@astrosheep/keiyaku 2.9.13 → 4.0.0

package/build/core/atomic-publish.js

@@ -1,64 +0,0 @@
-import * as crypto from "node:crypto";
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { isErrnoException } from "../errno.js";
-export class ProjectionStateError extends Error {
-    code = "PROJECTION_STATE_ERROR";
-    constructor(message, options) {
-        super(message, options);
-        this.name = "ProjectionStateError";
-    }
-}
-export function randomHex8() {
-    return crypto.randomBytes(4).toString("hex");
-}
-/**
- * Atomic publish: O_EXCL temp write → linkSync temp→target → unlink temp.
- * link EEXIST returns 'taken' (no retry). Temp EEXIST retries up to maxTempRetries.
- * No startup .tmp.* GC; orphan temps are left behind on unlink failure.
- */
-export function atomicPublishFile(target, content, maxTempRetries = 3, options) {
-    if (!Number.isInteger(maxTempRetries) || maxTempRetries < 1) {
-        throw new ProjectionStateError("maxTempRetries must be a positive integer");
-    }
-    const directory = path.dirname(target);
-    const randomHex = options?.randomHex ?? randomHex8;
-    let tempPath;
-    for (let attempt = 0; attempt < maxTempRetries; attempt += 1) {
-        const candidate = path.join(directory, `.tmp.${randomHex()}`);
-        try {
-            fs.writeFileSync(candidate, content, { flag: "wx" });
-            tempPath = candidate;
-            break;
-        }
-        catch (error) {
-            if (isErrnoException(error) && error.code === "EEXIST") {
-                continue;
-            }
-            throw error;
-        }
-    }
-    if (tempPath === undefined) {
-        throw new ProjectionStateError(`failed to create exclusive temp file for ${target} after ${maxTempRetries} retries (PROJECTION_STATE_ERROR)`);
-    }
-    try {
-        try {
-            fs.linkSync(tempPath, target);
-            return "published";
-        }
-        catch (error) {
-            if (isErrnoException(error) && error.code === "EEXIST") {
-                return "taken";
-            }
-            throw error;
-        }
-    }
-    finally {
-        try {
-            fs.unlinkSync(tempPath);
-        }
-        catch {
-            // Orphan temp is allowed; no GC.
-        }
-    }
-}

package/build/core/audit/candidate.js

@@ -1,141 +0,0 @@
-import * as fs from "node:fs/promises";
-import * as os from "node:os";
-import * as path from "node:path";
-import { FlowError, asMessage } from "../../flow-error.js";
-import { requireCommitCoordinate } from "../../git/commits.js";
-import { createGit } from "../../git/core.js";
-import { readStructuredDiff } from "../../git/diff/structured.js";
-import { abortDetachedRenewChain, buildDetachedRenewChain, renewScratchName } from "../renew-rewrite.js";
-import { isBootstrapSuccess, runWorktreeBootstrap } from "../worktree-bootstrap.js";
-export async function createAuditCandidate(input) {
-    const cwd = await fs.mkdtemp(path.join(os.tmpdir(), "keiyaku-audit-"));
-    const git = createGit(input.root);
-    try {
-        await git.raw(["clone", "--quiet", "--no-hardlinks", "--no-checkout", input.root, cwd]);
-        const candidateGit = createGit(cwd);
-        await candidateGit.raw(["config", "user.name", "Keiyaku Audit"]);
-        await candidateGit.raw(["config", "user.email", "audit@keiyaku.invalid"]);
-        await candidateGit.raw(["checkout", "--quiet", "-B", `keiyaku/${input.contractId}`, input.frozen.coordinates.delivery.head]);
-        if (input.frozen.base === input.frozen.coordinates.target.head)
-            return { cwd, rehearsal: { status: "fresh" }, candidate: { base: input.frozen.coordinates.target.head, head: input.frozen.coordinates.delivery.head, tree: input.frozen.coordinates.delivery.tree, rewritten: false } };
-        const scratchName = renewScratchName(`audit-${input.contractId}-${input.frozen.coordinates.delivery.head}`);
-        const deliveryCommits = (await candidateGit.raw(["rev-list", "--reverse", "--ancestry-path", `${input.frozen.base}..${input.frozen.coordinates.delivery.head}`])).split(/\r?\n/).filter(Boolean);
-        const rewrite = await buildDetachedRenewChain({
-            cwd,
-            scratchName,
-            observedLedgerHead: input.frozen.repository.observedLedgerHead,
-            lifecycleHead: input.frozen.lifecycle.contractHead,
-            deliveryRef: input.frozen.coordinates.delivery.ref,
-            targetRef: input.frozen.coordinates.target.ref,
-            effectiveScope: input.frozen.scope,
-            oldBase: input.frozen.base,
-            oldHead: input.frozen.coordinates.delivery.head,
-            newBase: input.frozen.coordinates.target.head,
-            deliveryCommits,
-        });
-        if (rewrite.status === "conflict") {
-            await abortDetachedRenewChain({ cwd, scratchName });
