pineforge-codegen 0.7.0__tar.gz → 0.7.2__tar.gz

pineforge_codegen-0.7.2/.github/workflows/gate.yml

@@ -0,0 +1,60 @@
+name: Pyodide Gate
+
+# Differential parity gate: the transpiler in real wasm32 Pyodide must match
+# native CPython on every corpus input (success + failure). Heavier than the
+# unit matrix (loads Pyodide), so: on demand, nightly, and on PRs that touch the
+# gate itself. It does NOT block releases yet — that wiring is Phase 3.
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "27 5 * * *"   # nightly 05:27 UTC
+  pull_request:
+    paths:
+      - "gate/**"
+      - "tests/gate-corpus/**"
+      - "package.json"
+      - "package-lock.json"
+      - ".github/workflows/gate.yml"
+      - "pineforge_codegen/**"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: gate-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  gate:
+    runs-on: ubuntu-latest
+    env:
+      PYTHONHASHSEED: "0"
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
+        with:
+          python-version: "3.14"
+
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4
+        with:
+          node-version: "22"
+
+      - name: Install codegen (native oracle) + node deps
+        run: |
+          python -m pip install -e .
+          npm ci
+
+      - name: Selftest (comparator catches divergences)
+        run: npm run gate:selftest
+
+      - name: Run differential gate (full corpus)
+        run: npm run gate:full
+
+      - name: Upload release.json (derived versions, for Phase 3 handoff)
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
+        with:
+          name: release-json
+          path: release.json
+          if-no-files-found: ignore

pineforge_codegen-0.7.2/.github/workflows/publish-pyodide.yml

@@ -0,0 +1,80 @@
+name: Publish codegen-pyodide
+
+# Builds @pineforge/codegen-pyodide from the GATE-VALIDATED archive and publishes
+# it via npm OIDC Trusted Publishing (mirrors pineforge-codegen-mcp/publish.yml).
+# Auto-release: a `v*` tag push (e.g. created by release.yml) publishes for real,
+# gate-blocked. workflow_dispatch defaults to a DRY RUN (set dry_run=false to
+# publish manually). Publishing only happens after the gate passes.
+on:
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: "npm publish --dry-run (default true). Set false to actually publish."
+        type: boolean
+        default: true
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: read
+  id-token: write   # npm OIDC Trusted Publishing
+
+concurrency:
+  group: publish-pyodide-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    env:
+      PYTHONHASHSEED: "0"
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+
+      # Tag push must match VERSION (mirrors mcp). Skipped for dispatch.
+      - name: Verify tag matches VERSION
+        if: startsWith(github.ref, 'refs/tags/v')
+        env:
+          TAG_NAME: ${{ github.ref_name }}
+        run: |
+          tag="${TAG_NAME#v}"; file="$(tr -d '[:space:]' < VERSION)"
+          if [ "$tag" != "$file" ]; then
+            echo "::error::tag '$TAG_NAME' != VERSION '$file'"; exit 1
+          fi
+
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
+        with:
+          python-version: "3.14"
+
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4
+        with:
+          node-version: "22"
+          registry-url: https://registry.npmjs.org
+
+      # npm OIDC Trusted Publishing needs npm >= 11.5.1 (newer than Node 22's npm;
+      # npm docs + spec §7 require >= 11.5.1).
+      - run: npm install -g npm@11.5.1
+
+      - name: Install + run the gate (publish only ships gate-validated bytes)
+        run: |
+          python -m pip install -e .
+          npm ci
+          npm run gate:selftest
+          npm run gate:full
+
+      - name: Assemble the package
+        run: node scripts/build-npm-package.mjs
+
+      - name: Publish (real on tag push or dispatch dry_run=false; dry-run otherwise)
+        working-directory: npm
+        env:
+          EVENT: ${{ github.event_name }}
+          DRY_RUN: ${{ inputs.dry_run }}
+        run: |
+          if [ "$EVENT" = "push" ] || { [ "$EVENT" = "workflow_dispatch" ] && [ "$DRY_RUN" = "false" ]; }; then
+            echo "Publishing for real (--access=public)"
+            npm publish --access=public
+          else
+            echo "DRY RUN (a v* tag push or dispatch with dry_run=false publishes for real)"
+            npm publish --dry-run --access=public
+          fi

