@allocator-one/rcl 4.4.19

package/dist/config/providers.js

@@ -0,0 +1,9 @@
+export const MODEL_PROVIDERS = [
+    'anthropic',
+    'openai',
+    'google',
+    'openrouter',
+    'openai-compat',
+];
+export const MODEL_PROVIDER_SET = new Set(MODEL_PROVIDERS);
+//# sourceMappingURL=providers.js.map

package/dist/config/providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.js","sourceRoot":"","sources":["../../src/config/providers.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,WAAW;IACX,QAAQ;IACR,QAAQ;IACR,YAAY;IACZ,eAAe;CACP,CAAC;AAIX,MAAM,CAAC,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC"}

package/dist/config/schema.d.ts

@@ -0,0 +1,179 @@
+import { z } from 'zod';
+/** Node clamps longer timer delays to 1 ms. */
+export declare const MAX_TIMER_DELAY_MS = 2147483647;
+export declare const SeveritySchema: z.ZodEnum<{
+    critical: "critical";
+    important: "important";
+    minor: "minor";
+    nitpick: "nitpick";
+}>;
+export declare const CategorySchema: z.ZodEnum<{
+    security: "security";
+    correctness: "correctness";
+    "best-practices": "best-practices";
+    tests: "tests";
+    "api-design": "api-design";
+}>;
+export declare const ReviewerPairSchema: z.ZodObject<{
+    model: z.ZodString;
+    role: z.ZodString;
+}, z.core.$strip>;
+export declare const RoleConfigSchema: z.ZodObject<{
+    name: z.ZodString;
+    systemPrompt: z.ZodOptional<z.ZodString>;
+    focus: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    severityBias: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNumber>>;
+}, z.core.$strip>;
+export declare const ThresholdsSchema: z.ZodObject<{
+    minConsensusScore: z.ZodOptional<z.ZodNumber>;
+    minConfidence: z.ZodOptional<z.ZodNumber>;
+    dedupeLineWindow: z.ZodOptional<z.ZodNumber>;
+    jaccardThreshold: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export declare const OutputSchema: z.ZodObject<{
+    terminal: z.ZodOptional<z.ZodBoolean>;
+    json: z.ZodOptional<z.ZodBoolean>;
+    markdown: z.ZodOptional<z.ZodBoolean>;
+    github: z.ZodOptional<z.ZodBoolean>;
+    jsonPath: z.ZodOptional<z.ZodString>;
+    markdownPath: z.ZodOptional<z.ZodString>;
+    belowThresholdAppendix: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const ReasoningEffortSchema: z.ZodEnum<{
+    low: "low";
+    medium: "medium";
+    high: "high";
+}>;
+export declare const VerificationReasoningEffortSchema: z.ZodEnum<{
+    low: "low";
+    medium: "medium";
+    high: "high";
+    xhigh: "xhigh";
+    max: "max";
+}>;
+export type VerificationReasoningEffort = z.infer<typeof VerificationReasoningEffortSchema>;
+/**
+ * Convergence gating (RCL-23). `verified-consensus` (default): a finding
+ * gates only when multi-model, critical, or confirmed with evidence by the verification
+ * pass. `all-findings` restores the legacy behavior where every
+ * critical/important finding gates.
+ */
+export declare const GatingSchema: z.ZodObject<{
+    mode: z.ZodOptional<z.ZodEnum<{
+        "verified-consensus": "verified-consensus";
+        "all-findings": "all-findings";
+    }>>;
+    minModels: z.ZodOptional<z.ZodNumber>;
+    verificationModel: z.ZodOptional<z.ZodString>;
+    verificationReasoningEffort: z.ZodOptional<z.ZodEnum<{
+        low: "low";
+        medium: "medium";
+        high: "high";
+        xhigh: "xhigh";
+        max: "max";
+    }>>;
+    verificationTimeout: z.ZodOptional<z.ZodNumber>;
+    verificationPassTimeout: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+/**
+ * Evidence delivery to Harness (epic IO-12475, section 8.6). `telemetry`
+ * is the payload tier: `off` sends nothing, `envelope` the run header and
+ * stats, `findings` adds findings and calls, `full` (default) also uploads
+ * the JSON and Markdown reports. `parseFailures` opts in to sending a
+ * parse-failed call's raw model answer (fenced code and key-shaped strings
+ * removed, 32 KB cap).
