@aperant/framework 0.6.2

package/dist/cli/profile/schema.mjs

@@ -0,0 +1,44 @@
+/**
+ * profile/schema.mjs — Zod schema for C19 profiles.
+ *
+ * Lives in `.mjs` (not the `.ts` sibling at `src/schemas/profile.ts`) so raw
+ * Node can consume it from the apt-tools CLI without relying on experimental
+ * TypeScript stripping. `src/schemas/profile.ts` re-exports these values and
+ * layers on TS types for the schema-package surface.
+ */
+import { z } from 'zod';
+export const SLUG_RE = /^[a-z0-9][a-z0-9-]*$/;
+const SlugString = z
+    .string()
+    .regex(SLUG_RE, 'must match /^[a-z0-9][a-z0-9-]*$/ (lowercase, digits, hyphens)');
+// Severity vocabulary matches the Principle shape emitted by
+// src/cli/constitution/parse.mjs:parseAgentsMd so profile obligations append
+// cleanly into the principle list without a translation layer.
+export const SEVERITY_VALUES = ['must', 'should', 'never', 'principle', 'obligation'];
+const SeverityEnum = z.enum(SEVERITY_VALUES);
+export const ObligationSchema = z
+    .object({
+    id: z.string().regex(SLUG_RE, 'obligation id must match /^[a-z0-9][a-z0-9-]*$/'),
+    title: z.string().min(1),
+    text: z.string().min(1),
+    severity: SeverityEnum,
+})
+    .strict();
+const StringRecord = z.record(z.string(), z.string());
+export const ProfileSchema = z
+    .object({
+    name: SlugString,
+    extends: SlugString.optional(),
+    description: z.string().optional(),
+    obligations: z.array(ObligationSchema).optional(),
+    conventions: StringRecord.optional(),
+    tooling: StringRecord.optional(),
+    merge_obligations: z.boolean().optional(),
+    merge_conventions: z.boolean().optional(),
+    merge_tooling: z.boolean().optional(),
+})
+    .strict();
+export function validateProfile(data) {
+    return ProfileSchema.safeParse(data);
+}
+//# sourceMappingURL=schema.mjs.map

package/dist/cli/profile/schema.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.mjs","sourceRoot":"","sources":["../../../src/cli/profile/schema.mjs"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,MAAM,CAAC,MAAM,OAAO,GAAG,sBAAsB,CAAA;AAE7C,MAAM,UAAU,GAAG,CAAC;KAClB,MAAM,EAAE;KACR,KAAK,CAAC,OAAO,EAAE,gEAAgE,CAAC,CAAA;AAElF,6DAA6D;AAC7D,6EAA6E;AAC7E,+DAA+D;AAC/D,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,CAAC,CAAA;AAErF,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;AAE5C,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACP,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,iDAAiD,CAAC;IAChF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,QAAQ,EAAE,YAAY;CACtB,CAAC;KACD,MAAM,EAAE,CAAA;AAEV,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;AAErD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC5B,MAAM,CAAC;IACP,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,UAAU,CAAC,QAAQ,EAAE;IAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,YAAY,CAAC,QAAQ,EAAE;IACpC,OAAO,EAAE,YAAY,CAAC,QAAQ,EAAE;IAChC,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACzC,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACzC,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC;KACD,MAAM,EAAE,CAAA;AAEV,MAAM,UAAU,eAAe,CAAC,IAAI;IACnC,OAAO,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;AACrC,CAAC"}

package/dist/cli/risk/globs.d.mts

@@ -0,0 +1,23 @@
+/**
+ * globs.mjs — glob matcher + risk-class path classifier (C29).
+ */
+/**
+ * Convert a simple glob pattern to a RegExp.
+ * Supports ** (any path segments) and * (any chars except /).
+ * Bounded: rejects patterns longer than 200 chars to prevent ReDoS (T-10-02).
+ */
+export function globToRegex(pattern: any): RegExp | null;
+/**
+ * Match a file path against an array of glob patterns.
+ * Returns the first matching pattern or null.
+ */
+export function matchGlobs(filepath: any, patterns: any): any;
+/**
+ * Classify a single file path against the risk map.
+ * Checks critical first, then elevated, then safe. Unmatched = Normal.
+ */
+export function classifyPath(filepath: any, riskMap: any): {
+    risk_class: string;
+    matched_pattern: any;
+};
+//# sourceMappingURL=globs.d.mts.map

package/dist/cli/risk/globs.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"globs.d.mts","sourceRoot":"","sources":["../../../src/cli/risk/globs.mjs"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;;GAIG;AACH,yDA4BC;AAED;;;GAGG;AACH,8DAMC;AAED;;;GAGG;AACH;;;EAYC"}

