@attalabs/vinaya 0.26.0 → 0.28.0

package/dist/lib/pre-push-select-tests.js

@@ -0,0 +1,1473 @@
+#!/usr/bin/env node
+
+// src/lib/config.ts
+import { existsSync, mkdirSync, readFileSync as readFileSync2, realpathSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { z as z4 } from "zod";
+// ../../packages/aeg-forge-state/src/gh.ts
+import { execFile, execFileSync } from "node:child_process";
+import { promisify } from "node:util";
+var execFileAsync = promisify(execFile);
+var systemEnv = {
+  ...process.env,
+  PATH: [process.env.PATH, "/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin"].filter(Boolean).join(":")
+};
+
+// ../../packages/aeg-forge-state/src/labels.ts
+var LABELS = [
+  {
+    key: "blocked",
+    id: "vinaya/blocked",
+    category: "state",
+    form: "literal",
+    carries: "Execution is halted pending an external unblock; wins over every other derived status."
+  },
+  {
+    key: "backlog",
+    id: "vinaya/backlog",
+    category: "state",
+    form: "literal",
+    carries: "The Issue is deliberately unplanned — belongs to no tranche and is excluded from dispatch, until a Planner promotes it."
+  },
+  {
+    key: "tier-0",
+    id: "vinaya/tier:0",
+    category: "tier",
+    form: "literal",
+    carries: "Lowest governance weight — typecheck, lint, tests, and a conforming PR body."
+  },
+  {
+    key: "tier-1",
+    id: "vinaya/tier:1",
+    category: "tier",
+    form: "literal",
+    carries: "Tier 0 plus spec/skill coverage and a passing verify-docs run."
+  },
+  {
+    key: "tier-3",
+    id: "vinaya/tier:3",
+    category: "tier",
+    form: "literal",
+    carries: "Tier 1 plus the reasoning for the change, stated in the pull request that makes it."
+  },
+  {
+    key: "tranche",
+    id: "vinaya/tranche:",
+    category: "tranche",
+    form: "prefix",
+    carries: "The tranche slug this task Issue belongs to — the forge's grouping key, matched by prefix."
+  },
+  {
+    key: "needs-execution-input",
+    id: "vinaya/needs:execution-input",
+    category: "needs",
+    form: "literal",
+    carries: "Waiting on a missing execution detail — a flag, a dependency, a value the brief did not carry."
+  },
+  {
+    key: "needs-strategy-input",
+    id: "vinaya/needs:strategy-input",
+    category: "needs",
+    form: "literal",
+    carries: "Waiting on a strategy call — the brief assumes an approach the codebase has moved away from."
+  },
+  {
+    key: "needs-principal-input",
+    id: "vinaya/needs:principal-input",
+    category: "needs",
+    form: "literal",
+    carries: "Waiting on the Principal — a product-level call no agent may make."
+  },
+  {
+    key: "needs-brief-correction",
+    id: "vinaya/needs:brief-correction",
+    category: "needs",
+    form: "literal",
+    carries: "Waiting on the Planner — the brief contradicts the surface it describes."
+  },
+  {
+    key: "waiver-docs",
+    id: "vinaya/waiver:docs",
+    category: "waiver",
+    form: "literal",
+    carries: "Doc-coverage gate excused for this PR — honored only when a principal applied it."
+  },
+  {
+    key: "waiver-review",
+    id: "vinaya/waiver:review",
+    category: "waiver",
+    form: "literal",
+    carries: "Review gate excused for this PR — honored only when a principal applied it."
+  },
+  {
+    key: "override-docs",
+    id: "vinaya/override:docs",
+    category: "waiver",
+    form: "literal",
+    carries: "The whole verify-docs gate suppressed for this PR — a Principal-only blunt override, wider than a waiver."
+  },
+  {
+    key: "incoherent",
+    id: "vinaya/incoherent",
+    category: "flag",
+    form: "literal",
+    carries: "Closed COMPLETED with no merged-PR link — done-but-unprovable, surfaced for a human."
+  },
+  {
+    key: "direct-main-push",
+    id: "vinaya/direct-main-push",
+    category: "flag",
+    form: "literal",
+    carries: "A commit reached main with no associated merged PR — ring-2 detection, never a mutation."
+  },
+  {
+    key: "dead-branch-push",
+    id: "vinaya/dead-branch-push",
+    category: "flag",
+    form: "literal",
+    carries: "Commits landed on a branch after its PR had already resolved — daily-drift detection."
+  },
+  {
+    key: "state-object",
+    id: "vinaya/state-object",
+    category: "kind",
+    form: "literal",
+    carries: "A permanent forge-native storage object, never actionable work — excluded from every backlog."
+  },
+  {
+    key: "type-build",
+    id: "vinaya/type:build",
+    category: "type",
+    form: "literal",
+    carries: "The task changes the build system, packaging, or an external dependency rather than product behavior."
+  },
+  {
+    key: "type-chore",
+    id: "vinaya/type:chore",
+    category: "type",
+    form: "literal",
+    carries: "The task is maintenance or repo housekeeping with no functional, user-facing change."
+  },
+  {
+    key: "type-docs",
+    id: "vinaya/type:docs",
+    category: "type",
+    form: "literal",
+    carries: "The task changes documentation only, with no code behavior affected."
+  },
+  {
+    key: "type-feat",
+    id: "vinaya/type:feat",
+    category: "type",
+    form: "literal",
+    carries: "The task adds a capability that did not exist before."
+  },
+  {
+    key: "type-fix",
+    id: "vinaya/type:fix",
+    category: "type",
+    form: "literal",
+    carries: "The task corrects incorrect behavior — a bug, not a missing capability."
+  },
+  {
+    key: "type-perf",
+    id: "vinaya/type:perf",
+    category: "type",
+    form: "literal",
+    carries: "The task improves performance or resource use without changing observable behavior."
+  },
+  {
+    key: "type-refactor",
+    id: "vinaya/type:refactor",
+    category: "type",
+    form: "literal",
+    carries: "The task restructures existing code without changing its external behavior."
+  },
+  {
+    key: "type-revert",
+    id: "vinaya/type:revert",
+    category: "type",
+    form: "literal",
+    carries: "The task undoes a previous change that shipped in error or is no longer wanted."
+  },
+  {
+    key: "type-style",
+    id: "vinaya/type:style",
+    category: "type",
+    form: "literal",
+    carries: "The task changes formatting, naming, or non-semantic code shape with no logic change."
+  },
+  {
+    key: "type-test",
+    id: "vinaya/type:test",
+    category: "type",
+    form: "literal",
+    carries: "The task adds or corrects test coverage with no production-code behavior change."