+ */
+export declare const HarnessSchema: z.ZodObject<{
+    telemetry: z.ZodOptional<z.ZodEnum<{
+        off: "off";
+        envelope: "envelope";
+        findings: "findings";
+        full: "full";
+    }>>;
+    parseFailures: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const ConfigSchema: z.ZodObject<{
+    models: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    secondaryModels: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    asyncModels: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    reviewers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        model: z.ZodString;
+        role: z.ZodString;
+    }, z.core.$strip>>>;
+    customRoles: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        systemPrompt: z.ZodOptional<z.ZodString>;
+        focus: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        severityBias: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNumber>>;
+    }, z.core.$strip>>>;
+    thresholds: z.ZodOptional<z.ZodObject<{
+        minConsensusScore: z.ZodOptional<z.ZodNumber>;
+        minConfidence: z.ZodOptional<z.ZodNumber>;
+        dedupeLineWindow: z.ZodOptional<z.ZodNumber>;
+        jaccardThreshold: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>;
+    gating: z.ZodOptional<z.ZodObject<{
+        mode: z.ZodOptional<z.ZodEnum<{
+            "verified-consensus": "verified-consensus";
+            "all-findings": "all-findings";
+        }>>;
+        minModels: z.ZodOptional<z.ZodNumber>;
+        verificationModel: z.ZodOptional<z.ZodString>;
+        verificationReasoningEffort: z.ZodOptional<z.ZodEnum<{
+            low: "low";
+            medium: "medium";
+            high: "high";
+            xhigh: "xhigh";
+            max: "max";
+        }>>;
+        verificationTimeout: z.ZodOptional<z.ZodNumber>;
+        verificationPassTimeout: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>;
+    output: z.ZodOptional<z.ZodObject<{
+        terminal: z.ZodOptional<z.ZodBoolean>;
+        json: z.ZodOptional<z.ZodBoolean>;
+        markdown: z.ZodOptional<z.ZodBoolean>;
+        github: z.ZodOptional<z.ZodBoolean>;
+        jsonPath: z.ZodOptional<z.ZodString>;
+        markdownPath: z.ZodOptional<z.ZodString>;
+        belowThresholdAppendix: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    timeout: z.ZodOptional<z.ZodNumber>;
+    asyncTimeout: z.ZodOptional<z.ZodNumber>;
+    quorumFraction: z.ZodOptional<z.ZodNumber>;
+    maxRetries: z.ZodOptional<z.ZodNumber>;
+    concurrency: z.ZodOptional<z.ZodNumber>;
+    providerConcurrency: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
+        anthropic: "anthropic";
+        openai: "openai";
+        google: "google";
+        openrouter: "openrouter";
+        "openai-compat": "openai-compat";
+    }> & z.core.$partial, z.ZodNumber>>;
+    reasoningEffort: z.ZodOptional<z.ZodEnum<{
+        low: "low";
+        medium: "medium";
+        high: "high";
+    }>>;
+    githubToken: z.ZodOptional<z.ZodString>;
+    context: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    spec: z.ZodOptional<z.ZodString>;
+    focus: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    harness: z.ZodOptional<z.ZodObject<{
+        telemetry: z.ZodOptional<z.ZodEnum<{
+            off: "off";
+            envelope: "envelope";
+            findings: "findings";
+            full: "full";
+        }>>;
+        parseFailures: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type Config = z.infer<typeof ConfigSchema>;
+export type ReviewerPair = z.infer<typeof ReviewerPairSchema>;
+export type RoleConfig = z.infer<typeof RoleConfigSchema>;
+export type Thresholds = z.infer<typeof ThresholdsSchema>;
+export type Severity = z.infer<typeof SeveritySchema>;
+export type ReasoningEffort = z.infer<typeof ReasoningEffortSchema>;
+export type Category = z.infer<typeof CategorySchema>;

package/dist/config/schema.js

@@ -0,0 +1,115 @@
+import { z } from 'zod';
+import { MODEL_PROVIDERS } from './providers.js';
+/** Node clamps longer timer delays to 1 ms. */
+export const MAX_TIMER_DELAY_MS = 2_147_483_647;
+const TimerDelaySchema = z.number().finite().positive().max(MAX_TIMER_DELAY_MS);
+const ProviderConcurrencyKeySchema = z.enum(MODEL_PROVIDERS);
+export const SeveritySchema = z.enum(['critical', 'important', 'minor', 'nitpick']);
+export const CategorySchema = z.enum([
+    'security',
+    'correctness',
+    'best-practices',
+    'tests',
+    'api-design',
+]);
+export const ReviewerPairSchema = z.object({
+    model: z.string(),
+    role: z.string(),
+});
+export const RoleConfigSchema = z.object({
+    name: z.string(),
+    systemPrompt: z.string().optional(),
+    focus: z.array(z.string()).optional(),
+    severityBias: z.record(z.string(), z.number()).optional(),
+});
+export const ThresholdsSchema = z.object({
+    minConsensusScore: z.number().min(0).max(1).optional(),
+    minConfidence: z.number().min(0).max(1).optional(),
+    dedupeLineWindow: z.number().int().positive().optional(),
+    jaccardThreshold: z.number().min(0).max(1).optional(),
+});
+export const OutputSchema = z.object({
+    terminal: z.boolean().optional(),
+    json: z.boolean().optional(),
+    markdown: z.boolean().optional(),
+    github: z.boolean().optional(),
+    jsonPath: z.string().optional(),
+    markdownPath: z.string().optional(),
+    /**
+     * Carry below-threshold findings into the report's demoted "worth
+     * checking" appendix (and the JSON `belowThresholdFindings` field).
