@agenticprimitives/devkit 0.0.0-alpha.1

package/dist/rules/demo-person-org-distinct.js

@@ -0,0 +1,26 @@
+export const demoPersonOrgDistinct = {
+    id: 'demo-person-org-distinct',
+    spec: 'ADR-0046',
+    twin: 'check:demo-person-org-distinct',
+    describe: 'a person SA is never also their organization SA',
+    run(ctx, cfg) {
+        if (!ctx.exists(cfg.roster))
+            return { status: 'error', summary: `roster ${cfg.roster} is missing`, findings: [{ file: cfg.roster, message: 'roster of record not found', tag: 'missing' }] };
+        const roster = JSON.parse(ctx.read(cfg.roster));
+        const findings = [];
+        for (const [handle, p] of Object.entries(roster)) {
+            const person = (p.sa ?? '').toLowerCase();
+            if (!/^0x[0-9a-f]{40}$/.test(person)) {
+                findings.push({ file: cfg.roster, message: `${handle}: persona.sa is not an address`, tag: 'shape' });
+                continue;
+            }
+            for (const org of p.custodies ?? []) {
+                const sa = (org.sa ?? '').toLowerCase();
+                if (sa && sa === person)
+                    findings.push({ file: cfg.roster, message: `${handle}: org "${org.name ?? sa}" reuses the person SA — deploy a distinct org`, tag: 'reuse' });
+            }
+        }
+        return { summary: findings.length ? `${findings.length} persona(s) reuse a person SA as an org` : `${Object.keys(roster).length} personas, every org SA distinct`, findings };
+    },
+};
+//# sourceMappingURL=demo-person-org-distinct.js.map

package/dist/rules/demo-person-org-distinct.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"demo-person-org-distinct.js","sourceRoot":"","sources":["../../src/rules/demo-person-org-distinct.ts"],"names":[],"mappings":"AAOA,MAAM,CAAC,MAAM,qBAAqB,GAAsD;IACtF,EAAE,EAAE,0BAA0B;IAC9B,IAAI,EAAE,UAAU;IAChB,IAAI,EAAE,gCAAgC;IACtC,QAAQ,EAAE,iDAAiD;IAC3D,GAAG,CAAC,GAAG,EAAE,GAAG;QACV,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,GAAG,CAAC,MAAM,aAAa,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,4BAA4B,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QAC7L,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAW,CAAC;QAC1D,MAAM,QAAQ,GAAkB,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACjD,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAC1C,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,gCAAgC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC1J,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;gBACpC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;gBACxC,IAAI,EAAE,IAAI,EAAE,KAAK,MAAM;oBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,UAAU,GAAG,CAAC,IAAI,IAAI,EAAE,gDAAgD,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;YACzK,CAAC;QACH,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,yCAAyC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,kCAAkC,EAAE,QAAQ,EAAE,CAAC;IAChL,CAAC;CACF,CAAC"}

package/dist/rules/fail-open-knobs.d.ts

@@ -0,0 +1,4 @@
+import type { DoctorConfig } from '../config.js';
+import type { DoctorRule } from './types.js';
+export declare const failOpenKnobs: DoctorRule<DoctorConfig['failOpenKnobs']>;
+//# sourceMappingURL=fail-open-knobs.d.ts.map

package/dist/rules/fail-open-knobs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fail-open-knobs.d.ts","sourceRoot":"","sources":["../../src/rules/fail-open-knobs.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAe,MAAM,YAAY,CAAC;AAqB1D,eAAO,MAAM,aAAa,EAAE,UAAU,CAAC,YAAY,CAAC,eAAe,CAAC,CAgCnE,CAAC"}

