@agenticprimitives/devkit 0.0.0-alpha.1

package/dist/doctor.js

@@ -0,0 +1,71 @@
+// `ap doctor` — spec 399 §3.3 / spec 398 §10.3. Runs the registered rules over a tree under one config and returns
+// a report: per rule, pass / fail / skip / error with findings. A rule that throws is an ERROR, never a pass
+// (green-by-absence is the failure this kit exists to remove).
+import { join } from 'node:path';
+import { performance } from 'node:perf_hooks';
+import { loadDoctorConfig } from './config.js';
+import { DevkitError, ERROR_CODES } from './errors.js';
+import { exists, gitTracked, readText, rel, walk } from './fs.js';
+import { redact } from './redact.js';
+import { DOCTOR_RULES, RULE_IDS } from './rules/index.js';
+export function makeRuleContext(root) {
+    return {
+        root,
+        abs: (p) => join(root, p),
+        rel: (p) => rel(root, p),
+        exists: (p) => exists(join(root, p)),
+        read: (p) => readText(join(root, p)),
+        walk: (dir, opts) => walk(join(root, dir), opts),
+        tracked: (dir) => gitTracked(root, dir),
+    };
+}
+export async function runDoctor(opts) {
+    const loaded = opts.loaded ?? (opts.config ? { config: opts.config, source: 'built-in ring-0 layout', overrides: [] } : loadDoctorConfig(opts.root));
+    if (opts.only)
+        for (const id of opts.only)
+            if (!RULE_IDS.includes(id))
+                throw new DevkitError(ERROR_CODES.E_RULE_UNKNOWN, `unknown rule "${id}" (known: ${RULE_IDS.join(', ')})`);
+    const ctx = makeRuleContext(opts.root);
+    const results = [];
+    for (const { rule, section } of DOCTOR_RULES) {
+        if (opts.only && !opts.only.includes(rule.id))
+            continue;
+        const t0 = performance.now();
+        const cfg = loaded.config[section];
+        if (cfg.skip) {
+            results.push({ id: rule.id, status: 'skip', summary: `skipped by config — ${cfg.skip}`, findings: [], notes: [], ms: 0 });
+            continue;
+        }
+        try {
+            const out = await rule.run(ctx, cfg);
+            const findings = (out.findings ?? []).map((f) => ({ ...f, message: redact(f.message) }));
+            const status = out.status ?? (findings.length ? 'fail' : 'pass');
+            results.push({ id: rule.id, status, summary: redact(out.summary), findings, notes: (out.notes ?? []).map(redact), ms: Math.round(performance.now() - t0) });
+        }
+        catch (e) {
+            results.push({ id: rule.id, status: 'error', summary: redact(`${ERROR_CODES.E_RULE_ERROR}: ${e.message}`), findings: [], notes: [], ms: Math.round(performance.now() - t0) });
+        }
+    }
+    return { root: opts.root, configSource: loaded.source, configOverrides: loaded.overrides, rules: results, ok: results.every((r) => r.status === 'pass' || r.status === 'skip'), errored: results.some((r) => r.status === 'error') };
+}
+export function formatDoctorReport(report, opts = {}) {
+    const mark = { pass: '✓', fail: '✗', skip: '⊘', error: '‼' };
+    const lines = [`ap doctor · ${report.root} · config: ${report.configSource}${report.configOverrides.length ? ` (${report.configOverrides.join(', ')})` : ''}`, ''];
+    for (const r of report.rules) {
+        lines.push(`${mark[r.status]} ${r.id.padEnd(30)} ${r.summary}`);
+        const show = r.status === 'fail' || r.status === 'error' || opts.verbose;
+        if (show)
+            for (const f of r.findings.slice(0, opts.verbose ? undefined : 40))
+                lines.push(`    ${f.file ?? ''}${f.line ? `:${f.line}` : ''}${f.file ? '  ' : ''}${f.message}`);
+        if (show && !opts.verbose && r.findings.length > 40)
+            lines.push(`    … ${r.findings.length - 40} more (use --verbose)`);
+        if (opts.verbose)
+            for (const n of r.notes)
+                lines.push(`    · ${n}`);
+    }
+    const fails = report.rules.filter((r) => r.status === 'fail').length;
+    const errors = report.rules.filter((r) => r.status === 'error').length;
+    lines.push('', report.ok ? `✓ ${report.rules.length} rule(s) clean` : `✗ ${fails} failing, ${errors} errored of ${report.rules.length}`);
+    return lines.join('\n');
+}
+//# sourceMappingURL=doctor.js.map

