etymd 0.14.0 → 0.16.0

package/dist/fleet-UEFLKIRI.js

@@ -0,0 +1,489 @@
+#!/usr/bin/env node
+import { dismiss, accept } from './chunk-HOR4M6EC.js';
+import { sweepFleet, FLEET_JSON_SCHEMA, checkManifest, FLEET_TRUST_VALUES, isFleetTrust, MILESTONES_FILE, parseMilestones, parseInitiatives, BOARD_JSON_SCHEMA, renderBoard, loadFleetManifest, fleetLedgerTarget, ensureFindingRecorded } from './chunk-ANXGT7V3.js';
+import './chunk-UV3YIBDW.js';
+import { parseFailOnTier, meetsFailOn } from './chunk-Y4E6ERCM.js';
+import './chunk-3E2IPCRY.js';
+import { print, theme, section, renderFleetRows, renderFleetNotes, renderFindings, TIER_BADGE, glyph } from './chunk-HI7NWPRA.js';
+import { scanProject } from './chunk-EJM47PIF.js';
+import './chunk-UYCGP5BS.js';
+import './chunk-P6ATKV2R.js';
+import './chunk-YQZDYDAK.js';
+import { readText, pathExists, git } from './chunk-4VPBP6K6.js';
+import { promises } from 'fs';
+import os from 'os';
+import path from 'path';
+import { select, isCancel, cancel, text, confirm } from '@clack/prompts';
+
+var LAST_SWEEP_FILE = "last.fleet.json";
+async function loadManifest(cwd, manifestOpt) {
+  if (manifestOpt) {
+    return { manifest: await loadFleetManifest(path.resolve(cwd, manifestOpt)) };
+  }
+  const candidate = path.join(cwd, "registry.json");
+  if (await pathExists(candidate)) {
+    return {
+      manifest: await loadFleetManifest(candidate),
+      autoNote: `manifest auto-selected from the cwd: ${candidate} (no --manifest given)`
+    };
+  }
+  throw new Error(
+    "no --manifest given and no registry.json in the current directory \u2014 pass --manifest <file> (there is deliberately no env var and no global pointer)"
+  );
+}
+async function readLastSweep(lastPath) {
+  const raw = await readText(lastPath);
+  if (raw === null) return { record: null };
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return {
+      record: null,
+      note: `${LAST_SWEEP_FILE} exists but is not valid JSON \u2014 delta baseline reset (every finding reads as new this sweep).`
+    };
+  }
+  const rec = parsed;
+  if (typeof rec !== "object" || rec === null || rec.schema !== FLEET_JSON_SCHEMA || typeof rec.projects !== "object" || rec.projects === null || Array.isArray(rec.projects) || !Array.isArray(rec.wall)) {
+    return {
+      record: null,
+      note: `${LAST_SWEEP_FILE} carries a foreign schema \u2014 delta baseline reset (every finding reads as new this sweep).`
+    };
+  }
+  return { record: rec };
+}
+function failOnExit(failOn, findings) {
+  if (failOn === void 0) return;
+  if (meetsFailOn(findings, parseFailOnTier(failOn))) process.exitCode = 1;
+}
+async function sweep(opts) {
+  if (opts.profile && opts.profile !== "personal" && opts.profile !== "guarded") {
+    throw new Error(`--profile must be personal or guarded, got \`${opts.profile}\``);
+  }
+  if (opts.failOn !== void 0) parseFailOnTier(opts.failOn);
+  const { manifest, autoNote } = await loadManifest(opts.cwd, opts.manifest);
+  const result = await sweepFleet(manifest, {
+    only: opts.only,
+    profile: opts.profile,
+    kind: opts.truth ? "truth" : void 0,
+    persistLedgers: opts.persistLedgers
+  });
+  const lastPath = path.join(manifest.dir, LAST_SWEEP_FILE);
+  const { record: previous, note: baselineNote } = await readLastSweep(lastPath);
+  const previousIds = (name) => new Set((previous?.projects[name] ?? []).map((e) => e.id));
+  const previousWallIds = new Set((previous?.wall ?? []).map((e) => e.id));
+  const allFindings = [...result.projects.flatMap((p) => p.findings), ...result.wall];
+  failOnExit(opts.failOn, allFindings);
+  const fullSweep = !opts.only && !opts.profile && !opts.truth;
+  const delta = {};
+  for (const p of result.projects) {
