@aperant/framework 0.11.0 → 0.12.0

package/dist/cli/verify-proof/sandbox/gate-predicate.mjs

@@ -0,0 +1,115 @@
+/**
+ * gate-predicate.mjs — extracted decision function for the sandbox
+ * precondition gate at apt-verify-proof/SKILL.md Step 2c.
+ *
+ * Refactored out of the SKILL.md prose so the e2e test (subtask 7.3)
+ * can call it directly without re-implementing the dispatch table.
+ *
+ * Inputs:
+ *   - config:           {verification?: {sandbox?: {enabled:bool, ...}}}
+ *   - stateFile:        the v2-shaped envelope read from
+ *                       .aperant/state/verify-proof-sandbox-verified.json
+ *                       OR null when the file is missing.
+ *   - parallelRequested: bool — true when /apt:verify-proof was invoked
+ *                       with --parallel.
+ *
+ * Returns:
+ *   - {action: 'proceed'}                — verified + approved, walker may run
+ *   - {action: 'skip-gate'}              — --parallel NOT requested OR
+ *                                          verification.sandbox absent;
+ *                                          Fast Path Guarantee (ID-07).
+ *   - {action: 'exit', envelope}         — verified:false OR state missing;
+ *                                          envelope is the v2 fail-loud shape.
+ *
+ * The `envelope` shape on exit is:
+ *   {status:'error', code:'E_SANDBOX_UNVERIFIED', verdict:'needs_human',
+ *    reason:'sandbox_unverified', remediation:'/apt:verify-proof setup'}
+ *
+ * No I/O, no process.exit — pure function for testability.
+ */
+const FAIL_ENVELOPE = Object.freeze({
+    status: 'error',
+    code: 'E_SANDBOX_UNVERIFIED',
+    verdict: 'needs_human',
+    reason: 'sandbox_unverified',
+    remediation: '/apt:verify-proof setup',
+});
+const STALE_VERDICT_ENVELOPE = Object.freeze({
+    status: 'error',
+    code: 'E_SANDBOX_VERDICT_STALE',
+    verdict: 'needs_human',
+    reason: 'sandbox_recipe_version_drift',
+    remediation: 'apt-tools verify-sandbox <project-dir>',
+});
+/**
+ * @typedef {Object} GateInput
+ * @property {object|null|undefined} config
+ * @property {object|null|undefined} stateFile
+ * @property {boolean} parallelRequested
+ */
+/**
+ * @typedef {Object} GateEnvelope
+ * @property {'error'} status
+ * @property {string} code
+ * @property {string} verdict
+ * @property {string} reason
+ * @property {string} remediation
+ */
+/**
+ * @typedef {Object} GateOutput
+ * @property {'proceed'|'skip-gate'|'exit'} action
+ * @property {GateEnvelope} [envelope]
+ */
+/**
+ * @param {GateInput} input
+ * @returns {GateOutput}
+ */
+export function gatePredicate({ config, stateFile, parallelRequested }) {
+    // (1) --parallel NOT requested → gate is a no-op (Fast Path Guarantee ID-07).
+    if (!parallelRequested)
+        return { action: 'skip-gate' };
+    // (2) verification.sandbox is ABSENT → also skip-gate (the adopter
+    //     has not opted in; respect the absent-config branch as no-op).
+    const sandboxCfg = config?.verification?.sandbox;
+    if (!sandboxCfg || sandboxCfg.enabled !== true) {
+        // Note: even though --parallel was requested, the absent-config
+        // branch returns skip-gate; the SKILL.md Step 2c prose handles
+        // the absent-config case via the first-run hook (Step 1) which
+        // is a UX surface, not a gate failure.
+        return { action: 'skip-gate' };
+    }
+    // (3) state file present + verified:true + verdict:'approved' → check version drift.
+    if (stateFile && stateFile.verified === true && stateFile.verdict === 'approved') {
+        // (3a) Version drift check: when both sides have recipeVersion, verify the
+        //      state file's version is in the active recipe's compatibleWithApplied[].
+        //      If either side has null/undefined recipeVersion, fall through (compat
+        //      with pre-LOG-003 state files that predate recipeVersion population).
+        const stateVersion = stateFile.recipeVersion ?? null;
+        const activeVersion = sandboxCfg.recipeVersion ?? null;
+        const compatibleWith = Array.isArray(sandboxCfg.compatibleWithApplied)
+            ? sandboxCfg.compatibleWithApplied
+            : null;
+        if (stateVersion && activeVersion && compatibleWith !== null) {
+            // Both sides versioned — only stale if the state version is NOT
+            // listed in the active recipe's compatibleWithApplied AND the
+            // versions differ.
+            if (stateVersion !== activeVersion && !compatibleWith.includes(stateVersion)) {
+                return { action: 'exit', envelope: { ...STALE_VERDICT_ENVELOPE } };
+            }
+        }
+        return { action: 'proceed' };
+    }
+    // (4) Everything else → fail loud with the v2 envelope.
+    return { action: 'exit', envelope: { ...FAIL_ENVELOPE } };
+}
+/**
+ * The frozen fail envelope — exported so callers can detect-and-match
+ * without re-stringifying.
+ */
+export const SANDBOX_UNVERIFIED_ENVELOPE = FAIL_ENVELOPE;
+/**
+ * The frozen stale-verdict envelope — emitted when the state file's
+ * recipeVersion is no longer in the active recipe's compatibleWithApplied[].
+ */
+export const SANDBOX_VERDICT_STALE_ENVELOPE = STALE_VERDICT_ENVELOPE;
+//# sourceMappingURL=gate-predicate.mjs.map

