codictator 0.1.2 → 0.2.0

package/dist/features/deps/stable.js

@@ -14,24 +14,37 @@ export const DEFAULT_DEP_LAG_PARAMS = {
 // SPEC §6.1: an exact pin is a full x.y.z with an optional -pre suffix;
 // compare follows npm version order (numeric parts first, release beats
 // prerelease, prerelease identifiers numeric then lexical).
+// The pattern lives at module scope so its quantifiers never count as
+// branches of the function that applies it.
+const NPM_VERSION_PATTERN = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/;
+function versionPart(match, index) {
+    return Number(match[index] ?? "");
+}
+function narrowVersionParts(match) {
+    const major = versionPart(match, 1);
+    const minor = versionPart(match, 2);
+    const patch = versionPart(match, 3);
+    if (!Number.isSafeInteger(major) ||
+        !Number.isSafeInteger(minor) ||
+        !Number.isSafeInteger(patch)) {
+        return undefined;
+    }
+    return { major, minor, patch };
+}
 export function parseNpmVersion(value) {
-    const match = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(value);
+    const match = NPM_VERSION_PATTERN.exec(value);
     if (match === null) {
         return undefined;
     }
-    const major = Number(match[1] ?? "");
-    const minor = Number(match[2] ?? "");
-    const patch = Number(match[3] ?? "");
-    if (!Number.isSafeInteger(major) ||
-        !Number.isSafeInteger(minor) ||
-        !Number.isSafeInteger(patch)) {
+    const parts = narrowVersionParts(match);
+    if (parts === undefined) {
         return undefined;
     }
     const pre = match[4];
     if (pre === undefined || pre === "") {
-        return { major, minor, patch, prerelease: undefined };
+        return { ...parts, prerelease: undefined };
     }
-    return { major, minor, patch, prerelease: pre.split(".") };
+    return { ...parts, prerelease: pre.split(".") };
 }
 export function isNpmPrerelease(value) {
     const parsed = parseNpmVersion(value);
@@ -65,12 +78,13 @@ function compareIdentifiers(left, right) {
     }
     return 0;
 }
-export function compareNpmVersions(left, right) {
-    for (const pair of [
+function compareVersionCore(left, right) {
+    const pairs = [
         [left.major, right.major],
         [left.minor, right.minor],
         [left.patch, right.patch],
-    ]) {
+    ];
+    for (const pair of pairs) {
         if (pair[0] < pair[1]) {
             return -1;
         }
@@ -78,29 +92,40 @@ export function compareNpmVersions(left, right) {
             return 1;
         }
     }
-    if (left.prerelease === undefined && right.prerelease === undefined) {
-        return 0;
+    return 0;
+}
+function prereleaseOrderAt(left, right, index) {
+    const leftId = left[index];
+    const rightId = right[index];
+    if (leftId === undefined) {
+        return -1;
     }
-    if (left.prerelease === undefined) {
+    if (rightId === undefined) {
         return 1;
     }
-    if (right.prerelease === undefined) {
+    const order = compareIdentifiers(leftId, rightId);
+    return order === 0 ? undefined : order;
+}
+function comparePrerelease(left, right) {
+    if (left === undefined) {
+        return right === undefined ? 0 : 1;
+    }
+    if (right === undefined) {
         return -1;
     }
-    const length = Math.max(left.prerelease.length, right.prerelease.length);
+    const length = Math.max(left.length, right.length);
     for (let index = 0; index < length; index += 1) {
-        const leftId = left.prerelease[index];
-        const rightId = right.prerelease[index];
-        if (leftId === undefined) {
-            return -1;
-        }
-        if (rightId === undefined) {
-            return 1;
-        }
-        const order = compareIdentifiers(leftId, rightId);
-        if (order !== 0) {
+        const order = prereleaseOrderAt(left, right, index);
+        if (order !== undefined) {
             return order;
         }
     }
     return 0;
 }
+export function compareNpmVersions(left, right) {
+    const core = compareVersionCore(left, right);
+    if (core !== 0) {
+        return core;
+    }
+    return comparePrerelease(left.prerelease, right.prerelease);
+}