package/dist/doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA,mHAAmH;AACnH,6GAA6G;AAC7G,+DAA+D;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAwC,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACrF,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAY1D,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO;QACL,IAAI;QACJ,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACzB,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACxB,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACpC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACpC,IAAI,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC;QAChD,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAqF;IACnH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,wBAAiC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9J,IAAI,IAAI,CAAC,IAAI;QAAE,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI;YAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAAE,MAAM,IAAI,WAAW,CAAC,WAAW,CAAC,cAAc,EAAE,iBAAiB,EAAE,aAAa,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjL,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,YAAY,EAAE,CAAC;QAC7C,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,SAAS;QACxD,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,GAAG,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACtJ,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrC,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YACzF,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACjE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9J,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,WAAW,CAAC,YAAY,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC3L,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,EAAE,CAAC;AACvO,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAoB,EAAE,OAA8B,EAAE;IACvF,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAW,CAAC;IACtE,MAAM,KAAK,GAAG,CAAC,eAAe,MAAM,CAAC,IAAI,cAAc,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IACnK,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC;QACzE,IAAI,IAAI;YAAE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9K,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,uBAAuB,CAAC,CAAC;QACxH,IAAI,IAAI,CAAC,OAAO;YAAE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK;gBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IACrE,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,MAAM,CAAC;IACvE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,MAAM,gBAAgB,CAAC,CAAC,CAAC,KAAK,KAAK,aAAa,MAAM,eAAe,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACzI,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,37 @@
+export declare const ERROR_CODES: {
+    /** The config file could not be read or is not the shape `ap.config.json` / `agentic.lock.json#doctor` declares. */
+    readonly E_CONFIG: "E_CONFIG";
+    /** `--rule <id>` names no registered rule. */
+    readonly E_RULE_UNKNOWN: "E_RULE_UNKNOWN";
+    /** A rule threw instead of judging — its own defect, reported as `status: error`, never as a pass. */
+    readonly E_RULE_ERROR: "E_RULE_ERROR";
+    /** A rule needed a file the config names and it is not there. */
+    readonly E_INPUT_MISSING: "E_INPUT_MISSING";
+    /** An `ap` command dispatches to a package that is not installed (a2a / mcp-protocol / evaluation / create-app). */
+    readonly E_MODULE_ABSENT: "E_MODULE_ABSENT";
+    /** The dispatched module is installed but does not export the function this CLI version expects. */
+    readonly E_MODULE_SHAPE: "E_MODULE_SHAPE";
+    /** Command-line usage error. */
+    readonly E_USAGE: "E_USAGE";
+    /** `ap upgrade` could not resolve a version for a package. */
+    readonly E_RESOLVE: "E_RESOLVE";
+    /** `ap upgrade` stops for review: a contract's authority or effects changed (398 §10.3). */
+    readonly E_REVIEW_REQUIRED: "E_REVIEW_REQUIRED";
+    /** `ap doctor --rules`: a projection target exists but carries no managed block. */
+    readonly E_UNMANAGED_TARGET: "E_UNMANAGED_TARGET";
+};
+export type ErrorCode = (typeof ERROR_CODES)[keyof typeof ERROR_CODES];
+export declare class DevkitError extends Error {
+    readonly code: ErrorCode;
+    constructor(code: ErrorCode, message: string, options?: {
+        cause?: unknown;
+    });
+}
+/** Process exit codes, fixed: 0 clean · 1 findings · 2 usage/config · 3 a rule or dispatch errored. */
+export declare const EXIT: {
+    readonly OK: 0;
+    readonly FINDINGS: 1;
+    readonly USAGE: 2;
+    readonly ERROR: 3;
+};
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,WAAW;IACtB,oHAAoH;;IAEpH,8CAA8C;;IAE9C,sGAAsG;;IAEtG,iEAAiE;;IAEjE,oHAAoH;;IAEpH,oGAAoG;;IAEpG,gCAAgC;;IAEhC,8DAA8D;;IAE9D,4FAA4F;;IAE5F,oFAAoF;;CAE5E,CAAC;AACX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,OAAO,WAAW,CAAC,CAAC;AAEvE,qBAAa,WAAY,SAAQ,KAAK;IACpC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;gBACb,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAK5E;AAED,uGAAuG;AACvG,eAAO,MAAM,IAAI;;;;;CAAsD,CAAC"}

package/dist/errors.js

@@ -0,0 +1,35 @@
+// Stable error codes — a coding agent (398 §10.3: every command has `--json`) branches on the CODE, never on
+// the sentence. Add a code; never repurpose one.
+export const ERROR_CODES = {
+    /** The config file could not be read or is not the shape `ap.config.json` / `agentic.lock.json#doctor` declares. */
+    E_CONFIG: 'E_CONFIG',
+    /** `--rule <id>` names no registered rule. */
+    E_RULE_UNKNOWN: 'E_RULE_UNKNOWN',
+    /** A rule threw instead of judging — its own defect, reported as `status: error`, never as a pass. */
+    E_RULE_ERROR: 'E_RULE_ERROR',
+    /** A rule needed a file the config names and it is not there. */
+    E_INPUT_MISSING: 'E_INPUT_MISSING',
+    /** An `ap` command dispatches to a package that is not installed (a2a / mcp-protocol / evaluation / create-app). */
+    E_MODULE_ABSENT: 'E_MODULE_ABSENT',
+    /** The dispatched module is installed but does not export the function this CLI version expects. */
+    E_MODULE_SHAPE: 'E_MODULE_SHAPE',
+    /** Command-line usage error. */
+    E_USAGE: 'E_USAGE',
+    /** `ap upgrade` could not resolve a version for a package. */
+    E_RESOLVE: 'E_RESOLVE',
+    /** `ap upgrade` stops for review: a contract's authority or effects changed (398 §10.3). */
+    E_REVIEW_REQUIRED: 'E_REVIEW_REQUIRED',
+    /** `ap doctor --rules`: a projection target exists but carries no managed block. */
+    E_UNMANAGED_TARGET: 'E_UNMANAGED_TARGET',
+};
+export class DevkitError extends Error {
+    code;
+    constructor(code, message, options) {
+        super(message, options);
+        this.name = 'DevkitError';
+        this.code = code;
+    }
+}
+/** Process exit codes, fixed: 0 clean · 1 findings · 2 usage/config · 3 a rule or dispatch errored. */
+export const EXIT = { OK: 0, FINDINGS: 1, USAGE: 2, ERROR: 3 };
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,6GAA6G;AAC7G,iDAAiD;AACjD,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,oHAAoH;IACpH,QAAQ,EAAE,UAAU;IACpB,8CAA8C;IAC9C,cAAc,EAAE,gBAAgB;IAChC,sGAAsG;IACtG,YAAY,EAAE,cAAc;IAC5B,iEAAiE;IACjE,eAAe,EAAE,iBAAiB;IAClC,oHAAoH;IACpH,eAAe,EAAE,iBAAiB;IAClC,oGAAoG;IACpG,cAAc,EAAE,gBAAgB;IAChC,gCAAgC;IAChC,OAAO,EAAE,SAAS;IAClB,8DAA8D;IAC9D,SAAS,EAAE,WAAW;IACtB,4FAA4F;IAC5F,iBAAiB,EAAE,mBAAmB;IACtC,oFAAoF;IACpF,kBAAkB,EAAE,oBAAoB;CAChC,CAAC;AAGX,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,IAAI,CAAY;IACzB,YAAY,IAAe,EAAE,OAAe,EAAE,OAA6B;QACzE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,uGAAuG;AACvG,MAAM,CAAC,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAW,CAAC"}