package/dist/rules/fail-open-knobs.js

@@ -0,0 +1,64 @@
+const KNOBS = [
+    { id: 'allowUnboundSessionToken', re: /allowUnboundSessionToken:\s*true/, what: 'accepts an UNBOUND (non-DEL-001) session token' },
+    { id: 'allowUnsignedGrant', re: /allowUnsignedGrant:\s*true/, what: 'accepts a DecryptGrant with no signature verifier' },
+    { id: 'allowUnboundGrant', re: /allowUnboundGrant:\s*true/, what: 'accepts a grant with no delegation-hash binding' },
+    { id: 'allowUnsignedMandate', re: /allowUnsignedMandate:\s*true/, what: 'settles a payment with no mandate signature' },
+    { id: 'revocationFailMode-open', re: /revocationFailMode:\s*'open'/, what: 'tolerates an unconfirmable revocation read' },
+    { id: 'requireDeployed-false', re: /requireDeployed:\s*false/, what: 'verifies a counterfactual (undeployed) delegator' },
+    { id: 'allowUnresolvedStatus', re: /allowUnresolvedStatus:\s*true/, what: 'accepts a status-bearing VC without resolving revocation' },
+    { id: 'developmentMode', re: /developmentMode:\s*true/, what: 'skips the connect-auth iss/aud production gate' },
+];
+const ENV_KNOBS = [
+    { id: 'DEMO_OAUTH_MINT_ENABLED', re: /^\s*DEMO_OAUTH_MINT_ENABLED\s*=\s*"true"/, what: 'enables an open token demo mint' },
+    { id: 'DEMO_VAULT_PROVISION_ENABLED', re: /^\s*DEMO_VAULT_PROVISION_ENABLED\s*=\s*"true"/, what: 'registers the admin-credential KEK provision route' },
+    { id: 'DEMO_VAULT_PROVISION_SKIP_PROOF', re: /^\s*DEMO_VAULT_PROVISION_SKIP_PROOF\s*=\s*"true"/, what: 'skips the owner-control proof on the KEK provision route' },
+    { id: 'skip-proof-generic', re: /^\s*\w*_SKIP_(PROOF|AUTH|SIG\w*)\s*=\s*"true"/, what: 'a *_SKIP_PROOF/_AUTH env flag disabling an authority check' },
+    { id: 'bypass-generic', re: /^\s*\w*_BYPASS\w*\s*=\s*"true"/, what: 'a *_BYPASS env flag disabling a gate' },
+];
+const SKIP = new Set(['node_modules', 'dist', '.wrangler']);
+export const failOpenKnobs = {
+    id: 'fail-open-knobs',
+    spec: 'ADR-0045',
+    twin: 'check:fail-open-knobs',
+    describe: 'every fail-open knob is allow-listed by name with a reason',
+    run(ctx, cfg) {
+        const found = [];
+        let scanned = 0;
+        for (const root of cfg.roots) {
+            for (const abs of ctx.walk(root, { skipDirs: SKIP, file: (n) => (/\.(ts|tsx|mjs)$/.test(n) && !/\.test\.|\.spec\./.test(n)) || n === 'wrangler.toml' })) {
+                scanned += 1;
+                const file = ctx.rel(abs);
+                const isToml = file.endsWith('wrangler.toml');
+                ctx.read(file).split('\n').forEach((ln, i) => {
+                    const t = ln.trimStart();
+                    if (isToml) {
+                        if (t.startsWith('#'))
+                            return;
+                        for (const k of ENV_KNOBS)
+                            if (k.re.test(ln)) {
+                                found.push({ file, knob: k.id, line: i + 1, what: k.what });
+                                break;
+                            }
+                        return;
+                    }
+                    if (t.startsWith('//') || t.startsWith('*'))
+                        return;
+                    for (const k of KNOBS)
+                        if (k.re.test(ln))
+                            found.push({ file, knob: k.id, line: i + 1, what: k.what });
+                });
+            }
+        }
+        const allowed = (file, knob) => cfg.allowlist.some((a) => a.file === file && a.knob === knob);
+        const findings = [];
+        for (const f of found)
+            if (!allowed(f.file, f.knob))
+                findings.push({ file: f.file, line: f.line, message: `${f.knob} — ${f.what} (not allow-listed)`, tag: f.knob });
+        const used = new Set(found.map((f) => `${f.file}::${f.knob}`));
+        for (const a of cfg.allowlist)
+            if (!used.has(`${a.file}::${a.knob}`))
+                findings.push({ file: a.file, message: `${a.knob} — STALE allow-list entry, the knob is no longer present (tighten the allow-list)`, tag: 'stale' });
+        return { summary: findings.length ? `${findings.length} un-allow-listed or stale knob(s)` : `${scanned} files, ${found.length} knob occurrence(s), all allow-listed`, findings };
+    },
+};
+//# sourceMappingURL=fail-open-knobs.js.map

package/dist/rules/fail-open-knobs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fail-open-knobs.js","sourceRoot":"","sources":["../../src/rules/fail-open-knobs.ts"],"names":[],"mappings":"AAMA,MAAM,KAAK,GAA4D;IACrE,EAAE,EAAE,EAAE,0BAA0B,EAAE,EAAE,EAAE,kCAAkC,EAAE,IAAI,EAAE,gDAAgD,EAAE;IAClI,EAAE,EAAE,EAAE,oBAAoB,EAAE,EAAE,EAAE,4BAA4B,EAAE,IAAI,EAAE,mDAAmD,EAAE;IACzH,EAAE,EAAE,EAAE,mBAAmB,EAAE,EAAE,EAAE,2BAA2B,EAAE,IAAI,EAAE,iDAAiD,EAAE;IACrH,EAAE,EAAE,EAAE,sBAAsB,EAAE,EAAE,EAAE,8BAA8B,EAAE,IAAI,EAAE,6CAA6C,EAAE;IACvH,EAAE,EAAE,EAAE,yBAAyB,EAAE,EAAE,EAAE,8BAA8B,EAAE,IAAI,EAAE,4CAA4C,EAAE;IACzH,EAAE,EAAE,EAAE,uBAAuB,EAAE,EAAE,EAAE,0BAA0B,EAAE,IAAI,EAAE,kDAAkD,EAAE;IACzH,EAAE,EAAE,EAAE,uBAAuB,EAAE,EAAE,EAAE,+BAA+B,EAAE,IAAI,EAAE,0DAA0D,EAAE;IACtI,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,yBAAyB,EAAE,IAAI,EAAE,gDAAgD,EAAE;CACjH,CAAC;AACF,MAAM,SAAS,GAA4D;IACzE,EAAE,EAAE,EAAE,yBAAyB,EAAE,EAAE,EAAE,0CAA0C,EAAE,IAAI,EAAE,iCAAiC,EAAE;IAC1H,EAAE,EAAE,EAAE,8BAA8B,EAAE,EAAE,EAAE,+CAA+C,EAAE,IAAI,EAAE,oDAAoD,EAAE;IACvJ,EAAE,EAAE,EAAE,iCAAiC,EAAE,EAAE,EAAE,kDAAkD,EAAE,IAAI,EAAE,0DAA0D,EAAE;IACnK,EAAE,EAAE,EAAE,oBAAoB,EAAE,EAAE,EAAE,+CAA+C,EAAE,IAAI,EAAE,4DAA4D,EAAE;IACrJ,EAAE,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,gCAAgC,EAAE,IAAI,EAAE,sCAAsC,EAAE;CAC7G,CAAC;AACF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;AAE5D,MAAM,CAAC,MAAM,aAAa,GAA8C;IACtE,EAAE,EAAE,iBAAiB;IACrB,IAAI,EAAE,UAAU;IAChB,IAAI,EAAE,uBAAuB;IAC7B,QAAQ,EAAE,4DAA4D;IACtE,GAAG,CAAC,GAAG,EAAE,GAAG;QACV,MAAM,KAAK,GAAsE,EAAE,CAAC;QACpF,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YAC7B,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,eAAe,EAAE,CAAC,EAAE,CAAC;gBACxJ,OAAO,IAAI,CAAC,CAAC;gBACb,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;gBAC9C,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE;oBAC3C,MAAM,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;oBACzB,IAAI,MAAM,EAAE,CAAC;wBACX,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;4BAAE,OAAO;wBAC9B,KAAK,MAAM,CAAC,IAAI,SAAS;4BAAE,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gCAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gCAAC,MAAM;4BAAC,CAAC;wBACrH,OAAO;oBACT,CAAC;oBACD,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;wBAAE,OAAO;oBACpD,KAAK,MAAM,CAAC,IAAI,KAAK;wBAAE,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;4BAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBACxG,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAC9G,MAAM,QAAQ,GAAkB,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,IAAI,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACrK,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC/D,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,mFAAmF,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3N,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,mCAAmC,CAAC,CAAC,CAAC,GAAG,OAAO,WAAW,KAAK,CAAC,MAAM,uCAAuC,EAAE,QAAQ,EAAE,CAAC;IACnL,CAAC;CACF,CAAC"}

