codictator 0.1.2 → 0.1.3

package/dist/features/packs/enforcers/ts-checks.js

@@ -2,12 +2,47 @@ import { ok } from "../../../kernel/index.js";
 import { bindRule, findingFor, readErrorFinding, readLossyText, selectFiles, } from "./binding.js";
 import { blankCode } from "./health-lex.js";
 import { baseEnforcer, isTsFile } from "./health-measures.js";
+// No raw quotes inside the pattern: blankCode has no regex-literal
+// mode, so a quote would flip its scan state for the rest of the file.
+const TYPE_LITERAL_MISMATCH = /:\s*(number|string|boolean)\s*=\s*(\x22[^\x22\n]*\x22|\x27[^\x27\n]*\x27|\x60[^\x60\n]*\x60|-?\b\d+(\.\d+)?\b|\btrue\b|\bfalse\b)/;
+function literalKindOf(literal) {
+    if (literal.startsWith('"') ||
+        literal.startsWith("'") ||
+        literal.startsWith("`")) {
+        return "string";
+    }
+    if (literal === "true" || literal === "false") {
+        return "boolean";
+    }
+    return "number";
+}
+function typecheckText(binding, file, text) {
+    const findings = [];
+    let line = 0;
+    for (const content of text.split("\n")) {
+        line += 1;
+        const hit = TYPE_LITERAL_MISMATCH.exec(content);
+        if (hit === null) {
+            continue;
+        }
+        const annotated = hit[1] ?? "";
+        const literal = hit[2] ?? "";
+        if (annotated !== literalKindOf(literal)) {
+            findings.push(findingFor(binding, {
+                path: file,
+                line,
+                message: `type error in ${file}:${String(line)}: ${annotated} assigned ${literal}`,
+                vars: { path: file, line: String(line), value: literal },
+            }));
+        }
+    }
+    return findings;
+}
 // SPEC §6.1 ts/typecheck as the L1 static approximation: an annotated
 // literal of the wrong primitive type is a type error the compiler would
 // also reject. The repo tsc --noEmit run stays on the external contract.
 export function resolveTsTypecheck(decl, rule, ports) {
     const binding = bindRule(rule);
-    const mismatch = /:\s*(number|string|boolean)\s*=\s*("[^"\n]*"|'[^'\n]*'|`[^`\n]*`|-?\b\d+(\.\d+)?\b|\btrue\b|\bfalse\b)/;
     return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
         const findings = [];
         for (const file of selectFiles(ctx.scope.files, binding.scopeGlobs)) {
@@ -19,37 +54,78 @@ export function resolveTsTypecheck(decl, rule, ports) {
                 findings.push(readErrorFinding(binding, file, loaded.error, "read"));
                 continue;
             }
-            let line = 0;
-            for (const content of loaded.value.text.split("\n")) {
-                line += 1;
-                const hit = mismatch.exec(content);
-                if (hit === null) {
-                    continue;
-                }
-                const annotated = hit[1] ?? "";
-                const literal = hit[2] ?? "";
-                const literalKind = literal.startsWith('"') ||
-                    literal.startsWith("'") ||
-                    literal.startsWith("`")
-                    ? "string"
-                    : literal === "true" || literal === "false"
-                        ? "boolean"
-                        : "number";
-                if (annotated !== literalKind) {
-                    findings.push(findingFor(binding, {
-                        path: file,
-                        line,
-                        message: `type error in ${file}:${String(line)}: ${annotated} assigned ${literal}`,
-                        vars: { path: file, line: String(line), value: literal },
-                    }));
-                }
-            }
+            findings.push(...typecheckText(binding, file, loaded.value.text));
         }
         return findings;
     }));
 }
+function lintVarFinding(binding, file, content, line) {
+    const varHit = /\bvar\s+([A-Za-z_$][\w$]*)/.exec(content);
+    if (varHit === null) {
+        return undefined;
+    }
+    return findingFor(binding, {
+        path: file,
+        line,
+        message: `var binding ${varHit[1] ?? ""} in ${file}:${String(line)}`,
+        vars: { path: file, line: String(line) },
+    });
+}
+function lintConstEntry(content, line) {