package/dist/fs.d.ts

@@ -0,0 +1,20 @@
+import { existsSync } from 'node:fs';
+export interface WalkOptions {
+    /** Directory names skipped at any depth. */
+    skipDirs?: ReadonlySet<string>;
+    /** File filter over the base name. */
+    file?: (name: string) => boolean;
+}
+/** Every file under `dir` (absolute paths), depth-first, deterministic order. Missing dir → []. */
+export declare function walk(dir: string, opts?: WalkOptions): string[];
+/** Repo-relative path with forward slashes — the form every finding prints. */
+export declare function rel(root: string, abs: string): string;
+/** Files git tracks under `subdir` (repo-relative), or `null` when `root` is not a git checkout. */
+export declare function gitTracked(root: string, subdir: string): string[] | null;
+export declare function readText(path: string): string;
+export { existsSync as exists };
+/** Strip block and line comments — code, not prose, is what a rule judges. */
+export declare function stripComments(src: string): string;
+/** True when a line is a comment line (//, *, /*) — doctrine references in prose are fine. */
+export declare function isCommentLine(line: string): boolean;
+//# sourceMappingURL=fs.d.ts.map

package/dist/fs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../src/fs.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAuC,MAAM,SAAS,CAAC;AAI1E,MAAM,WAAW,WAAW;IAC1B,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC/B,sCAAsC;IACtC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;CAClC;AAID,mGAAmG;AACnG,wBAAgB,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,MAAM,EAAE,CAYlE;AAED,+EAA+E;AAC/E,wBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,oGAAoG;AACpG,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAQxE;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED,OAAO,EAAE,UAAU,IAAI,MAAM,EAAE,CAAC;AAEhC,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,8FAA8F;AAC9F,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGnD"}

package/dist/fs.js

@@ -0,0 +1,54 @@
+// Filesystem helpers shared by every rule. Rules never touch `node:fs` directly: they receive a `RuleContext`
+// built from these, which is what makes a rule testable against a temp tree.
+import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import { join, relative, sep } from 'node:path';
+const DEFAULT_SKIP = new Set(['node_modules', 'dist', '.git', 'coverage', '.next', '.wrangler', '.turbo']);
+/** Every file under `dir` (absolute paths), depth-first, deterministic order. Missing dir → []. */
+export function walk(dir, opts = {}) {
+    const skip = opts.skipDirs ?? DEFAULT_SKIP;
+    const out = [];
+    if (!existsSync(dir))
+        return out;
+    for (const entry of readdirSync(dir).sort()) {
+        if (skip.has(entry))
+            continue;
+        const p = join(dir, entry);
+        const s = statSync(p);
+        if (s.isDirectory())
+            out.push(...walk(p, opts));
+        else if (!opts.file || opts.file(entry))
+            out.push(p);
+    }
+    return out;
+}
+/** Repo-relative path with forward slashes — the form every finding prints. */
+export function rel(root, abs) {
+    return relative(root, abs).split(sep).join('/');
+}
+/** Files git tracks under `subdir` (repo-relative), or `null` when `root` is not a git checkout. */
+export function gitTracked(root, subdir) {
+    if (!existsSync(join(root, '.git')))
+        return null;
+    try {
+        const out = execFileSync('git', ['ls-files', subdir], { cwd: root, encoding: 'utf8' });
+        return out.split('\n').map((l) => l.trim()).filter(Boolean);
+    }
+    catch {
+        return null;
+    }
+}
+export function readText(path) {
+    return readFileSync(path, 'utf8');
+}
+export { existsSync as exists };
+/** Strip block and line comments — code, not prose, is what a rule judges. */
+export function stripComments(src) {
+    return src.replace(/\/\*[\s\S]*?\*\//g, '').replace(/^\s*\/\/.*$/gm, '');
+}
+/** True when a line is a comment line (//, *, /*) — doctrine references in prose are fine. */
+export function isCommentLine(line) {
+    const t = line.trim();
+    return t.startsWith('//') || t.startsWith('*') || t.startsWith('/*');
+}
+//# sourceMappingURL=fs.js.map