+  }
+];
+var BY_KEY = new Map(LABELS.map((l) => [l.key, l]));
+function entry(key) {
+  const found = BY_KEY.get(key);
+  if (!found)
+    throw new Error(`labels.ts: no LABELS entry for key '${key}'`);
+  return found;
+}
+function label(key) {
+  return entry(key).id;
+}
+// ../../packages/aeg-forge-state/src/github-token.ts
+import { execFile as execFile2 } from "node:child_process";
+import { promisify as promisify2 } from "node:util";
+var execFileAsync2 = promisify2(execFile2);
+var systemEnv2 = {
+  ...process.env,
+  PATH: [process.env.PATH, "/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin"].filter(Boolean).join(":")
+};
+// ../../packages/aeg-forge-state/src/resolve-repo.ts
+import { execFile as execFile3 } from "node:child_process";
+import { promisify as promisify3 } from "node:util";
+var execFileAsync3 = promisify3(execFile3);
+var systemEnv3 = {
+  ...process.env,
+  PATH: [process.env.PATH, "/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin"].filter(Boolean).join(":")
+};
+// ../../packages/aeg-core/src/state-machine-model.ts
+var FORGE_FACT_INPUTS = [
+  {
+    fact: "issueState",
+    readsFrom: "Issue.state (OPEN | CLOSED)",
+    meaning: "Whether the task Issue is still open — the anchor for the honest terminal statuses."
+  },
+  {
+    fact: "assigned",
+    readsFrom: "Issue.assignees (count > 0)",
+    meaning: "An assignee exists. No longer affects derivation: assigned and unassigned are both todo."
+  },
+  {
+    fact: "branchExists",
+    readsFrom: "Ref refs/heads/task/<tranche>/<id>",
+    meaning: "A task branch has been published — the todo → in-flight transition, written by git push, not by hand."
+  },
+  {
+    fact: "prState",
+    readsFrom: "PullRequest.state (OPEN | CLOSED | MERGED)",
+    meaning: "Whether work is proposed or landed. CLOSED-without-merge collapses to none — AEG models open/merged/none."
+  },
+  {
+    fact: "reviewDecision",
+    readsFrom: "PullRequest.reviewDecision",
+    meaning: "Only 'changes_requested' flips status; approved-but-unmerged stays in-review."
+  },
+  {
+    fact: "blockedLabel",
+    readsFrom: `Issue.labels contains '${label("blocked")}'`,
+    meaning: "Execution halted pending an external unblock. Wins over every other rule."
+  },
+  {
+    fact: "stateReason",
+    readsFrom: "Issue.stateReason (COMPLETED | NOT_PLANNED | REOPENED | null)",
+    meaning: "Separates a legitimate drop from an incoherent close on a closed, never-merged Issue."
+  },
+  {
+    fact: "closedAt",
+    readsFrom: "Issue.closedAt",
+    meaning: "Timestamp for the coherence oracle grandfather cutoff. No derivation rule reads it."
+  },
+  {
+    fact: "mergedAt",
+    readsFrom: "PullRequest.mergedAt",
+    meaning: "Timestamp for the coherence oracle grandfather cutoff. No derivation rule reads it."
+  },
+  {
+    fact: "closedByActor",
+    readsFrom: "ClosedEvent.actor.login (most recent timeline CLOSED_EVENT)",
+    meaning: "GitHub login that hand-closed the Issue. No task-status derivation rule reads it — it is consumed by dispatch-gate.ts/coherence-checks.ts A1 to recognize a hand-closed dependency as resolved (task vinaya-engine-v1 21, #99), not by this status model."
+  }
+];
+var DERIVED_STATUSES = [
+  "backlog",
+  "todo",
+  "in-flight",
+  "in-review",
+  "changes-requested",
+  "merged",
+  "blocked",
+  "dropped",
+  "incoherent"
+];
+var DERIVABLE_STATUSES = DERIVED_STATUSES.filter((s) => s !== "backlog");
+// ../../packages/aeg-core/src/waiver-label.ts
+var WAIVER_LABEL = label("waiver-docs");
+var WAIVER_LABEL_REVIEW = label("waiver-review");
+// ../../packages/aeg-core/src/report-tokens.ts
+var DASH_LOOKALIKES = {
+  "-": "‑",
+  "–": "‒",
+  "—": "―"
+};
+var DASH_CHARS = new Set(Object.keys(DASH_LOOKALIKES));
+// ../../packages/aeg-core/src/metering-io-guard.ts
+import { closeSync, constants as fsConstants, fstatSync, openSync, readFileSync } from "node:fs";
+var GUARD_OPEN_FLAGS = fsConstants.O_RDONLY | fsConstants.O_NONBLOCK | fsConstants.O_NOFOLLOW;
+// ../../packages/aeg-core/src/doc-owners.ts
+function globToRegex(pat) {
+  let re = "^";
+  let i = 0;
+  while (i < pat.length) {
+    const c = pat[i];
+    if (c === "*") {
+      if (pat[i + 1] === "*") {
+        re += ".*";
+        i += 2;
+      } else {
+        re += "[^/]*";
+        i += 1;
+      }
+    } else if (/[.+^$|(){}[\]\\?]/.test(c)) {
+      re += `\\${c}`;
+      i += 1;
+    } else {
+      re += c;
+      i += 1;
+    }
+  }
+  re += "$";
+  return new RegExp(re);
+}
+var SEPARATOR = /(?:[ \t]*[—–][ \t]*|[ \t]+-[ \t]+)/.source;
+// ../../packages/aeg-core/src/pr-tier.ts
+var OVERRIDE_BODY_TOKEN = `[${label("override-docs")}]`;
+// ../../packages/aeg-core/src/premise-check.ts
+var ASSERTION_KINDS = new Set(["contains", "absent", "sha256"]);
+
+// ../../packages/aeg-core/src/brief-validation.ts
+var COMMIT_TYPES = [
+  "Build",
+  "Chore",
+  "Docs",
+  "Feat",
+  "Fix",
+  "Perf",
+  "Plan",
+  "Refactor",
+  "Revert",
+  "Style",
+  "Test"
+];
+var COMMIT_TYPE_STYLE = new RegExp(`^(${COMMIT_TYPES.join("|")})(\\([a-z0-9-]+\\))?: \\S`);
+// ../../packages/aeg-core/src/doctrine-portability.ts
+var EXEMPT_LITERALS = new Set([
+  "path/inside/the/shipped/diff.ts",
+  "path/inside/the/surface.ts",
+  "apps/x/specs/..."
