From c3c584917ac55883dadde00d1280a6626a872159 Mon Sep 17 00:00:00 2001 From: "Dylan Mordaunt (ISLHD)" Date: Sat, 1 Aug 2026 15:19:59 +1000 Subject: [PATCH 1/6] chore(conductor): initialize track 'post-release-security-quality-frontier_20260801' --- conductor/index.md | 1 + conductor/roadmap.md | 20 ++-- conductor/tracks.md | 8 +- .../design.md | 57 +++++++++ .../index.md | 27 +++++ .../metadata.json | 22 ++++ .../plan.md | 74 ++++++++++++ .../requirements.md | 52 +++++++++ .../spec.md | 110 ++++++++++++++++++ 9 files changed, 361 insertions(+), 10 deletions(-) create mode 100644 conductor/tracks/post-release-security-quality-frontier_20260801/design.md create mode 100644 conductor/tracks/post-release-security-quality-frontier_20260801/index.md create mode 100644 conductor/tracks/post-release-security-quality-frontier_20260801/metadata.json create mode 100644 conductor/tracks/post-release-security-quality-frontier_20260801/plan.md create mode 100644 conductor/tracks/post-release-security-quality-frontier_20260801/requirements.md create mode 100644 conductor/tracks/post-release-security-quality-frontier_20260801/spec.md diff --git a/conductor/index.md b/conductor/index.md index f98cd07..93b0074 100644 --- a/conductor/index.md +++ b/conductor/index.md @@ -19,6 +19,7 @@ than guessing paths. - [Roadmap](./roadmap.md) - [Tracks Registry](./tracks.md) +- [Active Security and Quality Track](./tracks/post-release-security-quality-frontier_20260801/index.md) - [Released Bleeding-Edge Track](./tracks/archive/bleeding-edge-agent-skills-conductor_20260731/index.md) - [GitHub Issue Mapping](./github-mapping.json) diff --git a/conductor/roadmap.md b/conductor/roadmap.md index 6e0ef7b..7fa1287 100644 --- a/conductor/roadmap.md +++ b/conductor/roadmap.md @@ -7,16 +7,20 @@ Local Conductor files define scope and evidence. GitHub issues, subissues, and Project fields mirror that state; they do not establish implementation, publication, or release. -## Now: restore a trustworthy control plane +## Now: post-release security and quality frontier -- Restore the Conductor handshake and current setup assets. -- Mirror all 29 historical track records and their phases as closed GitHub - issues and native subissues. -- Add every repository issue/subissue to Project 36. -- Preserve archive content as history and record stale metadata rather than - rewriting it. +- Move maintained automation from EOL Node 20 to Node 24 LTS. +- Consolidate PR #219 with overlapping dependency and audit work. +- Resolve supported npm audit findings without forced upgrades. +- Add measured coverage and evaluate bounded property/mutation improvements. +- Strengthen solo-maintainer controls without reviewer or CODEOWNERS gates. +- Reconcile stale issues and hosted Project state. -## Next: standards-compliant portable core +Primary track: +[`post-release-security-quality-frontier_20260801`](./tracks/post-release-security-quality-frontier_20260801/index.md), +coordinated under [GitHub issue #65](https://github.com/edithatogo/authentext/issues/65). + +## Completed: standards-compliant portable core Primary track: [`bleeding-edge-agent-skills-conductor_20260731`](./tracks/archive/bleeding-edge-agent-skills-conductor_20260731/index.md), diff --git a/conductor/tracks.md b/conductor/tracks.md index 291ad38..49cee85 100644 --- a/conductor/tracks.md +++ b/conductor/tracks.md @@ -8,7 +8,11 @@ This file tracks all major tracks for the project. Each track has its own detail ## Active Tracks -No active tracks. +- [ ] **post-release-security-quality-frontier_20260801** (P0) - Consolidate + dependencies and Node 24, add measured quality evidence, strengthen + solo-maintainer controls, and reconcile the post-3.2.0 backlog. See + [`tracks/post-release-security-quality-frontier_20260801/`](./tracks/post-release-security-quality-frontier_20260801/index.md) + and portfolio [GitHub #65](https://github.com/edithatogo/authentext/issues/65). --- @@ -193,4 +197,4 @@ Live self-improvement outputs (not a track): `conductor/self-improvement/` Last updated: 2026-07-31. -No active track. Latest release: `v3.2.0`. +Active P0 track: post-release security and quality frontier. diff --git a/conductor/tracks/post-release-security-quality-frontier_20260801/design.md b/conductor/tracks/post-release-security-quality-frontier_20260801/design.md new file mode 100644 index 0000000..6382d35 --- /dev/null +++ b/conductor/tracks/post-release-security-quality-frontier_20260801/design.md @@ -0,0 +1,57 @@ +# Design: Post-Release Security and Quality Frontier + +## Control flow + +```mermaid +flowchart TD + A["Current main and hosted state"] --> B["Audit and engine baseline"] + B --> C["Node 24 guardrail tests"] + C --> D["Consolidated dependency graph"] + D --> E["Local full validation"] + E --> F["Linux macOS Windows hosted validation"] + F --> G["Supersede overlapping PRs"] + G --> H["Coverage and property evidence"] + H --> I["Bounded mutation evaluation"] + I --> J["Solo-maintainer controls"] + J --> K["Backlog and roadmap reconciliation"] + K --> L["Formal review and archive"] +``` + +## Evidence layers + +```mermaid +flowchart LR + S["Source and lockfile"] --> T["Tests and audit"] + T --> H["Hosted checks"] + H --> P["Project and issue state"] + P --> R["Durable reconciliation receipt"] +``` + +No later layer substitutes for an earlier one. A green Project field cannot +replace tests, and a local lockfile cannot establish hosted automation state. + +## Dependency decision model + +1. Capture the current audit and tool-engine baseline. +2. Add executable assertions for the supported Node line and workflow inputs. +3. Reproduce PR #219's coherent dependency set on a current-main branch. +4. Run audit, sync, lint, type, tests, and portable/host validation. +5. Merge only the coherent replacement; close overlapping lockfile PRs with an + evidence link. + +## Solo-maintainer control model + +- Required automated checks may block merges. +- Force-push and deletion protections should be enabled where owner recovery is + preserved. +- No approval count, CODEOWNERS, team assignment, or second person is required. +- Dependency bots remain additive until one is proven to replace the other. + +## Rollback + +- Dependency/runtime changes remain isolated in reviewable commits and a PR. +- Ruleset changes must record prior configuration and exact rule identifiers. +- Bot changes are reversed before removing the incumbent update path if hosted + replacement evidence disappears. +- Experimental quality tools remain optional until their signal and runtime are + measured. diff --git a/conductor/tracks/post-release-security-quality-frontier_20260801/index.md b/conductor/tracks/post-release-security-quality-frontier_20260801/index.md new file mode 100644 index 0000000..76c8c5c --- /dev/null +++ b/conductor/tracks/post-release-security-quality-frontier_20260801/index.md @@ -0,0 +1,27 @@ +# Post-Release Security and Quality Frontier + +- **Track ID:** `post-release-security-quality-frontier_20260801` +- **Priority:** P0 +- **Status:** New +- **Portfolio issue:** [#65](https://github.com/edithatogo/authentext/issues/65) + +## Track artifacts + +- [Specification](./spec.md) +- [MoSCoW Requirements](./requirements.md) +- [Design](./design.md) +- [Implementation Plan](./plan.md) +- [Metadata](./metadata.json) +- [Repository Roadmap](../../roadmap.md) + +## Outcome + +Authentext moves from a released 3.2.0 baseline to a sustainable Node 24, +dependency-secure, evidence-measured, solo-maintainer operating model without +weakening portable Agent Skills guarantees or inventing human review gates. + +## Evidence boundary + +Track creation does not establish dependency remediation, coverage, mutation +quality, ruleset enforcement, Renovate/Codecov activation, or hosted success. +Each claim requires the corresponding plan evidence. diff --git a/conductor/tracks/post-release-security-quality-frontier_20260801/metadata.json b/conductor/tracks/post-release-security-quality-frontier_20260801/metadata.json new file mode 100644 index 0000000..f7839e8 --- /dev/null +++ b/conductor/tracks/post-release-security-quality-frontier_20260801/metadata.json @@ -0,0 +1,22 @@ +{ + "track_id": "post-release-security-quality-frontier_20260801", + "title": "Post-Release Security and Quality Frontier", + "description": "Consolidate dependency updates, retire the Node 20 maintenance baseline, strengthen evidence-based tests and solo-maintainer controls, and reconcile the post-3.2.0 backlog.", + "type": "maintenance", + "priority": "P0", + "status": "new", + "created_at": "2026-08-01", + "updated_at": "2026-08-01", + "current_phase": "Phase 1: Dependency and runtime consolidation", + "depends_on": [ + "bleeding-edge-agent-skills-conductor_20260731" + ], + "parallel_safe": false, + "portfolio_issue": 65, + "moscow": { + "must": 14, + "should": 7, + "could": 5, + "wont_this_track": 5 + } +} diff --git a/conductor/tracks/post-release-security-quality-frontier_20260801/plan.md b/conductor/tracks/post-release-security-quality-frontier_20260801/plan.md new file mode 100644 index 0000000..d30146e --- /dev/null +++ b/conductor/tracks/post-release-security-quality-frontier_20260801/plan.md @@ -0,0 +1,74 @@ +# Implementation Plan: Post-Release Security and Quality Frontier + +- Track: `post-release-security-quality-frontier_20260801` +- Requirements: [`requirements.md`](./requirements.md) +- Design: [`design.md`](./design.md) +- Portfolio issue: [#65](https://github.com/edithatogo/authentext/issues/65) + +Tasks move from `[ ]` to `[~]` to `[x]` only with repository and hosted +evidence. Each phase is mirrored by a native GitHub subissue. + +## Phase 1: Dependency and runtime consolidation + +- [ ] Add failing guardrails for Node 24 and dependency-engine compatibility. + (M-001, M-008) +- [ ] Update maintained workflows and declared tooling baseline to Node 24. + (M-001, M-004) +- [ ] Reproduce and review PR #219's dependency set on current `main`. + (M-002, M-003) +- [ ] Run audit, sync, validation, lint, type, tests, and host/portable checks. + (M-003–M-006, S-001) +- [ ] Verify the exact revision on Linux, macOS, Windows, and CodeQL. +- [ ] Close or supersede overlapping PRs #50, #53, and #62 with evidence. + (M-002) +- [ ] Phase verification and checkpoint per `conductor/workflow.md`. + +## Phase 2: Measured quality frontier + +- [ ] Inventory existing property, contract, behavioral, and integration tests. + (M-007, S-002, S-003, C-003) +- [ ] Add a failing test for deterministic machine-readable coverage output. +- [ ] Implement Node-native coverage across the real aggregate test corpus. + (M-007) +- [ ] Extend property tests where current invariant coverage is weak. (S-003) +- [ ] Evaluate mutation tooling against maintained JavaScript and record a + bounded adopt/exclude decision. (S-002, C-004) +- [ ] Upload a quality summary artifact; add Codecov OIDC only if hosted setup + is verified. (S-005, C-002) +- [ ] Phase verification and checkpoint per `conductor/workflow.md`. + +## Phase 3: Solo-maintainer security controls + +- [ ] Inventory current rulesets, automation actors, templates, and security + context. (M-009, S-004) +- [ ] Add failing validation for warranted repository-owned context files. +- [ ] Add missing contribution/issue/PR context without legacy installer claims. + (S-004) +- [ ] Implement the least restrictive ruleset that blocks destructive pushes + and requires stable automated checks without human approvals. (M-010) +- [ ] Verify hosted ruleset behavior and owner recovery. +- [ ] Verify Renovate access before any Dependabot removal; otherwise retain + Dependabot and record the external gate. (M-011, S-006) +- [ ] Phase verification and checkpoint per `conductor/workflow.md`. + +## Phase 4: Backlog, roadmap, and GitHub reconciliation + +- [ ] Reconcile issue #54 against the final audit and install-surface contract. +- [ ] Reconcile issues #57–#59 against merged files, tests, and hosted runs. + (M-012) +- [ ] Keep or route issue #61 based on its product-scope evidence. +- [ ] Rewrite `conductor/roadmap.md` for the post-3.2.0 frontier. (S-007) +- [ ] Verify native issue/subissue hierarchy and Project 36 fields. (M-013) +- [ ] Refresh the deterministic GitHub mapping receipt. +- [ ] Phase verification and checkpoint per `conductor/workflow.md`. + +## Phase 5: Final verification and governed handoff + +- [ ] Run full local, official Agent Skills, audit, coverage, and Conductor + gates. +- [ ] Run formal Conductor review and resolve findings. +- [ ] Verify hosted CI on the exact final revision. +- [ ] Record external gates for Renovate, Codecov, publication, or credentials. + (M-014) +- [ ] Archive the track only after repository and hosted evidence agree. +- [ ] Phase verification and checkpoint per `conductor/workflow.md`. diff --git a/conductor/tracks/post-release-security-quality-frontier_20260801/requirements.md b/conductor/tracks/post-release-security-quality-frontier_20260801/requirements.md new file mode 100644 index 0000000..63aa75b --- /dev/null +++ b/conductor/tracks/post-release-security-quality-frontier_20260801/requirements.md @@ -0,0 +1,52 @@ +# MoSCoW Requirements: Post-Release Security and Quality Frontier + +## Must + +| ID | Requirement | Evidence | +| ----- | ------------------------------------------------------------------------------------------------- | ------------------------------------------ | +| M-001 | Use a supported Node 24 LTS maintenance and CI baseline. | Manifests, workflows, hosted matrix. | +| M-002 | Treat PR #219 and overlapping dependency PRs as one dependency graph. | PR decision record and final lockfile. | +| M-003 | Resolve supported npm audit fixes without `--force`. | Before/after audit receipts. | +| M-004 | Preserve deterministic generated outputs across platforms. | Sync and cross-platform checks. | +| M-005 | Preserve portable Agent Skills and host-overlay validation. | Official validator and host checks. | +| M-006 | Run every existing test in isolation and aggregate. | Test receipts. | +| M-007 | Measure coverage from the real Node test corpus. | Machine-readable coverage artifact. | +| M-008 | Test dependency/runtime guardrails before implementing changes. | Red/green regression evidence. | +| M-009 | Inventory automation actors before changing rulesets or dependency bots. | Hosted inventory receipt. | +| M-010 | Preserve solo-maintainer operation without mandatory reviewers. | Ruleset inspection and hosted validation. | +| M-011 | Keep dependency-update coverage continuous during bot rationalization. | Hosted Dependabot/Renovate evidence. | +| M-012 | Reconcile issues #54 and #57–#59 using repository and hosted evidence. | Issue comments/states and mapping receipt. | +| M-013 | Mirror the track and phases as native GitHub issues/subissues in Project 36. | Mapping and relationship receipt. | +| M-014 | Keep release, publication, app installation, and credential decisions as explicit external gates. | Plan and handoff receipt. | + +## Should + +| ID | Requirement | Evidence | +| ----- | -------------------------------------------------------------------- | ------------------------------------ | +| S-001 | Reach zero npm audit findings. | `npm audit --json`. | +| S-002 | Add actionable mutation testing for maintained JavaScript. | Mutation report and bounded runtime. | +| S-003 | Extend property tests for compiler and literal invariants. | Deterministic property suite. | +| S-004 | Add missing issue and pull-request contribution context. | Templates and validation. | +| S-005 | Upload coverage with Codecov OIDC if hosted setup is available. | Hosted status, not YAML alone. | +| S-006 | Adopt inherited Renovate configuration after app access is verified. | Dependency Dashboard or real PR. | +| S-007 | Refresh the roadmap around the post-3.2.0 frontier. | Updated roadmap and Project fields. | + +## Could + +| ID | Requirement | Evidence | +| ----- | ----------------------------------------------------------------------- | ------------------------- | +| C-001 | Add a scheduled dependency/audit drift receipt. | Scheduled hosted run. | +| C-002 | Add a compact quality summary artifact to CI. | Downloadable receipt. | +| C-003 | Add contract tests for generated host metadata and workflow interfaces. | Contract suite. | +| C-004 | Add mutation thresholds after a stable baseline is measured. | Reviewed baseline. | +| C-005 | Add a Project view for current security and quality work. | Hosted view verification. | + +## Won't this track + +| ID | Exclusion | Reason | +| ----- | -------------------------------------------------------- | ---------------------------------------- | +| W-001 | Use `npm audit fix --force`. | Avoid unreviewed breaking graph changes. | +| W-002 | Require a second reviewer, CODEOWNERS, or team approval. | Preserve solo-maintainer operation. | +| W-003 | Remove Dependabot before Renovate is proven active. | Avoid an update-coverage gap. | +| W-004 | Reintroduce legacy adapters/installers. | Outside maintained product contract. | +| W-005 | Release or publish a new version automatically. | Requires a separate explicit gate. | diff --git a/conductor/tracks/post-release-security-quality-frontier_20260801/spec.md b/conductor/tracks/post-release-security-quality-frontier_20260801/spec.md new file mode 100644 index 0000000..4d8fa2b --- /dev/null +++ b/conductor/tracks/post-release-security-quality-frontier_20260801/spec.md @@ -0,0 +1,110 @@ +# Track Specification: Post-Release Security and Quality Frontier + +- **Track ID:** `post-release-security-quality-frontier_20260801` +- **Type:** Maintenance and hardening +- **Priority:** P0 +- **Status:** New +- **Created:** 2026-08-01 +- **Portfolio issue:** [#65](https://github.com/edithatogo/authentext/issues/65) + +## Objective + +Move Authentext from a successfully released 3.2.0 baseline to a sustainable, +secure solo-maintainer operating model. Consolidate overlapping dependency pull +requests, remove the EOL Node 20 maintenance lane, resolve warranted audit +findings, add evidence-based quality controls, and reconcile stale roadmap and +GitHub coordination records. + +## Current evidence + +- `main` is clean at the post-release reconciliation commit `c26146a`. +- Release `v3.2.0`, CI, CodeQL, and Linux/macOS/Windows skill validation passed. +- `npm audit` reports six development-tool findings: three high and three + moderate. +- PR #219 is green and upgrades seven development dependencies, but several + upgraded tools require Node 22 or newer while maintained workflows use Node 20. +- PRs #50, #53, and #62 overlap the same dependency graph and currently have + failing checks; draft PR #52 is a stale generated decision record. +- Node 24 is the current LTS line and Node 20 is EOL. +- Issues #63–#65 define warranted quality and solo-maintainer hardening work. +- Issues #57–#59 may be partly or fully satisfied by the completed 3.2.0 track + and require evidence-based reconciliation. + +## Scope + +### Dependency and runtime consolidation + +- Establish Node 24 as the maintained CI and development baseline. +- Evaluate PR #219 as one coherent dependency set rather than merging + overlapping PRs independently. +- Resolve the current npm audit findings where supported fixes exist. +- Preserve deterministic sync, portable validation, and cross-platform tests. +- Close or supersede overlapping dependency PRs only after the replacement is + merged and verified. + +### Quality frontier + +- Inventory existing property, integration, contract, and behavioral evidence + before adding tools. +- Add measured test coverage using the smallest supported Node-native path. +- Add mutation testing only where it yields actionable signal for maintained + JavaScript and stays practical for a solo maintainer. +- Avoid arbitrary percentage claims that the harness cannot measure. + +### Solo-maintainer security and repository controls + +- Inventory branch/ruleset behavior and automation actors before mutation. +- Prefer required automated checks without mandatory reviewers, CODEOWNERS, or + team gates. +- Add missing contribution, security, issue, and pull-request context only + where absent from the maintained surface. +- Rationalize Dependabot and Renovate only after hosted Renovate access is + evidenced; never create a dependency-update coverage gap. +- Evaluate Codecov OIDC only after real repository coverage exists. + +### Backlog and roadmap reconciliation + +- Reconcile issues #57–#59 and #54 against files, tests, history, and hosted + state. +- Keep FOI-O issue #61 separate unless evidence shows it belongs to this + repository-maintenance track. +- Rewrite `conductor/roadmap.md` around post-3.2.0 work and the next product + frontier. +- Mirror this track and phases as native GitHub issues/subissues in Project 36. + +## Acceptance criteria + +- [ ] Maintained workflows and declared tooling baseline use Node 24 LTS. +- [ ] Dependency consolidation passes sync, validation, lint, type, tests, and + Linux/macOS/Windows hosted checks. +- [ ] `npm audit` reaches zero or every residual finding has a precise, + evidence-backed exception with exposure and upgrade path. +- [ ] Overlapping dependency PRs are merged, superseded, or retained with one + explicit role each. +- [ ] Coverage is measured and published from real tests without a fabricated + threshold. +- [ ] Property/mutation/contract controls are implemented or excluded with + reproducible evidence. +- [ ] Solo-maintainer controls preserve owner recovery and require no second + reviewer. +- [ ] Issues #54 and #57–#59 are reconciled against current evidence. +- [ ] Roadmap and GitHub Project state match the repository truth. +- [ ] No release, npm publication, registry submission, or unrelated product + feature is performed without its own authorization. + +## Out of scope + +- Mandatory human reviewers, CODEOWNERS, team assignment, or approval counts. +- Blind `npm audit fix --force` or independent merging of overlapping lockfile + PRs. +- Reintroducing adapter bundles, installer shims, or frozen legacy paths. +- Claiming Codecov, Renovate, ruleset, registry, or publication success from + local configuration alone. +- Implementing the FOI-O editorial feature without a separate product decision. + +## Sources + +- [Node.js release status](https://nodejs.org/en/about/previous-releases) +- [npm audit documentation](https://docs.npmjs.com/cli/commands/npm-audit) +- [GitHub repository rulesets](https://docs.github.com/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets) +- [GitHub dependency security](https://docs.github.com/code-security/dependabot) From 7abaf05642e6e428d2cce8fc680699e31cf4e025 Mon Sep 17 00:00:00 2001 From: "Dylan Mordaunt (ISLHD)" Date: Sat, 1 Aug 2026 15:24:43 +1000 Subject: [PATCH 2/6] chore(conductor): start post-release frontier track --- conductor/github-mapping.json | 93 +++++++++++++++++-- conductor/tracks.md | 10 +- .../metadata.json | 7 +- .../plan.md | 4 +- 4 files changed, 100 insertions(+), 14 deletions(-) diff --git a/conductor/github-mapping.json b/conductor/github-mapping.json index 5954011..013d98a 100644 --- a/conductor/github-mapping.json +++ b/conductor/github-mapping.json @@ -1,6 +1,6 @@ { "schema_version": 1, - "generated_at": "2026-08-01T04:47:10.102Z", + "generated_at": "2026-08-01T05:25:00.000Z", "repository": "edithatogo/authentext", "project": { "number": 36, @@ -8,10 +8,10 @@ "url": "https://github.com/users/edithatogo/projects/36" }, "counts": { - "tracks": 30, - "phases": 123, - "repository_issues": 162, - "open_tracks": 0, + "tracks": 31, + "phases": 128, + "repository_issues": 168, + "open_tracks": 1, "historical_tracks": 30 }, "verification": { @@ -20,9 +20,90 @@ "duplicate_phase_markers": 0, "native_parent_child_relationships": "verified", "issue_states": "verified", - "project_membership": "153/153" + "project_membership": "159/159" }, "tracks": [ + { + "track_id": "post-release-security-quality-frontier_20260801", + "title": "Post-Release Security and Quality Frontier", + "path": "conductor/tracks/post-release-security-quality-frontier_20260801", + "priority": "P0", + "historical": false, + "metadata_status": "in_progress", + "parent_issue": { + "number": 224, + "node_id": "I_kwDORAMgA88AAAABLCLcjQ", + "url": "https://github.com/edithatogo/authentext/issues/224", + "state": "open" + }, + "phases": [ + { + "phase_id": "post-release-security-quality-frontier_20260801.phase1", + "number": 1, + "title": "Dependency and runtime consolidation", + "source": "conductor/tracks/post-release-security-quality-frontier_20260801/plan.md", + "reconstructed": false, + "issue": { + "number": 225, + "node_id": "I_kwDORAMgA88AAAABLCLc0w", + "url": "https://github.com/edithatogo/authentext/issues/225", + "state": "open" + } + }, + { + "phase_id": "post-release-security-quality-frontier_20260801.phase2", + "number": 2, + "title": "Measured quality frontier", + "source": "conductor/tracks/post-release-security-quality-frontier_20260801/plan.md", + "reconstructed": false, + "issue": { + "number": 226, + "node_id": "I_kwDORAMgA88AAAABLCLdJg", + "url": "https://github.com/edithatogo/authentext/issues/226", + "state": "open" + } + }, + { + "phase_id": "post-release-security-quality-frontier_20260801.phase3", + "number": 3, + "title": "Solo-maintainer security controls", + "source": "conductor/tracks/post-release-security-quality-frontier_20260801/plan.md", + "reconstructed": false, + "issue": { + "number": 227, + "node_id": "I_kwDORAMgA88AAAABLCLdeQ", + "url": "https://github.com/edithatogo/authentext/issues/227", + "state": "open" + } + }, + { + "phase_id": "post-release-security-quality-frontier_20260801.phase4", + "number": 