gitnexus 1.6.11-rc.2 → 1.6.11-rc.21

package/dist/core/group/config-parser.js

@@ -22,6 +22,7 @@ const VALID_ROLES = ['provider', 'consumer'];
 // repos that need cross-repo header tracking.
 const DEFAULT_DETECT = {
     http: true,
+    graphql: false,
     grpc: true,
     thrift: true,
     topics: true,
@@ -47,7 +48,14 @@ export function parseGroupConfig(yamlContent) {
     if (!raw.repos || typeof raw.repos !== 'object' || Array.isArray(raw.repos)) {
         throw new Error('repos is required in group.yaml (must be a mapping)');
     }
-    const repos = raw.repos;
+    const reposRaw = raw.repos;
+    const repos = {};
+    for (const [memberPath, registryName] of Object.entries(reposRaw)) {
+        if (typeof registryName !== 'string' || registryName.trim() === '') {
+            throw new Error(`repos["${memberPath}"] must be a non-empty registry name string, not ${typeof registryName}`);
+        }
+        repos[memberPath] = registryName.trim();
+    }
     const repoPaths = new Set(Object.keys(repos));
     const rawLinks = raw.links || [];
     const links = rawLinks.map((l, i) => {
@@ -77,7 +85,17 @@ export function parseGroupConfig(yamlContent) {
             role: link.role,
         };
     });
-    const detect = { ...DEFAULT_DETECT, ...(raw.detect || {}) };
+    const rawDetect = raw.detect;
+    if (rawDetect !== undefined &&
+        (!rawDetect || typeof rawDetect !== 'object' || Array.isArray(rawDetect))) {
+        throw new Error('detect must be a mapping of boolean flags');
+    }
+    for (const [key, value] of Object.entries(rawDetect || {})) {
+        if (key in DEFAULT_DETECT && typeof value !== 'boolean') {
+            throw new Error(`detect.${key} must be true or false`);
+        }
+    }
+    const detect = { ...DEFAULT_DETECT, ...(rawDetect || {}) };
     const matching = { ...DEFAULT_MATCHING, ...(raw.matching || {}) };
     const packages = raw.packages || {};
     return {

package/dist/core/group/cross-impact.d.ts

@@ -2,6 +2,7 @@
  * Cross-repo impact (Phase 1 local walk + Phase 2 bridge fan-out).
  * All bridge Cypher for this feature lives in this module.
  */
+import type { ImpactRisk } from '../../_shared/index.js';
 import type { BridgeHandle, BridgeMeta, CrossRepoImpact, GroupImpactResult } from './types.js';
 import type { GroupToolPort } from './service.js';
 export { truncationFields, crossRepoCompleteness, type TruncationFields, type CrossRepoCompleteness, type CrossRepoCompletenessInput, } from './completeness.js';
@@ -109,7 +110,7 @@ export declare function collectImpactSymbolUids(local: unknown, servicePrefix: s
     uids: string[];
     targetFilePath?: string;
 };
-export declare function mergeRisk(localRisk: string, cross: CrossRepoImpact[]): string;
+export declare function mergeRisk(localRisk: ImpactRisk, cross: CrossRepoImpact[]): ImpactRisk;
 /**
  * Is this bridge's metadata unable to say where its contents came from?
  *