+]);
+var NON_PATH_TOP_SEGMENTS = new Set(["origin", "refs", "HEAD", "vinaya", "fix"]);
+
+// ../../packages/aeg-core/src/doctrine-no-procedures.ts
+var SHELL_LANGS = new Set(["", "sh", "bash", "shell", "console"]);
+// ../../packages/aeg-core/src/issue-validation.ts
+var TYPE_LABEL_IDS = LABELS.filter((l) => l.category === "type").map((l) => l.id);
+var DOC_PATH_RE = /(?:(?:aeg-root|apps|packages|specs|docs|tools|\.claude|\.github)\/[\w./@-]*\.(?:md|mdx)|\.claude\/(?:skills|rules)\/[\w./-]+|\b(?:docs-index|decisions|projects|state-machine|enforcement|process|README|CLAUDE)\.md\b|\b[\w-]+-(?:spec|decisions|backlog)\.md\b)/i;
+var DOC_PATH_RE_GLOBAL = new RegExp(DOC_PATH_RE.source, "gi");
+
+// ../../packages/aeg-core/src/coherence-checks.ts
+var R1_GRANDFATHERED_ISSUES = new Set([279, 280, 281, 282]);
+// ../../packages/aeg-core/src/diagram-model.ts
+import matter from "gray-matter";
+// ../../packages/aeg-core/src/reader-resolvable-prose.ts
+var SWEPT_CLASSES = new Set(["ships", "reader-facing"]);
+
+// ../../packages/aeg-core/src/quoted-command.ts
+var QUOTED_COMMAND_SWEPT_CLASSES = new Set(["ships", "reader-facing"]);
+// ../../packages/aeg-core/src/retired-vocabulary.ts
+var RETIRED_PATTERNS = [
+  String.raw`\bD-[0-9]{3}\b`,
+  "D-(###|NNN|nnn|xxx)",
+  "decision (entry|logged)",
+  "decision-log entry",
+  "decision log entry",
+  "decision log(s|ged|ging)?([^a-z]|$)",
+  "decision-log",
+  "decision entr",
+  "decisions? (are |is )?logged",
+  "log entries",
+  String.raw`decisions\.md`,
+  "decisions-legacy",
+  "CONTRADICTION",
+  "assumes Tier 3",
+  "Lock: ?YES",
+  "Lock: ?NO",
+  "lock approvals?",
+  "approves locks",
+  "Conforms to lock",
+  "Challenges lock",
+  "checkDecisionNumbersFresh",
+  String.raw`roles/team-leader\.md`,
+  String.raw`\(,`,
+  String.raw`,\)`,
+  String.raw`\(\.\)`
+];
+var PATTERN_EXEMPT = {
+  [String.raw`\bD-[0-9]{3}\b`]: ["./CLAUDE.md"],
+  [String.raw`decisions\.md`]: [
+    "docs-index.md",
+    "apps/vada-ai/specs/legacy/README.md",
+    "apps/vada-ai/specs/vada-product-spec.md",
+    "apps/vada-ai/web/CLAUDE.md",
+    "apps/vada-ai/CLAUDE.md"
+  ],
+  "decisions-legacy": [
+    "packages/aeg-core/src/file-classify.ts",
+    "packages/aeg-core/src/file-classify.test.ts",
+    "packages/aeg-core/src/pr-tier.test.ts",
+    "docs-index.md",
+    ".claude/skills/database/SKILL.md",
+    ".claude/skills/vada-architecture/SKILL.md",
+    "apps/vada-ai/specs/vada-byok-principles.md",
+    "apps/vada-ai/web/CLAUDE.md",
+    "apps/vada-ai/CLAUDE.md"
+  ],
+  CONTRADICTION: ["apps/vada-ai/specs/vada-reviewers-spec.md"]
+};
+// ../../packages/aeg-core/src/task-tools.ts
+import { z } from "zod";
+var TASK_TOOL_ERROR_KINDS = [
+  "validation",
+  "authority",
+  "precondition",
+  "capability",
+  "infrastructure",
+  "cancellation",
+  "timeout",
+  "uncertain_effect"
+];
+var TaskToolErrorSchema = z.object({
+  kind: z.enum(TASK_TOOL_ERROR_KINDS),
+  message: z.string().min(1),
+  detail: z.string().optional()
+});
+var TaskToolRefSchema = z.union([
+  z.object({ tranche: z.string().min(1), id: z.string().min(1) }),
+  z.object({ issue: z.number().int().positive() })
+]);
+var MAX_PAGE_LIMIT = 100;
+var PageRequestSchema = z.object({
+  cursor: z.string().optional(),
+  limit: z.number().int().positive().max(MAX_PAGE_LIMIT).optional()
+});
+var FreshnessSchema = z.enum(["fresh", "stale", "unknown"]);
+var ObservedSchema = z.object({
+  observedAt: z.string(),
+  freshness: FreshnessSchema
+});
+var TaskStatusInputSchema = z.object({
+  task: TaskToolRefSchema.optional()
+}).merge(PageRequestSchema);
+var TaskStatusItemSchema = z.object({
+  task: TaskToolRefSchema,
+  issue: z.number().int().positive(),
+  pr: z.number().int().positive().nullable(),
+  state: z.string()
+}).merge(ObservedSchema);
+var TaskStatusResultSchema = z.object({
+  items: z.array(TaskStatusItemSchema),
+  nextCursor: z.string().nullable()
+});
+var RequestedAuthoritySchema = z.enum(["planner", "principal", "operator", "self"]);
+var EscalationInputsSchema = z.object({
+  task: z.number().int().positive(),
+  round: z.number().int().nonnegative(),
+  head: z.string(),
+  branch: z.string(),
+  prNumber: z.number().int().positive()
+});
+var EscalationEvidenceSchema = z.object({
+  round: z.number().int().nonnegative(),
+  reviewer: z.string().nullable(),
+  security: z.string().nullable()
+});
+var TaskEscalationReadInputSchema = z.object({
+  task: TaskToolRefSchema
+}).merge(PageRequestSchema);
+var TaskEscalationPacketSchema = z.object({
+  reason: z.string(),
+  detail: z.string().nullable(),
+  inputs: EscalationInputsSchema.nullable(),
+  evidence: EscalationEvidenceSchema.nullable(),
+  attemptedRecovery: z.string(),
+  requestedAuthority: RequestedAuthoritySchema,
+  permittedNextActions: z.array(z.string())
+}).merge(ObservedSchema);
+var TaskEscalationReadResultSchema = z.object({
+  items: z.array(TaskEscalationPacketSchema),
+  nextCursor: z.string().nullable()
+}).merge(ObservedSchema);
+var TaskStartInputSchema = z.object({
+  tranche: z.string().min(1),
+  id: z.string().min(1)
+});
+var TaskResumeInputSchema = z.object({
+  task: TaskToolRefSchema
+});
+var TaskCancelInputSchema = z.object({
+  task: TaskToolRefSchema,
+  reason: z.string().min(1)
+});
+var NoResultSchema = z.never();
+// ../../packages/aeg-core/src/log/schema.ts
+import { z as z2 } from "zod";
+var ROLE_VALUES = [
+  "planner",
+  "developer",
+  "code-reviewer",
+  "security",
+  "principal",
+  "archivist",
+  "architect"
+];
+var RoleSchema = z2.enum(ROLE_VALUES);
+var HOST_VALUES = ["hook", "ci", "cli", "loop"];
+var HostSchema = z2.enum(HOST_VALUES);
+var RUN_ID_PATTERN = /^[A-Za-z0-9_.-]{1,128}$/;
+var headerMetaCore = {
+  ts: z2.string(),
+  run_id: z2.string().regex(RUN_ID_PATTERN),
+  seq: z2.number().int().nonnegative(),
+  repo: z2.string().nullable(),
+  vinaya: z2.string(),
+  doctrine: z2.string(),
+  host: HostSchema,
+  machine: z2.string()
+};
+var HeaderMetaV1Schema = z2.object({
+  schema: z2.literal(1),
+  ...headerMetaCore
+}).strict();
+var LineageSchema = z2.object({
+  run: z2.string().nullable(),
+  attempt: z2.number().int().nullable(),
+  parent: z2.string().nullable()
+}).strict();
+var InputVersionsSchema = z2.object({
+  objectives_version: z2.string().nullable(),
+  brief_hash: z2.string().nullable(),
+  ruling_ordinal: z2.number().int().nullable(),
+  policy_digest: z2.string().nullable()