{pineforge_codegen-0.7.0 → pineforge_codegen-0.7.2}/.github/workflows/release.yml

@@ -36,8 +36,9 @@ jobs:
   release:
     runs-on: ubuntu-latest
     env:
-      BUMP:     ${{ inputs.bump }}
-      OVERRIDE: ${{ inputs.override }}
+      BUMP:          ${{ inputs.bump }}
+      OVERRIDE:      ${{ inputs.override }}
+      PYTHONHASHSEED: "0"   # deterministic gate runtime (match gate.yml)
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
         with:
@@ -83,7 +84,22 @@ jobs:
 
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
         with:
-          python-version: "3.12"
+          python-version: "3.14"   # match the gate's runtime
+
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4
+        with:
+          node-version: "22"
+
+      # Conformance gate (BLOCKING): the differential parity gate must pass
+      # before anything is built, published, or tagged. A gate-broken codegen
+      # fails the release here — nothing reaches PyPI, no tag is pushed (so the
+      # tag->npm trigger never fires), and no GitHub Release is created.
+      - name: Run conformance gate (blocking)
+        run: |
+          python -m pip install -e .
+          npm ci
+          npm run gate:selftest
+          npm run gate:full
 
       - name: Build sdist + wheel
         run: |
@@ -91,8 +107,16 @@ jobs:
           python -m build
           ls -l dist/
 
-      # Commit + tag before publishing so a tag always corresponds to a built
-      # artifact set; the GitHub Release (with files) comes after PyPI succeeds.
+      # Publish to PyPI BEFORE the tag is pushed. The tag push triggers
+      # publish-pyodide.yml (npm), so PyPI must land first — otherwise a PyPI
+      # failure would leave npm shipping a version PyPI never got.
+      - name: Publish to PyPI
+        if: ${{ !inputs.dry_run }}
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # release/v1
+
+      # Commit + tag + push AFTER PyPI succeeds. The `git push --tags` triggers
+      # publish-pyodide.yml for npm (which re-runs the gate — defense in depth),
+      # so the tag only exists once the gate passed and PyPI published.
       - name: Commit + tag + push
         if: ${{ !inputs.dry_run }}
         env:
@@ -105,10 +129,6 @@ jobs:
           git tag "v${NEW_VERSION}"
           git push origin HEAD --tags
 
-      - name: Publish to PyPI
-        if: ${{ !inputs.dry_run }}
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # release/v1
-
       - name: Create GitHub Release
         if: ${{ !inputs.dry_run }}
         env:

pineforge_codegen-0.7.2/.github/workflows/test.yml

@@ -0,0 +1,42 @@
+name: Test
+
+# First CI for this repo: run the test suite on every push and PR across the
+# supported CPython range (the floor is 3.11; the ceiling tracks the Pyodide
+# target's CPython, currently 3.14). Engine-dependent compile tests skip
+# automatically on the runner (no engine checkout / no Eigen / no compiler env).
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: test-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  pytest:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13", "3.14"]
+    env:
+      PYTHONHASHSEED: "0"   # determinism; lockstep with the Phase 2 Pyodide gate
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install (with dev extras)
+        run: python -m pip install -e ".[dev]"
+
+      - name: Run test suite
+        # No engine present on the runner -> compile tests skip via
+        # pytest.mark.skipif(not have_compile_env()). This validates the
+        # pure-Python transpile path across the matrix.
+        run: python -m pytest -q