4, + "title": "Backlog, roadmap, and GitHub reconciliation", + "source": "conductor/tracks/post-release-security-quality-frontier_20260801/plan.md", + "reconstructed": false, + "issue": { + "number": 228, + "node_id": "I_kwDORAMgA88AAAABLCLdug", + "url": "https://github.com/edithatogo/authentext/issues/228", + "state": "open" + } + }, + { + "phase_id": "post-release-security-quality-frontier_20260801.phase5", + "number": 5, + "title": "Final verification and governed handoff", + "source": "conductor/tracks/post-release-security-quality-frontier_20260801/plan.md", + "reconstructed": false, + "issue": { + "number": 229, + "node_id": "I_kwDORAMgA88AAAABLCLd_A", + "url": "https://github.com/edithatogo/authentext/issues/229", + "state": "open" + } + } + ] + }, { "track_id": "bleeding-edge-agent-skills-conductor_20260731", "title": "Bleeding-Edge Agent Skills and Conductor Alignment", diff --git a/conductor/tracks.md b/conductor/tracks.md index 49cee85..2bff397 100644 --- a/conductor/tracks.md +++ b/conductor/tracks.md @@ -8,11 +8,11 @@ This file tracks all major tracks for the project. Each track has its own detail ## Active Tracks -- [ ] **post-release-security-quality-frontier_20260801** (P0) - Consolidate - dependencies and Node 24, add measured quality evidence, strengthen - solo-maintainer controls, and reconcile the post-3.2.0 backlog. See - [`tracks/post-release-security-quality-frontier_20260801/`](./tracks/post-release-security-quality-frontier_20260801/index.md) - and portfolio [GitHub #65](https://github.com/edithatogo/authentext/issues/65). +- [~] **post-release-security-quality-frontier_20260801** (P0) - Consolidate + dependencies and Node 24, add measured quality evidence, strengthen + solo-maintainer controls, and reconcile the post-3.2.0 backlog. See + [`tracks/post-release-security-quality-frontier_20260801/`](./tracks/post-release-security-quality-frontier_20260801/index.md) + and portfolio [GitHub #65](https://github.com/edithatogo/authentext/issues/65). --- diff --git a/conductor/tracks/post-release-security-quality-frontier_20260801/metadata.json b/conductor/tracks/post-release-security-quality-frontier_20260801/metadata.json index f7839e8..0c38099 100644 --- a/conductor/tracks/post-release-security-quality-frontier_20260801/metadata.json +++ b/conductor/tracks/post-release-security-quality-frontier_20260801/metadata.json @@ -4,7 +4,7 @@ "description": "Consolidate dependency updates, retire the Node 20 maintenance baseline, strengthen evidence-based tests and solo-maintainer controls, and reconcile the post-3.2.0 backlog.", "type": "maintenance", "priority": "P0", - "status": "new", + "status": "in_progress", "created_at": "2026-08-01", "updated_at": "2026-08-01", "current_phase": "Phase 1: Dependency and runtime consolidation", @@ -13,6 +13,11 @@ ], "parallel_safe": false, "portfolio_issue": 65, + "github": { + "track_issue": 224, + "phase_issues": [225, 226, 227, 228, 229], + "project_number": 36 + }, "moscow": { "must": 14, "should": 7, diff --git a/conductor/tracks/post-release-security-quality-frontier_20260801/plan.md b/conductor/tracks/post-release-security-quality-frontier_20260801/plan.md index d30146e..d83a0a1 100644 --- a/conductor/tracks/post-release-security-quality-frontier_20260801/plan.md +++ b/conductor/tracks/post-release-security-quality-frontier_20260801/plan.md @@ -10,8 +10,8 @@ evidence. Each phase is mirrored by a native GitHub subissue. ## Phase 1: Dependency and runtime consolidation -- [ ] Add failing guardrails for Node 24 and dependency-engine compatibility. - (M-001, M-008) +- [~] Add failing guardrails for Node 24 and dependency-engine compatibility. + (M-001, M-008) - [ ] Update maintained workflows and declared tooling baseline to Node 24. (M-001, M-004) - [ ] Reproduce and review PR #219's dependency set on current `main`. From 602b184a99bac93179b70ac8480bb9739c4a2ef3 Mon Sep 17 00:00:00 2001 From: "Dylan Mordaunt (ISLHD)" Date: Sat, 1 Aug 2026 15:27:21 +1000 Subject: [PATCH 3/6] build: adopt Node 24 and clear dependency audit --- .../actions/setup-maintainer-env/action.yml | 2 +- .github/workflows/ci.yml | 2 +- .github/workflows/release.yml | 2 +- .github/workflows/self-improvement.yml | 2 +- .github/workflows/skill-distribution.yml | 4 +- .../plan.md | 12 +- package-lock.json | 1077 +++++++++-------- package.json | 17 +- test/workflow-integrity.test.js | 14 + 9 files changed, 584 insertions(+), 548 deletions(-) diff --git a/.github/actions/setup-maintainer-env/action.yml b/.github/actions/setup-maintainer-env/action.yml index a7a5a6d..f07e1b2 100644 --- a/.github/actions/setup-maintainer-env/action.yml +++ b/.github/actions/setup-maintainer-env/action.yml @@ -5,7 +5,7 @@ inputs: node-version: description: Node.js version to install. required: false - default: '20' + default: '24' python-version: description: Optional Python version to install. required: false diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 81d4a95..8dcc5f9 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -20,7 +20,7 @@ jobs: - name: Set up shared maintainer toolchain uses: ./.github/actions/setup-maintainer-env with: - node-version: '20' + node-version: '24' install-vale: 'true' npm-ci: 'true' diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 1238fba..d1b945b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -23,7 +23,7 @@ jobs: - name: Set up shared maintainer toolchain uses: ./.github/actions/setup-maintainer-env with: - node-version: '20' + node-version: '24' install-vale: 'true' npm-ci: 'true' diff --git a/.github/workflows/self-improvement.yml b/.github/workflows/self-improvement.yml index 1100b36..d6f69fb 100644 --- a/.github/workflows/self-improvement.yml +++ b/.github/workflows/self-improvement.yml @@ -26,7 +26,7 @@ jobs: - name: Set up shared maintainer toolchain uses: ./.github/actions/setup-maintainer-env with: - node-version: '20' + node-version: '24' install-vale: 'false' npm-ci: 'true' diff --git a/.github/workflows/skill-distribution.yml b/.github/workflows/skill-distribution.yml index 117a195..e5bbdb6 100644 --- a/.github/workflows/skill-distribution.yml +++ b/.github/workflows/skill-distribution.yml @@ -20,7 +20,7 @@ jobs: - name: Set up Node uses: ./.github/actions/setup-maintainer-env with: - node-version: '20' + node-version: '24' install-vale: 'false' npm-ci: 'true' @@ -102,7 +102,7 @@ jobs: - name: Setup Node uses: ./.github/actions/setup-maintainer-env with: - node-version: '20' + node-version: '24' install-vale: 'true' npm-ci: 'true' diff --git a/conductor/tracks/post-release-security-quality-frontier_20260801/plan.md b/conductor/tracks/post-release-security-quality-frontier_20260801/plan.md index d83a0a1..956b2df 100644 --- a/conductor/tracks/post-release-security-quality-frontier_20260801/plan.md +++ b/conductor/tracks/post-release-security-quality-frontier_20260801/plan.md @@ -10,15 +10,15 @@ evidence. Each phase is mirrored by a native GitHub subissue. ## Phase 1: Dependency and runtime consolidation -- [~] Add failing guardrails for Node 24 and dependency-engine compatibility. - (M-001, M-008) -- [ ] Update maintained workflows and declared tooling baseline to Node 24. +- [x] Add failing guardrails for Node 24 and dependency-engine compatibility. + (M-001, M-008) +- [x] Update maintained workflows and declared tooling baseline to Node 24. (M-001, M-004) -- [ ] Reproduce and review PR #219's dependency set on current `main`. +- [x] Reproduce and review PR #219's dependency set on current `main`. (M-002, M-003) -- [ ] Run audit, sync, validation, lint, type, tests, and host/portable checks. +- [x] Run audit, sync, validation, lint, type, tests, and host/portable checks. (M-003–M-006, S-001) -- [ ] Verify the exact revision on Linux, macOS, Windows, and CodeQL. +- [~] Verify the exact revision on Linux, macOS, Windows, and CodeQL. - [ ] Close or supersede overlapping PRs #50, #53, and #62 with evidence. (M-002) - [ ] Phase verification and checkpoint per `conductor/workflow.md`. diff --git a/package-lock.json b/package-lock.json index f10ef48..d7c9a26 100644 --- a/package-lock.json +++ b/package-lock.json @@ -9,18 +9,21 @@ "version": "3.2.0", "license": "MIT", "devDependencies": { - "@types/node": "^25.6.0", - "eslint": "^10.2.1", + "@types/node": "^26.1.2", + "eslint": "^10.8.0", "eslint-config-prettier": "^10.1.8", "eslint-plugin-import": "^2.32.0", "eslint-plugin-node": "^11.1.0", "husky": "^9.1.7", - "js-yaml": "^4.3.0", - "lint-staged": "^16.4.0", - "markdownlint-cli": "^0.48.0", - "prettier": "^3.8.3", - "typescript": "^6.0.3", + "js-yaml": "^5.2.2", + "lint-staged": "^17.3.0", + "markdownlint-cli": "^0.49.1", + "prettier": "^3.9.6", + "typescript": "^7.0.2", "yaml": "^2.9.0" + }, + "engines": { + "node": ">=24" } }, "node_modules/@eslint-community/eslint-utils": { @@ -91,16 +94,16 @@ } }, "node_modules/@eslint/config-array/node_modules/brace-expansion": { - "version": "5.0.5", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz", - "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "dev": true, "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/@eslint/config-array/node_modules/minimatch": { @@ -120,9 +123,9 @@ } }, "node_modules/@eslint/config-helpers": { - "version": "0.5.5", - "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.5.5.tgz", - "integrity": "sha512-eIJYKTCECbP/nsKaaruF6LW967mtbQbsw4JTtSVkUQc9MneSkbrgPJAbKl9nWr0ZeowV8BfsarBmPpBzGelA2w==", + "version": "0.7.0", + "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.7.0.tgz", + "integrity": "sha512-DObd/KKUsU+FaFv4PLxSRenpXfQWmPXXP3pPZ6/K1PCrMu2vQpMDMuQe/BqYeoLcz8ro0bVDF1RxOJgfVEdhUw==", "dev": true, "license": "Apache-2.0", "dependencies": { @@ -156,9 +159,9 @@ } }, "node_modules/@eslint/plugin-kit": { - "version": "0.7.1", - "resolved": "https://registry.npmjs.org/@eslint/plugin-kit/-/plugin-kit-0.7.1.tgz", - "integrity": "sha512-rZAP3aVgB9ds9KOeUSL+zZ21hPmo8dh6fnIFwRQj5EAZl9gzR7wxYbYXYysAM8CTqGmUGyp2S4kUdV17MnGuWQ==", + "version": "0.7.2", + "resolved": "https://registry.npmjs.org/@eslint/plugin-kit/-/plugin-kit-0.7.2.tgz", + "integrity": "sha512-+CNAzxglkrpNf/kKywqQfk74QjtceuOE7Qm+AF8miRvPF/wmmK5+OJOgVh3AVTT3RP2mH3+FOaxlE5v72owk0A==", "dev": true, "license": "Apache-2.0", "dependencies": { @@ -229,9 +232,9 @@ "license": "MIT" }, "node_modules/@types/debug": { - "version": "4.1.12", - "resolved": "https://registry.npmjs.org/@types/debug/-/debug-4.1.12.tgz", - "integrity": "sha512-vIChWdVG3LG1SMxEvI/AK+FWJthlrqlTu7fbrlywTkkaONwk/UAGaULXRlf8vkzFBLVm0zkMdCquhL5aOjhXPQ==", + "version": "4.1.13", + "resolved": "https://registry.npmjs.org/@types/debug/-/debug-4.1.13.tgz", + "integrity": "sha512-KSVgmQmzMwPlmtljOomayoR89W4FynCAi3E8PPs7vmDVPe84hT+vGPKkJfThkmXs0x0jAaa9U8uW8bbfyS2fWw==", "dev": true, "license": "MIT", "dependencies": { @@ -281,13 +284,13 @@ "license": "MIT" }, "node_modules/@types/node": { - "version": "25.6.0", - "resolved": "https://registry.npmjs.org/@types/node/-/node-25.6.0.tgz", - "integrity": "sha512-+qIYRKdNYJwY3vRCZMdJbPLJAtGjQBudzZzdzwQYkEPQd+PJGixUL5QfvCLDaULoLv+RhT3LDkwEfKaAkgSmNQ==", + "version": "26.1.2", + "resolved": "https://registry.npmjs.org/@types/node/-/node-26.1.2.tgz", + "integrity": "sha512-Vu4a5UFA9rIIFJ7rB/Vaafh9lrCQszopTCx6KjFboXTGQbPNasehVR5TEiithSDGyd1DEiUByggTZsg8jukeIg==", "dev": true, "license": "MIT", "dependencies": { - "undici-types": "~7.19.0" + "undici-types": "~8.3.0" } }, "node_modules/@types/unist": { @@ -297,6 +300,346 @@ "dev": true, "license": "MIT" }, + "node_modules/@typescript/typescript-aix-ppc64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-aix-ppc64/-/typescript-aix-ppc64-7.0.2.tgz", + "integrity": "sha512-MTKKkWB7p/0E9xi1d1tHtZ5PiLkGEMIq88pK2CubZjOsLtYTLqhgIgi6zepFa+9GHZ6h05NMCkQxGKiPXMxXtQ==", + "cpu": [ + "ppc64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "aix" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-darwin-arm64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-arm64/-/typescript-darwin-arm64-7.0.2.tgz", + "integrity": "sha512-gowzar9MwS/aRWp6f3a4KUqzRjAZjOsmGNCM6LcTgXum+dBfgsBVMN+AgvOCCbguXyick6LJhpBszxMebJ8syA==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "darwin" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-darwin-x64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-x64/-/typescript-darwin-x64-7.0.2.tgz", + "integrity": "sha512-SZ9xZInqApNlNGc9s0W1VSsktYSOe9cFqNOIqmN1Gs8SmkjKZYFt017G4VwPxASInODuAdbTW7sXiFUf893RgA==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "darwin" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-freebsd-arm64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-arm64/-/typescript-freebsd-arm64-7.0.2.tgz", + "integrity": "sha512-W5NH4y/J0plIIS5b2xvTEkU7JFxyqdMAOgf+Ilhl0vHQXKO5dZoxd+C/jEtq56c4F3wk71RB4BMRQ2XdI+bwYQ==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "freebsd" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-freebsd-x64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-x64/-/typescript-freebsd-x64-7.0.2.tgz", + "integrity": "sha512-UMGDx5sTpzNw3WiPebH7l90IWfJggEd+egHt/q6p7/Cm3zqoV7VxkGXt+3DxPIw8CcmvAB0j3sVVfbhX+M4Tpw==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "freebsd" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-linux-arm": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm/-/typescript-linux-arm-7.0.2.tgz", + "integrity": "sha512-gffT3xPz9sR7j/YJExkyPntrI0P2EP9XbOyWzth2/Gs0RstK+90RBcO0ncXoXy/beYll1SXw846Nf2zdnEz0QQ==", + "cpu": [ + "arm" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-linux-arm64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm64/-/typescript-linux-arm64-7.0.2.tgz", + "integrity": "sha512-Qh4eU4/y3yDjnfjjyPYihMj5/ODIlmt+Bzu17OI+fiSRDW57QmU5SiN63exPRNJPKUzcc1INa1NXdrJ+MqHjUQ==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-linux-loong64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-loong64/-/typescript-linux-loong64-7.0.2.tgz", + "integrity": "sha512-uEHck9i8hoAzXPiYRib1O7miOnz23SxIeVl6F4LXox+qov1K35jHcEW6VHKvZI+pyvl7fZEP4MCU5LYvIq1GuQ==", + "cpu": [ + "loong64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-linux-mips64el": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-mips64el/-/typescript-linux-mips64el-7.0.2.tgz", + "integrity": "sha512-R4KvAMnE43W5Qeqb0Ly56O3mWMWIAgsMyz36DCaycd5nbg/9kzm0liw3JocfRqyJY0KPmzFjbswozXyW0DnIYA==", + "cpu": [ + "mips64el" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-linux-ppc64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-ppc64/-/typescript-linux-ppc64-7.0.2.tgz", + "integrity": "sha512-DORx5b3sd/4S7eayxm4FQv+A7CrkUIGRaHiwI8oiHTAI1fAPWhF4J0vAlkC8biAlHSVVwxMQ3tjZ2/DVbnQiiA==", + "cpu": [ + "ppc64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-linux-riscv64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-riscv64/-/typescript-linux-riscv64-7.0.2.tgz", + "integrity": "sha512-wf0jqEDOjrPRnKwYRyyJDRo11KMbvMFrU+q4zqKyChODBzvlkbhNQfKvLxQCcwTpdDaXSHZTVuh0JoCrKCUMHQ==", + "cpu": [ + "riscv64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-linux-s390x": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-s390x/-/typescript-linux-s390x-7.0.2.tgz", + "integrity": "sha512-IkwJc3L7yhytWd/ewjyxNDfOmswCm9GWMJT/ue/dU4aZNbwZeYAetq42VyLmsmSjvoX7z74X6ZaYCtzAr0EuGw==", + "cpu": [ + "s390x" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-linux-x64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-x64/-/typescript-linux-x64-7.0.2.tgz", + "integrity": "sha512-EYdf2cNg7rgCWJnxCdJ+F3V39O8ihb37eHAu1LK8oAFizgTQbPOK7zHHXbPt8rX24COqODXeI3sIf0fCXG7H/A==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-netbsd-arm64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-arm64/-/typescript-netbsd-arm64-7.0.2.tgz", + "integrity": "sha512-+polYF4MF04aPpO5FTkHran9yUQDSXqy5GiSDKpsll5jy3l3+g9QLhpf39T+ePtefhXLOGrLl0QIjkQP6VnelA==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "netbsd" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-netbsd-x64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-x64/-/typescript-netbsd-x64-7.0.2.tgz", + "integrity": "sha512-8YIT0EHM/3dq10ZOVF/A7pc/YSMtbcecct4rWtexrnSCHOPcpC2KTLXfTCR6vDpnSiY12heNb1GiN/wu+T/FyA==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "netbsd" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-openbsd-arm64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-arm64/-/typescript-openbsd-arm64-7.0.2.tgz", + "integrity": "sha512-APT8+ClYnuYm1u9+kgGXoMj2VzWzcymwh2gNSQVySHfkRDGOTVkoWLjCmOQSaO+PoqQ57B0flRp9SA+7GnnkzQ==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "openbsd" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-openbsd-x64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-x64/-/typescript-openbsd-x64-7.0.2.tgz", + "integrity": "sha512-yX7s+Q0Dln0Dt9tEzZsAjXXR/+ytBM7AlglaqyeMPxQszJ1JhlJdZ6jLA+IzldHtflX81em7lDao1xXu+aRRkg==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "openbsd" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-sunos-x64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-sunos-x64/-/typescript-sunos-x64-7.0.2.tgz", + "integrity": "sha512-dLJDGaLZ1D4HPQn62u1n8mBDkJREwMsAkCdkwd4Ieqw+x3TUyTsqY0YiBCtE6H6OzzgGk3iuZ3vFWRS+E8/d1g==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "sunos" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-win32-arm64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-win32-arm64/-/typescript-win32-arm64-7.0.2.tgz", + "integrity": "sha512-Gyl1Vy6OsWesLzmq+EP0Fb7b4Nid5232AvcA2SFcdYreldpNtYFFofPjnt62y9hQy7VTaZp65ICJjuAQRaVcIQ==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "win32" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-win32-x64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-win32-x64/-/typescript-win32-x64-7.0.2.tgz", + "integrity": "sha512-0BQ3HkAHHlKLSp1qRvf3SUhGpGsDuhB/jgFw75guyqbxJqEaS0Cw/VFO8i2nHglJUzQCRtMMR/IBAKE3ETMC4g==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "win32" + ], + "engines": { + "node": ">=16.20.0" + } + }, "node_modules/acorn": { "version": "8.16.0", "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.16.0.tgz", @@ -337,22 +680,6 @@ "url": "https://github.com/sponsors/epoberezkin" } }, - "node_modules/ansi-escapes": { - "version": "7.3.0", - "resolved": "https://registry.npmjs.org/ansi-escapes/-/ansi-escapes-7.3.0.tgz", - "integrity": "sha512-BvU8nYgGQBxcmMuEeUEmNTvrMVjJNSH7RgW24vXexN4Ven6qCvy4TntnvlnwnMLTVlcRQQdbRY8NKnaIoeWDNg==", - "dev": true, - "license": "MIT", - "dependencies": { - "environment": "^1.0.0" - }, - "engines": { - "node": ">=18" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, "node_modules/ansi-regex": { "version": "6.2.2", "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.2.2.tgz", @@ -529,9 +856,9 @@ "license": "MIT" }, "node_modules/brace-expansion": { - "version": "1.1.12", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz", - "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "dev": true, "license": "MIT", "dependencies": { @@ -622,71 +949,14 @@ "url": "https://github.com/sponsors/wooorm" } }, - "node_modules/cli-cursor": { - "version": "5.0.0", - "resolved": "https://registry.npmjs.org/cli-cursor/-/cli-cursor-5.0.0.tgz", - "integrity": "sha512-aCj4O5wKyszjMmDT4tZj93kxyydN/K5zPWSCe6/0AV/AA1pqe5ZBIw0a2ZfPQV7lL5/yb5HsUreJ6UFAF1tEQw==", - "dev": true, - "license": "MIT", - "dependencies": { - "restore-cursor": "^5.0.0" - }, - "engines": { - "node": ">=18" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/cli-truncate": { - "version": "5.1.1", - "resolved": "https://registry.npmjs.org/cli-truncate/-/cli-truncate-5.1.1.tgz", - "integrity": "sha512-SroPvNHxUnk+vIW/dOSfNqdy1sPEFkrTk6TUtqLCnBlo3N7TNYYkzzN7uSD6+jVjrdO4+p8nH7JzH6cIvUem6A==", - "dev": true, - "license": "MIT", - "dependencies": { - "slice-ansi": "^7.1.0", - "string-width": "^8.0.0" - }, - "engines": { - "node": ">=20" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/cli-truncate/node_modules/string-width": { - "version": "8.1.1", - "resolved": "https://registry.npmjs.org/string-width/-/string-width-8.1.1.tgz", - "integrity": "sha512-KpqHIdDL9KwYk22wEOg/VIqYbrnLeSApsKT/bSj6Ez7pn3CftUiLAv2Lccpq1ALcpLV9UX1Ppn92npZWu2w/aw==", - "dev": true, - "license": "MIT", - "dependencies": { - "get-east-asian-width": "^1.3.0", - "strip-ansi": "^7.1.0" - }, - "engines": { - "node": ">=20" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/colorette": { - "version": "2.0.20", - "resolved": "https://registry.npmjs.org/colorette/-/colorette-2.0.20.tgz", - "integrity": "sha512-IfEDxwoWIjkeXL1eXcDiow4UbKjhLdq6/EuSVR9GMN7KVH3r9gQ83e73hsz1Nd1T3ijd5xv1wcWRYO+D6kCI2w==", - "dev": true, - "license": "MIT" - }, "node_modules/commander": { - "version": "14.0.3", - "resolved": "https://registry.npmjs.org/commander/-/commander-14.0.3.tgz", - "integrity": "sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw==", + "version": "15.0.0", + "resolved": "https://registry.npmjs.org/commander/-/commander-15.0.0.tgz", + "integrity": "sha512-z67u4ZhzCL/Tydu1lJARtEZYWbWaN7oYLHbsuzocr6y4N6WZAagG3RQ4FW61V1/0+jImpj293XfrcYnd1qxtPg==", "dev": true, "license": "MIT", "engines": { - "node": ">=20" + "node": ">=22.12.0" } }, "node_modules/concat-map": { @@ -915,19 +1185,6 @@ "url": "https://github.com/fb55/entities?sponsor=1" } }, - "node_modules/environment": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/environment/-/environment-1.1.0.tgz", - "integrity": "sha512-xUtoPkMggbz0MPyPiIWr1Kp4aeWJjDZ6SMvURhimjdZgsRuDplF5/s9hcgGhyXMhs+6vpnuoiZ2kFiu3FMnS8Q==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=18" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, "node_modules/es-abstract": { "version": "1.24.1", "resolved": "https://registry.npmjs.org/es-abstract/-/es-abstract-1.24.1.tgz", @@ -1091,18 +1348,21 @@ } }, "node_modules/eslint": { - "version": "10.2.1", - "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.2.1.tgz", - "integrity": "sha512-wiyGaKsDgqXvF40P8mDwiUp/KQjE1FdrIEJsM8PZ3XCiniTMXS3OHWWUe5FI5agoCnr8x4xPrTDZuxsBlNHl+Q==", + "version": "10.8.0", + "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.8.0.tgz", + "integrity": "sha512-nuKKvN+oIBO0koN7Tm7dlkmnkc21mtt0QJLwAKzjLq14y6lRTdVG36MZHJ8eQHwdJMwZbQNMlPOYedMq/oVJvQ==", "dev": true, "license": "MIT", + "workspaces": [ + "packages/*" + ], "dependencies": { "@eslint-community/eslint-utils": "^4.8.0", "@eslint-community/regexpp": "^4.12.2", "@eslint/config-array": "^0.23.5", - "@eslint/config-helpers": "^0.5.5", + "@eslint/config-helpers": "^0.7.0", "@eslint/core": "^1.2.1", - "@eslint/plugin-kit": "^0.7.1", + "@eslint/plugin-kit": "^0.7.2", "@humanfs/node": "^0.16.6", "@humanwhocodes/module-importer": "^1.0.1", "@humanwhocodes/retry": "^0.4.2", @@ -1124,7 +1384,7 @@ "imurmurhash": "^0.1.4", "is-glob": "^4.0.0", "json-stable-stringify-without-jsonify": "^1.0.1", - "minimatch": "^10.2.4", + "minimatch": "^10.2.5", "natural-compare": "^1.4.0", "optionator": "^0.9.3" }, @@ -1366,16 +1626,16 @@ } }, "node_modules/eslint/node_modules/brace-expansion": { - "version": "5.0.5", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz", - "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "dev": true, "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/eslint/node_modules/minimatch": { @@ -1458,13 +1718,6 @@ "node": ">=0.10.0" } }, - "node_modules/eventemitter3": { - "version": "5.0.4", - "resolved": "https://registry.npmjs.org/eventemitter3/-/eventemitter3-5.0.4.tgz", - "integrity": "sha512-mlsTRyGaPBjPedk6Bvw+aqbsXDtoAyAzm5MO7JgU+yVRyMQ5O8bD4Kcci7BS85f93veegeCPkL8R4GLClnjLFw==", - "dev": true, - "license": "MIT" - }, "node_modules/fast-deep-equal": { "version": "3.1.3", "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz", @@ -1486,6 +1739,24 @@ "dev": true, "license": "MIT" }, + "node_modules/fdir": { + "version": "6.5.0", + "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz", + "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=12.0.0" + }, + "peerDependencies": { + "picomatch": "^3 || ^4" + }, + "peerDependenciesMeta": { + "picomatch": { + "optional": true + } + } + }, "node_modules/file-entry-cache": { "version": "8.0.0", "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-8.0.0.tgz", @@ -1605,9 +1876,9 @@ } }, "node_modules/get-east-asian-width": { - "version": "1.4.0", - "resolved": "https://registry.npmjs.org/get-east-asian-width/-/get-east-asian-width-1.4.0.tgz", - "integrity": "sha512-QZjmEOC+IT1uk6Rx0sX22V6uHWVwbdbxf1faPqJ1QhLdGgsRGCZoyaQBm/piRdJy/D2um6hM1UP7ZEeQ4EkP+Q==", + "version": "1.6.0", + "resolved": "https://registry.npmjs.org/get-east-asian-width/-/get-east-asian-width-1.6.0.tgz", + "integrity": "sha512-QRbvDIbx6YklUe6RxeTeleMR0yv3cYH6PsPZHcnVn7xv7zO1BHN8r0XETu8n6Ye3Q+ahtSarc3WgtNWmehIBfA==", "dev": true, "license": "MIT", "engines": { @@ -1838,13 +2109,13 @@ } }, "node_modules/ini": { - "version": "4.1.3", - "resolved": "https://registry.npmjs.org/ini/-/ini-4.1.3.tgz", - "integrity": "sha512-X7rqawQBvfdjS10YU1y1YVreA3SsLrW9dX2CewP2EbBJM4ypVNLDkO5y04gejPwKIY9lR+7r9gn3rFPt/kmWFg==", + "version": "7.0.0", + "resolved": "https://registry.npmjs.org/ini/-/ini-7.0.0.tgz", + "integrity": "sha512-ifK0CgjALofS5bkrcTy4RaQ9Vx2Knf/eLeIO+NaswQEpH1UblrtTSCIvN71qQDMq0PeQ/SSPojvEJp9vvvfr+w==", "dev": true, "license": "ISC", "engines": { - "node": "^14.17.0 || ^16.13.0 || >=18.0.0" + "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, "node_modules/internal-slot": { @@ -2307,9 +2578,9 @@ "license": "ISC" }, "node_modules/js-yaml": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", - "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", + "version": "5.2.2", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.2.tgz", + "integrity": "sha512-dayzUzKkJ1MkuUtZglSebU43utNXH0OWQByK9rKOOuYIO8M5TV1y+n8ALMdG0rdzBnfNkOmZEqrURepb0ejqBw==", "dev": true, "funding": [ { @@ -2326,7 +2597,7 @@ "argparse": "^2.0.1" }, "bin": { - "js-yaml": "bin/js-yaml.js" + "js-yaml": "bin/js-yaml.mjs" } }, "node_modules/json-buffer": { @@ -2381,9 +2652,9 @@ } }, "node_modules/katex": { - "version": "0.16.28", - "resolved": "https://registry.npmjs.org/katex/-/katex-0.16.28.tgz", - "integrity": "sha512-YHzO7721WbmAL6Ov1uzN/l5mY5WWWhJBSW+jq4tkfZfsxmo1hu6frS0EOswvjBUnWE6NtjEs48SFn5CQESRLZg==", + "version": "0.16.47", + "resolved": "https://registry.npmjs.org/katex/-/katex-0.16.47.tgz", + "integrity": "sha512-Eeo8Ys1doU1z+x8AZsPpQu+p/QcZBI5PeOo7QGQdy2x2m0MU/hYagBbGOmXwr5KVbEfVuWv9LpnQWeehogurjg==", "dev": true, "funding": [ "https://opencollective.com/katex", @@ -2432,111 +2703,47 @@ } }, "node_modules/linkify-it": { - "version": "5.0.0", - "resolved": "https://registry.npmjs.org/linkify-it/-/linkify-it-5.0.0.tgz", - "integrity": "sha512-5aHCbzQRADcdP+ATqnDuhhJ/MRIqDkZX5pyjFHRRysS8vZ5AbqGEoFIb6pYHPZ+L/OC2Lc+xT8uHVVR5CAK/wQ==", + "version": "5.0.2", + "resolved": "https://registry.npmjs.org/linkify-it/-/linkify-it-5.0.2.tgz", + "integrity": "sha512-ONTm2jCMAVZjgQa/Fy1kScXsuOoF5NPTsoFBdE1KVIZ2vAh/r9+Bqo+0jINCBYnavTPQZz38QzFTme79ENoN3Q==", "dev": true, + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/puzrin" + }, + { + "type": "github", + "url": "https://github.com/sponsors/markdown-it" + } + ], "license": "MIT", "dependencies": { "uc.micro": "^2.0.0" } }, "node_modules/lint-staged": { - "version": "16.4.0", - "resolved": "https://registry.npmjs.org/lint-staged/-/lint-staged-16.4.0.tgz", - "integrity": "sha512-lBWt8hujh/Cjysw5GYVmZpFHXDCgZzhrOm8vbcUdobADZNOK/bRshr2kM3DfgrrtR1DQhfupW9gnIXOfiFi+bw==", + "version": "17.3.0", + "resolved": "https://registry.npmjs.org/lint-staged/-/lint-staged-17.3.0.tgz", + "integrity": "sha512-woZS3vNe3UKqBaLPvbLOtKRY4tLANpWQhom12MGWqC8Mh1lCOO+WgSwmX2amjJAqTY9BkXYW87fCUH5H9Ph6xw==", "dev": true, "license": "MIT", "dependencies": { - "commander": "^14.0.3", - "listr2": "^9.0.5", - "picomatch": "^4.0.3", + "picomatch": "^4.0.5", "string-argv": "^0.3.2", - "tinyexec": "^1.0.4", - "yaml": "^2.8.2" + "tinyexec": "^1.2.4" }, "bin": { "lint-staged": "bin/lint-staged.js" }, "engines": { - "node": ">=20.17" + "node": ">=22.22.1" }, "funding": { "url": "https://opencollective.com/lint-staged" - } - }, - "node_modules/listr2": { - "version": "9.0.5", - "resolved": "https://registry.npmjs.org/listr2/-/listr2-9.0.5.tgz", - "integrity": "sha512-ME4Fb83LgEgwNw96RKNvKV4VTLuXfoKudAmm2lP8Kk87KaMK0/Xrx/aAkMWmT8mDb+3MlFDspfbCs7adjRxA2g==", - "dev": true, - "license": "MIT", - "dependencies": { - "cli-truncate": "^5.0.0", - "colorette": "^2.0.20", - "eventemitter3": "^5.0.1", - "log-update": "^6.1.0", - "rfdc": "^1.4.1", - "wrap-ansi": "^9.0.0" - }, - "engines": { - "node": ">=20.0.0" - } - }, - "node_modules/listr2/node_modules/ansi-styles": { - "version": "6.2.3", - "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.3.tgz", - "integrity": "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=12" - }, - "funding": { - "url": "https://github.com/chalk/ansi-styles?sponsor=1" - } - }, - "node_modules/listr2/node_modules/emoji-regex": { - "version": "10.6.0", - "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-10.6.0.tgz", - "integrity": "sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A==", - "dev": true, - "license": "MIT" - }, - "node_modules/listr2/node_modules/string-width": { - "version": "7.2.0", - "resolved": "https://registry.npmjs.org/string-width/-/string-width-7.2.0.tgz", - "integrity": "sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ==", - "dev": true, - "license": "MIT", - "dependencies": { - "emoji-regex": "^10.3.0", - "get-east-asian-width": "^1.0.0", - "strip-ansi": "^7.1.0" - }, - "engines": { - "node": ">=18" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/listr2/node_modules/wrap-ansi": { - "version": "9.0.2", - "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-9.0.2.tgz", - "integrity": "sha512-42AtmgqjV+X1VpdOfyTGOYRi0/zsoLqtXQckTmqTeybT+BDIbM/Guxo7x3pE2vtpr1ok6xRqM9OpBe+Jyoqyww==", - "dev": true, - "license": "MIT", - "dependencies": { - "ansi-styles": "^6.2.1", - "string-width": "^7.0.0", - "strip-ansi": "^7.1.0" }, - "engines": { - "node": ">=18" - }, - "funding": { - "url": "https://github.com/chalk/wrap-ansi?sponsor=1" + "optionalDependencies": { + "yaml": "^2.9.0" } }, "node_modules/locate-path": { @@ -2555,92 +2762,26 @@ "url": "https://github.com/sponsors/sindresorhus" } }, - "node_modules/log-update": { - "version": "6.1.0", - "resolved": "https://registry.npmjs.org/log-update/-/log-update-6.1.0.tgz", - "integrity": "sha512-9ie8ItPR6tjY5uYJh8K/Zrv/RMZ5VOlOWvtZdEHYSTFKZfIBPQa9tOAEeAWhd+AnIneLJ22w5fjOYtoutpWq5w==", - "dev": true, - "license": "MIT", - "dependencies": { - "ansi-escapes": "^7.0.0", - "cli-cursor": "^5.0.0", - "slice-ansi": "^7.1.0", - "strip-ansi": "^7.1.0", - "wrap-ansi": "^9.0.0" - }, - "engines": { - "node": ">=18" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/log-update/node_modules/ansi-styles": { - "version": "6.2.3", - "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.3.tgz", - "integrity": "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=12" - }, - "funding": { - "url": "https://github.com/chalk/ansi-styles?sponsor=1" - } - }, - "node_modules/log-update/node_modules/emoji-regex": { - "version": "10.6.0", - "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-10.6.0.tgz", - "integrity": "sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A==", - "dev": true, - "license": "MIT" - }, - "node_modules/log-update/node_modules/string-width": { - "version": "7.2.0", - "resolved": "https://registry.npmjs.org/string-width/-/string-width-7.2.0.tgz", - "integrity": "sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ==", - "dev": true, - "license": "MIT", - "dependencies": { - "emoji-regex": "^10.3.0", - "get-east-asian-width": "^1.0.0", - "strip-ansi": "^7.1.0" - }, - "engines": { - "node": ">=18" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/log-update/node_modules/wrap-ansi": { - "version": "9.0.2", - "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-9.0.2.tgz", - "integrity": "sha512-42AtmgqjV+X1VpdOfyTGOYRi0/zsoLqtXQckTmqTeybT+BDIbM/Guxo7x3pE2vtpr1ok6xRqM9OpBe+Jyoqyww==", - "dev": true, - "license": "MIT", - "dependencies": { - "ansi-styles": "^6.2.1", - "string-width": "^7.0.0", - "strip-ansi": "^7.1.0" - }, - "engines": { - "node": ">=18" - }, - "funding": { - "url": "https://github.com/chalk/wrap-ansi?sponsor=1" - } - }, "node_modules/markdown-it": { - "version": "14.1.1", - "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.1.1.tgz", - "integrity": "sha512-BuU2qnTti9YKgK5N+IeMubp14ZUKUUw7yeJbkjtosvHiP0AZ5c8IAgEMk79D0eC8F23r4Ac/q8cAIFdm2FtyoA==", + "version": "14.3.0", + "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.3.0.tgz", + "integrity": "sha512-RCEsPjR+sr0x+AuYp601tKTkgFG4YEPLCzHST3cQ/fhlJkqAkz1L2/Qbp1j9qw5SBwQHFBoW8+hoN5xssOF0Tw==", "dev": true, + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/puzrin" + }, + { + "type": "github", + "url": "https://github.com/sponsors/markdown-it" + } + ], "license": "MIT", "dependencies": { "argparse": "^2.0.1", - "entities": "^4.4.0", - "linkify-it": "^5.0.0", + "entities": "^4.5.0", + "linkify-it": "^5.0.2", "mdurl": "^2.0.0", "punycode.js": "^2.3.1", "uc.micro": "^2.1.0" @@ -2650,9 +2791,9 @@ } }, "node_modules/markdownlint": { - "version": "0.40.0", - "resolved": "https://registry.npmjs.org/markdownlint/-/markdownlint-0.40.0.tgz", - "integrity": "sha512-UKybllYNheWac61Ia7T6fzuQNDZimFIpCg2w6hHjgV1Qu0w1TV0LlSgryUGzM0bkKQCBhy2FDhEELB73Kb0kAg==", + "version": "0.41.1", + "resolved": "https://registry.npmjs.org/markdownlint/-/markdownlint-0.41.1.tgz", + "integrity": "sha512-qHKeU2E1bdyNAT077go2FVTNXvYcktN5IHtF6XyeD1l0PClxzSp2tUApAV14ORI8DGX4H9bNKZEzelZp4qn8IA==", "dev": true, "license": "MIT", "dependencies": { @@ -2664,40 +2805,40 @@ "micromark-extension-gfm-table": "2.1.1", "micromark-extension-math": "3.1.0", "micromark-util-types": "2.0.2", - "string-width": "8.1.0" + "string-width": "8.2.1" }, "engines": { - "node": ">=20" + "node": ">=22" }, "funding": { "url": "https://github.com/sponsors/DavidAnson" } }, "node_modules/markdownlint-cli": { - "version": "0.48.0", - "resolved": "https://registry.npmjs.org/markdownlint-cli/-/markdownlint-cli-0.48.0.tgz", - "integrity": "sha512-NkZQNu2E0Q5qLEEHwWj674eYISTLD4jMHkBzDobujXd1kv+yCxi8jOaD/rZoQNW1FBBMMGQpuW5So8B51N/e0A==", + "version": "0.49.1", + "resolved": "https://registry.npmjs.org/markdownlint-cli/-/markdownlint-cli-0.49.1.tgz", + "integrity": "sha512-qpYqJbSYf3jv57bdnFmCaZ/Wlu6IYHp2b6SOKrKBJ7OnPrDHIKmx4NERWH49QH9viTI6yO6raVDDn5nrf60VQQ==", "dev": true, "license": "MIT", "dependencies": { - "commander": "~14.0.3", + "commander": "~15.0.0", "deep-extend": "~0.6.0", - "ignore": "~7.0.5", - "js-yaml": "~4.1.1", + "ignore": "~7.0.6", + "js-yaml": "~5.2.1", "jsonc-parser": "~3.3.1", "jsonpointer": "~5.0.1", - "markdown-it": "~14.1.1", - "markdownlint": "~0.40.0", - "minimatch": "~10.2.4", - "run-con": "~1.3.2", - "smol-toml": "~1.6.0", - "tinyglobby": "~0.2.15" + "markdown-it": "~14.3.0", + "markdownlint": "~0.41.1", + "minimatch": "~10.2.5", + "run-con": "~1.3.3", + "smol-toml": "~1.7.0", + "tinyglobby": "~0.2.17" }, "bin": { "markdownlint": "markdownlint.js" }, "engines": { - "node": ">=20" + "node": ">=22" } }, "node_modules/markdownlint-cli/node_modules/balanced-match": { @@ -2711,49 +2852,36 @@ } }, "node_modules/markdownlint-cli/node_modules/brace-expansion": { - "version": "5.0.4", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.4.tgz", - "integrity": "sha512-h+DEnpVvxmfVefa4jFbCf5HdH5YMDXRsmKflpf1pILZWRFlTbJpxeU55nJl4Smt5HQaGzg1o6RHFPJaOqnmBDg==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "dev": true, "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/markdownlint-cli/node_modules/ignore": { - "version": "7.0.5", - "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.5.tgz", - "integrity": "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==", + "version": "7.0.6", + "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.6.tgz", + "integrity": "sha512-BAg6QkE8W+TuQLrrw0Ugr7HegXduRuuj8/ti2kSOc+jz1dmx8/WNcjr6XGnq5YpDWxFwwaavqD0+jIUOKelTsw==", "dev": true, "license": "MIT", "engines": { "node": ">= 4" } }, - "node_modules/markdownlint-cli/node_modules/js-yaml": { - "version": "4.1.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz", - "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==", - "dev": true, - "license": "MIT", - "dependencies": { - "argparse": "^2.0.1" - }, - "bin": { - "js-yaml": "bin/js-yaml.js" - } - }, "node_modules/markdownlint-cli/node_modules/minimatch": { - "version": "10.2.4", - "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.4.tgz", - "integrity": "sha512-oRjTw/97aTBN0RHbYCdtF1MQfvusSIBQM0IZEgzl6426+8jSC0nF1a/GmnVLpfB9yyr6g6FTqWqiZVbxrtaCIg==", + "version": "10.2.6", + "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz", + "integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==", "dev": true, "license": "BlueOak-1.0.0", "dependencies": { - "brace-expansion": "^5.0.2" + "brace-expansion": "^5.0.8" }, "engines": { "node": "18 || 20 || >=22" @@ -2773,9 +2901,9 @@ } }, "node_modules/mdurl": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/mdurl/-/mdurl-2.0.0.tgz", - "integrity": "sha512-Lf+9+2r+Tdp5wXDXC4PcIBjTDtq4UKjCPMQhKIuzpJNW0b96kVqSwW0bT7FhRSfmAiFYgP+SCRvdrDozfh0U5w==", + "version": "2.1.0", + "resolved": "https://registry.npmjs.org/mdurl/-/mdurl-2.1.0.tgz", + "integrity": "sha512-1+HBaOx0zi/dQWht8rNv9MYf9qqpqL/kxI0hXImU6Y547zM6Sni8BQibt7ifgMcYtQg41ao3Ivd6cnSM86inpg==", "dev": true, "license": "MIT" }, @@ -3315,19 +3443,6 @@ ], "license": "MIT" }, - "node_modules/mimic-function": { - "version": "5.0.1", - "resolved": "https://registry.npmjs.org/mimic-function/-/mimic-function-5.0.1.tgz", - "integrity": "sha512-VP79XUPxV2CigYP3jWwAUFSku2aKqBH7uTAapFWCBqutsbmDo96KY5o8uh6U+/YSIn5OxJnXp73beVkpqMIGhA==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=18" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, "node_modules/minimatch": { "version": "3.1.5", "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz", @@ -3462,22 +3577,6 @@ "url": "https://github.com/sponsors/ljharb" } }, - "node_modules/onetime": { - "version": "7.0.0", - "resolved": "https://registry.npmjs.org/onetime/-/onetime-7.0.0.tgz", - "integrity": "sha512-VXJjc87FScF88uafS3JllDgvAm+c/Slfz06lorj2uAY34rlUu0Nt+v8wreiImcrgAjjIHp1rXpTDlLOGw29WwQ==", - "dev": true, - "license": "MIT", - "dependencies": { - "mimic-function": "^5.0.0" - }, - "engines": { - "node": ">=18" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, "node_modules/optionator": { "version": "0.9.4", "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.4.tgz", @@ -3594,9 +3693,9 @@ "license": "MIT" }, "node_modules/picomatch": { - "version": "4.0.4", - "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz", - "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==", + "version": "4.0.5", + "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz", + "integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==", "dev": true, "license": "MIT", "engines": { @@ -3627,9 +3726,9 @@ } }, "node_modules/prettier": { - "version": "3.8.3", - "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.8.3.tgz", - "integrity": "sha512-7igPTM53cGHMW8xWuVTydi2KO233VFiTNyF5hLJqpilHfmn8C8gPf+PS7dUT64YcXFbiMGZxS9pCSxL/Dxm/Jw==", + "version": "3.9.6", + "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.9.6.tgz", + "integrity": "sha512-OpN0zzVdiaiAhxpuuj5efpIS4sY9j7bY6uR5mnj5yPzGkdkjNKSJeUThPb60Jw29QuAZgA4o+/iB49kFiaBX6g==", "dev": true, "license": "MIT", "bin": { @@ -3740,39 +3839,15 @@ "url": "https://github.com/sponsors/ljharb" } }, - "node_modules/restore-cursor": { - "version": "5.1.0", - "resolved": "https://registry.npmjs.org/restore-cursor/-/restore-cursor-5.1.0.tgz", - "integrity": "sha512-oMA2dcrw6u0YfxJQXm342bFKX/E4sG9rbTzO9ptUcR/e8A33cHuvStiYOwH7fszkZlZ1z/ta9AAoPk2F4qIOHA==", - "dev": true, - "license": "MIT", - "dependencies": { - "onetime": "^7.0.0", - "signal-exit": "^4.1.0" - }, - "engines": { - "node": ">=18" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/rfdc": { - "version": "1.4.1", - "resolved": "https://registry.npmjs.org/rfdc/-/rfdc-1.4.1.tgz", - "integrity": "sha512-q1b3N5QkRUWUl7iyylaaj3kOpIT0N2i9MqIEQXP73GVsN9cw3fdx8X63cEmWhJGi2PPCF23Ijp7ktmd39rawIA==", - "dev": true, - "license": "MIT" - }, "node_modules/run-con": { - "version": "1.3.2", - "resolved": "https://registry.npmjs.org/run-con/-/run-con-1.3.2.tgz", - "integrity": "sha512-CcfE+mYiTcKEzg0IqS08+efdnH0oJ3zV0wSUFBNrMHMuxCtXvBCLzCJHatwuXDcu/RlhjTziTo/a1ruQik6/Yg==", + "version": "1.3.3", + "resolved": "https://registry.npmjs.org/run-con/-/run-con-1.3.3.tgz", + "integrity": "sha512-Lb7OKM9aaykzyoNiHGhSVCjZsvbyy6qDMp2vDXL+MoCfz3GfNJtHYH7uYsU3QNMyInBk++xx+EZ8xZ8Sxs5fNQ==", "dev": true, "license": "(BSD-2-Clause OR MIT OR Apache-2.0)", "dependencies": { "deep-extend": "^0.6.0", - "ini": "~4.1.0", + "ini": "~7.0.0", "minimist": "^1.2.8", "strip-json-comments": "~3.1.1" }, @@ -3993,69 +4068,10 @@ "url": "https://github.com/sponsors/ljharb" } }, - "node_modules/signal-exit": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz", - "integrity": "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==", - "dev": true, - "license": "ISC", - "engines": { - "node": ">=14" - }, - "funding": { - "url": "https://github.com/sponsors/isaacs" - } - }, - "node_modules/slice-ansi": { - "version": "7.1.2", - "resolved": "https://registry.npmjs.org/slice-ansi/-/slice-ansi-7.1.2.tgz", - "integrity": "sha512-iOBWFgUX7caIZiuutICxVgX1SdxwAVFFKwt1EvMYYec/NWO5meOJ6K5uQxhrYBdQJne4KxiqZc+KptFOWFSI9w==", - "dev": true, - "license": "MIT", - "dependencies": { - "ansi-styles": "^6.2.1", - "is-fullwidth-code-point": "^5.0.0" - }, - "engines": { - "node": ">=18" - }, - "funding": { - "url": "https://github.com/chalk/slice-ansi?sponsor=1" - } - }, - "node_modules/slice-ansi/node_modules/ansi-styles": { - "version": "6.2.3", - "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.3.tgz", - "integrity": "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=12" - }, - "funding": { - "url": "https://github.com/chalk/ansi-styles?sponsor=1" - } - }, - "node_modules/slice-ansi/node_modules/is-fullwidth-code-point": { - "version": "5.1.0", - "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-5.1.0.tgz", - "integrity": "sha512-5XHYaSyiqADb4RnZ1Bdad6cPp8Toise4TzEjcOYDHZkTCbKgiUl7WTUCpNWHuxmDt91wnsZBc9xinNzopv3JMQ==", - "dev": true, - "license": "MIT", - "dependencies": { - "get-east-asian-width": "^1.3.1" - }, - "engines": { - "node": ">=18" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, "node_modules/smol-toml": { - "version": "1.6.0", - "resolved": "https://registry.npmjs.org/smol-toml/-/smol-toml-1.6.0.tgz", - "integrity": "sha512-4zemZi0HvTnYwLfrpk/CF9LOd9Lt87kAt50GnqhMpyF9U3poDAP2+iukq2bZsO/ufegbYehBkqINbsWxj4l4cw==", + "version": "1.7.1", + "resolved": "https://registry.npmjs.org/smol-toml/-/smol-toml-1.7.1.tgz", + "integrity": "sha512-PPlsspAZ4jbMBu5DMFhfUGDQLu/vrL4SyBROVS37x8ynnVmFIs1VPBz1Co8Xks3TvpIaZXmU85y4DrQ+UyVFoQ==", "dev": true, "license": "BSD-3-Clause", "engines": { @@ -4090,14 +4106,14 @@ } }, "node_modules/string-width": { - "version": "8.1.0", - "resolved": "https://registry.npmjs.org/string-width/-/string-width-8.1.0.tgz", - "integrity": "sha512-Kxl3KJGb/gxkaUMOjRsQ8IrXiGW75O4E3RPjFIINOVH8AMl2SQ/yWdTzWwF3FevIX9LcMAjJW+GRwAlAbTSXdg==", + "version": "8.2.1", + "resolved": "https://registry.npmjs.org/string-width/-/string-width-8.2.1.tgz", + "integrity": "sha512-IIaP0g3iy9Cyy18w3M9YcaDudujEAVHKt3a3QJg1+sr/oX96TbaGUubG0hJyCjCBThFH+tFpcIyoUHUn1ogaLA==", "dev": true, "license": "MIT", "dependencies": { - "get-east-asian-width": "^1.3.0", - "strip-ansi": "^7.1.0" + "get-east-asian-width": "^1.5.0", + "strip-ansi": "^7.1.2" }, "engines": { "node": ">=20" @@ -4166,13 +4182,13 @@ } }, "node_modules/strip-ansi": { - "version": "7.1.2", - "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.1.2.tgz", - "integrity": "sha512-gmBGslpoQJtgnMAvOVqGZpEz9dyoKTCzy2nfz/n8aIFhN/jCE/rCmcxabB6jOOHV+0WNnylOxaxBQPSvcWklhA==", + "version": "7.2.0", + "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.2.0.tgz", + "integrity": "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w==", "dev": true, "license": "MIT", "dependencies": { - "ansi-regex": "^6.0.1" + "ansi-regex": "^6.2.2" }, "engines": { "node": ">=12" @@ -4218,9 +4234,9 @@ } }, "node_modules/tinyexec": { - "version": "1.1.1", - "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.1.1.tgz", - "integrity": "sha512-VKS/ZaQhhkKFMANmAOhhXVoIfBXblQxGX1myCQ2faQrfmobMftXeJPcZGp0gS07ocvGJWDLZGyOZDadDBqYIJg==", + "version": "1.2.4", + "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.2.4.tgz", + "integrity": "sha512-SHf/r48b7vOrjve9PxJo3MN5v5yuyjHvdUcrQffT3WXMUfnGmHDVbC4k3sHJaJTgZCwpUplIaAo5ANtMyp3YHg==", "dev": true, "license": "MIT", "engines": { @@ -4228,14 +4244,14 @@ } }, "node_modules/tinyglobby": { - "version": "0.2.15", - "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.15.tgz", - "integrity": "sha512-j2Zq4NyQYG5XMST4cbs02Ak8iJUdxRM0XI5QyxXuZOzKOINmWurp3smXu3y5wDcJrptwpSjgXHzIQxR0omXljQ==", + "version": "0.2.17", + "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz", + "integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==", "dev": true, "license": "MIT", "dependencies": { "fdir": "^6.5.0", - "picomatch": "^4.0.3" + "picomatch": "^4.0.4" }, "engines": { "node": ">=12.0.0" @@ -4244,24 +4260,6 @@ "url": "https://github.com/sponsors/SuperchupuDev" } }, - "node_modules/tinyglobby/node_modules/fdir": { - "version": "6.5.0", - "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz", - "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=12.0.0" - }, - "peerDependencies": { - "picomatch": "^3 || ^4" - }, - "peerDependenciesMeta": { - "picomatch": { - "optional": true - } - } - }, "node_modules/tsconfig-paths": { "version": "3.15.0", "resolved": "https://registry.npmjs.org/tsconfig-paths/-/tsconfig-paths-3.15.0.tgz", @@ -4367,17 +4365,38 @@ } }, "node_modules/typescript": { - "version": "6.0.3", - "resolved": "https://registry.npmjs.org/typescript/-/typescript-6.0.3.tgz", - "integrity": "sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw==", + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/typescript/-/typescript-7.0.2.tgz", + "integrity": "sha512-8FYau96o3NKOhbjKi/qNvG/W5jhzxkbdm5sj9AbZ/5T5sWqn3hJgLfGx27sRKZWTvyzCP8dLRBTf5tBTSRVUNA==", "dev": true, "license": "Apache-2.0", "bin": { - "tsc": "bin/tsc", - "tsserver": "bin/tsserver" - }, - "engines": { - "node": ">=14.17" + "tsc": "bin/tsc" + }, + "engines": { + "node": ">=16.20.0" + }, + "optionalDependencies": { + "@typescript/typescript-aix-ppc64": "7.0.2", + "@typescript/typescript-darwin-arm64": "7.0.2", + "@typescript/typescript-darwin-x64": "7.0.2", + "@typescript/typescript-freebsd-arm64": "7.0.2", + "@typescript/typescript-freebsd-x64": "7.0.2", + "@typescript/typescript-linux-arm": "7.0.2", + "@typescript/typescript-linux-arm64": "7.0.2", + "@typescript/typescript-linux-loong64": "7.0.2", + "@typescript/typescript-linux-mips64el": "7.0.2", + "@typescript/typescript-linux-ppc64": "7.0.2", + "@typescript/typescript-linux-riscv64": "7.0.2", + "@typescript/typescript-linux-s390x": "7.0.2", + "@typescript/typescript-linux-x64": "7.0.2", + "@typescript/typescript-netbsd-arm64": "7.0.2", + "@typescript/typescript-netbsd-x64": "7.0.2", + "@typescript/typescript-openbsd-arm64": "7.0.2", + "@typescript/typescript-openbsd-x64": "7.0.2", + "@typescript/typescript-sunos-x64": "7.0.2", + "@typescript/typescript-win32-arm64": "7.0.2", + "@typescript/typescript-win32-x64": "7.0.2" } }, "node_modules/uc.micro": { @@ -4407,9 +4426,9 @@ } }, "node_modules/undici-types": { - "version": "7.19.2", - "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.19.2.tgz", - "integrity": "sha512-qYVnV5OEm2AW8cJMCpdV20CDyaN3g0AjDlOGf1OW4iaDEx8MwdtChUp4zu4H0VP3nDRF/8RKWH+IPp9uW0YGZg==", + "version": "8.3.0", + "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.3.0.tgz", + "integrity": "sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==", "dev": true, "license": "MIT" }, diff --git a/package.json b/package.json index 94243ee..c8411b2 100644 --- a/package.json +++ b/package.json @@ -4,6 +4,9 @@ "description": "Remove signs of AI-generated writing from text.", "private": true, "type": "module", + "engines": { + "node": ">=24" + }, "scripts": { "evaluate": "node scripts/run-evaluations.js", "conductor:reconcile": "node scripts/reconcile-conductor-github.js", @@ -49,17 +52,17 @@ "author": "", "license": "MIT", "devDependencies": { - "@types/node": "^25.6.0", - "eslint": "^10.2.1", + "@types/node": "^26.1.2", + "eslint": "^10.8.0", "eslint-config-prettier": "^10.1.8", "eslint-plugin-import": "^2.32.0", "eslint-plugin-node": "^11.1.0", "husky": "^9.1.7", - "js-yaml": "^4.3.0", - "lint-staged": "^16.4.0", - "markdownlint-cli": "^0.48.0", - "prettier": "^3.8.3", - "typescript": "^6.0.3", + "js-yaml": "^5.2.2", + "lint-staged": "^17.3.0", + "markdownlint-cli": "^0.49.1", + "prettier": "^3.9.6", + "typescript": "^7.0.2", "yaml": "^2.9.0" } } diff --git a/test/workflow-integrity.test.js b/test/workflow-integrity.test.js index 72b829b..16ace69 100644 --- a/test/workflow-integrity.test.js +++ b/test/workflow-integrity.test.js @@ -87,6 +87,20 @@ test('composite action dependencies are commit-pinned', () => { }); }); +test('maintained automation and tooling require Node.js 24 or newer', () => { + const packageJson = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf8')); + assert.equal(packageJson.engines?.node, '>=24', 'package engines should declare Node.js 24'); + + const actionPath = path.join(ROOT, '.github', 'actions', 'setup-maintainer-env', 'action.yml'); + const action = parseYaml(fs.readFileSync(actionPath, 'utf8')); + assert.equal(action.inputs?.['node-version']?.default, '24'); + + for (const file of WORKFLOW_FILES) { + const source = fs.readFileSync(path.join(WORKFLOW_DIR, file), 'utf8'); + assert.doesNotMatch(source, /node-version:\s*['"]?20['"]?