codictator 0.0.0 → 0.1.3

package/dist/features/config/validate-sections.js

@@ -0,0 +1,198 @@
+// SPEC §4.2.2: section validators for workflow, architecture, tools, llm,
+// packs and harnesses. Each throws the CdxError its SPEC row owns.
+import { e101Invalid, fail, field, isRecord, KNOWN_HARNESSES, KNOWN_PROFILES, MANDATORY_PHASES, } from "./validate-shared.js";
+// SPEC §4.17: llm keys holding secrets, and the env-var suffix that marks a
+// reference instead of a literal value. Local: only validateLlm uses them.
+const SECRET_KEY_PATTERN = /(key|token|secret)/i;
+const ENV_REF_SUFFIX = /env$/i;
+export function validateWorkflowPhases(raw) {
+    if (!Array.isArray(raw)) {
+        e101Invalid("#/workflow/phases", "an array of phases");
+    }
+    const names = [];
+    for (const entry of raw) {
+        const name = isRecord(entry) ? field(entry, "name") : undefined;
+        if (typeof name !== "string") {
+            e101Invalid("#/workflow/phases", "phases with string names");
+        }
+        names.push(name);
+    }
+    const mentioned = names.filter((name) => MANDATORY_PHASES.includes(name));
+    if (mentioned.length === 0) {
+        return;
+    }
+    let previous = -1;
+    for (const name of mentioned) {
+        const at = MANDATORY_PHASES.indexOf(name);
+        if (at <= previous) {
+            fail("CDX-E105", `workflow reorders mandatory phase "${name}"`, "Keep the seven mandatory phases in their SPEC §4.12.2 order; insert custom phases around them.");
+        }
+        previous = at;
+    }
+    if (mentioned.length !== MANDATORY_PHASES.length) {
+        const missing = MANDATORY_PHASES.filter((name) => !mentioned.includes(name));
+        fail("CDX-E105", `workflow removes mandatory phase "${missing.join(", ")}"`, "Restore every mandatory phase of SPEC §4.12.2; custom phases are additions only.");
+    }
+}
+function moduleDeps(raw) {
+    if (!isRecord(raw) || !Array.isArray(field(raw, "dependsOn"))) {
+        return undefined;
+    }
+    const found = field(raw, "dependsOn");
+    if (!Array.isArray(found)) {
+        return undefined;
+    }
+    const deps = [];
+    for (const entry of found) {
+        if (typeof entry !== "string") {
+            return undefined;
+        }
+        deps.push(entry);
+    }
+    return deps;
+}
+function findCycle(modules) {
+    const visiting = new Set();
+    const done = new Set();
+    const walk = (name, trail) => {
+        if (done.has(name)) {
+            return undefined;
+        }
+        if (visiting.has(name)) {
+            return [...trail, name];
+        }
+        visiting.add(name);
+        const deps = modules.get(name) ?? [];
+        for (const dep of deps) {
+            const found = walk(dep, [...trail, name]);
+            if (found !== undefined) {
+                return found;
+            }
+        }
+        visiting.delete(name);
+        done.add(name);
+        return undefined;
+    };
+    for (const name of modules.keys()) {
+        const found = walk(name, []);
+        if (found !== undefined) {
+            return found;
+        }
+    }
+    return undefined;
+}
+function checkArchitectureProfile(raw) {
+    const profile = field(raw, "profile");
+    if (profile === undefined) {
+        return;
+    }
+    if (typeof profile !== "string" || !KNOWN_PROFILES.has(profile)) {
+        fail("CDX-E101", `unknown architecture profile "${String(profile)}"`, "Use one of app, library, cli or service (SPEC §4.11.1).");
+    }
+}
+function collectModuleDeps(modules) {
+    const deps = new Map();
+    for (const entry of modules) {
+        const name = isRecord(entry) ? field(entry, "name") : undefined;
