@cairn-tool/cairn 2.0.0 → 2.1.0

package/dist/agent/types.d.ts

@@ -6,6 +6,7 @@ import type { AuditReport } from "./audit/index.js";
 import type { TestReport } from "./test/index.js";
 import type { InstallReport } from "./install/index.js";
 import type { MarketplaceReport } from "./marketplace/index.js";
+import type { VerifyReport } from "./verify/index.js";
 export declare const TARGETS: readonly ["claude-code", "codex", "cursor", "antigravity", "opencode"];
 export type AgentTarget = (typeof TARGETS)[number];
 export type AgentProfile = "plugin" | "project";
@@ -164,7 +165,7 @@ export interface AgentPlan {
     operations: PlanOperation[];
 }
 export interface AgentResult {
-    command: "convert" | "validate" | "inspect" | "compat" | "doctor" | "specs" | "init" | "add" | "upgrade" | "import" | "package" | "audit" | "test" | "install" | "uninstall" | "installed" | "marketplace";
+    command: "convert" | "validate" | "inspect" | "compat" | "doctor" | "specs" | "init" | "add" | "upgrade" | "import" | "package" | "audit" | "test" | "install" | "uninstall" | "installed" | "marketplace" | "verify";
     ok: boolean;
     source?: string;
     targets: AgentTarget[];
@@ -197,6 +198,8 @@ export interface AgentResult {
     install?: InstallReport;
     /** Collection build result, emitted by `agent marketplace`. */
     marketplace?: MarketplaceReport;
+    /** Drift and pin result, emitted by `agent verify`. */
+    verify?: VerifyReport;
     dryRun?: boolean;
     check?: boolean;
     stale?: boolean;

package/dist/agent/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/agent/types.ts"],"names":[],"mappings":"AASA,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAU,CAAC;AA0M9F,MAAM,UAAU,UAAU,CACxB,IAAY,EACZ,OAAe,EACf,OAAuB,EACvB,QAAkC,EAAE;IAEpC,OAAO;QACL,IAAI;QACJ,QAAQ,EACN,OAAO,KAAK,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,KAAK,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;QAC1F,OAAO;QACP,OAAO;QACP,GAAG,KAAK;KACT,CAAC;AACJ,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/agent/types.ts"],"names":[],"mappings":"AAUA,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAU,CAAC;AA6M9F,MAAM,UAAU,UAAU,CACxB,IAAY,EACZ,OAAe,EACf,OAAuB,EACvB,QAAkC,EAAE;IAEpC,OAAO;QACL,IAAI;QACJ,QAAQ,EACN,OAAO,KAAK,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,KAAK,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;QAC1F,OAAO;QACP,OAAO;QACP,GAAG,KAAK;KACT,CAAC;AACJ,CAAC"}

package/dist/agent/verify/compare.d.ts

@@ -0,0 +1,49 @@
+import type { AgentProfile, AgentTarget, Artifact } from "../types.js";
+export interface TreeDiff {
+    /** Expected artifacts absent from the tree, or present but not a regular file. */
+    missing: string[];
+    /** Expected artifacts whose bytes or permission bits differ. */
+    changed: string[];
+    /** Recorded in a prior install's inventory, but no longer rendered. */
+    orphaned: string[];
+    /** Inside managed territory, accounted for by neither the render nor the inventory. */
+    unmanaged: string[];
+}
+/**
+ * The longest leading run of segments containing no wildcard.
+ *
+ * `.claude/skills/{name}/**` yields `.claude/skills`; `.mcp.json` yields itself,
+ * which is how a wholly-literal pattern is recognized as a leaf file rather
+ * than a directory to walk.
+ */
+export declare function literalPrefix(pattern: string): string;
+/**
+ * The directories a hand-added file could hide in.
+ *
+ * Derived from the target profile's own declared output patterns, so it can
+ * never claim a surface the renderer does not describe. Three filters matter,
+ * and each one is load-bearing:
+ *
+ * - a wholly-literal pattern is a *leaf file* (`AGENTS.md`, `.mcp.json`,
+ *   `.claude/settings.json`). It is compared byte for byte by the expected-set
+ *   pass and never walked.
