repopo 0.12.0 → 0.14.0

package/esm/runner.js

@@ -1,174 +1,188 @@
-import { all, call } from "effection";
-import { createExcludedPolicyFileMap, } from "./context.js";
+import { all, call, run, spawn } from "effection";
+import { DEFAULT_CONCURRENCY, validateConcurrency } from "./concurrency.js";
+import { createExcludedPolicyFileMap, exclusionRegex, matchesPath, } from "./context.js";
+import { ParsedFileCache } from "./fileCache.js";
 import { identifyPolicyInstances } from "./makePolicy.js";
-import { newPerfStats, runWithPerf, } from "./perf.js";
-import { isPolicyError, isPolicyFixResult } from "./policy.js";
-function isOperation(value) {
-    return (typeof value === "object" &&
-        value !== null &&
-        "next" in value &&
-        typeof value.next === "function");
-}
-function matches(regex, value) {
-    if (!(regex.global || regex.sticky)) {
-        return regex.test(value);
-    }
-    const savedLastIndex = regex.lastIndex;
-    try {
-        regex.lastIndex = 0;
-        return regex.test(value);
-    }
-    finally {
-        regex.lastIndex = savedLastIndex;
-    }
-}
-/**
- * Runs configured policies against files and collects results.
- * @alpha
- */
+import { newPerfStats } from "./perf.js";
+import { PolicyExecutor } from "./policyExecution.js";
+import { annotateInventory, inventoryPaths, snapshotInventory, } from "./repositoryChanges.js";
+/** Effection runner; cancellation unwinds active generator handlers and resolvers. @public */
 export class PolicyRunner {
+    options;
     policies;
-    excludeFromAll;
-    excludePoliciesForFiles;
-    gitRoot;
-    resolve;
-    logger;
+    exclusions;
+    policyExclusions;
+    concurrency;
     constructor(options) {
-        this.policies = identifyPolicyInstances(options.policies);
-        this.excludeFromAll = options.excludeFromAll;
-        this.excludePoliciesForFiles = createExcludedPolicyFileMap(this.policies);
-        for (const [instanceId, exclusions] of options.excludePoliciesForFiles) {
-            this.excludePoliciesForFiles.set(instanceId, exclusions);
+        this.options = options;
+        this.policies = identifyPolicyInstances(options.policies.map((policy) => ({
+            ...policy,
+            config: policy.config === undefined ? policy.defaultConfig : policy.config,
+        })));
+        this.exclusions = (options.exclude ?? []).map(exclusionRegex);
+        this.policyExclusions = createExcludedPolicyFileMap(this.policies);
+        this.concurrency = validateConcurrency(options.concurrency ?? DEFAULT_CONCURRENCY);
+        if (this.policies.some((policy) => policy.scope === "repository" || policy.scope === "changes") &&
+            options.inventory === undefined) {
+            throw new TypeError("Repository policies require an explicit inventory array or loader; files is only a selection.");
+        }
+        for (const policy of this.policies) {
+            if ((policy.scope === "repository" || policy.scope === "changes") &&
+                policy.resolver !== undefined) {
+                throw new TypeError("Repository policies support inline fixes only; remove resolver.");
+            }
+            if (policy.requiresConfig &&
+                policy.config === undefined &&
+                policy.defaultConfig === undefined) {
+                throw new TypeError(`Policy '${policy.name}' requires config.`);
+            }
         }
-        this.gitRoot = options.gitRoot;
-        this.resolve = options.resolve;
-        this.logger = options.logger;
     }
-    *run(filePaths) {
-        const state = {
-            results: [],
-            perfStats: newPerfStats(),
-        };
-        for (const filePath of filePaths) {
-            yield* this.checkOrExcludeFile(filePath, state);
+    *run() {
+        const signal = this.options.signal;
+        if (signal?.aborted) {
+            throw signal.reason;
         }
-        return {
-            results: state.results,
-            perfStats: state.perfStats,
+        const task = yield* spawn(() => this.runInternal());
+        // halt() is lazy; consuming it initiates teardown. The task retains any teardown error.
+        const abort = () => {
+            task.halt().catch(() => undefined);
         };
-    }
-    *checkOrExcludeFile(relPath, state) {
-        state.perfStats.count++;
+        signal?.addEventListener("abort", abort, { once: true });
         try {
-            yield* this.routeToPolicies(relPath, state);
-        }
-        catch (error) {
-            throw new Error(`Error routing ${relPath} to handler: ${error}\nStack:\n${error.stack}`);
-        }
-    }
-    *routeToPolicies(relPath, state) {
-        if (this.excludeFromAll.some((regex) => matches(regex, relPath))) {
-            this.logger?.verbose(`Excluded all handlers: ${relPath}`);
-            return;
-        }
-        const matchingPolicies = this.policies.filter((policy) => matches(policy.match, relPath));
-        if (this.resolve) {
-            // Fixers can read and rewrite the same file.
-            for (const policy of matchingPolicies) {
-                yield* this.runPolicyOnFile(relPath, policy, state);
+            if (signal?.aborted) {
+                abort();
             }
-            return;
+            return yield* task;
+        }
+        finally {
+            signal?.removeEventListener("abort", abort);
         }
-        yield* all(matchingPolicies.map((policy) => {
-            return this.runPolicyOnFile(relPath, policy, state);
-        }));
     }
-    *runPolicyOnFile(relPath, policy, state) {
-        if (this.isPolicyExcluded(relPath, policy)) {
-            this.logger?.verbose(`Excluded from '${policy.instanceId}' policy: ${relPath}`);
-            return;
+    *runInternal() {
+        const result = {
+            findings: [],
+            errors: [],
+            skipped: [],
+            perfStats: newPerfStats(),
+        };
+        const fix = this.options.fix ?? false;
+        const cache = fix ? undefined : new ParsedFileCache();
+        const rawInventory = yield* this.loadInventory();
+        if (rawInventory.some((entry) => typeof entry === "string") &&
+            this.policies.some((policy) => policy.scope === "changes")) {
+            throw new TypeError("Change-aware policies require inventory entries with Git statuses, not string paths.");
         }
+        const inventory = snapshotInventory(rawInventory);
+        const files = this.options.files ?? inventoryPaths(inventory);
+        let fileFixError = false;
         try {
-            const result = yield* this.executePolicyHandler(relPath, policy, state);
-            // Success — nothing to report
-            if (result === true) {
-                return;
+            if (fix) {
+                for (const file of files) {
+                    if (yield* this.runFile(file, result, cache)) {
+                        fileFixError = true;
+                    }
+                }
             }
-            const fileResult = {
-                file: relPath,
-                policy: policy.name,
-                policyId: policy.instanceId,
-                outcome: result,
-            };
-            // Check if resolution should be attempted: result is a failure that
-            // wasn't already fixed, resolve mode is on, and a standalone resolver exists.
-            const alreadyFixed = isPolicyFixResult(result) ||
-                (isPolicyError(result) && result.fixed !== undefined);
-            if (!alreadyFixed && this.resolve && policy.resolver) {
-                const resolution = yield* this.attemptResolution(relPath, policy, policy.resolver, state);
-                fileResult.resolution = resolution;
+            else {
+                yield* this.runReadOnlyFiles(files, result, cache);
             }
-            state.results.push(fileResult);
         }
-        catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            state.results.push({
-                file: relPath,
-                policy: policy.name,
-                policyId: policy.instanceId,
-                outcome: {
-                    error: `System Error: Error executing policy '${policy.instanceId}' for file '${relPath}': ${message}`,
-                },
-            });
+        finally {
+            cache?.clear();
         }
+        yield* this.runRepositories(result, inventory, fileFixError);
+        return result;
     }
-    isPolicyExcluded(relPath, policy) {
-        return (this.excludePoliciesForFiles
-            .get(policy.instanceId)
-            ?.some((regex) => matches(regex, relPath)) ?? false);
+    *runReadOnlyFiles(files, result, cache) {
+        const entries = files.entries();
+        const outputs = [];
+        const runner = this;
+        yield* all(Array.from({ length: Math.min(this.concurrency, files.length) }, function* () {
+            for (let entry = entries.next(); !entry.done; entry = entries.next()) {
+                const [index, file] = entry.value;
+                const local = {
+                    findings: [],
+                    errors: [],
+                    skipped: [],
+                    perfStats: result.perfStats,
+                };
+                yield* runner.runFile(file, local, cache);
+                outputs[index] = local;
+            }
+        }));
+        for (const output of outputs) {
+            result.findings.push(...output.findings);
+            result.errors.push(...output.errors);
+            result.skipped.push(...output.skipped);
+        }
     }
-    *executePolicyHandler(relPath, policy, state) {
-        const { resolve, gitRoot } = this;
-        const result = yield* runWithPerf(policy.instanceId, "handle", state.perfStats, function* () {
-            const args = {
-                file: relPath,
-                root: gitRoot,
-                resolve,
-                config: policy.config,
-            };
-            if (policy._internalHandler) {
-                return yield* policy._internalHandler(args);
+    *runRepositories(result, initialInventory, fileFixError) {
+        let inventory = initialInventory;
+        const fix = this.options.fix ?? false;
+        let repositoryFixError = false;
+        for (const policy of this.policies) {
+            if (policy.scope !== "repository" && policy.scope !== "changes") {
+                continue;
             }
-            const handlerResult = policy.handler(args);
-            if (handlerResult instanceof Promise) {
-                return yield* call(() => handlerResult);
+            if (fileFixError || repositoryFixError) {
+                result.skipped.push({
+                    scope: policy.scope,
+                    policy: policy.name,
+                    policyId: policy.instanceId,
+                    reason: fileFixError ? "file-fix-error" : "repository-fix-error",
+                });
+                continue;
             }
-            if (isOperation(handlerResult)) {
-                return yield* handlerResult;
+            if (fix) {
+                const refreshed = yield* this.loadInventory();
+                inventory = annotateInventory(inventoryPaths(snapshotInventory(refreshed)), initialInventory);
             }
-            throw new Error(`Unexpected handler result type: ${typeof handlerResult}`);
-        });
-        if (result === undefined) {
-            throw new Error("Policy result was undefined.");
+            const eligible = inventory.filter((entry) => !this.excluded(entry.path, policy));
+            repositoryFixError = yield* new PolicyExecutor(this.options.root, fix).repository(policy, eligible, result);
         }
-        return result;
     }
-    *attemptResolution(relPath, policy, resolver, state) {
-        const { gitRoot } = this;
-        return yield* runWithPerf(policy.instanceId, "resolve", state.perfStats, function* () {
-            const result = resolver({
-                file: relPath,
-                root: gitRoot,
-                config: policy.config,
-            });
-            if (result instanceof Promise) {
-                return yield* call(() => result);
+    *loadInventory() {
+        const inventory = this.options.inventory;
+        return ((typeof inventory === "function" ? yield* call(inventory) : inventory) ??
+            []);
+    }
+    excluded(file, policy) {
+        return (this.exclusions.some((regex) => matchesPath(regex, file)) ||
+            (this.policyExclusions.get(policy.instanceId) ?? []).some((regex) => matchesPath(regex, file)));
+    }
+    *runFile(file, output, cache) {
+        output.perfStats.count++;
+        const globallyExcluded = this.exclusions.some((regex) => matchesPath(regex, file));
+        if (!globallyExcluded) {
+            output.perfStats.processed++;
+        }
+        let stopped = false;
+        for (const policy of this.policies) {
+            if (policy.scope !== undefined && policy.scope !== "file") {
+                continue;
             }
-            if (isOperation(result)) {
-                return yield* result;
+            if (!matchesPath(policy.match, file)) {
+                continue;
             }
-            throw new Error(`Unexpected resolver result type: ${typeof result}`);
-        });
+            if (stopped || this.excluded(file, policy)) {
+                output.skipped.push({
+                    scope: "file",
+                    file,
+                    policy: policy.name,
+                    policyId: policy.instanceId,
+                    reason: stopped ? "file-fix-error" : "excluded",
+                });
+                continue;
+            }
+            stopped = yield* new PolicyExecutor(this.options.root, this.options.fix ?? false).file(file, policy, output, cache);
+        }
+        return stopped;
     }
 }
+/** Promise entry point sharing the Effection runner's contracts and cancellation. @public */
+export async function runPolicies(options) {
+    const runner = new PolicyRunner(options);
+    return await run(() => runner.run());
+}
 //# sourceMappingURL=runner.js.map

