forgedock 1.26.0 → 1.27.0

package/scripts/review-prepare.sh

@@ -21,7 +21,8 @@
 #                   reported "SKIPPED — typescript.build not configured", and blocking it would stop every deploy of a repo
 #                   with plain .js files and no build command, ForgeDock itself included).
 #   --no-delta      skip the FULL/DELTA/BASE_SYNC_ONLY resolver: the review mode is always FULL (a staging bundle review always reviews the
-#                   whole bundle), without widening the roster to the full union the way --thorough does
+#                   whole bundle), without widening the roster to the full union the way --thorough does; it also enables the pinned
+#                   local-git diff fallback when `gh pr diff` fails (e.g. HTTP 406 over 20,000 lines), which a milestone->staging PR gets without it
 # Env: FORGE_CONFIG (forge.yaml path; default: the main checkout's forge.yaml, then the git top-level one),
 #      REVIEW_PREPARE_SLEEP (seconds between mergeability retries, default 5),
 #      REVIEW_PREPARE_INDEX_TIMEOUT (seconds the code-index build may take, default 120; on timeout or failure the slices say
@@ -126,15 +127,22 @@ case "$NFILES" in ''|*[!0-9]*) NFILES="" ;; esac
 LINES=$((ADDITIONS + DELETIONS))
 [ -z "$PR_INFO" ] || [ -n "$REVIEW_SHA" ] || block "could not read the PR head SHA"
 
+# Lane (the router already diverted staging->main; these gate the diff fallback, the full-build check and the roster).
+IS_STAGING_TO_MAIN="false"; [ "$HEAD" = "staging" ] && [ "$BASE" = "main" ] && IS_STAGING_TO_MAIN="true"
+IS_MILESTONE_TO_STAGING="false"; case "$HEAD" in milestone/*) [ "$BASE" = "staging" ] && IS_MILESTONE_TO_STAGING="true" ;; esac
+REQUIRES_FULL_BUILD="false"
+{ [ "$IS_STAGING_TO_MAIN" = "true" ] || [ "$IS_MILESTONE_TO_STAGING" = "true" ]; } && REQUIRES_FULL_BUILD="true"
+
 FILES=""; DIFF=""
 if [ -z "$BLOCKERS" ]; then
     FILES=$(gh pr diff "$PR_NUMBER" -R "$REPO" --name-only 2>/dev/null) || FILES="__FAILED__"
     [ "$FILES" = "__FAILED__" ] || DIFF=$(gh pr diff "$PR_NUMBER" -R "$REPO" 2>/dev/null) || FILES="__FAILED__"
     if [ "$FILES" = "__FAILED__" ]; then
-        # A staging bundle can exceed the API's diff size limit: read it from the long-lived branches instead (--no-delta only; a per-PR review blocks).
+        # A staging bundle or a milestone->staging PR can exceed the API's diff size limit: read it from the long-lived branches instead
+        # (--no-delta or the milestone lane only, both always FULL; any other per-PR review blocks — forge#4154).
         FILES=""; DIFF=""
         # Pinned (forge#3935): same-repo PRs only (a fork's branch name resolves to origin's own branch), and the fetched tip must equal REVIEW_SHA; the diff is taken against REVIEW_SHA, never the branch name.
-        if [ "$NO_DELTA" = "true" ] && [ -n "$BASE" ] && [ -n "$HEAD" ] && [ "$(printf '%s' "$PR_INFO" | jq -r .isCrossRepository 2>/dev/null)" = "false" ] && printf '%s' "$REVIEW_SHA" | grep -qE '^[0-9a-f]{40}$' \
+        if { [ "$NO_DELTA" = "true" ] || [ "$IS_MILESTONE_TO_STAGING" = "true" ]; } && [ -n "$BASE" ] && [ -n "$HEAD" ] && [ "$(printf '%s' "$PR_INFO" | jq -r .isCrossRepository 2>/dev/null)" = "false" ] && printf '%s' "$REVIEW_SHA" | grep -qE '^[0-9a-f]{40}$' \
            && git fetch -q origin "$BASE" "$HEAD" 2>/dev/null && [ "$(git rev-parse -q --verify "refs/remotes/origin/${HEAD}^{commit}" 2>/dev/null)" = "$REVIEW_SHA" ]; then
             FILES=$(git diff --name-only "origin/${BASE}...${REVIEW_SHA}" 2>/dev/null) && DIFF=$(git diff "origin/${BASE}...${REVIEW_SHA}" 2>/dev/null) || { FILES=""; DIFF=""; }
         fi
@@ -161,12 +169,6 @@ if [ -n "$PR_AUTHOR" ]; then
     [ "$PRIOR_MERGED_COUNT" -eq 0 ] && IS_FIRST_TIME_CONTRIBUTOR="true"
 fi
 
-# Lane (the router already diverted staging->main; these still gate the full-build check and the roster).