package/dist/cli/risk/globs.mjs

@@ -0,0 +1,73 @@
+/**
+ * globs.mjs — glob matcher + risk-class path classifier (C29).
+ */
+/**
+ * Convert a simple glob pattern to a RegExp.
+ * Supports ** (any path segments) and * (any chars except /).
+ * Bounded: rejects patterns longer than 200 chars to prevent ReDoS (T-10-02).
+ */
+export function globToRegex(pattern) {
+    if (pattern.length > 200)
+        return null;
+    let re = '';
+    let i = 0;
+    while (i < pattern.length) {
+        const ch = pattern[i];
+        if (ch === '*' && pattern[i + 1] === '*') {
+            // ** matches any path segments (including empty)
+            re += '.*';
+            i += 2;
+            // Skip trailing / after **
+            if (pattern[i] === '/')
+                i++;
+        }
+        else if (ch === '*') {
+            // * matches anything except /
+            re += '[^/]*';
+            i++;
+        }
+        else if (ch === '?') {
+            re += '[^/]';
+            i++;
+        }
+        else if ('.+^${}()|[]\\'.includes(ch)) {
+            re += '\\' + ch;
+            i++;
+        }
+        else {
+            re += ch;
+            i++;
+        }
+    }
+    return new RegExp('^' + re + '$');
+}
+/**
+ * Match a file path against an array of glob patterns.
+ * Returns the first matching pattern or null.
+ */
+export function matchGlobs(filepath, patterns) {
+    for (const pattern of patterns) {
+        const re = globToRegex(pattern);
+        if (re && re.test(filepath))
+            return pattern;
+    }
+    return null;
+}
+/**
+ * Classify a single file path against the risk map.
+ * Checks critical first, then elevated, then safe. Unmatched = Normal.
+ */
+export function classifyPath(filepath, riskMap) {
+    // Critical wins — check first
+    const critMatch = matchGlobs(filepath, riskMap.critical_paths || []);
+    if (critMatch)
+        return { risk_class: 'Critical', matched_pattern: critMatch };
+    const elevMatch = matchGlobs(filepath, riskMap.elevated_paths || []);
+    if (elevMatch)
+        return { risk_class: 'Elevated', matched_pattern: elevMatch };
+    const safeMatch = matchGlobs(filepath, riskMap.safe_paths || []);
+    if (safeMatch)
+        return { risk_class: 'Safe', matched_pattern: safeMatch };
+    return { risk_class: 'Normal', matched_pattern: null };
+}
+//# sourceMappingURL=globs.mjs.map

package/dist/cli/risk/globs.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"globs.mjs","sourceRoot":"","sources":["../../../src/cli/risk/globs.mjs"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,OAAO;IAClC,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAA;IACrC,IAAI,EAAE,GAAG,EAAE,CAAA;IACX,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;QACrB,IAAI,EAAE,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAC1C,iDAAiD;YACjD,EAAE,IAAI,IAAI,CAAA;YACV,CAAC,IAAI,CAAC,CAAA;YACN,2BAA2B;YAC3B,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,CAAC,EAAE,CAAA;QAC5B,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACvB,8BAA8B;YAC9B,EAAE,IAAI,OAAO,CAAA;YACb,CAAC,EAAE,CAAA;QACJ,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACvB,EAAE,IAAI,MAAM,CAAA;YACZ,CAAC,EAAE,CAAA;QACJ,CAAC;aAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACzC,EAAE,IAAI,IAAI,GAAG,EAAE,CAAA;YACf,CAAC,EAAE,CAAA;QACJ,CAAC;aAAM,CAAC;YACP,EAAE,IAAI,EAAE,CAAA;YACR,CAAC,EAAE,CAAA;QACJ,CAAC;IACF,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,GAAG,GAAG,EAAE,GAAG,GAAG,CAAC,CAAA;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,QAAQ,EAAE,QAAQ;IAC5C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAChC,MAAM,EAAE,GAAG,WAAW,CAAC,OAAO,CAAC,CAAA;QAC/B,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,OAAO,CAAA;IAC5C,CAAC;IACD,OAAO,IAAI,CAAA;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,QAAQ,EAAE,OAAO;IAC7C,8BAA8B;IAC9B,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAA;IACpE,IAAI,SAAS;QAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,SAAS,EAAE,CAAA;IAE5E,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAA;IACpE,IAAI,SAAS;QAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,SAAS,EAAE,CAAA;IAE5E,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAA;IAChE,IAAI,SAAS;QAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,CAAA;IAExE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,CAAA;AACvD,CAAC"}