package/esm/runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"runner.js","sourceRoot":"","sources":["../src/runner.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,IAAI,EAAkB,MAAM,WAAW,CAAC;AAEtD,OAAO,EACN,2BAA2B,GAE3B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EACN,YAAY,EAEZ,WAAW,GACX,MAAM,WAAW,CAAC;AAUnB,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAE/D,SAAS,WAAW,CAAI,KAAc;IACrC,OAAO,CACN,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,MAAM,IAAI,KAAK;QACf,OAAQ,KAA2B,CAAC,IAAI,KAAK,UAAU,CACvD,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,KAAa,EAAE,KAAa;IAC5C,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED,MAAM,cAAc,GAAG,KAAK,CAAC,SAAS,CAAC;IACvC,IAAI,CAAC;QACJ,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;QACpB,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;YAAS,CAAC;QACV,KAAK,CAAC,SAAS,GAAG,cAAc,CAAC;IAClC,CAAC;AACF,CAAC;AA4CD;;;GAGG;AACH,MAAM,OAAO,YAAY;IACP,QAAQ,CAAqB;IAC7B,cAAc,CAAW;IACzB,uBAAuB,CAAwB;IAC/C,OAAO,CAAS;IAChB,OAAO,CAAU;IACjB,MAAM,CAAsC;IAE7D,YAAmB,OAA4B;QAC9C,IAAI,CAAC,QAAQ,GAAG,uBAAuB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7C,IAAI,CAAC,uBAAuB,GAAG,2BAA2B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1E,KAAK,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;YACxE,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,CAAC;IAEM,CAAC,GAAG,CAAC,SAAmB;QAC9B,MAAM,KAAK,GAAmB;YAC7B,OAAO,EAAE,EAAE;YACX,SAAS,EAAE,YAAY,EAAE;SACzB,CAAC;QAEF,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YAClC,KAAK,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACjD,CAAC;QAED,OAAO;YACN,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC1B,CAAC;IACH,CAAC;IAEO,CAAC,kBAAkB,CAC1B,OAAe,EACf,KAAqB;QAErB,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC;YACJ,KAAK,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACd,iBAAiB,OAAO,gBAAgB,KAAK,aAAc,KAAe,CAAC,KAAK,EAAE,CAClF,CAAC;QACH,CAAC;IACF,CAAC;IAEO,CAAC,eAAe,CACvB,OAAe,EACf,KAAqB;QAErB,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;YAC1D,OAAO;QACR,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CACxD,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAC9B,CAAC;QACF,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,6CAA6C;YAC7C,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;gBACvC,KAAK,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACrD,CAAC;YACD,OAAO;QACR,CAAC;QAED,KAAK,CAAC,CAAC,GAAG,CACT,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;YAC/B,OAAO,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACrD,CAAC,CAAC,CACF,CAAC;IACH,CAAC;IAEO,CAAC,eAAe,CACvB,OAAe,EACf,MAAwB,EACxB,KAAqB;QAErB,IAAI,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,MAAM,EAAE,OAAO,CACnB,kBAAkB,MAAM,CAAC,UAAU,aAAa,OAAO,EAAE,CACzD,CAAC;YACF,OAAO;QACR,CAAC;QAED,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YAExE,8BAA8B;YAC9B,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACrB,OAAO;YACR,CAAC;YAED,MAAM,UAAU,GAAqB;gBACpC,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE,MAAM,CAAC,IAAI;gBACnB,QAAQ,EAAE,MAAM,CAAC,UAAU;gBAC3B,OAAO,EAAE,MAAM;aACf,CAAC;YAEF,oEAAoE;YACpE,8EAA8E;YAC9E,MAAM,YAAY,GACjB,iBAAiB,CAAC,MAAM,CAAC;gBACzB,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;YAEvD,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACtD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAC/C,OAAO,EACP,MAAM,EACN,MAAM,CAAC,QAAQ,EACf,KAAK,CACL,CAAC;gBACF,UAAU,CAAC,UAAU,GAAG,UAAU,CAAC;YACpC,CAAC;YAED,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;gBAClB,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE,MAAM,CAAC,IAAI;gBACnB,QAAQ,EAAE,MAAM,CAAC,UAAU;gBAC3B,OAAO,EAAE;oBACR,KAAK,EAAE,yCAAyC,MAAM,CAAC,UAAU,eAAe,OAAO,MAAM,OAAO,EAAE;iBACtG;aACD,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAEO,gBAAgB,CAAC,OAAe,EAAE,MAAwB;QACjE,OAAO,CACN,IAAI,CAAC,uBAAuB;aAC1B,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC;YACvB,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,CACpD,CAAC;IACH,CAAC;IAEO,CAAC,oBAAoB,CAC5B,OAAe,EACf,MAAwB,EACxB,KAAqB;QAErB,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;QAElC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,WAAW,CAChC,MAAM,CAAC,UAAU,EACjB,QAAQ,EACR,KAAK,CAAC,SAAS,EACf,QAAQ,CAAC;YACR,MAAM,IAAI,GAAG;gBACZ,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,OAAO;gBACb,OAAO;gBACP,MAAM,EAAE,MAAM,CAAC,MAAM;aACrB,CAAC;YAEF,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;gBAC7B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAC7C,CAAC;YAED,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC3C,IAAI,aAAa,YAAY,OAAO,EAAE,CAAC;gBACtC,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC;YACzC,CAAC;YACD,IAAI,WAAW,CAAsB,aAAa,CAAC,EAAE,CAAC;gBACrD,OAAO,KAAK,CAAC,CAAC,aAAa,CAAC;YAC7B,CAAC;YACD,MAAM,IAAI,KAAK,CACd,mCAAmC,OAAO,aAAa,EAAE,CACzD,CAAC;QACH,CAAC,CACD,CAAC;QAEF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACjD,CAAC;QAED,OAAO,MAAM,CAAC;IACf,CAAC;IAEO,CAAC,iBAAiB,CACzB,OAAe,EACf,MAAwB,EACxB,QAAkC,EAClC,KAAqB;QAErB,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;QAEzB,OAAO,KAAK,CAAC,CAAC,WAAW,CACxB,MAAM,CAAC,UAAU,EACjB,SAAS,EACT,KAAK,CAAC,SAAS,EACf,QAAQ,CAAC;YACR,MAAM,MAAM,GAAG,QAAQ,CAAC;gBACvB,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE,MAAM,CAAC,MAAM;aACrB,CAAC,CAAC;YACH,IAAI,MAAM,YAAY,OAAO,EAAE,CAAC;gBAC/B,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC;YAClC,CAAC;YACD,IAAI,WAAW,CAAkB,MAAM,CAAC,EAAE,CAAC;gBAC1C,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC;YACtB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,OAAO,MAAM,EAAE,CAAC,CAAC;QACtE,CAAC,CACD,CAAC;IACH,CAAC;CACD","sourcesContent":["import type { Logger } from \"@tylerbu/cli-api\";\nimport { all, call, type Operation } from \"effection\";\n\nimport {\n\tcreateExcludedPolicyFileMap,\n\ttype ExcludedPolicyFileMap,\n} from \"./context.js\";\nimport { identifyPolicyInstances } from \"./makePolicy.js\";\nimport {\n\tnewPerfStats,\n\ttype PolicyHandlerPerfStats,\n\trunWithPerf,\n} from \"./perf.js\";\nimport type {\n\tIdentifiedPolicy,\n\tPolicyFixResult,\n\tPolicyHandlerResult,\n\tPolicyInstance,\n\tPolicyInstanceId,\n\tPolicyName,\n\tPolicyStandaloneResolver,\n} from \"./policy.js\";\nimport { isPolicyError, isPolicyFixResult } from \"./policy.js\";\n\nfunction isOperation<T>(value: unknown): value is Operation<T> {\n\treturn (\n\t\ttypeof value === \"object\" &&\n\t\tvalue !== null &&\n\t\t\"next\" in value &&\n\t\ttypeof (value as { next: unknown }).next === \"function\"\n\t);\n}\n\nfunction matches(regex: RegExp, value: string): boolean {\n\tif (!