-IS_STAGING_TO_MAIN="false"; [ "$HEAD" = "staging" ] && [ "$BASE" = "main" ] && IS_STAGING_TO_MAIN="true"
-IS_MILESTONE_TO_STAGING="false"; case "$HEAD" in milestone/*) [ "$BASE" = "staging" ] && IS_MILESTONE_TO_STAGING="true" ;; esac
-REQUIRES_FULL_BUILD="false"
-{ [ "$IS_STAGING_TO_MAIN" = "true" ] || [ "$IS_MILESTONE_TO_STAGING" = "true" ]; } && REQUIRES_FULL_BUILD="true"
-
 # --- optional PR checkout (throwaway review checkout only) ---
 if [ "$CHECKOUT_PR" = "true" ] && [ -z "$BLOCKERS" ]; then
     ORIG_REF=$(git symbolic-ref -q --short HEAD 2>/dev/null || git rev-parse HEAD 2>/dev/null || echo "")

package/scripts/review-prepare.test.sh

@@ -287,6 +287,20 @@ CROSS_REPO=true setup pr-branch main "README.md" "$DIFF_PLAIN"; : > "$FIX/difffa
 prep "$ROOT" --no-delta; rc_is "--no-delta fallback refuses a cross-repository PR" 3
 setup feat/x staging "README.md" "$DIFF_PLAIN"; : > "$FIX/difffail"
 prep "$ROOT" --no-delta; rc_is "--no-delta with unfetchable branches still fails closed" 3; eq "unfetchable blocked" .status BLOCKED
+# forge#4154: a milestone->staging PR (always FULL) gets the same pinned fallback without --no-delta; other per-PR lanes still block
+git -C "$REPO_DIR" branch -f milestone/m1 "$SHA_B"; git -C "$REPO_DIR" branch -f staging "$SHA_A"
+setup milestone/m1 staging "README.md" "$DIFF_PLAIN"; : > "$FIX/difffail"
+prep "$ROOT"; rc_is "milestone->staging falls back to git when the API diff fails" 0; eq "milestone fallback status" .status OK
+eq "milestone fallback lane" .lane.is_milestone_to_staging true; eq "milestone fallback mode is FULL" .delta.mode FULL
+eq "milestone fallback file list comes from git" '.full_files | index("services/api/auth.py") != null' true
+setup milestone/m1 staging "README.md" "$DIFF_PLAIN" "0000000000000000000000000000000000000000"; : > "$FIX/difffail"
+prep "$ROOT"; rc_is "milestone fallback refuses a branch tip that is not the review SHA" 3
+CROSS_REPO=true setup milestone/m1 staging "README.md" "$DIFF_PLAIN"; : > "$FIX/difffail"
+prep "$ROOT"; rc_is "milestone fallback refuses a cross-repository PR" 3
+git -C "$REPO_DIR" branch -f feat/x "$SHA_B"
+setup feat/x staging "README.md" "$DIFF_PLAIN"; : > "$FIX/difffail"
+prep "$ROOT"; rc_is "a fetchable feat->staging per-PR review still blocks without --no-delta" 3; eq "feat blocked" '.blockers | join(" ") | test("gh pr diff failed")' true
+git -C "$REPO_DIR" branch -D milestone/m1 staging feat/x >/dev/null
 setup feat/x staging "README.md" "$DIFF_PLAIN"
 for bad_args in "--pr abc --repo o/r" "--pr 7 --repo noslash" "--pr 7 --repo o/r;x/y" "--pr 7 --repo o/r --bogus" "--repo o/r --pr"; do
     # shellcheck disable=SC2086

package/scripts/structure-delta.sh

@@ -0,0 +1,150 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# structure-delta.sh — deterministic cross-package structure facts for one change (forge#4159). No LLM, no network:
+# git + jq only. Run from the repo root.