package/dist/cli/verify-proof/sandbox/gate-predicate.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-predicate.mjs","sourceRoot":"","sources":["../../../../src/cli/verify-proof/sandbox/gate-predicate.mjs"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;IACnC,MAAM,EAAE,OAAO;IACf,IAAI,EAAE,sBAAsB;IAC5B,OAAO,EAAE,aAAa;IACtB,MAAM,EAAE,oBAAoB;IAC5B,WAAW,EAAE,yBAAyB;CACtC,CAAC,CAAA;AAEF,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,OAAO;IACf,IAAI,EAAE,yBAAyB;IAC/B,OAAO,EAAE,aAAa;IACtB,MAAM,EAAE,8BAA8B;IACtC,WAAW,EAAE,wCAAwC;CACrD,CAAC,CAAA;AAEF;;;;;GAKG;AAEH;;;;;;;GAOG;AAEH;;;;GAIG;AAEH;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE;IACrE,8EAA8E;IAC9E,IAAI,CAAC,iBAAiB;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;IAEtD,mEAAmE;IACnE,oEAAoE;IACpE,MAAM,UAAU,GAAG,MAAM,EAAE,YAAY,EAAE,OAAO,CAAA;IAChD,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAChD,gEAAgE;QAChE,+DAA+D;QAC/D,+DAA+D;QAC/D,uCAAuC;QACvC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;IAC/B,CAAC;IAED,qFAAqF;IACrF,IAAI,SAAS,IAAI,SAAS,CAAC,QAAQ,KAAK,IAAI,IAAI,SAAS,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAClF,2EAA2E;QAC3E,+EAA+E;QAC/E,6EAA6E;QAC7E,4EAA4E;QAC5E,MAAM,YAAY,GAAG,SAAS,CAAC,aAAa,IAAI,IAAI,CAAA;QACpD,MAAM,aAAa,GAAG,UAAU,CAAC,aAAa,IAAI,IAAI,CAAA;QACtD,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC;YACrE,CAAC,CAAC,UAAU,CAAC,qBAAqB;YAClC,CAAC,CAAC,IAAI,CAAA;QAEP,IAAI,YAAY,IAAI,aAAa,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAC9D,gEAAgE;YAChE,8DAA8D;YAC9D,mBAAmB;YACnB,IAAI,YAAY,KAAK,aAAa,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC9E,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,sBAAsB,EAAE,EAAE,CAAA;YACnE,CAAC;QACF,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IAC7B,CAAC;IAED,wDAAwD;IACxD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,aAAa,EAAE,EAAE,CAAA;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,aAAa,CAAA;AAExD;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,sBAAsB,CAAA"}

