domainforge 0.13.0

package/scripts/lint_workflow_gates.py

@@ -0,0 +1,113 @@
+#!/usr/bin/env python3
+"""Check that release workflow gates are correct.
+
+Verifies:
+- Every upload-artifact job is referenced in create-release needs
+- Dependabot automerge does not treat empty check results as success
+"""
+import sys
+from pathlib import Path
+
+try:
+    import yaml
+except ImportError:
+    print("PyYAML is required: pip install pyyaml")
+    sys.exit(1)
+
+
+def check_artifact_gates(path):
+    errors = []
+    with open(path) as f:
+        wf = yaml.safe_load(f)
+
+    if wf is None:
+        return []
+
+    jobs = wf.get("jobs", {})
+    create_release = jobs.get("create-release", {})
+    needs = create_release.get("needs", [])
+    if isinstance(needs, str):
+        needs = [needs]
+
+    for job_name, job in jobs.items():
+        if job_name == "create-release":
+            continue
+        steps = job.get("steps", [])
+        has_upload = any(
+            "upload-artifact" in str(step.get("uses", ""))
+            for step in steps
+        )
+        if has_upload and job_name not in needs:
+            errors.append(
+                f"{path.name}: job '{job_name}' uploads artifacts "
+                f"but is not in create-release needs (found: {needs})"
+            )
+
+    return errors
+
+
+def check_dependabot_gates(path):
+    errors = []
+    if "dependabot" not in path.name:
+        return []
+
+    with open(path) as f:
+        wf = yaml.safe_load(f)
+
+    if wf is None:
+        return []
+
+    for job_name, job in wf.get("jobs", {}).items():
+        for step in job.get("steps", []):
+            run = step.get("run", "")
+            if not isinstance(run, str):
+                continue
+            if "checks" in run.lower() or "status" in run.lower():
+                if "[]" in run and "exit 0" not in run.split("[]")[0]:
+                    lines_after = run.split("[]")
+                    remaining = lines_after[1] if len(lines_after) > 1 else ""
+                    if 'exit 0' in remaining and 'exit 1' not in remaining:
+                        continue
+
+                has_empty_fail = "[]" in run and "exit 1" in run
+                if not has_empty_fail:
+                    if "[]" in run:
+                        next_chunk = run.split("[]", 1)[1] if "[]" in run else ""
+                        if "exit 1" not in next_chunk:
+                            has_rejection = "no check" in run.lower() and "exit 1" in run
+                            if not has_rejection:
+                                errors.append(
+                                    f"{path.name}:{job_name}: "
+                                    f"dependabot check may treat empty [] as success "
+                                    f"without explicit failure"
+                                )
+
+    return errors
+
+
+def main():
+    workflows_dir = Path(".github/workflows")
+    if not workflows_dir.exists():
+        print("No .github/workflows directory found")
+        sys.exit(0)
+
+    all_errors = []
+    for wf in sorted(workflows_dir.glob("*.yml")):
+        all_errors.extend(check_artifact_gates(wf))
+        all_errors.extend(check_dependabot_gates(wf))
+    for wf in sorted(workflows_dir.glob("*.yaml")):
+        all_errors.extend(check_artifact_gates(wf))
+        all_errors.extend(check_dependabot_gates(wf))
+
+    if all_errors:
+        print("Workflow gate lint FAILURES:")
+        for e in all_errors:
+            print(f"  - {e}")
+        sys.exit(1)
+    else:
+        print("All workflow gate lints passed")
+        sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()