-            return { cwd, rehearsal: { status: "conflict", paths: [...rewrite.conflictPaths], pathCapture: "captured" }, candidate: null };
-        }
-        await candidateGit.raw(["reset", "--hard", rewrite.newHead]);
-        const coordinate = await requireCommitCoordinate(cwd, "HEAD");
-        return { cwd, rehearsal: { status: "clean", oldBase: input.frozen.base, newBase: input.frozen.coordinates.target.head, oldHead: input.frozen.coordinates.delivery.head }, candidate: { base: input.frozen.coordinates.target.head, head: coordinate.commit, tree: coordinate.tree, rewritten: true } };
-    }
-    catch (error) {
-        return { cwd, rehearsal: { status: "unknown", cause: { code: error instanceof FlowError ? error.code : "INTERNAL_STATE", message: asMessage(error) } }, candidate: null };
-    }
-}
-export async function disposeAuditCandidate(candidate) { await fs.rm(candidate.cwd, { recursive: true, force: true }); }
-export async function readAuditCandidateDiff(candidateResult) {
-    const candidate = candidateResult.candidate;
-    if (!candidate)
-        return null;
-    return readStructuredDiff(candidateResult.cwd, candidate.base, candidate.head);
-}
-async function readCandidateIntegrity(cwd) {
-    const [coordinate, status] = await Promise.all([
-        requireCommitCoordinate(cwd, "HEAD"),
-        createGit(cwd).raw(["status", "--porcelain=v1", "-z", "--untracked-files=no"]),
-    ]);
-    return { head: coordinate.commit, tree: coordinate.tree, trackedChanges: status.split("\0").filter(Boolean) };
-}
-function preparationPlan(plan) {
-    return { command: [...plan.command], timeoutMs: plan.timeoutMs };
-}
-function preparationOutput(observation) {
-    return {
-        ...(observation.stdoutTail !== undefined ? { stdoutTail: observation.stdoutTail } : {}),
-        ...(observation.stdoutTruncated ? { stdoutTruncated: true } : {}),
-        ...(observation.stderrTail !== undefined ? { stderrTail: observation.stderrTail } : {}),
-        ...(observation.stderrTruncated ? { stderrTruncated: true } : {}),
-    };
-}
-function bootstrapResultDescription(result) {
-    if (result.kind === "exit")
-        return `exit ${result.code}`;
-    if (result.kind === "signal")
-        return `signal ${result.signal}`;
-    if (result.kind === "timeout")
-        return "timeout";
-    return `spawn: ${result.message}`;
-}
-function observationFailure(plan, candidate, observation) {
-    return {
-        status: "failed",
-        plan: preparationPlan(plan),
-        candidate: { head: candidate.head, tree: candidate.tree },
-        result: observation.result,
-        durationMs: observation.durationMs,
-        ...preparationOutput(observation),
-        cause: { code: "CANDIDATE_BOOTSTRAP_FAILED", message: `candidate bootstrap failed with ${bootstrapResultDescription(observation.result)}` },
-    };
-}
-export async function prepareAuditCandidate(input, dependencies = {}) {
-    const candidate = input.candidateResult.candidate;
-    if (!candidate)
-        return { status: "not-required", reason: "candidate_unavailable" };
-    if (!input.verificationRequired)
-        return { status: "not-required", reason: "verification_not_configured" };
-    if (!input.plan)
-        return { status: "not-configured", candidate: { head: candidate.head, tree: candidate.tree } };
-    const runBootstrap = dependencies.runBootstrap ?? runWorktreeBootstrap;
-    const observation = await runBootstrap({ cwd: input.candidateResult.cwd, plan: input.plan, captureOutput: true });
-    if (!isBootstrapSuccess(observation))
-        return observationFailure(input.plan, candidate, observation);
-    let integrity;
-    try {
-        integrity = await (dependencies.readIntegrity ?? readCandidateIntegrity)(input.candidateResult.cwd);
-    }
-    catch (error) {
-        return {
-            status: "failed",
-            plan: preparationPlan(input.plan),
-            candidate: { head: candidate.head, tree: candidate.tree },
-            result: observation.result,
-            durationMs: observation.durationMs,
-            ...preparationOutput(observation),
-            cause: { code: "CANDIDATE_INTEGRITY_UNKNOWN", message: asMessage(error) },
-        };
-    }
-    if (integrity.head !== candidate.head || integrity.tree !== candidate.tree || integrity.trackedChanges.length > 0) {
-        return {
-            status: "failed",
-            plan: preparationPlan(input.plan),
-            candidate: { head: candidate.head, tree: candidate.tree },
-            result: observation.result,
-            durationMs: observation.durationMs,
-            ...preparationOutput(observation),
-            cause: { code: "CANDIDATE_INTEGRITY_CHANGED", message: "candidate HEAD, tree, or tracked worktree changed during preparation" },
-            integrity,
-        };
-    }
-    return {
-        status: "succeeded",
-        plan: preparationPlan(input.plan),