{pineforge_codegen-0.7.0 → pineforge_codegen-0.7.2}/.gitignore

@@ -56,8 +56,6 @@ pineforge_codegen/**/*.cpp
 # ─── Node / TypeScript ─────────────────────────────────────────────────────
 node_modules/
 **/node_modules/
-package-lock.json
-**/package-lock.json
 yarn.lock
 pnpm-lock.yaml
 npm-debug.log*
@@ -120,3 +118,14 @@ temp/
 # cloud/mcp-local/ was extracted to a public repo:
 #   https://github.com/fullpass-4pass/pineforge-codegen-mcp
 # Don't bring it back here.
+
+# ─── Gate output ───────────────────────────────────────────────────────────
+/release.json
+
+# @pineforge/codegen-pyodide built payload (assembled at publish time)
+/npm/pineforge_codegen-*.tar.gz
+/npm/pineforge_codegen/
+/npm/tables.json
+/npm/release.json
+/npm/transpile.worker.mjs
+/npm/glue.py

{pineforge_codegen-0.7.0 → pineforge_codegen-0.7.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pineforge-codegen
-Version: 0.7.0
+Version: 0.7.2
 Summary: PineScript v6 to C++ transpiler that targets the pineforge-engine runtime.
 Project-URL: Homepage, https://github.com/pineforge-4pass/pineforge-codegen-oss
 Project-URL: Issues, https://github.com/pineforge-4pass/pineforge-codegen-oss/issues
@@ -211,6 +211,7 @@ Classifier: License :: Free for non-commercial use
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Office/Business :: Financial
 Requires-Python: >=3.11
 Provides-Extra: dev

pineforge_codegen-0.7.2/PYODIDE_TARGET

@@ -0,0 +1 @@
+314.0.0

pineforge_codegen-0.7.2/VERSION

@@ -0,0 +1 @@
+0.7.2

pineforge_codegen-0.7.2/gate/compare.mjs

@@ -0,0 +1,69 @@
+// Pure, side-effect-free comparator for the gate. Both run-gate.mjs (the runner)
+// and selftest.mjs (the canary) import this — so importing it never triggers a
+// gate run. Each side is {json: "<transpile_json string>"} (normal return) or
+// {unexpected: "Type: msg"} (non-CompileError exception). Returns a mismatch
+// string, or null if the two sides agree.
+export function compareResults(name, native, browser) {
+  if (!native) return `${name}: oracle produced no result`;
+  if (!browser) return `${name}: pyodide produced no result`;
+  if (native.unexpected || browser.unexpected) {
+    if (native.unexpected !== browser.unexpected) {
+      return `${name}: unexpected-exception mismatch\n  native : ${native.unexpected ?? "<none>"}\n  pyodide: ${browser.unexpected ?? "<none>"}`;
+    }
+    return null;
+  }
+  if (native.json !== browser.json) {
+    let detail = "";
+    try {
+      const n = JSON.parse(native.json);
+      const b = JSON.parse(browser.json);
+      if (n.ok !== b.ok) detail = `verdict ${b.ok} (pyodide) != ${n.ok} (native)`;
+      else if (n.ok) detail = "C++ output differs";
+      else detail = `error/diagnostics differ\n  native : ${native.json}\n  pyodide: ${browser.json}`;
+    } catch {
+      detail = `raw json differs\n  native : ${native.json}\n  pyodide: ${browser.json}`;
+    }
+    return `${name}: ${detail}`;
+  }
+  return null;
+}
+
+// Expected verdict for a corpus branch: "ok/*" fixtures must transpile
+// successfully (result.ok === true), "err/*" fixtures must be rejected
+// (result.ok === false). Anything else — the wrong verdict, an unparseable
+// payload, or an unexpected (non-CompileError) exception — is a gate failure
+// even when native and wasm agree (two identical crashes must NOT pass).
+//
+// This is intentionally separate from compareResults so the gate enforces BOTH
+// (a) native↔wasm parity and (b) the right answer. `side` is {json} or
+// {unexpected}; `expectOk` is true for "ok", false for "err".
+function verdictOf(side) {
+  if (!side) return { kind: "missing" };
+  if (side.unexpected) return { kind: "unexpected", detail: side.unexpected };
+  try {
+    const v = JSON.parse(side.json);
+    if (typeof v.ok !== "boolean") return { kind: "malformed", detail: side.json };
+    return { kind: "verdict", ok: v.ok };
+  } catch {
+    return { kind: "malformed", detail: side.json };
+  }
+}
+
+// Returns a failure string if either side does not match the expected verdict
+// for the fixture's branch, or null if both sides produced the expected verdict.
+export function checkExpectedVerdict(name, expectOk, native, browser) {
+  for (const [label, side] of [["native", native], ["pyodide", browser]]) {
+    const r = verdictOf(side);
+    if (r.kind === "missing") return `${name}: ${label} produced no result`;
+    if (r.kind === "unexpected") {
+      return `${name}: ${label} threw an unexpected exception (expected ok=${expectOk}): ${r.detail}`;
+    }
+    if (r.kind === "malformed") {
+      return `${name}: ${label} returned a malformed result (expected ok=${expectOk}): ${r.detail}`;
+    }
+    if (r.ok !== expectOk) {
+      return `${name}: ${label} verdict ok=${r.ok} but corpus dir expects ok=${expectOk}`;
+    }
+  }
+  return null;
+}