package/dist/cli/verify-proof/sandbox/pattern-matcher.d.mts

@@ -0,0 +1,57 @@
+/**
+ * @typedef {import('../../util/runtime-capabilities.mjs').RuntimeCapabilities} RuntimeCapabilities
+ */
+/**
+ * @typedef {Object} SandboxRecipe
+ * @property {string} recipeId
+ * @property {string} recipeVersion
+ * @property {string} name
+ * @property {string} description
+ * @property {{capabilities: string[], deps: string[]}} match
+ * @property {{logPattern: string, timeoutMs: number}} readiness
+ * @property {Array<object>} changes
+ * @property {string[]} compatibleWithApplied
+ */
+/**
+ * @typedef {Object} MatchResult
+ * @property {string|null} recipeId
+ * @property {string} reason
+ */
+/**
+ * @param {RuntimeCapabilities} runtimeCaps
+ * @param {Record<string, unknown> | null} packageJson
+ * @param {SandboxRecipe[]} recipes
+ * @returns {MatchResult}
+ */
+export function matchPattern(runtimeCaps: RuntimeCapabilities, packageJson: Record<string, unknown> | null, recipes: SandboxRecipe[]): MatchResult;
+/**
+ * Convenience overload — load the project's package.json from disk.
+ *
+ * @param {string} projectDir
+ * @param {RuntimeCapabilities} runtimeCaps
+ * @param {SandboxRecipe[]} recipes
+ * @returns {MatchResult}
+ */
+export function matchPatternForProject(projectDir: string, runtimeCaps: RuntimeCapabilities, recipes: SandboxRecipe[]): MatchResult;
+export type RuntimeCapabilities = import("../../util/runtime-capabilities.mjs").RuntimeCapabilities;
+export type SandboxRecipe = {
+    recipeId: string;
+    recipeVersion: string;
+    name: string;
+    description: string;
+    match: {
+        capabilities: string[];
+        deps: string[];
+    };
+    readiness: {
+        logPattern: string;
+        timeoutMs: number;
+    };
+    changes: Array<object>;
+    compatibleWithApplied: string[];
+};
+export type MatchResult = {
+    recipeId: string | null;
+    reason: string;
+};
+//# sourceMappingURL=pattern-matcher.d.mts.map

package/dist/cli/verify-proof/sandbox/pattern-matcher.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pattern-matcher.d.mts","sourceRoot":"","sources":["../../../../src/cli/verify-proof/sandbox/pattern-matcher.mjs"],"names":[],"mappings":"AAuBA;;GAEG;AAEH;;;;;;;;;;GAUG;AAEH;;;;GAIG;AAEH;;;;;GAKG;AACH,0CALW,mBAAmB,eACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,WAC9B,aAAa,EAAE,GACb,WAAW,CA4BvB;AAED;;;;;;;GAOG;AACH,mDALW,MAAM,eACN,mBAAmB,WACnB,aAAa,EAAE,GACb,WAAW,CAavB;kCA1EY,OAAO,qCAAqC,EAAE,mBAAmB;;cAKhE,MAAM;mBACN,MAAM;UACN,MAAM;iBACN,MAAM;WACN;QAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAA;KAAC;eACxC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAC;aACvC,KAAK,CAAC,MAAM,CAAC;2BACb,MAAM,EAAE;;;cAKR,MAAM,GAAC,IAAI;YACX,MAAM"}