+ * - an empty prefix would make the destination root itself a walk root, which
+ *   is precisely the repository-enumeration failure this function exists to
+ *   prevent. No shipped profile declares such a pattern; the guard is here so a
+ *   future one cannot introduce the bug silently.
+ * - a prefix the render did not populate is not this bundle's territory. A
+ *   repository keeping its own `assets/` is only walked when the bundle
+ *   actually renders assets there.
+ */
+export declare function walkRootsFor(target: AgentTarget, profile: AgentProfile, expected: readonly string[]): string[];
+export interface TreeDiffOptions {
+    /** `off` skips both extra-file passes; `orphaned` reads only the inventory. */
+    unmanaged: "off" | "orphaned" | "strict";
+    /** Paths recorded by a prior install, destination-relative. */
+    priorInventory?: readonly string[];
+    /** Directory prefixes a `strict` walk may descend into. */
+    walkRoots?: readonly string[];
+}
+export declare function diffTree(destination: string, artifacts: readonly Artifact[], options: TreeDiffOptions): TreeDiff;
+/** True when the tree matches the artifacts exactly. */
+export declare function treeMatches(diff: TreeDiff): boolean;

package/dist/agent/verify/compare.js

@@ -0,0 +1,159 @@
+import fs from "node:fs";
+import path from "node:path";
+import { isInside } from "../../config-schema.js";
+import { profileFor } from "../targets/index.js";
+import { INSTALL_MANIFEST, LEGACY_INSTALL_MANIFEST } from "../install/index.js";
+/**
+ * Compares a tree a host actually reads — `.claude/skills/…` at a repository
+ * root, say — against the artifacts that should produce it.
+ *
+ * This cannot be {@link diffOutput}, which assumes an
+ * `<output>/<target>/<profile>/` conversion root and walks those roots
+ * exhaustively. A merge install has no such prefix, and an unbounded walk from
+ * a repository root would enumerate `node_modules`, `.git`, and every source
+ * file as unmanaged. The containment rule below is what replaces that
+ * assumption.
+ */
+/** A directory holding more files than this is not a generated tree. */
+const MAX_WALK_ENTRIES = 20_000;
+/** Byte comparison, never `localeCompare`: sort order must not depend on the ICU build. */
+function byBytes(a, b) {
+    return a < b ? -1 : a > b ? 1 : 0;
+}
+/**
+ * The longest leading run of segments containing no wildcard.
+ *
+ * `.claude/skills/{name}/**` yields `.claude/skills`; `.mcp.json` yields itself,
+ * which is how a wholly-literal pattern is recognized as a leaf file rather
+ * than a directory to walk.
+ */
+export function literalPrefix(pattern) {
+    const segments = pattern.split("/");
+    const literal = [];
+    for (const segment of segments) {
+        if (segment.includes("*") || segment.includes("{"))
+            break;
+        literal.push(segment);
+    }
+    return literal.join("/");
+}
+/**
+ * The directories a hand-added file could hide in.
+ *
+ * Derived from the target profile's own declared output patterns, so it can
+ * never claim a surface the renderer does not describe. Three filters matter,
+ * and each one is load-bearing:
+ *
+ * - a wholly-literal pattern is a *leaf file* (`AGENTS.md`, `.mcp.json`,
+ *   `.claude/settings.json`). It is compared byte for byte by the expected-set
+ *   pass and never walked.
+ * - an empty prefix would make the destination root itself a walk root, which
+ *   is precisely the repository-enumeration failure this function exists to
+ *   prevent. No shipped profile declares such a pattern; the guard is here so a
+ *   future one cannot introduce the bug silently.
+ * - a prefix the render did not populate is not this bundle's territory. A
+ *   repository keeping its own `assets/` is only walked when the bundle
+ *   actually renders assets there.