+}).strict();
+var ProvenanceSchema = z2.enum(["parent_attributed", "env_correlated", "self_reported", "unavailable"]);
+var HeaderMetaV2Schema = z2.object({
+  schema: z2.literal(2),
+  ...headerMetaCore,
+  event_id: z2.string().min(1),
+  process_id: z2.string().min(1),
+  actor_id: z2.string().nullable(),
+  lineage: LineageSchema,
+  input_versions: InputVersionsSchema,
+  provenance: ProvenanceSchema
+}).strict();
+var HeaderMetaSchema = z2.discriminatedUnion("schema", [HeaderMetaV1Schema, HeaderMetaV2Schema]);
+var SubjectSchema = z2.object({
+  issue: z2.number().int().nullable(),
+  pr: z2.number().int().optional(),
+  sha: z2.string().optional(),
+  role: z2.union([RoleSchema, z2.literal("unattributed")]),
+  round: z2.number().int().optional(),
+  objectives_version: z2.string().optional()
+}).strict();
+var HeaderSchema = z2.object({
+  meta: HeaderMetaSchema,
+  subject: SubjectSchema
+}).strict();
+var envelopeTail = {
+  duration_ms: z2.number().nonnegative().optional(),
+  payload: z2.object({}).strict()
+};
+var ReviewFindingSchema = z2.object({
+  id: z2.string(),
+  severity: z2.string(),
+  state: z2.string().optional(),
+  severity_scale: z2.string().optional(),
+  policy_treatment: z2.enum(["blocking", "non_blocking", "unavailable"]).optional(),
+  confidence: z2.number().min(0).max(1).optional(),
+  confidence_scale: z2.string().optional(),
+  confidence_source: z2.string().optional()
+}).strict();
+var DispatchOutcomeSchema = z2.discriminatedUnion("type", [
+  z2.object({ type: z2.literal("pr_opened"), pr: z2.number().int(), head: z2.string() }).strict(),
+  z2.object({
+    type: z2.literal("round_pushed"),
+    pr: z2.number().int(),
+    head: z2.string(),
+    comment_id: z2.number().int()
+  }).strict(),
+  z2.object({
+    type: z2.literal("verdict"),
+    verdict: z2.enum(["APPROVE", "REQUEST CHANGES", "PASS", "FAIL"]),
+    head: z2.string(),
+    comment_id: z2.number().int(),
+    objectives: z2.array(z2.object({ id: z2.string(), met: z2.boolean() }).strict()),
+    findings: z2.array(ReviewFindingSchema)
+  }).strict(),
+  z2.object({
+    type: z2.literal("escalation"),
+    class: z2.enum(["authority", "strategy", "product"]),
+    comment_id: z2.number().int()
+  }).strict(),
+  z2.object({ type: z2.literal("brief"), comment_id: z2.number().int(), hash: z2.string() }).strict(),
+  z2.object({ type: z2.literal("plan"), issues: z2.array(z2.number().int()) }).strict(),
+  z2.object({ type: z2.literal("archive"), provenance_comment_id: z2.number().int() }).strict()
+]);
+var dispatchShared = {
+  meta: HeaderMetaSchema,
+  subject: SubjectSchema,
+  kind: z2.literal("dispatch"),
+  ...envelopeTail,
+  target_role: RoleSchema,
+  model: z2.string(),
+  round: z2.number().int().optional(),
+  effect_id: z2.string()
+};
+var dispatchUsageField = z2.object({ input: z2.number().nonnegative(), output: z2.number().nonnegative() }).strict().nullable();
+var DispatchEventSchema = z2.discriminatedUnion("event", [
+  z2.object({ ...dispatchShared, event: z2.literal("dispatched"), prompt_hash: z2.string() }).strict(),
+  z2.object({
+    ...dispatchShared,
+    event: z2.literal("outcome_received"),
+    outcome: DispatchOutcomeSchema,
+    usage: dispatchUsageField
+  }).strict(),
+  z2.object({
+    ...dispatchShared,
+    event: z2.literal("dispatch_failed"),
+    reason: z2.enum(["timeout", "crash", "refused", "unattributed_write"]),
+    usage: dispatchUsageField
+  }).strict()
+]);
+var loopShared = {
+  meta: HeaderMetaSchema,
+  subject: SubjectSchema,
+  kind: z2.literal("dev_review_loop"),
+  ...envelopeTail,
+  loop_id: z2.string()
+};
+var DevReviewLoopEventSchema = z2.discriminatedUnion("event", [
+  z2.object({
+    ...loopShared,
+    event: z2.literal("loop_started"),
+    task: z2.number().int(),
+    policy: z2.object({
+      max_rounds: z2.number().int().nonnegative(),
+      reviewers: z2.array(RoleSchema),
+      models: z2.record(RoleSchema, z2.string())
+    }).strict()
+  }).strict(),
+  z2.object({ ...loopShared, event: z2.literal("round_started"), round: z2.number().int(), base_head: z2.string() }).strict(),
+  z2.object({
+    ...loopShared,
+    event: z2.literal("gate_result_read"),
+    round: z2.number().int(),
+    head: z2.string(),
+    green: z2.boolean()
+  }).strict(),
+  z2.object({
+    ...loopShared,
+    event: z2.literal("verdicts_read"),
+    round: z2.number().int(),
+    head: z2.string(),
+    all_approve: z2.boolean(),
+    blockers: z2.number().int().nonnegative()
+  }).strict(),
+  z2.object({
+    ...loopShared,
+    event: z2.literal("findings_compared"),
+    round: z2.number().int(),
+    open: z2.array(z2.string()),
+    resolved: z2.array(z2.string()),
+    new: z2.array(z2.string()),
+    recurring: z2.array(z2.string())
+  }).strict(),
+  z2.object({
+    ...loopShared,
+    event: z2.literal("stop_condition_met"),
+    round: z2.number().int(),
+    condition: z2.enum([
+      "green",
+      "max_rounds",
+      "no_progress",
+      "escalated",
+      "principal_stop",
+      "confidence",
+      "reappearance"
+    ])
+  }).strict(),
+  z2.object({
+    ...loopShared,
+    event: z2.literal("paused"),
+    round: z2.number().int(),
+    reason: z2.enum(["escalation", "principal_item", "refreeze_needed"])
+  }).strict(),
+  z2.object({
+    ...loopShared,
+    event: z2.literal("resumed"),
+    round: z2.number().int(),
+    by: z2.literal("principal")
+  }).strict(),
+  z2.object({
+    ...loopShared,
+    event: z2.literal("unpushed_work_resume"),
+    round: z2.number().int(),
+    branch: z2.string(),
+    detail: z2.string()
+  }).strict(),
+  z2.object({
+    ...loopShared,
+    event: z2.literal("round_ended"),
+    round: z2.number().int(),
+    base_head: z2.string(),
+    head: z2.string(),
+    files_changed: z2.number().int().nonnegative(),
+    insertions: z2.number().int().nonnegative(),
+    deletions: z2.number().int().nonnegative(),
+    wall_ms: z2.number().nonnegative(),
+    outcome: z2.enum(["green", "changes_requested", "escalated"])
+  }).strict(),
+  z2.object({
+    ...loopShared,
+    event: z2.literal("journal_finalized"),
+    rounds: z2.number().int().nonnegative(),
+    total_wall_ms: z2.number().nonnegative(),
+    time_to_green_ms: z2.number().nonnegative().nullable(),
+    files_changed_total: z2.number().int().nonnegative(),
+    final_head: z2.string(),
+    result: z2.enum(["merged_ready", "stopped"])