+#
+# Usage: structure-delta.sh <base>...<head> | <base> <head>      (the old side is git merge-base base head)
+# Output (stdout, one JSON object):
+#   {} when the repo declares no workspace packages (root package.json `workspaces` / pnpm-workspace.yaml), else
+#   {"package_edges_added":[{from,to,kind,manifest}], "package_edges_removed":[...],
+#    "import_pairs":[{from,to,files_added,files_removed}],
+#    "boundary_config_changed":{changed,files[],loosens,tightens}}
+# A package edge is a dependencies/devDependencies/peerDependencies key naming another workspace package. An import
+# pair counts changed non-test source files whose added (removed) lines quote an exact workspace name, optionally with
+# a subpath ('@s/x' or '@s/x/sub'); `import type` / `export type` lines are ignored. Counts only report.
+# Exit: 0 ok | 2 usage or bad ref. bash 3.2 portable.
+set -uo pipefail
+
+die() { echo "structure-delta: $*" >&2; exit 2; }
+command -v jq >/dev/null 2>&1 || die "jq is required"
+case "${1:-}" in
+  *...*) BASE="${1%%...*}"; HEAD="${1#*...}" ;;
+  "") die "usage: structure-delta.sh <base>...<head>" ;;
+  *) BASE="$1"; HEAD="${2:-}" ;;
+esac
+[ -n "$BASE" ] && [ -n "$HEAD" ] || die "usage: structure-delta.sh <base>...<head>"
+git rev-parse --verify -q "$BASE^{commit}" >/dev/null || die "bad base ref: $BASE"
+git rev-parse --verify -q "$HEAD^{commit}" >/dev/null || die "bad head ref: $HEAD"
+OLD=$(git merge-base "$BASE" "$HEAD") || die "no merge base for $BASE and $HEAD"
+NEW=$(git rev-parse "$HEAD^{commit}")
+
+T=$(mktemp -d "${TMPDIR:-/tmp}/structure-delta.XXXXXX") || die "mktemp failed"
+trap 'rm -rf "$T"' EXIT
+
+# ---- workspace globs, from the repo only ----
+for ref in "$OLD" "$NEW"; do
+  git show "$ref:package.json" 2>/dev/null | jq -r '(.workspaces // empty) | if type == "array" then .[] elif type == "object" then (.packages // [])[] else empty end | strings' 2>/dev/null
+  git show "$ref:pnpm-workspace.yaml" 2>/dev/null | awk '
+    /^packages:/ { on = 1; next }
+    on && /^[^ \t#-]/ { on = 0 }
+    on && /^[ \t]*-[ \t]*/ { sub(/^[ \t]*-[ \t]*/, ""); sub(/[ \t]+#.*$/, ""); gsub(/["\047]/, ""); sub(/[ \t]+$/, ""); if ($0 != "") print }'
+done | sed 's#^\./##; s#/$##' | sort -u > "$T/globs"
+[ -s "$T/globs" ] || { echo '{}'; exit 0; }
+
+# glob -> anchored ERE (`**` any depth, `*` one segment); `!glob` excludes
+to_re() { printf '%s' "$1" | sed 's/[.+^$()|{}[]/\\&/g; s/\*\*/%%/g; s/\*/[^\/]*/g; s/%%/.*/g; s/?/[^\/]/g'; }
+: > "$T/inc"; : > "$T/exc"
+while IFS= read -r g; do
+  case "$g" in \!*) echo "^$(to_re "${g#!}")\$" >> "$T/exc" ;; *) echo "^$(to_re "$g")\$" >> "$T/inc" ;; esac
+done < "$T/globs"
+
+# ---- workspace manifests at each ref: lines "ref<TAB>dir<TAB>manifest" ----
+: > "$T/manifests"
+for side in old new; do
+  ref=$OLD; [ "$side" = new ] && ref=$NEW
+  git ls-tree -r --name-only "$ref" | grep -E '/package\.json$' | grep -v '(^|/)node_modules/' | while IFS= read -r m; do
+    d=${m%/package.json}
+    printf '%s\n' "$d" | grep -qE -f "$T/inc" || continue
+    if [ -s "$T/exc" ] && printf '%s\n' "$d" | grep -qE -f "$T/exc"; then continue; fi
+    printf '%s\t%s\t%s\n' "$side" "$d" "$m"
+  done >> "$T/manifests"
+done
+