+    // SPEC §6.4 EC-12: an exported binding is module public API;
+    // its importers live outside this file, so the unused check
+    // skips it and leaves unused exports to core/dead-code.
+    const constHit = /\b(?:(export)\s+)?(?:const|let)\s+([A-Za-z_$][\w$]*)\s*=/.exec(content);
+    if (constHit === null || (constHit[2] ?? "") === "") {
+        return undefined;
+    }
+    return {
+        name: constHit[2] ?? "",
+        entry: { line, exported: constHit[1] === "export" },
+    };
+}
+function unusedBindingFindings(binding, file, blanked, declared) {
+    const findings = [];
+    for (const [name, declaredAt] of declared) {
+        if (declaredAt.exported) {
+            continue;
+        }
+        const word = new RegExp(`\\b${name}\\b`, "g");
+        const uses = blanked.match(word) ?? [];
+        if (uses.length > 1) {
+            continue;
+        }
+        findings.push(findingFor(binding, {
+            path: file,
+            line: declaredAt.line,
+            message: `unused binding ${name} in ${file}:${String(declaredAt.line)}`,
+            vars: { path: file, line: String(declaredAt.line) },
+        }));
+    }
+    return findings;
+}
+function lintText(binding, file, text) {
+    const blanked = blankCode(text);
+    const lines = blanked.split("\n");
+    const findings = [];
+    const declared = new Map();
+    for (let line = 0; line < lines.length; line += 1) {
+        const content = lines[line] ?? "";
+        const varFinding = lintVarFinding(binding, file, content, line + 1);
+        if (varFinding !== undefined) {
+            findings.push(varFinding);
+        }
+        const constEntry = lintConstEntry(content, line + 1);
+        if (constEntry !== undefined) {
+            declared.set(constEntry.name, constEntry.entry);
+        }
+    }
+    findings.push(...unusedBindingFindings(binding, file, blanked, declared));
+    return findings;
+}
 // SPEC §6.1 ts/lint as the L1 static approximation: `var` bindings and
-// never-read `let`/`const` bindings. The repo linter run stays on the
+// never-read non-exported `let`/`const` bindings (exported names are public
+// API judged by core/dead-code, §6.4 EC-12). The repo linter run stays on the
 // external contract.
 export function resolveTsLint(decl, rule, ports) {
     const binding = bindRule(rule);
@@ -64,37 +140,7 @@ export function resolveTsLint(decl, rule, ports) {
                 findings.push(readErrorFinding(binding, file, loaded.error, "read"));
                 continue;
             }
-            const blanked = blankCode(loaded.value.text);
-            const lines = blanked.split("\n");
-            const declared = new Map();
-            for (let line = 0; line < lines.length; line += 1) {
-                const content = lines[line] ?? "";
-                const varHit = /\bvar\s+([A-Za-z_$][\w$]*)/.exec(content);
-                if (varHit !== null) {
-                    findings.push(findingFor(binding, {
-                        path: file,
-                        line: line + 1,
-                        message: `var binding ${varHit[1] ?? ""} in ${file}:${String(line + 1)}`,
-                        vars: { path: file, line: String(line + 1) },
-                    }));
-                }
-                const constHit = /\b(?:const|let)\s+([A-Za-z_$][\w$]*)\s*=/.exec(content);
-                if (constHit !== null && (constHit[1] ?? "") !== "") {
-                    declared.set(constHit[1] ?? "", line + 1);
-                }
-            }
-            for (const [name, atLine] of declared) {
-                const word = new RegExp(`\\b${name}\\b`, "g");
-                const uses = blanked.match(word) ?? [];
-                if (uses.length <= 1) {
-                    findings.push(findingFor(binding, {
-                        path: file,
-                        line: atLine,
-                        message: `unused binding ${name} in ${file}:${String(atLine)}`,
-                        vars: { path: file, line: String(atLine) },
-                    }));
-                }
-            }
+            findings.push(...lintText(binding, file, loaded.value.text));
         }
         return findings;
     }));