(regex.global || regex.sticky)) {\n\t\treturn regex.test(value);\n\t}\n\n\tconst savedLastIndex = regex.lastIndex;\n\ttry {\n\t\tregex.lastIndex = 0;\n\t\treturn regex.test(value);\n\t} finally {\n\t\tregex.lastIndex = savedLastIndex;\n\t}\n}\n\n/**\n * Result of running a single policy on a single file.\n * @alpha\n */\nexport interface PolicyFileResult {\n\tfile: string;\n\tpolicy: PolicyName;\n\t/** Stable identity of the configured policy instance */\n\tpolicyId: PolicyInstanceId;\n\t/** The raw result from the policy handler */\n\toutcome: PolicyHandlerResult;\n\t/** Set when a standalone resolver was attempted (legacy resolver path) */\n\tresolution?: PolicyFixResult;\n}\n\n/**\n * Aggregated results from a full policy run.\n * @alpha\n */\nexport interface PolicyRunResults {\n\tresults: PolicyFileResult[];\n\tperfStats: PolicyHandlerPerfStats;\n}\n\ninterface PolicyRunState {\n\tresults: PolicyFileResult[];\n\tperfStats: PolicyHandlerPerfStats;\n}\n\n/**\n * Options for configuring a {@link PolicyRunner}.\n * @alpha\n */\nexport interface PolicyRunnerOptions {\n\tpolicies: PolicyInstance[];\n\texcludeFromAll: RegExp[];\n\texcludePoliciesForFiles: ExcludedPolicyFileMap;\n\tgitRoot: string;\n\tresolve: boolean;\n\tlogger?: Pick<Logger, \"verbose\">;\n}\n\n/**\n * Runs configured policies against files and collects results.\n * @alpha\n */\nexport class PolicyRunner {\n\tprivate readonly policies: IdentifiedPolicy[];\n\tprivate readonly excludeFromAll: RegExp[];\n\tprivate readonly excludePoliciesForFiles: ExcludedPolicyFileMap;\n\tprivate readonly gitRoot: string;\n\tprivate readonly resolve: boolean;\n\tprivate readonly logger: Pick<Logger, \"verbose\"> | undefined;\n\n\tpublic constructor(options: PolicyRunnerOptions) {\n\t\tthis.policies = identifyPolicyInstances(options.policies);\n\t\tthis.excludeFromAll = options.excludeFromAll;\n\t\tthis.excludePoliciesForFiles = createExcludedPolicyFileMap(this.policies);\n\t\tfor (const [instanceId, exclusions] of options.excludePoliciesForFiles) {\n\t\t\tthis.excludePoliciesForFiles.set(instanceId, exclusions);\n\t\t}\n\t\tthis.gitRoot = options.gitRoot;\n\t\tthis.resolve = options.resolve;\n\t\tthis.logger = options.logger;\n\t}\n\n\tpublic *run(filePaths: string[]): Operation<PolicyRunResults> {\n\t\tconst state: PolicyRunState = {\n\t\t\tresults: [],\n\t\t\tperfStats: newPerfStats(),\n\t\t};\n\n\t\tfor (const filePath of filePaths) {\n\t\t\tyield* this.checkOrExcludeFile(filePath, state);\n\t\t}\n\n\t\treturn {\n\t\t\tresults: state.results,\n\t\t\tperfStats: state.perfStats,\n\t\t};\n\t}\n\n\tprivate *checkOrExcludeFile(\n\t\trelPath: string,\n\t\tstate: PolicyRunState,\n\t): Operation<void> {\n\t\tstate.perfStats.count++;\n\t\ttry {\n\t\t\tyield* this.routeToPolicies(relPath, state);\n\t\t} catch (error: unknown) {\n\t\t\tthrow new Error(\n\t\t\t\t`Error routing ${relPath} to handler: ${error}\\nStack:\\n${(error as Error).stack}`,\n\t\t\t);\n\t\t}\n\t}\n\n\tprivate *routeToPolicies(\n\t\trelPath: string,\n\t\tstate: PolicyRunState,\n\t): Operation<void> {\n\t\tif (this.excludeFromAll.some((regex) => matches(regex, relPath))) {\n\t\t\tthis.logger?.verbose(`Excluded all handlers: ${relPath}`);\n\t\t\treturn;\n\t\t}\n\n\t\tconst matchingPolicies = this.policies.filter((policy) =>\n\t\t\tmatches(policy.match, relPath),\n\t\t);\n\t\tif (this.resolve) {\n\t\t\t// Fixers can read and rewrite the same file.\n\t\t\tfor (const policy of matchingPolicies) {\n\t\t\t\tyield* this.runPolicyOnFile(relPath, policy, state);\n\t\t\t}\n\t\t\treturn;\n\t\t}\n\n\t\tyield* all(\n\t\t\tmatchingPolicies.map((policy) => {\n\t\t\t\treturn this.runPolicyOnFile(relPath, policy, state);\n\t\t\t}),\n\t\t);\n\t}\n\n\tprivate *runPolicyOnFile(\n\t\trelPath: string,\n\t\tpolicy: IdentifiedPolicy,\n\t\tstate: PolicyRunState,\n\t): Operation<void> {\n\t\tif (this.isPolicyExcluded(relPath, policy)) {\n\t\t\tthis.logger?.verbose(\n\t\t\t\t`Excluded from '${policy.instanceId}' policy: ${relPath}`,\n\t\t\t);\n\t\t\treturn;\n\t\t}\n\n\t\ttry {\n\t\t\tconst result = yield* this.executePolicyHandler(relPath, policy, state);\n\n\t\t\t// Success — nothing to report\n\t\t\tif (result === true) {\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tconst fileResult: PolicyFileResult = {\n\t\t\t\tfile: relPath,\n\t\t\t\tpolicy: policy.name,\n\t\t\t\tpolicyId: policy.instanceId,\n\t\t\t\toutcome: result,\n\t\t\t};\n\n\t\t\t// Check if resolution should be attempted: result is a failure that\n\t\t\t// wasn't already fixed, resolve mode is on, and a standalone resolver exists.\n\t\t\tconst alreadyFixed =\n\t\t\t\tisPolicyFixResult(result) ||\n\t\t\t\t(isPolicyError(result) && result.fixed !== undefined);\n\n\t\t\tif (!alreadyFixed && this.resolve && policy.resolver) {\n\t\t\t\tconst resolution = yield* this.attemptResolution(\n\t\t\t\t\trelPath,\n\t\t\t\t\tpolicy,\n\t\t\t\t\tpolicy.resolver,\n\t\t\t\t\tstate,\n\t\t\t\t);\n\t\t\t\tfileResult.resolution = resolution;\n\t\t\t}\n\n\t\t\tstate.results.push(fileResult);\n\t\t} catch (error: unknown) {\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\tstate.results.push({\n\t\t\t\tfile: relPath,\n\t\t\t\tpolicy: policy.name,\n\t\t\t\tpolicyId: policy.instanceId,\n\t\t\t\toutcome: {\n\t\t\t\t\terror: `System Error: Error executing policy '${policy.instanceId}' for file '${relPath}': ${message}`,\n\t\t\t\t},\n\t\t\t});\n\t\t}\n\t}\n\n\tprivate isPolicyExcluded(relPath: string, policy: IdentifiedPolicy): boolean {\n\t\treturn (\n\t\t\tthis.excludePoliciesForFiles\n\t\t\t\t.get(policy.instanceId)\n\t\t\t\t?.some((regex) => matches(regex, relPath)) ?? false\n\t\t);\n\t}\n\n\tprivate *executePolicyHandler(\n\t\trelPath: string,\n\t\tpolicy: IdentifiedPolicy,\n\t\tstate: PolicyRunState,\n\t): Operation<PolicyHandlerResult> {\n\t\tconst { resolve, gitRoot } = this;\n\n\t\tconst result = yield* runWithPerf(\n\t\t\tpolicy.instanceId,\n\t\t\t\"handle\",\n\t\t\tstate.perfStats,\n\t\t\tfunction* () {\n\t\t\t\tconst args = {\n\t\t\t\t\tfile: relPath,\n\t\t\t\t\troot: gitRoot,\n\t\t\t\t\tresolve,\n\t\t\t\t\tconfig: policy.config,\n\t\t\t\t};\n\n\t\t\t\tif (policy._internalHandler) {\n\t\t\t\t\treturn yield* policy._internalHandler(args);\n\t\t\t\t}\n\n\t\t\t\tconst handlerResult = policy.handler(args);\n\t\t\t\tif (handlerResult instanceof Promise) {\n\t\t\t\t\treturn yield* call(() => handlerResult);\n\t\t\t\t}\n\t\t\t\tif (isOperation<PolicyHandlerResult>(handlerResult)) {\n\t\t\t\t\treturn yield* handlerResult;\n\t\t\t\t}\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`Unexpected handler result type: ${typeof handlerResult}`,\n\t\t\t\t);\n\t\t\t},\n\t\t);\n\n\t\tif (result === undefined) {\n\t\t\tthrow new Error(\"Policy result was undefined.