package/dist/fs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs.js","sourceRoot":"","sources":["../src/fs.ts"],"names":[],"mappings":"AAAA,8GAA8G;AAC9G,6EAA6E;AAC7E,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAShD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE3G,mGAAmG;AACnG,MAAM,UAAU,IAAI,CAAC,GAAW,EAAE,OAAoB,EAAE;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC;IAC3C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5C,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,CAAC,WAAW,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;aAC3C,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,GAAW;IAC3C,OAAO,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,MAAc;IACrD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACvF,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,OAAO,EAAE,UAAU,IAAI,MAAM,EAAE,CAAC;AAEhC,8EAA8E;AAC9E,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,OAAO,GAAG,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,OAAO,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACvE,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,24 @@
+export declare const PACKAGE_NAME: "@agenticprimitives/devkit";
+export declare const PACKAGE_STATUS: "w0-doctor-rules-upgrade";
+export declare const SPEC_REF: "specs/399-repository-split-program.md";
+export { ERROR_CODES, DevkitError, EXIT } from './errors.js';
+export type { ErrorCode } from './errors.js';
+export { redact } from './redact.js';
+export { RING0_DOCTOR_CONFIG, mergeDoctorConfig, loadDoctorConfig } from './config.js';
+export type { DoctorConfig, DoctorConfigOverrides, ConfigSource, LoadedConfig, Skippable, WhyEntry, KnobAllow } from './config.js';
+export type { DoctorRule, RuleContext, RuleFinding, RuleOutcome, RuleResult, RuleStatus } from './rules/types.js';
+export { DOCTOR_RULES, RULE_IDS } from './rules/index.js';
+export type { RegisteredRule } from './rules/index.js';
+export { runDoctor, makeRuleContext, formatDoctorReport } from './doctor.js';
+export type { DoctorReport } from './doctor.js';
+export { BUNDLED_RULES_DIR, RULES_BLOCK_START, RULES_BLOCK_END, ruleDigest, extractHardRules, loadRulesCorpus, rulesLockEntries, renderMdc, renderRulesBlock, replaceRulesBlock, projectRules, } from './rules-projection.js';
+export type { RuleSidecarEntry, RulesSidecar, RuleSource, RulesCorpus, ProjectionResult, ProjectOptions } from './rules-projection.js';
+export { readLock, writeLock } from './lock.js';
+export type { AgenticLockV1 } from './lock.js';
+export { workspaceGlobs, workspaceManifests } from './workspace.js';
+export type { PackageManifest, WorkspaceManifest } from './workspace.js';
+export { planUpgrade, applyUpgradePlan, formatUpgradePlan, npmDistTags } from './upgrade.js';
+export type { UpgradeMode, UpgradeChange, UpgradePlan, DistTagResolver } from './upgrade.js';
+export { CONFORM_MODULES, LIVE_GATES_MODULE, CREATE_APP_MODULE, loadConform, loadLiveGatesRunner, loadCreateApp, formatConformanceReport } from './dispatch.js';
+export type { ConformanceCheck, ConformanceReport, ConformFn, LiveGatesRunner } from './dispatch.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,YAAY,EAAG,2BAAoC,CAAC;AACjE,eAAO,MAAM,cAAc,EAAG,yBAAkC,CAAC;AACjE,eAAO,MAAM,QAAQ,EAAG,uCAAgD,CAAC;AAEzE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAC7D,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACvF,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACnI,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAClH,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC1D,YAAY,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC7E,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,iBAAiB,EAAE,iBAAiB,EAAE,eAAe,EACrD,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,YAAY,GAC9H,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvI,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAChD,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpE,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC7F,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,WAAW,EAAE,mBAAmB,EAAE,aAAa,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAChK,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -0,0 +1,19 @@
+// @agenticprimitives/devkit — the Developer Kit core (spec 398 §10, spec 399 §3.3–3.6, ADR-0063 §1). The packages'
+// own front door: `ap doctor` (the doctrine gates as data + pure rules), `ap doctor --rules` (one rules source
+// projected by digest), `ap upgrade` (one coherent exact set), and thin dispatch to the packages that own
+// conformance (`ap conform`) and live gates (`ap test`). Generic by construction (ADR-0021): the layout a rule
+// judges is CONFIG; the reference layout ships so Ring 0's root checks have their twins.
+export const PACKAGE_NAME = '@agenticprimitives/devkit';
+export const PACKAGE_STATUS = 'w0-doctor-rules-upgrade';
+export const SPEC_REF = 'specs/399-repository-split-program.md';
+export { ERROR_CODES, DevkitError, EXIT } from './errors.js';
+export { redact } from './redact.js';
+export { RING0_DOCTOR_CONFIG, mergeDoctorConfig, loadDoctorConfig } from './config.js';
+export { DOCTOR_RULES, RULE_IDS } from './rules/index.js';
+export { runDoctor, makeRuleContext, formatDoctorReport } from './doctor.js';
+export { BUNDLED_RULES_DIR, RULES_BLOCK_START, RULES_BLOCK_END, ruleDigest, extractHardRules, loadRulesCorpus, rulesLockEntries, renderMdc, renderRulesBlock, replaceRulesBlock, projectRules, } from './rules-projection.js';
+export { readLock, writeLock } from './lock.js';
+export { workspaceGlobs, workspaceManifests } from './workspace.js';
+export { planUpgrade, applyUpgradePlan, formatUpgradePlan, npmDistTags } from './upgrade.js';
+export { CONFORM_MODULES, LIVE_GATES_MODULE, CREATE_APP_MODULE, loadConform, loadLiveGatesRunner, loadCreateApp, formatConformanceReport } from './dispatch.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mHAAmH;AACnH,+GAA+G;AAC/G,0GAA0G;AAC1G,+GAA+G;AAC/G,yFAAyF;AACzF,MAAM,CAAC,MAAM,YAAY,GAAG,2BAAoC,CAAC;AACjE,MAAM,CAAC,MAAM,cAAc,GAAG,yBAAkC,CAAC;AACjE,MAAM,CAAC,MAAM,QAAQ,GAAG,uCAAgD,CAAC;AAEzE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAE7D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAGvF,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE1D,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAE7E,OAAO,EACL,iBAAiB,EAAE,iBAAiB,EAAE,eAAe,EACrD,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,YAAY,GAC9H,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEhD,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE7F,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,WAAW,EAAE,mBAAmB,EAAE,aAAa,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC"}

