforcer } from "../engine/index.ts";
|
|
3
|
+
import type { ExternalOptions, ToolDecl } from "./enforcers/external.ts";
|
|
4
|
+
import type { PackManifest } from "./index.ts";
|
|
5
|
+
import { type EnforcerDecl } from "./manifest.ts";
|
|
6
|
+
export interface RegistryOptions {
|
|
7
|
+
readonly onToolEvent?: ExternalOptions["onToolEvent"];
|
|
8
|
+
}
|
|
9
|
+
export declare function livePorts(root: string): Promise<Result<Ports>>;
|
|
10
|
+
export declare function resolvePackEnforcers(manifest: PackManifest, decls: ReadonlyArray<EnforcerDecl>, ports: Ports, tools: ReadonlyArray<ToolDecl>, options?: RegistryOptions): Result<Array<Enforcer>>;
|
|
11
|
+
export declare function resolveManifestEnforcers(manifest: PackManifest, ports: Ports): Result<Array<Enforcer>>;
|
|
@@ -0,0 +1,136 @@
|
|
|
1
|
+
import { err, makeError, NodeEnv, NodeFs, NodeGit, NodeNet, NodeProc, ok, SystemClock, } from "../../kernel/index.js";
|
|
2
|
+
import { resolveCodeEnforcer } from "./enforcers/code.js";
|
|
3
|
+
import { resolveExternal } from "./enforcers/external-check.js";
|
|
4
|
+
import { isParametricKind, resolveParametric } from "./enforcers/parametric.js";
|
|
5
|
+
import { narrowEnforcerDecl } from "./manifest.js";
|
|
6
|
+
// SPEC §4.4.3 step 4: a deferred stub throws CDX-E901 when run — violating
|
|
7
|
+
// fixtures cannot pass on it, and the engine turns the throw into a block
|
|
8
|
+
// (§4.3.8). Kinds owned by later modules, orphan decls no rule references,
|
|
9
|
+
// unbound parametric decls and external bindings with no config.tools row
|
|
10
|
+
// all defer here.
|
|
11
|
+
function deferredEnforcer(decl, note) {
|
|
12
|
+
const owner = decl.kind === "code"
|
|
13
|
+
? `module ${decl.module ?? "unassigned"}`
|
|
14
|
+
: `kind ${decl.kind}`;
|
|
15
|
+
const until = note ?? "until its owning module lands";
|
|
16
|
+
return {
|
|
17
|
+
id: decl.id,
|
|
18
|
+
kinds: [],
|
|
19
|
+
budgetMs: decl.budgetMs,
|
|
20
|
+
check: () => {
|
|
21
|
+
throw makeError("CDX-E901", `enforcer "${decl.id}" (${owner}) is deferred ${until}`, "Implement the enforcer in its owning module, then re-run the pack self-test.");
|
|
22
|
+
},
|
|
23
|
+
};
|
|
24
|
+
}
|
|
25
|
+
function wiredKind(kind) {
|
|
26
|
+
return kind === "external" || isParametricKind(kind);
|
|
27
|
+
}
|
|
28
|
+
function missingToolEnforcer(decl) {
|
|
29
|
+
return {
|
|
30
|
+
id: decl.id,
|
|
31
|
+
kinds: [],
|
|
32
|
+
budgetMs: decl.budgetMs,
|
|
33
|
+
check: () => {
|
|
34
|
+
throw makeError("CDX-E901", `enforcer "${decl.id}" needs config.tools id "${decl.tool ?? "unknown"}" bound before it resolves`, "Declare the tool in config.tools, then reload the pack.");
|
|
35
|
+
},
|
|
36
|
+
};
|
|
37
|
+
}
|
|
38
|
+
// SPEC §4.4.5: production callers inject repo-rooted ports; without them the
|
|
39
|
+
// registry falls back to a drive-rooted live bundle mirroring the loader's
|
|
40
|
+
// own read path, so builtin self-checks behave like the loader's reads.