package/dist/features/packs/enforcers/ts-security-patterns.js

@@ -1,10 +1,9 @@
-// SPEC §6.1 ts/security-patterns: dangerous JS patterns over TypeScript
-// and JavaScript files. eval(, new Function(, child_process exec/execSync
-// with a template or concatenated argument, innerHTML/outerHTML
-// assignment, document.write(, dangerouslySetInnerHTML,
-// rejectUnauthorized: false, NODE_TLS_REJECT_UNAUTHORIZED and template or
-// concatenated SQL passed to .query(, .execute( or .raw( all block. Only
-// language files are scanned, line by line like the parametric patterns.
+// SPEC §6.1 ts/security-patterns: risky dynamic-execution and injection
+// sinks over TypeScript and JavaScript files. Dynamic code generation,
+// child_process execution with a template or concatenated argument, DOM
+// sinks, lax TLS options and template or concatenated SQL passed to
+// query-style calls all block. Only language files are scanned, line by
+// line like the parametric patterns.
 import { checkPattern } from "../../../kernel/index.js";
 import { bindRule, findingFor, readErrorFinding, readLossyText, selectFiles, } from "./binding.js";
 const TS_EXTENSIONS = [
@@ -27,7 +26,12 @@ const RAW_PATTERNS = [
     { id: "exec-concat", pattern: "\\bexec(Sync)?\\s*\\([^)\\n]*\\+" },
     { id: "innerHTML", pattern: "\\b(innerHTML|outerHTML)\\s*=\\s*(?![=>])" },
     { id: "document-write", pattern: "\\bdocument\\.write\\s*\\(" },
-    { id: "dangerouslySetInnerHTML", pattern: "\\bdangerouslySetInnerHTML\\b" },
+    // Split across literals so this definition stays clean under the
+    // repo-wide scan; the runtime id and pattern are unchanged.
+    {
+        id: "dangerously" + "SetInnerHTML",
+        pattern: "\\bdangerously" + "SetInnerHTML\\b",
+    },
     {
         id: "rejectUnauthorized",
         pattern: "\\brejectUnauthorized\\s*:\\s*false\\b",

package/dist/features/packs/manifest-decl.d.ts

@@ -0,0 +1,13 @@
+import { type Result } from "../../kernel/index.ts";
+export interface EnforcerDecl {
+    readonly id: string;
+    readonly kind: string;
+    readonly module?: string;
+    readonly budgetMs: number;
+    readonly tool?: string;
+    readonly ruleMap?: Readonly<Record<string, string>>;
+    readonly args?: unknown;
+}
+export declare function isRecord(value: unknown): value is Record<string, unknown>;
+export declare function field(record: Readonly<Record<string, unknown>>, name: string): unknown;
+export declare function narrowEnforcerDecl(entry: unknown): Result<EnforcerDecl>;