package/dist/cli/verify-proof/sandbox/pattern-matcher.mjs

@@ -0,0 +1,124 @@
+/**
+ * pattern-matcher.mjs — sandbox-recipe pattern matcher.
+ *
+ * Walks the registered recipes' `match.capabilities[]` + `match.deps[]`
+ * predicates against the loaded runtime capabilities + package.json deps,
+ * and returns the FIRST matching recipe (or null with a human reason).
+ *
+ * Two-arg shape:
+ *   - `match.capabilities[]` — every entry must be `true` on the
+ *     RuntimeCapabilities record (AND semantics — all required).
+ *   - `match.deps[]` — at least one entry must appear in the merged
+ *     dependencies + devDependencies of the project's root package.json
+ *     (OR semantics — any-of).
+ *
+ * This split lets a recipe say "I need is_electron AND one of
+ * [@libsql/client, better-sqlite3]" without enumerating every combination.
+ *
+ * See: spec ID-04 (v1 ships ONE recipe — electron-libsql), AC5.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+/**
+ * @typedef {import('../../util/runtime-capabilities.mjs').RuntimeCapabilities} RuntimeCapabilities
+ */
+/**
+ * @typedef {Object} SandboxRecipe
+ * @property {string} recipeId
+ * @property {string} recipeVersion
+ * @property {string} name
+ * @property {string} description
+ * @property {{capabilities: string[], deps: string[]}} match
+ * @property {{logPattern: string, timeoutMs: number}} readiness
+ * @property {Array<object>} changes
+ * @property {string[]} compatibleWithApplied
+ */
+/**
+ * @typedef {Object} MatchResult
+ * @property {string|null} recipeId
+ * @property {string} reason
+ */
+/**
+ * @param {RuntimeCapabilities} runtimeCaps
+ * @param {Record<string, unknown> | null} packageJson
+ * @param {SandboxRecipe[]} recipes
+ * @returns {MatchResult}
+ */
+export function matchPattern(runtimeCaps, packageJson, recipes) {
+    if (!Array.isArray(recipes) || recipes.length === 0) {
+        return { recipeId: null, reason: 'no recipes registered' };
+    }
+    const deps = mergedDeps(packageJson);
+    for (const recipe of recipes) {
+        const reqCaps = recipe.match?.capabilities ?? [];
+        const anyDeps = recipe.match?.deps ?? [];
+        const capsOk = reqCaps.every((cap) => runtimeCaps && runtimeCaps[cap] === true);
+        if (!capsOk)
+            continue;
+        // deps[] is any-of — recipe matches if at least one declared dep is in
+        // the project. An empty deps[] means "no dep constraint" (cap-only match).
+        const depsOk = anyDeps.length === 0 || anyDeps.some((d) => deps.has(d.toLowerCase()));
+        if (!depsOk)
+            continue;
+        return { recipeId: recipe.recipeId, reason: 'matched' };
+    }
+    return {
+        recipeId: null,
+        reason: `no recipe available for runtime: ${describeRuntime(runtimeCaps)}`,
+    };
+}
+/**
+ * Convenience overload — load the project's package.json from disk.
+ *
+ * @param {string} projectDir
+ * @param {RuntimeCapabilities} runtimeCaps
+ * @param {SandboxRecipe[]} recipes
+ * @returns {MatchResult}
+ */
+export function matchPatternForProject(projectDir, runtimeCaps, recipes) {
+    const pkgPath = join(resolve(projectDir), 'package.json');
+    let pkg = null;
+    if (existsSync(pkgPath)) {
+        try {
+            pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));
+        }
+        catch {
+            /* fall through with pkg=null */
+        }
+    }
+    return matchPattern(runtimeCaps, pkg, recipes);
+}
+/**
+ * Build a Set of lowercased package names from dependencies + devDependencies.
+ *
+ * @param {Record<string, unknown> | null} packageJson
+ */
+function mergedDeps(packageJson) {
+    const out = new Set();
+    if (packageJson === null || typeof packageJson !== 'object')
+        return out;
+    const d = /** @type {Record<string, unknown>} */ (packageJson.dependencies);
+    const dd = /** @type {Record<string, unknown>} */ (packageJson.devDependencies);
+    if (d && typeof d === 'object')
+        for (const k of Object.keys(d))
+            out.add(k.toLowerCase());
+    if (dd && typeof dd === 'object')
+        for (const k of Object.keys(dd))
+            out.add(k.toLowerCase());
+    return out;
+}
+/**
+ * One-line description of the detected runtime shape — used in the
+ * no-match reason so an adopter sees what the matcher saw.
+ *
+ * @param {RuntimeCapabilities} runtimeCaps
+ */
+function describeRuntime(runtimeCaps) {
+    if (!runtimeCaps || typeof runtimeCaps !== 'object')
+        return 'unknown';
+    const active = Object.keys(runtimeCaps).filter((k) => runtimeCaps[k] === true);
+    if (active.length === 0)
+        return 'no capabilities detected';
+    return active.join(', ');
+}
+//# sourceMappingURL=pattern-matcher.mjs.map

package/dist/cli/verify-proof/sandbox/pattern-matcher.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"pattern-matcher.mjs","sourceRoot":"","sources":["../../../../src/cli/verify-proof/sandbox/pattern-matcher.mjs"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAEzC;;GAEG;AAEH;;;;;;;;;;GAUG;AAEH;;;;GAIG;AAEH;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO;IAC7D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAA;IAC3D,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,WAAW,CAAC,CAAA;IAEpC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,YAAY,IAAI,EAAE,CAAA;QAChD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAA;QAExC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAA;QAC/E,IAAI,CAAC,MAAM;YAAE,SAAQ;QAErB,uEAAuE;QACvE,2EAA2E;QAC3E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;QACrF,IAAI,CAAC,MAAM;YAAE,SAAQ;QAErB,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IACxD,CAAC;IAED,OAAO;QACN,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,oCAAoC,eAAe,CAAC,WAAW,CAAC,EAAE;KAC1E,CAAA;AACF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO;IACtE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC,CAAA;IACzD,IAAI,GAAG,GAAG,IAAI,CAAA;IACd,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC;YACJ,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAA;QACjD,CAAC;QAAC,MAAM,CAAC;YACR,gCAAgC;QACjC,CAAC;IACF,CAAC;IACD,OAAO,YAAY,CAAC,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;AAC/C,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,WAAW;IAC9B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAE,CAAA;IACrB,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,WAAW,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAA;IACvE,MAAM,CAAC,GAAG,sCAAsC,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC,CAAA;IAC3E,MAAM,EAAE,GAAG,sCAAsC,CAAC,CAAC,WAAW,CAAC,eAAe,CAAC,CAAA;IAC/E,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;IACxF,IAAI,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;IAC3F,OAAO,GAAG,CAAA;AACX,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,WAAW;IACnC,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IACrE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAA;IAC9E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,0BAA0B,CAAA;IAC1D,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC"}