\");\n\t\t}\n\n\t\treturn result;\n\t}\n\n\tprivate *attemptResolution(\n\t\trelPath: string,\n\t\tpolicy: IdentifiedPolicy,\n\t\tresolver: PolicyStandaloneResolver,\n\t\tstate: PolicyRunState,\n\t): Operation<PolicyFixResult> {\n\t\tconst { gitRoot } = this;\n\n\t\treturn yield* runWithPerf(\n\t\t\tpolicy.instanceId,\n\t\t\t\"resolve\",\n\t\t\tstate.perfStats,\n\t\t\tfunction* () {\n\t\t\t\tconst result = resolver({\n\t\t\t\t\tfile: relPath,\n\t\t\t\t\troot: gitRoot,\n\t\t\t\t\tconfig: policy.config,\n\t\t\t\t});\n\t\t\t\tif (result instanceof Promise) {\n\t\t\t\t\treturn yield* call(() => result);\n\t\t\t\t}\n\t\t\t\tif (isOperation<PolicyFixResult>(result)) {\n\t\t\t\t\treturn yield* result;\n\t\t\t\t}\n\t\t\t\tthrow new Error(`Unexpected resolver result type: ${typeof result}`);\n\t\t\t},\n\t\t);\n\t}\n}\n"]}
+{"version":3,"file":"runner.js","sourceRoot":"","sources":["../src/runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,IAAI,EAAkB,GAAG,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EACN,2BAA2B,EAE3B,cAAc,EACd,WAAW,GACX,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAA+B,MAAM,WAAW,CAAC;AAMtE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EACN,iBAAiB,EACjB,cAAc,EAEd,iBAAiB,GACjB,MAAM,wBAAwB,CAAC;AAmEhC,8FAA8F;AAC9F,MAAM,OAAO,YAAY;IAMY;IALnB,QAAQ,CAAqB;IAC7B,UAAU,CAAW;IACrB,gBAAgB,CAAwB;IACxC,WAAW,CAAS;IAErC,YAAoC,OAA4B;QAA5B,YAAO,GAAP,OAAO,CAAqB;QAC/D,IAAI,CAAC,QAAQ,GAAG,uBAAuB,CACtC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACjC,GAAG,MAAM;YACT,MAAM,EACL,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM;SACnE,CAAC,CAAC,CACH,CAAC;QACF,IAAI,CAAC,UAAU,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC9D,IAAI,CAAC,gBAAgB,GAAG,2BAA2B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnE,IAAI,CAAC,WAAW,GAAG,mBAAmB,CACrC,OAAO,CAAC,WAAW,IAAI,mBAAmB,CAC1C,CAAC;QACF,IACC,IAAI,CAAC,QAAQ,CAAC,IAAI,CACjB,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,YAAY,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,CACvE;YACD,OAAO,CAAC,SAAS,KAAK,SAAS,EAC9B,CAAC;YACF,MAAM,IAAI,SAAS,CAClB,+FAA+F,CAC/F,CAAC;QACH,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,IACC,CAAC,MAAM,CAAC,KAAK,KAAK,YAAY,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC;gBAC7D,MAAM,CAAC,QAAQ,KAAK,SAAS,EAC5B,CAAC;gBACF,MAAM,IAAI,SAAS,CAClB,iEAAiE,CACjE,CAAC;YACH,CAAC;YACD,IACC,MAAM,CAAC,cAAc;gBACrB,MAAM,CAAC,MAAM,KAAK,SAAS;gBAC3B,MAAM,CAAC,aAAa,KAAK,SAAS,EACjC,CAAC;gBACF,MAAM,IAAI,SAAS,CAAC,WAAW,MAAM,CAAC,IAAI,oBAAoB,CAAC,CAAC;YACjE,CAAC;QACF,CAAC;IACF,CAAC;IAEM,CAAC,GAAG;QACV,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACnC,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACrB,MAAM,MAAM,CAAC,MAAM,CAAC;QACrB,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACpD,wFAAwF;QACxF,MAAM,KAAK,GAAG,GAAG,EAAE;YAClB,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC,CAAC;QACF,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC;YACJ,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBACrB,KAAK,EAAE,CAAC;YACT,CAAC;YACD,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC;QACpB,CAAC;gBAAS,CAAC;YACV,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;IACF,CAAC;IAEO,CAAC,WAAW;QACnB,MAAM,MAAM,GAAqB;YAChC,QAAQ,EAAE,EAAE;YACZ,MAAM,EAAE,EAAE;YACV,OAAO,EAAE,EAAE;YACX,SAAS,EAAE,YAAY,EAAE;SACzB,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,KAAK,CAAC;QACtC,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC;QACtD,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QACjD,IACC,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;YACvD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,EACzD,CAAC;YACF,MAAM,IAAI,SAAS,CAClB,sFAAsF,CACtF,CAAC;QACH,CAAC;QACD,MAAM,SAAS,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,cAAc,CAAC,SAAS,CAAC,CAAC;QAC9D,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,CAAC;YACJ,IAAI,GAAG,EAAE,CAAC;gBACT,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBAC1B,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;wBAC9C,YAAY,GAAG,IAAI,CAAC;oBACrB,CAAC;gBACF,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,KAAK,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACpD,CAAC;QACF,CAAC;gBAAS,CAAC;YACV,KAAK,EAAE,KAAK,EAAE,CAAC;QAChB,CAAC;QACD,KAAK,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC;IACf,CAAC;IAEO,CAAC,gBAAgB,CACxB,KAAwB,EACxB,MAAwB,EACxB,KAAkC;QAElC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;QAChC,MAAM,OAAO,GAAuB,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC;QACpB,KAAK,CAAC,CAAC,GAAG,CACT,KAAK,CAAC,IAAI,CACT,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,EACpD,QAAQ,CAAC;YACR,KACC,IAAI,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,EAC1B,CAAC,KAAK,CAAC,IAAI,EACX,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,EACrB,CAAC;gBACF,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;gBAClC,MAAM,KAAK,GAAqB;oBAC/B,QAAQ,EAAE,EAAE;oBACZ,MAAM,EAAE,EAAE;oBACV,OAAO,EAAE,EAAE;oBACX,SAAS,EAAE,MAAM,CAAC,SAAS;iBAC3B,CAAC;gBACF,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;gBAC1C,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;YACxB,CAAC;QACF,CAAC,CACD,CACD,CAAC;QACF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC9B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;YACzC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YACrC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC;IACF,CAAC;IAEO,CAAC,eAAe,CACvB,MAAwB,EACxB,gBAA2C,EAC3C,YAAqB;QAErB,IAAI,SAAS,GAAG,gBAAgB,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,KAAK,CAAC;QACtC,IAAI,kBAAkB,GAAG,KAAK,CAAC;QAC/B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,MAAM,CAAC,KAAK,KAAK,YAAY,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBACjE,SAAS;YACV,CAAC;YACD,IAAI,YAAY,IAAI,kBAAkB,EAAE,CAAC;gBACxC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,MAAM,EAAE,MAAM,CAAC,IAAI;oBACnB,QAAQ,EAAE,MAAM,CAAC,UAAU;oBAC3B,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,sBAAsB;iBAChE,CAAC,CAAC;gBACH,SAAS;YACV,CAAC;YACD,IAAI,GAAG,EAAE,CAAC;gBACT,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC9C,SAAS,GAAG,iBAAiB,CAC5B,cAAc,