package/dist/lock.d.ts

@@ -0,0 +1,18 @@
+import type { DoctorConfigOverrides } from './config.js';
+export interface AgenticLockV1 {
+    lockVersion: 1;
+    /** Exact @agenticprimitives/* versions the product pins — one coherent set. */
+    packages: Record<string, string>;
+    /** sha256 digest per rule in the pinned rules source (399 §3.4). */
+    rules: Record<string, string>;
+    /** The devkit version that generated / last upgraded this lock. */
+    devkit?: string;
+    template?: {
+        name: string;
+        revision: string;
+    };
+    doctor?: DoctorConfigOverrides;
+}
+export declare function readLock(root: string): AgenticLockV1 | null;
+export declare function writeLock(root: string, lock: AgenticLockV1): void;
+//# sourceMappingURL=lock.d.ts.map

package/dist/lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock.d.ts","sourceRoot":"","sources":["../src/lock.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEzD,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,CAAC,CAAC;IACf,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,oEAAoE;IACpE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C,MAAM,CAAC,EAAE,qBAAqB,CAAC;CAChC;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAI3D;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,IAAI,CAEjE"}

package/dist/lock.js

@@ -0,0 +1,15 @@
+// `agentic.lock.json` — what a package-manager lock cannot pin (398 §10.4): the @agenticprimitives/* version set,
+// the rules-source digests, the template revision, and the doctor config the product carries. W0 binds the first
+// three; contract deployments, ontology closures and definition digests are later fields on the same document.
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+export function readLock(root) {
+    const p = join(root, 'agentic.lock.json');
+    if (!existsSync(p))
+        return null;
+    return JSON.parse(readFileSync(p, 'utf8'));
+}
+export function writeLock(root, lock) {
+    writeFileSync(join(root, 'agentic.lock.json'), `${JSON.stringify(lock, null, 2)}\n`);
+}
+//# sourceMappingURL=lock.js.map

package/dist/lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock.js","sourceRoot":"","sources":["../src/lock.ts"],"names":[],"mappings":"AAAA,kHAAkH;AAClH,iHAAiH;AACjH,+GAA+G;AAC/G,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAejC,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAkB,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,IAAmB;IACzD,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AACvF,CAAC"}

package/dist/redact.d.ts

@@ -0,0 +1,2 @@
+export declare function redact(text: string): string;
+//# sourceMappingURL=redact.d.ts.map

package/dist/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":"AAQA,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAK3C"}

package/dist/redact.js

@@ -0,0 +1,14 @@
+// Redacted output (398 §10.3 T22): a finding names WHERE a secret-shaped thing is, never WHAT it is. Every
+// message that leaves `ap` passes through here, so a rule author cannot leak by accident.
+// A digest is public and a person needs it (`record 0x…`); key material never reaches a message, this is depth.
+const HEX_32 = /(?<!\b(?:digest|recorded|record)\s)0x[0-9a-fA-F]{64}/g;
+// Long opaque tokens (a pasted bearer, a base64 blob); a `sha256:` / `0x` digest is spared — see HEX_32.
+const LONG_TOKEN = /(?<![\w/.:-])(?!0x[0-9a-fA-F]{64}\b)[A-Za-z0-9_-]{48,}(?![\w/.-])/g;
+const BEARER = /(bearer\s+)[A-Za-z0-9._~+/=-]{8,}/gi;
+export function redact(text) {
+    return text
+        .replace(HEX_32, '0x…[redacted 32 bytes]')
+        .replace(BEARER, '$1[redacted]')
+        .replace(LONG_TOKEN, '[redacted]');
+}
+//# sourceMappingURL=redact.js.map

package/dist/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":"AAAA,2GAA2G;AAC3G,0FAA0F;AAC1F,gHAAgH;AAChH,MAAM,MAAM,GAAG,uDAAuD,CAAC;AACvE,yGAAyG;AACzG,MAAM,UAAU,GAAG,oEAAoE,CAAC;AACxF,MAAM,MAAM,GAAG,qCAAqC,CAAC;AAErD,MAAM,UAAU,MAAM,CAAC,IAAY;IACjC,OAAO,IAAI;SACR,OAAO,CAAC,MAAM,EAAE,wBAAwB,CAAC;SACzC,OAAO,CAAC,MAAM,EAAE,cAAc,CAAC;SAC/B,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;AACvC,CAAC"}

package/dist/rules/archetype-catalog.d.ts

@@ -0,0 +1,4 @@
+import type { DoctorConfig } from '../config.js';
+import type { DoctorRule } from './types.js';
+export declare const archetypeCatalog: DoctorRule<DoctorConfig['archetypeCatalog']>;
+//# sourceMappingURL=archetype-catalog.d.ts.map

package/dist/rules/archetype-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"archetype-catalog.d.ts","sourceRoot":"","sources":["../../src/rules/archetype-catalog.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAe,MAAM,YAAY,CAAC;AAI1D,eAAO,MAAM,gBAAgB,EAAE,UAAU,CAAC,YAAY,CAAC,kBAAkB,CAAC,CA4BzE,CAAC"}