|
|
41
|
+
export async function livePorts(root) {
|
|
42
|
+
const made = await NodeFs.create({ root });
|
|
43
|
+
if (!made.ok) {
|
|
44
|
+
return err(made.error);
|
|
45
|
+
}
|
|
46
|
+
const proc = new NodeProc();
|
|
47
|
+
return ok({
|
|
48
|
+
fs: made.value,
|
|
49
|
+
proc,
|
|
50
|
+
net: new NodeNet(),
|
|
51
|
+
clock: new SystemClock(),
|
|
52
|
+
git: new NodeGit(proc, "."),
|
|
53
|
+
env: new NodeEnv(),
|
|
54
|
+
});
|
|
55
|
+
}
|
|
56
|
+
export function resolvePackEnforcers(manifest, decls, ports, tools, options = {}) {
|
|
57
|
+
const byDecl = new Map();
|
|
58
|
+
for (const rule of manifest.rules) {
|
|
59
|
+
const bound = byDecl.get(rule.enforcer);
|
|
60
|
+
if (bound === undefined) {
|
|
61
|
+
byDecl.set(rule.enforcer, [rule]);
|
|
62
|
+
}
|
|
63
|
+
else {
|
|
64
|
+
bound.push(rule);
|
|
65
|
+
}
|
|
66
|
+
}
|
|
67
|
+
const resolved = [];
|
|
68
|
+
for (const decl of decls) {
|
|
69
|
+
const rules = (byDecl.get(decl.id) ?? []).sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
|
|
70
|
+
if (rules.length === 0 || (!wiredKind(decl.kind) && decl.kind !== "code")) {
|
|
71
|
+
resolved.push(deferredEnforcer(decl));
|
|
72
|
+
continue;
|
|
73
|
+
}
|
|
74
|
+
if (decl.kind === "code") {
|
|
75
|
+
for (const rule of rules) {
|
|
76
|
+
const made = resolveCodeEnforcer(decl, rule, ports);
|
|
77
|
+
if (!made.ok) {
|
|
78
|
+
return err(made.error);
|
|
79
|
+
}
|
|
80
|
+
if (made.value === undefined) {
|
|
81
|
+
resolved.push(deferredEnforcer(decl, "until its owning module lands"));
|
|
82
|
+
continue;
|
|
83
|
+
}
|
|
84
|
+
resolved.push(made.value);
|
|
85
|
+
}
|
|
86
|
+
continue;
|
|
87
|
+
}
|
|
88
|
+
for (const rule of rules) {
|
|
89
|
+
if (isParametricKind(decl.kind)) {
|
|
90
|
+
const made = resolveParametric(decl, rule, ports);
|
|
91
|
+
if (!made.ok) {
|
|
92
|
+
return err(made.error);
|
|
93
|
+
}
|
|
94
|
+
if (made.value === undefined) {
|
|
95
|
+
resolved.push(deferredEnforcer(decl, "until its §4.4.6 args bind it"));
|
|
96
|
+
continue;
|
|
97
|
+
}
|
|
98
|
+
resolved.push(made.value);
|
|
99
|
+
}
|
|
100
|
+
else {
|
|
101
|
+
const tool = tools.find((entry) => entry.id === decl.tool);
|
|
102
|
+
if (tool === undefined) {
|
|
103
|
+
resolved.push(missingToolEnforcer(decl));
|
|
104
|
+
continue;
|
|
105
|
+
}
|
|
106
|
+
const externalOptions = options.onToolEvent === undefined
|
|
107
|
+
? {}
|
|
108
|
+
: { onToolEvent: options.onToolEvent };
|
|
109
|
+
const made = resolveExternal(decl, rule, ports, tool, externalOptions);
|
|
110
|
+
if (!made.ok) {
|
|
111
|
+
return err(made.error);
|
|
112
|
+
}
|
|
113
|
+
resolved.push(made.value);
|
|
114
|
+
}
|
|
115
|
+
}
|
|
116
|
+
}
|
|
117
|
+
resolved.sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
|
|
118
|
+
return ok(resolved);
|
|
119
|
+
}
|
|
120
|
+
// SPEC §4.19.2 + §4.3.3: repo-rooted enforcers for command evaluation. The
|
|
121
|
+
// loader resolves enforcers against its own read ports; a command evaluating
|
|
122
|
+
// a repo must narrow the manifest decls itself and resolve them against the
|
|
123
|
+
// root-confined ports, so scope files read repo-relatively (§4.1.1).
|
|
124
|
+
// External tools stay unbound here (their config.tools wiring lands with
|
|
125
|
+
// the custom-pack flow); unbound externals resolve inert, never failing.