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,EAC5C,gBAAgB,CAChB,CAAC;YACH,CAAC;YACD,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAChC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAC7C,CAAC;YACF,kBAAkB,GAAG,KAAK,CAAC,CAAC,IAAI,cAAc,CAC7C,IAAI,CAAC,OAAO,CAAC,IAAI,EACjB,GAAG,CACH,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACxC,CAAC;IACF,CAAC;IAEO,CAAC,aAAa;QACrB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QACzC,OAAO,CACN,CAAC,OAAO,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACtE,EAAE,CACF,CAAC;IACH,CAAC;IAEO,QAAQ,CAAC,IAAY,EAAE,MAAwB;QACtD,OAAO,CACN,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACzD,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACnE,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CACxB,CACD,CAAC;IACH,CAAC;IAEO,CAAC,OAAO,CACf,IAAY,EACZ,MAAwB,EACxB,KAAkC;QAElC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACvD,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CACxB,CAAC;QACF,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACvB,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;QAC9B,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;gBAC3D,SAAS;YACV,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;gBACtC,SAAS;YACV,CAAC;YACD,IAAI,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;gBAC5C,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,MAAM;oBACb,IAAI;oBACJ,MAAM,EAAE,MAAM,CAAC,IAAI;oBACnB,QAAQ,EAAE,MAAM,CAAC,UAAU;oBAC3B,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,UAAU;iBAC/C,CAAC,CAAC;gBACH,SAAS;YACV,CAAC;YACD,OAAO,GAAG,KAAK,CAAC,CAAC,IAAI,cAAc,CAClC,IAAI,CAAC,OAAO,CAAC,IAAI,EACjB,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,KAAK,CACzB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,OAAO,CAAC;IAChB,CAAC;CACD;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,WAAW,CAChC,OAA4B;IAE5B,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,CAAC;IACzC,OAAO,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;AACtC,CAAC","sourcesContent":["import { all, call, type Operation, run, spawn } from \"effection\";\nimport { DEFAULT_CONCURRENCY, validateConcurrency } from \"./concurrency.js\";\nimport {\n\tcreateExcludedPolicyFileMap,\n\ttype ExcludedPolicyFileMap,\n\texclusionRegex,\n\tmatchesPath,\n} from \"./context.js\";\nimport { ParsedFileCache } from \"./fileCache.js\";\nimport { identifyPolicyInstances } from \"./makePolicy.js\";\nimport { newPerfStats, type PolicyHandlerPerfStats } from \"./perf.js\";\nimport type {\n\tConfiguredPolicy,\n\tIdentifiedPolicy,\n\tPolicyFinding,\n} from \"./policy.js\";\nimport { PolicyExecutor } from \"./policyExecution.js\";\nimport {\n\tannotateInventory,\n\tinventoryPaths,\n\ttype RepositoryFile,\n\tsnapshotInventory,\n} from \"./repositoryChanges.js\";\n\n/** A finding with runner-owned identity and scope-safe location. @public */\nexport type PolicyRunFinding =\n\t| (Omit<PolicyFinding, \"files\"> & {\n\t\t\tscope: \"file\";\n\t\t\tfile: string;\n\t\t\tfiles?: never;\n\t\t\tpolicy: string;\n\t\t\tpolicyId: string;\n\t  })\n\t| (PolicyFinding & {\n\t\t\tscope: \"repository\" | \"changes\";\n\t\t\tfile?: never;\n\t\t\tpolicy: string;\n\t\t\tpolicyId: string;\n\t  });\n\n/** An execution failure, separate from ordinary policy findings. @public */\nexport type PolicyExecutionError = {\n\tpolicy: string;\n\tpolicyId: string;\n\tphase: \"handle\" | \"resolve\";\n\tkind: \"contract\" | \"exception\";\n\tmessage: string;\n\tcause: unknown;\n} & (\n\t| { scope: \"file\"; file: string; files?: never }\n\t| { scope: \"repository\" | \"changes\"; files: readonly string[]; file?: never }\n);\n\n/** A unit that was not executed. @public */\nexport type PolicySkippedWork = {\n\tpolicy: string;\n\tpolicyId: string;\n\treason: \"excluded\" | \"file-fix-error\" | \"repository-fix-error\";\n} & (\n\t| { scope: \"file\"; file: string }\n\t| { scope: \"repository\" | \"changes\"; file?: never }\n);\n\n/** Findings, failures, skipped units, and file/per-instance timing statistics. @public */\nexport interface PolicyRunResults {\n\tfindings: PolicyRunFinding[];\n\terrors: PolicyExecutionError[];\n\tskipped: PolicySkippedWork[];\n\tperfStats: PolicyHandlerPerfStats;\n}\n\n/** Full repository inventory, never inferred from a file selection. @public */\nexport type RepositoryInventory =\n\t| readonly (string | RepositoryFile)[]\n\t| (() => Promise<readonly (string | RepositoryFile)[]>);\n\n/** Shared Promise and Effection runner options. @public */\nexport interface PolicyRunnerOptions {\n\tpolicies: readonly ConfiguredPolicy[];\n\troot: string;\n\tinventory?: RepositoryInventory | undefined;\n\t/** Selection limits only file policies. Defaults to inventory when supplied. */\n\tfiles?: readonly string[] | undefined;\n\texclude?: readonly (string | RegExp)[] | undefined;\n\tfix?: boolean | undefined;\n\tconcurrency?: number | undefined;\n\tsignal?: AbortSignal | undefined;\n}\n\n/** Effection runner; cancellation unwinds active generator handlers and resolvers. @public */\nexport class PolicyRunner {\n\tprivate readonly policies: IdentifiedPolicy[];\n\tprivate readonly exclusions: RegExp[];\n\tprivate readonly policyExclusions: ExcludedPolicyFileMap;\n\tprivate readonly concurrency: number;\n\n\tpublic constructor(private readonly options: PolicyRunnerOptions) {\n\t\tthis.policies = identifyPolicyInstances(\n\t\t\toptions.policies.map((policy) => ({\n\t\t\t\t...policy,\n\t\t\t\tconfig:\n\t\t\t\t\tpolicy.config === undefined ? policy.defaultConfig : policy.config,\n\t\t\t})),\n\t\t);\n\t\tthis.exclusions = (options.exclude ?? []).map(exclusionRegex);\n\t\tthis.policyExclusions = createExcludedPolicyFileMap(this.policies);\n\t\tthis.concurrency = validateConcurrency(\n\t\t\toptions.concurrency ?? DEFAULT_CONCURRENCY,\n\t\t);\n\t\tif (\n\t\t\tthis.policies.some(\n\t\t\t\t(policy) => policy.scope === \"repository\" || policy.scope === \"changes\",\n\t\t\t) &&\n\t\t\toptions.inventory === undefined\n\t\t) {\n\t\t\tthrow new TypeError(\n\t\t\t\t\"Repository policies require an explicit inventory array or loader; files is only a selection.\",\n\t\t\t);\n\t\t}\n\t\tfor (const policy of this.policies) {\n\t\t\tif (\n\t\t\t\t(policy.scope === \"repository\" || policy.scope === \"changes\") &&\n\t\t\t\tpolicy.resolver !== undefined\n\t\t\t) {\n\t\t\t\tthrow new TypeError(\n\t\t\t\t\t\"Repository policies support inline fixes only; remove resolver.