-        candidate: { head: candidate.head, tree: candidate.tree },
-        result: { kind: "exit", code: 0 },
-        durationMs: observation.durationMs,
-        ...preparationOutput(observation),
-        integrity,
-    };
-}

package/build/core/audit/coordinates.js

@@ -1,230 +0,0 @@
-import * as fs from "node:fs/promises";
-import * as path from "node:path";
-import { createHash } from "node:crypto";
-import { FlowError, asMessage } from "../../flow-error.js";
-import { requireCommitCoordinate } from "../../git/commits.js";
-import { createGit, wrapGitError } from "../../git/core.js";
-import { effectiveCriteria } from "../amendment-criteria.js";
-import { hasStrandableProjectionGeneration } from "../projection/index.js";
-import { admitRepositoryLifecycleContract, } from "../repository-ledger/admission.js";
-import { lookupCurrentContract, readRepositoryLifecycle, } from "../repository-ledger/read-model.js";
-import { deriveQueueReadModel, queueMembership } from "../settlement/queue.js";
-import { findRegisteredContractWorktreePathFromModel } from "../worktree-path.js";
-import { readRemainingTaskNeedsForSettlement } from "../task/settlement-policy.js";
-export function appendedScopeTerms(model) {
-    return model.history.flatMap(({ entry }) => entry.kind === "amend" && entry.data.scopeDelta ? entry.data.scopeDelta.add : []);
-}
-function auditCriteria(model) {
-    const bind = model.history.find(({ entry }) => entry.kind === "bind")?.entry;
-    if (!bind || bind.kind !== "bind")
-        throw new FlowError("INTERNAL_STATE", `contract ${model.contract} is missing folded bind terms`);
-    const amendments = model.history.flatMap(({ entry }) => entry.kind === "amend" ? [entry.data.amendment] : []);
-    return effectiveCriteria(bind.data.criteria, amendments);
-}
-function repositoryLifecycleDiseaseError(outcome) {
-    return new FlowError("INTERNAL_STATE", `contract ${outcome.contract} is unavailable because repository lifecycle evidence is ${outcome.status}`, {
-        facts: {
-            kind: "repository_lifecycle_disease",
-            contractId: outcome.contract,
-            status: outcome.status,
-            diagnostics: outcome.diagnostics.map((diagnostic) => ({
-                objectId: diagnostic.objectId,
-                code: diagnostic.code,
-                detail: diagnostic.detail,
-                ...(diagnostic.contract === undefined ? {} : { contract: diagnostic.contract }),
-            })),
-        },
-    });
-}
-async function pinLedgerCoordinates(input) {
-    const repository = await readRepositoryLifecycle(input.root);
-    const admission = admitRepositoryLifecycleContract(repository, input.contractId);
-    let model;
-    switch (admission.status) {
-        case "healthy":
-            model = admission.model;
-            break;
-        case "diseased":
-        case "isolated":
-        case "indeterminate":
-            throw repositoryLifecycleDiseaseError(admission);
-        case "absent":
-            throw new FlowError("CONTRACT_NOT_FOUND", `contract ${admission.contract} not found`);
-    }
-    if (repository.observedLedgerHead === null)
-        throw new FlowError("INTERNAL_STATE", "repository lifecycle ledger is absent");
-    const bind = model.history.find(({ entry }) => entry.kind === "bind")?.entry;
-    if (!bind || bind.kind !== "bind")
-        throw new FlowError("INTERNAL_STATE", `contract ${input.contractId} is missing folded bind terms`);
-    const [delivery, target] = await Promise.all([
-        requireCommitCoordinate(input.root, model.resources.deliveryRef),
-        requireCommitCoordinate(input.root, model.pins.target.ref),
-    ]);
-    if (model.pins.target.approvedHead !== null && model.petition.state === "approved" && model.pins.target.approvedHead !== target.commit) {
-        throw new FlowError("INTERNAL_STATE", `target ref ${model.pins.target.ref} moved from approved petition pin`);
-    }
-    return {
-        criteria: auditCriteria(model), scope: [...model.effectiveScope], appendScope: appendedScopeTerms(model), base: model.pins.base,
-        lifecycle: model, repository,
-        coordinates: { ledger: { head: repository.observedLedgerHead }, delivery: { ref: model.resources.deliveryRef, head: delivery.commit, tree: delivery.tree }, target: { ref: model.pins.target.ref, head: target.commit, tree: target.tree } },
-    };
-}
-async function deliveryResidue(cwd) {
-    const fields = (await createGit(cwd).raw(["status", "--porcelain=v1", "-z", "--untracked-files=all"])).split("\0");
-    const staged = new Set();
-    const unstaged = new Set();
-    const untracked = new Set();
-    for (let index = 0; index < fields.length; index += 1) {
-        const field = fields[index];
-        if (!field)
-            continue;
-        const xy = field.slice(0, 2);
-        const filePath = field.slice(3);
-        if (xy === "??")