+ */
+export function walkRootsFor(target, profile, expected) {
+    const patterns = profileFor(target).outputs[profile] ?? [];
+    const roots = new Set();
+    for (const { pattern } of patterns) {
+        const prefix = literalPrefix(pattern);
+        if (!prefix || prefix === pattern)
+            continue;
+        if (!expected.some((candidate) => candidate.startsWith(`${prefix}/`)))
+            continue;
+        roots.add(prefix);
+    }
+    return [...roots].sort(byBytes);
+}
+function walk(directory, root, onFile) {
+    let seen = 0;
+    for (const dirent of fs.readdirSync(directory, { withFileTypes: true })) {
+        const full = path.join(directory, dirent.name);
+        // Dirent is lstat-based, so a symlinked directory reports false here and is
+        // never descended into.
+        if (dirent.isDirectory()) {
+            seen += walk(full, root, onFile);
+        }
+        else {
+            seen += 1;
+            onFile(path.relative(root, full).split(path.sep).join("/"));
+        }
+        if (seen > MAX_WALK_ENTRIES)
+            throw new Error(`Refusing to walk more than ${MAX_WALK_ENTRIES} files under ${root}`);
+    }
+    return seen;
+}
+/**
+ * The install manifest is never compared by bytes, and never reported missing.
+ *
+ * It embeds the generator version, so byte-comparing it would report every tree
+ * as drifted after any CLI upgrade — the same concession `payloadMatches` and
+ * `diffOutput` both make, for the same reason. It is bookkeeping rather than
+ * agent content, so a repository that ignores it is not drifted; the cost is
+ * orphan detection, reported once as AB426.
+ */
+function existenceOnly(relative) {
+    return relative === INSTALL_MANIFEST || relative === LEGACY_INSTALL_MANIFEST;
+}
+export function diffTree(destination, artifacts, options) {
+    const diff = { missing: [], changed: [], orphaned: [], unmanaged: [] };
+    const expected = new Set(artifacts.map((artifact) => artifact.path));
+    for (const artifact of artifacts) {
+        const file = path.join(destination, artifact.path);
+        let stat;
+        try {
+            stat = fs.statSync(file);
+        }
+        catch {
+            stat = undefined;
+        }
+        if (!stat || !stat.isFile()) {
+            // An absent install manifest is bookkeeping, not drift: a repository may
+            // legitimately commit the generated tree while ignoring the manifest.
+            // Its absence is reported once, as AB426, and costs only orphan
+            // detection.
+            if (!existenceOnly(artifact.path))
+                diff.missing.push(artifact.path);
+            continue;
+        }
+        if (existenceOnly(artifact.path))
+            continue;
+        if (!fs.readFileSync(file).equals(artifact.content) ||
+            (stat.mode & 0o777) !== (artifact.mode & 0o777))
+            diff.changed.push(artifact.path);
+    }
+    if (options.unmanaged !== "off")
+        for (const recorded of options.priorInventory ?? [])
+            if (!expected.has(recorded) && !existenceOnly(recorded))
+                diff.orphaned.push(recorded);
+    if (options.unmanaged === "strict") {
+        const inventory = new Set(options.priorInventory ?? []);
+        for (const root of options.walkRoots ?? []) {
+            const absolute = path.join(destination, root);
+            if (!fs.existsSync(absolute) || !fs.statSync(absolute).isDirectory())
+                continue;
+            // A walk root reached through a symlink could leave the destination
+            // entirely; refuse rather than report someone else's files.