+  }).strict()
+]);
+var ForgeOpSchema = z2.enum([
+  "pr.create",
+  "pr.comment",
+  "pr.body.replace",
+  "pr.refreeze",
+  "issue.create",
+  "issue.edit",
+  "issue.comment",
+  "milestone.create",
+  "milestone.edit",
+  "milestone.close",
+  "label.add",
+  "label.remove"
+]);
+var ForgeWriteTargetSchema = z2.object({
+  issue: z2.number().int().optional(),
+  pr: z2.number().int().optional()
+}).strict();
+var forgeWriteShared = {
+  meta: HeaderMetaSchema,
+  subject: SubjectSchema,
+  kind: z2.literal("forge_write"),
+  ...envelopeTail,
+  op: ForgeOpSchema,
+  target: ForgeWriteTargetSchema
+};
+var ForgeWriteEventSchema = z2.discriminatedUnion("event", [
+  z2.object({ ...forgeWriteShared, event: z2.literal("validated") }).strict(),
+  z2.object({ ...forgeWriteShared, event: z2.literal("refused"), reason: z2.string() }).strict(),
+  z2.object({ ...forgeWriteShared, event: z2.literal("written"), comment_ids: z2.array(z2.string()) }).strict()
+]);
+var GateOutcomeSchema = z2.enum([
+  "pass",
+  "fail",
+  "wait",
+  "skip",
+  "invalid_input",
+  "unavailable_dependency",
+  "timeout",
+  "cancelled"
+]);
+var gateShared = {
+  meta: HeaderMetaSchema,
+  subject: SubjectSchema,
+  kind: z2.literal("gate"),
+  ...envelopeTail,
+  check: z2.string(),
+  check_version: z2.string().nullable(),
+  policy_version: z2.string().nullable(),
+  input_fingerprint: z2.string().nullable()
+};
+var GateEventSchema = z2.discriminatedUnion("event", [
+  z2.object({
+    ...gateShared,
+    event: z2.literal("checked"),
+    outcome: GateOutcomeSchema,
+    reason: z2.string().optional()
+  }).strict()
+]);
+var OperationResultSchema = z2.enum(["ok", "error", "refused", "timeout", "cancelled", "unavailable"]);
+var operationShared = {
+  meta: HeaderMetaSchema,
+  subject: SubjectSchema,
+  kind: z2.literal("operation"),
+  ...envelopeTail,
+  operation: z2.string(),
+  target: z2.string().nullable()
+};
+var OperationEventSchema = z2.discriminatedUnion("event", [
+  z2.object({
+    ...operationShared,
+    event: z2.literal("completed"),
+    result: OperationResultSchema,
+    error_class: z2.string().nullable()
+  }).strict()
+]);
+var UsageUnitsSchema = z2.object({
+  input: z2.number().nonnegative().nullable(),
+  output: z2.number().nonnegative().nullable(),
+  cache: z2.number().nonnegative().nullable()
+}).strict();
+var usageShared = {
+  meta: HeaderMetaSchema,
+  subject: SubjectSchema,
+  kind: z2.literal("usage"),
+  ...envelopeTail,
+  model: z2.string().nullable(),
+  source: z2.string(),
+  semantics: z2.enum(["cumulative", "delta"])
+};
+var UsageEventSchema = z2.discriminatedUnion("event", [
+  z2.object({
+    ...usageShared,
+    event: z2.literal("observed"),
+    units: UsageUnitsSchema,
+    unknown_reason: z2.string().nullable()
+  }).strict()
+]);
+var RoleAttemptOutcomeSchema = z2.enum([
+  "completed",
+  "incomplete",
+  "infrastructure_failed",
+  "cancelled",
+  "timed_out",
+  "capability_refused"
+]);
+var roleAttemptShared = {
+  meta: HeaderMetaSchema,
+  subject: SubjectSchema,
+  kind: z2.literal("role_attempt"),
+  ...envelopeTail,
+  actor: z2.string().nullable(),
+  attempt: z2.number().int().nullable()
+};
+var RoleAttemptEventSchema = z2.discriminatedUnion("event", [
+  z2.object({
+    ...roleAttemptShared,
+    event: z2.literal("attempted"),
+    outcome: RoleAttemptOutcomeSchema,
+    usage: dispatchUsageField
+  }).strict()
+]);
+var handoffShared = {
+  meta: HeaderMetaSchema,
+  subject: SubjectSchema,
+  kind: z2.literal("handoff"),
+  ...envelopeTail,
+  class: z2.enum(["authority", "strategy", "product"]),
+  reason: z2.string()
+};
+var HandoffEventSchema = z2.discriminatedUnion("event", [
+  z2.object({
+    ...handoffShared,
+    event: z2.literal("raised"),
+    requested_decision: z2.string().nullable()
+  }).strict(),
+  z2.object({
+    ...handoffShared,
+    event: z2.literal("resolved"),
+    resolution: z2.string().nullable(),
+    resolved_by: z2.string().nullable()
+  }).strict()
+]);
+var EffectTargetSchema = z2.object({
+  kind: z2.string(),
+  ref: z2.string()
+}).strict();
+var effectShared = {
+  meta: HeaderMetaSchema,
+  subject: SubjectSchema,
+  kind: z2.literal("effect"),
+  ...envelopeTail,
+  effect_id: z2.string(),
+  target: EffectTargetSchema
+};
+var EffectEventSchema = z2.discriminatedUnion("event", [
+  z2.object({ ...effectShared, event: z2.literal("attempted") }).strict(),
+  z2.object({ ...effectShared, event: z2.literal("observed"), outcome: z2.enum(["success", "failure", "uncertain"]) }).strict(),
+  z2.object({ ...effectShared, event: z2.literal("verified"), outcome: z2.enum(["success", "failure", "uncertain"]) }).strict()
+]);
+var LogEventSchema = z2.union([
+  DispatchEventSchema,
+  DevReviewLoopEventSchema,
+  ForgeWriteEventSchema,
+  GateEventSchema,
+  OperationEventSchema,
+  UsageEventSchema,
+  RoleAttemptEventSchema,
+  HandoffEventSchema,
+  EffectEventSchema
+]);
+// ../../packages/aeg-core/src/dev-review-loop/journal-reconstruction.ts
+var STOPPED_CONDITIONS = new Set(["confidence", "reappearance", "no_progress", "max_rounds"]);
+// ../../packages/aeg-core/src/control-store/records.ts
+import { z as z3 } from "zod";
+var isoTimestamp = z3.string().min(1);
+var taskId = z3.number().int().positive();
+var epochNumber = z3.number().int().nonnegative();
+var RunRecordSchema = z3.object({
+  version: z3.literal(1),
+  kind: z3.literal("run"),
+  task: taskId,
+  runId: z3.string().min(1),
+  pid: z3.number().int().positive(),
+  host: z3.string().min(1),
+  startedAt: isoTimestamp
+}).strict();
+var InputRecordSchema = z3.object({
+  version: z3.literal(1),
+  kind: z3.literal("input"),
+  task: taskId,
+  runId: z3.string().min(1),
+  source: z3.union([z3.literal("fresh"), z3.literal("resume")]),
+  pr: z3.number().int().positive().nullable(),
+  round: z3.number().int().nonnegative(),
+  recordedAt: isoTimestamp
+}).strict();
+var OwnershipRecordSchema = z3.object({
+  version: z3.literal(1),
+  kind: z3.literal("ownership"),
+  task: taskId,
+  epoch: epochNumber,
+  ownerId: z3.string().min(1),
+  pid: z3.number().int().positive(),
+  host: z3.string().min(1),
+  acquiredAt: isoTimestamp
+}).strict();
+var TransitionRecordSchema = z3.object({
+  version: z3.literal(1),
+  kind: z3.literal("transition"),
+  task: taskId,
+  epoch: epochNumber,
+  seq: z3.number().int().nonnegative(),
+  from: z3.string().min(1),