package/dist/cli/risk/postcondition.d.mts

@@ -0,0 +1,46 @@
+/**
+ * Evaluate a subtask postcondition predicate. Supports three shapes:
+ *   { cmd: "pnpm test -- auth.spec" }        — exit code 0 = pass
+ *   { file_contains: "export ...", path: "src/x.ts" }
+ *   { file_exists: "src/x.ts" }
+ * Returns { ok: boolean, kind, reason }. Trivially-satisfied predicates
+ * (empty object, unknown shape) are REJECTED — per R3 the planner must
+ * produce a real check, not a rubber stamp.
+ */
+export function evaluatePostcondition(pc: any, targetDir: any): {
+    ok: boolean;
+    kind: string;
+    reason: string;
+    cmd?: undefined;
+    path?: undefined;
+    expected?: undefined;
+} | {
+    ok: boolean;
+    kind: string;
+    cmd: any;
+    reason?: undefined;
+    path?: undefined;
+    expected?: undefined;
+} | {
+    ok: boolean;
+    kind: string;
+    cmd: any;
+    reason: any;
+    path?: undefined;
+    expected?: undefined;
+} | {
+    ok: boolean;
+    kind: string;
+    path: any;
+    expected: any;
+    reason: string | null;
+    cmd?: undefined;
+} | {
+    ok: boolean;
+    kind: string;
+    path: any;
+    reason: string | null;
+    cmd?: undefined;
+    expected?: undefined;
+};
+//# sourceMappingURL=postcondition.d.mts.map

package/dist/cli/risk/postcondition.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postcondition.d.mts","sourceRoot":"","sources":["../../../src/cli/risk/postcondition.mjs"],"names":[],"mappings":"AAQA;;;;;;;;GAQG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgDC"}

package/dist/cli/risk/postcondition.mjs

@@ -0,0 +1,67 @@
+/**
+ * postcondition.mjs — subtask postcondition evaluator (C29).
+ */
+import { execSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+/**
+ * Evaluate a subtask postcondition predicate. Supports three shapes:
+ *   { cmd: "pnpm test -- auth.spec" }        — exit code 0 = pass
+ *   { file_contains: "export ...", path: "src/x.ts" }
+ *   { file_exists: "src/x.ts" }
+ * Returns { ok: boolean, kind, reason }. Trivially-satisfied predicates
+ * (empty object, unknown shape) are REJECTED — per R3 the planner must
+ * produce a real check, not a rubber stamp.
+ */
+export function evaluatePostcondition(pc, targetDir) {
+    if (!pc || typeof pc !== 'object' || Array.isArray(pc)) {
+        return { ok: false, kind: 'invalid', reason: 'postcondition is not an object' };
+    }
+    if (typeof pc.cmd === 'string' && pc.cmd.trim().length > 0) {
+        try {
+            execSync(pc.cmd, { cwd: targetDir, stdio: 'pipe', encoding: 'utf-8', timeout: 120000 });
+            return { ok: true, kind: 'cmd', cmd: pc.cmd };
+        }
+        catch (err) {
+            const stderr = err.stderr ? String(err.stderr).slice(0, 500) : '';
+            const msg = err.message ? err.message.slice(0, 200) : 'non-zero exit';
+            return { ok: false, kind: 'cmd', cmd: pc.cmd, reason: stderr || msg };
+        }
+    }
+    if (typeof pc.file_contains === 'string' && typeof pc.path === 'string') {
+        try {
+            const content = readFileSync(join(targetDir, pc.path), 'utf-8');
+            const found = content.includes(pc.file_contains);
+            return {
+                ok: found,
+                kind: 'file_contains',
+                path: pc.path,
+                expected: pc.file_contains,
+                reason: found ? null : 'substring not found',
+            };
+        }
+        catch (err) {
+            return {
+                ok: false,
+                kind: 'file_contains',
+                path: pc.path,
+                reason: `read failed: ${err.message}`,
+            };
+        }
+    }
+    if (typeof pc.file_exists === 'string') {
+        const exists = existsSync(join(targetDir, pc.file_exists));
+        return {
+            ok: exists,
+            kind: 'file_exists',
+            path: pc.file_exists,
+            reason: exists ? null : 'file missing',
+        };
+    }
+    return {
+        ok: false,
+        kind: 'unknown',
+        reason: 'postcondition shape not recognized (need cmd | file_contains+path | file_exists)',
+    };
+}
+//# sourceMappingURL=postcondition.mjs.map