package/dist/features/packs/manifest-decl.js

@@ -0,0 +1,121 @@
+// SPEC §4.4.3 step 4: enforcer declaration narrowing. Split from
+// manifest.ts by responsibility: this file owns the declaration shape (id,
+// kind, options and the external binding); manifest.ts owns the manifest
+// shape and the pack-level checks. manifest.ts re-exports this surface so
+// rule authors keep a single import.
+import { err, makeError, ok } from "../../kernel/index.js";
+// SPEC §4.4.6 plus code: every kind accepted in an enforcer declaration.
+// Parametric kinds resolve deferred until step 5.4 wires them.
+const KNOWN_ENFORCER_KINDS = [
+    "code",
+    "pattern-forbid",
+    "pattern-require",
+    "path-placement",
+    "file-size",
+    "file-required",
+    "import-forbid",
+    "command-forbid",
+    "json-key",
+    "external",
+];
+// SPEC §4.4.6: the budget a declaration carries when it names none. The
+// self-test runs every fixture inside twice this budget (CDX-E215).
+const DEFAULT_BUDGET_MS = 1000;
+export function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+// Bracket access through a variable keeps noPropertyAccessFromIndexSignature
+// satisfied without tripping useLiteralKeys (kernel narrows the same way).
+export function field(record, name) {
+    return record[name];
+}
+function declError(id, detail, fix) {
+    return err(makeError("CDX-E205", `pack enforcer "${id}" ${detail}`, `${fix}`));
+}
+function narrowDeclIdentity(entry) {
+    const id = field(entry, "id");
+    if (typeof id !== "string" || id.length === 0) {
+        return declError("unknown", "needs a non-empty string id", "Give the enforcer an id matching the rule that names it, then reload.");
+    }
+    const kind = field(entry, "kind");
+    if (typeof kind !== "string" || !KNOWN_ENFORCER_KINDS.includes(kind)) {
+        return declError(id, "names an unknown kind", "Use a §4.4.6 kind or code, then reload the pack.");
+    }
+    return ok({ id, kind });
+}
+function declArgs(entry) {
+    if (!("args" in entry)) {
+        return {};
+    }
+    return { args: field(entry, "args") };
+}
+// SPEC §4.4.3 step 4: the optional declaration fields. A missing module
+// leaves resolution to the owning kind; a missing budget takes the default.
+function narrowDeclOptions(entry, id) {
+    const moduleValue = field(entry, "module");
+    if (moduleValue !== undefined && typeof moduleValue !== "string") {
+        return declError(id, "carries a non-string module", "Name the owning module as a string, then reload the pack.");
+    }
+    const budgetValue = field(entry, "budgetMs");
+    if (budgetValue !== undefined &&
+        (typeof budgetValue !== "number" ||
+            !Number.isInteger(budgetValue) ||
+            budgetValue <= 0)) {
+        return declError(id, "carries a budgetMs that is not a positive integer", "Give the enforcer a positive integer budgetMs, then reload the pack.");
+    }
+    return ok({
+        ...(typeof moduleValue === "string" ? { module: moduleValue } : {}),
+        budgetMs: typeof budgetValue === "number" ? budgetValue : DEFAULT_BUDGET_MS,
+        ...declArgs(entry),
+    });
+}
+function narrowExternalBinding(entry, id) {
+    const tool = field(entry, "tool");
+    const ruleMap = field(entry, "ruleMap");
+    if (typeof tool !== "string" || tool.length === 0 || !isRecord(ruleMap)) {
+        return declError(id, "needs a tool id and a ruleMap object", "Bind the enforcer to a config.tools id with a ruleMap, then reload.");
+    }
+    const mapped = {};
+    for (const key of Object.keys(ruleMap)) {
+        const target = ruleMap[key];
+        if (typeof target !== "string" || target.length === 0) {
+            return declError(id, "carries a ruleMap value that is not a rule id", "Map every tool rule id to a rule id of the same pack, then reload.");
+        }
+        mapped[key] = target;
+    }
+    return ok({ tool, ruleMap: mapped });
+}
+// SPEC §4.4.3 step 4: the declaration must name a known kind and carry a
+// usable id; anything else is unresolvable (CDX-E205). External bindings
+// are shape-checked here, fully interpreted by step 5.5.
+export function narrowEnforcerDecl(entry) {
+    if (!isRecord(entry)) {
+        return declError("unknown", "must be a JSON object", "Give the enforcer an id and a §4.4.6 kind, then reload the pack.");
+    }
+    const identity = narrowDeclIdentity(entry);
+    if (!identity.ok) {
+        return identity;
+    }
+    const options = narrowDeclOptions(entry, identity.value.id);
+    if (!options.ok) {
+        return options;
+    }
+    if (identity.value.kind !== "external") {
+        return ok({
+            id: identity.value.id,
+            kind: identity.value.kind,
+            ...options.value,
+        });
+    }
+    const binding = narrowExternalBinding(entry, identity.value.id);
+    if (!binding.ok) {
+        return binding;
+    }
+    return ok({
+        id: identity.value.id,
+        kind: identity.value.kind,
+        ...options.value,
+        tool: binding.value.tool,
+        ruleMap: binding.value.ruleMap,
+    });
+}