+    const prev = previousIds(p.name);
+    const current = new Set(p.findings.map((f) => f.id));
+    delta[p.name] = {
+      new: [...current].filter((id) => !prev.has(id)),
+      resolved: [...prev].filter((id) => !current.has(id))
+    };
+  }
+  const wallNew = result.wall.filter((f) => !previousWallIds.has(f.id)).map((f) => f.id);
+  if (opts.json) {
+    print(
+      JSON.stringify(
+        {
+          ...result,
+          delta: previous ? delta : null,
+          ...baselineNote ? { deltaBaselineNote: baselineNote } : {}
+        },
+        null,
+        2
+      )
+    );
+  } else {
+    if (autoNote) print(`  ${theme.dim(`\u25E6 ${autoNote}`)}`);
+    if (baselineNote) print(`  ${theme.dim(`\u25E6 ${baselineNote}`)}`);
+    renderSweep(result, previous, delta, wallNew);
+  }
+  if (fullSweep) {
+    const record = {
+      schema: FLEET_JSON_SCHEMA,
+      sweptAt: result.sweptAt,
+      projects: Object.fromEntries(
+        result.projects.map((p) => [p.name, p.findings.map((f) => ({ id: f.id, tier: f.tier }))])
+      ),
+      wall: result.wall.map((f) => ({ id: f.id, tier: f.tier }))
+    };
+    const tmpPath = `${lastPath}.tmp`;
+    await promises.writeFile(tmpPath, JSON.stringify(record, null, 2) + "\n", "utf8");
+    await promises.rename(tmpPath, lastPath);
+  } else if (!opts.json) {
+    print();
+    print(`  ${theme.dim("partial sweep \u2014 the delta baseline was not updated")}`);
+  }
+}
+function renderSweep(result, previous, delta, wallNew) {
+  section(
+    `Fleet sweep ${theme.dim(`\xB7 ${path.basename(result.manifest)} \xB7 ${result.projects.length} project(s) \xB7 schema ${result.schema}`)}`
+  );
+  const rows = result.projects.map((p) => {
+    const d = delta[p.name] ?? { new: [], resolved: [] };
+    const deltaStr = !previous ? "first sweep" : d.new.length || d.resolved.length ? `\u0394 ${[d.new.length ? `+${d.new.length}` : "", d.resolved.length ? `\u2212${d.resolved.length}` : ""].filter(Boolean).join(" ")}` : "\u0394 \xB10";
+    return {
+      name: p.name,
+      age: p.stateAgeDays === null ? "\u2014" : `${p.stateAgeDays}/${p.staleAfterDays}d`,
+      counts: p.counts,
+      delta: deltaStr,
+      note: p.unresolved
+    };
+  });
+  renderFleetRows(rows);
+  renderFleetNotes(
+    result.problems,
+    result.projects.flatMap((p) => p.disclosures.map((d) => `${p.name}: ${d}`))
+  );
+  const detail = [
+    ...result.projects.flatMap(
+      (p) => p.findings.filter((f) => f.tier === "risk" || (delta[p.name]?.new ?? []).includes(f.id))
+    ),
+    ...result.wall.filter((f) => f.tier === "risk" || wallNew.includes(f.id))
+  ];
+  if (detail.length) {
+    section(`New or risk findings ${theme.dim(`(${detail.length})`)}`);
+    renderFindings(detail);
+  }
+  if (result.recurringClasses.length) {
+    section(`Recurring classes ${theme.dim("(open in \u22652 projects \u2014 class-fix candidates)")}`);
+    for (const rc of result.recurringClasses) {
+      print(
+        `  ${TIER_BADGE[rc.tier]} ${rc.classId} ${theme.dim(`\u2014 ${rc.projects.length}\xD7: ${rc.projects.join(", ")}`)}`
+      );
+    }
+  }
+  section("Fleet wall");
+  if (!result.wall.length) print(`  ${glyph.ok} ${theme.dim("clean")}`);
+  else
+    print(
+      `  ${theme.warn(`${result.wall.length} finding(s)`)} ${theme.dim("(detailed above if new or risk)")}`
+    );
+  renderFleetNotes([], result.wallDisclosures);
+  if (result.outOfScope.length) {
+    print(
+      `  ${theme.dim(`out of scope (not audited, named above): ${result.outOfScope.join(", ")}`)}`
+    );
+  }
+}
+async function check(opts) {
+  const { manifest, autoNote } = await loadManifest(opts.cwd, opts.manifest);
+  const { findings, disclosures } = await checkManifest(manifest);