+# ---- names and deps: lines "side<TAB>dir<TAB>manifest<TAB>name" and "side<TAB>manifest<TAB>kind<TAB>dep" ----
+: > "$T/names"; : > "$T/deps"
+while IFS="$(printf '\t')" read -r side d m; do
+  ref=$OLD; [ "$side" = new ] && ref=$NEW
+  git show "$ref:$m" 2>/dev/null > "$T/pj" || continue
+  n=$(jq -r '.name // empty | strings' "$T/pj" 2>/dev/null) || continue
+  [ -n "$n" ] || continue
+  printf '%s\t%s\t%s\t%s\n' "$side" "$d" "$m" "$n" >> "$T/names"
+  jq -r --arg s "$side" --arg m "$m" '["dependencies","devDependencies","peerDependencies"][] as $k | (.[$k] // {}) | objects | keys[] | [$s, $m, $k, .] | @tsv' "$T/pj" 2>/dev/null >> "$T/deps"
+done < "$T/manifests"
+[ -s "$T/names" ] || { echo '{}'; exit 0; }
+cut -f4 "$T/names" | sort -u > "$T/wsnames"
+
+# ---- package edges: "manifest<TAB>from<TAB>to<TAB>kind" per side, then set difference ----
+for side in old new; do
+  awk -F'\t' -v s="$side" '
+    FILENAME == ARGV[1] { ws[$1] = 1; next }
+    FILENAME == ARGV[2] { if ($1 == s) name[$3] = $4; next }
+    $1 == s && ($4 in ws) && ($2 in name) && name[$2] != $4 { print $2 "\t" name[$2] "\t" $4 "\t" $3 }
+  ' "$T/wsnames" "$T/names" "$T/deps" | sort -u > "$T/edges.$side"
+done
+edges_json() { jq -R -s -c 'split("\n") | map(select(length > 0) | split("\t") | {from: .[1], to: .[2], kind: .[3], manifest: .[0]})'; }
+ADDED=$(comm -13 "$T/edges.old" "$T/edges.new" | edges_json)
+REMOVED=$(comm -23 "$T/edges.old" "$T/edges.new" | edges_json)
+
+# ---- import pairs: one -U0 diff pass over source files ----
+# workspace dirs (both sides, longest first) for "which package owns this file"
+cut -f2,4 "$T/names" | sort -u | awk -F'\t' '{ print length($1) "\t" $0 }' | sort -t"$(printf '\t')" -k1,1nr | cut -f2- > "$T/dirs"
+git diff -U0 --no-color --no-renames --no-ext-diff "$OLD" "$NEW" -- \
+  '*.js' '*.jsx' '*.ts' '*.tsx' '*.mjs' '*.cjs' '*.mts' '*.cts' '*.vue' '*.svelte' '*.astro' 2>/dev/null > "$T/diff"
+IMPORTS=$(awk -F'\t' '
+  FILENAME == ARGV[1] { nd++; dir[nd] = $1; own[nd] = $2; next }
+  FILENAME == ARGV[2] { nw++; ws[nw] = $1; next }
+  function owner(f,   i) { for (i = 1; i <= nd; i++) if (index(f, dir[i] "/") == 1) return own[i]; return "" }
+  function istest(f) { return f ~ /(^|\/)(test|tests|__tests__|spec|specs)\// || f ~ /\.(test|spec)\.[A-Za-z0-9]+$/ }
+  # true when line quotes exactly name n: a quote, n, then a closing quote of the same kind or a "/" subpath
+  function quotes(line, n,   q, qi, rest, p, nx) {
+    for (qi = 1; qi <= 2; qi++) {
+      q = (qi == 1) ? "\"" : "\047"; rest = line
+      while ((p = index(rest, q n)) > 0) {
+        nx = substr(rest, p + 1 + length(n), 1)
+        if (nx == q || nx == "/") return 1
+        rest = substr(rest, p + 1)
+      }
+    }
+    return 0
+  }
+  /^diff --git / { f = $0; sub(/^diff --git a\/.* b\//, "", f); from = owner(f); skip = (from == "" || istest(f)); hdr = 1; next }
+  /^@@/ { hdr = 0; next }
+  hdr { next }
+  /^[+-]/ {
+    if (skip) next
+    s = substr($0, 1, 1); l = substr($0, 2)
+    if (l ~ /^[ \t]*(import|export)[ \t]+type([ \t{]|$)/) next
+    for (i = 1; i <= nw; i++) if (ws[i] != from && quotes(l, ws[i])) hit[f SUBSEP ws[i] SUBSEP s] = 1
+    fromof[f] = from
+  }
+  END {
+    for (k in hit) {