|
|
126
|
+
export function resolveManifestEnforcers(manifest, ports) {
|
|
127
|
+
const decls = [];
|
|
128
|
+
for (const entry of manifest.enforcers) {
|
|
129
|
+
const narrowed = narrowEnforcerDecl(entry);
|
|
130
|
+
if (!narrowed.ok) {
|
|
131
|
+
return err(narrowed.error);
|
|
132
|
+
}
|
|
133
|
+
decls.push(narrowed.value);
|
|
134
|
+
}
|
|
135
|
+
return resolvePackEnforcers(manifest, decls, ports, []);
|
|
136
|
+
}
|
|
@@ -0,0 +1,127 @@
|
|
|
1
|
+
import { err, makeError, ok } from "../../kernel/index.js";
|
|
2
|
+
import { TRIGGERS, } from "../engine/index.js";
|
|
3
|
+
import { checkParam } from "./params.js";
|
|
4
|
+
const SELF_TEST_CONFIG_HASH = "self-test";
|
|
5
|
+
// No clock port reaches the self-test signature, so the context carries a
|
|
6
|
+
// synthetic instant. Enforcers under test decide on fixture content, never
|
|
7
|
+
// on wall time; real fixture runs take a real clock in a later phase.
|
|
8
|
+
const SELF_TEST_NOW = "self-test";
|
|
9
|
+
const TIMED_OUT = { timedOut: true };
|
|
10
|
+
function toTrigger(value) {
|
|
11
|
+
if (typeof value === "string") {
|
|
12
|
+
for (const trigger of TRIGGERS) {
|
|
13
|
+
if (trigger === value) {
|
|
14
|
+
return trigger;
|
|
15
|
+
}
|
|
16
|
+
}
|
|
17
|
+
}
|
|
18
|
+
return "startup";
|
|
19
|
+
}
|
|
20
|
+
function testContext(rule) {
|
|
21
|
+
return {
|
|
22
|
+
trigger: toTrigger(rule.triggers[0]),
|
|
23
|
+
scope: { files: [] },
|
|
24
|
+
now: SELF_TEST_NOW,
|
|
25
|
+
configHash: SELF_TEST_CONFIG_HASH,
|
|
26
|
+
};
|
|
27
|
+
}
|
|
28
|
+
function thrownError(ruleId, enforcerId) {
|
|
29
|
+
return err(makeError("CDX-E901", `enforcer "${enforcerId}" threw during self-test of rule "${ruleId}"; the pack is inert`, "Fix the guard so it runs clean on every fixture, then re-run the pack self-test."));
|
|
30
|
+
}
|
|
31
|
+
// SPEC §4.4.4: every fixture run finishes inside twice the budget. The
|
|
32
|
+
// timeout race detects exactly that without a clock port.
|
|
33
|
+
function withBudget(pending, budgetMs) {
|
|
34
|
+
let timer;
|
|
35
|
+
const timeout = new Promise((_resolve, reject) => {
|
|
36
|
+
timer = setTimeout(() => {
|
|
37
|
+
reject(TIMED_OUT);
|
|
38
|
+
}, budgetMs * 2);
|
|
39
|
+
});
|
|
40
|
+
return Promise.race([pending, timeout]).finally(() => {
|
|
41
|
+
if (timer !== undefined) {
|
|
42
|
+
clearTimeout(timer);
|
|
43
|
+
}
|
|
44
|
+
});
|
|
45
|
+
}
|
|
46
|
+
async function runCase(enforcer, rule, name) {
|
|
47
|
+
let pending;
|
|
48
|
+
try {
|
|
49
|
+
pending = enforcer.check(testContext(rule), {});
|
|
50
|
+
}
|
|
51
|
+
catch {
|
|
52
|
+
return thrownError(rule.id, enforcer.id);
|
|
53
|
+
}
|
|
54
|
+
try {
|
|
55
|
+
return ok(await withBudget(pending, enforcer.budgetMs));
|
|
56
|
+
}
|
|
57
|
+
catch (error) {
|
|
58
|
+
if (error === TIMED_OUT) {
|
|
59
|
+
return err(makeError("CDX-E215", `rule "${rule.id}" fixture "${name}" exceeded twice its ${enforcer.budgetMs} ms budget`, "Give the enforcer a larger budgetMs in the pack manifest, then re-run the self-test."));
|
|
60
|
+
}
|
|
61
|
+
return thrownError(rule.id, enforcer.id);
|
|
62
|
+
}
|
|
63
|
+
}
|
|
64
|
+
// SPEC §4.4.4: the enforcer for a self-test is found by the name the rule
|
|
65
|
+
// declares, falling back to the rule id so hand-built packs keep working.