+        if (typeof name !== "string") {
+            e101Invalid("#/architecture/modules", "modules with string names");
+        }
+        deps.set(name, moduleDeps(entry) ?? []);
+    }
+    return deps;
+}
+export function validateArchitecture(raw) {
+    if (!isRecord(raw)) {
+        e101Invalid("#/architecture", "an object");
+    }
+    checkArchitectureProfile(raw);
+    const modules = field(raw, "modules");
+    if (modules === undefined) {
+        return;
+    }
+    if (!Array.isArray(modules)) {
+        e101Invalid("#/architecture/modules", "an array of modules");
+    }
+    const cycle = findCycle(collectModuleDeps(modules));
+    if (cycle !== undefined) {
+        fail("CDX-E105", `architecture change closes a cycle: ${cycle.join(" -> ")}`, "Remove a dependsOn edge so the module graph stays acyclic (SPEC §4.11.2).");
+    }
+}
+export function validateTools(raw) {
+    if (!Array.isArray(raw)) {
+        e101Invalid("#/tools", "an array of tools");
+    }
+    for (const entry of raw) {
+        if (!isRecord(entry)) {
+            e101Invalid("#/tools", "an array of tool objects");
+        }
+        const version = field(entry, "version");
+        if (!isRecord(version) ||
+            typeof field(version, "pin") !== "string" ||
+            field(version, "pin") === "") {
+            fail("CDX-E206", "tool without an exact version pin", "Give every config.tools entry an exact version.pin, then retry.");
+        }
+    }
+}
+export function validateLlm(raw) {
+    if (!isRecord(raw)) {
+        e101Invalid("#/llm", "an object");
+    }
+    for (const key of Object.keys(raw)) {
+        if (!SECRET_KEY_PATTERN.test(key) || ENV_REF_SUFFIX.test(key)) {
+            continue;
+        }
+        const value = field(raw, key);
+        if (typeof value === "string" && value !== "") {
+            fail("CDX-E106", `literal secret in config.llm.${key}`, "Reference secrets by env-var name (for example llm.apiKeyEnv), never by literal value (§4.17).");
+        }
+    }
+}
+function packEntryId(entry) {
+    const id = isRecord(entry) ? field(entry, "id") : undefined;
+    if (typeof id !== "string" || id === "") {
+        e101Invalid("#/packs", "packs with non-empty string ids");
+    }
+    return id;
+}
+function checkPackKeys(entry, id) {
+    if (!isRecord(entry)) {
+        return;
+    }
+    for (const key of Object.keys(entry)) {
+        if (key !== "id" && key !== "version" && key !== "path") {
+            e101Invalid(`#/packs/${id}/${key}`, "id, version or path");
+        }
+    }
+}
+function checkDuplicatePackId(ids, id) {
+    if (ids.has(id)) {
+        fail("CDX-E101", `duplicate pack id "${id}"`, "List each pack once, at one pinned version.");
+    }
+}
+export function validatePacks(raw) {
+    if (!Array.isArray(raw)) {
+        e101Invalid("#/packs", "an array of packs");
+    }
+    const ids = new Set();
+    for (const entry of raw) {
+        const id = packEntryId(entry);
+        checkPackKeys(entry, id);
+        checkDuplicatePackId(ids, id);
+        ids.add(id);
+    }
+    return ids;
+}
+export function validateHarnesses(raw) {
+    if (!Array.isArray(raw) || raw.length === 0) {
+        e101Invalid("#/harnesses", "a non-empty array of harness ids");
+    }
+    for (const entry of raw) {
+        if (typeof entry !== "string" || entry === "") {
+            e101Invalid("#/harnesses", "a non-empty array of harness ids");
+        }
+        if (!KNOWN_HARNESSES.has(entry) && !entry.startsWith("custom:")) {
+            fail("CDX-E301", `unknown harness id "${entry}"`, "Use an installed adapter id (§7.2) or a custom: id with an adapter in .codictator/adapters/.");
+        }
+    }
+}