+            if (!isInside(fs.realpathSync(destination), fs.realpathSync(absolute)))
+                continue;
+            walk(absolute, destination, (relative) => {
+                if (expected.has(relative) || inventory.has(relative) || existenceOnly(relative))
+                    return;
+                diff.unmanaged.push(relative);
+            });
+        }
+    }
+    diff.missing.sort(byBytes);
+    diff.changed.sort(byBytes);
+    diff.orphaned.sort(byBytes);
+    diff.unmanaged.sort(byBytes);
+    return diff;
+}
+/** True when the tree matches the artifacts exactly. */
+export function treeMatches(diff) {
+    return (!diff.missing.length && !diff.changed.length && !diff.orphaned.length && !diff.unmanaged.length);
+}
+//# sourceMappingURL=compare.js.map

package/dist/agent/verify/compare.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compare.js","sourceRoot":"","sources":["../../../src/agent/verify/compare.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAEhF;;;;;;;;;;GAUG;AAEH,wEAAwE;AACxE,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAahC,2FAA2F;AAC3F,SAAS,OAAO,CAAC,CAAS,EAAE,CAAS;IACnC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM;QAC1D,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAmB,EACnB,OAAqB,EACrB,QAA2B;IAE3B,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC3D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,OAAO;YAAE,SAAS;QAC5C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;YAAE,SAAS;QAChF,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,IAAI,CAAC,SAAiB,EAAE,IAAY,EAAE,MAAkC;IAC/E,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,MAAM,IAAI,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/C,4EAA4E;QAC5E,wBAAwB;QACxB,IAAI,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;YACzB,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,IAAI,IAAI,CAAC,CAAC;YACV,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,IAAI,GAAG,gBAAgB;YACzB,MAAM,IAAI,KAAK,CAAC,8BAA8B,gBAAgB,gBAAgB,IAAI,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,aAAa,CAAC,QAAgB;IACrC,OAAO,QAAQ,KAAK,gBAAgB,IAAI,QAAQ,KAAK,uBAAuB,CAAC;AAC/E,CAAC;AAWD,MAAM,UAAU,QAAQ,CACtB,WAAmB,EACnB,SAA8B,EAC9B,OAAwB;IAExB,MAAM,IAAI,GAAa,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACjF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAErE,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,IAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YAC5B,yEAAyE;YACzE,sEAAsE;YACtE,gEAAgE;YAChE,aAAa;YACb,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACpE,SAAS;QACX,CAAC;QACD,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QAC3C,IACE,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC/C,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC;YAE/C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,OAAO,CAAC,SAAS,KAAK,KAAK;QAC7B,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,cAAc,IAAI,EAAE;YACjD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;gBAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAE1F,IAAI,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;QACxD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YAC9C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE;gBAAE,SAAS;YAC/E,oEAAoE;YACpE,4DAA4D;YAC5D,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;gBAAE,SAAS;YACjF,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,QAAQ,EAAE,EAAE;gBACvC,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC;oBAAE,OAAO;gBACzF,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAChC,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,WAAW,CAAC,IAAc;IACxC,OAAO,CACL,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAChG,CAAC;AACJ,CAAC"}

package/dist/agent/verify/config.d.ts

@@ -0,0 +1,54 @@
+import type { AgentProfile, AgentTarget } from "../types.js";
+export declare const UNMANAGED_MODES: readonly ["off", "orphaned", "strict"];
+export type UnmanagedMode = (typeof UNMANAGED_MODES)[number];
+export declare const VERIFY_LAYOUTS: readonly ["merge", "plugin-dir", "conversion"];
+export type VerifyLayout = (typeof VERIFY_LAYOUTS)[number];
+export declare const VERIFY_SCOPES: readonly ["user", "project"];
+export type VerifyScope = (typeof VERIFY_SCOPES)[number];
+/**
+ * An inclusive bound, never a range grammar.
+ *
+ * {@link compareSemver} is deliberately an ordering rather than a range parser,
+ * and the target profiles record single bounds for the same reason. Accepting
+ * `">=2.1 <3"` here would promise a grammar nothing else in the project has.
+ */
+export interface VersionBound {
+    exact?: string;
+    min?: string;
+    max?: string;
+}
+export interface VerifyPins {
+    cli?: VersionBound;
+    profileSchemaVersion?: string;
+    targets: Partial<Record<AgentTarget, VersionBound>>;
+}
+export interface VerifyEntry {
+    /** Stable identifier for the entry, reported in findings and the payload. */
+    name: string;
+    /** Absolute bundle root: the directory holding `agent-bundle.yaml`. */
+    bundle: string;
+    target: AgentTarget;
+    profile: AgentProfile;
+    /** Absolute root the rendered tree was placed at. */
+    destination: string;
+    scope: VerifyScope;
+    layout: VerifyLayout;
+    unmanaged: UnmanagedMode;
+}
+export interface VerifyConfig {
+    /** Absolute path of the document this block came from. */
+    file: string;
+    /** Directory holding the document; every relative path resolves against it. */
+    directory: string;
+    pins: VerifyPins;
+    entries: VerifyEntry[];
+}
+export declare function emptyVerifyConfig(file: string, directory: string): VerifyConfig;
+/**
+ * Parses an `agent:` block. Returns an empty configuration when the key is
+ * absent, so a document that declares nothing is valid rather than an error.