package/dist/cli/verify-proof/sandbox/recipe-diff.d.mts

@@ -0,0 +1,28 @@
+/**
+ * @param {{projectDir: string, recipeId: string, recipes: object[]}} args
+ * @returns {{
+ *   format: 'markdown',
+ *   body: string,
+ *   changes: Array<{path: string, kind: string, summary: string}>,
+ *   envelope: {status: 'ok'|'error', recipe_version: string|null, compatible: boolean}
+ * }}
+ */
+export function generateRecipeDiff({ projectDir, recipeId, recipes }: {
+    projectDir: string;
+    recipeId: string;
+    recipes: object[];
+}): {
+    format: "markdown";
+    body: string;
+    changes: Array<{
+        path: string;
+        kind: string;
+        summary: string;
+    }>;
+    envelope: {
+        status: "ok" | "error";
+        recipe_version: string | null;
+        compatible: boolean;
+    };
+};
+//# sourceMappingURL=recipe-diff.d.mts.map

package/dist/cli/verify-proof/sandbox/recipe-diff.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipe-diff.d.mts","sourceRoot":"","sources":["../../../../src/cli/verify-proof/sandbox/recipe-diff.mjs"],"names":[],"mappings":"AA8CA;;;;;;;;GAQG;AACH,sEARW;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAC,GACvD;IACR,MAAM,EAAE,UAAU,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAC,CAAC,CAAC;IAC9D,QAAQ,EAAE;QAAC,MAAM,EAAE,IAAI,GAAC,OAAO,CAAC;QAAC,cAAc,EAAE,MAAM,GAAC,IAAI,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAC,CAAA;CACnF,CAuDH"}