package/dist/cli/risk/postcondition.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"postcondition.mjs","sourceRoot":"","sources":["../../../src/cli/risk/postcondition.mjs"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,EAAE,EAAE,SAAS;IAClD,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAA;IAChF,CAAC;IACD,IAAI,OAAO,EAAE,CAAC,GAAG,KAAK,QAAQ,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC;YACJ,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;YACvF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,CAAA;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YACjE,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAA;YACrE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,IAAI,GAAG,EAAE,CAAA;QACtE,CAAC;IACF,CAAC;IACD,IAAI,OAAO,EAAE,CAAC,aAAa,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACzE,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAA;YAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,aAAa,CAAC,CAAA;YAChD,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,eAAe;gBACrB,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,QAAQ,EAAE,EAAE,CAAC,aAAa;gBAC1B,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB;aAC5C,CAAA;QACF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,eAAe;gBACrB,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,MAAM,EAAE,gBAAgB,GAAG,CAAC,OAAO,EAAE;aACrC,CAAA;QACF,CAAC;IACF,CAAC;IACD,IAAI,OAAO,EAAE,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAA;QAC1D,OAAO;YACN,EAAE,EAAE,MAAM;YACV,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,EAAE,CAAC,WAAW;YACpB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc;SACtC,CAAA;IACF,CAAC;IACD,OAAO;QACN,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,kFAAkF;KAC1F,CAAA;AACF,CAAC"}

package/dist/cli/risk/secrets.d.mts

@@ -0,0 +1,6 @@
+export function scanFileForSecrets(filePath: any): any[];
+export const SECRET_PATTERNS: {
+    id: string;
+    re: RegExp;
+}[];
+//# sourceMappingURL=secrets.d.mts.map

package/dist/cli/risk/secrets.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.mts","sourceRoot":"","sources":["../../../src/cli/risk/secrets.mjs"],"names":[],"mappings":"AA0BA,yDAYC;AA3BD;;;IAaC"}

package/dist/cli/risk/secrets.mjs

@@ -0,0 +1,39 @@
+/**
+ * secrets.mjs — pre-commit secret-pattern tripwire (C29).
+ *
+ * Regexes covering the common secret shapes. Not a replacement for gitleaks
+ * — this is the pre-commit tripwire so an artifact containing a leaked token
+ * never gets staged. False positives are acceptable; false negatives are the
+ * thing we refuse to ship.
+ */
+import { readFileSync } from 'node:fs';
+export const SECRET_PATTERNS = [
+    { id: 'aws-access-key', re: /AKIA[0-9A-Z]{16}/ },
+    { id: 'github-pat', re: /gh[pousr]_[A-Za-z0-9]{36,}/ },
+    { id: 'openai-api-key', re: /sk-[A-Za-z0-9]{32,}/ },
+    { id: 'anthropic-api-key', re: /sk-ant-[A-Za-z0-9\-_]{32,}/ },
+    { id: 'slack-token', re: /xox[baprs]-[A-Za-z0-9-]{10,}/ },
+    { id: 'private-key-block', re: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----/ },
+    // JWT — require 3 base64url segments of meaningful length, and skip the
+    // short sample tokens that litter docs/tests.
+    { id: 'jwt', re: /eyJ[A-Za-z0-9_-]{20,}\.eyJ[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}/ },
+    // "aws_secret_access_key" line with an actual 40-char value — scoped to
+    // contexts that name the key, so commit hashes don't trip the scan.
+    { id: 'aws-secret-key', re: /aws[_-]?secret[_-]?access[_-]?key["'\s:=]+[A-Za-z0-9/+=]{40}/i },
+];
+export function scanFileForSecrets(filePath) {
+    const hits = [];
+    let content;
+    try {
+        content = readFileSync(filePath, 'utf-8');
+    }
+    catch {
+        return hits;
+    }
+    for (const { id, re } of SECRET_PATTERNS) {
+        if (re.test(content))
+            hits.push(id);
+    }
+    return hits;
+}
+//# sourceMappingURL=secrets.mjs.map

package/dist/cli/risk/secrets.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.mjs","sourceRoot":"","sources":["../../../src/cli/risk/secrets.mjs"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAEtC,MAAM,CAAC,MAAM,eAAe,GAAG;IAC9B,EAAE,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,kBAAkB,EAAE;IAChD,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,4BAA4B,EAAE;IACtD,EAAE,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,qBAAqB,EAAE;IACnD,EAAE,EAAE,EAAE,mBAAmB,EAAE,EAAE,EAAE,4BAA4B,EAAE;IAC7D,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,8BAA8B,EAAE;IACzD,EAAE,EAAE,EAAE,mBAAmB,EAAE,EAAE,EAAE,6DAA6D,EAAE;IAC9F,wEAAwE;IACxE,8CAA8C;IAC9C,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,kEAAkE,EAAE;IACrF,wEAAwE;IACxE,oEAAoE;IACpE,EAAE,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,+DAA+D,EAAE;CAC7F,CAAA;AAED,MAAM,UAAU,kBAAkB,CAAC,QAAQ;IAC1C,MAAM,IAAI,GAAG,EAAE,CAAA;IACf,IAAI,OAAO,CAAA;IACX,IAAI,CAAC;QACJ,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC1C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,KAAK,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,eAAe,EAAE,CAAC;QAC1C,IAAI,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACpC,CAAC;IACD,OAAO,IAAI,CAAA;AACZ,CAAC"}