-            untracked.add(filePath);
-        else {
-            if (xy[0] !== " ")
-                staged.add(filePath);
-            if (xy[1] !== " ")
-                unstaged.add(filePath);
-            if (xy[0] === "R" || xy[0] === "C")
-                index += 1;
-        }
-    }
-    const tracked = new Set([...staged, ...unstaged]);
-    return { tracked: [...tracked], staged: [...staged], unstaged: [...unstaged], untracked: [...untracked] };
-}
-function residueKey(residue) {
-    return JSON.stringify({ tracked: [...residue.tracked].sort(), staged: [...residue.staged].sort(), unstaged: [...residue.unstaged].sort(), untracked: [...residue.untracked].sort() });
-}
-async function residueFingerprint(cwd, residue) {
-    const git = createGit(cwd);
-    const digest = createHash("sha256").update(residueKey(residue));
-    const tracked = [...residue.tracked].sort();
-    if (tracked.length > 0)
-        digest.update(await git.raw(["diff", "--no-color", "--no-ext-diff", "--binary", "HEAD", "--", ...tracked]));
-    for (const pathname of [...residue.untracked].sort()) {
-        const absolute = path.join(cwd, pathname);
-        const stat = await fs.lstat(absolute);
-        digest.update(pathname).update("\0").update(String(stat.mode)).update("\0");
-        if (stat.isSymbolicLink())
-            digest.update(await fs.readlink(absolute));
-        else
-            digest.update(await fs.readFile(absolute));
-        digest.update("\0");
-    }
-    return digest.digest("hex");
-}
-async function deliveryCoordinate(cwd) {
-    const [coordinate, residue] = await Promise.all([requireCommitCoordinate(cwd, "HEAD"), deliveryResidue(cwd)]);
-    return { head: coordinate.commit, tree: coordinate.tree, residue, residueFingerprint: await residueFingerprint(cwd, residue) };
-}
-async function checkedOutRef(cwd) {
-    try {
-        return (await createGit(cwd).raw(["symbolic-ref", "--quiet", "HEAD"])).trim();
-    }
-    catch {
-        return null;
-    }
-}
-async function receiptsAfterPinnedFence(input) {
-    const fence = input.model.pins.delivery;
-    try {
-        return (await createGit(input.root).raw(["rev-list", "--reverse", `${fence}..${input.deliveryHead}`]))
-            .split(/\r?\n/).filter(Boolean);
-    }
-    catch (error) {
-        throw wrapGitError(`rev-list ${fence}..${input.deliveryHead}`, error, input.root);
-    }
-}
-async function readReadiness(input) {
-    const model = input.frozen.lifecycle;
-    const [residue, looseCommits, queue, liveProjection, afterDependencies, taskNeeds] = await Promise.all([
-        deliveryResidue(input.deliveryCwd), receiptsAfterPinnedFence({ root: input.root, model, deliveryHead: input.frozen.coordinates.delivery.head }), Promise.resolve(deriveQueueReadModel(input.frozen.repository)),
-        hasStrandableProjectionGeneration({ cwd: input.root, commissionId: input.contractId, deliveryWorktree: input.deliveryCwd, nowMs: Date.now() }),
-        Promise.resolve(model.causal.after.map((id) => {
-            const outcome = lookupCurrentContract(input.frozen.repository, id);
-            const state = outcome.status === "healthy" ? outcome.model.phase : outcome.status;
-            return { id, satisfied: outcome.status === "healthy" && (state === "claimed" || state === "forfeited"), state };
-        })),
-        readRemainingTaskNeedsForSettlement(input.root, model.causal.needs),
-    ]);
-    const dependencies = [...afterDependencies, ...taskNeeds];
-    const membership = queueMembership(queue, input.contractId);
-    return { deliveryResidue: residue, arc: { open: model.phase === "active" ? model.intent.arc : null, max: model.intent.arc, fence: model.pins.delivery, looseCommits }, rewriteGuard: { liveProjection }, dependencies, petition: { state: model.phase, queue: membership ? { position: membership.position, length: membership.queueLength, head: membership.queueHead, diagnostics: membership.diagnostics.map((item) => item.kind) } : null } };
-}
-export async function pinAuditSnapshot(input) {
-    const contractId = input.address.binding.commissionId;
-    const root = input.address.repo.stableRoot;
-    return pinLedgerCoordinates({ root, contractId });
-}
-export function initialCoordinateRace(input) {