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (\n\t\t\t\tpolicy.requiresConfig &&\n\t\t\t\tpolicy.config === undefined &&\n\t\t\t\tpolicy.defaultConfig === undefined\n\t\t\t) {\n\t\t\t\tthrow new TypeError(`Policy '${policy.name}' requires config.`);\n\t\t\t}\n\t\t}\n\t}\n\n\tpublic *run(): Operation<PolicyRunResults> {\n\t\tconst signal = this.options.signal;\n\t\tif (signal?.aborted) {\n\t\t\tthrow signal.reason;\n\t\t}\n\t\tconst task = yield* spawn(() => this.runInternal());\n\t\t// halt() is lazy; consuming it initiates teardown. The task retains any teardown error.\n\t\tconst abort = () => {\n\t\t\ttask.halt().catch(() => undefined);\n\t\t};\n\t\tsignal?.addEventListener(\"abort\", abort, { once: true });\n\t\ttry {\n\t\t\tif (signal?.aborted) {\n\t\t\t\tabort();\n\t\t\t}\n\t\t\treturn yield* task;\n\t\t} finally {\n\t\t\tsignal?.removeEventListener(\"abort\", abort);\n\t\t}\n\t}\n\n\tprivate *runInternal(): Operation<PolicyRunResults> {\n\t\tconst result: PolicyRunResults = {\n\t\t\tfindings: [],\n\t\t\terrors: [],\n\t\t\tskipped: [],\n\t\t\tperfStats: newPerfStats(),\n\t\t};\n\t\tconst fix = this.options.fix ?? false;\n\t\tconst cache = fix ? undefined : new ParsedFileCache();\n\t\tconst rawInventory = yield* this.loadInventory();\n\t\tif (\n\t\t\trawInventory.some((entry) => typeof entry === \"string\") &&\n\t\t\tthis.policies.some((policy) => policy.scope === \"changes\")\n\t\t) {\n\t\t\tthrow new TypeError(\n\t\t\t\t\"Change-aware policies require inventory entries with Git statuses, not string paths.\",\n\t\t\t);\n\t\t}\n\t\tconst inventory = snapshotInventory(rawInventory);\n\t\tconst files = this.options.files ?? inventoryPaths(inventory);\n\t\tlet fileFixError = false;\n\t\ttry {\n\t\t\tif (fix) {\n\t\t\t\tfor (const file of files) {\n\t\t\t\t\tif (yield* this.runFile(file, result, cache)) {\n\t\t\t\t\t\tfileFixError = true;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\tyield* this.runReadOnlyFiles(files, result, cache);\n\t\t\t}\n\t\t} finally {\n\t\t\tcache?.clear();\n\t\t}\n\t\tyield* this.runRepositories(result, inventory, fileFixError);\n\t\treturn result;\n\t}\n\n\tprivate *runReadOnlyFiles(\n\t\tfiles: readonly string[],\n\t\tresult: PolicyRunResults,\n\t\tcache: ParsedFileCache | undefined,\n\t): Operation<void> {\n\t\tconst entries = files.entries();\n\t\tconst outputs: PolicyRunResults[] = [];\n\t\tconst runner = this;\n\t\tyield* all(\n\t\t\tArray.from(\n\t\t\t\t{ length: Math.min(this.concurrency, files.length) },\n\t\t\t\tfunction* () {\n\t\t\t\t\tfor (\n\t\t\t\t\t\tlet entry = entries.next();\n\t\t\t\t\t\t!entry.done;\n\t\t\t\t\t\tentry = entries.next()\n\t\t\t\t\t) {\n\t\t\t\t\t\tconst [index, file] = entry.value;\n\t\t\t\t\t\tconst local: PolicyRunResults = {\n\t\t\t\t\t\t\tfindings: [],\n\t\t\t\t\t\t\terrors: [],\n\t\t\t\t\t\t\tskipped: [],\n\t\t\t\t\t\t\tperfStats: result.perfStats,\n\t\t\t\t\t\t};\n\t\t\t\t\t\tyield* runner.runFile(file, local, cache);\n\t\t\t\t\t\toutputs[index] = local;\n\t\t\t\t\t}\n\t\t\t\t},\n\t\t\t),\n\t\t);\n\t\tfor (const output of outputs) {\n\t\t\tresult.findings.push(...output.findings);\n\t\t\tresult.errors.push(...output.errors);\n\t\t\tresult.skipped.push(...output.skipped);\n\t\t}\n\t}\n\n\tprivate *runRepositories(\n\t\tresult: PolicyRunResults,\n\t\tinitialInventory: readonly RepositoryFile[],\n\t\tfileFixError: boolean,\n\t): Operation<void> {\n\t\tlet inventory = initialInventory;\n\t\tconst fix = this.options.fix ?? false;\n\t\tlet repositoryFixError = false;\n\t\tfor (const policy of this.policies) {\n\t\t\tif (policy.scope !== \"repository\" && policy.scope !== \"changes\") {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (fileFixError || repositoryFixError) {\n\t\t\t\tresult.skipped.push({\n\t\t\t\t\tscope: policy.scope,\n\t\t\t\t\tpolicy: policy.name,\n\t\t\t\t\tpolicyId: policy.instanceId,\n\t\t\t\t\treason: fileFixError ? \"file-fix-error\" : \"repository-fix-error\",\n\t\t\t\t});\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (fix) {\n\t\t\t\tconst refreshed = yield* this.loadInventory();\n\t\t\t\tinventory = annotateInventory(\n\t\t\t\t\tinventoryPaths(snapshotInventory(refreshed)),\n\t\t\t\t\tinitialInventory,\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst eligible = inventory.filter(\n\t\t\t\t(entry) => !this.excluded(entry.path, policy),\n\t\t\t);\n\t\t\trepositoryFixError = yield* new PolicyExecutor(\n\t\t\t\tthis.options.root,\n\t\t\t\tfix,\n\t\t\t).repository(policy, eligible, result);\n\t\t}\n\t}\n\n\tprivate *loadInventory(): Operation<readonly (string | RepositoryFile)[]> {\n\t\tconst inventory = this.options.inventory;\n\t\treturn (\n\t\t\t(typeof inventory === \"function\" ? yield* call(inventory) : inventory) ??\n\t\t\t[]\n\t\t);\n\t}\n\n\tprivate excluded(file: string, policy: IdentifiedPolicy): boolean {\n\t\treturn (\n\t\t\tthis.exclusions.some((regex) => matchesPath(regex, file)) ||\n\t\t\t(this.policyExclusions.get(policy.instanceId) ?? []).some((regex) =>\n\t\t\t\tmatchesPath(regex, file),\n\t\t\t)\n\t\t);\n\t}\n\n\tprivate *runFile(\n\t\tfile: string,\n\t\toutput: PolicyRunResults,\n\t\tcache: ParsedFileCache | undefined,\n\t): Operation<boolean> {\n\t\toutput.perfStats.count++;\n\t\tconst globallyExcluded = this.exclusions.some((regex) =>\n\t\t\tmatchesPath(regex, file),\n\t\t);\n\t\tif (!globallyExcluded) {\n\t\t\toutput.perfStats.processed++;\n\t\t}\n\t\tlet stopped = false;\n\t\tfor (const policy of this.policies) {\n\t\t\tif (policy.scope !== undefined && policy.scope !== \"file\") {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (!matchesPath(policy.match, file)) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (stopped || this.excluded(file, policy)) {\n\t\t\t\toutput.skipped.push({\n\t\t\t\t\tscope: \"file\",\n\t\t\t\t\tfile,\n\t\t\t\t\tpolicy: policy.name,\n\t\t\t\t\tpolicyId: policy.instanceId,\n\t\t\t\t\treason: stopped ? \"file-fix-error\" : \"excluded\",\n\t\t\t\t});\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tstopped = yield* new PolicyExecutor(\n\t\t\t\tthis.options.root,\n\t\t\t\tthis.options.fix ?? false,\n\t\t\t).file(file, policy, output, cache);\n\t\t}\n\t\treturn stopped;\n\t}\n}\n\n/** Promise entry point sharing the Effection runner's contracts and cancellation. @public */\nexport async function runPolicies(\n\toptions: PolicyRunnerOptions,\n): Promise<PolicyRunResults> {\n\tconst runner = new PolicyRunner(options);\n\treturn await run(() => runner.run());\n}\n"]}