package/dist/features/deps/upgrade.d.ts

@@ -30,6 +30,6 @@ export interface UpgradeHost {
     readonly push: (branch: string) => Promise<Result<void>>;
 }
 export declare function upgradeCommitSubject(name: string, from: string, to: string): string;
-export declare function upgradeHistoryEntry(date: string, subject: string, name: string, from: string, to: string, task: string, advisoryIds: ReadonlyArray<string>): string;
+export declare function upgradeHistoryEntry(date: string, commitSubject: string, name: string, from: string, to: string, task: string, advisoryIds: ReadonlyArray<string>): string;
 export declare function planUpgradePr(input: UpgradePrInput): Result<UpgradePrPlan>;
 export declare function runUpgradePr(plan: UpgradePrPlan, host: UpgradeHost): Promise<Result<UpgradePrPlan>>;

package/dist/features/deps/upgrade.js

@@ -12,10 +12,10 @@ export function upgradeCommitSubject(name, from, to) {
 }
 // SPEC §7.7: a deps entry carries Kind, Task, Why and one Deps line per
 // change in the added, upgraded or removed form.
-export function upgradeHistoryEntry(date, subject, name, from, to, task, advisoryIds) {
+export function upgradeHistoryEntry(date, commitSubject, name, from, to, task, advisoryIds) {
     const rendered = advisoryIds.length === 0 ? "none" : [...advisoryIds].sort().join(", ");
     return [
-        `## ${date} · ${subject}`,
+        `## ${date} · ${commitSubject}`,
         `- **Kind:** deps`,
         `- **Task:** ${task}`,
         `- **Why:** L5 sweep upgrades ${name} to latest stable ${to} (SPEC §4.8.7).`,
@@ -54,25 +54,19 @@ function appendHistoryEntry(historyText, date, entry) {
     }
     return `${title}\n\n${entry}\n\n${rest.endsWith("\n") ? rest : `${rest}\n`}`;
 }
-// SPEC §4.8.7: the PR holds the manifest edit, the regenerated lockfile and
-// its history entry. The lockfile bytes come from the caller (regenerated by
-// the ecosystem tool); without them the plan holds manifest plus history.
-export function planUpgradePr(input) {
-    if (!/^\d{4}-\d{2}-\d{2}$/.test(input.date)) {
-        return {
-            ok: false,
-            error: makeError("CDX-E903", `upgrade date ${input.date} is not a UTC YYYY-MM-DD date`, "Pass the commit date in UTC as YYYY-MM-DD."),
-        };
+function checkUpgradeDate(date) {
+    if (/^\d{4}-\d{2}-\d{2}$/.test(date)) {
+        return { ok: true, value: date };
     }
-    const bumped = bumpManifestPin(input.manifestText, input.name, input.from, input.to);
-    if (!bumped.ok) {
-        return bumped;
-    }
-    const subject = upgradeCommitSubject(input.name, input.from, input.to);
-    const entry = upgradeHistoryEntry(input.date, subject, input.name, input.from, input.to, input.task ?? "none", input.advisoryIds ?? []);
+    return {
+        ok: false,
+        error: makeError("CDX-E903", `upgrade date ${date} is not a UTC YYYY-MM-DD date`, "Pass the commit date in UTC as YYYY-MM-DD."),
+    };
+}
+function upgradePlanFiles(input, manifestText, entry) {
     const historyPath = input.historyPath ?? `docs/HISTORY/${input.date.slice(0, 10)}.md`;
     const files = [
-        { path: input.manifestPath, text: bumped.value },
+        { path: input.manifestPath, text: manifestText },
         {
             path: historyPath,
             text: appendHistoryEntry(input.historyText, input.date, entry),
@@ -81,12 +75,28 @@ export function planUpgradePr(input) {
     if (input.lockfilePath !== undefined && input.lockfileText !== undefined) {
         files.push({ path: input.lockfilePath, text: input.lockfileText });
     }
+    return files;
+}
+// SPEC §4.8.7: the PR holds the manifest edit, the regenerated lockfile and
+// its history entry. The lockfile bytes come from the caller (regenerated by
+// the ecosystem tool); without them the plan holds manifest plus history.
+export function planUpgradePr(input) {
+    const dated = checkUpgradeDate(input.date);
+    if (!dated.ok) {
+        return dated;
+    }
+    const bumped = bumpManifestPin(input.manifestText, input.name, input.from, input.to);
+    if (!bumped.ok) {
+        return bumped;
+    }
+    const subject = upgradeCommitSubject(input.name, input.from, input.to);
+    const entry = upgradeHistoryEntry(input.date, subject, input.name, input.from, input.to, input.task ?? "none", input.advisoryIds ?? []);
     return {
         ok: true,
         value: {
             branch: upgradeBranchName(input.ecosystem, input.name, input.to),
             subject,
-            files,
+            files: upgradePlanFiles(input, bumped.value, entry),
         },
     };
 }