package/dist/cli/verify-proof/sandbox/recipe-diff.mjs

@@ -0,0 +1,190 @@
+/**
+ * recipe-diff.mjs — read-only Markdown diff generator for a recipe.
+ *
+ * Loads the recipe, walks `changes[]`, and emits a Markdown report
+ * enumerating every proposed write WITH `--- before` / `+++ after`
+ * blocks. The generator is pure read — it never writes to the adopter's
+ * tree (ID-02). The companion `apply-recipe` command is the only
+ * writer.
+ *
+ * Public contract:
+ *   generateRecipeDiff({projectDir, recipeId, recipes}) → {
+ *     format: 'markdown',
+ *     body: string,
+ *     changes: [{path, kind, summary}],
+ *     envelope: {status, recipe_version, compatible}
+ *   }
+ *
+ * The Markdown is user-facing and load-bearing — drift = golden-snapshot
+ * test failure by design (subtask 2.1 / TD-03).
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+const __dirname = dirname(fileURLToPath(import.meta.url));
+/**
+ * Defense-in-depth path-under-root check. Returns the validated absolute
+ * path or null when the candidate escapes the root. The diff generator
+ * surfaces a "template not found" envelope rather than throwing (read-
+ * only generator stays non-fatal).
+ *
+ * @param {string} rootAbs
+ * @param {string} relPath
+ * @returns {string|null}
+ */
+function safeJoinUnderRoot(rootAbs, relPath) {
+    if (typeof relPath !== 'string' || relPath.length === 0)
+        return null;
+    if (isAbsolute(relPath))
+        return null;
+    const candidate = resolve(rootAbs, relPath);
+    const rel = relative(rootAbs, candidate);
+    if (rel.startsWith('..') || isAbsolute(rel))
+        return null;
+    return candidate;
+}
+/**
+ * @param {{projectDir: string, recipeId: string, recipes: object[]}} args
+ * @returns {{
+ *   format: 'markdown',
+ *   body: string,
+ *   changes: Array<{path: string, kind: string, summary: string}>,
+ *   envelope: {status: 'ok'|'error', recipe_version: string|null, compatible: boolean}
+ * }}
+ */
+export function generateRecipeDiff({ projectDir, recipeId, recipes }) {
+    const recipe = (recipes ?? []).find((r) => r && r.recipeId === recipeId);
+    if (!recipe) {
+        return {
+            format: 'markdown',
+            body: `# No recipe available\n\nrecipeId \`${recipeId}\` is not in the registered recipes list.\n`,
+            changes: [],
+            envelope: { status: 'error', recipe_version: null, compatible: false },
+        };
+    }
+    const adopterRoot = resolve(projectDir);
+    const changeRows = [];
+    const sections = [];
+    for (const change of recipe.changes ?? []) {
+        // Defense-in-depth: a malicious recipe could otherwise read
+        // arbitrary host files via `change.path: '../../etc/passwd'`. The
+        // diff generator is read-only but the read CONTENT lands in the
+        // emitted Markdown — refuse to enumerate paths outside root.
+        const targetAbs = safeJoinUnderRoot(adopterRoot, change.path);
+        if (targetAbs === null) {
+            sections.push(`## ${change.path}\n\n_(rejected: change.path escapes project root — recipe defect)_\n`);
+            changeRows.push({
+                path: change.path,
+                kind: change.kind,
+                summary: 'rejected (path escapes root)',
+            });
+            continue;
+        }
+        const exists = existsSync(targetAbs);
+        const before = exists ? safeReadFile(targetAbs) : '';
+        const after = renderAfter(change, recipe, adopterRoot);
+        const summary = renderChangeSummary(change, exists);
+        changeRows.push({ path: change.path, kind: change.kind, summary });
+        sections.push(renderChangeSection(change, before, after, exists));
+    }
+    const body = renderBody(recipe, sections);
+    return {
+        format: 'markdown',
+        body,
+        changes: changeRows,
+        envelope: {
+            status: 'ok',
+            recipe_version: recipe.recipeVersion ?? null,
+            compatible: true,
+        },
+    };
+}
+function renderBody(recipe, sections) {
+    const lines = [];
+    lines.push(`# Recipe diff: ${recipe.name ?? recipe.recipeId}`);
+    lines.push('');
+    lines.push(`**Recipe:** \`${recipe.recipeId}\` v${recipe.recipeVersion}  ` +
+        `(compatibleWithApplied: ${JSON.stringify(recipe.compatibleWithApplied ?? [])})`);
+    lines.push('');
+    lines.push(recipe.description ?? '');
+    lines.push('');
+    lines.push(`This recipe proposes **${(recipe.changes ?? []).length}** changes.`);
+    lines.push('No file is written until you run `apt-tools apply-recipe . --confirm` ' +
+        'and accept each change individually.');
+    lines.push('');
+    for (const section of sections) {
+        lines.push(section);
+        lines.push('');
+    }
+    return lines.join('\n').replace(/\n{3,}/g, '\n\n');
+}
+function renderChangeSummary(change, exists) {
+    const verb = change.kind === 'file-create' ? 'create' : change.kind === 'json-merge' ? 'merge into' : 'edit';
+    const target = exists ? change.path : `${change.path} (new file)`;
+    return `${verb} ${target}`;
+}
+function renderChangeSection(change, before, after, exists) {
+    const lines = [];
+    lines.push(`## ${change.path}`);
+    lines.push('');
+    lines.push(`- kind: \`${change.kind}\``, `- marker: \`${change.marker ?? '(none)'}\``, `- target ${exists ? 'exists' : 'does not exist'} on disk`);
+    lines.push('');
+    lines.push('```diff');
+    const beforeBlock = before === '' ? '(empty / file does not exist)' : before;
+    for (const line of beforeBlock.split('\n'))
+        lines.push(`--- ${line}`);
+    lines.push('');
+    for (const line of after.split('\n'))
+        lines.push(`+++ ${line}`);
+    lines.push('```');
+    return lines.join('\n');
+}
+/**
+ * Render the "after" content per change kind. For json-merge we stringify
+ * the patch payload; for text-insert / file-create we load the template
+ * from the recipe directory (when present).
+ */
+function renderAfter(change, recipe, adopterRoot) {
+    if (change.kind === 'json-merge') {
+        return JSON.stringify(change.after ?? {}, null, 2);
+    }
+    if (change.template) {
+        const tplPath = locateRecipeTemplate(recipe, change.template, adopterRoot);
+        if (tplPath && existsSync(tplPath)) {
+            return safeReadFile(tplPath);
+        }
+        return `(template not found on disk: ${change.template})`;
+    }
+    if (typeof change.after === 'string')
+        return change.after;
+    return '';
+}
+/**
+ * Resolve a recipe template path relative to the framework's recipes/
+ * directory. The framework ships recipes at packages/framework/recipes/
+ * <id>/templates/. We compute the directory from this module's location
+ * so the resolver works regardless of cwd.
+ */
+function locateRecipeTemplate(recipe, templateName, _adopterRoot) {
+    // __dirname → packages/framework/src/cli/verify-proof/sandbox/
+    // → up four levels → packages/framework/
+    // Defense-in-depth: reject `../` escapes in templateName AND validate
+    // recipeId so a crafted id (e.g. '../../evil') cannot shift the anchor
+    // outside the framework root. discoverBundledRecipes() skips schema
+    // validation, so the ^[a-z][a-z0-9_-]*$ pattern may not have been enforced.
+    if (typeof recipe.recipeId !== 'string' || !/^[a-z][a-z0-9_-]*$/.test(recipe.recipeId)) {
+        return null;
+    }
+    const frameworkRoot = resolve(__dirname, '..', '..', '..', '..');
+    const templatesRoot = join(frameworkRoot, 'recipes', recipe.recipeId, 'templates');
+    return safeJoinUnderRoot(templatesRoot, templateName);
+}
+function safeReadFile(path) {
+    try {
+        return readFileSync(path, 'utf-8');
+    }
+    catch {
+        return '';
+    }
+}
+//# sourceMappingURL=recipe-diff.mjs.map