+  if (findings.length) process.exitCode = 1;
+  if (opts.json) {
+    print(
+      JSON.stringify(
+        { schema: FLEET_JSON_SCHEMA, manifest: manifest.manifestPath, findings, disclosures },
+        null,
+        2
+      )
+    );
+    return;
+  }
+  if (autoNote) print(`  ${theme.dim(`\u25E6 ${autoNote}`)}`);
+  section(
+    `Fleet check ${theme.dim(`\xB7 ${path.basename(manifest.manifestPath)} \xB7 ${manifest.entries.length} entr${manifest.entries.length === 1 ? "y" : "ies"} \xB7 manifest truth only, no lenses`)}`
+  );
+  renderFindings(findings);
+  renderFleetNotes([], disclosures);
+}
+async function recordGuardedMapping(manifest, name, absTarget) {
+  const home = os.homedir();
+  const value = absTarget === home || absTarget.startsWith(home + path.sep) ? `~${absTarget.slice(home.length)}` : absTarget;
+  const insideRepo = await git(manifest.dir, ["rev-parse", "--is-inside-work-tree"]) === "true";
+  if (insideRepo) {
+    const ignored = await git(manifest.dir, ["check-ignore", "-q", manifest.localPath]) !== null;
+    if (!ignored) {
+      throw new Error(
+        `${path.basename(manifest.localPath)} is not gitignored \u2014 refusing to write guarded-side directory names into a file git would track. Add it to .gitignore, then re-run.`
+      );
+    }
+  }
+  const existing = await readText(manifest.localPath);
+  let doc = {};
+  if (existing) {
+    try {
+      doc = JSON.parse(existing);
+    } catch {
+      throw new Error(
+        `${path.basename(manifest.localPath)} is not valid JSON \u2014 fix it before registering, so the mapping is not written over hand-maintained entries that cannot be re-derived.`
+      );
+    }
+  }
+  const dirs = doc.dirs ?? {};
+  dirs[name] = value;
+  doc.dirs = dirs;
+  await promises.writeFile(manifest.localPath, JSON.stringify(doc, null, 2) + "\n", "utf8");
+  return value;
+}
+async function add(opts) {
+  const { manifest, autoNote } = await loadManifest(opts.cwd, opts.manifest);
+  if (autoNote) print(`  ${theme.dim(`\u25E6 ${autoNote}`)}`);
+  if (manifest.shape !== "registry") {
+    throw new Error("`fleet add` targets the registry shape \u2014 this manifest is a legacy corpus");
+  }
+  const raw = await readText(manifest.manifestPath);
+  if (raw === null) throw new Error(`cannot read ${manifest.manifestPath}`);
+  const absTarget = path.resolve(opts.cwd, opts.target);
+  if (!await pathExists(absTarget)) throw new Error(`no such directory: ${absTarget}`);
+  const name = opts.name ?? path.basename(absTarget);
+  if (manifest.entries.some((e) => e.name === name)) {
+    throw new Error(`\`${name}\` is already registered \u2014 resolution is keyed by name`);
+  }
+  const facts = await scanProject(absTarget);
+  const remote = facts.git.isRepo ? await git(absTarget, ["remote", "get-url", "origin"]) : null;
+  section(`Fleet add ${theme.dim(`\xB7 ${name} \xB7 ${absTarget}`)}`);
+  let profile = opts.profile;
+  if (!profile && !opts.yes) {
+    const picked = await select({
+      message: "Which side of the wall does this belong to?",
+      initialValue: "personal",
+      options: [
+        { value: "personal", label: "personal \u2014 your own work" },
+        { value: "guarded", label: "guarded \u2014 kept apart: alias-only, machine-pinned" }
+      ]
+    });
+    if (isCancel(picked)) {
+      cancel("No entry written.");
+      return;
+    }
+    profile = picked;
+  }
+  profile = profile ?? "personal";
+  if (profile !== "personal" && profile !== "guarded") {
+    throw new Error(`--profile must be personal or guarded, got \`${profile}\``);
+  }
+  const derivedKind = facts.commands.build || facts.commands.test ? "tool" : "repo";
+  let kind = opts.kind;
+  if (!kind && !opts.yes) {