package/dist/rules/index.d.ts

@@ -0,0 +1,10 @@
+import type { DoctorConfig } from '../config.js';
+import type { DoctorRule } from './types.js';
+/** A rule paired with the config section it reads. */
+export interface RegisteredRule<K extends keyof DoctorConfig = keyof DoctorConfig> {
+    rule: DoctorRule<DoctorConfig[K]>;
+    section: K;
+}
+export declare const DOCTOR_RULES: ReadonlyArray<RegisteredRule>;
+export declare const RULE_IDS: readonly string[];
+//# sourceMappingURL=index.d.ts.map

package/dist/rules/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/rules/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAajD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,sDAAsD;AACtD,MAAM,WAAW,cAAc,CAAC,CAAC,SAAS,MAAM,YAAY,GAAG,MAAM,YAAY;IAAI,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IAAC,OAAO,EAAE,CAAC,CAAA;CAAE;AAIpI,eAAO,MAAM,YAAY,EAAE,aAAa,CAAC,cAAc,CAarB,CAAC;AAEnC,eAAO,MAAM,QAAQ,EAAE,SAAS,MAAM,EAAuC,CAAC"}

package/dist/rules/index.js

@@ -0,0 +1,29 @@
+import { webNoDirectMcp } from './web-no-direct-mcp.js';
+import { noPrivateKeys } from './no-private-keys.js';
+import { noHmacHomeBridge } from './no-hmac-home-bridge.js';
+import { noCrossSubjectVaultReads } from './no-cross-subject-vault-reads.js';
+import { failOpenKnobs } from './fail-open-knobs.js';
+import { internalMarkerSplit } from './internal-marker-split.js';
+import { custodianCoverage } from './custodian-coverage.js';
+import { archetypeCatalog } from './archetype-catalog.js';
+import { capabilityVocabulary } from './capability-vocabulary.js';
+import { demoPersonOrgDistinct } from './demo-person-org-distinct.js';
+import { rulesDrift } from './rules-drift.js';
+import { lockCoherent } from './lock-coherent.js';
+const entry = (rule, section) => ({ rule, section });
+export const DOCTOR_RULES = [
+    entry(webNoDirectMcp, 'webNoDirectMcp'),
+    entry(noPrivateKeys, 'noPrivateKeys'),
+    entry(noHmacHomeBridge, 'noHmacHomeBridge'),
+    entry(noCrossSubjectVaultReads, 'noCrossSubjectVaultReads'),
+    entry(failOpenKnobs, 'failOpenKnobs'),
+    entry(internalMarkerSplit, 'internalMarkerSplit'),
+    entry(custodianCoverage, 'custodianCoverage'),
+    entry(archetypeCatalog, 'archetypeCatalog'),
+    entry(capabilityVocabulary, 'capabilityVocabulary'),
+    entry(demoPersonOrgDistinct, 'demoPersonOrgDistinct'),
+    entry(rulesDrift, 'rulesDrift'),
+    entry(lockCoherent, 'lockCoherent'),
+];
+export const RULE_IDS = DOCTOR_RULES.map((r) => r.rule.id);
+//# sourceMappingURL=index.js.map

package/dist/rules/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/rules/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAMlD,MAAM,KAAK,GAAG,CAA+B,IAAiC,EAAE,OAAU,EAAqB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAEtI,MAAM,CAAC,MAAM,YAAY,GAAkC;IACzD,KAAK,CAAC,cAAc,EAAE,gBAAgB,CAAC;IACvC,KAAK,CAAC,aAAa,EAAE,eAAe,CAAC;IACrC,KAAK,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;IAC3C,KAAK,CAAC,wBAAwB,EAAE,0BAA0B,CAAC;IAC3D,KAAK,CAAC,aAAa,EAAE,eAAe,CAAC;IACrC,KAAK,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;IACjD,KAAK,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;IAC7C,KAAK,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;IAC3C,KAAK,CAAC,oBAAoB,EAAE,sBAAsB,CAAC;IACnD,KAAK,CAAC,qBAAqB,EAAE,uBAAuB,CAAC;IACrD,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC;IAC/B,KAAK,CAAC,YAAY,EAAE,cAAc,CAAC;CACH,CAAC;AAEnC,MAAM,CAAC,MAAM,QAAQ,GAAsB,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC"}

package/dist/rules/internal-marker-split.d.ts

@@ -0,0 +1,4 @@
+import type { DoctorConfig } from '../config.js';
+import type { DoctorRule } from './types.js';
+export declare const internalMarkerSplit: DoctorRule<DoctorConfig['internalMarkerSplit']>;
+//# sourceMappingURL=internal-marker-split.d.ts.map

package/dist/rules/internal-marker-split.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-marker-split.d.ts","sourceRoot":"","sources":["../../src/rules/internal-marker-split.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAe,MAAM,YAAY,CAAC;AAE1D,eAAO,MAAM,mBAAmB,EAAE,UAAU,CAAC,YAAY,CAAC,qBAAqB,CAAC,CA0B/E,CAAC"}