pineforge_codegen-0.7.2/gate/glue.py

@@ -0,0 +1,35 @@
+# CANONICAL GLUE — runtime-equivalent to the body of PY_GLUE in
+# pineforge-app/apps/web/lib/pyodide-transpiler/glue.ts (produces identical
+# transpile_json output). The browser worker and this gate run the same logic,
+# so the gate's parity guarantee reflects shipped behavior.
+# (Phase 3: ship this from the npm package so there is one source of truth.)
+import json
+import sys
+
+if "/codegen" not in sys.path:
+    sys.path.insert(0, "/codegen")
+
+from pineforge_codegen import transpile
+from pineforge_codegen.errors import CompileError
+
+
+def transpile_json(source: str) -> str:
+    try:
+        cpp = transpile(source)
+    except CompileError as e:
+        diags = []
+        for d in e.diagnostics:
+            loc = d.location
+            message = d.message + " — " + d.hint if getattr(d, "hint", None) else d.message
+            entry = {
+                "line": loc.line if loc else 1,
+                "col": loc.col if loc else 1,
+                "message": message,
+                "severity": getattr(d.level, "value", "error"),
+            }
+            end_col = getattr(loc, "end_col", None) if loc else None
+            if end_col is not None:
+                entry["endCol"] = end_col
+            diags.append(entry)
+        return json.dumps({"ok": False, "error": str(e), "diagnostics": diags})
+    return json.dumps({"ok": True, "cpp": cpp})

pineforge_codegen-0.7.2/gate/oracle.py

@@ -0,0 +1,34 @@
+"""Native-CPython oracle for the conformance gate.
+
+Reads a JSON array of {"name","src"} from stdin, runs the CANONICAL glue's
+transpile_json on each, and writes a JSON object {name: result} to stdout.
+Each result is {"json": <transpile_json string>} on a normal return, or
+{"unexpected": "<ExcType>: <msg>"} if transpile_json raised something other
+than CompileError (CompileError is already encoded inside the json string).
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+
+GLUE = os.path.join(os.path.dirname(__file__), "glue.py")
+exec(compile(open(GLUE).read(), GLUE, "exec"))  # defines transpile_json  # noqa: S102
+
+
+def main() -> None:
+    items = json.load(sys.stdin)
+    out: dict[str, dict] = {}
+    for item in items:
+        name = item["name"]
+        src = item["src"]
+        try:
+            out[name] = {"json": transpile_json(src)}  # noqa: F821 — from exec
+        except Exception as exc:  # noqa: BLE001 — capture for parity, don't throw
+            out[name] = {"unexpected": f"{type(exc).__name__}: {exc}"}
+    json.dump(out, sys.stdout)
+
+
+if __name__ == "__main__":
+    main()