package/scripts/optimized-wasm-build.sh

@@ -0,0 +1,61 @@
+#!/bin/bash
+set -e
+
+# optimized-wasm-build.sh
+# Performs a production build of the domainforge-core WASM bundle with SAFE optimizations.
+
+echo "🚀 Starting Optimized WASM Build..."
+
+# 1. Clean previous builds
+echo "🧹 Cleaning previous artifacts..."
+cargo clean -p domainforge-core --target wasm32-unknown-unknown
+
+# 2. Build with wasm-pack
+# Note: Profile configuration in domainforge-core/Cargo.toml now enables wasm-opt
+echo "🏗️  Building with wasm-pack (Release mode)..."
+# Using --target web as a standard default, can be changed to --target nodejs if needed
+wasm-pack build domainforge-core --target web --release --features wasm
+
+# 3. Explicit Optimization (Verification Step)
+# Even though we enabled it in Cargo.toml, running it explicitly ensures it happens
+# and allows us to see the output stats.
+WASM_FILE="domainforge-core/pkg/domainforge_core_bg.wasm"
+OPTIMIZED_FILE="domainforge-core/pkg/domainforge_core_bg.optimized.wasm"
+
+if command -v wasm-opt >/dev/null 2>&1; then
+    echo "🔧 Running explicit wasm-opt -Oz..."
+    wasm-opt -Oz -o "$OPTIMIZED_FILE" "$WASM_FILE"
+    
+    # Compare sizes
+    ORIG_SIZE=$(stat -c%s "$WASM_FILE")
+    OPT_SIZE=$(stat -c%s "$OPTIMIZED_FILE")
+    
+    echo "📊 Size Report:"
+    echo "   Original: $(numfmt --to=iec-i --suffix=B $ORIG_SIZE)"
+    echo "   Optimized: $(numfmt --to=iec-i --suffix=B $OPT_SIZE)"
+    
+    # Replace if smaller
+    if [ $OPT_SIZE -lt $ORIG_SIZE ]; then
+        echo "✅ Optimization successful! Replacing original file."
+        mv "$OPTIMIZED_FILE" "$WASM_FILE"
+    else
+        echo "⚠️  Optimization did not reduce size. Keeping original."
+        rm "$OPTIMIZED_FILE"
+    fi
+else
+    echo "⚠️  'wasm-opt' not found in PATH. Skipping explicit optimization step."
+    echo "   (Note: wasm-pack usually runs this internally if configured)"
+fi
+
+# 4. Final Size Check
+FINAL_SIZE=$(stat -c%s "$WASM_FILE")
+MAX_SIZE=$((2048 * 1024)) # 2 MB
+
+echo "----------------------------------------"
+echo "🏁 Final Bundle Size: $(numfmt --to=iec-i --suffix=B $FINAL_SIZE)"
+if [ $FINAL_SIZE -gt $MAX_SIZE ]; then
+    echo "❌ WARNING: Bundle exceeds 0.5 MB limit!"
+else
+    echo "✅ SUCCESS: Bundle is under 0.5 MB limit."
+fi
+echo "----------------------------------------"

package/scripts/patch_napi_types.py

@@ -0,0 +1,62 @@
+#!/usr/bin/env python3
+"""Post-build patcher for napi-rs generated index.d.ts.
+
+napi-rs auto-generates index.d.ts with two known issues that must be fixed
+after each `napi build`:
+
+1. `Self | null` — napi-rs generates `Self` for `Option<Self>` return types
+   on class methods. TypeScript consumers need the concrete class name.
+2. `function:` — Rust parameter names that are JS reserved words get emitted
+   verbatim. We patch them to safe names.
+
+This script is idempotent and safe to run multiple times.
+"""
+
+import re
+import sys
+from pathlib import Path
+
+DECL_FILE = Path("index.d.ts")
+
+# Patches: (pattern, replacement)
+PATCHES = [
+    # Fix `Self | null` → `NamespaceRegistry | null` in discover() return type
+    (
+        r"static discover\(path: string\): Self \| null",
+        r"static discover(path: string): NamespaceRegistry | null",
+    ),
+    # Fix reserved-word `function:` param → `aggregateFunction:`
+    (
+        r"aggregationComprehension\(function:",
+        r"aggregationComprehension(aggregateFunction:",
+    ),
+]
+
+
+def patch_file(path: Path) -> int:
+    if not path.exists():
+        print(f"ERROR: {path} not found", file=sys.stderr)
+        return 1
+
+    original = path.read_text(encoding="utf-8")
+    patched = original
+    changes = 0
+
+    for pattern, replacement in PATCHES:
+        new_text = re.sub(pattern, replacement, patched)
+        if new_text != patched:
+            changes += 1
+            patched = new_text
+
+    if changes > 0:
+        path.write_text(patched, encoding="utf-8")
+        print(f"Patched {changes} issue(s) in {path}")
+    else:
+        print(f"No patches needed for {path}")
+
+    return 0
+
+
+if __name__ == "__main__":
+    target = Path(sys.argv[1]) if len(sys.argv) > 1 else DECL_FILE
+    sys.exit(patch_file(target))