package/dist/rules/internal-marker-split.js

@@ -0,0 +1,31 @@
+export const internalMarkerSplit = {
+    id: 'internal-marker-split',
+    spec: 'spec 341 §7',
+    twin: 'check:internal-marker-split',
+    describe: 'the in-Worker marker and the custody secret stay separate',
+    run(ctx, cfg) {
+        const findings = [];
+        const reads = new Map();
+        const secretRe = new RegExp(cfg.secret.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'));
+        const markerRe = new RegExp(`'${cfg.marker}'\\s*:`);
+        for (const abs of ctx.walk(cfg.src, { skipDirs: new Set(), file: (n) => n.endsWith('.ts') })) {
+            const name = abs.slice(ctx.abs(cfg.src).length + 1);
+            const file = ctx.rel(abs);
+            ctx.read(file).split('\n').forEach((text, i) => {
+                if (markerRe.test(text) && secretRe.test(text))
+                    findings.push({ file, line: i + 1, message: 'marker header built from the CUSTODY secret', tag: 'merged' });
+                const t = text.trimStart();
+                if (secretRe.test(text) && !/\?:\s*string/.test(text) && !t.startsWith('//') && !t.startsWith('*'))
+                    reads.set(name, [...(reads.get(name) ?? []), { line: i + 1 }]);
+            });
+        }
+        for (const [name, sites] of reads) {
+            const b = cfg.budget[name] ?? 0;
+            const budget = b === 'unbounded' ? Number.POSITIVE_INFINITY : b;
+            if (sites.length > budget)
+                findings.push({ file: `${cfg.src}/${name}`, message: `${sites.length} custody-secret read(s), budget ${b} (lines ${sites.map((s) => s.line).join(', ')})`, tag: 'budget' });
+        }
+        return { summary: findings.length ? `${findings.length} marker/secret problem(s)` : 'the in-Worker marker and the custody secret are separate', findings };
+    },
+};
+//# sourceMappingURL=internal-marker-split.js.map

package/dist/rules/internal-marker-split.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-marker-split.js","sourceRoot":"","sources":["../../src/rules/internal-marker-split.ts"],"names":[],"mappings":"AAKA,MAAM,CAAC,MAAM,mBAAmB,GAAoD;IAClF,EAAE,EAAE,uBAAuB;IAC3B,IAAI,EAAE,aAAa;IACnB,IAAI,EAAE,6BAA6B;IACnC,QAAQ,EAAE,2DAA2D;IACrE,GAAG,CAAC,GAAG,EAAE,GAAG;QACV,MAAM,QAAQ,GAAkB,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAmC,CAAC;QACzD,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/E,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,CAAC;QACpD,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;YAC7F,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACpD,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1B,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;gBAC7C,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,6CAA6C,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC5J,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;gBAC3B,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YACrK,CAAC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,MAAM,GAAG,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;YAChE,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM;gBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,mCAAmC,CAAC,WAAW,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzM,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,2BAA2B,CAAC,CAAC,CAAC,0DAA0D,EAAE,QAAQ,EAAE,CAAC;IAC7J,CAAC;CACF,CAAC"}

package/dist/rules/lock-coherent.d.ts

@@ -0,0 +1,4 @@
+import type { DoctorConfig } from '../config.js';
+import type { DoctorRule } from './types.js';
+export declare const lockCoherent: DoctorRule<DoctorConfig['lockCoherent']>;
+//# sourceMappingURL=lock-coherent.d.ts.map

package/dist/rules/lock-coherent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock-coherent.d.ts","sourceRoot":"","sources":["../../src/rules/lock-coherent.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAe,MAAM,YAAY,CAAC;AAK1D,eAAO,MAAM,YAAY,EAAE,UAAU,CAAC,YAAY,CAAC,cAAc,CAAC,CA6BjE,CAAC"}

package/dist/rules/lock-coherent.js

@@ -0,0 +1,39 @@
+import { workspaceManifests } from '../workspace.js';
+const EXACT = /^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/;
+export const lockCoherent = {
+    id: 'lock-coherent',
+    spec: 'spec 399 §3.1 / §5.2',
+    describe: 'every @agenticprimitives/* pin is exact and the set is coherent',
+    run(ctx, cfg) {
+        const findings = [];
+        const seen = new Map(); // dep → version → manifests
+        let pins = 0;
+        for (const m of workspaceManifests(ctx.root)) {
+            for (const field of ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies']) {
+                for (const [dep, spec] of Object.entries(m.json[field] ?? {})) {
+                    if (!dep.startsWith(cfg.scope))
+                        continue;
+                    pins += 1;
+                    if (spec.startsWith('workspace:')) {
+                        if (!cfg.allowWorkspace)
+                            findings.push({ file: m.file, message: `${dep}: workspace alias "${spec}" — a product repo pins a published exact version (ADR-0063 §2)`, tag: 'workspace' });
+                        continue;
+                    }
+                    if (!EXACT.test(spec)) {
+                        findings.push({ file: m.file, message: `${dep}: "${spec}" is a range, not an exact version`, tag: 'range' });
+                        continue;
+                    }
+                    const byVersion = seen.get(dep) ?? new Map();
+                    byVersion.set(spec, [...(byVersion.get(spec) ?? []), m.file]);
+                    seen.set(dep, byVersion);
+                }
+            }
+        }
+        for (const [dep, byVersion] of seen) {
+            if (byVersion.size > 1)
+                findings.push({ message: `${dep}: pinned at ${byVersion.size} different versions (${[...byVersion.entries()].map(([v, fs]) => `${v} in ${fs.join(', ')}`).join('; ')}) — one coherent set`, tag: 'incoherent' });
+        }
+        return { summary: findings.length ? `${findings.length} pin problem(s)` : `${pins} scoped pin(s), exact and coherent`, findings };
+    },
+};
+//# sourceMappingURL=lock-coherent.js.map