package/dist/features/engine/evaluate.js

@@ -93,7 +93,12 @@ function ruleIdsOf(findings) {
 }
 async function collectFindings(ordered, ctx, store) {
     const runnable = ordered.filter((enforcer) => enforcer.kinds.includes(ctx.trigger));
-    const ran = await Promise.all(runnable.map((enforcer) => runEnforcer(enforcer, ctx)));
+    // SPEC §4.3.3 step 2: bounded concurrency — one guard at a time keeps every
+    // guard's event-loop share (no E902 herd); sortFindings keeps the verdict byte-identical (§4.3.6).
+    const ran = [];
+    for (const enforcer of runnable) {
+        ran.push(await runEnforcer(enforcer, ctx));
+    }
     return applyWaivers(sortFindings(ran.flat()), store, ctx.now);
 }
 function decideDecision(kept, trigger) {

package/dist/features/packs/enforcers/ci-guards.js

@@ -110,7 +110,10 @@ export function resolveConventionalCommit(decl, rule, ports) {
         const findings = [];
         for (const file of selectFiles(ctx.scope.files, binding.scopeGlobs)) {
             const text = await loadScopeText(ports, binding, file, findings);
-            if (text === undefined) {
+            // Commit subjects arrive as marker reports (SPEC §4.4.1
+            // sample.txt fixtures); source files carry `subject:` lines
+            // of their own (parameters, YAML keys), which are not commits.
+            if (text === undefined || !isMarkerFile(file)) {
                 continue;
             }
             const subject = parseMarkers(text).get("subject") ?? "";

package/dist/features/packs/enforcers/code.js

@@ -6,7 +6,8 @@ import { resolveDepExactPin, resolveDepLatestStable, resolveDepLockfile, resolve
 import { resolveDepLicense, resolveDepNoDeprecated, resolveDepNoVulnerable, resolveDepOnePerCapability, } from "./deps-policy-guards.js";
 import { resolveDocNoCorpusCounts, resolveDocOneLevel, resolveDocPlacement, resolveDocRouterLeaf, resolveDocSingleOwner, } from "./docs-guards.js";
 import { resolveDocBreadth, resolveDocDensity, resolveDocLinksValid, resolveDocNoInlineChangelog, } from "./docs-guards-measures.js";
-import { resolveAgentAssetsPresent, resolveCustomPackSelftest, resolveEngineVersionMatch, resolveGuardrailManifest, resolveHooksActive, resolvePerfBudgets, resolveWaiversValid, } from "./gate-guards.js";
+import { resolveEngineVersionMatch } from "./engine-version-guards.js";
+import { resolveAgentAssetsPresent, resolveCustomPackSelftest, resolveGuardrailManifest, resolveHooksActive, resolvePerfBudgets, resolveWaiversValid, } from "./gate-guards.js";
 import { resolveNoSpeculativeAbstraction } from "./health-abstraction.js";
 import { resolveDuplication } from "./health-duplication.js";
 import { resolveDeadCode } from "./health-refs.js";

package/dist/features/packs/enforcers/engine-version-guards.d.ts

@@ -0,0 +1,6 @@
+import type { Ports } from "../../../kernel/index.ts";
+import { type Result } from "../../../kernel/index.ts";
+import type { Enforcer } from "../../engine/index.ts";
+import type { PackRule } from "../index.ts";
+import type { EnforcerDecl } from "../manifest.ts";
+export declare function resolveEngineVersionMatch(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;