package/dist/cli/verify-proof/sandbox/recipe-diff.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipe-diff.mjs","sourceRoot":"","sources":["../../../../src/cli/verify-proof/sandbox/recipe-diff.mjs"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAExC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AAEzD;;;;;;;;;GASG;AACH,SAAS,iBAAiB,CAAC,OAAO,EAAE,OAAO;IAC1C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACpE,IAAI,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAA;IACpC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAC3C,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;IACxC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACxD,OAAO,SAAS,CAAA;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE;IACnE,MAAM,MAAM,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAA;IACxE,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO;YACN,MAAM,EAAE,UAAU;YAClB,IAAI,EAAE,uCAAuC,QAAQ,6CAA6C;YAClG,OAAO,EAAE,EAAE;YACX,QAAQ,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE;SACtE,CAAA;IACF,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IACvC,MAAM,UAAU,GAAG,EAAE,CAAA;IACrB,MAAM,QAAQ,GAAG,EAAE,CAAA;IAEnB,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QAC3C,4DAA4D;QAC5D,kEAAkE;QAClE,gEAAgE;QAChE,6DAA6D;QAC7D,MAAM,SAAS,GAAG,iBAAiB,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QAC7D,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CACZ,MAAM,MAAM,CAAC,IAAI,sEAAsE,CACvF,CAAA;YACD,UAAU,CAAC,IAAI,CAAC;gBACf,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE,8BAA8B;aACvC,CAAC,CAAA;YACF,SAAQ;QACT,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,CAAA;QACpC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QACpD,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,CAAA;QAEtD,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACnD,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;QAElE,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAA;IAClE,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACzC,OAAO;QACN,MAAM,EAAE,UAAU;QAClB,IAAI;QACJ,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE;YACT,MAAM,EAAE,IAAI;YACZ,cAAc,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI;YAC5C,UAAU,EAAE,IAAI;SAChB;KACD,CAAA;AACF,CAAC;AAED,SAAS,UAAU,CAAC,MAAM,EAAE,QAAQ;IACnC,MAAM,KAAK,GAAG,EAAE,CAAA;IAChB,KAAK,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAA;IAC9D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACd,KAAK,CAAC,IAAI,CACT,iBAAiB,MAAM,CAAC,QAAQ,OAAO,MAAM,CAAC,aAAa,IAAI;QAC9D,2BAA2B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,qBAAqB,IAAI,EAAE,CAAC,GAAG,CACjF,CAAA;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACd,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAA;IACpC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACd,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,aAAa,CAAC,CAAA;IAChF,KAAK,CAAC,IAAI,CACT,wEAAwE;QACvE,sCAAsC,CACvC,CAAA;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACd,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACnB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACf,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;AACnD,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAM,EAAE,MAAM;IAC1C,MAAM,IAAI,GACT,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAA;IAChG,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,aAAa,CAAA;IACjE,OAAO,GAAG,IAAI,IAAI,MAAM,EAAE,CAAA;AAC3B,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;IACzD,MAAM,KAAK,GAAG,EAAE,CAAA;IAChB,KAAK,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;IAC/B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACd,KAAK,CAAC,IAAI,CACT,aAAa,MAAM,CAAC,IAAI,IAAI,EAC5B,eAAe,MAAM,CAAC,MAAM,IAAI,QAAQ,IAAI,EAC5C,YAAY,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,UAAU,CAC1D,CAAA;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACd,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACrB,MAAM,WAAW,GAAG,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,MAAM,CAAA;IAC5E,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAA;IACrE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACd,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAA;IAC/D,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACjB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACxB,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW;IAC/C,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IACnD,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;QAC1E,IAAI,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACpC,OAAO,YAAY,CAAC,OAAO,CAAC,CAAA;QAC7B,CAAC;QACD,OAAO,gCAAgC,MAAM,CAAC,QAAQ,GAAG,CAAA;IAC1D,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,KAAK,CAAA;IACzD,OAAO,EAAE,CAAA;AACV,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY;IAC/D,+DAA+D;IAC/D,yCAAyC;IACzC,sEAAsE;IACtE,uEAAuE;IACvE,oEAAoE;IACpE,4EAA4E;IAC5E,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxF,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,MAAM,aAAa,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;IAChE,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;IAClF,OAAO,iBAAiB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;AACtD,CAAC;AAED,SAAS,YAAY,CAAC,IAAI;IACzB,IAAI,CAAC;QACJ,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACnC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAA;IACV,CAAC;AACF,CAAC"}