package/dist/core/group/cross-impact.js

@@ -165,6 +165,16 @@ export function validateGroupImpactParams(params) {
 async function resolveGroupRepo(port, config, repoPath) {
     const registryName = config.repos[repoPath];
     if (!registryName) {
+        const matchingMemberPaths = Object.entries(config.repos)
+            .filter(([, alias]) => alias.toLowerCase() === repoPath.toLowerCase())
+            .map(([memberPath]) => memberPath);
+        if (matchingMemberPaths.length > 0) {
+            return {
+                error: `Unknown repo path "${repoPath}" in this group. ` +
+                    `That value is a registry alias for member path(s): ${matchingMemberPaths.join(', ')}. ` +
+                    `Pass the group.yaml key to --repo, not the alias.`,
+            };
+        }
         return { error: `Unknown repo path "${repoPath}" in this group.` };
     }
     try {
@@ -279,6 +289,15 @@ function extractProcessNames(impact) {
 // permanently that a PDG `risk:'UNKNOWN'` never coalesces to a confident `LOW`.
 // No behavior change — `'UNKNOWN'` was already handled correctly at the
 // `(localRisk === 'LOW' || localRisk === 'UNKNOWN')` branch below.
+function asImpactRisk(value, fallback = 'LOW') {
+    return value === 'LOW' ||
+        value === 'MEDIUM' ||
+        value === 'HIGH' ||
+        value === 'CRITICAL' ||
+        value === 'UNKNOWN'
+        ? value
+        : fallback;
+}
 export function mergeRisk(localRisk, cross) {
     const traversed = cross.filter((c) => c.fanout_status !== 'not_attempted');
     const highConf = traversed.some((c) => c.contract.confidence >= 0.85);
@@ -292,6 +311,15 @@ export function mergeRisk(localRisk, cross) {
         return 'MEDIUM';
     return localRisk;
 }
+function liftLocalRiskMeta(local, cross) {
+    const { riskSharedAxes, riskScale } = local;
+    return {
+        ...(riskSharedAxes !== undefined
+            ? { riskSharedAxes: mergeRisk(asImpactRisk(riskSharedAxes), cross) }
+            : {}),
+        ...(riskScale !== undefined ? { riskScale } : {}),
+    };
+}
 /**
  * Is this bridge's metadata unable to say where its contents came from?
  *
@@ -461,6 +489,7 @@ export async function runGroupImpact(deps, params) {
                 cross_repo_hits: 0,
             },
             risk: 'UNKNOWN',
+            ...liftLocalRiskMeta(local, []),
             timeoutMs,
             crossDepthWarning,
         };
@@ -513,7 +542,8 @@ export async function runGroupImpact(deps, params) {
                 modules_affected: s.modules_affected ?? 0,
                 cross_repo_hits: 0,
             },
-            risk: String(local.risk ?? 'LOW'),
+            risk: asImpactRisk(local.risk),
+            ...liftLocalRiskMeta(local, []),
             timeoutMs,
             crossDepthWarning,
         };
@@ -666,7 +696,7 @@ export async function runGroupImpact(deps, params) {
         await closeBridgeDb(handle);
     }
     const localSum = local?.summary || {};
-    const localRisk = String(local.risk ?? 'LOW');
+    const localRisk = asImpactRisk(local.risk);
     const localPartial = Boolean(local.partial);
     // The bridge's own incompleteness, in the shared vocabulary, read through
     // what this query DECLARED. The fan-out above already drops every neighbour
@@ -740,6 +770,7 @@ export async function runGroupImpact(deps, params) {
             cross_repo_hits: cross.length,
         },
         risk: mergeRisk(localRisk, cross),
+        ...liftLocalRiskMeta(local, cross),
         timeoutMs,
         crossDepthWarning,
     };

package/dist/core/group/extractors/fs-utils.d.ts

@@ -8,3 +8,5 @@
  * sensitive) lives in exactly one place.
  */
 export declare function readSafe(repoPath: string, rel: string): string | null;
+/** Read a regular in-repo file without buffering more than `maxBytes`. */
+export declare function readSafeBounded(repoPath: string, rel: string, maxBytes: number): Promise<string | null>;