package/dist/features/packs/enforcers/engine-version-guards.js

@@ -0,0 +1,42 @@
+import { parseJson } from "../../../kernel/index.js";
+import { findingFor, readErrorFinding, selectFiles, } from "./binding.js";
+import { checkEnforcer, loadScopeText } from "./health-measures.js";
+async function checkEngineVersionFile(ports, binding, file, findings) {
+    const text = await loadScopeText(ports, binding, file, findings);
+    if (text === undefined) {
+        return;
+    }
+    const parsed = parseJson(text);
+    if (!parsed.ok) {
+        findings.push(readErrorFinding(binding, file, parsed.error, "parse"));
+        return;
+    }
+    const record = (typeof parsed.value === "object" && parsed.value !== null
+        ? parsed.value
+        : {});
+    if (typeof record.engine !== "string" ||
+        typeof record.pack !== "string" ||
+        record.engine === record.pack) {
+        return;
+    }
+    findings.push(findingFor(binding, {
+        path: file,
+        message: `pack version ${record.pack} does not match the engine ${record.engine}`,
+        vars: { path: file, value: record.engine },
+    }));
+}
+async function checkEngineVersionFiles(ports, binding, ctx) {
+    const findings = [];
+    for (const file of selectFiles(ctx.scope.files, binding.scopeGlobs)) {
+        if (file !== "engine.json" && !file.endsWith("/engine.json")) {
+            continue;
+        }
+        await checkEngineVersionFile(ports, binding, file, findings);
+    }
+    return findings;
+}
+// SPEC §4.14.2 core/engine-version-match: the declared version must equal
+// the installed engine; a pack ahead of the engine flags.
+export function resolveEngineVersionMatch(decl, rule, ports) {
+    return checkEnforcer(decl, rule, (binding, ctx) => checkEngineVersionFiles(ports, binding, ctx));
+}

package/dist/features/packs/enforcers/external-bind.js

@@ -15,17 +15,20 @@ function stringList(value) {
     }
     return undefined;
 }
-// SPEC §7.2: a tools entry needs an id, an argv command and an exact pin
-// with its probe. CDX-E206 when the pin is missing (§8).
-export function narrowToolDecl(entry) {
-    if (!isRecord(entry)) {
-        return toolError("CDX-E203", "a config.tools entry must be an object");
-    }
+function narrowTimeoutMs(timeout) {
+    return typeof timeout === "number" && Number.isInteger(timeout) && timeout > 0
+        ? timeout
+        : DEFAULT_TIMEOUT_MS;
+}
+function narrowToolIdentity(entry) {
     const id = field(entry, "id");
     const command = stringList(field(entry, "command")) ?? [];
     if (typeof id !== "string" || id.length === 0 || command.length === 0) {
         return toolError("CDX-E203", "a config.tools entry needs a non-empty id and command argv");
     }
+    return ok({ id, command });
+}
+function narrowToolVersion(entry, id) {
     const version = field(entry, "version");
     if (!isRecord(version)) {
         return toolError("CDX-E206", `tool "${id}" has no exact version pin`);
@@ -41,47 +44,78 @@ export function narrowToolDecl(entry) {
         pattern.length === 0) {
         return toolError("CDX-E203", `tool "${id}" needs a probe argv and a pattern`);
     }
+    return ok({ pin, probe, pattern });
+}
+// SPEC §7.2: a tools entry needs an id, an argv command and an exact pin
+// with its probe. CDX-E206 when the pin is missing (§8).
+export function narrowToolDecl(entry) {
+    if (!isRecord(entry)) {
+        return toolError("CDX-E203", "a config.tools entry must be an object");
+    }
+    const identity = narrowToolIdentity(entry);
+    if (!identity.ok) {
+        return identity;
+    }
+    const version = narrowToolVersion(entry, identity.value.id);
+    if (!version.ok) {
+        return version;
+    }
     const role = field(entry, "role");
     if (typeof role === "string" && role !== "enforcer") {
-        return toolError("CDX-E203", `tool "${id}" is a helper and cannot back an enforcer`);
+        return toolError("CDX-E203", `tool "${identity.value.id}" is a helper and cannot back an enforcer`);
     }
     const timeout = field(entry, "timeoutMs");
     const envPass = stringList(field(entry, "envPass")) ?? [];
     return ok({
-        id,
-        command,
-        version: { pin, probe, pattern },
+        id: identity.value.id,
+        command: identity.value.command,
+        version: version.value,
         role: typeof role === "string" ? role : undefined,
-        timeoutMs: typeof timeout === "number" && Number.isInteger(timeout) && timeout > 0
-            ? timeout
-            : DEFAULT_TIMEOUT_MS,
+        timeoutMs: narrowTimeoutMs(timeout),
         envPass,
     });
 }
+function narrowOutputFormat(value, withId) {
+    if (value === "sarif" ||
+        value === "json" ||
+        value === "regex" ||
+        value === "exit-code") {
+        return ok(value);
+    }
+    return withId("needs an output format of sarif, json, regex or exit-code");
+}
+function narrowOutputSource(value, withId) {
+    const source = value ?? "stdout";
+    if (source === "stdout" || source === "{out}") {
+        return ok(source);
+    }
+    return withId("needs an output source of stdout or {out}");
+}
 function narrowOutput(declId, value) {
     if (!isRecord(value)) {
         return toolError(declId, "needs an output binding");
     }
     const withId = (detail) => toolError("CDX-E203", `pack enforcer "${declId}" ${detail}`);
-    const format = field(value, "format");
-    if (format !== "sarif" &&
-        format !== "json" &&
-        format !== "regex" &&
-        format !== "exit-code") {
-        return withId("needs an output format of sarif, json, regex or exit-code");
+    const format = narrowOutputFormat(field(value, "format"), withId);
+    if (!format.ok) {
+        return format;
     }
-    const source = field(value, "source") ?? "stdout";
-    if (source !== "stdout" && source !== "{out}") {
-        return withId("needs an output source of stdout or {out}");
+    const source = narrowOutputSource(field(value, "source"), withId);
+    if (!source.ok) {
+        return source;
     }
-    const output = source === "{out}" ? "{out}" : "stdout";
-    if (format === "json") {
-        return narrowJsonSelect(withId, format, output, field(value, "select"));
+    if (format.value === "json") {
+        return narrowJsonSelect(withId, format.value, source.value, field(value, "select"));
     }
-    if (format === "regex") {
-        return narrowRegexPattern(withId, format, output, field(value, "pattern"));
+    if (format.value === "regex") {
+        return narrowRegexPattern(withId, format.value, source.value, field(value, "pattern"));
     }
-    return ok({ format, source: output, select: undefined, pattern: undefined });
+    return ok({
+        format: format.value,
+        source: source.value,
+        select: undefined,
+        pattern: undefined,
+    });
 }
 function narrowJsonSelect(withId, format, output, select) {
     if (!isRecord(select)) {