package/dist/features/config/validate-shared.d.ts

@@ -0,0 +1,8 @@
+export declare const KNOWN_TOP_KEYS: ReadonlySet<string>;
+export declare const KNOWN_HARNESSES: ReadonlySet<string>;
+export declare const KNOWN_PROFILES: ReadonlySet<string>;
+export declare const MANDATORY_PHASES: ReadonlyArray<string>;
+export declare function fail(code: string, message: string, remediation: string, detail?: string): never;
+export declare function isRecord(value: unknown): value is Record<string, unknown>;
+export declare function field(record: Record<string, unknown>, name: string): unknown;
+export declare function e101Invalid(path: string, expected: string): never;

package/dist/features/config/validate-shared.js

@@ -0,0 +1,69 @@
+// SPEC §4.2.2: shared validation primitives for config.json. Every check
+// throws the CdxError its SPEC row owns; the CLI maps codes to exit codes.
+import { makeError } from "../../kernel/index.js";
+// SPEC §7.2 and schema/config.schema.json: the only accepted top-level keys.
+export const KNOWN_TOP_KEYS = new Set([
+    "version",
+    "codictator",
+    "packs",
+    "harnesses",
+    "tunables",
+    "architecture",
+    "workflow",
+    "spec",
+    "testing",
+    "commands",
+    "steering",
+    "tools",
+    "security",
+    "deps",
+    "network",
+    "integrity",
+    "ci",
+    "llm",
+]);
+// SPEC §7.2: adapter ids, plus custom: names.
+export const KNOWN_HARNESSES = new Set([
+    "muse-code",
+    "universal",
+    "claude-code",
+    "copilot",
+    "codex-cli",
+    "cursor",
+    "gemini-cli",
+    "opencode",
+]);
+// SPEC §4.11.1: the architecture profiles.
+export const KNOWN_PROFILES = new Set([
+    "app",
+    "library",
+    "cli",
+    "service",
+]);
+// SPEC §4.12.2: the seven mandatory phases in order.
+export const MANDATORY_PHASES = [
+    "discovery",
+    "planning",
+    "implementation",
+    "validation",
+    "review",
+    "record",
+    "integrate",
+];
+export function fail(code, message, remediation, detail) {
+    const error = detail === undefined
+        ? makeError(code, message, remediation)
+        : makeError(code, message, remediation, detail);
+    throw error;
+}
+export function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+// Bracket access through a variable keeps noPropertyAccessFromIndexSignature
+// satisfied without tripping useLiteralKeys (kernel schema.ts pattern).
+export function field(record, name) {
+    return record[name];
+}
+export function e101Invalid(path, expected) {
+    fail("CDX-E101", `value at ${path} is invalid: expected ${expected}`, "Fix the value so it matches schema/config.schema.json, then retry.");
+}

package/dist/features/config/validate-tunables.d.ts

@@ -0,0 +1 @@
+export declare function validateTunables(raw: unknown, packIds: ReadonlySet<string>): void;