package/dist/cli/roadmap/io.d.mts

@@ -0,0 +1,30 @@
+/**
+ * Load the roadmap for a scope.
+ *
+ * Read preference:
+ *   1. If phases/ has at least one JSON file, reconstruct from there and
+ *      return. Never consult the legacy blob in this case (subtask 11
+ *      hardens this, subtask 10 already prefers phases/ when available).
+ *   2. Else if legacy milestones.json exists, parse it, auto-migrate each
+ *      phase into phases/ so the next reader hits the fast path, then return
+ *      the parsed legacy blob.
+ *   3. Else return null.
+ */
+export function loadRoadmapForScope(targetDir: any, scope: any): any;
+/**
+ * Save the roadmap for a scope (dual-write).
+ *
+ *   - Writes legacy milestones.json + ROADMAP.md atomically under a single
+ *     file lock (same behavior as before R5).
+ *   - Iterates milestones + phases and calls savePhaseFile for each, so the
+ *     per-phase layout stays in sync with the blob.
+ *
+ * The two writes are NOT atomic with each other (they hold separate locks),
+ * but both use atomic tmp+rename so neither can produce a torn file. During
+ * Wave 2 a partial failure is tolerable: the next load will prefer whichever
+ * layout completed (phases/ wins if any file landed), and saveRoadmapForScope
+ * will re-sync both on the next save.
+ */
+export function saveRoadmapForScope(targetDir: any, scope: any, roadmap: any): void;
+export function findMilestoneScopeGlobal(targetDir: any, milestoneId: any): string | null;
+//# sourceMappingURL=io.d.mts.map

package/dist/cli/roadmap/io.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"io.d.mts","sourceRoot":"","sources":["../../../src/cli/roadmap/io.mjs"],"names":[],"mappings":"AA0BA;;;;;;;;;;;GAWG;AACH,qEAgCC;AAsED;;;;;;;;;;;;;GAaG;AACH,oFAsBC;AAED,0FASC"}