package/esm/settlePolicyPromise.d.ts

@@ -0,0 +1,4 @@
+import { type Operation } from "effection";
+/** Keep arbitrary rejected values out of Effection's error normalization. */
+export declare function settlePolicyPromise<T>(promise: Promise<T>): Operation<T>;
+//# sourceMappingURL=settlePolicyPromise.d.ts.map

package/esm/settlePolicyPromise.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"settlePolicyPromise.d.ts","sourceRoot":"","sources":["../src/settlePolicyPromise.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAEjD,6EAA6E;AAC7E,wBAAiB,mBAAmB,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAWzE"}

package/esm/settlePolicyPromise.js

@@ -0,0 +1,10 @@
+import { call } from "effection";
+/** Keep arbitrary rejected values out of Effection's error normalization. */
+export function* settlePolicyPromise(promise) {
+    const settled = yield* call(() => promise.then((value) => ({ ok: true, value }), (cause) => ({ ok: false, cause })));
+    if (!settled.ok) {
+        throw settled.cause;
+    }
+    return settled.value;
+}
+//# sourceMappingURL=settlePolicyPromise.js.map

package/esm/settlePolicyPromise.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settlePolicyPromise.js","sourceRoot":"","sources":["../src/settlePolicyPromise.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAkB,MAAM,WAAW,CAAC;AAEjD,6EAA6E;AAC7E,MAAM,SAAS,CAAC,CAAC,mBAAmB,CAAI,OAAmB;IAC1D,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAChC,OAAO,CAAC,IAAI,CACX,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAU,EACzC,CAAC,KAAc,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAU,CACnD,CACD,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,OAAO,CAAC,KAAK,CAAC;IACrB,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC;AACtB,CAAC","sourcesContent":["import { call, type Operation } from \"effection\";\n\n/** Keep arbitrary rejected values out of Effection's error normalization. */\nexport function* settlePolicyPromise<T>(promise: Promise<T>): Operation<T> {\n\tconst settled = yield* call(() =>\n\t\tpromise.then(\n\t\t\t(value) => ({ ok: true, value }) as const,\n\t\t\t(cause: unknown) => ({ ok: false, cause }) as const,\n\t\t),\n\t);\n\tif (!settled.ok) {\n\t\tthrow settled.cause;\n\t}\n\treturn settled.value;\n}\n"]}