+    const known = [...new Set(manifest.entries.map((e) => e.kind).filter(Boolean))];
+    const choices = [.../* @__PURE__ */ new Set([derivedKind, ...known])];
+    const picked = await select({
+      message: "Kind?",
+      initialValue: derivedKind,
+      options: [
+        ...choices.map((k) => ({
+          value: k,
+          label: k === derivedKind ? `${k} \u2014 matches this repo's shape` : k
+        })),
+        { value: "", label: "something else\u2026" }
+      ]
+    });
+    if (isCancel(picked)) {
+      cancel("No entry written.");
+      return;
+    }
+    kind = picked;
+    if (!kind) {
+      const typed = await text({
+        message: "Kind (free text):",
+        validate: (v) => v.trim() ? void 0 : "a kind is required"
+      });
+      if (isCancel(typed)) {
+        cancel("No entry written.");
+        return;
+      }
+      kind = typed.trim();
+    }
+  }
+  kind = kind ?? derivedKind;
+  let trust;
+  if (profile === "personal") {
+    trust = opts.trust;
+    if (!trust && !opts.yes) {
+      const picked = await select({
+        message: "How exposed is this repo's history? (gates content screening)",
+        options: [
+          { value: "private", label: "private \u2014 not destined to be published" },
+          { value: "public-bound", label: "public-bound \u2014 private now, plausibly public later" },
+          { value: "public-repo", label: "public-repo \u2014 already public" }
+        ]
+      });
+      if (isCancel(picked)) {
+        cancel("No entry written.");
+        return;
+      }
+      trust = picked;
+    }
+    if (!trust) {
+      throw new Error(
+        `\`${name}\` needs a trust level: pass --trust <${FLEET_TRUST_VALUES.join("|")}> (non-interactive runs cannot be prompted, and there is deliberately no default \u2014 trust gates content screening)`
+      );
+    }
+    if (!isFleetTrust(trust)) {
+      throw new Error(`--trust must be one of ${FLEET_TRUST_VALUES.join(", ")}, got \`${trust}\``);
+    }
+  } else if (opts.trust) {
+    throw new Error("guarded entries take no `trust` \u2014 `profile: guarded` already implies it");
+  }
+  const guardedHost = remote ? manifest.guardedHosts.find((h) => remote.includes(h)) : void 0;
+  if (guardedHost && profile !== "guarded") {
+    throw new Error(
+      `\`${name}\` has a remote on the guarded host \`${guardedHost}\`, but --profile is \`${profile}\`. A personal entry records its path and raw remote in the TRACKED manifest \u2014 register it with \`--profile guarded\` (alias-only, machine-pinned), or move it out of the fleet root.`
+    );
+  }
+  const entry = profile === "guarded" ? { name, kind, profile, private: true } : {
+    name,
+    kind,
+    profile,
+    path: path.relative(manifest.root ?? manifest.dir, absTarget),
+    trust,
+    // A milestones file present at registration is registered as the project's plan
+    // surface; absent, the board shows the project as "not declared" until one lands —
+    // never a silent default to `none`, which is a decision only the owner takes.
+    contract: await pathExists(path.join(absTarget, MILESTONES_FILE)) ? { milestones: MILESTONES_FILE } : {},
+    links: {}
+    // The remote is deliberately NOT recorded. Nothing reads it — it was persisted only
+    // because it happened to be derivable — and it is the field that turns a mis-profiled
+    // entry into a disclosure: a raw URL carries the host AND the internal group path,
+    // while `path` carries a bare directory name. Removing a field no consumer reads
+    // retires that whole class without any host-matching guess, and keeps working on a
+    // machine that has no local manifest for the guarded-host guard above to read.