+      split(k, a, SUBSEP); f = a[1]; to = a[2]; s = a[3]
+      if (s == "+" && !((f SUBSEP to SUBSEP "-") in hit)) add[fromof[f] SUBSEP to]++
+      if (s == "-" && !((f SUBSEP to SUBSEP "+") in hit)) rem[fromof[f] SUBSEP to]++
+    }
+    for (k in add) pair[k] = 1
+    for (k in rem) pair[k] = 1
+    for (k in pair) { split(k, a, SUBSEP); print a[1] "\t" a[2] "\t" (add[k] + 0) "\t" (rem[k] + 0) }
+  }
+' "$T/dirs" "$T/wsnames" "$T/diff" | sort | jq -R -s -c 'split("\n") | map(select(length > 0) | split("\t") | {from: .[0], to: .[1], files_added: (.[2] | tonumber), files_removed: (.[3] | tonumber)})')
+
+# ---- boundary config (eslint-plugin-boundaries, dependency-cruiser, Nx depConstraints) ----
+: > "$T/bfiles"; LOOSE=false; TIGHT=false
+git diff --name-only --no-renames "$OLD" "$NEW" | while IFS= read -r f; do
+  case "${f##*/}" in .eslintrc|.eslintrc.*|eslint.config.*|.dependency-cruiser.*|nx.json|project.json) printf '%s\n' "$f" ;; esac
+done > "$T/bcand"
+while IFS= read -r f; do
+  git diff -U0 --no-color --no-renames "$OLD" "$NEW" -- "$f" | grep -E '^[+-][^+-]' > "$T/bd" || true
+  grep -qE 'boundaries|allow|disallow|forbidden|depConstraints|DependOnLibsWithTags' "$T/bd" || continue
+  printf '%s\n' "$f" >> "$T/bfiles"
+  if grep -E '^\+' "$T/bd" | grep -iv 'disallow' | grep -qE 'allow|onlyDependOnLibsWithTags.*\*'; then LOOSE=true; fi
+  if grep -E '^-' "$T/bd" | grep -iv 'disallow' | grep -qE 'allow'; then TIGHT=true; fi
+  if grep -E '^\+' "$T/bd" | grep -qE 'disallow|forbidden|notDependOnLibsWithTags'; then TIGHT=true; fi
+done < "$T/bcand"
+BFILES=$(jq -R -s -c 'split("\n") | map(select(length > 0))' < "$T/bfiles")
+
+jq -n -c --argjson a "$ADDED" --argjson r "$REMOVED" --argjson i "$IMPORTS" --argjson b "$BFILES" --argjson lo "$LOOSE" --argjson ti "$TIGHT" \
+  '{package_edges_added: $a, package_edges_removed: $r, import_pairs: $i, boundary_config_changed: {changed: ($b | length > 0), files: $b, loosens: $lo, tightens: $ti}}'

package/scripts/structure-delta.test.sh

@@ -0,0 +1,135 @@
+#!/usr/bin/env bash
+# structure-delta.test.sh — cases for scripts/structure-delta.sh (forge#4159).
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+set -uo pipefail
+S="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/structure-delta.sh"
+PASS=0; FAILN=0
+TMP="$(mktemp -d "${TMPDIR:-/tmp}/structure-delta-test.XXXXXX")"; trap 'rm -rf "$TMP"' EXIT
+ok() { PASS=$((PASS+1)); }
+bad() { FAILN=$((FAILN+1)); echo "FAIL: $1"; }
+eq() { if [ "$2" = "$3" ]; then ok; else bad "$1 (got: $2 want: $3)"; fi }
+q() { printf '%s' "$OUT" | jq -c "$1"; }
+
+new_repo() {
+  rm -rf "$TMP/w"; mkdir -p "$TMP/w"; cd "$TMP/w" || exit 1
+  git init -q; git config user.email t@example.com; git config user.name t; git config commit.gpgsign false
+}
+commit() { git add -A; git commit -qm "$1"; }
+pj() { mkdir -p "$1"; printf '%s\n' "$2" > "$1/package.json"; }
+
+# ---- 1. single-package repo: {} and exit 0 ----
+new_repo
+printf '{"name":"solo","dependencies":{"left-pad":"1"}}\n' > package.json
+mkdir -p src; echo "import x from 'left-pad';" > src/a.ts; commit base
+git checkout -q -b feat; echo "import y from 'solo/x';" >> src/a.ts; commit change
+OUT="$(bash "$S" master...feat 2>/dev/null || bash "$S" main...feat)"; rc=$?