package/dist/features/config/validate-tunables.js

@@ -0,0 +1,89 @@
+// SPEC §4.2.2: tunable tightening checks. Any loosening past the pack
+// default is CDX-E104; floor rules (§5) have no override (CDX-E103).
+import { FLOOR_RULES, TUNABLE_PARAMS } from "./pack-data.js";
+import { e101Invalid, fail, field, isRecord } from "./validate-shared.js";
+function checkTunablesShape(ruleId, raw) {
+    if (!isRecord(raw)) {
+        e101Invalid(`#/tunables/${ruleId}`, "an object of parameters");
+    }
+    // The red suite pins { params: { ... } }; SPEC §7.2 shows the params
+    // inline. Both normalize to the parameter map before per-param checks.
+    const params = field(raw, "params");
+    if (params !== undefined) {
+        if (!isRecord(params)) {
+            e101Invalid(`#/tunables/${ruleId}/params`, "an object of parameters");
+        }
+        return params;
+    }
+    return raw;
+}
+function checkNumericParam(ruleId, name, spec, value) {
+    if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
+        e101Invalid(`#/tunables/${ruleId}/${name}`, "a finite number at or above zero");
+    }
+    const looser = spec.stricter === "lower" ? value > spec.default : value < spec.default;
+    if (looser) {
+        fail("CDX-E104", `tunable ${ruleId} ${name}=${value} is looser than the pack default ${spec.default}`, `Move the loosening into .codictator/waivers.json (bound ${spec.bound}), or tighten ${name} to ${spec.default} or stricter.`);
+    }
+}
+function checkSetParam(ruleId, name, spec, value) {
+    if (!Array.isArray(value) ||
+        value.some((entry) => typeof entry !== "string")) {
+        e101Invalid(`#/tunables/${ruleId}/${name}`, "an array of strings");
+    }
+    const values = value;
+    const looser = spec.stricter === "subset"
+        ? values.some((entry) => !spec.default.includes(entry))
+        : spec.default.some((entry) => !values.includes(entry));
+    if (looser) {
+        fail("CDX-E104", `tunable ${ruleId} ${name} is looser than the pack default`, "Move the loosening into .codictator/waivers.json, or tighten the list back toward the default.");
+    }
+}
+function checkParamValue(ruleId, name, spec, value) {
+    if (spec.kind === "policy") {
+        return;
+    }
+    if (spec.kind === "set") {
+        checkSetParam(ruleId, name, spec, value);
+        return;
+    }
+    checkNumericParam(ruleId, name, spec, value);
+}
+function rulePackId(ruleId) {
+    const slash = ruleId.indexOf("/");
+    return slash < 0 ? ruleId : ruleId.slice(0, slash);
+}
+function isParamSpec(value) {
+    if (!isRecord(value) || typeof field(value, "kind") !== "string") {
+        return false;
+    }
+    return (field(value, "kind") === "number" ||
+        field(value, "kind") === "set" ||
+        field(value, "kind") === "policy");
+}
+export function validateTunables(raw, packIds) {
+    if (!isRecord(raw)) {
+        e101Invalid("#/tunables", "an object keyed by rule id");
+    }
+    for (const ruleId of Object.keys(raw)) {
+        const packId = rulePackId(ruleId);
+        if (!packIds.has(packId)) {
+            fail("CDX-E101", `tunable rule "${ruleId}" needs pack "${packId}", which config.packs does not load`, `Add "${packId}" to config.packs or remove the tunable.`);
+        }
+        if (FLOOR_RULES.has(ruleId)) {
+            fail("CDX-E103", `floor rule ${ruleId} has no override`, "Remove it from tunables; floor rules cannot be loosened or waived.");
+        }
+        const spec = TUNABLE_PARAMS[ruleId];
+        if (spec === undefined) {
+            fail("CDX-E101", `unknown tunable rule "${ruleId}"`, "Use a rule id from a loaded pack, then retry.");
+        }
+        const params = checkTunablesShape(ruleId, field(raw, ruleId));
+        for (const name of Object.keys(params)) {
+            const param = field(spec, name);
+            if (!isParamSpec(param)) {
+                e101Invalid(`#/tunables/${ruleId}/${name}`, "a parameter the rule declares");
+            }
+            checkParamValue(ruleId, name, param, field(params, name));
+        }
+    }
+}

package/dist/features/config/validate.d.ts

@@ -0,0 +1,2 @@
+import type { Config } from "./index.ts";
+export declare function validateConfigValue(value: unknown, engineVersion: string): Config;