/, `${file} must not select Node 20`); + } +}); + test('Vale archives are extracted outside the checked-out repository', () => { const actionPath = path.join(ROOT, '.github', 'actions', 'setup-maintainer-env', 'action.yml'); const source = fs.readFileSync(actionPath, 'utf8'); From f64d2a642edd10dbe11d75017ca779ae7c9f6ae9 Mon Sep 17 00:00:00 2001 From: "Dylan Mordaunt (ISLHD)" Date: Sat, 1 Aug 2026 15:33:10 +1000 Subject: [PATCH 4/6] test: add native coverage evidence and floors --- .github/workflows/ci.yml | 10 +++ .gitignore | 1 + .../plan.md | 12 ++-- .../quality-evidence.md | 52 ++++++++++++++++ package.json | 1 + scripts/run-coverage.js | 61 +++++++++++++++++++ test/coverage-runner.test.js | 25 ++++++++ 7 files changed, 156 insertions(+), 6 deletions(-) create mode 100644 conductor/tracks/post-release-security-quality-frontier_20260801/quality-evidence.md create mode 100644 scripts/run-coverage.js create mode 100644 test/coverage-runner.test.js diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8dcc5f9..aedf46f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -33,5 +33,15 @@ jobs: - name: Run Node tests run: npm test + - name: Generate Node coverage evidence + run: npm run test:coverage + + - name: Upload coverage evidence + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + with: + name: node-coverage + path: coverage/ + if-no-files-found: error + - name: Verify sync outputs run: npm run check:sync diff --git a/.gitignore b/.gitignore index 4136ef2..e319d2c 100644 --- a/.gitignore +++ b/.gitignore @@ -9,6 +9,7 @@ htmlcov/ # Node / JS node_modules/ +coverage/ npm-debug.log* yarn-debug.log* yarn-error.log* diff --git a/conductor/tracks/post-release-security-quality-frontier_20260801/plan.md b/conductor/tracks/post-release-security-quality-frontier_20260801/plan.md index 956b2df..756c7f3 100644 --- a/conductor/tracks/post-release-security-quality-frontier_20260801/plan.md +++ b/conductor/tracks/post-release-security-quality-frontier_20260801/plan.md @@ -25,15 +25,15 @@ evidence. Each phase is mirrored by a native GitHub subissue. ## Phase 2: Measured quality frontier -- [ ] Inventory existing property, contract, behavioral, and integration tests. +- [x] Inventory existing property, contract, behavioral, and integration tests. (M-007, S-002, S-003, C-003) -- [ ] Add a failing test for deterministic machine-readable coverage output. -- [ ] Implement Node-native coverage across the real aggregate test corpus. +- [x] Add a failing test for deterministic machine-readable coverage output. +- [x] Implement Node-native coverage across the real aggregate test corpus. (M-007) -- [ ] Extend property tests where current invariant coverage is weak. (S-003) -- [ ] Evaluate mutation tooling against maintained JavaScript and record a +- [x] Extend property tests where current invariant coverage is weak. (S-003) +- [x] Evaluate mutation tooling against maintained JavaScript and record a bounded adopt/exclude decision. (S-002, C-004) -- [ ] Upload a quality summary artifact; add Codecov OIDC only if hosted setup +- [x] Upload a quality summary artifact; add Codecov OIDC only if hosted setup is verified. (S-005, C-002) - [ ] Phase verification and checkpoint per `conductor/workflow.md`. diff --git a/conductor/tracks/post-release-security-quality-frontier_20260801/quality-evidence.md b/conductor/tracks/post-release-security-quality-frontier_20260801/quality-evidence.md new file mode 100644 index 0000000..6de2cfb --- /dev/null +++ b/conductor/tracks/post-release-security-quality-frontier_20260801/quality-evidence.md @@ -0,0 +1,52 @@ +# Phase 2 Quality Evidence + +Date: 2026-08-01 + +## Test inventory + +The maintained suite contains contract tests for Agent Skills and host overlays, +behavioral trigger/output evaluations, golden and taxonomy fixtures, deterministic +generation and reconciliation tests, workflow integrity checks, upstream triage, +integration checks, and generated mixed-input literal-preservation properties. + +The aggregate Node suite exercises 19 test files after adding the coverage +contract. Python-era compatibility checks remain in the integration runner, but +the maintained implementation and quality tooling are Node-based. + +## Coverage baseline + +`npm run test:coverage` uses Node 24's native test coverage, writes LCOV and a +stable JSON summary under the ignored `coverage/` directory, and fails below +these non-regression floors: + +- lines: 75% +- functions: 80% +- branches: 60% + +Observed baseline on 2026-08-01: + +- 8 maintained script files +- lines: 511/658 (77.66%) +- functions: 30/36 (83.33%) +- branches: 70/107 (65.42%) + +CI uploads the LCOV and JSON files as the `node-coverage` artifact. + +## Property and mutation decision + +Literal preservation already has generated mixed-input property coverage and a +fail-closed placeholder corruption case. The remaining tools primarily compile, +validate, reconcile, or render repository files, for which their existing +contract and fixture tests provide clearer failure evidence than additional +random generators. + +Mutation tooling is not adopted in this phase. The executable surface is small, +filesystem-heavy, and includes process-spawning integration scripts; introducing +a third-party mutation runtime would materially expand the dependency and +configuration surface before identifying a mutation-specific blind spot. This +decision should be revisited if maintained transformation logic grows. + +Codecov is also not enabled. Native LCOV, JSON, threshold enforcement, and a +hosted artifact provide repository-controlled evidence without an external app +or token/OIDC configuration. Codecov remains an optional future enhancement if +cross-PR trend visualization becomes worth that external dependency. diff --git a/package.json b/package.json index c8411b2..058e560 100644 --- a/package.json +++ b/package.json @@ -25,6 +25,7 @@ "typecheck": "tsc --noEmit", "lint:all": "npm run lint && npm run vale && npm run lint:js && npm run typecheck && npm run format:check", "test": "node scripts/run-node-tests.js && node scripts/run-tests.js", + "test:coverage": "node scripts/run-coverage.js", "build": "node scripts/compile-skill.js", "prepare": "node -e \"if (!process.env.CI) require('child_process').execSync('npx husky install', { stdio: 'inherit' })\"", "release": "echo 'No npm release: Authentext ships Agent Skill artifacts, not a publishable npm library'", diff --git a/scripts/run-coverage.js b/scripts/run-coverage.js new file mode 100644 index 0000000..64073a0 --- /dev/null +++ b/scripts/run-coverage.js @@ -0,0 +1,61 @@ +import fs from 'node:fs'; +import path from 'node:path'; +import { spawnSync } from 'node:child_process'; +import { fileURLToPath } from 'node:url'; + +const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..'); + +function percent(hit, found) { + return found === 0 ? 100 : Number(((hit / found) * 100).toFixed(2)); +} + +export function summarizeLcov(source) { + const totals = { LF: 0, LH: 0, FNF: 0, FNH: 0, BRF: 0, BRH: 0 }; + for (const line of source.split(/\r?\n/)) { + const match = /^(LF|LH|FNF|FNH|BRF|BRH):(\d+)$/.exec(line); + if (match) totals[match[1]] += Number(match[2]); + } + + return { + schemaVersion: 1, + files: (source.match(/^SF:/gm) ?? []).length, + lines: { found: totals.LF, hit: totals.LH, percent: percent(totals.LH, totals.LF) }, + functions: { found: totals.FNF, hit: totals.FNH, percent: percent(totals.FNH, totals.FNF) }, + branches: { found: totals.BRF, hit: totals.BRH, percent: percent(totals.BRH, totals.BRF) }, + }; +} + +function main() { + const testFiles = fs + .readdirSync(path.join(ROOT, 'test')) + .filter((file) => file.endsWith('.test.js')) + .sort() + .map((file) => path.join('test', file)); + const result = spawnSync( + process.execPath, + [ + '--test', + '--experimental-test-coverage', + '--test-coverage-include=scripts/**/*.js', + '--test-coverage-lines=75', + '--test-coverage-functions=80', + '--test-coverage-branches=60', + '--test-reporter=lcov', + ...testFiles, + ], + { cwd: ROOT, encoding: 'utf8' } + ); + if (result.status !== 0) { + process.stderr.write(result.stderr || result.stdout); + process.exit(result.status ?? 1); + } + + const outputDir = path.join(ROOT, 'coverage'); + fs.mkdirSync(outputDir, { recursive: true }); + fs.writeFileSync(path.join(outputDir, 'lcov.info'), result.stdout); + const summary = summarizeLcov(result.stdout); + fs.writeFileSync(path.join(outputDir, 'summary.json'), `${JSON.stringify(summary, null, 2)}\n`); + process.stdout.write(`${JSON.stringify(summary)}\n`); +} + +if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) main(); diff --git a/test/coverage-runner.test.js b/test/coverage-runner.test.js new file mode 100644 index 0000000..c55f31d --- /dev/null +++ b/test/coverage-runner.test.js @@ -0,0 +1,25 @@ +import test from 'node:test'; +import assert from 'node:assert/strict'; +import { summarizeLcov } from '../scripts/run-coverage.js'; + +test('LCOV summaries are deterministic and machine-readable', () => { + const lcov = [ + 'TN:', + 'SF:a.js', + 'FNF:2', + 'FNH:1', + 'BRF:4', + 'BRH:3', + 'LF:10', + 'LH:8', + 'end_of_record', + '', + ].join('\n'); + assert.deepEqual(summarizeLcov(lcov), { + schemaVersion: 1, + files: 1, + lines: { found: 10, hit: 8, percent: 80 }, + functions: { found: 2, hit: 1, percent: 50 }, + branches: { found: 4, hit: 3, percent: 75 }, + }); +}); From 772422b99b20fbcd687bdf43649251a1ff04eb4d Mon Sep 17 00:00:00 2001 From: "Dylan Mordaunt (ISLHD)" Date: Sat, 1 Aug 2026 15:37:22 +1000 Subject: [PATCH 5/6] chore: harden solo-maintainer contribution controls --- .github/CODEOWNERS | 7 -- .github/ISSUE_TEMPLATE/bug_report.yml | 27 ++++++ .github/ISSUE_TEMPLATE/config.yml | 5 ++ .github/ISSUE_TEMPLATE/feature_request.yml | 24 +++++ .github/PULL_REQUEST_TEMPLATE.md | 16 ++++ CONTRIBUTING.md | 37 +++++--- SECURITY.md | 87 ++++--------------- .../plan.md | 12 +-- .../security-evidence.md | 32 +++++++ test/workflow-integrity.test.js | 17 ++++ 10 files changed, 170 insertions(+), 94 deletions(-) delete mode 100644 .github/CODEOWNERS create mode 100644 .github/ISSUE_TEMPLATE/bug_report.yml create mode 100644 .github/ISSUE_TEMPLATE/config.yml create mode 100644 .github/ISSUE_TEMPLATE/feature_request.yml create mode 100644 .github/PULL_REQUEST_TEMPLATE.md create mode 100644 conductor/tracks/post-release-security-quality-frontier_20260801/security-evidence.md diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS deleted file mode 100644 index 4bd326a..0000000 --- a/.github/CODEOWNERS +++ /dev/null @@ -1,7 +0,0 @@ -# Default maintainer ownership for a single-maintainer skill-source repo. -* @edithatogo - -# Workflow and automation changes should stay visible to the maintainer. -.github/ @edithatogo -scripts/ @edithatogo -conductor/ @edithatogo diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml new file mode 100644 index 0000000..fd91365 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -0,0 +1,27 @@ +name: Bug report +description: Report a reproducible problem in the maintained Authentext skill surface. +title: '[Bug] ' +labels: [bug] +body: + - type: markdown + attributes: + value: Do not report security vulnerabilities here; use private vulnerability reporting. + - type: textarea + id: problem + attributes: + label: Problem + description: What happened, and what did you expect? + validations: + required: true + - type: textarea + id: reproduction + attributes: + label: Reproduction + description: Include the smallest safe input, command, and revision that reproduce the issue. + validations: + required: true + - type: textarea + id: evidence + attributes: + label: Evidence + description: Include relevant validation output without secrets or sensitive text. diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 0000000..442dc91 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -0,0 +1,5 @@ +blank_issues_enabled: false +contact_links: + - name: Report a security vulnerability + url: https://github.com/edithatogo/authentext/security/advisories/new + about: Use private vulnerability reporting instead of a public issue. diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml new file mode 100644 index 0000000..c3220e1 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature_request.yml @@ -0,0 +1,24 @@ +name: Feature request +description: Propose an evidence-based improvement to the maintained skill contract. +title: '[Feature] ' +labels: [enhancement] +body: + - type: textarea + id: need + attributes: + label: User need + description: What concrete task or failure mode should this address? + validations: + required: true + - type: textarea + id: outcome + attributes: + label: Proposed outcome + description: Describe observable behavior, not only an implementation. + validations: + required: true + - type: textarea + id: evidence + attributes: + label: Evidence and compatibility + description: Link examples or standards and note portable versus host-specific impact. diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md new file mode 100644 index 0000000..6583215 --- /dev/null +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -0,0 +1,16 @@ +## Outcome + + + +## Evidence + + + +- [ ] Generated outputs are synchronized where applicable. +- [ ] Validation, lint, tests, and audit appropriate to this change pass. +- [ ] Technical literals, URLs, paths, identifiers, and code remain intact. +- [ ] No release, publication, credential, or external-service action is implied. + +## Scope + + diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 3a72d96..38e2b79 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -1,21 +1,36 @@ # Contributing to Authentext -Thanks for contributing! Please run local validation before opening a PR to reduce CI noise. +Authentext is an Agent Skills source repository. Changes should stay within the +maintained surface described in `AGENTS.md`; `experiments/` and archived +Conductor tracks are not supported runtime targets. -Recommended steps: +## Development baseline + +Use Node.js 24 or newer, then install the locked dependencies: ```bash -# Ensure build outputs are up to date -npm install -npm run sync +npm ci +``` -# Run skill validation (Skillshare dry-run + optional AIX validation) -./scripts/validate-skill.sh +Before opening a pull request, run: + +```bash +npm run sync +npm run validate +npm run validate:hosts +npm run lint:all +npm test +npm run test:coverage +npm audit --audit-level=moderate ``` -If CI fails on the skill distribution job, inspect the job logs and run the same commands locally. The job may fail due to: +Generated `SKILL.md`, `SKILL_PROFESSIONAL.md`, references, and root manifests +must be produced with `npm run sync`, not edited independently of their canonical +`src/` fragments. -- A new `SKILL.md` formatting issue -- Tooling changes in Skillshare/AIX +## Pull requests -If you need help, open an issue referencing the failing workflow and include the workflow logs. +Keep changes focused, explain the user-facing or maintenance outcome, and attach +the commands or hosted runs that support the claim. Automated checks and +self-review are the merge gates for this solo-maintainer repository; no second +reviewer, team assignment, or CODEOWNERS approval is required. diff --git a/SECURITY.md b/SECURITY.md index e65b25b..2563ebd 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,78 +1,25 @@ # Security Policy -## Reporting a Vulnerability +## Supported versions -We take the security of Authentext seriously. If you believe you've found a security vulnerability, please follow these guidelines: +Security fixes target the latest tagged release and the current `main` branch. +Older releases are not maintained unless a notice says otherwise. -### How to Report +## Reporting a vulnerability -**Preferred Method:** Use GitHub's private vulnerability reporting feature: +Do not disclose a suspected vulnerability in a public issue. Use GitHub's +[private vulnerability report](https://github.com/edithatogo/authentext/security/advisories/new) +with reproduction steps, affected versions or revisions, likely impact, and any +suggested mitigation. -1. Go to the [Security tab](https://github.com/edithatogo/authentext-next/security) -2. Click "Report a vulnerability" -3. Provide details about the vulnerability +Reports are acknowledged as maintainer availability permits. Response and +resolution times depend on validated severity and are not guaranteed service +levels. Coordinated disclosure and responsible research are welcome; do not +access other people's data, degrade services, or test outside systems you own or +are authorized to assess. -**Alternative Method:** If you cannot use GitHub's feature, you may create an issue with the `[security]` label prefix, but note that this will be publicly visible. +## Scope -### What to Include - -Please provide as much information as possible: - -- Description of the vulnerability -- Steps to reproduce -- Affected versions -- Potential impact -- Any suggested fixes (optional) - -### Response Timeline - -- **Initial Response:** Within 48 hours -- **Status Update:** Within 5 business days -- **Resolution Target:** Depends on severity (see below) - -### Severity Levels - -| Severity | Response Time | Resolution Target | -| :--- | :--- | :--- | -| Critical | 24 hours | 7 days | -| High | 48 hours | 14 days | -| Medium | 5 days | 30 days | -| Low | 10 days | Next release | - -### What to Expect - -1. **Acknowledgment:** We'll confirm receipt of your report within 48 hours -2. **Assessment:** Our team will evaluate the vulnerability and determine severity -3. **Communication:** We'll keep you informed of our progress -4. **Resolution:** Once fixed, we'll notify you and optionally credit you (with your permission) - -### Supported Versions - -| Version | Supported | -|---------|-----------| -| 2.3.x | ✅ Yes | -| 2.2.x | ✅ Yes | -| < 2.2 | ❌ No | - -### Security Best Practices for Users - -While we work to keep Authentext secure, please also follow these best practices: - -1. **Keep Updated:** Always use the latest version -2. **Review Permissions:** Only grant necessary tool access -3. **Validate Input:** Be cautious with untrusted text input -4. **Report Issues:** Don't hesitate to report potential vulnerabilities - -### Security Research - -We welcome responsible security research. If you're conducting security research on Authentext: - -- Please coordinate with us first -- Avoid testing on production systems -- Respect user privacy and data - ---- - -**Last Updated:** 2026-03-03 - -**Contact:** For security questions, please use the vulnerability reporting system above. +The supported contract is the maintained repository surface described in +`AGENTS.md`. Archived Conductor history, `experiments/`, third-party clients, and +downstream copies are outside the supported security boundary. diff --git a/conductor/tracks/post-release-security-quality-frontier_20260801/plan.md b/conductor/tracks/post-release-security-quality-frontier_20260801/plan.md index 756c7f3..bc35477 100644 --- a/conductor/tracks/post-release-security-quality-frontier_20260801/plan.md +++ b/conductor/tracks/post-release-security-quality-frontier_20260801/plan.md @@ -39,15 +39,15 @@ evidence. Each phase is mirrored by a native GitHub subissue. ## Phase 3: Solo-maintainer security controls -- [ ] Inventory current rulesets, automation actors, templates, and security +- [x] Inventory current rulesets, automation actors, templates, and security context. (M-009, S-004) -- [ ] Add failing validation for warranted repository-owned context files. -- [ ] Add missing contribution/issue/PR context without legacy installer claims. +- [x] Add failing validation for warranted repository-owned context files. +- [x] Add missing contribution/issue/PR context without legacy installer claims. (S-004) -- [ ] Implement the least restrictive ruleset that blocks destructive pushes +- [x] Implement the least restrictive ruleset that blocks destructive pushes and requires stable automated checks without human approvals. (M-010) -- [ ] Verify hosted ruleset behavior and owner recovery. -- [ ] Verify Renovate access before any Dependabot removal; otherwise retain +- [x] Verify hosted ruleset behavior and owner recovery. +- [x] Verify Renovate access before any Dependabot removal; otherwise retain Dependabot and record the external gate. (M-011, S-006) - [ ] Phase verification and checkpoint per `conductor/workflow.md`. diff --git a/conductor/tracks/post-release-security-quality-frontier_20260801/security-evidence.md b/conductor/tracks/post-release-security-quality-frontier_20260801/security-evidence.md new file mode 100644 index 0000000..e8adffb --- /dev/null +++ b/conductor/tracks/post-release-security-quality-frontier_20260801/security-evidence.md @@ -0,0 +1,32 @@ +# Phase 3 Security Evidence + +Date: 2026-08-01 + +## Repository context + +- Private vulnerability reporting is enabled. +- `SECURITY.md` now points to the current repository's private advisory form and + states the supported surface without unsupported response promises. +- Contribution, pull request, bug, and feature context reflects the Node 24 + validation path and portable skill boundary. +- CODEOWNERS was removed because a mandatory or implied second-reviewer gate is + inappropriate for this solo-maintainer repository. + +## Hosted controls + +Default GitHub Actions permissions are now read-only and workflows cannot approve +pull requests. Individual jobs continue to declare narrower or explicitly +warranted permissions. + +Active ruleset `20171596` (`Authentext main safeguards`) targets the default +branch and blocks branch deletion and non-fast-forward pushes. It requires +up-to-date `test`, `actionlint`, and `portable-spec` checks. Repository +administrators retain an explicit recovery bypass; no review count, team, +CODEOWNERS, or human approval is required. + +## Dependency automation gate + +`renovate.json` exists, but the current GitHub credential cannot enumerate app +installations (`403` requires a GitHub App-authorized token). Renovate access is +therefore unverified. Dependabot remains enabled and must not be removed until a +hosted Renovate run proves repository access and update behavior. diff --git a/test/workflow-integrity.test.js b/test/workflow-integrity.test.js index 16ace69..f1a17e1 100644 --- a/test/workflow-integrity.test.js +++ b/test/workflow-integrity.test.js @@ -151,3 +151,20 @@ test('release workflow packages only maintained, existing paths', () => { assert.doesNotMatch(source, /docs\/install-matrix\.md/); assert.doesNotMatch(source, /humanizer-next/); }); + +test('solo-maintainer contribution context is current and reviewer-neutral', () => { + for (const file of [ + 'CONTRIBUTING.md', + 'SECURITY.md', + '.github/PULL_REQUEST_TEMPLATE.md', + '.github/ISSUE_TEMPLATE/bug_report.yml', + '.github/ISSUE_TEMPLATE/feature_request.yml', + '.github/ISSUE_TEMPLATE/config.yml', + ]) { + assert.ok(fs.existsSync(path.join(ROOT, file)), `missing repository context: ${file}`); + } + assert.equal(fs.existsSync(path.join(ROOT, '.github', 'CODEOWNERS')), false); + const security = fs.readFileSync(path.join(ROOT, 'SECURITY.md'), 'utf8'); + assert.match(security, /edithatogo\/authentext\/security\/advisories\/new/); + assert.doesNotMatch(security, /authentext-next/); +}); From 90ada42e965bad9233bd4151a0b75f265e3c2177 Mon Sep 17 00:00:00 2001 From: "Dylan Mordaunt (ISLHD)" Date: Sat, 1 Aug 2026 15:39:33 +1000 Subject: [PATCH 6/6] docs(conductor): reconcile frontier backlog and hosted map --- conductor/github-mapping.json | 2 +- .../backlog-evidence.md | 19 +++++++++++++++++++ .../plan.md | 12 ++++++------ 3 files changed, 26 insertions(+), 7 deletions(-) create mode 100644 conductor/tracks/post-release-security-quality-frontier_20260801/backlog-evidence.md diff --git a/conductor/github-mapping.json b/conductor/github-mapping.json index 013d98a..3851590 100644 --- a/conductor/github-mapping.json +++ b/conductor/github-mapping.json @@ -1,6 +1,6 @@ { "schema_version": 1, - "generated_at": "2026-08-01T05:25:00.000Z", + "generated_at": "2026-08-01T05:38:31.622Z", "repository": "edithatogo/authentext", "project": { "number": 36, diff --git a/conductor/tracks/post-release-security-quality-frontier_20260801/backlog-evidence.md b/conductor/tracks/post-release-security-quality-frontier_20260801/backlog-evidence.md new file mode 100644 index 0000000..c260b63 --- /dev/null +++ b/conductor/tracks/post-release-security-quality-frontier_20260801/backlog-evidence.md @@ -0,0 +1,19 @@ +# Phase 4 Backlog Evidence + +Date: 2026-08-01 + +- Issue #54 remains open until PR #230 merges and the default branch proves zero + audit findings. Its former MCP install claim is outside the current supported + surface. +- Issue #57 received the current anchor: track #224, phases #225-#229, 31 mapped + tracks, 128 phases, and 159/159 Project nodes. +- Issue #58 was closed after confirming current runtime, package, CI, and release + surfaces are Authentext-only. The orphaned installer is explicitly frozen + historical evidence, not a supported consumer path. +- Issue #59 was closed after verifying the shared code-scanning gate is present, + commit-pinned, and follows the pinned CodeQL analysis steps. +- Issue #61 remains open and separate because FOI-O semantic/citation evidence + and editorial publication approval are product/human gates, not repository + maintenance work. +- Live deterministic reconciliation found no missing issues, Project items, + native subissue relationships, or state changes across 159 mapped nodes. diff --git a/conductor/tracks/post-release-security-quality-frontier_20260801/plan.md b/conductor/tracks/post-release-security-quality-frontier_20260801/plan.md index bc35477..8f4c4a1 100644 --- a/conductor/tracks/post-release-security-quality-frontier_20260801/plan.md +++ b/conductor/tracks/post-release-security-quality-frontier_20260801/plan.md @@ -53,13 +53,13 @@ evidence. Each phase is mirrored by a native GitHub subissue. ## Phase 4: Backlog, roadmap, and GitHub reconciliation -- [ ] Reconcile issue #54 against the final audit and install-surface contract. -- [ ] Reconcile issues #57–#59 against merged files, tests, and hosted runs. +- [~] Reconcile issue #54 against the final audit and install-surface contract. +- [x] Reconcile issues #57–#59 against merged files, tests, and hosted runs. (M-012) -- [ ] Keep or route issue #61 based on its product-scope evidence. -- [ ] Rewrite `conductor/roadmap.md` for the post-3.2.0 frontier. (S-007) -- [ ] Verify native issue/subissue hierarchy and Project 36 fields. (M-013) -- [ ] Refresh the deterministic GitHub mapping receipt. +- [x] Keep or route issue #61 based on its product-scope evidence. +- [x] Rewrite `conductor/roadmap.md` for the post-3.2.0 frontier. (S-007) +- [x] Verify native issue/subissue hierarchy and Project 36 fields. (M-013) +- [x] Refresh the deterministic GitHub mapping receipt. - [ ] Phase verification and checkpoint per `conductor/workflow.md`. ## Phase 5: Final verification and governed handoff