+  to: z3.string().min(1),
+  detail: z3.string().optional(),
+  at: isoTimestamp
+}).strict();
+// src/lib/agent-vendors.ts
+var AGENT_VENDORS = ["skills", "claude", "gemini"];
+
+// src/lib/config.ts
+var EnvEntrySchema = z4.union([
+  z4.literal(true),
+  z4.object({ optional: z4.literal(true) }),
+  z4.object({ anyOf: z4.array(z4.string()).min(2) }),
+  z4.string()
+]);
+var CheckEntrySchema = z4.object({
+  run: z4.string(),
+  scope: z4.enum(["diff", "full"]),
+  include: z4.array(z4.string()).optional(),
+  args: z4.array(z4.string()).optional(),
+  timeoutMs: z4.number().optional(),
+  env: z4.record(z4.string(), EnvEntrySchema).optional(),
+  requiresOpenPr: z4.boolean().optional(),
+  ownWorkflow: z4.boolean().optional(),
+  principalOwed: z4.literal(true).optional(),
+  validates: z4.enum(["body", "issue"]).optional()
+}).superRefine((entry2, ctx) => {
+  if (!entry2.env)
+    return;
+  for (const [key, value] of Object.entries(entry2.env)) {
+    if (typeof value !== "object" || value === null || !("anyOf" in value))
+      continue;
+    const members = value.anyOf;
+    if (new Set(members).size !== members.length) {
+      ctx.addIssue({
+        code: z4.ZodIssueCode.custom,
+        message: `env.${key}.anyOf has duplicate members`,
+        path: ["env", key, "anyOf"]
+      });
+    }
+    if (!members.includes(key)) {
+      ctx.addIssue({
+        code: z4.ZodIssueCode.custom,
+        message: `env.${key}.anyOf must include "${key}" itself as a member`,
+        path: ["env", key, "anyOf"]
+      });
+    }
+  }
+});
+var RoleEntrySchema = z4.object({
+  contract: z4.string().refine((p) => p.includes("/"), {
+    message: 'must be a path (contain at least one "/"), not a bare filename'
+  })
+});
+var MAX_REPORT_COMMAND_TIMEOUT_MS = 3600000;
+var BRIEF_BUILTINS = [
+  "tier",
+  "testPlan",
+  "testPlanExclusivity",
+  "principalPlaceholder",
+  "surfaceMap",
+  "docUpdateList",
+  "worktreeStep0",
+  "stopConditions",
+  "autonomyClause",
+  "project",
+  "for",
+  "closesN",
+  "premiseCoverage",
+  "issueRationale",
+  "objectives",
+  "briefSections",
+  "milestoneShape"
+];
+var BriefSectionSchema = z4.union([
+  z4.object({ builtin: z4.enum(BRIEF_BUILTINS) }),
+  z4.object({ heading: z4.string().min(1), name: z4.string().optional() }),
+  z4.object({ field: z4.string().min(1), name: z4.string().optional() }),
+  z4.object({ phrase: z4.string().min(1), name: z4.string().optional() })
+]);
+var BriefSchemaSchema = z4.object({
+  pr: z4.object({ sections: z4.array(BriefSectionSchema) }).optional(),
+  issue: z4.object({ sections: z4.array(BriefSectionSchema) }).optional(),
+  milestone: z4.object({ sections: z4.array(BriefSectionSchema) }).optional(),
+  ack: z4.array(z4.enum(BRIEF_BUILTINS)).optional()
+});
+function isSafeRepoRelPath(p) {
+  if (p.length === 0)
+    return false;
+  if (p.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(p))
+    return false;
+  return p.split(/[\\/]/).every((seg) => seg !== ".." && seg !== "");
+}
+var SafeRepoRelPath = z4.string().refine(isSafeRepoRelPath, {
+  message: "must be a repo-root-relative path with no `..` segment or absolute root"
+});
+var CANONICAL_HOOK_BLOCK_PREFIXES = [".git/", ".husky/", ".vinaya/hooks/", ".claude/hooks/"];
+function isCanonicalHookBlockPath(p) {
+  return CANONICAL_HOOK_BLOCK_PREFIXES.some((prefix) => p.startsWith(prefix) && p.length > prefix.length);
+}
+var ManagedHookBlockPath = SafeRepoRelPath.refine(isCanonicalHookBlockPath, {
+  message: `must start with one of ${CANONICAL_HOOK_BLOCK_PREFIXES.join(", ")} (byte-exact, case-sensitive)`
+});
+var ManagedBlockRecordSchema = z4.object({
+  path: ManagedHookBlockPath,
+  marker: z4.string(),
+  comment: z4.enum(["hash", "html"])
+});
+var ManagedManifestSchema = z4.object({
+  version: z4.number().int().positive(),
+  files: z4.array(SafeRepoRelPath),
+  blocks: z4.array(ManagedBlockRecordSchema),
+  labels: z4.array(z4.string()),
+  agents: z4.array(z4.enum(AGENT_VENDORS)).optional()
+});
+var ProjectEntrySchema = z4.object({
+  name: z4.string().min(1),
+  description: z4.string().min(1).optional(),
+  path: z4.string().min(1).optional()
+});
+function parseTokensCollectDeclaration(value) {
+  const m = value.trim().match(/^(\S+)\s+(\S+)$/);
+  if (!m)
+    return null;
+  const [, interpreter, script] = m;
+  if (!isSafeRepoRelPath(script))
+    return null;
+  return { interpreter, script };
+}
+var VinayaConfigSchema = z4.object({
+  rings: z4.object({
+    ring1_forgeWriteInterception: z4.boolean(),
+    ring2_asyncAudits: z4.boolean()
+  }).optional(),
+  checks: z4.record(z4.string(), CheckEntrySchema).optional(),
+  roles: z4.record(z4.string(), RoleEntrySchema).optional(),
+  briefSchema: BriefSchemaSchema.optional(),
+  managed: ManagedManifestSchema.optional(),
+  principals: z4.array(z4.string()).min(1).optional(),
+  releaseActor: z4.string().min(1).optional(),
+  ci: z4.object({ setup: z4.string().min(1) }).optional(),
+  tokens: z4.object({
+    collect: z4.string().min(1).refine((v) => parseTokensCollectDeclaration(v) !== null, {
+      message: 'tokens.collect must be exactly "<interpreter> <repo-relative-script-path>" — two whitespace-separated tokens, no flags, no shell syntax, no quoting'
+    })
+  }).optional(),
+  blastRadius: z4.object({ extraDomains: z4.array(z4.string()).optional() }).optional(),
+  proseGates: z4.object({
+    doctrineRoot: z4.string().min(1).optional(),
+    readerFacingPrefix: z4.string().min(1).optional(),
+    readerFacingSuffix: z4.string().min(1).optional(),
+    legacySlugDir: z4.string().min(1).optional()
+  }).optional(),
+  projects: z4.array(ProjectEntrySchema).optional(),
+  dispatch: z4.object({
+    timeoutMs: z4.number().int().positive().optional(),
+    killGraceMs: z4.number().int().positive().optional(),
+    agent: z4.enum(["claude", "codex", "gemini"]).optional()
+  }).optional(),
+  reviewPolicy: z4.object({
+    codeReviewThreshold: z4.string().min(1).optional(),
+    securityThreshold: z4.string().min(1).optional(),
+    maxRounds: z4.number().optional()
+  }).optional(),
+  prePush: z4.object({
+    alwaysRun: z4.array(z4.string()).optional()
+  }).optional(),
+  report: z4.object({
+    commandTimeoutMs: z4.number().int().positive().optional()
+  }).superRefine((report, ctx) => {
+    const commandTimeoutMs = report.commandTimeoutMs;
+    if (commandTimeoutMs !== undefined && commandTimeoutMs > MAX_REPORT_COMMAND_TIMEOUT_MS) {