pineforge_codegen-0.7.2/gate/run-gate.mjs

@@ -0,0 +1,133 @@
+// Differential parity gate: run the transpiler in real wasm32 Pyodide and assert
+// it behaves identically to native CPython on EVERY corpus input — success
+// (byte-identical cpp) AND failure (same verdict/error/diagnostics + same
+// unexpected-exception type+message). Also writes release.json.
+//
+//   node gate/run-gate.mjs              # smoke: all err + first N ok fixtures
+//   GATE_FULL=1 node gate/run-gate.mjs  # entire corpus
+//
+// Exit 0 = parity holds; exit 1 = mismatch(es) or setup failure.
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { checkExpectedVerdict, compareResults } from "./compare.mjs";
+
+const require = createRequire(import.meta.url);
+const HERE = dirname(fileURLToPath(import.meta.url));
+const ROOT = join(HERE, "..");
+const CORPUS = join(ROOT, "tests", "gate-corpus");
+const SCRATCH = join(HERE, ".scratch");
+const GLUE = readFileSync(join(HERE, "glue.py"), "utf8");
+const PYTHON = process.env.GATE_PYTHON ?? "python3";
+const OK_CAP = process.env.GATE_FULL ? Infinity : 60;
+
+function branchItems(branch) {
+  const dir = join(CORPUS, branch);
+  if (!existsSync(dir)) return [];
+  return readdirSync(dir)
+    .filter((x) => x.endsWith(".pine"))
+    .sort()
+    .map((f) => ({ name: `${branch}/${f}`, src: readFileSync(join(dir, f), "utf8") }));
+}
+
+async function main() {
+  const okItems = branchItems("ok");
+  const errItems = branchItems("err");
+  if (okItems.length + errItems.length === 0) {
+    console.error("gate: empty corpus at tests/gate-corpus/{ok,err}");
+    process.exit(1);
+  }
+  // ALWAYS include the (small) err branch so the smoke run exercises the failure
+  // path; cap only the large ok branch.
+  const items = [
+    ...(Number.isFinite(OK_CAP) ? okItems.slice(0, OK_CAP) : okItems),
+    ...errItems,
+  ];
+  console.log(
+    `gate: ${items.length} fixtures (ok=${Math.min(okItems.length, OK_CAP)}/${okItems.length}, err=${errItems.length}, GATE_FULL=${process.env.GATE_FULL ? "1" : "0"})`,
+  );
+
+  // 1. Pack the in-repo source into an archive (excluding __pycache__).
+  mkdirSync(SCRATCH, { recursive: true });
+  const archive = join(SCRATCH, "pineforge_codegen.tar.gz");
+  const tar = require("tar");
+  await tar.create(
+    { gzip: true, file: archive, cwd: ROOT, portable: true, filter: (p) => !p.includes("__pycache__") },
+    ["pineforge_codegen"],
+  );
+  const archiveBytes = readFileSync(archive);
+
+  // 2. Load Pyodide, unpack, run glue.
+  const { loadPyodide } = await import("pyodide");
+  const indexURL = dirname(require.resolve("pyodide/package.json"));
+  const pyodide = await loadPyodide({ indexURL });
+  const u8 = new Uint8Array(archiveBytes.buffer, archiveBytes.byteOffset, archiveBytes.byteLength);