+    // It stays derivable at any time from the checkout itself, which is where it came from.
+  };
+  print(`  ${glyph.bullet} ${theme.dim("entry")}`);
+  print(
+    JSON.stringify(entry, null, 2).split("\n").map((l) => `    ${theme.dim(l)}`).join("\n")
+  );
+  if (!opts.yes) {
+    const ok = await confirm({
+      message: `Write this entry to ${path.basename(manifest.manifestPath)}?`
+    });
+    if (isCancel(ok) || !ok) {
+      cancel("No entry written.");
+      return;
+    }
+  }
+  let mappedTo;
+  if (profile === "guarded") {
+    mappedTo = await recordGuardedMapping(manifest, name, absTarget);
+  }
+  const doc = JSON.parse(raw);
+  if (!Array.isArray(doc.projects)) throw new Error("manifest has no `projects` array to append to");
+  doc.projects.push(entry);
+  await promises.writeFile(manifest.manifestPath, JSON.stringify(doc, null, 2) + "\n", "utf8");
+  print(`  ${glyph.ok} ${theme.dim("registered")} ${theme.info(name)}`);
+  if (mappedTo) {
+    print(
+      `  ${glyph.ok} ${theme.dim("mapped")} ${theme.info(`${name} \u2192 ${mappedTo}`)} ${theme.dim(`in ${path.basename(manifest.localPath)} (gitignored)`)}`
+    );
+  }
+  print(`  ${theme.dim(`verify with \`etymd fleet check --manifest ${manifest.manifestPath}\``)}`);
+}
+async function resolveFleetFinding(opts, status) {
+  if (status === "dismissed" && !opts.reason?.trim()) {
+    throw new Error('dismiss needs a reason: etymd fleet dismiss <name> <id> --reason "\u2026"');
+  }
+  const { manifest, autoNote } = await loadManifest(opts.cwd, opts.manifest);
+  if (autoNote) print(`  ${theme.dim(`\u25E6 ${autoNote}`)}`);
+  const target = await fleetLedgerTarget(manifest, opts.name);
+  const hadLedger = await pathExists(path.join(target.ledgerRoot, ".etymd"));
+  const { ledgerRoot, recorded } = await ensureFindingRecorded(manifest, opts.name, opts.id);
+  if (!recorded) {
+    throw new Error(
+      `no finding \`${opts.id}\` recorded for \`${opts.name}\` even after a fresh audit \u2014 check the id against \`etymd fleet\` output (fleet-manifest wall findings are not ledger-quietable)`
+    );
+  }
+  if (!hadLedger) {
+    print(
+      `  ${theme.dim(`first ledger for \`${opts.name}\`: created ${path.join(ledgerRoot, ".etymd")} (a persisting audit ran to record the finding)`)}`
+    );
+  }
+  const args = { cwd: ledgerRoot, id: opts.id, reason: opts.reason };
+  await (status === "dismissed" ? dismiss(args) : accept(args));
+  print(`  ${theme.dim(`ledger: ${path.join(ledgerRoot, ".etymd", "ledger.json")}`)}`);
+}
+async function dismiss2(opts) {
+  await resolveFleetFinding(opts, "dismissed");
+}
+async function accept2(opts) {
+  await resolveFleetFinding(opts, "accepted");
+}
+async function board(opts) {
+  const { manifest, autoNote } = await loadManifest(opts.cwd, opts.manifest);
+  const projects = [];
+  for (const entry of manifest.entries) {
+    if (entry.profile === "guarded") continue;
+    const file = entry.contract.milestones;
+    const base = { name: entry.name, kind: entry.kind, rows: [], problems: [] };
+    if (!file) {
+      projects.push({ ...base, state: "not-declared" });
+      continue;
+    }
+    if (file === "none") {
+      projects.push({ ...base, file, state: "none" });
+      continue;
+    }
+    if (!entry.resolvedRoot) {
+      projects.push({
+        ...base,
+        file,
+        state: "unresolved",
+        problems: [entry.unresolved ?? "unresolved"]
+      });
+      continue;
+    }
+    const text2 = await readText(path.join(entry.resolvedRoot, file));