+eq "single-package rc" "$rc" 0
+eq "single-package empty JSON" "$OUT" "{}"
+# workspaces declared but no package matches: still {}
+printf '{"name":"solo","workspaces":["packages/*"]}\n' > package.json; commit ws
+OUT="$(bash "$S" HEAD~1 HEAD)"; eq "workspaces with no packages" "$OUT" "{}"
+
+# ---- 2. monorepo fixture ----
+new_repo
+printf '{"name":"root","private":true,"workspaces":["apps/*","packages/*"],"dependencies":{"@scope/db":"1"}}\n' > package.json
+pj apps/web '{"name":"@scope/web","dependencies":{"@scope/db":"workspace:*","@scope/old":"workspace:*","react":"18"}}'
+pj packages/db '{"name":"@scope/db","dependencies":{"pg":"8"}}'
+pj packages/x '{"name":"@scope/x"}'
+pj packages/old '{"name":"@scope/old"}'
+pj packages/core '{"name":"@scope/core"}'
+mkdir -p apps/web/src apps/web/test
+echo "export const a = 1;" > apps/web/src/existing.ts
+echo "import { db } from '@scope/old';" > apps/web/src/legacy.ts
+commit base
+BASE_SHA=$(git rev-parse HEAD)
+git checkout -q -b feat
+# edges: added (db -> core), dev-only (x -> db), removed (web -> old), non-workspace ignored (db -> zod), root ignored
+pj packages/db '{"name":"@scope/db","dependencies":{"pg":"8","zod":"3","@scope/core":"workspace:*"}}'
+pj packages/x '{"name":"@scope/x","devDependencies":{"@scope/db":"workspace:*"}}'
+pj apps/web '{"name":"@scope/web","dependencies":{"@scope/db":"workspace:*","react":"18"}}'
+# imports
+cat > apps/web/src/value.ts <<'EOF'
+import { db } from "@scope/db";
+import type { Row } from '@scope/core';
+EOF
+echo 'const m = await import("@scope/x");' > apps/web/src/dyn.ts
+echo "import { sub } from '@scope/x/sub';" > apps/web/src/sub.ts
+echo "import { o } from '@scope-other/x';" > apps/web/src/other.ts
+echo "export type { T } from '@scope/db';" > apps/web/src/typeonly.ts
+echo "import { db } from '@scope/db';" > apps/web/test/db.ts
+echo "import { db } from '@scope/db';" > apps/web/src/db.test.ts
+echo "// mentions @scope/db without quotes" > apps/web/src/comment.ts
+echo "import { db } from '@scope/db-extra';" > apps/web/src/prefix.ts
+rm apps/web/src/legacy.ts
+commit change
+OUT="$(bash "$S" "$BASE_SHA...feat")"; rc=$?
+eq "monorepo rc" "$rc" 0
+eq "edges added" "$(q '.package_edges_added | sort_by(.from)')" '[{"from":"@scope/db","to":"@scope/core","kind":"dependencies","manifest":"packages/db/package.json"},{"from":"@scope/x","to":"@scope/db","kind":"devDependencies","manifest":"packages/x/package.json"}]'
+eq "edges removed" "$(q '.package_edges_removed')" '[{"from":"@scope/web","to":"@scope/old","kind":"dependencies","manifest":"apps/web/package.json"}]'
+eq "non-workspace dep ignored" "$(q '[.package_edges_added[] | select(.to == "zod" or .to == "pg")] | length')" 0
+eq "import pairs" "$(q '.import_pairs | sort_by(.to)')" '[{"from":"@scope/web","to":"@scope/db","files_added":1,"files_removed":0},{"from":"@scope/web","to":"@scope/old","files_added":0,"files_removed":1},{"from":"@scope/web","to":"@scope/x","files_added":2,"files_removed":0}]'
+eq "import type never counted" "$(q '[.import_pairs[] | select(.to == "@scope/core")] | length')" 0
+eq "no boundary change" "$(q '.boundary_config_changed')" '{"changed":false,"files":[],"loosens":false,"tightens":false}'
+# the two-arg form agrees
+eq "two-arg form" "$(bash "$S" "$BASE_SHA" feat | jq -c '.package_edges_added | length')" 2