package/esm/tsdoc-metadata.json

@@ -5,7 +5,7 @@
   "toolPackages": [
     {
       "packageName": "@microsoft/api-extractor",
-      "packageVersion": "7.58.11"
+      "packageVersion": "7.59.4"
     }
   ]
 }

package/esm/utils/safePaths.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Resolves a candidate file path against the repository root and verifies it does not escape that root.
+ */
+export declare function resolveRepoFilePath(root: string, filePath: string): string;
+/**
+ * Converts an input path into a normalized repository-relative path after validating root containment.
+ */
+export declare function normalizeRepoRelativeFilePath(root: string, filePath: string): string;
+//# sourceMappingURL=safePaths.d.ts.map

package/esm/utils/safePaths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safePaths.d.ts","sourceRoot":"","sources":["../../src/utils/safePaths.ts"],"names":[],"mappings":"AAkBA;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAe1E;AAED;;GAEG;AACH,wBAAgB,6BAA6B,CAC5C,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACd,MAAM,CAaR"}

package/esm/utils/safePaths.js

@@ -0,0 +1,40 @@
+import { isAbsolute, normalize, relative, resolve } from "pathe";
+function normalizeRoot(root) {
+    return normalize(resolve(root));
+}
+function isPathWithinRoot(rootPath, candidatePath) {
+    const relativePath = normalize(relative(rootPath, candidatePath));
+    if (relativePath === "" || relativePath === ".") {
+        return true;
+    }
+    return (!isAbsolute(relativePath) &&
+        relativePath !== ".." &&
+        !relativePath.startsWith("../"));
+}
+/**
+ * Resolves a candidate file path against the repository root and verifies it does not escape that root.
+ */
+export function resolveRepoFilePath(root, filePath) {
+    if (filePath.trim().length === 0) {
+        throw new Error("File path cannot be empty.");
+    }
+    const rootPath = normalizeRoot(root);
+    const candidatePath = normalize(resolve(rootPath, filePath));
+    if (!isPathWithinRoot(rootPath, candidatePath)) {
+        throw new Error(`File path must be within repository root. Received: ${filePath}`);
+    }
+    return candidatePath;
+}
+/**
+ * Converts an input path into a normalized repository-relative path after validating root containment.
+ */
+export function normalizeRepoRelativeFilePath(root, filePath) {
+    const rootPath = normalizeRoot(root);
+    const absolutePath = resolveRepoFilePath(rootPath, filePath);
+    const relativePath = normalize(relative(rootPath, absolutePath)).replace(/\\/g, "/");
+    if (relativePath === "" || relativePath === ".") {
+        throw new Error("File path resolves to repository root instead of a file.");
+    }
+    return relativePath;
+}
+//# sourceMappingURL=safePaths.js.map

package/esm/utils/safePaths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safePaths.js","sourceRoot":"","sources":["../../src/utils/safePaths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAEjE,SAAS,aAAa,CAAC,IAAY;IAClC,OAAO,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB,EAAE,aAAqB;IAChE,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;IAClE,IAAI,YAAY,KAAK,EAAE,IAAI,YAAY,KAAK,GAAG,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,CACN,CAAC,UAAU,CAAC,YAAY,CAAC;QACzB,YAAY,KAAK,IAAI;QACrB,CAAC,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,CAC/B,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,QAAgB;IACjE,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IAE7D,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACd,uDAAuD,QAAQ,EAAE,CACjE,CAAC;IACH,CAAC;IAED,OAAO,aAAa,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,6BAA6B,CAC5C,IAAY,EACZ,QAAgB;IAEhB,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,YAAY,GAAG,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC7D,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CACvE,KAAK,EACL,GAAG,CACH,CAAC;IAEF,IAAI,YAAY,KAAK,EAAE,IAAI,YAAY,KAAK,GAAG,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,YAAY,CAAC;AACrB,CAAC","sourcesContent":["import { isAbsolute, normalize, relative, resolve } from \"pathe\";\n\nfunction normalizeRoot(root: string): string {\n\treturn normalize(resolve(root));\n}\n\nfunction isPathWithinRoot(rootPath: string, candidatePath: string): boolean {\n\tconst relativePath = normalize(relative(rootPath, candidatePath));\n\tif (relativePath === \"\" || relativePath === \".\") {\n\t\treturn true;\n\t}\n\treturn (\n\t\t!isAbsolute(relativePath) &&\n\t\trelativePath !== \"..\" &&\n\t\t!relativePath.startsWith(\"../\")\n\t);\n}\n\n/**\n * Resolves a candidate file path against the repository root and verifies it does not escape that root.\n */\nexport function resolveRepoFilePath(root: string, filePath: string): string {\n\tif (filePath.trim().length === 0) {\n\t\tthrow new Error(\"File path cannot be empty.\");\n\t}\n\n\tconst rootPath = normalizeRoot(root);\n\tconst candidatePath = normalize(resolve(rootPath, filePath));\n\n\tif (!isPathWithinRoot(rootPath, candidatePath)) {\n\t\tthrow new Error(\n\t\t\t`File path must be within repository root. Received: ${filePath}`,\n\t\t);\n\t}\n\n\treturn candidatePath;\n}\n\n/**\n * Converts an input path into a normalized repository-relative path after validating root containment.\n */\nexport function normalizeRepoRelativeFilePath(\n\troot: string,\n\tfilePath: string,\n): string {\n\tconst rootPath = normalizeRoot(root);\n\tconst absolutePath = resolveRepoFilePath(rootPath, filePath);\n\tconst relativePath = normalize(relative(rootPath, absolutePath)).replace(\n\t\t/\\\\/g,\n\t\t\"/\",\n\t);\n\n\tif (relativePath === \"\" || relativePath === \".\") {\n\t\tthrow new Error(\"File path resolves to repository root instead of a file.\");\n\t}\n\n\treturn relativePath;\n}\n"]}

package/oclif.manifest.json

@@ -3,8 +3,35 @@
     "check-native": {
       "aliases": [],
       "args": {},
-      "description": "Runs the Rust-based repopo-core engine with the Node.js sidecar. This provides the same policy checking as 'check' but with Rust-based file enumeration, regex matching, and orchestration for better performance.",
+      "description": "Runs the Rust-based repopo-core engine with the Node.js sidecar. Rust handles file matching, scheduling and reporting; the sidecar shares per-policy contracts with 'check'. Repository policies always run with the full repository inventory, including with --stdin. With --fix, repository policies can modify files outside the stdin selection.",
       "flags": {
+        "change-mode": {
+          "description": "Change context: pr (default), local, or staged. Does not select file-policy paths.",
+          "name": "change-mode",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "pr",
+            "local",
+            "staged"
+          ],
+          "type": "option"
+        },
+        "change-base": {
+          "description": "Override the PR change context base ref.",
+          "name": "change-base",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "concurrency": {
+          "description": "Maximum concurrent files in read-only checks. Fixes remain sequential.",
+          "name": "concurrency",
+          "default": 8,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
         "fix": {
           "aliases": [
             "resolve"
@@ -100,6 +127,7 @@
     "check": {
       "aliases": [],
       "args": {},
+      "description": "File policies check selected files. Repository policies always run with the full repository file inventory, including with --stdin. With --fix, repository policies can modify files outside the stdin selection.",
       "flags": {
         "verbose": {
           "char": "v",
@@ -124,6 +152,33 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "change-mode": {
+          "description": "Change context: pr (default), local, or staged. Does not select file-policy paths.",
+          "name": "change-mode",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "pr",
+            "local",
+            "staged"
+          ],
+          "type": "option"
+        },
+        "change-base": {
+          "description": "Override the PR change context base ref.",
+          "name": "change-base",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "concurrency": {
+          "description": "Maximum concurrent files in read-only checks. Fixes remain sequential.",
+          "name": "concurrency",
+          "default": 8,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
         "fix": {
           "aliases": [
             "resolve"
@@ -222,5 +277,5 @@
       ]
     }
   },
-  "version": "0.12.0"
+  "version": "0.14.0"
 }