-    return { which: "delivery-worktree", pinned: input.frozen.coordinates.delivery, observed: input.observed };
-}
-async function authoritativeDeliveryCwd(root, model) {
-    const bind = model.history.find(({ entry }) => entry.kind === "bind")?.entry;
-    if (!bind || bind.kind !== "bind")
-        throw new FlowError("INTERNAL_STATE", `contract ${model.contract} is missing folded bind terms`);
-    if (bind.data.workspace === "here")
-        return fs.realpath(root);
-    const worktree = model.resources.worktree;
-    if (!worktree || worktree.state !== "held" || worktree.place !== bind.data.place) {
-        throw new FlowError("INTERNAL_STATE", `contract ${model.contract} has no held worktree matching folded bind place ${bind.data.place}`);
-    }
-    const registered = await findRegisteredContractWorktreePathFromModel(root, model);
-    if (!registered) {
-        throw new FlowError("INTERNAL_STATE", `contract ${model.contract} has no Git-registered delivery worktree at folded bind place ${bind.data.place}`);
-    }
-    return registered;
-}
-export async function pinAuditCoordinates(input) {
-    const frozen = await pinAuditSnapshot({ address: input.address });
-    return completeAuditCoordinates({ address: input.address, frozen, deliveryCwd: input.deliveryCwd });
-}
-/** Expensive worktree/readiness capture performed after repository admission is released. */
-export async function completeAuditCoordinates(input) {
-    const contractId = input.address.binding.commissionId;
-    const root = input.address.repo.stableRoot;
-    const frozen = input.frozen;
-    const deliveryCwd = await authoritativeDeliveryCwd(root, frozen.lifecycle);
-    if (input.deliveryCwd && path.resolve(input.deliveryCwd) !== path.resolve(deliveryCwd)) {
-        throw new Error(`observed delivery worktree ${deliveryCwd} does not match expected worktree ${input.deliveryCwd}`);
-    }
-    const coordinate = await deliveryCoordinate(deliveryCwd);
-    const branchRef = await checkedOutRef(deliveryCwd);
-    if (branchRef !== frozen.coordinates.delivery.ref || coordinate.head !== frozen.coordinates.delivery.head || coordinate.tree !== frozen.coordinates.delivery.tree)
-        throw new Error(`registered delivery worktree ${branchRef ?? "detached"} ${coordinate.head}/${coordinate.tree} does not match pinned delivery ref ${frozen.coordinates.delivery.ref} ${frozen.coordinates.delivery.head}/${frozen.coordinates.delivery.tree}`);
-    const readiness = await readReadiness({ root, deliveryCwd, contractId, frozen });
-    return { ...frozen, deliveryCwd, deliveryCoordinate: coordinate, readiness };
-}
-export async function rereadCoordinateRace(input) {
-    const contractId = input.address.binding.commissionId;
-    const root = input.address.repo.stableRoot;
-    let after;
-    try {
-        after = await pinLedgerCoordinates({ root, contractId });
-    }
-    catch (error) {
-        return { which: "ledger", pinned: input.frozen.coordinates.ledger, observed: asMessage(error) };
-    }
-    if (after.coordinates.ledger.head !== input.frozen.coordinates.ledger.head)
-        return { which: "ledger", pinned: input.frozen.coordinates.ledger, observed: after.coordinates.ledger };
-    if (after.coordinates.delivery.head !== input.frozen.coordinates.delivery.head || after.coordinates.delivery.tree !== input.frozen.coordinates.delivery.tree)
-        return { which: "delivery", pinned: input.frozen.coordinates.delivery, observed: after.coordinates.delivery };
-    if (after.coordinates.target.head !== input.frozen.coordinates.target.head || after.coordinates.target.tree !== input.frozen.coordinates.target.tree)
-        return { which: "target", pinned: input.frozen.coordinates.target, observed: after.coordinates.target };
-    try {
-        const deliveryCwd = await authoritativeDeliveryCwd(root, after.lifecycle);
-        if (input.deliveryCwd && path.resolve(input.deliveryCwd) !== path.resolve(deliveryCwd)) {
-            return { which: "delivery-worktree", pinned: { cwd: input.frozen.deliveryCwd, ...input.frozen.deliveryCoordinate }, observed: { cwd: deliveryCwd, expected: input.deliveryCwd } };
-        }
-        const observed = await deliveryCoordinate(deliveryCwd);
-        const branchRef = await checkedOutRef(deliveryCwd);