package/scripts/pre-release-check.sh

@@ -0,0 +1,289 @@
+#!/usr/bin/env bash
+# pre-release-check.sh - Pre-flight validation for releases
+# Usage: ./scripts/pre-release-check.sh [--dry-run]
+#
+# Validates the repository is ready for a release:
+# - No uncommitted changes
+# - On correct branch (main, release/*)
+# - All tests pass
+# - Version files are in sync
+# - CHANGELOG.md is up to date
+
+set -euo pipefail
+
+# ============================================================================
+# Configuration
+# ============================================================================
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m' # No Color
+
+# Flags
+DRY_RUN=false
+VERBOSE=false
+
+# ============================================================================
+# Helper Functions
+# ============================================================================
+log_info() {
+    echo -e "${BLUE}[INFO]${NC} $1"
+}
+
+log_success() {
+    echo -e "${GREEN}[✓]${NC} $1"
+}
+
+log_warn() {
+    echo -e "${YELLOW}[WARN]${NC} $1"
+}
+
+log_error() {
+    echo -e "${RED}[✗]${NC} $1"
+}
+
+log_step() {
+    echo -e "${BLUE}[STEP]${NC} $1"
+}
+
+usage() {
+    cat <<EOF
+Usage: $(basename "$0") [OPTIONS]
+
+Pre-release validation checks for DomainForge.
+
+OPTIONS:
+    --dry-run       Show what would be checked without running tests
+    --verbose       Show verbose output
+    --skip-tests    Skip running test suites (faster, less thorough)
+    -h, --help      Show this help message
+
+CHECKS PERFORMED:
+    1. Git status - no uncommitted changes
+    2. Branch validation - must be main or release/*
+    3. Latest changes pulled from remote
+    4. All test suites pass (Rust, Python, TypeScript)
+    5. Version consistency across Cargo.toml, pyproject.toml, package.json
+    6. CHANGELOG.md has entry for current version
+
+EXIT CODES:
+    0   All checks passed
+    1   One or more checks failed
+
+EXAMPLES:
+    $(basename "$0")              # Run full pre-release checks
+    $(basename "$0") --dry-run    # Preview what would be checked
+    $(basename "$0") --skip-tests # Skip running tests (faster)
+EOF
+}
+
+# ============================================================================
+# Parse Arguments
+# ============================================================================
+SKIP_TESTS=false
+
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        --dry-run)
+            DRY_RUN=true
+            shift
+            ;;
+        --verbose)
+            VERBOSE=true
+            shift
+            ;;
+        --skip-tests)
+            SKIP_TESTS=true
+            shift
+            ;;
+        -h|--help)
+            usage
+            exit 0
+            ;;
+        *)
+            log_error "Unknown option: $1"
+            usage
+            exit 1
+            ;;
+    esac
+done
+
+# ============================================================================
+# Checks
+# ============================================================================
+cd "$PROJECT_ROOT"
+
+FAILED=0
+
+echo ""
+echo "=============================================="
+echo "  DomainForge Pre-Release Checks"
+echo "=============================================="
+echo ""
+
+if $DRY_RUN; then
+    log_warn "DRY RUN MODE - Showing what would be checked"
+    echo ""
+fi
+
+# Check 1: Git status
+log_step "Checking git status for uncommitted changes..."
+if $DRY_RUN; then
+    log_info "Would run: git status --porcelain"
+else
+    if [[ -n $(git status --porcelain) ]]; then
+        log_error "Uncommitted changes detected:"
+        git status --short
+        FAILED=1
+    else
+        log_success "No uncommitted changes"
+    fi
+fi
+
+# Check 2: Branch validation
+log_step "Validating current branch..."
+if $DRY_RUN; then
+    log_info "Would check if branch matches: main or release/*"
+else
+    BRANCH=$(git rev-parse --abbrev-ref HEAD)
+    if [[ "$BRANCH" =~ ^(main|release/.*)$ ]]; then
+        log_success "On valid branch: $BRANCH"
+        if [[ "$BRANCH" != "main" ]]; then
+            log_warn "Release preparation is allowed on $BRANCH, but scripts/release.sh must be run from main after promotion."
+        fi
+    else
+        log_warn "On branch '$BRANCH' - releases typically done from main or release/*"
+        # Not a hard failure, just a warning
+    fi
+fi
+
+# Check 3: Pull latest changes
+log_step "Checking for latest changes from remote..."