package/dist/rules/lock-coherent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock-coherent.js","sourceRoot":"","sources":["../../src/rules/lock-coherent.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD,MAAM,KAAK,GAAG,mCAAmC,CAAC;AAElD,MAAM,CAAC,MAAM,YAAY,GAA6C;IACpE,EAAE,EAAE,eAAe;IACnB,IAAI,EAAE,sBAAsB;IAC5B,QAAQ,EAAE,iEAAiE;IAC3E,GAAG,CAAC,GAAG,EAAE,GAAG;QACV,MAAM,QAAQ,GAAkB,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAiC,CAAC,CAAC,4BAA4B;QACnF,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,KAAK,MAAM,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,KAAK,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,sBAAsB,CAAU,EAAE,CAAC;gBAC7G,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;oBAC9D,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC;wBAAE,SAAS;oBACzC,IAAI,IAAI,CAAC,CAAC;oBACV,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;wBAClC,IAAI,CAAC,GAAG,CAAC,cAAc;4BAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,GAAG,sBAAsB,IAAI,iEAAiE,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC;wBACvL,SAAS;oBACX,CAAC;oBACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,GAAG,MAAM,IAAI,oCAAoC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;wBAAC,SAAS;oBAAC,CAAC;oBAClJ,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAoB,CAAC;oBAC/D,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;oBAC9D,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBAC3B,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC;YACpC,IAAI,SAAS,CAAC,IAAI,GAAG,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,eAAe,SAAS,CAAC,IAAI,wBAAwB,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3O,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,iBAAiB,CAAC,CAAC,CAAC,GAAG,IAAI,oCAAoC,EAAE,QAAQ,EAAE,CAAC;IACpI,CAAC;CACF,CAAC"}

package/dist/rules/no-cross-subject-vault-reads.d.ts

@@ -0,0 +1,4 @@
+import type { DoctorConfig } from '../config.js';
+import type { DoctorRule } from './types.js';
+export declare const noCrossSubjectVaultReads: DoctorRule<DoctorConfig['noCrossSubjectVaultReads']>;
+//# sourceMappingURL=no-cross-subject-vault-reads.d.ts.map

package/dist/rules/no-cross-subject-vault-reads.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-cross-subject-vault-reads.d.ts","sourceRoot":"","sources":["../../src/rules/no-cross-subject-vault-reads.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD,OAAO,KAAK,EAAE,UAAU,EAAe,MAAM,YAAY,CAAC;AAI1D,eAAO,MAAM,wBAAwB,EAAE,UAAU,CAAC,YAAY,CAAC,0BAA0B,CAAC,CAyBzF,CAAC"}

package/dist/rules/no-cross-subject-vault-reads.js

@@ -0,0 +1,35 @@
+import { stripComments } from '../fs.js';
+const READS = /\b(readRecords|readSubjectRecord|survey|interactionsOp|directory|readInbox|vaultGet|queryRecords)\s*[(?.]/;
+export const noCrossSubjectVaultReads = {
+    id: 'no-cross-subject-vault-reads',
+    spec: 'spec 366 R3',
+    twin: 'check:no-cross-subject-vault-reads',
+    describe: 'a read tool reads only at its own subject',
+    run(ctx, cfg) {
+        const findings = [];
+        const gateRe = new RegExp(`\\b${cfg.gate}\\(`);
+        let checked = 0;
+        for (const root of cfg.roots) {
+            if (!ctx.exists(root))
+                continue;
+            for (const abs of ctx.walk(root, { file: (n) => n.endsWith('.ts') && !n.endsWith('.test.ts') })) {
+                const file = ctx.rel(abs);
+                if (abs.slice(ctx.abs(root).length + 1).includes('/'))
+                    continue; // top level of the root only, like the twin
+                const name = file.split('/').pop() ?? '';
+                if (cfg.exemptFiles.includes(name))
+                    continue;
+                const src = stripComments(ctx.read(file));
+                if (!/^\s*subject:\s*'[a-zA-Z]+'/m.test(src))
+                    continue;
+                if (!READS.test(src))
+                    continue;
+                checked += 1;
+                if (!gateRe.test(src))
+                    findings.push({ file, message: `declares a subject and reads records, but never passes the subject through ${cfg.gate}()`, tag: 'cross-subject' });
+            }
+        }
+        return { summary: findings.length ? `${findings.length} module(s) read records at a subject they never gate` : `${checked} subject-declaring record-reading module(s) read only at their own subject`, findings };
+    },
+};
+//# sourceMappingURL=no-cross-subject-vault-reads.js.map

package/dist/rules/no-cross-subject-vault-reads.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-cross-subject-vault-reads.js","sourceRoot":"","sources":["../../src/rules/no-cross-subject-vault-reads.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,MAAM,KAAK,GAAG,2GAA2G,CAAC;AAE1H,MAAM,CAAC,MAAM,wBAAwB,GAAyD;IAC5F,EAAE,EAAE,8BAA8B;IAClC,IAAI,EAAE,aAAa;IACnB,IAAI,EAAE,oCAAoC;IAC1C,QAAQ,EAAE,2CAA2C;IACrD,GAAG,CAAC,GAAG,EAAE,GAAG;QACV,MAAM,QAAQ,GAAkB,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC;QAC/C,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YAC7B,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,SAAS;YAChC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;gBAChG,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC1B,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;oBAAE,SAAS,CAAC,4CAA4C;gBAC7G,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;gBACzC,IAAI,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAC7C,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC1C,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC;oBAAE,SAAS;gBACvD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAC/B,OAAO,IAAI,CAAC,CAAC;gBACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;oBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,8EAA8E,GAAG,CAAC,IAAI,IAAI,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,CAAC;YAC5K,CAAC;QACH,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,sDAAsD,CAAC,CAAC,CAAC,GAAG,OAAO,4EAA4E,EAAE,QAAQ,EAAE,CAAC;IACpN,CAAC;CACF,CAAC"}

package/dist/rules/no-hmac-home-bridge.d.ts

@@ -0,0 +1,4 @@
+import type { DoctorConfig } from '../config.js';
+import type { DoctorRule } from './types.js';
+export declare const noHmacHomeBridge: DoctorRule<DoctorConfig['noHmacHomeBridge']>;
+//# sourceMappingURL=no-hmac-home-bridge.d.ts.map