+ */
+export declare function parseVerifyBlock(value: unknown, context: {
+    file: string;
+    directory: string;
+}): VerifyConfig;

package/dist/agent/verify/config.js

@@ -0,0 +1,196 @@
+import path from "node:path";
+import { isInside, knownKeys, object, optionalString } from "../../config-schema.js";
+import { parseSemver } from "../targets/schema.js";
+import { TARGETS } from "../types.js";
+/** Local, because `src/agent/types.ts` declares the profile as a union, not a list. */
+const PROFILES = ["plugin", "project"];
+/**
+ * The `agent.verify` block: what a repository claims its committed agent trees
+ * were generated from, and which toolchain is allowed to have generated them.
+ *
+ * Parsed here rather than in `src/config.ts` for the reason `scripts:` is:
+ * `agent` commands run with configuration discovery disabled, so they resolve
+ * this block through their own walk. The loader still calls
+ * {@link parseVerifyBlock} for its throw, so a typo is an error at `md lint`
+ * rather than a surprise in CI.
+ */
+const ROOT_KEYS = new Set(["verify"]);
+const VERIFY_KEYS = new Set(["pins", "defaults", "entries"]);
+const PIN_KEYS = new Set(["cli", "profileSchemaVersion", "targets"]);
+const BOUND_KEYS = new Set(["exact", "min", "max"]);
+const DEFAULT_KEYS = new Set(["unmanaged", "scope", "profile", "layout"]);
+const ENTRY_KEYS = new Set([
+    "name",
+    "bundle",
+    "target",
+    "profile",
+    "destination",
+    "scope",
+    "layout",
+    "unmanaged",
+]);
+export const UNMANAGED_MODES = ["off", "orphaned", "strict"];
+export const VERIFY_LAYOUTS = ["merge", "plugin-dir", "conversion"];
+export const VERIFY_SCOPES = ["user", "project"];
+export function emptyVerifyConfig(file, directory) {
+    return { file, directory, pins: { targets: {} }, entries: [] };
+}
+function version(value, name) {
+    const text = optionalString(value, name);
+    if (text === undefined)
+        throw new Error(`${name} is required`);
+    if (!parseSemver(text))
+        throw new Error(`${name} must be a version: ${text}`);
+    return text;
+}
+/**
+ * A documentation revision is an ISO date, compared lexicographically — the
+ * same comparison `agent doctor` already makes against
+ * `host.documentationRevision`.