+     * Default true; set false to drop them outright as before 1.6.0.
+     */
+    belowThresholdAppendix: z.boolean().optional(),
+});
+export const ReasoningEffortSchema = z.enum(['low', 'medium', 'high']);
+export const VerificationReasoningEffortSchema = z.enum(['low', 'medium', 'high', 'xhigh', 'max']);
+/**
+ * Convergence gating (RCL-23). `verified-consensus` (default): a finding
+ * gates only when multi-model, critical, or confirmed with evidence by the verification
+ * pass. `all-findings` restores the legacy behavior where every
+ * critical/important finding gates.
+ */
+export const GatingSchema = z.object({
+    mode: z.enum(['verified-consensus', 'all-findings']).optional(),
+    /** Distinct supporting models that make a finding consensus-gated. */
+    minModels: z.number().int().min(2).optional(),
+    /** Direct-API model for the refutation pass (openrouter/ is rejected). */
+    verificationModel: z.string().optional(),
+    /** OpenAI verifier effort, independent of reviewer reasoning effort. */
+    verificationReasoningEffort: VerificationReasoningEffortSchema.optional(),
+    /** Per-call timeout (ms) for the verification pass. */
+    verificationTimeout: TimerDelaySchema.optional(),
+    /** Whole-pass timeout (ms) across every verification batch. */
+    verificationPassTimeout: TimerDelaySchema.optional(),
+});
+/**
+ * Evidence delivery to Harness (epic IO-12475, section 8.6). `telemetry`
+ * is the payload tier: `off` sends nothing, `envelope` the run header and
+ * stats, `findings` adds findings and calls, `full` (default) also uploads
+ * the JSON and Markdown reports. `parseFailures` opts in to sending a
+ * parse-failed call's raw model answer (fenced code and key-shaped strings
+ * removed, 32 KB cap).
+ */
+export const HarnessSchema = z.object({
+    telemetry: z.enum(['off', 'envelope', 'findings', 'full']).optional(),
+    parseFailures: z.boolean().optional(),
+});
+export const ConfigSchema = z.object({
+    models: z.array(z.string()).optional(),
+    secondaryModels: z.array(z.string()).optional(),
+    /**
+     * Async bonus reviewers — fired with each round, never awaited. Results
+     * that have arrived by the next round's dedup are merged then and marked
+     * async in the report. Never on the blocking path.
+     */
+    asyncModels: z.array(z.string()).optional(),
+    roles: z.array(z.string()).optional(),
+    reviewers: z.array(ReviewerPairSchema).optional(),
+    customRoles: z.array(RoleConfigSchema).optional(),
+    thresholds: ThresholdsSchema.optional(),
+    gating: GatingSchema.optional(),
+    output: OutputSchema.optional(),
+    timeout: z.number().positive().optional(),
+    /** Per-call timeout (ms) for the async lane; defaults higher than `timeout`. */
+    asyncTimeout: z.number().positive().optional(),
+    /**
+     * Fraction of planned calls whose completion closes a review round;
+     * outstanding non-core calls are canceled. 1 disables early closure.
+     * Floored at ⅔ so a closed round can still pass the converge
+     * reviewer-health check (successful ≥ ⅔ of total).