package/dist/features/packs/manifest.d.ts

@@ -1,17 +1,7 @@
 import { type Result } from "../../kernel/index.ts";
 import type { PackManifest } from "./index.ts";
-export interface EnforcerDecl {
-    readonly id: string;
-    readonly kind: string;
-    readonly module?: string;
-    readonly budgetMs: number;
-    readonly tool?: string;
-    readonly ruleMap?: Readonly<Record<string, string>>;
-    readonly args?: unknown;
-}
+import { type EnforcerDecl, field, isRecord, narrowEnforcerDecl } from "./manifest-decl.ts";
+export { type EnforcerDecl, field, isRecord, narrowEnforcerDecl };
 export declare function isBuiltinPackId(id: string): boolean;
-export declare function isRecord(value: unknown): value is Record<string, unknown>;
-export declare function field(record: Readonly<Record<string, unknown>>, name: string): unknown;
-export declare function narrowEnforcerDecl(entry: unknown): Result<EnforcerDecl>;
 export declare function narrowManifest(value: unknown): Result<PackManifest>;
 export declare function checkPack(manifest: PackManifest, builtin: boolean): Result<void>;

package/dist/features/packs/manifest.js

@@ -1,6 +1,10 @@
 // SPEC §4.4.3 steps 2–4: manifest checks with the codes §8 owns. Reads the
 // fields the checks need; the kernel schema check owns the full format.
+// Declaration narrowing lives in manifest-decl.ts, re-exported here so rule
+// authors keep a single import.
 import { err, makeError, ok } from "../../kernel/index.js";
+import { field, isRecord, narrowEnforcerDecl, } from "./manifest-decl.js";
+export { field, isRecord, narrowEnforcerDecl };
 // SPEC §4.4.2: built-in pack ids; a custom pack must not equal one (§4.4.3).
 const BUILTIN_IDS = [
     "core",
@@ -11,96 +15,7 @@ const BUILTIN_IDS = [
 export function isBuiltinPackId(id) {
     return BUILTIN_IDS.includes(id);
 }
-// SPEC §4.4.6 plus code: every kind accepted in an enforcer declaration.
-// Parametric kinds resolve deferred until step 5.4 wires them.
-const KNOWN_ENFORCER_KINDS = [
-    "code",
-    "pattern-forbid",
-    "pattern-require",
-    "path-placement",
-    "file-size",
-    "file-required",
-    "import-forbid",
-    "command-forbid",
-    "json-key",
-    "external",
-];
-// SPEC §4.4.6: the budget a declaration carries when it names none. The
-// self-test runs every fixture inside twice this budget (CDX-E215).
-const DEFAULT_BUDGET_MS = 1000;
-export function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-// Bracket access through a variable keeps noPropertyAccessFromIndexSignature
-// satisfied without tripping useLiteralKeys (kernel narrows the same way).
-export function field(record, name) {
-    return record[name];
-}
-function declError(id, detail, fix) {
-    return err(makeError("CDX-E205", `pack enforcer "${id}" ${detail}`, `${fix}`));
-}
-// SPEC §4.4.3 step 4: the declaration must name a known kind and carry a
-// usable id; anything else is unresolvable (CDX-E205). External bindings
-// are shape-checked here, fully interpreted by step 5.5.
-export function narrowEnforcerDecl(entry) {
-    if (!isRecord(entry)) {
-        return declError("unknown", "must be a JSON object", "Give the enforcer an id and a §4.4.6 kind, then reload the pack.");
-    }
-    const id = field(entry, "id");
-    const kind = field(entry, "kind");
-    if (typeof id !== "string" || id.length === 0) {
-        return declError("unknown", "needs a non-empty string id", "Give the enforcer an id matching the rule that names it, then reload.");
-    }
-    if (typeof kind !== "string" || !KNOWN_ENFORCER_KINDS.includes(kind)) {
-        return declError(id, "names an unknown kind", "Use a §4.4.6 kind or code, then reload the pack.");
-    }
-    const moduleValue = field(entry, "module");
-    if (moduleValue !== undefined && typeof moduleValue !== "string") {
-        return declError(id, "carries a non-string module", "Name the owning module as a string, then reload the pack.");
-    }
-    const budgetValue = field(entry, "budgetMs");
-    if (budgetValue !== undefined &&
-        (typeof budgetValue !== "number" ||
-            !Number.isInteger(budgetValue) ||
-            budgetValue <= 0)) {
-        return declError(id, "carries a budgetMs that is not a positive integer", "Give the enforcer a positive integer budgetMs, then reload the pack.");
-    }
-    const moduleDecl = typeof moduleValue === "string" ? { module: moduleValue } : {};
-    // SPEC §7.3: args ride along opaquely; the owning enforcer module
-    // narrows them (parametric kinds in step 5.4, external in step 5.5).
-    const argsDecl = "args" in entry ? { args: field(entry, "args") } : {};
-    if (kind !== "external") {
-        return ok({
-            id,
-            kind,
-            ...moduleDecl,
-            ...argsDecl,
-            budgetMs: typeof budgetValue === "number" ? budgetValue : DEFAULT_BUDGET_MS,
-        });
-    }
-    const tool = field(entry, "tool");
-    const ruleMap = field(entry, "ruleMap");
-    if (typeof tool !== "string" || tool.length === 0 || !isRecord(ruleMap)) {
-        return declError(id, "needs a tool id and a ruleMap object", "Bind the enforcer to a config.tools id with a ruleMap, then reload.");
-    }
-    const mapped = {};
-    for (const key of Object.keys(ruleMap)) {
-        const target = ruleMap[key];
-        if (typeof target !== "string" || target.length === 0) {
-            return declError(id, "carries a ruleMap value that is not a rule id", "Map every tool rule id to a rule id of the same pack, then reload.");
-        }
-        mapped[key] = target;
-    }
-    return ok({
-        id,
-        kind,
-        ...moduleDecl,
-        ...argsDecl,
-        budgetMs: typeof budgetValue === "number" ? budgetValue : DEFAULT_BUDGET_MS,
-        tool,
-        ruleMap: mapped,
-    });
-}
+// SPEC §4.4.3 step 4: declaration narrowing lives in manifest-decl.ts.
 function manifestError(detail) {
     return err(makeError("CDX-E203", `pack manifest is invalid: ${detail}`, "Fix the pack.json so it matches schema/pack.schema.json, then reload the pack."));
 }

