diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md new file mode 100644 index 0000000..a8fce61 --- /dev/null +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -0,0 +1,29 @@ +## Summary + + + +## Why + + + +## Behavior + + + +## Validation + + + +- [ ] `cargo fmt --check` +- [ ] `cargo test --locked` +- [ ] `cargo clippy --locked --all-targets -- -D warnings` +- [ ] `cargo build --locked` + +## Checklist + +- [ ] The change is focused and targets `wavefnd/Vex:master`. +- [ ] User-facing behavior and recovery instructions are documented. +- [ ] Dependency changes preserve lockfile reproducibility. +- [ ] `--locked` and `--offline` behavior remains correct. +- [ ] No raw `wavec` flags were added to the Vex CLI. +- [ ] New commits include a DCO `Signed-off-by:` line. diff --git a/.gitignore b/.gitignore index cb676eb..90998cf 100644 --- a/.gitignore +++ b/.gitignore @@ -44,6 +44,7 @@ desktop.ini *.old *.orig *.rej +/.tmp/ /tmp/ /temp/ diff --git a/.mailmap b/.mailmap new file mode 100644 index 0000000..b5d8a77 --- /dev/null +++ b/.mailmap @@ -0,0 +1,2 @@ +LunaStev +LunaStev <96914208+LunaStev@users.noreply.github.com> diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..aceed5b --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,84 @@ +# Contributor Covenant Code of Conduct + +## Our pledge + +We as members, contributors, and leaders pledge to make participation in the +Vex community harassment-free for everyone, regardless of age, body size, +visible or invisible disability, ethnicity, sex characteristics, gender +identity and expression, level of experience, education, socio-economic +status, nationality, personal appearance, race, caste, color, religion, or +sexual identity and orientation. + +We pledge to act and interact in ways that contribute to an open, welcoming, +diverse, inclusive, and healthy community. + +## Our standards + +Positive behavior includes: + +- demonstrating empathy and kindness +- respecting different opinions, viewpoints, and experiences +- giving and accepting constructive feedback +- accepting responsibility, apologizing, and learning from mistakes +- focusing on what is best for the community as a whole + +Unacceptable behavior includes: + +- sexualized language or imagery and sexual attention or advances +- trolling, insulting or derogatory comments, and personal or political attacks +- public or private harassment +- publishing another person's private information without explicit permission +- other behavior reasonably considered inappropriate in a professional setting + +## Enforcement responsibilities + +Community leaders are responsible for clarifying and enforcing these standards. +They will take appropriate and fair corrective action in response to behavior +they consider inappropriate, threatening, offensive, or harmful. + +Community leaders may remove, edit, or reject comments, commits, code, issues, +and other contributions that do not align with this Code of Conduct. When +appropriate, they will communicate the reason for moderation decisions. + +## Scope + +This Code of Conduct applies in all Vex community spaces and when an individual +officially represents the project in public, including through official email, +social accounts, or online and offline events. + +## Reporting and enforcement + +Report abusive, harassing, or otherwise unacceptable behavior privately to +`luna@lunastev.org` with the subject `[Vex Conduct]`. Reports will be reviewed +promptly and fairly. Community leaders must protect the privacy and security of +reporters. + +Community leaders will use the following impact guidelines: + +### 1. Correction + +For isolated inappropriate or unprofessional behavior, a private written +warning may explain the impact and request a correction or apology. + +### 2. Warning + +For a violation through a single incident or series of actions, a warning may +set consequences and a period during which interaction with affected people or +enforcers is prohibited. + +### 3. Temporary ban + +For a serious or sustained violation, participation and public or private +interaction in project spaces may be prohibited for a defined period. + +### 4. Permanent ban + +For a pattern of violations, harassment, aggression, or disparagement of groups, +an individual may be permanently removed from project spaces. + +## Attribution + +This Code of Conduct is adapted from the +[Contributor Covenant, version 2.1](https://www.contributor-covenant.org/version/2/1/code_of_conduct/). +Its Community Impact Guidelines were inspired by Mozilla's code of conduct +enforcement ladder. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..3627df7 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,133 @@ +# Contributing to Vex + +Thank you for helping improve Vex, the package manager and build tool for the +Wave programming language. Vex accepts focused contributions through GitHub +pull requests and email patches. + +## Project direction + +Vex is not a raw command-line wrapper around `wavec`. It owns the Wave project +manifest, dependency resolution, the lockfile, and compiler orchestration. +Changes should preserve these rules: + +- `vex.ws` is the supported project manifest. +- `wavec` is an internal compiler dependency, not a source of Vex CLI flags. +- Git and path dependencies are the current package sources; a central registry + and publishing are outside the current scope. +- The same manifest and lockfile must produce the same dependency