package/dist/cli/roadmap/io.mjs

@@ -0,0 +1,189 @@
+/**
+ * io.mjs — roadmap read/write/lookup helpers (C29, R5).
+ *
+ * R5 (subtask 10): dual-write transition.
+ *   - saveRoadmapForScope writes BOTH the legacy milestones.json AND per-phase
+ *     files under .aperant/roadmap/{scope}/phases/{phase-id}.json. This keeps
+ *     rollback possible until Wave 3 removes the legacy write.
+ *   - loadRoadmapForScope prefers phases/ when any phase file exists. If only
+ *     the legacy blob is present, parse it AND trigger a one-way migration
+ *     (savePhaseFile for every phase, legacy file preserved on disk).
+ *
+ * Subtask 11 tightens the read to NEVER fall back once phases/ exists, closing
+ * the window where a stale milestones.json could mask a fresh phase update.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { withFileLock } from '../util/fs-lock.mjs';
+import { listRoadmapScopes, roadmapScopePaths } from './paths.mjs';
+import { hasPhaseFiles, loadPhasesAsRoadmap, migrateRoadmapToPhasesDir, savePhaseFile, } from './phases-io.mjs';
+import { renderRoadmapMd } from './render.mjs';
+/**
+ * Load the roadmap for a scope.
+ *
+ * Read preference:
+ *   1. If phases/ has at least one JSON file, reconstruct from there and
+ *      return. Never consult the legacy blob in this case (subtask 11
+ *      hardens this, subtask 10 already prefers phases/ when available).
+ *   2. Else if legacy milestones.json exists, parse it, auto-migrate each
+ *      phase into phases/ so the next reader hits the fast path, then return
+ *      the parsed legacy blob.
+ *   3. Else return null.
+ */
+export function loadRoadmapForScope(targetDir, scope) {
+    if (hasPhaseFiles(targetDir, scope)) {
+        const reconstructed = loadPhasesAsRoadmap(targetDir, scope);
+        // C12 overlay: milestone-level fields (today: seed_id) live only in
+        // the legacy milestones.json blob, not in phases/{id}.json. During
+        // Wave 2 dual-write, the legacy blob is kept in lockstep with phases/,
+        // so we overlay those fields on top of the phases/-reconstructed
+        // output. This preserves two invariants simultaneously:
+        //   1. A clean `seed assign` round-trips: seeds.json ↔ reconstructed
+        //      roadmap agree (seed_id present on both sides).
+        //   2. A hand-edit that strips seed_id from milestones.json shows up
+        //      as drift — the overlay simply finds no value to overlay, so
+        //      validate sees the milestone without seed_id and flags
+        //      `missing-seed-id`.
+        // After Wave 3 removes the legacy blob, seed_id will need to live on
+        // either phases/ records or a per-milestone sidecar; this overlay is
+        // a transition helper, not a permanent fixture.
+        if (reconstructed)
+            overlayLegacyMilestoneFields(targetDir, scope, reconstructed);
+        return reconstructed;
+    }
+    const { jsonPath } = roadmapScopePaths(targetDir, scope);
+    if (!existsSync(jsonPath))
+        return null;
+    const legacy = JSON.parse(readFileSync(jsonPath, 'utf-8'));
+    // Fire-and-forget migration. Non-destructive: leaves milestones.json on
+    // disk. Best-effort — if the migration throws (permissions, disk full),
+    // we still return the parsed legacy blob so the caller isn't blocked.
+    try {
+        migrateRoadmapToPhasesDir(targetDir, scope);
+    }
+    catch {
+        /* migration retries next load */
+    }
+    return legacy;
+}
+/**
+ * Merge milestone-level fields from the legacy milestones.json blob onto a
+ * phases/-reconstructed roadmap. Today only `seed_id` participates — the
+ * phases/ layout doesn't own milestone metadata, so we copy from the legacy
+ * blob when it exists. Missing blob ⇒ no overlay, no error.
+ *
+ * Also surfaces empty-phases milestones. The phases/-reconstruction drops
+ * milestones that own zero phase files, because the reconstruction is built
+ * by grouping phase files by `milestone_id`. Freshly-added milestones (via
+ * `roadmap add-milestone`) start life with `phases: []`, so they exist in
+ * the legacy blob but never in the phases/ layout until the first phase is
+ * added. Without this augmentation, `findMilestoneScopes` (and any caller
+ * of `loadRoadmapForScope`) can't see a just-added milestone, and
+ * `add-phase --milestone <new-id>` fails with "not found in scope …".
+ * The legacy blob stays authoritative for the milestone *set*; the
+ * phases/ layout stays authoritative for phase *data*.
+ */
+function overlayLegacyMilestoneFields(targetDir, scope, reconstructed) {
+    const { jsonPath } = roadmapScopePaths(targetDir, scope);
+    if (!existsSync(jsonPath))
+        return;
+    let legacy;
+    try {
+        legacy = JSON.parse(readFileSync(jsonPath, 'utf-8'));
+    }
+    catch {
+        return;
+    }
+    if (!legacy || !Array.isArray(legacy.milestones))
+        return;
+    const legacyById = new Map(legacy.milestones.map((m) => [m.id, m]));
+    const reconstructedIds = new Set((reconstructed.milestones || []).map((m) => m && m.id).filter(Boolean));
+    for (const ms of reconstructed.milestones || []) {
+        const legacyMs = legacyById.get(ms.id);
+        if (!legacyMs)
+            continue;
+        if (Object.hasOwn(legacyMs, 'seed_id')) {
+            ms.seed_id = legacyMs.seed_id;
+        }
+        // C33 — milestone-level `status` is a derived rollup value that also
+        // lives only in the legacy blob (phases/ per-file records describe
+        // phases, not milestones). Overlay so the phases/-preferred read path
+        // returns the cached rollup, and writers see the current value for
+        // change-detection.
+        if (Object.hasOwn(legacyMs, 'status')) {
+            ms.status = legacyMs.status;
+        }
+    }
+    // Append empty-phases milestones that the phases/ reconstruction missed.
+    // We only append when the legacy record itself has zero phases — a legacy
+    // milestone with phases that are absent from phases/ is data drift the
+    // operator should resolve, not a new blank milestone we should resurrect.
+    if (!reconstructed.milestones)
+        reconstructed.milestones = [];
+    for (const legacyMs of legacy.milestones) {
+        if (!legacyMs || !legacyMs.id)
+            continue;
+        if (reconstructedIds.has(legacyMs.id))
+            continue;
+        const legacyPhases = Array.isArray(legacyMs.phases) ? legacyMs.phases : [];
+        if (legacyPhases.length > 0)
+            continue;
+        reconstructed.milestones.push({
+            id: legacyMs.id,
+            title: legacyMs.title || legacyMs.id,
+            goal: legacyMs.goal || '',
+            scope: legacyMs.scope || scope,
+            phases: [],
+            ...(Object.hasOwn(legacyMs, 'seed_id') ? { seed_id: legacyMs.seed_id } : {}),
+            ...(Object.hasOwn(legacyMs, 'status') ? { status: legacyMs.status } : {}),
+        });
+    }
+}
+/**
+ * Save the roadmap for a scope (dual-write).
+ *
+ *   - Writes legacy milestones.json + ROADMAP.md atomically under a single
+ *     file lock (same behavior as before R5).
+ *   - Iterates milestones + phases and calls savePhaseFile for each, so the
+ *     per-phase layout stays in sync with the blob.
+ *
+ * The two writes are NOT atomic with each other (they hold separate locks),
+ * but both use atomic tmp+rename so neither can produce a torn file. During
+ * Wave 2 a partial failure is tolerable: the next load will prefer whichever
+ * layout completed (phases/ wins if any file landed), and saveRoadmapForScope
+ * will re-sync both on the next save.
+ */
+export function saveRoadmapForScope(targetDir, scope, roadmap) {
+    const { scopeDir, jsonPath, mdPath } = roadmapScopePaths(targetDir, scope);
+    roadmap.scope = scope;
+    roadmap.updated_at = new Date().toISOString();
+    mkdirSync(scopeDir, { recursive: true });
+    withFileLock(jsonPath, () => {
+        writeFileSync(jsonPath, JSON.stringify(roadmap, null, 2) + '\n', 'utf-8');
+        writeFileSync(mdPath, renderRoadmapMd(roadmap), 'utf-8');
+    }, { projectRoot: targetDir });
+    // Per-phase dual-write. Each savePhaseFile takes its own file lock, so
+    // concurrent callers never corrupt a phase record.
+    for (const milestone of roadmap.milestones || []) {
+        if (!milestone || !Array.isArray(milestone.phases))
+            continue;
+        for (const phase of milestone.phases) {
+            if (!phase || !phase.id)
+                continue;
+            savePhaseFile(targetDir, scope, milestone, phase);
+        }
+    }
+}
+export function findMilestoneScopeGlobal(targetDir, milestoneId) {
+    const hits = [];
+    for (const scope of listRoadmapScopes(targetDir)) {
+        const rm = loadRoadmapForScope(targetDir, scope);
+        if (rm && (rm.milestones || []).some((m) => m.id === milestoneId))
+            hits.push(scope);
+    }
+    if (hits.length === 0)
+        return null;
+    if (hits.length > 1)
+        return null; // ambiguous — drain treats as no-op
+    return hits[0];
+}
+//# sourceMappingURL=io.mjs.map