+     */
+    quorumFraction: z.number().min(2 / 3).max(1).optional(),
+    maxRetries: z.number().int().nonnegative().optional(),
+    concurrency: z.number().int().positive().optional(),
+    /** Per-provider admission caps, applied in addition to global concurrency. */
+    providerConcurrency: z.partialRecord(ProviderConcurrencyKeySchema, z.number().int().positive().max(Number.MAX_SAFE_INTEGER)).optional(),
+    /** Reasoning budget for providers that support it (currently OpenRouter). */
+    reasoningEffort: ReasoningEffortSchema.optional(),
+    githubToken: z.string().optional(),
+    context: z.array(z.string()).optional(),
+    spec: z.string().optional(),
+    focus: z.array(z.string()).optional(),
+    harness: HarnessSchema.optional(),
+});
+//# sourceMappingURL=schema.js.map

package/dist/config/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD,+CAA+C;AAC/C,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC;AAEhD,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAChF,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;AAE7D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AACpF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC;IACnC,UAAU;IACV,aAAa;IACb,gBAAgB;IAChB,OAAO;IACP,YAAY;CACb,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC;;;;OAIG;IACH,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AACvE,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAGnG;;;;;GAKG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/D,sEAAsE;IACtE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC7C,0EAA0E;IAC1E,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,wEAAwE;IACxE,2BAA2B,EAAE,iCAAiC,CAAC,QAAQ,EAAE;IACzE,uDAAuD;IACvD,mBAAmB,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IAChD,+DAA+D;IAC/D,uBAAuB,EAAE,gBAAgB,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrE,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC/C;;;;OAIG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IACjD,UAAU,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IACvC,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACzC,gFAAgF;IAChF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC9C;;;;;OAKG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACrD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnD,8EAA8E;IAC9E,mBAAmB,EAAE,CAAC,CAAC,aAAa,CAClC,4BAA4B,EAC5B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CACzD,CAAC,QAAQ,EAAE;IACZ,6EAA6E;IAC7E,eAAe,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC"}

package/dist/consensus/claim-contract.d.ts

@@ -0,0 +1,9 @@
+import type { Finding } from './types.js';
+import type { ClaimDescriptor } from '../evidence/claim-recovery/validation/claims.js';
+type ClaimText = Pick<Finding, 'file' | 'title' | 'description' | 'suggestedFix'>;
+/** Every accepted sentence is parsed; no subset of a compound claim qualifies. */
+export declare function describeContract(f: ClaimText): ClaimDescriptor | undefined;
+export declare function isContractDescriptor(descriptor: ClaimDescriptor): boolean;
+/** Applies only to explicitly generated contracts, never to retained free text. */
+export declare function compareContractDescriptors(a: ClaimDescriptor, b: ClaimDescriptor): 'exact_descriptor' | 'supported_paraphrase' | undefined;
+export {};

package/dist/consensus/claim-contract.js

@@ -0,0 +1,307 @@
+const PREFIX = 'rcl-claim-contract-v1:';
+const CONTRACTS = {
+    'embedded-authentication-key': {
+        fields: ['authentication purpose', 'constant binding', 'configuration binding'],
+        condition: 'The named authentication key is embedded in source instead of loaded from external configuration.',
+    },
+    'sql-value-interpolation': {
+        fields: ['operation binding', 'query action', 'table', 'column', 'operator', 'input binding'],
+        condition: 'The named input value is interpolated into SQL syntax instead of passed as a bound parameter.',
+    },
+    'absent-owner-authorization': {
+        fields: ['principal', 'action', 'resource', 'required owner condition'],
+        condition: 'Authentication alone permits deletion of another user resource without checking ownership.',
+    },
+    'unbounded-collection-materialization': {
+        fields: ['collection', 'read operation', 'absent bound'],
+        condition: 'Reading the named collection materializes all records without a row bound.',
+    },
+    'label-derived-privilege': {
+        fields: ['guard binding', 'principal field', 'comparison operator', 'comparison literal', 'required condition'],
+        condition: 'The privilege decision compares the principal username to a label instead of checking role membership.',
+    },
+    'unguarded-map-field-access': {
+        fields: ['helper', 'receiver', 'field', 'guarded sibling fields', 'access operation', 'failure condition'],
+        condition: 'Strict map field access without a presence guard raises KeyError when the named key is absent.',
+    },
+};
+function evidence(kind, subject) {
+    return CONTRACTS[kind].fields.map((label, index) => `${label}: ${subject[index]}`).join('; ');
+}
+const text = (value) => value.trim().replace(/\s+/g, ' ').replace(/[.!]$/, '');
+const sentences = (value) => value.trim().split(/(?<=[.!?])\s+(?=[A-Z])/).map(text);
+/**
+ * Bounded grammar productions for the same key-externalization predicate.