+  pyodide.unpackArchive(u8, "gztar", { extractDir: "/codegen" });
+  pyodide.runPython(GLUE);
+  const transpileJson = pyodide.globals.get("transpile_json");
+
+  // 3. Native oracle (one process, whole corpus). PYTHONHASHSEED pinned for
+  //    determinism per spec §6.1.
+  const oracleOut = execFileSync(PYTHON, [join(HERE, "oracle.py")], {
+    input: JSON.stringify(items),
+    env: { ...process.env, PYTHONPATH: ROOT, PYTHONHASHSEED: "0" },
+    maxBuffer: 256 * 1024 * 1024,
+    encoding: "utf8",
+  });
+  const native = JSON.parse(oracleOut);
+
+  // 4. Pyodide side + compare. The gate enforces TWO independent properties:
+  //    (a) native↔wasm parity (compareResults) and
+  //    (b) the EXPECTED verdict by corpus dir (checkExpectedVerdict): ok/* must
+  //        succeed, err/* must be rejected. A purely differential check would
+  //        let two identical crashes — or an ok/ fixture that erroneously errors
+  //        — slip through; (b) closes that gap.
+  const mismatches = [];
+  const verdictFailures = [];
+  for (const { name, src } of items) {
+    let browser;
+    try {
+      browser = { json: transpileJson(src) };
+    } catch (err) {
+      browser = { unexpected: `${err?.constructor?.name ?? "Error"}: ${err?.message ?? String(err)}` };
+    }
+    const m = compareResults(name, native[name], browser);
+    if (m) mismatches.push(m);
+    const expectOk = name.startsWith("ok/");
+    const v = checkExpectedVerdict(name, expectOk, native[name], browser);
+    if (v) verdictFailures.push(v);
+  }
+
+  // 5. release.json (versions derived from the loaded Pyodide lock).
+  const lock = require("pyodide/pyodide-lock.json");
+  const codegen = readFileSync(join(ROOT, "VERSION"), "utf8").trim();
+  const pyodideVer = readFileSync(join(ROOT, "PYODIDE_TARGET"), "utf8").trim();
+  const release = {
+    codegen,
+    pyodide: pyodideVer,
+    python: lock.info.python,
+    emscripten: lock.info.platform,
+    sha256: createHash("sha256").update(archiveBytes).digest("hex"),
+  };
+  writeFileSync(join(ROOT, "release.json"), JSON.stringify(release, null, 2) + "\n");
+  console.log("gate: release.json ->", JSON.stringify(release));
+
+  if (mismatches.length || verdictFailures.length) {
+    if (mismatches.length) {
+      console.error(`gate: ${mismatches.length} PARITY MISMATCH(es):\n` + mismatches.join("\n"));
+    }
+    if (verdictFailures.length) {
+      console.error(`gate: ${verdictFailures.length} VERDICT FAILURE(s) (wrong ok/err result):\n` + verdictFailures.join("\n"));
+    }
+    process.exit(1);
+  }
+  console.log(`gate: PARITY OK over ${items.length} fixtures (verdicts asserted: ok/* succeed, err/* rejected)`);
+}
+
+main().catch((e) => {
+  console.error("gate: fatal", e);
+  process.exit(1);
+});