+    if (text2 === null) {
+      projects.push({ ...base, file, state: "missing" });
+      continue;
+    }
+    const doc = parseMilestones(text2);
+    projects.push({
+      ...base,
+      file,
+      rows: doc.rows,
+      problems: doc.problems,
+      state: doc.problems.length ? "invalid" : doc.rows.length ? "ok" : "declared-empty"
+    });
+  }
+  let initiatives = null;
+  let initiativesProblems = [];
+  if (opts.initiatives) {
+    const abs = path.resolve(opts.cwd, opts.initiatives);
+    const text2 = await readText(abs);
+    if (text2 === null) throw new Error(`initiatives file not found: ${abs}`);
+    const parsed = parseInitiatives(text2);
+    initiatives = parsed.rows;
+    initiativesProblems = parsed.problems;
+  }
+  const generatedOn = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  const input = {
+    generatedOn,
+    manifest: path.basename(manifest.manifestPath),
+    initiatives,
+    initiativesProblems,
+    projects
+  };
+  const trouble = projects.filter((p) => p.state === "missing" || p.state === "invalid");
+  if (trouble.length || initiativesProblems.length) process.exitCode = 1;
+  if (opts.json) {
+    print(JSON.stringify({ schema: BOARD_JSON_SCHEMA, ...input }, null, 2));
+    return;
+  }
+  const markdown = renderBoard(input);
+  if (opts.out) {
+    const abs = path.resolve(opts.cwd, opts.out);
+    await promises.mkdir(path.dirname(abs), { recursive: true });
+    await promises.writeFile(abs, markdown, "utf8");
+    const total = projects.reduce((n, p) => n + p.rows.length, 0);
+    if (autoNote) print(`  ${theme.dim(`\u25E6 ${autoNote}`)}`);
+    print(
+      `  ${glyph.bullet} wrote ${opts.out} \u2014 ${projects.length} project${projects.length === 1 ? "" : "s"}, ${total} milestone${total === 1 ? "" : "s"}` + (initiatives ? `, ${initiatives.length} initiative${initiatives.length === 1 ? "" : "s"}` : "")
+    );
+    for (const p of trouble) {
+      print(
+        `  ${TIER_BADGE.gap} ${p.name}: ${p.state === "missing" ? `\`${p.file}\` declared and absent` : p.problems.join("; ")}`
+      );
+    }
+    for (const problem of initiativesProblems) print(`  ${TIER_BADGE.gap} initiatives: ${problem}`);
+    return;
+  }
+  print(markdown);
+}
+
+export { accept2 as accept, add, board, check, dismiss2 as dismiss, sweep };

package/dist/{gates-F4YPKWJR.js → gates-NVWWKMT2.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { applyFiles } from './chunk-GWGKEPRX.js';
-import { deriveFailOn, derivedCommands, planWorkflow, runPrefix, isSafeGateCommand } from './chunk-UFNETE6P.js';
+import { deriveFailOn, derivedCommands, planWorkflow, runPrefix, isSafeGateCommand } from './chunk-OKJ3RGJB.js';
 import { section, print, glyph, theme, renderPlan } from './chunk-HI7NWPRA.js';
-import { scanProject } from './chunk-HWC6PKJM.js';
-import './chunk-623W6KVC.js';
+import { scanProject } from './chunk-EJM47PIF.js';
+import './chunk-UYCGP5BS.js';
 import { readConfig, CONFIG_FILE, configPath } from './chunk-P6ATKV2R.js';
 import './chunk-YQZDYDAK.js';
 import { readText, git } from './chunk-4VPBP6K6.js';

package/dist/{generate-KEX75XNG.js → generate-YEARCSHW.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-export { deriveFailOn, derivedCommands, planWorkflow, riskReachability } from './chunk-UFNETE6P.js';
+export { deriveFailOn, derivedCommands, planWorkflow, riskReachability } from './chunk-OKJ3RGJB.js';
 import './chunk-P6ATKV2R.js';
 import './chunk-YQZDYDAK.js';
 import './chunk-4VPBP6K6.js';