package/dist/rules/archetype-catalog.js

@@ -0,0 +1,48 @@
+// archetype-catalog — spec 354 §3 (twin of root check:archetype-catalog). The app-config catalog carries compiled
+// AgentHarnessDefinitionV1 objects committed verbatim; each is re-validated against the Ring-0 schema and its
+// digest re-derived against the recorded value. The catalog module is loaded by dynamic import; run under a
+// TypeScript-capable runtime (node ≥ 22.18 strips types; `tsx` otherwise).
+import { pathToFileURL } from 'node:url';
+import { validateAgentHarnessDefinition, definitionDigest } from '@agenticprimitives/capability-claims';
+export const archetypeCatalog = {
+    id: 'archetype-catalog',
+    spec: 'spec 354 §3',
+    twin: 'check:archetype-catalog',
+    describe: 'the compiled archetype catalog validates and carries its recorded digests',
+    async run(ctx, cfg) {
+        if (!ctx.exists(cfg.module))
+            return { status: 'error', summary: `catalog module ${cfg.module} is missing`, findings: [{ file: cfg.module, message: 'catalog module not found', tag: 'missing' }] };
+        let mod;
+        try {
+            mod = (await import(pathToFileURL(ctx.abs(cfg.module)).href));
+        }
+        catch (e) {
+            return { status: 'error', summary: `could not load ${cfg.module}: ${e.message}`, findings: [{ file: cfg.module, message: `module load failed (${e.message}) — run under a TypeScript-capable runtime`, tag: 'load' }] };
+        }
+        const catalog = mod[cfg.exportName];
+        if (!Array.isArray(catalog))
+            return { status: 'error', summary: `${cfg.module} does not export an array named ${cfg.exportName}`, findings: [{ file: cfg.module, message: `no array export ${cfg.exportName}`, tag: 'shape' }] };
+        const findings = [];
+        const notes = [];
+        for (const entry of catalog) {
+            const v = validateAgentHarnessDefinition(entry.definition);
+            if (!v.ok) {
+                findings.push({ file: cfg.module, message: `${entry.key}: definition invalid — ${v.errors.join('; ')}`, tag: 'invalid' });
+                continue;
+            }
+            const digest = definitionDigest(entry.definition);
+            const want = cfg.expected[entry.key];
+            if (want === undefined) {
+                findings.push({ file: cfg.module, message: `${entry.key}: no recorded expected digest — record ${digest} after reviewing the change`, tag: 'unrecorded' });
+                continue;
+            }
+            if (digest !== want) {
+                findings.push({ file: cfg.module, message: `${entry.key}: digest ${digest} ≠ recorded ${want} — the definition changed; update the record if intended`, tag: 'drift' });
+                continue;
+            }
+            notes.push(`${entry.key} (${entry.definition.archetypeId} v${entry.definition.archetypeVersion}) ${digest}`);
+        }
+        return { summary: findings.length ? `${findings.length} catalog problem(s)` : `${catalog.length} archetype(s) validated at their recorded digests`, findings, notes };
+    },
+};
+//# sourceMappingURL=archetype-catalog.js.map

package/dist/rules/archetype-catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"archetype-catalog.js","sourceRoot":"","sources":["../../src/rules/archetype-catalog.ts"],"names":[],"mappings":"AAAA,kHAAkH;AAClH,8GAA8G;AAC9G,4GAA4G;AAC5G,2EAA2E;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,8BAA8B,EAAE,gBAAgB,EAAiC,MAAM,sCAAsC,CAAC;AAMvI,MAAM,CAAC,MAAM,gBAAgB,GAAiD;IAC5E,EAAE,EAAE,mBAAmB;IACvB,IAAI,EAAE,aAAa;IACnB,IAAI,EAAE,yBAAyB;IAC/B,QAAQ,EAAE,2EAA2E;IACrF,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG;QAChB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,kBAAkB,GAAG,CAAC,MAAM,aAAa,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,0BAA0B,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QACnM,IAAI,GAA4B,CAAC;QACjC,IAAI,CAAC;YACH,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAA4B,CAAC;QAC3F,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,kBAAkB,GAAG,CAAC,MAAM,KAAM,CAAW,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,uBAAwB,CAAW,CAAC,OAAO,4CAA4C,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QAChP,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,MAAM,mCAAmC,GAAG,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,CAAC,UAAU,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QACjO,MAAM,QAAQ,GAAkB,EAAE,CAAC;QACnC,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,KAAK,IAAI,OAAyB,EAAE,CAAC;YAC9C,MAAM,CAAC,GAAG,8BAA8B,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC3D,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,GAAG,0BAA0B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YACnJ,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,GAAG,0CAA0C,MAAM,6BAA6B,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YACjM,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,GAAG,YAAY,MAAM,eAAe,IAAI,0DAA0D,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC3M,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,UAAU,CAAC,WAAW,KAAK,KAAK,CAAC,UAAU,CAAC,gBAAgB,KAAK,MAAM,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,qBAAqB,CAAC,CAAC,CAAC,GAAI,OAAqB,CAAC,MAAM,mDAAmD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACvL,CAAC;CACF,CAAC"}

package/dist/rules/capability-vocabulary.d.ts

@@ -0,0 +1,4 @@
+import type { DoctorConfig } from '../config.js';
+import type { DoctorRule } from './types.js';
+export declare const capabilityVocabulary: DoctorRule<DoctorConfig['capabilityVocabulary']>;
+//# sourceMappingURL=capability-vocabulary.d.ts.map

package/dist/rules/capability-vocabulary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-vocabulary.d.ts","sourceRoot":"","sources":["../../src/rules/capability-vocabulary.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAe,MAAM,YAAY,CAAC;AAE1D,eAAO,MAAM,oBAAoB,EAAE,UAAU,CAAC,YAAY,CAAC,sBAAsB,CAAC,CAoCjF,CAAC"}