package/dist/features/config/validate.js

@@ -0,0 +1,57 @@
+// SPEC §4.2.2: validation rules for config.json. Every check throws the
+// CdxError its SPEC row owns; the CLI maps codes to exit codes.
+import { validateArchitecture, validateHarnesses, validateLlm, validatePacks, validateTools, validateWorkflowPhases, } from "./validate-sections.js";
+import { e101Invalid, fail, field, isRecord, KNOWN_TOP_KEYS, } from "./validate-shared.js";
+import { validateTunables } from "./validate-tunables.js";
+// SPEC §4.2.2: every validation rule. Throws the CdxError its row owns and
+// returns the narrowed Config on success.
+export function validateConfigValue(value, engineVersion) {
+    if (!isRecord(value)) {
+        e101Invalid("#", "a config object");
+    }
+    for (const key of Object.keys(value)) {
+        if (!KNOWN_TOP_KEYS.has(key)) {
+            fail("CDX-E101", `unknown top-level key "${key}"`, "Remove the key or move it under the section schema/config.schema.json defines.");
+        }
+    }
+    if (field(value, "version") !== 1) {
+        e101Invalid("#/version", "the const 1");
+    }
+    const codictator = field(value, "codictator");
+    if (typeof codictator !== "string" || codictator === "") {
+        e101Invalid("#/codictator", "the installed engine version");
+    }
+    if (codictator !== engineVersion) {
+        fail("CDX-E102", `config.codictator "${codictator}" does not match the installed engine "${engineVersion}"`, `Set "codictator" to "${engineVersion}" in .codictator/config.json.`);
+    }
+    const packIds = validatePacks(field(value, "packs"));
+    validateHarnesses(field(value, "harnesses"));
+    const tunables = field(value, "tunables");
+    if (tunables !== undefined) {
+        validateTunables(tunables, packIds);
+    }
+    const workflow = field(value, "workflow");
+    if (workflow !== undefined) {
+        if (!isRecord(workflow)) {
+            e101Invalid("#/workflow", "an object");
+        }
+        if (field(workflow, "phases") !== undefined) {
+            validateWorkflowPhases(field(workflow, "phases"));
+        }
+    }
+    const architecture = field(value, "architecture");
+    if (architecture !== undefined) {
+        validateArchitecture(architecture);
+    }
+    const tools = field(value, "tools");
+    if (tools !== undefined) {
+        validateTools(tools);
+    }
+    const llm = field(value, "llm");
+    if (llm !== undefined) {
+        validateLlm(llm);
+    }
+    // Every field above is verified, so the unknown-to-Config narrowing is
+    // exact: the intermediate unknown keeps the cast from widening.
+    return value;
+}

package/dist/features/deps/bots.d.ts

@@ -0,0 +1,5 @@
+export type UpgradeBot = "renovate" | "dependabot" | "codictator";
+export declare function detectUpgradeBots(files: ReadonlyArray<string>): UpgradeBot;
+export declare function isRenovateFile(path: string): boolean;
+export declare function isDependabotFile(path: string): boolean;
+export declare function upgradeBranchName(ecosystem: string, name: string, version: string): string;

package/dist/features/deps/bots.js

@@ -0,0 +1,39 @@
+const RENOVATE_FILES = [
+    "renovate.json",
+    "renovate.json5",
+    ".github/renovate.json",
+    ".github/renovate.json5",
+    ".renovaterc",
+    ".renovaterc.json",
+    ".renovaterc.json5",
+];
+const DEPENDABOT_FILE = ".github/dependabot.yml";
+// SPEC §4.8.6: renovate files → Renovate; dependabot.yml → Dependabot;
+// neither → Codictator upgrades (§4.8.7).
+export function detectUpgradeBots(files) {
+    const names = new Set(files.map((file) => file.replaceAll("\\", "/")));
+    const hasRenovate = RENOVATE_FILES.some((candidate) => names.has(candidate));
+    const hasDependabot = names.has(DEPENDABOT_FILE);
+    if (hasRenovate && hasDependabot) {
+        return "renovate";
+    }
+    if (hasRenovate) {
+        return "renovate";
+    }
+    if (hasDependabot) {
+        return "dependabot";
+    }
+    return "codictator";
+}
+export function isRenovateFile(path) {
+    return RENOVATE_FILES.includes(path.replaceAll("\\", "/"));
+}
+export function isDependabotFile(path) {
+    return path.replaceAll("\\", "/") === DEPENDABOT_FILE;
+}
+// SPEC §4.8.7: one branch per dependency grouping patch and minor of the same
+// package line; majors become remediation chains (§4.13.5), never single PRs.
+export function upgradeBranchName(ecosystem, name, version) {
+    const safe = `${name}-${version}`.replaceAll(/[^0-9A-Za-z._-]+/g, "-");
+    return `codictator/deps/${ecosystem}/${safe}`;
+}

package/dist/features/deps/capabilities.d.ts

@@ -0,0 +1,3 @@
+export declare const DEFAULT_LICENSE_ALLOW: ReadonlyArray<string>;
+export declare function capabilityOf(packageName: string): string | undefined;
+export declare function platformCapabilityCover(capability: string): string | undefined;