+ */
+function revision(value, name) {
+    const text = optionalString(value, name);
+    if (text === undefined)
+        throw new Error(`${name} is required`);
+    if (!/^\d{4}-\d{2}-\d{2}$/.test(text))
+        throw new Error(`${name} must be an ISO date (YYYY-MM-DD): ${text}`);
+    return text;
+}
+function bound(value, name, parse) {
+    const block = object(value, name);
+    knownKeys(block, BOUND_KEYS, name);
+    if (!Object.keys(block).length)
+        throw new Error(`${name} must declare exact, min, or max`);
+    if (block.exact !== undefined && (block.min !== undefined || block.max !== undefined))
+        throw new Error(`${name}.exact cannot be combined with min or max`);
+    const parsed = {};
+    if (block.exact !== undefined)
+        parsed.exact = parse(block.exact, `${name}.exact`);
+    if (block.min !== undefined)
+        parsed.min = parse(block.min, `${name}.min`);
+    if (block.max !== undefined)
+        parsed.max = parse(block.max, `${name}.max`);
+    return parsed;
+}
+function enumerated(value, name, allowed, fallback) {
+    const text = optionalString(value, name);
+    if (text === undefined)
+        return fallback;
+    if (!allowed.includes(text))
+        throw new Error(`${name} must be one of ${allowed.join(", ")}: ${text}`);
+    return text;
+}
+function pins(value) {
+    const block = object(value, "agent.verify.pins");
+    knownKeys(block, PIN_KEYS, "agent.verify.pins");
+    const targets = {};
+    const declared = object(block.targets, "agent.verify.pins.targets");
+    for (const [key, entry] of Object.entries(declared)) {
+        if (!TARGETS.includes(key))
+            throw new Error(`Unknown target in agent.verify.pins.targets: ${key}`);
+        targets[key] = bound(entry, `agent.verify.pins.targets.${key}`, revision);
+    }
+    return {
+        ...(block.cli !== undefined ? { cli: bound(block.cli, "agent.verify.pins.cli", version) } : {}),
+        ...(block.profileSchemaVersion !== undefined
+            ? {
+                profileSchemaVersion: (() => {
+                    const text = optionalString(block.profileSchemaVersion, "agent.verify.pins.profileSchemaVersion");
+                    if (!text)
+                        throw new Error("agent.verify.pins.profileSchemaVersion must be a string");
+                    return text;
+                })(),
+            }
+            : {}),
+        targets,
+    };
+}
+/**
+ * Resolves a declared path against the document's directory and refuses one
+ * that escapes it. A verify document describes its own repository; reaching
+ * outside would let a checked-in file name an arbitrary destination.
+ */
+function contained(raw, directory, name) {
+    const resolved = path.resolve(directory, raw);
+    if (!isInside(directory, resolved))
+        throw new Error(`${name} escapes the configuration directory: ${raw}`);
+    return resolved;
+}
+function entry(value, index, directory, defaults) {
+    const name = `agent.verify.entries[${index}]`;
+    const block = object(value, name);
+    knownKeys(block, ENTRY_KEYS, name);
+    const bundleRaw = optionalString(block.bundle, `${name}.bundle`);
+    if (!bundleRaw)
+        throw new Error(`${name}.bundle is required`);
+    const targetRaw = optionalString(block.target, `${name}.target`);
+    if (!targetRaw)
+        throw new Error(`${name}.target is required`);
+    if (!TARGETS.includes(targetRaw))
+        throw new Error(`Unknown target in ${name}.target: ${targetRaw}`);
+    const target = targetRaw;
+    const profileRaw = optionalString(block.profile, `${name}.profile`) ?? defaults.profile;
+    if (!profileRaw)
+        throw new Error(`${name}.profile is required`);
+    if (!PROFILES.includes(profileRaw))
+        throw new Error(`Unknown profile in ${name}.profile: ${profileRaw}`);
+    const profile = profileRaw;
+    const destinationRaw = optionalString(block.destination, `${name}.destination`) ?? ".";
+    const bundle = contained(bundleRaw, directory, `${name}.bundle`);
+    const destination = contained(destinationRaw, directory, `${name}.destination`);
+    return {
+        name: optionalString(block.name, `${name}.name`) ?? `${bundleRaw}/${target}/${profile}`,
+        bundle,
+        target,
+        profile,
+        destination,
+        scope: enumerated(block.scope, `${name}.scope`, VERIFY_SCOPES, defaults.scope),
+        layout: enumerated(block.layout, `${name}.layout`, VERIFY_LAYOUTS, defaults.layout ?? "merge"),
+        unmanaged: enumerated(block.unmanaged, `${name}.unmanaged`, UNMANAGED_MODES, defaults.unmanaged),
+    };
+}
+/**
+ * Parses an `agent:` block. Returns an empty configuration when the key is
+ * absent, so a document that declares nothing is valid rather than an error.