+      ctx.addIssue({
+        code: z4.ZodIssueCode.custom,
+        path: ["commandTimeoutMs"],
+        message: "must be at most 3600000 (1 hour)"
+      });
+    }
+  }).optional()
+});
+var GLOBAL_VINAYA_HOME = join(homedir(), ".vinaya");
+var GLOBAL_CONFIG_PATH = join(GLOBAL_VINAYA_HOME, "config.json");
+var LOCAL_CONFIG_FILENAME = "vinaya.config.json";
+function findLocalConfig() {
+  let dir = process.cwd();
+  while (true) {
+    const candidate = join(dir, LOCAL_CONFIG_FILENAME);
+    if (existsSync(candidate))
+      return candidate;
+    if (existsSync(join(dir, ".git")))
+      return null;
+    const parent = dirname(dir);
+    if (parent === dir)
+      return null;
+    dir = parent;
+  }
+}
+function configPath() {
+  const local = findLocalConfig();
+  if (local)
+    return local;
+  if (existsSync(GLOBAL_CONFIG_PATH))
+    return GLOBAL_CONFIG_PATH;
+  return null;
+}
+function globalChecksIgnoredWarning(path) {
+  return `${path}: "checks" registration in the global config is ignored — checks may only be registered from a repo-local vinaya.config.json.`;
+}
+function globalPrincipalsIgnoredWarning(path) {
+  return `${path}: "principals" in the global config is ignored — principals may only be declared from a repo-local vinaya.config.json.`;
+}
+function globalRolesIgnoredWarning(path) {
+  return `${path}: "roles" registration in the global config is ignored — roles may only be registered from a repo-local vinaya.config.json.`;
+}
+function globalReleaseActorIgnoredWarning(path) {
+  return `${path}: "releaseActor" in the global config is ignored — releaseActor may only be declared from a repo-local vinaya.config.json.`;
+}
+function globalTokensCollectIgnoredWarning(path) {
+  return `${path}: "tokens" in the global config is ignored — tokens.collect may only be declared from a repo-local vinaya.config.json.`;
+}
+function stripGlobalOnlyKeys(config, path) {
+  if (path !== GLOBAL_CONFIG_PATH)
+    return config;
+  let result = config;
+  if (result.checks && Object.keys(result.checks).length > 0) {
+    console.error(`⚠ ${globalChecksIgnoredWarning(path)}`);
+    result = { ...result, checks: undefined };
+  }
+  if (result.roles && Object.keys(result.roles).length > 0) {
+    console.error(`⚠ ${globalRolesIgnoredWarning(path)}`);
+    result = { ...result, roles: undefined };
+  }
+  if (result.principals && result.principals.length > 0) {
+    console.error(`⚠ ${globalPrincipalsIgnoredWarning(path)}`);
+    result = { ...result, principals: undefined };
+  }
+  if (result.releaseActor) {
+    console.error(`⚠ ${globalReleaseActorIgnoredWarning(path)}`);
+    result = { ...result, releaseActor: undefined };
+  }
+  if (result.tokens) {
+    console.error(`⚠ ${globalTokensCollectIgnoredWarning(path)}`);
+    result = { ...result, tokens: undefined };
+  }
+  return result;
+}
+function loadConfig() {
+  const path = configPath();
+  if (!path)
+    return null;
+  try {
+    const raw = JSON.parse(readFileSync2(path, "utf-8"));
+    return stripGlobalOnlyKeys(VinayaConfigSchema.parse(raw), path);
+  } catch {
+    return null;
+  }
+}
+var TOKENS_COLLECT_TRUST_PATH = join(GLOBAL_VINAYA_HOME, "tokens-collect-trust.json");
+
+// src/lib/remote-base.ts
+import { execFileSync as execFileSync2 } from "node:child_process";
+import { join as join2 } from "node:path";
+function cleanGitEnv() {
+  const env = { ...process.env };
+  for (const key of Object.keys(env)) {
+    if (key.startsWith("GIT_"))
+      delete env[key];
+  }
+  return env;
+}
+function git(repoRoot, args) {
+  try {
+    return execFileSync2("git", args, {
+      cwd: repoRoot,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      env: cleanGitEnv()
+    }).trim();
+  } catch {
+    return "";
+  }
+}
+function resolveRemoteBase(repoRoot) {
+  const upstream = git(repoRoot, ["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}"]);
+  if (upstream)
+    return upstream;
+  const originMain = git(repoRoot, ["rev-parse", "--verify", "--quiet", "origin/main"]);
+  if (originMain)
+    return "origin/main";
+  return "HEAD~1";
+}
+function changedFilesSinceRemoteBase(repoRoot) {
+  const base = resolveRemoteBase(repoRoot);
+  const out = git(repoRoot, ["diff", "--name-only", "--diff-filter=ACMR", `${base}...HEAD`]);
+  return out.split(`
+`).map((s) => s.trim()).filter(Boolean);
+}
+function changedFilesSinceRemoteBaseAbsolute(repoRoot) {
+  return changedFilesSinceRemoteBase(repoRoot).map((f) => join2(repoRoot, f));
+}
+function addedOrRenamedFilesSinceRemoteBase(repoRoot) {
+  const base = resolveRemoteBase(repoRoot);
+  const out = git(repoRoot, ["diff", "--name-only", "--diff-filter=AR", `${base}...HEAD`]);
+  return out.split(`
+`).map((s) => s.trim()).filter(Boolean);
+}
+function addedOrRenamedFilesSinceRemoteBaseAbsolute(repoRoot) {
+  return addedOrRenamedFilesSinceRemoteBase(repoRoot).map((f) => join2(repoRoot, f));
+}
+
+// src/lib/test-selector.ts
+import { readdirSync, readFileSync as readFileSync3, statSync } from "node:fs";
+import { dirname as dirname2, extname, isAbsolute, join as join3, resolve as resolve2 } from "node:path";
+var FROM_CLAUSE_RE = /^\s*(?:import|export)\b[^'"]*?\bfrom\s*(['"])([^'"]+)\1/gm;
+var BARE_IMPORT_RE = /^\s*import\s*(['"])([^'"]+)\1/gm;
+var DYNAMIC_IMPORT_RE = /\bimport\s*\(\s*(['"])([^'"]+)\1\s*\)/g;
+var SOURCE_EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"];
+var SKIP_DIRS = new Set(["node_modules", "dist", ".git", "build", "coverage"]);
+function extractImportSpecifiers(source) {
+  const specifiers = new Set;
+  for (const re of [FROM_CLAUSE_RE, BARE_IMPORT_RE, DYNAMIC_IMPORT_RE]) {
+    re.lastIndex = 0;
+    let match = re.exec(source);
+    while (match !== null) {
+      specifiers.add(match[2]);
+      match = re.exec(source);
+    }
+  }
+  return [...specifiers];
+}
+function walkFiles(root) {
+  const out = [];
+  let entries;
+  try {
+    entries = readdirSync(root);
+  } catch {
+    return out;
+  }
+  for (const entry2 of entries) {
+    if (SKIP_DIRS.has(entry2))
+      continue;
+    const abs = join3(root, entry2);
+    let s;
+    try {
+      s = statSync(abs);
+    } catch {
+      continue;
+    }
+    if (s.isDirectory()) {
+      out.push(...walkFiles(abs));
+    } else {
+      out.push(abs);
+    }
+  }
+  return out;
+}
+function resolveRelativeImport(fromFile, specifier, knownFiles) {
+  if (!specifier.startsWith("."))