+if $DRY_RUN; then
+    log_info "Would run: git fetch origin && git status -uno"
+else
+    git fetch origin --quiet 2>/dev/null || log_warn "Could not fetch from origin"
+    LOCAL=$(git rev-parse HEAD)
+    REMOTE=$(git rev-parse "@{u}" 2>/dev/null || echo "")
+    if [[ -z "$REMOTE" ]]; then
+        log_warn "No upstream branch set"
+    elif [[ "$LOCAL" != "$REMOTE" ]]; then
+        BEHIND=$(git rev-list --count HEAD..@{u} 2>/dev/null || echo "0")
+        if [[ "$BEHIND" -gt 0 ]]; then
+            log_warn "Branch is $BEHIND commits behind remote. Consider pulling."
+        fi
+    else
+        log_success "Up to date with remote"
+    fi
+fi
+
+# Check 4: Version consistency
+log_step "Checking version consistency across files..."
+if $DRY_RUN; then
+    log_info "Would compare versions in:"
+    log_info "  - domainforge-core/Cargo.toml"
+    log_info "  - pyproject.toml"
+    log_info "  - package.json"
+else
+    CARGO_VERSION=$(grep -m1 '^version = ' domainforge-core/Cargo.toml | sed 's/version = "\(.*\)"/\1/')
+    PYPROJECT_VERSION=$(grep -m1 '^version = ' pyproject.toml | sed 's/version = "\(.*\)"/\1/' | tr -d '\r')
+    PKG_VERSION=$(grep -m1 '"version"' package.json | sed 's/.*"\([0-9][^"]*\)".*/\1/')
+
+    log_info "Cargo.toml:    $CARGO_VERSION"
+    log_info "pyproject.toml: $PYPROJECT_VERSION"
+    log_info "package.json:   $PKG_VERSION"
+
+    if [[ "$CARGO_VERSION" == "$PYPROJECT_VERSION" && "$CARGO_VERSION" == "$PKG_VERSION" ]]; then
+        log_success "All versions match: $CARGO_VERSION"
+    else
+        log_error "Version mismatch across files!"
+        FAILED=1
+    fi
+fi
+
+# Check 5: CHANGELOG.md has entry for current version
+log_step "Checking CHANGELOG.md..."
+if $DRY_RUN; then
+    log_info "Would verify CHANGELOG.md contains entry for current version"
+else
+    if [[ -f "CHANGELOG.md" ]]; then
+        # Get the first version entry
+        FIRST_CHANGELOG_VERSION=$(grep -m1 '^\#\# \[' CHANGELOG.md | sed 's/.*\[\([0-9][^]]*\)\].*/\1/' || echo "")
+        if [[ -n "$FIRST_CHANGELOG_VERSION" ]]; then
+            if [[ "$FIRST_CHANGELOG_VERSION" == "$CARGO_VERSION" ]]; then
+                log_success "CHANGELOG.md has entry for current version ($CARGO_VERSION)"
+            else
+                log_warn "CHANGELOG.md top entry ($FIRST_CHANGELOG_VERSION) doesn't match current version ($CARGO_VERSION)"
+            fi
+        else
+            log_warn "Could not find version entry in CHANGELOG.md"
+        fi
+    else
+        log_error "CHANGELOG.md not found"
+        FAILED=1
+    fi
+fi
+
+# Check 6: Run tests
+if $SKIP_TESTS; then
+    log_step "Skipping tests (--skip-tests flag)"
+else
+    log_step "Running test suites..."
+    if $DRY_RUN; then
+        log_info "Would run: just all-tests (Rust + Python + TypeScript)"
+    else
+        if command -v just &> /dev/null; then
+            log_info "Running: just all-tests"
+            if just all-tests; then
+                log_success "All tests passed"
+            else
+                log_error "Tests failed"
+                FAILED=1
+            fi
+        else
+            log_warn "'just' not found, attempting individual test commands..."
+
+            # Try Rust tests
+            log_info "Running Rust tests..."
+            if cargo test -p domainforge-core --features cli; then
+                log_success "Rust tests passed"
+            else
+                log_error "Rust tests failed"
+                FAILED=1
+            fi
+        fi
+    fi
+fi
+
+# Check 7: Verify build works
+log_step "Verifying release build..."
+if $DRY_RUN; then
+    log_info "Would run: cargo build -p domainforge-core --release --features cli"
+else
+    if cargo build -p domainforge-core --release --features cli 2>/dev/null; then
+        log_success "Release build successful"
+    else
+        log_error "Release build failed"
+        FAILED=1
+    fi
+fi
+
+# ============================================================================
+# Summary
+# ============================================================================
+echo ""
+echo "=============================================="
+if [[ $FAILED -eq 0 ]]; then
+    log_success "All pre-release checks passed!"
+    echo "=============================================="
+    exit 0
+else
+    log_error "Some pre-release checks failed"
+    echo "=============================================="
+    exit 1
+fi