+ */
+export function parseVerifyBlock(value, context) {
+    if (value === undefined)
+        return emptyVerifyConfig(context.file, context.directory);
+    const root = object(value, "agent");
+    knownKeys(root, ROOT_KEYS, "agent");
+    if (root.verify === undefined)
+        return emptyVerifyConfig(context.file, context.directory);
+    const block = object(root.verify, "agent.verify");
+    knownKeys(block, VERIFY_KEYS, "agent.verify");
+    const defaultBlock = object(block.defaults, "agent.verify.defaults");
+    knownKeys(defaultBlock, DEFAULT_KEYS, "agent.verify.defaults");
+    const defaults = {
+        scope: enumerated(defaultBlock.scope, "agent.verify.defaults.scope", VERIFY_SCOPES, "project"),
+        unmanaged: enumerated(defaultBlock.unmanaged, "agent.verify.defaults.unmanaged", UNMANAGED_MODES, "orphaned"),
+        ...(defaultBlock.profile !== undefined
+            ? {
+                profile: enumerated(defaultBlock.profile, "agent.verify.defaults.profile", PROFILES, "project"),
+            }
+            : {}),
+        ...(defaultBlock.layout !== undefined
+            ? {
+                layout: enumerated(defaultBlock.layout, "agent.verify.defaults.layout", VERIFY_LAYOUTS, "merge"),
+            }
+            : {}),
+    };
+    const declared = block.entries;
+    if (declared !== undefined && !Array.isArray(declared))
+        throw new Error("agent.verify.entries must be a list");
+    const list = (declared ?? []);
+    if (!list.length)
+        throw new Error("agent.verify.entries must declare at least one entry");
+    const entries = list.map((item, index) => entry(item, index, context.directory, defaults));
+    const seen = new Set();
+    for (const item of entries) {
+        if (seen.has(item.name))
+            throw new Error(`Duplicate agent.verify entry name: ${item.name}`);
+        seen.add(item.name);
+    }
+    return { file: context.file, directory: context.directory, pins: pins(block.pins), entries };
+}
+//# sourceMappingURL=config.js.map

package/dist/agent/verify/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/agent/verify/config.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACrF,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAGtC,uFAAuF;AACvF,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAU,CAAC;AAEhD;;;;;;;;;GASG;AAEH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;AAC7D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,sBAAsB,EAAE,SAAS,CAAC,CAAC,CAAC;AACrE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AACpD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC1E,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,aAAa;IACb,OAAO;IACP,QAAQ;IACR,WAAW;CACZ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAU,CAAC;AAGtE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,YAAY,EAAE,YAAY,CAAU,CAAC;AAG7E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,SAAS,CAAU,CAAC;AA6C1D,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,SAAiB;IAC/D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,OAAO,CAAC,KAAc,EAAE,IAAY;IAC3C,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACzC,IAAI,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,cAAc,CAAC,CAAC;IAC/D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uBAAuB,IAAI,EAAE,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,KAAc,EAAE,IAAY;IAC5C,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACzC,IAAI,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,cAAc,CAAC,CAAC;IAC/D,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,sCAAsC,IAAI,EAAE,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,KAAK,CAAC,KAAc,EAAE,IAAY,EAAE,KAA4C;IACvF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAClC,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,kCAAkC,CAAC,CAAC;IAC3F,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,2CAA2C,CAAC,CAAC;IACtE,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,IAAI,QAAQ,CAAC,CAAC;IAClF,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;QAAE,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;IAC1E,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;QAAE,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;IAC1E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CACjB,KAAc,EACd,IAAY,