-        if (branchRef !== input.frozen.coordinates.delivery.ref || path.resolve(deliveryCwd) !== path.resolve(input.frozen.deliveryCwd) || observed.head !== input.frozen.deliveryCoordinate.head || observed.tree !== input.frozen.deliveryCoordinate.tree || observed.residueFingerprint !== input.frozen.deliveryCoordinate.residueFingerprint)
-            return { which: "delivery-worktree", pinned: { cwd: input.frozen.deliveryCwd, ref: input.frozen.coordinates.delivery.ref, ...input.frozen.deliveryCoordinate }, observed: { cwd: deliveryCwd, ref: branchRef, ...observed } };
-    }
-    catch (error) {
-        return { which: "delivery-worktree", pinned: { cwd: input.frozen.deliveryCwd, ...input.frozen.deliveryCoordinate }, observed: asMessage(error) };
-    }
-    return null;
-}

package/build/core/audit/evidence.js

@@ -1,156 +0,0 @@
-import { FlowError, asMessage } from "../../flow-error.js";
-import { scopePathEvidence } from "../scope.js";
-import { composeVerificationPlan, runVerificationPlan, resolveVerificationPolicy } from "../settlement/verification.js";
-function importLine(line) {
-    return /^(?:import\b|export\s+(?:\*|\{)|(?:const|let|var)\s+[^=]+\s*=\s*require\s*\(|[^=]+\brequire\s*\(|[^=]+\bimport\s*\()/.test(line.content.trim());
-}
-function identifierRename(before, after) {
-    const left = before.match(/[A-Za-z_$][\w$]*/g) ?? [];
-    const right = after.match(/[A-Za-z_$][\w$]*/g) ?? [];
-    if (left.length !== right.length)
-        return null;
-    const differences = left.flatMap((value, index) => value === right[index] ? [] : [{ from: value, to: right[index] }]);
-    if (differences.length !== 1)
-        return null;
-    const rename = differences[0];
-    const expression = new RegExp(`\\b${rename.from.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`, "g");
-    return before.replace(expression, rename.to) === after ? rename : null;
-}
-function explainFile(file, matcher) {
-    const explanations = [];
-    const explained = new Set();
-    if (file.status === "R" && file.oldPath)
-        explanations.push({ kind: "file-rename", from: file.oldPath, to: file.path, similarity: file.similarity ?? 0 });
-    for (const hunk of file.hunks) {
-        const changed = hunk.lines.filter((line) => line.kind !== "context");
-        for (const line of changed) {
-            if (!importLine(line))
-                continue;
-            explanations.push({ kind: "import", hunk: hunk.index, oldLine: line.oldLine, newLine: line.newLine });
-            explained.add(`${hunk.index}:${line.kind}:${line.oldLine}:${line.newLine}`);
-        }
-        const deletions = changed.filter((line) => line.kind === "deletion" && !importLine(line));
-        const additions = changed.filter((line) => line.kind === "addition" && !importLine(line));
-        if (deletions.length === additions.length)
-            deletions.forEach((deletion, index) => {
-                const addition = additions[index];
-                const rename = identifierRename(deletion.content, addition.content);
-                if (!rename)
-                    return;
-                explanations.push({ kind: "symbol-rename", ...rename, hunk: hunk.index, oldLine: deletion.oldLine, newLine: addition.newLine });
-                explained.add(`${hunk.index}:${deletion.kind}:${deletion.oldLine}:${deletion.newLine}`);
-                explained.add(`${hunk.index}:${addition.kind}:${addition.oldLine}:${addition.newLine}`);
-            });
-    }
-    const residue = file.binary ? [{ hunk: -1, oldLine: null, newLine: null, kind: "binary", content: "binary content changed" }] : [];
-    for (const hunk of file.hunks)
-        for (const line of hunk.lines) {
-            if (line.kind === "context")
-                continue;
-            const key = `${hunk.index}:${line.kind}:${line.oldLine}:${line.newLine}`;
-            if (!explained.has(key))
-                residue.push({ hunk: hunk.index, oldLine: line.oldLine, newLine: line.newLine, kind: line.kind, content: line.content });
-        }
-    return { path: file.path, ...(file.oldPath ? { oldPath: file.oldPath } : {}), matcher, explanations, residue, class: matcher.matched ? "in-scope" : residue.length === 0 && explanations.length > 0 ? "downgraded" : "violated" };
-}
-export async function evaluateScope(input) {