package/dist/cli/roadmap/io.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"io.mjs","sourceRoot":"","sources":["../../../src/cli/roadmap/io.mjs"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAClE,OAAO,EACN,aAAa,EACb,mBAAmB,EACnB,yBAAyB,EACzB,aAAa,GACb,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAE9C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAS,EAAE,KAAK;IACnD,IAAI,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,aAAa,GAAG,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;QAC3D,oEAAoE;QACpE,mEAAmE;QACnE,uEAAuE;QACvE,iEAAiE;QACjE,wDAAwD;QACxD,qEAAqE;QACrE,sDAAsD;QACtD,qEAAqE;QACrE,mEAAmE;QACnE,6DAA6D;QAC7D,0BAA0B;QAC1B,qEAAqE;QACrE,qEAAqE;QACrE,gDAAgD;QAChD,IAAI,aAAa;YAAE,4BAA4B,CAAC,SAAS,EAAE,KAAK,EAAE,aAAa,CAAC,CAAA;QAChF,OAAO,aAAa,CAAA;IACrB,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,GAAG,iBAAiB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IACxD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAA;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAA;IAC1D,wEAAwE;IACxE,wEAAwE;IACxE,sEAAsE;IACtE,IAAI,CAAC;QACJ,yBAAyB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACR,iCAAiC;IAClC,CAAC;IACD,OAAO,MAAM,CAAA;AACd,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,4BAA4B,CAAC,SAAS,EAAE,KAAK,EAAE,aAAa;IACpE,MAAM,EAAE,QAAQ,EAAE,GAAG,iBAAiB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IACxD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAM;IACjC,IAAI,MAAM,CAAA;IACV,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAA;IACrD,CAAC;IAAC,MAAM,CAAC;QACR,OAAM;IACP,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QAAE,OAAM;IACxD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IACnE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAC/B,CAAC,aAAa,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CACtE,CAAA;IACD,KAAK,MAAM,EAAE,IAAI,aAAa,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;QACjD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;QACtC,IAAI,CAAC,QAAQ;YAAE,SAAQ;QACvB,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YACxC,EAAE,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAA;QAC9B,CAAC;QACD,qEAAqE;QACrE,mEAAmE;QACnE,sEAAsE;QACtE,mEAAmE;QACnE,oBAAoB;QACpB,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;YACvC,EAAE,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAA;QAC5B,CAAC;IACF,CAAC;IACD,yEAAyE;IACzE,0EAA0E;IAC1E,uEAAuE;IACvE,0EAA0E;IAC1E,IAAI,CAAC,aAAa,CAAC,UAAU;QAAE,aAAa,CAAC,UAAU,GAAG,EAAE,CAAA;IAC5D,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QAC1C,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,SAAQ;QACvC,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAE,SAAQ;QAC/C,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;QAC1E,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;YAAE,SAAQ;QACrC,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC;YAC7B,EAAE,EAAE,QAAQ,CAAC,EAAE;YACf,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,EAAE;YACpC,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,EAAE;YACzB,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,KAAK;YAC9B,MAAM,EAAE,EAAE;YACV,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,CAAC,CAAA;IACH,CAAC;AACF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO;IAC5D,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IAC1E,OAAO,CAAC,KAAK,GAAG,KAAK,CAAA;IACrB,OAAO,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAC7C,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACxC,YAAY,CACX,QAAQ,EACR,GAAG,EAAE;QACJ,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;QACzE,aAAa,CAAC,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAA;IACzD,CAAC,EACD,EAAE,WAAW,EAAE,SAAS,EAAE,CAC1B,CAAA;IACD,uEAAuE;IACvE,mDAAmD;IACnD,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;QAClD,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC;YAAE,SAAQ;QAC5D,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;YACtC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,EAAE;gBAAE,SAAQ;YACjC,aAAa,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;QAClD,CAAC;IACF,CAAC;AACF,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,SAAS,EAAE,WAAW;IAC9D,MAAM,IAAI,GAAG,EAAE,CAAA;IACf,KAAK,MAAM,KAAK,IAAI,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;QAClD,MAAM,EAAE,GAAG,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;QAChD,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,WAAW,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACpF,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAClC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA,CAAC,oCAAoC;IACrE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;AACf,CAAC"}