package/dist/rules/no-hmac-home-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-hmac-home-bridge.d.ts","sourceRoot":"","sources":["../../src/rules/no-hmac-home-bridge.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAe,MAAM,YAAY,CAAC;AAE1D,eAAO,MAAM,gBAAgB,EAAE,UAAU,CAAC,YAAY,CAAC,kBAAkB,CAAC,CA8BzE,CAAC"}

package/dist/rules/no-hmac-home-bridge.js

@@ -0,0 +1,40 @@
+export const noHmacHomeBridge = {
+    id: 'no-hmac-home-bridge',
+    spec: 'spec 341 §7 / ADR-0059 / ADR-0041',
+    twin: 'check:no-hmac-home-bridge',
+    describe: 'the control plane never rides a shared secret; the bridge-call ratchet only falls',
+    run(ctx, cfg) {
+        const esc = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        // `(<[^()]*>)?` is load-bearing: a call with an explicit type argument is still a call.
+        const hmacRe = new RegExp(`\\b${esc(cfg.hmacCall)}\\s*(<[^()]*>)?\\s*\\(`);
+        const rpcRe = new RegExp(`\\b${esc(cfg.sessionRpcCall)}\\s*(<[^()]*>)?\\s*\\(`);
+        const hits = [];
+        for (const abs of ctx.walk(cfg.dir, { skipDirs: new Set(['node_modules', '.next', 'dist']), file: (n) => /\.(ts|tsx)$/.test(n) && !/\.test\.tsx?$/.test(n) })) {
+            const file = ctx.rel(abs);
+            ctx.read(file).split('\n').forEach((text, i) => {
+                if (hmacRe.test(text))
+                    hits.push({ file, line: i + 1, kind: 'hmac', message: `${cfg.hmacCall}( call site [hmac]`, tag: 'hmac' });
+                if (rpcRe.test(text))
+                    hits.push({ file, line: i + 1, kind: 'sessionRpc', message: `${cfg.sessionRpcCall}( call site [sessionRpc]`, tag: 'sessionRpc' });
+            });
+        }
+        const hmac = hits.filter((h) => h.kind === 'hmac').length;
+        const sessionRpc = hits.length - hmac;
+        const total = hits.length;
+        const findings = [];
+        const notes = [];
+        if (hmac > cfg.ceilings.hmac)
+            for (const h of hits.filter((x) => x.kind === 'hmac'))
+                findings.push(h);
+        if (total > cfg.ceilings.total)
+            for (const h of hits)
+                findings.push(h);
+        if (hmac < cfg.ceilings.hmac)
+            notes.push(`hmac ${hmac}/${cfg.ceilings.hmac} — lower the ceiling`);
+        if (total < cfg.ceilings.total)
+            notes.push(`total ${total}/${cfg.ceilings.total} — lower the ceiling`);
+        const counts = `hmac ${hmac}/${cfg.ceilings.hmac}, sessionRpc ${sessionRpc}, total ${total}/${cfg.ceilings.total}`;
+        return { summary: findings.length ? `a bridge count ROSE (${counts})` : counts, findings, notes };
+    },
+};
+//# sourceMappingURL=no-hmac-home-bridge.js.map

package/dist/rules/no-hmac-home-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-hmac-home-bridge.js","sourceRoot":"","sources":["../../src/rules/no-hmac-home-bridge.ts"],"names":[],"mappings":"AAOA,MAAM,CAAC,MAAM,gBAAgB,GAAiD;IAC5E,EAAE,EAAE,qBAAqB;IACzB,IAAI,EAAE,mCAAmC;IACzC,IAAI,EAAE,2BAA2B;IACjC,QAAQ,EAAE,mFAAmF;IAC7F,GAAG,CAAC,GAAG,EAAE,GAAG;QACV,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QACpE,wFAAwF;QACxF,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,wBAAwB,CAAC,CAAC;QAChF,MAAM,IAAI,GAAyD,EAAE,CAAC;QACtE,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YAC9J,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1B,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;gBAC7C,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,QAAQ,oBAAoB,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;gBACjI,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,cAAc,0BAA0B,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;YAC1J,CAAC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;QAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,MAAM,QAAQ,GAAkB,EAAE,CAAC;QACnC,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI;YAAE,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtG,IAAI,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK;YAAE,KAAK,MAAM,CAAC,IAAI,IAAI;gBAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvE,IAAI,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,sBAAsB,CAAC,CAAC;QAClG,IAAI,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,sBAAsB,CAAC,CAAC;QACvG,MAAM,MAAM,GAAG,QAAQ,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,gBAAgB,UAAU,WAAW,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnH,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,wBAAwB,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACpG,CAAC;CACF,CAAC"}

package/dist/rules/no-private-keys.d.ts

@@ -0,0 +1,4 @@
+import type { DoctorConfig } from '../config.js';
+import type { DoctorRule } from './types.js';
+export declare const noPrivateKeys: DoctorRule<DoctorConfig['noPrivateKeys']>;
+//# sourceMappingURL=no-private-keys.d.ts.map

package/dist/rules/no-private-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-private-keys.d.ts","sourceRoot":"","sources":["../../src/rules/no-private-keys.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAe,MAAM,YAAY,CAAC;AAQ1D,eAAO,MAAM,aAAa,EAAE,UAAU,CAAC,YAAY,CAAC,eAAe,CAAC,CAkCnE,CAAC"}