package/dist/rules/capability-vocabulary.js

@@ -0,0 +1,56 @@
+// capability-vocabulary — ADR-0051 (twin of root check:capability-vocabulary, the product-source half). Three
+// names, one meaning each: capability (what an agent can do) · protocol features (A2A's streaming/push flags) ·
+// skill (a SKILL.md playbook). `skills[]` is the A2A wire word and is legitimate only where config says the wire
+// is written or shown raw.
+import { globSync } from 'node:fs';
+export const capabilityVocabulary = {
+    id: 'capability-vocabulary',
+    spec: 'ADR-0051',
+    twin: 'check:capability-vocabulary',
+    describe: 'capability · protocol features · playbook stay distinct in product source',
+    run(ctx, cfg) {
+        const findings = [];
+        const allowed = (file) => cfg.wireAllowed.some((p) => file.startsWith(p));
+        const scan = (patterns, check, tag) => {
+            for (const file of globSync(patterns, { cwd: ctx.root })) {
+                if (file.includes('node_modules') || file.includes('/dist/'))
+                    continue;
+                if (allowed(file))
+                    continue;
+                let src;
+                try {
+                    src = ctx.read(file);
+                }
+                catch {
+                    continue;
+                }
+                src.split('\n').forEach((line, i) => {
+                    const why = check(line);
+                    if (why)
+                        findings.push({ file, line: i + 1, message: why, tag });
+                });
+            }
+        };
+        scan(cfg.homeGlobs, (line) => {
+            if (/\/\/|\/\*|\*/.test(line.trimStart().slice(0, 2)))
+                return null;
+            const m = /(?:label|title|placeholder|aria-label|heading|name):\s*['"`]([^'"`]*\bSkills?\b[^'"`]*)['"`]/i.exec(line)
+                ?? />\s*(Skills)\s*</.exec(line)
+                ?? /,\s*['"`](Skills?)['"`]\s*,/.exec(line);
+            if (!m)
+                return null;
+            if (/playbook/i.test(line))
+                return null;
+            return 'user-visible "Skills" — say Capabilities (or Playbook, if that is what it is)';
+        }, 'user-visible');
+        scan([cfg.packagesGlob], (line) => {
+            if (/^\s*(\/\/|\*|\/\*)/.test(line))
+                return null;
+            if (!/^\s*(?:readonly\s+)?skills\??\s*:/.test(line))
+                return null;
+            return 'a `skills` field outside the A2A wire — the field is `capabilities`';
+        }, 'field');
+        return { summary: findings.length ? `${findings.length} vocabulary drift(s)` : 'capability / protocol features / playbook stay distinct', findings };
+    },
+};
+//# sourceMappingURL=capability-vocabulary.js.map

package/dist/rules/capability-vocabulary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-vocabulary.js","sourceRoot":"","sources":["../../src/rules/capability-vocabulary.ts"],"names":[],"mappings":"AAAA,8GAA8G;AAC9G,gHAAgH;AAChH,iHAAiH;AACjH,2BAA2B;AAC3B,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAInC,MAAM,CAAC,MAAM,oBAAoB,GAAqD;IACpF,EAAE,EAAE,uBAAuB;IAC3B,IAAI,EAAE,UAAU;IAChB,IAAI,EAAE,6BAA6B;IACnC,QAAQ,EAAE,2EAA2E;IACrF,GAAG,CAAC,GAAG,EAAE,GAAG;QACV,MAAM,QAAQ,GAAkB,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAClF,MAAM,IAAI,GAAG,CAAC,QAAkB,EAAE,KAAsC,EAAE,GAAW,EAAE,EAAE;YACvF,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBACzD,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBACvE,IAAI,OAAO,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAC5B,IAAI,GAAW,CAAC;gBAChB,IAAI,CAAC;oBAAC,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBACjD,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;oBAClC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;oBACxB,IAAI,GAAG;wBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;gBACnE,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE;YAC3B,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnE,MAAM,CAAC,GAAG,+FAA+F,CAAC,IAAI,CAAC,IAAI,CAAC;mBAC/G,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;mBAC7B,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpB,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YACxC,OAAO,+EAA+E,CAAC;QACzF,CAAC,EAAE,cAAc,CAAC,CAAC;QACnB,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE;YAChC,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjD,IAAI,CAAC,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjE,OAAO,qEAAqE,CAAC;QAC/E,CAAC,EAAE,OAAO,CAAC,CAAC;QACZ,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,sBAAsB,CAAC,CAAC,CAAC,yDAAyD,EAAE,QAAQ,EAAE,CAAC;IACvJ,CAAC;CACF,CAAC"}

package/dist/rules/custodian-coverage.d.ts

@@ -0,0 +1,4 @@
+import type { DoctorConfig } from '../config.js';
+import type { DoctorRule } from './types.js';
+export declare const custodianCoverage: DoctorRule<DoctorConfig['custodianCoverage']>;
+//# sourceMappingURL=custodian-coverage.d.ts.map

package/dist/rules/custodian-coverage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"custodian-coverage.d.ts","sourceRoot":"","sources":["../../src/rules/custodian-coverage.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAe,MAAM,YAAY,CAAC;AAE1D,eAAO,MAAM,iBAAiB,EAAE,UAAU,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAkC3E,CAAC"}