-    const matchers = await scopePathEvidence(input.cwd, input.frozen.scope, input.diff.files.map((file) => file.path));
-    return input.diff.files.map((file, index) => explainFile(file, matchers[index]));
-}
-function rawHunk(file, hunk) {
-    return [`${file.status} ${file.oldPath ? `${file.oldPath} -> ` : ""}${file.path} · +${file.insertions} -${file.deletions}`, hunk.header, ...hunk.lines.map((line) => `${line.kind === "addition" ? "+" : line.kind === "deletion" ? "-" : " "}${line.content}`)].join("\n");
-}
-function rawFile(file) { return `${file.status} ${file.oldPath ? `${file.oldPath} -> ` : ""}${file.path} · +${file.insertions} -${file.deletions}`; }
-function moduleFor(pathname) { const segments = pathname.split("/"); return segments.length > 1 ? segments.slice(0, -1).join("/") : "."; }
-function byteLength(content) { return new TextEncoder().encode(content).byteLength; }
-function isAuthorityBoundary(pathname) { return /(^|\/)(auth(?:entication|orization)?|schema|schemas|migrations?|api|config|ci|\.github|permissions?|concurrency)(\/|$)|(^|\/)(package|tsconfig|vite|webpack|eslint|prettier)\.(json|ya?ml|[cm]?[jt]s)$/.test(pathname); }
-function isGeneratedOrLowPriority(pathname, file) { return file.binary || /(^|\/)(vendor|generated|dist|build)(\/|$)|(^|\/)([^/]+\.)?(lock|min)\.(json|ya?ml|js|css)$|(?:^|\/)(package-lock\.json|pnpm-lock\.yaml|yarn\.lock)$/.test(pathname); }
-function isSource(pathname) { return /\.(?:[cm]?[jt]sx?|py|go|rs|java|kt|rb|php|cs|swift)$/.test(pathname) && !/(^|\/)(test|tests|__tests__|spec)(\/|\.)/.test(pathname); }
-function hasRelatedTest(file, all) { const stem = file.path.replace(/\.[^.]+$/, "").replace(/\/index$/, ""); return all.some((candidate) => candidate.path !== file.path && /(test|tests|__tests__|spec)/.test(candidate.path) && candidate.path.replace(/\.(?:[cm]?[jt]sx?|py|go|rs|java|kt|rb|php|cs|swift)$/, "").includes(stem.split("/").at(-1) ?? "")); }
-function portfolioTier(file, scope, all) {
-    if (scope.class === "violated")
-        return { tier: 0, mandatory: true };
-    if (isAuthorityBoundary(file.path))
-        return { tier: 1, mandatory: true };
-    if (/(^|\/)(package\.json|workspace|pnpm-workspace|turbo|nx)\b/.test(file.path))
-        return { tier: 2, mandatory: false };
-    if (isGeneratedOrLowPriority(file.path, file))
-        return { tier: 6, mandatory: false };
-    if (isSource(file.path) && !hasRelatedTest(file, all))
-        return { tier: 3, mandatory: false };
-    if (file.status === "R" || scope.class === "downgraded")
-        return { tier: 5, mandatory: false };
-    return { tier: 4, mandatory: false };
-}
-function stablePortfolioOrder(left, right) { if (left.tier !== right.tier)
-    return left.tier - right.tier; const ratio = (1000 - right.tier * 100) / Math.max(right.bytes, 1) - (1000 - left.tier * 100) / Math.max(left.bytes, 1); return ratio || left.path.localeCompare(right.path) || (left.hunk ?? -1) - (right.hunk ?? -1); }
-function retrieval(from, to, pathname, hunk) { return { kind: "git-coordinate", from, to, argv: ["git", "diff", "--no-color", "--no-ext-diff", "--unified=3", `${from}..${to}`, "--", pathname], path: pathname, hunk }; }
-export function presentDiff(input) {
-    const { diff, scope, budget } = input;
-    const candidates = [];
-    for (let fileIndex = 0; fileIndex < diff.files.length; fileIndex += 1) {
-        const file = diff.files[fileIndex];
-        const policy = portfolioTier(file, scope[fileIndex], diff.files);
-        const chunks = file.hunks.length === 0 ? [{ hunk: null, content: rawFile(file) }] : file.hunks.map((hunk) => ({ hunk: hunk.index, content: rawHunk(file, hunk) }));
-        for (const chunk of chunks) {
-            const bytes = byteLength(chunk.content);
-            candidates.push({ path: file.path, hunk: chunk.hunk, content: chunk.content, bytes, cost: bytes, tier: policy.tier, mandatory: policy.mandatory, module: moduleFor(file.path) });
-        }
-    }
-    const selected = [];
-    const selectedKeys = new Set();
-    let used = 0;
-    const keyFor = (candidate) => `${candidate.path}\0${candidate.hunk ?? "file"}`;
-    const take = (candidate) => { const key = keyFor(candidate); if (selectedKeys.has(key))
-        return; selectedKeys.add(key); selected.push(candidate); used += candidate.cost; };