+    return null;
+  const base = resolve2(dirname2(fromFile), specifier);
+  if (knownFiles.has(base))
+    return base;
+  for (const ext of SOURCE_EXTENSIONS) {
+    if (knownFiles.has(base + ext))
+      return base + ext;
+  }
+  for (const ext of SOURCE_EXTENSIONS) {
+    const indexed = join3(base, `index${ext}`);
+    if (knownFiles.has(indexed))
+      return indexed;
+  }
+  return null;
+}
+function isBunTestScript(script) {
+  if (!script)
+    return true;
+  return /(^|[\s;&|])bun\s+test\b/.test(script);
+}
+function discoverWorkspacePackages(repoRoot) {
+  const rootPkgPath = join3(repoRoot, "package.json");
+  let workspaces = [];
+  try {
+    const rootPkg = JSON.parse(readFileSync3(rootPkgPath, "utf8"));
+    workspaces = rootPkg.workspaces ?? [];
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const glob of workspaces) {
+    const m = /^([^*]+)\*$/.exec(glob);
+    if (!m)
+      continue;
+    const parentDir = join3(repoRoot, m[1].replace(/\/$/, ""));
+    let entries;
+    try {
+      entries = readdirSync(parentDir);
+    } catch {
+      continue;
+    }
+    for (const entry2 of entries) {
+      const dir = join3(parentDir, entry2);
+      const pkgPath = join3(dir, "package.json");
+      try {
+        const pkg = JSON.parse(readFileSync3(pkgPath, "utf8"));
+        if (pkg.name)
+          out.push({ dir, name: pkg.name, bunTestCompatible: isBunTestScript(pkg.scripts?.test) });
+      } catch {}
+    }
+  }
+  return out;
+}
+function isTestFile(path) {
+  const withoutExt = path.slice(0, -extname(path).length);
+  return withoutExt.endsWith(".test");
+}
+function buildFileGraph(pkgDir) {
+  const files = walkFiles(pkgDir).filter((f) => SOURCE_EXTENSIONS.includes(extname(f)));
+  const knownFiles = new Set(files);
+  const edges = new Map;
+  for (const file of files) {
+    let source;
+    try {
+      source = readFileSync3(file, "utf8");
+    } catch {
+      continue;
+    }
+    const deps = [];
+    for (const specifier of extractImportSpecifiers(source)) {
+      if (specifier.startsWith(".")) {
+        const resolved = resolveRelativeImport(file, specifier, knownFiles);
+        if (resolved)
+          deps.push(resolved);
+      } else {
+        deps.push(`external:${specifier}`);
+      }
+    }
+    edges.set(file, deps);
+  }
+  return { files, edges };
+}
+function selectAffectedTestFiles(repoRoot, changedFiles, options = {}) {
+  const packages = discoverWorkspacePackages(repoRoot);
+  const absChanged = new Set(changedFiles.map((f) => isAbsolute(f) ? f : join3(repoRoot, f)));
+  const alwaysRunRegexes = (options.alwaysRun ?? []).map(globToRegex);
+  const addedOrRenamed = new Set((options.addedOrRenamed ?? []).map((f) => isAbsolute(f) ? f : join3(repoRoot, f)));
+  const changedPackageNames = new Set;
+  for (const pkg of packages) {
+    for (const f of absChanged) {
+      if (f.startsWith(`${pkg.dir}/`)) {
+        changedPackageNames.add(pkg.name);
+        break;
+      }
+    }
+  }
+  const selected = [];
+  let totalTestFiles = 0;
+  for (const pkg of packages) {
+    const { files, edges } = buildFileGraph(pkg.dir);
+    const testFiles = files.filter(isTestFile);
+    totalTestFiles += testFiles.length;
+    if (!pkg.bunTestCompatible)
+      continue;
+    const packageChanged = new Set([...absChanged].filter((f) => f.startsWith(`${pkg.dir}/`)));
+    const relevant = packageChanged.size > 0 || changedPackageNames.size > 0;
+    for (const test of testFiles) {
+      const forced = alwaysRunRegexes.some((re) => re.test(test.slice(repoRoot.length + 1))) || addedOrRenamed.has(test);
+      if (forced || relevant && reachesChangedFile(test, edges, packageChanged, changedPackageNames, pkg.name)) {
+        selected.push(test);
+      }
+    }
+  }
+  return { selected, totalTestFiles };
+}
+function reachesChangedFile(start, edges, changedInPackage, changedOtherPackages, ownPackageName) {
+  const visited = new Set;
+  const stack = [start];
+  while (stack.length > 0) {
+    const current = stack.pop();
+    if (visited.has(current))
+      continue;
+    visited.add(current);
+    if (changedInPackage.has(current))
+      return true;
+    for (const dep of edges.get(current) ?? []) {
+      if (dep.startsWith("external:")) {
+        const specifier = dep.slice("external:".length);
+        for (const otherPkg of changedOtherPackages) {
+          if (otherPkg === ownPackageName)
+            continue;
+          if (specifier === otherPkg || specifier.startsWith(`${otherPkg}/`))
+            return true;
+        }
+        continue;
+      }
+      if (!visited.has(dep))
+        stack.push(dep);
+    }
+  }
+  return false;
+}
+
+// src/lib/pre-push-select-tests.ts
+function main() {
+  const repoRoot = process.cwd();
+  const changed = changedFilesSinceRemoteBaseAbsolute(repoRoot);
+  const addedOrRenamed = addedOrRenamedFilesSinceRemoteBaseAbsolute(repoRoot);
+  const alwaysRun = loadConfig()?.prePush?.alwaysRun ?? [];
+  const { selected, totalTestFiles } = selectAffectedTestFiles(repoRoot, changed, { alwaysRun, addedOrRenamed });
+  for (const file of selected)
+    process.stdout.write(`${file}
+`);
+  process.stderr.write(`vinaya pre-push: selected ${selected.length} of ${totalTestFiles} test file(s)
+`);
+}
+main();