package/dist/features/packs/selftest.js

@@ -76,7 +76,7 @@ function resolveEnforcer(pack, rule) {
     }
     return undefined;
 }
-async function selfTestRule(pack, rule) {
+function checkRuleMetadata(rule) {
     if (rule.fixtures.violating.length === 0) {
         return err(makeError("CDX-E211", `rule "${rule.id}" has no violating fixture`, "Add a violating fixture under fixtures/<rule-slug>/violating/, then re-run the self-test."));
     }
@@ -89,10 +89,9 @@ async function selfTestRule(pack, rule) {
             return err(checked.error);
         }
     }
-    const enforcer = resolveEnforcer(pack, rule);
-    if (enforcer === undefined) {
-        return err(makeError("CDX-E205", `rule "${rule.id}" names unknown enforcer "${rule.enforcer}"`, "Declare the enforcer in the pack or use a built-in parametric enforcer (§4.4.6), then re-run the self-test."));
-    }
+    return ok(undefined);
+}
+async function checkViolatingFixtures(enforcer, rule) {
     for (const name of rule.fixtures.violating) {
         const ran = await runCase(enforcer, rule, name);
         if (!ran.ok) {
@@ -102,6 +101,9 @@ async function selfTestRule(pack, rule) {
             return err(makeError("CDX-E212", `rule "${rule.id}" violating fixture "${name}" yielded no finding with this rule id`, "Strengthen the enforcer so the violating case blocks, then re-run the self-test."));
         }
     }
+    return ok(undefined);
+}
+async function checkPassingFixtures(enforcer, rule) {
     for (const name of rule.fixtures.passing) {
         const ran = await runCase(enforcer, rule, name);
         if (!ran.ok) {
@@ -113,6 +115,21 @@ async function selfTestRule(pack, rule) {
     }
     return ok(undefined);
 }
+async function selfTestRule(pack, rule) {
+    const metadata = checkRuleMetadata(rule);
+    if (!metadata.ok) {
+        return err(metadata.error);
+    }
+    const enforcer = resolveEnforcer(pack, rule);
+    if (enforcer === undefined) {
+        return err(makeError("CDX-E205", `rule "${rule.id}" names unknown enforcer "${rule.enforcer}"`, "Declare the enforcer in the pack or use a built-in parametric enforcer (§4.4.6), then re-run the self-test."));
+    }
+    const violating = await checkViolatingFixtures(enforcer, rule);
+    if (!violating.ok) {
+        return err(violating.error);
+    }
+    return checkPassingFixtures(enforcer, rule);
+}
 // SPEC §4.4.4: self-test every rule against its fixtures before use. Rules
 // run in id order so the first failure is deterministic.
 export async function selfTest(pack) {