package/dist/core/group/extractors/fs-utils.js

@@ -22,3 +22,89 @@ export function readSafe(repoPath, rel) {
         return null;
     }
 }
+/** Read a regular in-repo file without buffering more than `maxBytes`. */
+export async function readSafeBounded(repoPath, rel, maxBytes) {
+    if (!Number.isSafeInteger(maxBytes) || maxBytes < 0)
+        return null;
+    const abs = path.resolve(repoPath, rel);
+    const base = path.resolve(repoPath);
+    const relToBase = path.relative(base, abs);
+    if (relToBase.startsWith('..') || path.isAbsolute(relToBase))
+        return null;
+    try {
+        const canonicalBase = await fs.promises.realpath(base);
+        const canonicalFile = await fs.promises.realpath(abs);
+        const canonicalRelative = path.relative(canonicalBase, canonicalFile);
+        if (canonicalRelative.startsWith('..') || path.isAbsolute(canonicalRelative))
+            return null;
+        const beforeOpen = await fs.promises.lstat(canonicalFile);
+        if (!beforeOpen.isFile() || beforeOpen.size > maxBytes)
+            return null;
+        if (maxBytes === 0)
+            return beforeOpen.size === 0 ? '' : null;
+        return await new Promise((resolve) => {
+            const stream = fs.createReadStream(canonicalFile, {
+                flags: 'r',
+                start: 0,
+                end: maxBytes,
+                autoClose: true,
+            });
+            const chunks = [];
+            let totalBytes = 0;
+            let validated = false;
+            let settled = false;
+            const finish = (value) => {
+                if (settled)
+                    return;
+                settled = true;
+                resolve(value);
+            };
+            stream.pause();
+            stream.once('open', (fd) => {
+                try {
+                    const opened = fs.fstatSync(fd);
+                    if (!opened.isFile() || opened.size > maxBytes) {
+                        finish(null);
+                        stream.destroy();
+                        return;
+                    }
+                    const currentCanonical = fs.realpathSync(canonicalFile);
+                    const currentRelative = path.relative(canonicalBase, currentCanonical);
+                    const current = fs.statSync(currentCanonical);
+                    if (currentRelative.startsWith('..') ||
+                        path.isAbsolute(currentRelative) ||
+                        opened.dev !== current.dev ||
+                        opened.ino !== current.ino) {
+                        finish(null);
+                        stream.destroy();
+                        return;
+                    }
+                    validated = true;
+                    stream.resume();
+                }
+                catch {
+                    finish(null);
+                    stream.destroy();
+                }
+            });
+            stream.on('data', (chunk) => {
+                const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+                totalBytes += bytes.length;
+                if (totalBytes > maxBytes) {
+                    finish(null);
+                    stream.destroy();
+                    return;
+                }
+                chunks.push(bytes);
+            });
+            stream.once('end', () => {
+                finish(validated ? Buffer.concat(chunks, totalBytes).toString('utf8') : null);
+            });
+            stream.once('error', () => finish(null));
+            stream.once('close', () => finish(null));
+        });
+    }
+    catch {
+        return null;
+    }
+}

package/dist/core/group/extractors/graphql-extractor.d.ts

@@ -0,0 +1,17 @@
+import Parser from 'tree-sitter';
+import type { ContractExtractor, CypherExecutor } from '../contract-extractor.js';
+import type { ExtractedContract, RepoHandle } from '../types.js';
+type GraphqlOperationKind = 'query' | 'mutation' | 'subscription';
+type GeneratedSymbolIndex = Map<string, Parser.SyntaxNode[]>;
+export declare const RESOLVE_METHOD_QUERY = "\nMATCH (n)\nWHERE labels(n) IN ['Method','Function','Property','CodeElement']\n  AND n.name = $name AND n.filePath = $filePath AND n.startLine = $startLine AND n.id <> ''\nRETURN n.id AS uid, n.name AS name, n.filePath AS filePath\nORDER BY n.id ASC\nLIMIT 2";
+export declare const RESOLVE_GENERATED_SYMBOL_QUERY = "\nMATCH (n)\nWHERE labels(n) IN ['Const','Variable','Function','Method','CodeElement']\n  AND n.name = $name AND n.filePath <> '' AND n.id <> ''\nRETURN n.id AS uid, n.name AS name, n.filePath AS filePath\nORDER BY n.id ASC\nLIMIT 2";
+export declare function hasGeneratedDocumentProof(initializer: Parser.SyntaxNode, operationKind: GraphqlOperationKind, operationName: string, requiredFields: readonly string[]): boolean;
+export declare function indexGeneratedDeclarators(root: Parser.SyntaxNode): GeneratedSymbolIndex;
+export declare class GraphqlExtractor implements ContractExtractor {
+    type: "graphql";
+    canExtract(_repo: RepoHandle): Promise<boolean>;
+    extract(dbExecutor: CypherExecutor | null, repoPath: string, _repo: RepoHandle): Promise<ExtractedContract[]>;
+    private extractProviders;
+    private extractConsumers;
+}
+export {};