|
|
66
|
+
function resolveEnforcer(pack, rule) {
|
|
67
|
+
for (const enforcer of pack.enforcers) {
|
|
68
|
+
if (enforcer.id === rule.enforcer) {
|
|
69
|
+
return enforcer;
|
|
70
|
+
}
|
|
71
|
+
}
|
|
72
|
+
for (const enforcer of pack.enforcers) {
|
|
73
|
+
if (enforcer.id === rule.id) {
|
|
74
|
+
return enforcer;
|
|
75
|
+
}
|
|
76
|
+
}
|
|
77
|
+
return undefined;
|
|
78
|
+
}
|
|
79
|
+
async function selfTestRule(pack, rule) {
|
|
80
|
+
if (rule.fixtures.violating.length === 0) {
|
|
81
|
+
return err(makeError("CDX-E211", `rule "${rule.id}" has no violating fixture`, "Add a violating fixture under fixtures/<rule-slug>/violating/, then re-run the self-test."));
|
|
82
|
+
}
|
|
83
|
+
if (rule.remediation.length === 0 || rule.remediation === rule.reason) {
|
|
84
|
+
return err(makeError("CDX-E214", `rule "${rule.id}" remediation is empty or repeats its reason`, "Write remediation as Do-instead text distinct from Why, then re-run the self-test."));
|
|
85
|
+
}
|
|
86
|
+
for (const name of Object.keys(rule.params)) {
|
|
87
|
+
const checked = checkParam(rule.id, name, rule.params[name]);
|
|
88
|
+
if (!checked.ok) {
|
|
89
|
+
return err(checked.error);
|
|
90
|
+
}
|
|
91
|
+
}
|
|
92
|
+
const enforcer = resolveEnforcer(pack, rule);
|
|
93
|
+
if (enforcer === undefined) {
|
|
94
|
+
return err(makeError("CDX-E205", `rule "${rule.id}" names unknown enforcer "${rule.enforcer}"`, "Declare the enforcer in the pack or use a built-in parametric enforcer (§4.4.6), then re-run the self-test."));
|
|
95
|
+
}
|
|
96
|
+
for (const name of rule.fixtures.violating) {
|
|
97
|
+
const ran = await runCase(enforcer, rule, name);
|
|
98
|
+
if (!ran.ok) {
|
|
99
|
+
return err(ran.error);
|
|
100
|
+
}
|
|
101
|
+
if (!ran.value.some((finding) => finding.ruleId === rule.id)) {
|
|
102
|
+
return err(makeError("CDX-E212", `rule "${rule.id}" violating fixture "${name}" yielded no finding with this rule id`, "Strengthen the enforcer so the violating case blocks, then re-run the self-test."));
|
|
103
|
+
}
|
|
104
|
+
}
|
|
105
|
+
for (const name of rule.fixtures.passing) {
|
|
106
|
+
const ran = await runCase(enforcer, rule, name);
|
|
107
|
+
if (!ran.ok) {
|
|
108
|
+
return err(ran.error);
|
|
109
|
+
}
|
|
110
|
+
if (ran.value.some((finding) => finding.ruleId === rule.id)) {
|
|
111
|
+
return err(makeError("CDX-E213", `rule "${rule.id}" passing fixture "${name}" yielded a finding with this rule id`, "Narrow the enforcer so the passing case stays clean, then re-run the self-test."));
|
|
112
|
+
}
|
|
113
|
+
}
|
|
114
|
+
return ok(undefined);
|
|
115
|
+
}
|
|
116
|
+
// SPEC §4.4.4: self-test every rule against its fixtures before use. Rules
|
|
117
|
+
// run in id order so the first failure is deterministic.
|
|
118
|
+
export async function selfTest(pack) {
|
|
119
|
+
const rules = [...pack.manifest.rules].sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
|
|
120
|
+
for (const rule of rules) {
|
|
121
|
+
const tested = await selfTestRule(pack, rule);
|
|
122
|
+
if (!tested.ok) {
|
|
123
|
+
return err(tested.error);
|
|
124
|
+
}
|
|
125
|
+
}
|
|
126
|
+
return ok(undefined);
|
|
127
|
+
}
|
|
@@ -0,0 +1,17 @@
|
|
|
1
|
+
export type BugStatus = "open" | "fixed" | "wontfix";
|
|
2
|
+
export interface BugRow {
|
|
3
|
+
readonly id: string;
|
|
4
|
+
readonly status: BugStatus;
|
|
5
|
+
readonly title: string;
|
|
6
|
+
readonly found: string;
|
|
7
|
+
readonly fix: string;
|
|
8
|
+
readonly regressionTest: string;
|
|
9
|
+
}
|
|
10
|
+
export interface BugFile {
|
|
11
|
+
readonly year: string;
|
|
12
|
+
readonly rows: ReadonlyArray<BugRow>;
|
|
13
|
+
}
|
|
14
|
+
export declare function parseBugFile(text: string): {
|
|
15
|
+
readonly file: BugFile | undefined;
|
|
16
|
+
readonly errors: ReadonlyArray<string>;
|
|
17
|
+
};
|