graph. +- `--locked` must prevent lockfile changes. +- `--offline` must prevent Git network access. +- Errors and progress should explain what Vex is doing and how users can recover. + +Please open an issue before beginning a large change that alters these product +boundaries or a persistent file format. + +## Development setup + +You need: + +- a stable Rust toolchain with `rustfmt` and `clippy` +- Git for dependency integration tests +- a compatible `wavec` in `PATH` for end-to-end build and run tests + +Set `VEX_WAVEC=/path/to/wavec` when testing a specific compiler binary. + +Clone your fork and run the baseline checks: + +```sh +cargo fmt --check +cargo test --locked +cargo clippy --locked --all-targets -- -D warnings +cargo build --locked +``` + +## Making a change + +Create a branch from the current `wavefnd/Vex:master`. Use `feat/` for +features and `patch/` for fixes. Keep each branch focused on one logical +change. + +```sh +git switch -c feat/example +``` + +Do not overwrite unrelated working-tree changes. Do not commit build output, +managed dependencies under `.vex/`, local release notes under `.tmp/`, secrets, +or editor state. + +## Tests + +Add tests at the same level as the behavior being changed: + +- parser and policy details belong in unit tests +- dependency graph and Git behavior belong in integration tests +- compiler invocation changes require dry-run schema and end-to-end smoke tests + +Git integration tests must use local fixture repositories and must not require +external network access. Dependency changes should cover direct and transitive +graphs, exact locked commits, cycles, source/version/name conflicts, and relevant +`--locked` and `--offline` behavior. + +When changing selective update behavior, prove that unrelated locked commits and +remote-tracking refs remain unchanged. + +## Pull requests + +Push your branch to a fork and open a pull request against +`wavefnd/Vex:master`. A pull request should contain: + +- a concise Summary +- Why the change is needed +- observable Behavior and compatibility impact +- Validation commands and results +- documentation updates for user-facing behavior + +Draft pull requests are welcome for early review. Keep commits understandable +and avoid mixing cleanup with functional changes. + +## Email patches + +Email patches are accepted when GitHub is not suitable. Send them to +`luna@lunastev.org` with a subject beginning `[Vex PATCH]`. + +```sh +git commit -s +git format-patch --cover-letter -1 +git send-email --to luna@lunastev.org *.patch +``` + +Use `[Vex PATCH 0/N]` for a multi-patch series. Each patch should build on the +previous one, explain its purpose in the commit message, and address one logical +change. Do not send security vulnerabilities through a public mailing list or +public issue; follow [SECURITY.md](SECURITY.md). + +## Developer Certificate of Origin + +New contributions must include a `Signed-off-by:` line certifying the +[Developer Certificate of Origin 1.1](https://developercertificate.org/). +Create it with: + +```sh +git commit -s +``` + +By signing off, you certify that you have the right to submit the contribution +under the project's license. + +## Documentation and compatibility + +Public command syntax, lockfile behavior, environment variables, supported +platforms, and recovery instructions must be documented. A lockfile format +change needs an explicit compatibility and migration plan; silently reinterpreting +an existing lockfile is not acceptable. + +Use clear English for code, public identifiers, commit messages, and canonical +project documentation. Translations may be added alongside the canonical text. + +## Conduct and licensing + +Participation is governed by the [Code of Conduct](CODE_OF_CONDUCT.md). +Security reports follow [SECURITY.md](SECURITY.md). + +Unless a file says otherwise, contributions are licensed under the +[Mozilla Public License 2.0](LICENSE). diff --git a/COPYRIGHT b/COPYRIGHT new file mode 100644 index 0000000..57bcb8e --- /dev/null +++ b/COPYRIGHT @@ -0,0 +1,13 @@ +Vex Package Manager - Copyright Information +=========================================== + +Copyright (c) 2025-2026 Wave Foundation +Copyright (c) 2025-2026 LunaStev and contributors + +Vex was initially authored by LunaStev and is maintained as part of the Wave +language project. The Git history and repository contributor list provide the +authoritative record of individual contributions. + +Copyright ownership of an individual contribution remains with its copyright +holder unless separately assigned. Unless a file states otherwise, Vex source +code and documentation are distributed under the Mozilla Public License 2.0. diff --git a/LICENSE b/LICENSE index 1aa1964..a612ad9 100644 --- a/LICENSE +++ b/LICENSE @@ -1,6 +1,5 @@ Mozilla Public License Version 2.0 ================================== -LunaStev. Wave Project 1. Definitions -------------- diff --git a/MAINTAINERS b/MAINTAINERS new file mode 100644 index 0000000..e27dd16 --- /dev/null +++ b/MAINTAINERS @@ -0,0 +1,39 @@ +[CLI and Commands] +M: LunaStev +F: src/main.rs +F: src/commands/ +F: src/ui.rs + +[Manifest and Lockfile] +M: LunaStev +F: src/manifest.rs +F: src/lockfile.rs + +[Dependency Resolution and Git] +M: LunaStev +F: src/resolver.rs +F: tests/git_*.rs + +[wavec Integration] +M: LunaStev +F: src/wavec.rs +F: src/validate.rs +F: src/commands/build.rs +F: src/commands/check.rs +F: src/commands/run.rs + +[Release and CI] +M: LunaStev +F: .github/ +F: Cargo.toml +F: Cargo.lock +F: Makefile +F: x.py + +[Documentation and Community] +M: LunaStev +F: *.md +F: MAINTAINERS +F: COPYRIGHT +F: NOTICE +F: ai.txt diff --git a/NOTICE b/NOTICE new file mode 100644 index 0000000..489a6b2 --- /dev/null +++ b/NOTICE @@ -0,0 +1,19 @@ +Vex Package Manager +=================== + +Vex is the package manager and build tool for the Wave programming language. + +Copyright (c) 2025-2026 Wave Foundation +Copyright (c) 2025-2026 LunaStev and contributors + +Unless a file states otherwise, Vex is licensed under the Mozilla Public +License 2.0. See LICENSE for the complete license text and COPYRIGHT for project +copyright information. + +Vex invokes the separately distributed `wavec` compiler. The Vex source and +release archives do not grant additional rights to `wavec`, Wave packages, or +third-party dependencies; those works remain subject to their respective +licenses. + +Source code for this release is available from: +https://github.com/wavefnd/Vex diff --git a/README.md b/README.md index 9c9055d..3c68597 100644 --- a/README.md +++ b/README.md @@ -134,3 +134,13 @@ VEX_WAVEC=/opt/wave/bin/wavec vex build --dry-run ## License [MPL 2.0 LICENSE](LICENSE) + +## Community and Project Policies + +- [Contributing](CONTRIBUTING.md) +- [Code of Conduct](CODE_OF_CONDUCT.md) +- [Maintainers](MAINTAINERS) +- [Security Policy](SECURITY.md) +- [Copyright](COPYRIGHT) +- [Notice](NOTICE) +- [AI Usage Policy](ai.txt) diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..d0d0e66 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,54 @@ +# Security Policy + +## Supported versions + +Vex has not published a stable release yet. Until v0.0.1 is released, security +fixes are made on the latest `master` branch. This table will be updated when a +public release is available. + +| Version | Supported | +|---|---| +| `master` | Best effort | +| Unreleased snapshots and older commits | No | + +## Reporting a vulnerability + +Do not disclose a suspected vulnerability in a public issue, pull request, +discussion, or email list. + +Use GitHub's private vulnerability reporting for +[`wavefnd/Vex`](https://github.com/wavefnd/Vex/security/advisories/new) when the +report form is available. Otherwise email `luna@lunastev.org` with the subject +`[Vex SECURITY]` and ask to establish a private reporting channel. Do not place +exploit details in an initial unencrypted email if that would put users at risk. + +Include, when possible: + +- affected Vex version or commit +- affected operating system and architecture +- impact and attack prerequisites +- minimal reproduction steps or proof of concept +- known mitigations +- whether the issue has been disclosed elsewhere + +Maintainers will acknowledge reports on a best-effort basis, coordinate a fix +and disclosure timeline with the reporter, and credit reporters who request it +when publishing an advisory. + +## Scope + +Security-sensitive areas include dependency source validation, Git checkout +handling, lockfile integrity, path traversal, command execution, archive or +release integrity, and the boundary between Vex and `wavec`. + +Dependency confusion against a registry is currently out of scope because Vex +does not implement a central registry. Vulnerabilities in `wavec` or a third-party +Wave package should be reported to that project's maintainers unless Vex creates +or amplifies the issue. + +## Responsible disclosure + +Please allow maintainers a reasonable opportunity to investigate and release a +fix before public disclosure. Maintainers will avoid requesting unnecessary +personal information and will keep the report private until coordinated +disclosure. diff --git a/ai.txt b/ai.txt new file mode 100644 index 0000000..6e167fc --- /dev/null +++ b/ai.txt @@ -0,0 +1,40 @@ +# Vex AI Usage Policy +# Updated: 2026-08-10 + +User-agent: * +Disallow: / + +Policy: NO_AI_TRAINING_WITHOUT_PERMISSION +Scope: source code, documentation, tests, metadata, build outputs, and revision history in this repository. + +# Human reading and ordinary use of Vex under its open-source license are allowed. +# The project asks that training, fine-tuning, distillation, embedding for model +# development, dataset construction, or redistribution of repository content +# for AI/ML development receive prior written permission from the relevant +# copyright holders, except to the extent applicable licenses or law authorize +# the activity. + +Disallow-Action: crawl-for-training +Disallow-Action: scrape-for-training +Disallow-Action: dataset-construction +Disallow-Action: pretraining +Disallow-Action: finetuning +Disallow-Action: distillation +Disallow-Action: model-evaluation-for-improvement +Disallow-Action: embedding-generation-for-model-development +Disallow-Action: synthetic-data-generation-from-repository-content +Disallow-Action: redistribution-for-ai-use + +Contact: legal@wave-lang.dev + +Lang: en +Notice: Do not use this repository to train, fine-tune, distill, evaluate, or improve an AI/ML model without prior written permission from the relevant copyright holders. + +Lang: ko +Notice: 관련 저작권자의 사전 서면 허가 없이 이 저장소를 AI/ML 모델의 학습, 미세조정, 증류, 평가 또는 성능 개선에 사용하지 마십시오. + +# License clarification +# This policy does not replace, narrow, or modify the Mozilla Public License +# 2.0. Where this policy and an applicable license differ, the license controls. +# This file records the project copyright holders' policy and requested +# machine-readable crawling preference.