pineforge_codegen-0.7.2/gate/selftest.mjs

@@ -0,0 +1,57 @@
+// Canary: prove the gate's checks actually catch divergences. Imports the PURE
+// comparator + verdict checker (gate/compare.mjs) so it runs in <1s without
+// loading Pyodide. Covers BOTH (a) native↔wasm parity (compareResults) and
+// (b) expected-verdict-by-corpus-dir (checkExpectedVerdict).
+import { checkExpectedVerdict, compareResults } from "./compare.mjs";
+
+const OK = '{"ok":true,"cpp":"X"}';
+const ERR = '{"ok":false,"error":"e","diagnostics":[]}';
+
+// --- (a) differential comparator cases: [name, native, browser, mustFlag] ---
+const cmpCases = [
+  ["same-ok", { json: OK }, { json: OK }, false],
+  ["cpp-differs", { json: '{"ok":true,"cpp":"X"}' }, { json: '{"ok":true,"cpp":"Y"}' }, true],
+  ["verdict-differs", { json: OK }, { json: ERR }, true],
+  ["error-differs", { json: '{"ok":false,"error":"a","diagnostics":[]}' }, { json: '{"ok":false,"error":"b","diagnostics":[]}' }, true],
+  ["unexpected-one-side", { json: OK }, { unexpected: "TypeError: boom" }, true],
+  ["unexpected-both-same", { unexpected: "TypeError: boom" }, { unexpected: "TypeError: boom" }, false],
+  ["unexpected-both-diff", { unexpected: "TypeError: a" }, { unexpected: "ValueError: b" }, true],
+  ["missing-native", undefined, { json: OK }, true],
+];
+
+// --- (b) expected-verdict cases: [name, expectOk, native, browser, mustFlag] ---
+// A native↔wasm match with the WRONG verdict (e.g. ok/ that errors, or a shared
+// unexpected exception) must FAIL even though compareResults would pass it.
+const verdictCases = [
+  ["ok/good", true, { json: OK }, { json: OK }, false],
+  ["err/bad", false, { json: ERR }, { json: ERR }, false],
+  ["ok/that-errors-both-sides", true, { json: ERR }, { json: ERR }, true],
+  ["err/that-succeeds-both-sides", false, { json: OK }, { json: OK }, true],
+  ["ok/unexpected-both-same", true, { unexpected: "TypeError: boom" }, { unexpected: "TypeError: boom" }, true],
+  ["err/unexpected-both-same", false, { unexpected: "TypeError: boom" }, { unexpected: "TypeError: boom" }, true],
+  ["ok/native-wrong-only", true, { json: ERR }, { json: OK }, true],
+  ["ok/pyodide-wrong-only", true, { json: OK }, { json: ERR }, true],
+  ["ok/missing-native", true, undefined, { json: OK }, true],
+  ["ok/malformed", true, { json: "not json" }, { json: OK }, true],
+];
+
+let failed = 0;
+for (const [name, n, b, mustFlag] of cmpCases) {
+  const flagged = compareResults(name, n, b) !== null;
+  if (flagged !== mustFlag) {
+    console.error(`selftest FAIL (compareResults): ${name} expected mustFlag=${mustFlag} got ${flagged}`);
+    failed++;
+  }
+}
+for (const [name, expectOk, n, b, mustFlag] of verdictCases) {
+  const flagged = checkExpectedVerdict(name, expectOk, n, b) !== null;
+  if (flagged !== mustFlag) {
+    console.error(`selftest FAIL (checkExpectedVerdict): ${name} expected mustFlag=${mustFlag} got ${flagged}`);
+    failed++;
+  }
+}
+if (failed) {
+  console.error(`gate selftest: ${failed} case(s) failed`);
+  process.exit(1);
+}
+console.log(`gate selftest: ${cmpCases.length} comparator + ${verdictCases.length} verdict cases OK`);

pineforge_codegen-0.7.2/npm/README.md

@@ -0,0 +1,25 @@
+# @pineforge/codegen-pyodide
+
+Gate-validated Pyodide payload for the PineScript v6 → C++ transpiler. Built and
+published from `pineforge-codegen-oss` by `.github/workflows/publish-pyodide.yml`.
+
+## Contents
+- `pineforge_codegen-<version>.tar.gz` — the gate-validated archive (unpack into Pyodide).
+- `pineforge_codegen/` — unpacked Python source (put on `PYTHONPATH` for Node oracle/grammar tooling).
+- `tables.json` — introspected codegen tables (the app renders `tables.generated.ts` from this).
+- `release.json` — `{ codegen, pyodide, python, emscripten, sha256 }`.
+- `index.mjs` — `release`, `tables`, `archivePath`, `codegenSourceDir`.
+
+## One-time bootstrap (maintainer, manual)
+This is a NEW package; npm OIDC Trusted Publishing can only be configured after
+the package exists:
+1. Build locally: `npm run gate:full && node scripts/build-npm-package.mjs`.
+2. From `npm/`, do the first publish with a granular npm token:
+   `npm publish --access=public` (one time).
+3. On npmjs.com, configure the package's Trusted Publisher: GitHub Actions,
+   repo `pineforge-4pass/pineforge-codegen-oss`, workflow `publish-pyodide.yml`.
+4. Thereafter releases publish via OIDC (no token): run `publish-pyodide.yml`
+   via **workflow_dispatch with `dry_run=false`**. NOTE: tag pushes currently run
+   a DRY-RUN only (a safe validation) — the sole real-publish path is dispatch +
+   `dry_run=false`. To switch to tag-driven releases later, change the publish
+   condition in the workflow.