+
+# moving an import within a file (- and + of the same target) is not growth
+git checkout -q -b move feat
+printf '// header\nimport { db } from "@scope/db";\nimport type { Row } from "@scope/core";\n' > apps/web/src/value.ts; commit move
+OUT="$(bash "$S" feat...move)"; eq "moved import not counted" "$(q '.import_pairs')" '[]'
+
+# ---- 3. boundary config: loosen, tighten ----
+git checkout -q -b eslint-base feat
+cat > eslint.config.mjs <<'EOF'
+export default [{ rules: { "boundaries/element-types": [2, { default: "disallow", rules: [
+  { from: ["app"], allow: ["core"] },
+] }] } }];
+EOF
+commit eslint
+git checkout -q -b loosen
+awk '{ print } /allow: \["core"\]/ { print "  { from: [\"app\"], allow: [\"package\"] }," }' eslint.config.mjs > "$TMP/e" && cat "$TMP/e" > eslint.config.mjs; commit loosen
+OUT="$(bash "$S" eslint-base...loosen)"
+eq "loosen" "$(q '.boundary_config_changed')" '{"changed":true,"files":["eslint.config.mjs"],"loosens":true,"tightens":false}'
+git checkout -q -b tighten eslint-base
+grep -v 'allow: \["core"\]' eslint.config.mjs > "$TMP/e" && cat "$TMP/e" > eslint.config.mjs; commit tighten
+OUT="$(bash "$S" eslint-base...tighten)"
+eq "tighten" "$(q '.boundary_config_changed')" '{"changed":true,"files":["eslint.config.mjs"],"loosens":false,"tightens":true}'
+
+# ---- 4. pnpm-workspace.yaml globs with a negation ----
+new_repo
+printf '{"name":"root","private":true}\n' > package.json
+printf "packages:\n  - 'packages/**'\n  - \"!packages/ignored\"\n" > pnpm-workspace.yaml
+pj packages/a '{"name":"a"}'
+pj packages/nested/b '{"name":"b"}'
+pj packages/ignored '{"name":"ignored"}'
+commit base
+git checkout -q -b feat
+pj packages/a '{"name":"a","dependencies":{"b":"workspace:*","ignored":"workspace:*"}}'
+commit edge
+OUT="$(bash "$S" HEAD~1...HEAD)"
+eq "pnpm globs, ** depth, negation" "$(q '[.package_edges_added[] | .to]')" '["b"]'
+
+# ---- 5. bad ref and usage exit 2 ----
+bash "$S" nope...HEAD >/dev/null 2>&1; eq "bad ref exit" "$?" 2
+bash "$S" >/dev/null 2>&1; eq "usage exit" "$?" 2
+
+# ---- 6. 300-file diff in under 2 s, no network tools invoked ----
+new_repo
+printf '{"name":"root","workspaces":["packages/*"]}\n' > package.json
+for p in a b c d e f; do pj "packages/$p" "{\"name\":\"@s/$p\"}"; done
+commit base
+git checkout -q -b big
+i=0; while [ $i -lt 300 ]; do printf "import { v } from '@s/b';\nexport const n$i = v;\n" > "packages/a/f$i.ts"; i=$((i+1)); done
+commit big
+mkdir -p "$TMP/bin"
+for t in gh curl wget npm npx pnpm yarn nc ssh; do printf '#!/bin/sh\necho "%s" >> "%s/net.log"\nexit 1\n' "$t" "$TMP" > "$TMP/bin/$t"; chmod +x "$TMP/bin/$t"; done
+start=$(date +%s%N 2>/dev/null)
+OUT="$(PATH="$TMP/bin:$PATH" bash "$S" master...big 2>/dev/null || PATH="$TMP/bin:$PATH" bash "$S" main...big)"
+end=$(date +%s%N 2>/dev/null)
+eq "300-file count" "$(q '.import_pairs')" '[{"from":"@s/a","to":"@s/b","files_added":300,"files_removed":0}]'
+case "$start$end" in *N*|"") ok ;; *) ms=$(( (end - start) / 1000000 )); if [ "$ms" -lt 2000 ]; then ok; else bad "300-file diff took ${ms} ms (limit 2000)"; fi ;; esac
+if [ -e "$TMP/net.log" ]; then bad "network tool invoked: $(tr '\n' ' ' < "$TMP/net.log")"; else ok; fi
+
+echo "structure-delta.test.sh: $PASS passed, $FAILN failed"
+[ "$FAILN" -eq 0 ]