package/dist/cli/roadmap/lifecycle.d.mts

@@ -0,0 +1,53 @@
+/**
+ * Shared lifecycle phase side-effect helper.
+ *
+ * Applies a phase-status transition to a task's linked roadmap phase, mirroring
+ * what the effects drain used to do — from-state guarded, idempotent, commits
+ * via `syncRoadmapInProcess`.
+ *
+ * Callers:
+ *   - `task update --lifecycle-phase` (mapping lifecycle → phase spec inline)
+ *   - `task close --verdict approved` ({from: 'in-progress', to: 'completed'})
+ *   - The drain's `applyPhaseTransition` wrapper (legacy ops / in-flight queue)
+ *
+ * Contract:
+ *   - No-op (returns null) when `task.milestone_id` / `task.phase_id` missing,
+ *     when the roadmap / milestone / phase can't be located, or when the phase
+ *     is not currently at `spec.from`.
+ *   - On success, mutates `phase.status` (and `phase.completed_at` when
+ *     transitioning to `completed`), writes via `saveRoadmapForScope`, and
+ *     runs `syncRoadmapInProcess` with reason `${reasonPrefix}:${phase_id}`.
+ *
+ * Returns: `{ transition: {op, scope, milestone_id, phase_id, from, to}, commit: string|null } | null`
+ *   - `commit` is the short sha from `syncRoadmapInProcess`, or null when
+ *     the sync was skipped (team mode off / clean / etc).
+ */
+export function applyLifecyclePhaseSideEffect(targetDir: any, task: any, spec: any, reasonPrefix: any, opts?: {}): {
+    transition: {
+        op: any;
+        scope: any;
+        milestone_id: any;
+        phase_id: any;
+        from: any;
+        to: any;
+    };
+    commit: null;
+    rollup?: undefined;
+} | {
+    transition: {
+        op: any;
+        scope: any;
+        milestone_id: any;
+        phase_id: any;
+        from: any;
+        to: any;
+    };
+    commit: string | null;
+    rollup: {
+        before: any;
+        after: "in-progress" | "completed" | "planned" | "blocked" | null;
+        changed: boolean;
+        milestone_id: any;
+    };
+} | null;
+//# sourceMappingURL=lifecycle.d.mts.map

package/dist/cli/roadmap/lifecycle.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.d.mts","sourceRoot":"","sources":["../../../src/cli/roadmap/lifecycle.mjs"],"names":[],"mappings":"AAQA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;SAwEC"}