-    for (const candidate of [...candidates].filter((item) => item.mandatory).sort(stablePortfolioOrder))
-        if (used + candidate.cost <= budget)
-            take(candidate);
-    for (const module of [...new Set(candidates.map((candidate) => candidate.module))].sort()) {
-        const representative = candidates.filter((candidate) => candidate.module === module && !selectedKeys.has(keyFor(candidate))).sort(stablePortfolioOrder)[0];
-        if (representative && used + representative.cost <= budget)
-            take(representative);
-    }
-    for (const candidate of [...candidates].sort(stablePortfolioOrder))
-        if (!selectedKeys.has(keyFor(candidate)) && used + candidate.cost <= budget)
-            take(candidate);
-    const omissions = candidates.filter((candidate) => !selectedKeys.has(keyFor(candidate))).sort((left, right) => left.path.localeCompare(right.path) || (left.hunk ?? -1) - (right.hunk ?? -1)).map((candidate) => ({ path: candidate.path, hunk: candidate.hunk, bytes: candidate.bytes, reason: candidate.hunk === null ? "no-raw-hunks" : used + candidate.cost > budget ? "budget" : "not-selected", retrieval: retrieval(input.retrievalCoordinates.from, input.retrievalCoordinates.to, candidate.path, candidate.hunk) }));
-    return { budget: { limit: budget, used }, selected: selected.sort((left, right) => left.path.localeCompare(right.path) || (left.hunk ?? -1) - (right.hunk ?? -1)), omissions };
-}
-function fileFacts(diff, scope) { return diff.files.map((file, index) => { const row = scope[index]; return { path: file.path, ...(file.oldPath ? { oldPath: file.oldPath } : {}), status: file.status, stats: { insertions: file.insertions, deletions: file.deletions, binary: file.binary }, matcher: row.matcher, explanations: row.explanations, residue: row.residue, class: row.class }; }); }
-export async function resolveAuditVerificationPlan(input) {
-    let policy;
-    try {
-        policy = await resolveVerificationPolicy(input.cwd);
-    }
-    catch (error) {
-        return { status: "unknown", cause: { code: error instanceof FlowError ? error.code : "INTERNAL_STATE", message: asMessage(error) } };
-    }
-    const plan = composeVerificationPlan({ contract: input.contract, repositoryGates: policy.commands, timeoutMs: policy.timeoutMs });
-    return { status: "resolved", plan };
-}
-export async function evaluateVerification(input) {
-    const plan = input.plan;
-    if (plan.length === 0)
-        return { status: "not_configured", results: [] };
-    const invocation = await runVerificationPlan({ cwd: input.cwd, candidate: { head: input.candidate.head, tree: input.candidate.tree }, plan, signal: input.signal, root: input.root });
-    // runId is addressable immediately; owner await cancels on abort and observes terminal cleanup.
-    const completion = await invocation.awaitTerminal();
-    const results = completion.results.map((result) => {
-        const common = { source: result.source, declaration: result.declaration, label: result.label, executor: result.executor, command: result.command, argv: [result.command, ...result.args], candidate: result.candidate };
-        if (result.execution.status === "runner_failed")
-            return { ...common, ...result.execution };
-        return { status: "executed", ...common, body: result.shell ? result.command : result.args.at(-1) ?? "", exitCode: result.execution.code, durationMs: result.execution.durationMs, stdout: result.execution.stdout, stderr: result.execution.stderr };
-    });
-    return { status: "evaluated", runId: completion.runId, results };
-}
-export async function collectEvidence(input) {
-    const candidate = input.candidateResult.candidate;
-    if (!candidate)
-        return null;
-    if (!input.diff)
-        return null;
-    const diff = input.diff;
-    const scope = await evaluateScope({ cwd: input.candidateResult.cwd, frozen: input.frozen, diff });
-    return { diff, scope, presentation: presentDiff({ diff, scope, budget: input.diffBudgetBytes, retrievalCoordinates: { from: input.frozen.base, to: input.frozen.coordinates.delivery.head } }), files: fileFacts(diff, scope), verification: input.verificationOverride ?? await evaluateVerification({ cwd: input.candidateResult.cwd, root: input.root, candidate, plan: input.verificationPlan, signal: input.signal }), candidate };
-}