package/dist/rules/no-private-keys.js

@@ -0,0 +1,45 @@
+const PATTERNS = [
+    { re: /\b[A-Z][A-Z0-9_]*_PRIVATE_KEY\b/g, what: 'env-var name containing _PRIVATE_KEY — source signing via a KMS-backed signer, not raw keys', tag: 'env-name' },
+    { re: /privateKeyToAccount\s*\(/g, what: 'privateKeyToAccount(...) — converts a raw private key to an account; key-handling smell', tag: 'private-key-to-account' },
+    { re: /\bgeneratePrivateKey\s*\(/g, what: 'generatePrivateKey() — derive identity via KMS, not a locally minted key', tag: 'generate-private-key' },
+];
+export const noPrivateKeys = {
+    id: 'no-private-keys',
+    spec: 'key-custody doctrine (packages/key-custody)',
+    twin: 'check:no-app-private-keys',
+    describe: 'no raw key material in app source',
+    run(ctx, cfg) {
+        const allowed = new Set(cfg.allowedIn.map((a) => a.file));
+        const tolerated = new Set(cfg.toleratedEnvNames.map((t) => t.name));
+        const files = [];
+        for (const root of cfg.roots) {
+            const tracked = ctx.tracked(root);
+            const list = tracked ?? ctx.walk(root).map((f) => ctx.rel(f));
+            files.push(...list.filter((f) => (f.endsWith('.ts') || f.endsWith('.tsx')) && !f.includes('/test/') && !f.includes('.test.') && !f.includes('/dist/')));
+        }
+        const findings = [];
+        for (const file of files) {
+            if (allowed.has(file))
+                continue;
+            if (!ctx.exists(file))
+                continue;
+            const lines = ctx.read(file).split('\n');
+            for (const p of PATTERNS) {
+                lines.forEach((line, i) => {
+                    const t = line.trim();
+                    if (t.startsWith('//') || t.startsWith('*'))
+                        return;
+                    p.re.lastIndex = 0;
+                    let m;
+                    while ((m = p.re.exec(line)) !== null) {
+                        if (tolerated.has(m[0]))
+                            continue;
+                        findings.push({ file, line: i + 1, message: `"${m[0]}" — ${p.what}`, tag: p.tag });
+                    }
+                });
+            }
+        }
+        return { summary: findings.length ? `${findings.length} private-key smell(s) in app source` : `${files.length} app source files, no private-key smells`, findings };
+    },
+};
+//# sourceMappingURL=no-private-keys.js.map

package/dist/rules/no-private-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-private-keys.js","sourceRoot":"","sources":["../../src/rules/no-private-keys.ts"],"names":[],"mappings":"AAMA,MAAM,QAAQ,GAA6D;IACzE,EAAE,EAAE,EAAE,kCAAkC,EAAE,IAAI,EAAE,6FAA6F,EAAE,GAAG,EAAE,UAAU,EAAE;IAChK,EAAE,EAAE,EAAE,2BAA2B,EAAE,IAAI,EAAE,yFAAyF,EAAE,GAAG,EAAE,wBAAwB,EAAE;IACnK,EAAE,EAAE,EAAE,4BAA4B,EAAE,IAAI,EAAE,0EAA0E,EAAE,GAAG,EAAE,sBAAsB,EAAE;CACpJ,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAA8C;IACtE,EAAE,EAAE,iBAAiB;IACrB,IAAI,EAAE,6CAA6C;IACnD,IAAI,EAAE,2BAA2B;IACjC,QAAQ,EAAE,mCAAmC;IAC7C,GAAG,CAAC,GAAG,EAAE,GAAG;QACV,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,IAAI,GAAG,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9D,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC1J,CAAC;QACD,MAAM,QAAQ,GAAkB,EAAE,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YAChC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,SAAS;YAChC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;oBACxB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;oBACtB,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;wBAAE,OAAO;oBACpD,CAAC,CAAC,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;oBACnB,IAAI,CAAyB,CAAC;oBAC9B,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;wBACtC,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;4BAAE,SAAS;wBAClC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;oBACrF,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,qCAAqC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,0CAA0C,EAAE,QAAQ,EAAE,CAAC;IACtK,CAAC;CACF,CAAC"}

package/dist/rules/rules-drift.d.ts

@@ -0,0 +1,4 @@
+import type { DoctorConfig } from '../config.js';
+import type { DoctorRule } from './types.js';
+export declare const rulesDrift: DoctorRule<DoctorConfig['rulesDrift']>;
+//# sourceMappingURL=rules-drift.d.ts.map

package/dist/rules/rules-drift.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules-drift.d.ts","sourceRoot":"","sources":["../../src/rules/rules-drift.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD,OAAO,KAAK,EAAE,UAAU,EAAe,MAAM,YAAY,CAAC;AAE1D,eAAO,MAAM,UAAU,EAAE,UAAU,CAAC,YAAY,CAAC,YAAY,CAAC,CA+B7D,CAAC"}

package/dist/rules/rules-drift.js

@@ -0,0 +1,46 @@
+import { loadRulesCorpus, projectRules, rulesLockEntries } from '../rules-projection.js';
+export const rulesDrift = {
+    id: 'rules-drift',
+    spec: 'spec 399 §3.4 / ADR-0063 §8',
+    describe: 'projected rules match the pinned source by digest',
+    run(ctx, cfg) {
+        const corpus = loadRulesCorpus({ root: ctx.root, source: cfg.source, hardRulesFrom: cfg.hardRulesFrom });
+        const findings = [];
+        const notes = [];
+        let compared = 0;
+        if (ctx.exists(cfg.lock)) {
+            const lock = JSON.parse(ctx.read(cfg.lock));
+            if (lock.rules) {
+                const now = rulesLockEntries(corpus);
+                for (const [name, digest] of Object.entries(lock.rules)) {
+                    compared += 1;
+                    if (now[name] === undefined)
+                        findings.push({ file: cfg.lock, message: `rule "${name}" is pinned but no longer in the source`, tag: 'lock' });
+                    else if (now[name] !== digest)
+                        findings.push({ file: cfg.lock, message: `rule "${name}" drifted from its pinned digest (${digest} → ${now[name]})`, tag: 'lock' });
+                }
+                for (const name of Object.keys(now))
+                    if (lock.rules[name] === undefined)
+                        findings.push({ file: cfg.lock, message: `rule "${name}" is in the source but not pinned`, tag: 'lock' });
+            }
+            else
+                notes.push(`${cfg.lock} carries no "rules" pins`);
+        }
+        else
+            notes.push(`no ${cfg.lock} — source not pinned`);
+        const projection = projectRules({ root: ctx.root, corpus, cursorRules: cfg.cursorRules, agentsMd: cfg.agentsMd, claudeMd: cfg.claudeMd, write: false });
+        for (const p of projection) {
+            if (p.status === 'unchanged')
+                compared += 1;
+            else if (p.status === 'would-write')
+                findings.push({ file: p.path, message: `projection differs from the source (${p.reason ?? 'content'})`, tag: 'projection' });
+            else if (p.status === 'unmanaged')
+                notes.push(`${p.path}: no managed block — not projected`);
+            else if (p.status === 'absent')
+                notes.push(`${p.path}: absent — not projected`);
+        }
+        const status = findings.length ? 'fail' : compared === 0 ? 'skip' : 'pass';
+        return { status, summary: findings.length ? `${findings.length} drift(s) between source and projection` : compared ? `${compared} pinned/projected rule(s) match the source` : 'nothing pinned or projected here', findings, notes };
+    },
+};
+//# sourceMappingURL=rules-drift.js.map