package/scripts/prepare_rust_debug.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+# Prepare rust test binary and update launch.json program path
+set -euo pipefail
+
+if [ -z "${1-}" ]; then
+  echo "Usage: $0 <test_name_prefix>"
+  echo "Example: $0 entity_tests"
+  exit 2
+fi
+
+PYTHON_BIN="${PYTHON_BIN:-python3}"
+if ! command -v "${PYTHON_BIN}" >/dev/null 2>&1; then
+  if command -v python >/dev/null 2>&1; then
+    PYTHON_BIN="python"
+  else
+    echo "python3 (or python) is required to update launch.json" >&2
+    exit 1
+  fi
+fi
+
+TESTNAME=$1
+ROOT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+SCRIPTS_DIR="$ROOT_DIR/scripts"
+
+echo "Preparing debug binary for: $TESTNAME"
+pushd "$ROOT_DIR" > /dev/null
+log_file="$(mktemp)"
+trap 'rm -f "$log_file"' EXIT
+if ! "$SCRIPTS_DIR/find_and_link_test_binary.sh" "$TESTNAME" | tee "$log_file"; then
+  echo "Error: failed to locate or link debug binary" >&2
+  exit 1
+fi
+link_path="$(grep -v '^[[:space:]]*$' "$log_file" | tail -n 1)"
+if [ -z "${link_path}" ]; then
+  echo "Error: linking script did not report the binary path" >&2
+  exit 1
+fi
+if [ ! -e "${link_path}" ]; then
+  echo "Error: linked binary not found at reported path: ${link_path}" >&2
+  exit 1
+fi
+if [ ! -f "${link_path}" ] && [ ! -L "${link_path}" ]; then
+  echo "Error: reported path is not a file or symlink: ${link_path}" >&2
+  exit 1
+fi
+trap - EXIT
+rm -f "$log_file"
+
+# Update launch.json program entry to point to the stable symlink
+"${PYTHON_BIN}" "$SCRIPTS_DIR/update_launch_program.py" --program "${link_path}"
+echo "Prepared debug program and updated launch.json"
+popd > /dev/null