+ * Referents are local to the parsed key. Neither arbitrary explanatory prose
+ * nor a consequence involving another token purpose is thrown away.
+ */
+function keyExternalizationClause(sentence, purpose) {
+    const key = '(?:this(?: (?:key|secret))?|(?:the )?(?:key|secret)s?)';
+    const source = '(?:source(?: code)?|code)';
+    const external = '(?:(?:an? )?environment variables?|external configuration|a secrets manager)';
+    const destination = `${external}(?: or ${external})?`;
+    const motivation = '(?: to prevent secret exposure in source control)?';
+    const modal = '(?:must|should)';
+    const externalize = new RegExp(`^${key} ${modal} (?:never be hardcoded in ${source} and ${modal} )?be loaded from ${destination}${motivation}$`, 'i');
+    const imperative = new RegExp(`^(?:load ${key} from ${destination}|use ${destination})$`, 'i');
+    if (externalize.test(sentence) || imperative.test(sentence))
+        return true;
+    const actor = '(?:anyone who reads the source code|an attacker with source access)';
+    const capability = '(?:can|could|may)';
+    const tokens = `(?:${purpose}s|${purpose} tokens)`;
+    const forge = new RegExp(`^${actor} ${capability} (?:forge|create) valid ${tokens} and impersonate (?:any user|users)$`, 'i');
+    return forge.test(sentence);
+}
+function hardcodedKey(f) {
+    const title = /^Hardcoded (?:([A-Z][A-Z0-9_]*) )?secret(?: key)?(?: in ([A-Z][A-Z0-9_]*) verification| exposes authentication to attack)?$/.exec(text(f.title));
+    if (!title)
+        return;
+    const purpose = title[1] ?? title[2];
+    if (!purpose)
+        return;
+    const binding = /^const ([A-Za-z_$][\w$]*) = process\.env\.([A-Za-z_$][\w$]*)/.exec((f.suggestedFix ?? '').trim());
+    if (!binding)
+        return;
+    const parts = sentences(f.description);
+    const literal = /^A hardcoded secret ('[^']*'|"[^"]*") is used for ([A-Z][A-Z0-9_]*) signing and verification$/.exec(parts[0] ?? '');
+    const staticKey = /^The ([A-Z][A-Z0-9_]*)(?: signing)? (?:secret|key) (?:is|was|remains) (?:hardcoded (?:as a string literal|in (?:the )?(?:source|code))|a hardcoded string constant)$/.exec(parts[0] ?? '');
+    if ((literal?.[2] ?? staticKey?.[1]) !== purpose)
+        return;
+    if (!parts.slice(1).every(part => keyExternalizationClause(part, purpose)))
+        return;
+    return { kind: 'embedded-authentication-key', subject: [`${purpose} signing and verification`, binding[1], binding[2]],
+        condition: 'The named authentication key is embedded in source instead of loaded from external configuration.',
+        // The original finding retains its source observation. A fresh semantic
+        // descriptor needs only its presence, never another copy of a credential.
+        observations: literal ? ['Source literal observed'] : [] };
+}
+/** Accept a direct query argument or an immediately used immutable binding. */
+function sqlParameter(fix, query) {
+    const before = fix.slice(0, query.index);
+    const after = fix.slice(query.index + query[0].length);
+    const call = '[A-Za-z_$][\\w$]*(?:\\.[A-Za-z_$][\\w$]*)*';
+    if (before.trimEnd().endsWith('(')) {
+        return /^\s*,\s*\[\s*([A-Za-z_$][\w$]*)\s*\]\s*\)/.exec(after)?.[1];
+    }
+    const statement = before.slice(Math.max(before.lastIndexOf(';'), before.lastIndexOf('\n')) + 1);
+    const declaration = /^\s*const ([A-Za-z_$][\w$]*)\s*=\s*$/.exec(statement);
+    if (!declaration)
+        return;
+    const binding = declaration[1].replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    return new RegExp(`^\\s*;\\s*(?:return\\s+|await\\s+)?${call}\\(\\s*${binding}\\s*,\\s*\\[\\s*([A-Za-z_$][\\w$]*)\\s*\\]\\s*\\)(?:\\s*;)?$`).exec(after.trimEnd())?.[1];
+}
+function sqlInterpolation(f) {
+    const title = /^SQL injection(?: vulnerability)? (?:in|via string interpolation in) ([A-Za-z_$][\w$]*|DELETE endpoint)$/i.exec(text(f.title));