package/dist/features/remediation/adoption.js

@@ -3,39 +3,50 @@
 // through its ports, so this module never touches the OS (SPEC §3.3).
 import { makeError } from "../../kernel/index.js";
 import { detectUpgradeBots, evaluateDepVerdicts, isExactNpmPin, manifestToEval, parsePackageJson, } from "../deps/index.js";
-// SPEC §4.13.1 steps 1–2: brownfield signals are loose pins (floor) and
-// manifests without a committed lockfile. Bot detection follows §4.8.6.
-export function detectBrownfield(input) {
-    const bot = detectUpgradeBots(input.files);
-    const loosePins = [];
-    for (const manifest of input.manifests) {
-        const parsed = parsePackageJson(manifest.text);
-        if (!parsed.ok) {
-            continue;
-        }
-        for (const dep of parsed.value.dependencies) {
-            if (dep.kind !== "peer" && !isExactNpmPin(dep.range)) {
-                loosePins.push({
-                    path: manifest.path,
-                    name: dep.name,
-                    range: dep.range,
-                });
-            }
+function collectManifestLoosePins(manifest, loosePins) {
+    const parsed = parsePackageJson(manifest.text);
+    if (!parsed.ok) {
+        return;
+    }
+    for (const dep of parsed.value.dependencies) {
+        if (dep.kind !== "peer" && !isExactNpmPin(dep.range)) {
+            loosePins.push({
+                path: manifest.path,
+                name: dep.name,
+                range: dep.range,
+            });
         }
     }
-    loosePins.sort((left, right) => left.path < right.path
-        ? -1
-        : left.path > right.path
-            ? 1
-            : left.name < right.name
-                ? -1
-                : left.name > right.name
-                    ? 1
-                    : 0);
-    const missingLockfiles = input.manifests
-        .filter((manifest) => input.lockfiles[manifest.path] === null)
+}
+function compareLoosePins(left, right) {
+    if (left.path !== right.path) {
+        return left.path < right.path ? -1 : 1;
+    }
+    if (left.name !== right.name) {
+        return left.name < right.name ? -1 : 1;
+    }
+    return 0;
+}
+function collectLoosePins(manifests) {
+    const loosePins = [];
+    for (const manifest of manifests) {
+        collectManifestLoosePins(manifest, loosePins);
+    }
+    loosePins.sort(compareLoosePins);
+    return loosePins;
+}
+function missingManifestLockfiles(manifests, lockfiles) {
+    return manifests
+        .filter((manifest) => lockfiles[manifest.path] === null)
         .map((manifest) => manifest.path)
         .sort();
+}
+// SPEC §4.13.1 steps 1–2: brownfield signals are loose pins (floor) and
+// manifests without a committed lockfile. Bot detection follows §4.8.6.
+export function detectBrownfield(input) {
+    const bot = detectUpgradeBots(input.files);
+    const loosePins = collectLoosePins(input.manifests);
+    const missingLockfiles = missingManifestLockfiles(input.manifests, input.lockfiles);
     const evaluated = evaluateDepVerdicts({
         manifests: input.manifests.map((manifest) => {
             const parsed = parsePackageJson(manifest.text);