package/dist/rules/rules-drift.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules-drift.js","sourceRoot":"","sources":["../../src/rules/rules-drift.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAGzF,MAAM,CAAC,MAAM,UAAU,GAA2C;IAChE,EAAE,EAAE,aAAa;IACjB,IAAI,EAAE,6BAA6B;IACnC,QAAQ,EAAE,mDAAmD;IAC7D,GAAG,CAAC,GAAG,EAAE,GAAG;QACV,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC;QACzG,MAAM,QAAQ,GAAkB,EAAE,CAAC;QACnC,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAuC,CAAC;YAClF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACf,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;gBACrC,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBACxD,QAAQ,IAAI,CAAC,CAAC;oBACd,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS;wBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,IAAI,yCAAyC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;yBACxI,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,MAAM;wBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,IAAI,qCAAqC,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;gBACrK,CAAC;gBACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;oBAAE,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS;wBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,IAAI,mCAAmC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;YACrL,CAAC;;gBAAM,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,0BAA0B,CAAC,CAAC;QAC3D,CAAC;;YAAM,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,sBAAsB,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,YAAY,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACxJ,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW;gBAAE,QAAQ,IAAI,CAAC,CAAC;iBACvC,IAAI,CAAC,CAAC,MAAM,KAAK,aAAa;gBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,uCAAuC,CAAC,CAAC,MAAM,IAAI,SAAS,GAAG,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;iBAC7J,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,oCAAoC,CAAC,CAAC;iBACxF,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,0BAA0B,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3E,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,yCAAyC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,4CAA4C,CAAC,CAAC,CAAC,kCAAkC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACvO,CAAC;CACF,CAAC"}

package/dist/rules/types.d.ts

@@ -0,0 +1,50 @@
+export interface RuleFinding {
+    /** Repo-relative file, when the finding is about one. */
+    file?: string;
+    line?: number;
+    message: string;
+    /** A short machine tag within the rule (e.g. the knob id, the pattern name). */
+    tag?: string;
+}
+export type RuleStatus = 'pass' | 'fail' | 'skip' | 'error';
+export interface RuleResult {
+    id: string;
+    status: RuleStatus;
+    /** One sentence a person reads in the table. */
+    summary: string;
+    findings: RuleFinding[];
+    /** Non-failing notes (a ratchet with slack, a skipped input). */
+    notes: string[];
+    ms: number;
+}
+export interface RuleContext {
+    root: string;
+    /** Absolute path under root. */
+    abs(relPath: string): string;
+    rel(absPath: string): string;
+    exists(relPath: string): boolean;
+    read(relPath: string): string;
+    /** Files under a repo-relative dir (absolute paths). */
+    walk(relDir: string, opts?: {
+        skipDirs?: ReadonlySet<string>;
+        file?: (name: string) => boolean;
+    }): string[];
+    /** Git-tracked files under a repo-relative dir, or null outside a checkout. */
+    tracked(relDir: string): string[] | null;
+}
+export interface RuleOutcome {
+    status?: RuleStatus;
+    summary: string;
+    findings?: RuleFinding[];
+    notes?: string[];
+}
+export interface DoctorRule<C = unknown> {
+    id: string;
+    /** Spec / ADR the rule enforces. */
+    spec: string;
+    /** The root check this rule twins (399 §2.3). */
+    twin?: string;
+    describe: string;
+    run(ctx: RuleContext, config: C): RuleOutcome | Promise<RuleOutcome>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/rules/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/rules/types.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,WAAW;IAC1B,yDAAyD;IACzD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAE5D,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,UAAU,CAAC;IACnB,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,iEAAiE;IACjE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,gCAAgC;IAChC,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IAC9B,wDAAwD;IACxD,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;KAAE,GAAG,MAAM,EAAE,CAAC;IAC5G,+EAA+E;IAC/E,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;CAC1C;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,UAAU,CAAC,CAAC,GAAG,OAAO;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,GAAG,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACtE"}

package/dist/rules/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/rules/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/rules/types.ts"],"names":[],"mappings":""}

package/dist/rules/web-no-direct-mcp.d.ts

@@ -0,0 +1,4 @@
+import type { DoctorConfig } from '../config.js';
+import type { DoctorRule } from './types.js';
+export declare const webNoDirectMcp: DoctorRule<DoctorConfig['webNoDirectMcp']>;
+//# sourceMappingURL=web-no-direct-mcp.d.ts.map

package/dist/rules/web-no-direct-mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-no-direct-mcp.d.ts","sourceRoot":"","sources":["../../src/rules/web-no-direct-mcp.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD,OAAO,KAAK,EAAE,UAAU,EAAe,MAAM,YAAY,CAAC;AAS1D,eAAO,MAAM,cAAc,EAAE,UAAU,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAuBrE,CAAC"}