+    if (!title)
+        return;
+    const fix = f.suggestedFix ?? '';
+    const queries = [...fix.matchAll(/(['"])(SELECT \* FROM ([A-Za-z_][\w]*) WHERE ([A-Za-z_][\w]*) = (?:\$1|\?)|DELETE FROM ([A-Za-z_][\w]*) WHERE ([A-Za-z_][\w]*) = \$1)\1/gi)];
+    if (queries.length !== 1)
+        return;
+    const query = queries[0];
+    const parameter = sqlParameter(fix, query);
+    if (!parameter)
+        return;
+    const operation = query[3] ? 'SELECT' : 'DELETE';
+    const table = query[3] ?? query[5];
+    const column = query[4] ?? query[6];
+    const parts = sentences(f.description);
+    const core = /^(User-controlled input|The ([A-Za-z_$][\w$]*) parameter|The user ID from the URL parameter|The ([A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)+) value) is (?:directly )?interpolated(?: directly)? into (?:a |the )?(SQL query string|SQL string|SQL query|SQL DELETE statement)(?: without sanitization(?: or parameterization)?)?$/i.exec(parts[0] ?? '');
+    if (!core)
+        return;
+    const namedSource = core[2] ?? core[3]?.split('.').at(-1);
+    if (namedSource && namedSource !== parameter)
+        return;
+    if (core[4]?.toUpperCase() === 'SQL DELETE STATEMENT' && operation !== 'DELETE')
+        return;
+    if (title[1]?.toUpperCase() === 'DELETE ENDPOINT' && operation !== 'DELETE')
+        return;
+    if (!parts.slice(1).every(part => /^This (?:is a (?:classic|textbook) SQL injection vulnerability|allows SQL injection attacks)$/i.test(part)))
+        return;
+    return { kind: 'sql-value-interpolation', subject: [title[1], operation, table, column, '=', parameter],
+        condition: 'The named input value is interpolated into SQL syntax instead of passed as a bound parameter.', observations: [] };
+}
+function ownerAuthorization(f) {
+    const title = /^(?:IDOR: missing authorization on DELETE endpoint|Missing authorization check allows any user to delete any ([a-z]+)|IDOR vulnerability [—–-] missing ownership check on delete)$/i.exec(text(f.title));
+    if (!title)
+        return;
+    const parts = sentences(f.description);
+    let deletion = false;
+    let ownership = false;
+    let resource;
+    // A named route is supported only when it names this file's resource and
+    // its sole parameter is the target id. Other routes/conditions stay raw.
+    const fileResource = f.file.split('/').at(-1)?.replace(/\.[^.]+$/, '').toLowerCase();
+    for (const part of parts) {
+        const effect = /^Any authenticated user can delete any (?:other user's ([a-z]+)(?: by supplying a different user ID in the URL)?|([a-z]+) including other users' ([a-z]+)s)$/i.exec(part);
+        if (effect) {
+            const target = (effect[1] ?? effect[3]).toLowerCase();
+            const namedResource = effect[2]?.toLowerCase();
+            if (resource && resource !== target ||
+                namedResource && namedResource !== target && namedResource !== `${target}s`)
+                return;
+            resource = target;
+            deletion = true;
+        }
+        else if (/^The endpoint only (?:checks|validates) authentication but not authorization$/i.test(part)) {
+            ownership = true;
+        }
+        else {
+            const route = /^The DELETE \/([A-Za-z_][\w]*)\/:id endpoint only (?:checks|validates) authentication but not authorization$/i.exec(part);
+            if (route) {
+                if (route[1].toLowerCase() !== fileResource)
+                    return;
+                ownership = true;
+                continue;
+            }
+            const owner = /^There is no check that the requesting user owns the ([a-z]+) being deleted$/i.exec(part);
+            const ownerResource = owner?.[1]?.toLowerCase();
+            if (!ownerResource || resource && resource !== ownerResource)
+                return;