package/dist/cli/verify-proof/sandbox/sandbox-config.d.mts

@@ -0,0 +1,25 @@
+/**
+ * Resolve the framework's recipes directory at runtime. Works whether
+ * the module is loaded from source (packages/framework/src/...) or from
+ * the installed dist (.aperant/deps/node_modules/@aperant/framework/...).
+ *
+ * @returns {string}
+ */
+export function resolveRecipesDir(): string;
+/**
+ * Walk the recipes/ directory and return every recipe.json that parses.
+ * Each entry is the raw recipe object (NOT validated — callers can
+ * call validateManifest if they need schema guarantees).
+ *
+ * @returns {Array<object>}
+ */
+export function discoverBundledRecipes(): Array<object>;
+/**
+ * Read .aperant/config.json's verification.sandbox block, or null when
+ * absent / unparseable. Pure read — no defaults injected.
+ *
+ * @param {string} projectDir
+ * @returns {object|null}
+ */
+export function readSandboxConfig(projectDir: string): object | null;
+//# sourceMappingURL=sandbox-config.d.mts.map

package/dist/cli/verify-proof/sandbox/sandbox-config.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-config.d.mts","sourceRoot":"","sources":["../../../../src/cli/verify-proof/sandbox/sandbox-config.mjs"],"names":[],"mappings":"AA0BA;;;;;;GAMG;AACH,qCAFa,MAAM,CAMlB;AAED;;;;;;GAMG;AACH,0CAFa,KAAK,CAAC,MAAM,CAAC,CAiBzB;AAED;;;;;;GAMG;AACH,8CAHW,MAAM,GACJ,MAAM,GAAC,IAAI,CAavB"}

package/dist/cli/verify-proof/sandbox/sandbox-config.mjs

@@ -0,0 +1,85 @@
+/**
+ * sandbox-config.mjs — central loader for sandbox recipes + the
+ * adopter's verification.sandbox config block.
+ *
+ * Two responsibilities:
+ *
+ *   1. discoverBundledRecipes() — walk packages/framework/recipes/<id>/
+ *      and return every parseable recipe.json. Mirrors the bundled-
+ *      drivers discovery pattern in commands/detect-runtime.mjs.
+ *
+ *   2. readSandboxConfig(projectDir) — read .aperant/config.json's
+ *      verification.sandbox block (or null if absent). Pure read; no
+ *      merge with config.local.json — sandbox state is shared, not
+ *      per-device.
+ *
+ * Stays in src/cli/verify-proof/sandbox/ so consumers under that tree
+ * share one loader. The CLI commands (recipe-diff, apply-recipe,
+ * verify-sandbox) all import from here.
+ */
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+const __dirname = dirname(fileURLToPath(import.meta.url));
+/**
+ * Resolve the framework's recipes directory at runtime. Works whether
+ * the module is loaded from source (packages/framework/src/...) or from
+ * the installed dist (.aperant/deps/node_modules/@aperant/framework/...).
+ *
+ * @returns {string}
+ */
+export function resolveRecipesDir() {
+    // __dirname → packages/framework/src/cli/verify-proof/sandbox/
+    // → up four levels → packages/framework/
+    return resolve(__dirname, '..', '..', '..', '..', 'recipes');
+}
+/**
+ * Walk the recipes/ directory and return every recipe.json that parses.
+ * Each entry is the raw recipe object (NOT validated — callers can
+ * call validateManifest if they need schema guarantees).
+ *
+ * @returns {Array<object>}
+ */
+export function discoverBundledRecipes() {
+    const dir = resolveRecipesDir();
+    if (!existsSync(dir))
+        return [];
+    const out = [];
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+        if (!entry.isDirectory())
+            continue;
+        const recipePath = join(dir, entry.name, 'recipe.json');
+        if (!existsSync(recipePath))
+            continue;
+        try {
+            out.push(JSON.parse(readFileSync(recipePath, 'utf-8')));
+        }
+        catch {
+            /* skip malformed recipes */
+        }
+    }
+    return out;
+}
+/**
+ * Read .aperant/config.json's verification.sandbox block, or null when
+ * absent / unparseable. Pure read — no defaults injected.
+ *
+ * @param {string} projectDir
+ * @returns {object|null}
+ */
+export function readSandboxConfig(projectDir) {
+    const path = join(resolve(projectDir), '.aperant', 'config.json');
+    if (!existsSync(path))
+        return null;
+    try {
+        const config = JSON.parse(readFileSync(path, 'utf-8'));
+        const v = config?.verification;
+        if (v === null || typeof v !== 'object')
+            return null;
+        return v.sandbox ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=sandbox-config.mjs.map