package/dist/features/deps/capabilities.js

@@ -0,0 +1,91 @@
+// SPEC §5.3 and §6.1: the npm capability catalogue and the license allow
+// policy. One repo holds one package per capability; platform entries name
+// the pinned-platform cover (Node >= 24).
+export const DEFAULT_LICENSE_ALLOW = [
+    "MIT",
+    "ISC",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "Apache-2.0",
+    "0BSD",
+    "BlueOak-1.0.0",
+    "Unlicense",
+    "CC0-1.0",
+    "Python-2.0",
+    "MPL-2.0",
+];
+// SPEC §6.1: package names grouped by the capability they provide.
+const NPM_CAPABILITIES = {
+    axios: "http-client",
+    got: "http-client",
+    "node-fetch": "http-client",
+    ky: "http-client",
+    superagent: "http-client",
+    undici: "http-client",
+    request: "http-client",
+    "cross-fetch": "http-client",
+    uuid: "unique-ids",
+    nanoid: "unique-ids",
+    dotenv: "env-files",
+    jest: "test-runner",
+    vitest: "test-runner",
+    mocha: "test-runner",
+    ava: "test-runner",
+    jasmine: "test-runner",
+    tap: "test-runner",
+    glob: "glob",
+    "fast-glob": "glob",
+    globby: "glob",
+    rimraf: "recursive-fs",
+    mkdirp: "recursive-fs",
+    "fs-extra": "recursive-fs",
+    "lodash.clonedeep": "deep-clone",
+    "clone-deep": "deep-clone",
+    rfdc: "deep-clone",
+    chalk: "terminal-colours",
+    kleur: "terminal-colours",
+    picocolors: "terminal-colours",
+    colors: "terminal-colours",
+    commander: "argument-parsing",
+    yargs: "argument-parsing",
+    minimist: "argument-parsing",
+    meow: "argument-parsing",
+    moment: "dates",
+    dayjs: "dates",
+    "date-fns": "dates",
+    luxon: "dates",
+    zod: "schema-validation",
+    yup: "schema-validation",
+    joi: "schema-validation",
+    ajv: "schema-validation",
+    valibot: "schema-validation",
+    superstruct: "schema-validation",
+    prettier: "format",
+    "@biomejs/biome": "format",
+    dprint: "format",
+    eslint: "lint",
+    oxlint: "lint",
+    lodash: "utility-belt",
+    underscore: "utility-belt",
+    ramda: "utility-belt",
+    remeda: "utility-belt",
+};
+const PLATFORM_CAPABILITIES = {
+    "http-client": "fetch",
+    "unique-ids": "crypto.randomUUID",
+    "env-files": "node --env-file",
+    "test-runner": "node:test",
+    glob: "fs.glob",
+    "recursive-fs": "fs.rm with recursive",
+    "deep-clone": "structuredClone",
+    "terminal-colours": "util.styleText",
+    "argument-parsing": "util.parseArgs",
+};
+// SPEC §6.4 EC-1: Biome and Prettier together block on the shared "format"
+// capability; both entries carry it.
+export function capabilityOf(packageName) {
+    return NPM_CAPABILITIES[packageName];
+}
+export function platformCapabilityCover(capability) {
+    return PLATFORM_CAPABILITIES[capability];
+}

package/dist/features/deps/check.d.ts

@@ -0,0 +1,18 @@
+import type { Fs, Net } from "../../kernel/index.ts";
+import type { CheckContext, Finding } from "../engine/index.ts";
+import type { Manifest, RegistrySnapshot } from "./index.ts";
+export interface DepCheckContext {
+    readonly snapshot?: RegistrySnapshot;
+    readonly unpublished?: ReadonlyArray<string>;
+    readonly npmrc?: {
+        readonly path: string;
+        readonly text: string;
+    };
+    readonly allowedRegistryHosts?: ReadonlyArray<string>;
+    readonly platformCaps?: ReadonlyArray<string>;
+    readonly net?: Net;
+    readonly fs?: Fs;
+    readonly registryBaseUrl?: string;
+    readonly fetchSleep?: (ms: number) => Promise<void>;
+}
+export declare function checkDeps(ctx: CheckContext, manifests: ReadonlyArray<Manifest>, depsContext?: DepCheckContext): Promise<Array<Finding>>;