+            resource = ownerResource;
+            ownership = true;
+        }
+    }
+    if (!deletion || !ownership || !resource || title[1] && title[1].toLowerCase() !== resource)
+        return;
+    return { kind: 'absent-owner-authorization', subject: ['authenticated user', 'DELETE', resource, 'requesting user owns target resource'],
+        condition: 'Authentication alone permits deletion of another user resource without checking ownership.', observations: [] };
+}
+function unboundedCollection(f) {
+    const title = /^(?:Missing pagination on ([A-Za-z_][\w]*) listing endpoint|Unbounded query on ([A-Za-z_][\w]*) table)$/i.exec(text(f.title));
+    if (!title)
+        return;
+    const parts = sentences(f.description);
+    const route = /^The GET \/([A-Za-z_][\w]*) endpoint fetches all ([A-Za-z_][\w]*) without pagination$/i.exec(parts[0] ?? '');
+    const sql = /^SELECT \* FROM ([A-Za-z_][\w]*) without a LIMIT clause will return all records$/i.exec(parts[0] ?? '');
+    if (!route && !sql)
+        return;
+    if (route && route[1].toLowerCase() !== route[2].toLowerCase())
+        return;
+    const resource = (route?.[1] ?? sql[1]).toLowerCase();
+    if ((title[1] ?? title[2]).toLowerCase().replace(/s$/, '') !== resource.replace(/s$/, ''))
+        return;
+    if (!parts.slice(1).every(part => /^(?:This will cause performance issues and excessive memory usage at scale|Add pagination to prevent memory exhaustion)$/i.test(part)))
+        return;
+    return { kind: 'unbounded-collection-materialization', subject: [resource, 'read all records', 'no pagination or row limit'],
+        condition: 'Reading the named collection materializes all records without a row bound.', observations: [] };
+}
+function labelPrivilege(f) {
+    const title = /^(?:([a-z]+) check uses username instead of role|Broken ([a-z]+) role check [—–-] compares username instead of role)$/i.exec(text(f.title));
+    if (!title)
+        return;
+    const parts = sentences(f.description);
+    const core = /^The ([A-Za-z_$][\w$]*) (?:middleware|guard) checks (?:if )?([A-Za-z_$][\w$]*\.[A-Za-z_$][\w$]*) === ('[^']*'|"[^"]*") (?:instead of checking a proper role field|which is a broken security check)$/i.exec(parts[0] ?? '');
+    if (!core)
+        return;
+    if (core[2].split('.').at(-1)?.toLowerCase() !== 'username')
+        return;
+    const literal = core[3].slice(1, -1);
+    if ((title[1] ?? title[2]).toLowerCase() !== literal.toLowerCase())
+        return;
+    // The effects and remedy must refer to the same privilege named in the
+    // compared literal. Other principals, conditions, or extra duties refuse.
+    const escaped = literal.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const effects = new RegExp(`^Any user named ['"]${escaped}['"] would get ${escaped} access, and actual ${escaped}s with different usernames would be denied$`, 'i');
+    const flag = `is${literal[0].toUpperCase()}${literal.slice(1)}`;
+    if (!parts.slice(1).every(part => effects.test(part) || part === `It should verify a roles array or an ${flag} flag`))
+        return;
+    return { kind: 'label-derived-privilege', subject: [core[1], core[2], '===', literal, 'role membership'],
+        condition: 'The privilege decision compares the principal username to a label instead of checking role membership.', observations: [] };
+}
+/** Parse the access and its absent-key precondition, including contextual guards. */
+function mapFieldAccess(f) {
+    if ((f.description.match(/`/g) ?? []).length % 2 !== 0)
+        return;
+    const parts = sentences(f.description.replaceAll('`', ''));
+    if (parts.length !== 2)
+        return;
+    const first = /^([A-Za-z_][\w]*(?:\/\d+)?) safely Map\.gets :([A-Za-z_][\w]*) \/ :([A-Za-z_][\w]*), then uses ([A-Za-z_][\w]*)\.([A-Za-z_][\w]*) with dot access for the final fallback$/.exec(parts[0]) ??