package/dist/features/packs/enforcers/external-sarif.js

@@ -59,6 +59,35 @@ function sarifLocation(result) {
     }
     return { path: uri, line };
 }
+function collectSarifEntry(entry, run, findings, escapes) {
+    if (!isRecord(entry)) {
+        return;
+    }
+    const toolRule = sarifRuleId(entry, run);
+    if (toolRule === undefined) {
+        return;
+    }
+    const location = sarifLocation(entry);
+    const detail = field(entry, "message");
+    pushEntry(findings, escapes, {
+        toolRule,
+        path: location.path,
+        line: location.line,
+        message: isRecord(detail) ? field(detail, "text") : undefined,
+    });
+}
+function collectSarifRun(run, findings, escapes) {
+    if (!isRecord(run)) {
+        return;
+    }
+    const results = field(run, "results");
+    if (!Array.isArray(results)) {
+        return;
+    }
+    for (const entry of results) {
+        collectSarifEntry(entry, run, findings, escapes);
+    }
+}
 export function parseSarif(text) {
     const parsed = parseJson(text);
     if (!parsed.ok) {
@@ -74,30 +103,7 @@ export function parseSarif(text) {
     const findings = [];
     const escapes = { count: 0 };
     for (const run of runs) {
-        if (!isRecord(run)) {
-            continue;
-        }
-        const results = field(run, "results");
-        if (!Array.isArray(results)) {
-            continue;
-        }
-        for (const entry of results) {
-            if (!isRecord(entry)) {
-                continue;
-            }
-            const toolRule = sarifRuleId(entry, run);
-            if (toolRule === undefined) {
-                continue;
-            }
-            const location = sarifLocation(entry);
-            const detail = field(entry, "message");
-            pushEntry(findings, escapes, {
-                toolRule,
-                path: location.path,
-                line: location.line,
-                message: isRecord(detail) ? field(detail, "text") : undefined,
-            });
-        }
+        collectSarifRun(run, findings, escapes);
     }
     return ok({ findings, escapes: escapes.count });
 }

package/dist/features/packs/enforcers/gate-guards.d.ts

@@ -7,6 +7,5 @@ export declare function resolveAgentAssetsPresent(decl: EnforcerDecl, rule: Pack
 export declare function resolvePerfBudgets(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;
 export declare function resolveGuardrailManifest(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;
 export declare function resolveHooksActive(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;
-export declare function resolveEngineVersionMatch(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;
 export declare function resolveWaiversValid(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;
 export declare function resolveCustomPackSelftest(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;