package/dist/features/deps/check.js

@@ -0,0 +1,70 @@
+import { uniqueDeps } from "./eval.js";
+import { isExactNpmPin, isUnversionedNpmSource } from "./npm.js";
+import { buildSnapshot, fetchNpmPackument } from "./registry.js";
+import { depErrorFinding, evaluateDepVerdicts, manifestToEval, } from "./verdicts.js";
+export async function checkDeps(ctx, manifests, depsContext = {}) {
+    let snapshot = depsContext.snapshot;
+    if (snapshot === undefined && depsContext.net !== undefined) {
+        const fetched = await fetchEvaluationSnapshot(depsContext.net, manifests, ctx.now, depsContext.registryBaseUrl, depsContext.fetchSleep);
+        if (!fetched.ok) {
+            return [
+                depErrorFinding("core/dep-no-vulnerable", manifests[0]?.path ?? "package.json", fetched.error, "Retry the sweep; without registry data dependency changes block fail-closed."),
+            ];
+        }
+        snapshot = fetched.value;
+    }
+    const input = {
+        manifests: manifests.map(manifestToEval),
+        now: ctx.now,
+        ...(snapshot === undefined ? {} : { snapshot }),
+        ...(depsContext.unpublished === undefined
+            ? {}
+            : { unpublished: depsContext.unpublished }),
+        ...(depsContext.npmrc === undefined ? {} : { npmrc: depsContext.npmrc }),
+        ...(depsContext.allowedRegistryHosts === undefined
+            ? {}
+            : { allowedRegistryHosts: depsContext.allowedRegistryHosts }),
+        ...(depsContext.platformCaps === undefined
+            ? {}
+            : { platformCaps: depsContext.platformCaps }),
+    };
+    const evaluated = evaluateDepVerdicts(input);
+    const findings = [...evaluated.findings];
+    if (snapshot === undefined) {
+        for (const { path, dep } of uniqueDeps(input.manifests)) {
+            if (!isExactNpmPin(dep.range) || isUnversionedNpmSource(dep.range)) {
+                continue;
+            }
+            const parsed = dep.range.replace(/^v/, "");
+            if (/-/.test(parsed) && !/^\d+\.\d+\.\d+$/.test(parsed)) {
+                findings.push({
+                    ruleId: "core/dep-latest-stable",
+                    path,
+                    message: `${dep.name}@${dep.range} in ${path} is a prerelease, never stable`,
+                    remediation: `Pin ${dep.name} to a stable release.`,
+                });
+            }
+        }
+    }
+    return findings;
+}
+async function fetchEvaluationSnapshot(net, manifests, now, baseUrl, sleep) {
+    const names = [
+        ...new Set(manifests.flatMap((m) => m.dependencies.map((d) => d.name))),
+    ].sort();
+    const docs = [];
+    for (const name of names) {
+        const fetched = await fetchNpmPackument(net, name, {
+            ...(baseUrl === undefined ? {} : { baseUrl }),
+            ...(sleep === undefined ? {} : { sleep }),
+        });
+        if (!fetched.ok) {
+            return fetched;
+        }
+        docs.push(fetched.value);
+    }
+    return {
+        ok: true,
+        value: buildSnapshot("npm", now, docs, {}),
+    };
+}

package/dist/features/deps/dependabot.d.ts

@@ -0,0 +1,10 @@
+import type { Finding } from "../engine/index.ts";
+export interface DependabotUpdateEntry {
+    readonly packageEcosystem: string;
+    readonly directory: string;
+    readonly scheduleInterval: string | undefined;
+    readonly cooldownDays: string | undefined;
+    readonly versioningStrategy: string | undefined;
+}
+export declare function parseDependabotUpdates(text: string): ReadonlyArray<DependabotUpdateEntry>;
+export declare function checkDependabotOwnedKeys(path: string, text: string, ecosystems: ReadonlyArray<string>, minReleaseAgeDays: number): ReadonlyArray<Finding>;