+        /^([A-Za-z_][\w]*(?:\/\d+)?) retrieves :([A-Za-z_][\w]*) and :([A-Za-z_][\w]*) defensively using Map\.get\/2, but accesses ([A-Za-z_][\w]*)\.([A-Za-z_][\w]*) using dot syntax$/.exec(parts[0]);
+    if (!first)
+        return;
+    const [, helper, guardedA, guardedB, receiver, field] = first;
+    const title = /^([A-Za-z_][\w]*(?:\/\d+)?) mixes Map\.get with hard field access$/.exec(text(f.title));
+    const accessTitle = /^Unsafe map field access ([A-Za-z_][\w]*)\.([A-Za-z_][\w]*) in ([A-Za-z_][\w]*(?:\/\d+)?)$/.exec(text(f.title));
+    if (!title && !accessTitle)
+        return;
+    const titleHelper = title?.[1] ?? accessTitle[3];
+    if (titleHelper.includes('/') ? titleHelper !== helper : titleHelper !== helper.split('/')[0])
+        return;
+    if (accessTitle && (accessTitle[1] !== receiver || accessTitle[2] !== field))
+        return;
+    const absent = /^A bare ([A-Za-z_][\w]*) map missing :([A-Za-z_][\w]*) will raise KeyError(?: despite the comment that this ("[^"]+"|“[^”]+”))?$/.exec(parts[1]);
+    const conditional = /^If ([A-Za-z_][\w]*) is missing the :([A-Za-z_][\w]*) key, evaluating ([A-Za-z_][\w]*)\.([A-Za-z_][\w]*) will raise a KeyError$/.exec(parts[1]);
+    if (!absent && !conditional)
+        return;
+    if ((absent?.[1] ?? conditional[1]) !== receiver || (absent?.[2] ?? conditional[2]) !== field)
+        return;
+    if (conditional && (conditional[3] !== receiver || conditional[4] !== field))
+        return;
+    return { kind: 'unguarded-map-field-access', subject: [helper, receiver, field, [guardedA, guardedB].sort().join(','), 'strict dot access', 'absent key raises KeyError'],
+        condition: CONTRACTS['unguarded-map-field-access'].condition,
+        // A quoted comment is attributed context, not an asserted extra runtime
+        // obligation. Preserve it verbatim in its immutable sighting descriptor.
+        observations: absent?.[3] ? [`Quoted comment observed: ${absent[3]}`] : [] };
+}
+/** Every accepted sentence is parsed; no subset of a compound claim qualifies. */
+export function describeContract(f) {
+    const contract = hardcodedKey(f) ?? sqlInterpolation(f) ?? ownerAuthorization(f) ?? unboundedCollection(f) ?? labelPrivilege(f) ?? mapFieldAccess(f);
+    if (!contract)
+        return;
+    const descriptor = {
+        version: 1,
+        operation: `${f.file} :: ${PREFIX}${JSON.stringify([contract.kind, contract.subject])}`,
+        invariant: contract.condition,
+        evidence: [evidence(contract.kind, contract.subject), ...contract.observations],
+    };
+    if ([descriptor.operation, descriptor.invariant, ...descriptor.evidence].some(value => [...value].length > 500))
+        return;
+    return descriptor;
+}
+export function isContractDescriptor(descriptor) {
+    return descriptor.operation.includes(` :: ${PREFIX}`);
+}
+/** Applies only to explicitly generated contracts, never to retained free text. */
+export function compareContractDescriptors(a, b) {
+    const parse = (descriptor) => {
+        const marker = descriptor.operation.indexOf(` :: ${PREFIX}`);
+        if (marker <= 0)
+            return;
+        try {
+            const parsed = JSON.parse(descriptor.operation.slice(marker + ` :: ${PREFIX}`.length));
+            if (!Array.isArray(parsed) || parsed.length !== 2 || typeof parsed[0] !== 'string' ||
+                !Object.hasOwn(CONTRACTS, parsed[0]) || !Array.isArray(parsed[1]))
+                return;
+            const kind = parsed[0];
+            const subject = parsed[1];
+            if (subject.length !== CONTRACTS[kind].fields.length || !subject.every(value => typeof value === 'string' && value.length > 0))
+                return;
+            if (descriptor.invariant !== CONTRACTS[kind].condition || descriptor.evidence[0] !== evidence(kind, subject))
+                return;
+            if (!['embedded-authentication-key', 'unguarded-map-field-access'].includes(kind) && descriptor.evidence.length !== 1)
+                return;
+            if (descriptor.evidence.length > 2)
+                return;
+            return kind;
+        }
+        catch {
+            return;
+        }
+    };
+    const kind = parse(a);
+    if (!kind || parse(b) !== kind)
+        return;
+    if (a.operation !== b.operation || a.invariant !== b.invariant || a.evidence[0] !== b.evidence[0])
+        return;
+    // Embedding any literal violates this contract. New descriptors retain only
+    // the observation's presence; historical literal observations stay readable
+    // and are compared without rewriting their immutable descriptor bytes.
+    const observation = kind === 'unguarded-map-field-access'
+        ? /^Quoted comment observed: ("[^"]+"|“[^”]+”)$/
+        : /^Source literal observed(?:: ('[^']*'|"[^"]*"))?$/;
+    if (![...a.evidence.slice(1), ...b.evidence.slice(1)].every(value => observation.test(value)))
+        return;
+    return JSON.stringify(a.evidence) === JSON.stringify(b.evidence) ? 'exact_descriptor' : 'supported_paraphrase';
+}
+//# sourceMappingURL=claim-contract.js.map