package/dist/rules/custodian-coverage.js

@@ -0,0 +1,47 @@
+export const custodianCoverage = {
+    id: 'custodian-coverage',
+    spec: 'specs 294 / 295',
+    twin: 'check:custodian-coverage',
+    describe: 'provider-neutral custodian; the Home offers every custody class; relying apps delegate',
+    run(ctx, cfg) {
+        const findings = [];
+        if (!ctx.exists(cfg.matrix))
+            findings.push({ file: cfg.matrix, message: 'the custodian coverage matrix is missing', tag: 'matrix' });
+        else {
+            const m = ctx.read(cfg.matrix).toLowerCase();
+            for (const kind of cfg.matrixKinds)
+                if (!m.includes(kind))
+                    findings.push({ file: cfg.matrix, message: `the matrix does not mention the '${kind}' custody kind`, tag: 'matrix' });
+        }
+        if (ctx.exists(cfg.homeVia)) {
+            const decl = ctx.read(cfg.homeVia).match(/type Via\s*=\s*([^;]+);/)?.[1] ?? '';
+            for (const req of cfg.viaRequired)
+                if (!new RegExp(`'${req}'`).test(decl))
+                    findings.push({ file: cfg.homeVia, message: `the Home \`Via\` type is missing '${req}'`, tag: 'via' });
+            if (!cfg.viaSocialAny.some((s) => new RegExp(`'${s}'`).test(decl)))
+                findings.push({ file: cfg.homeVia, message: `the Home \`Via\` type offers no SOCIAL custody kind (${cfg.viaSocialAny.join('/')})`, tag: 'via' });
+        }
+        else
+            findings.push({ file: cfg.homeVia, message: 'not found — cannot verify the Home custody surface', tag: 'via' });
+        const usesClient = ctx.exists(cfg.relyingApp.dir) && cfg.relyingApp.entryFiles.some((f) => {
+            const p = `${cfg.relyingApp.dir}/${f}`;
+            return ctx.exists(p) && ctx.read(p).includes(cfg.relyingApp.mustImport);
+        });
+        if (!usesClient)
+            findings.push({ file: cfg.relyingApp.dir, message: `the relying app must hand custody off through ${cfg.relyingApp.mustImport}`, tag: 'relying' });
+        const providerRe = new RegExp(`['"\`]\\/(?:a2a\\/)?custody\\/(${cfg.providerNamedCustody.join('|')})\\/`);
+        const skip = new Set(['node_modules', 'dist', '.wrangler', 'server', 'functions']);
+        for (const app of cfg.browserApps) {
+            const src = `${app}/src`;
+            if (!ctx.exists(src))
+                continue;
+            for (const abs of ctx.walk(src, { skipDirs: skip, file: (n) => /\.(ts|tsx)$/.test(n) })) {
+                const hit = ctx.read(ctx.rel(abs)).match(providerRe);
+                if (hit)
+                    findings.push({ file: ctx.rel(abs), message: `references a PROVIDER-NAMED custody path (${hit[1]}); use the generic /custody/oidc/*`, tag: 'provider-named' });
+            }
+        }
+        return { summary: findings.length ? `${findings.length} custodian-coverage problem(s)` : 'custodian provider-neutral; Home offers every custody class; relying apps delegate', findings };
+    },
+};
+//# sourceMappingURL=custodian-coverage.js.map

package/dist/rules/custodian-coverage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custodian-coverage.js","sourceRoot":"","sources":["../../src/rules/custodian-coverage.ts"],"names":[],"mappings":"AAMA,MAAM,CAAC,MAAM,iBAAiB,GAAkD;IAC9E,EAAE,EAAE,oBAAoB;IACxB,IAAI,EAAE,iBAAiB;IACvB,IAAI,EAAE,0BAA0B;IAChC,QAAQ,EAAE,wFAAwF;IAClG,GAAG,CAAC,GAAG,EAAE,GAAG;QACV,MAAM,QAAQ,GAAkB,EAAE,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,0CAA0C,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;aAChI,CAAC;YACJ,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;YAC7C,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,WAAW;gBAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,oCAAoC,IAAI,gBAAgB,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnL,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/E,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW;gBAAE,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,qCAAqC,GAAG,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YAClL,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,wDAAwD,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QACvN,CAAC;;YAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,oDAAoD,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QACvH,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YACxF,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;YACvC,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,UAAU;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,iDAAiD,GAAG,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;QACpK,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,kCAAkC,GAAG,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1G,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;QACnF,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,GAAG,GAAG,MAAM,CAAC;YACzB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC/B,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;gBACxF,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBACrD,IAAI,GAAG;oBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,6CAA6C,GAAG,CAAC,CAAC,CAAC,oCAAoC,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC1K,CAAC;QACH,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,gCAAgC,CAAC,CAAC,CAAC,oFAAoF,EAAE,QAAQ,EAAE,CAAC;IAC5L,CAAC;CACF,CAAC"}

package/dist/rules/demo-person-org-distinct.d.ts

@@ -0,0 +1,4 @@
+import type { DoctorConfig } from '../config.js';
+import type { DoctorRule } from './types.js';
+export declare const demoPersonOrgDistinct: DoctorRule<DoctorConfig['demoPersonOrgDistinct']>;
+//# sourceMappingURL=demo-person-org-distinct.d.ts.map

package/dist/rules/demo-person-org-distinct.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"demo-person-org-distinct.d.ts","sourceRoot":"","sources":["../../src/rules/demo-person-org-distinct.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAe,MAAM,YAAY,CAAC;AAI1D,eAAO,MAAM,qBAAqB,EAAE,UAAU,CAAC,YAAY,CAAC,uBAAuB,CAAC,CAmBnF,CAAC"}