EACZ,OAAqB,EACrB,QAAW;IAEX,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACzC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACxC,IAAI,CAAE,OAA6B,CAAC,QAAQ,CAAC,IAAI,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,mBAAmB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC3E,OAAO,IAAS,CAAC;AACnB,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;IACjD,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAChD,MAAM,OAAO,GAA+C,EAAE,CAAC;IAC/D,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC;IACpE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,IAAI,CAAE,OAA6B,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,gDAAgD,GAAG,EAAE,CAAC,CAAC;QACzE,OAAO,CAAC,GAAkB,CAAC,GAAG,KAAK,CAAC,KAAK,EAAE,6BAA6B,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO;QACL,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,uBAAuB,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,GAAG,CAAC,KAAK,CAAC,oBAAoB,KAAK,SAAS;YAC1C,CAAC,CAAC;gBACE,oBAAoB,EAAE,CAAC,GAAG,EAAE;oBAC1B,MAAM,IAAI,GAAG,cAAc,CACzB,KAAK,CAAC,oBAAoB,EAC1B,wCAAwC,CACzC,CAAC;oBACF,IAAI,CAAC,IAAI;wBAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;oBACtF,OAAO,IAAI,CAAC;gBACd,CAAC,CAAC,EAAE;aACL;YACH,CAAC,CAAC,EAAE,CAAC;QACP,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,GAAW,EAAE,SAAiB,EAAE,IAAY;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,yCAAyC,GAAG,EAAE,CAAC,CAAC;IACzE,OAAO,QAAQ,CAAC;AAClB,CAAC;AASD,SAAS,KAAK,CAAC,KAAc,EAAE,KAAa,EAAE,SAAiB,EAAE,QAAuB;IACtF,MAAM,IAAI,GAAG,wBAAwB,KAAK,GAAG,CAAC;IAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAClC,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;IAEnC,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,IAAI,SAAS,CAAC,CAAC;IACjE,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,qBAAqB,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,IAAI,SAAS,CAAC,CAAC;IACjE,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,qBAAqB,CAAC,CAAC;IAC9D,IAAI,CAAE,OAA6B,CAAC,QAAQ,CAAC,SAAS,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,YAAY,SAAS,EAAE,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,SAAwB,CAAC;IAExC,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,IAAI,UAAU,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC;IACxF,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,sBAAsB,CAAC,CAAC;IAChE,IAAI,CAAE,QAA8B,CAAC,QAAQ,CAAC,UAAU,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,aAAa,UAAU,EAAE,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,UAA0B,CAAC;IAE3C,MAAM,cAAc,GAAG,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,IAAI,cAAc,CAAC,IAAI,GAAG,CAAC;IACvF,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,IAAI,SAAS,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE,GAAG,IAAI,cAAc,CAAC,CAAC;IAEhF,OAAO;QACL,IAAI,EAAE,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,IAAI,OAAO,CAAC,IAAI,GAAG,SAAS,IAAI,MAAM,IAAI,OAAO,EAAE;QACvF,MAAM;QACN,MAAM;QACN,OAAO;QACP,WAAW;QACX,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,IAAI,QAAQ,EAAE,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC;QAC9E,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,IAAI,SAAS,EAAE,cAAc,EAAE,QAAQ,CAAC,MAAM,IAAI,OAAO,CAAC;QAC9F,SAAS,EAAE,UAAU,CACnB,KAAK,CAAC,SAAS,EACf,GAAG,IAAI,YAAY,EACnB,eAAe,EACf,QAAQ,CAAC,SAAS,CACnB;KACoB,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAc,EACd,OAA4C;IAE5C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,iBAAiB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACpC,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,iBAAiB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAEzF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAClD,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;IAE9C,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC;IACrE,SAAS,CAAC,YAAY,EAAE,YAAY,EAAE,uBAAuB,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAkB;QAC9B,KAAK,EAAE,UAAU,CAAC,YAAY,CAAC,KAAK,EAAE,6BAA6B,EAAE,aAAa,EAAE,SAAS,CAAC;QAC9F,SAAS,EAAE,UAAU,CACnB,YAAY,CAAC,SAAS,EACtB,iCAAiC,EACjC,eAAe,EACf,UAAU,CACX;QACD,GAAG,CAAC,YAAY,CAAC,OAAO,KAAK,SAAS;YACpC,CAAC,CAAC;gBACE,OAAO,EAAE,UAAU,CACjB,YAAY,CAAC,OAAO,EACpB,+BAA+B,EAC/B,QAAQ,EACR,SAAS,CACV;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,YAAY,CAAC,MAAM,KAAK,SAAS;YACnC,CAAC,CAAC;gBACE,MAAM,EAAE,UAAU,CAChB,YAAY,CAAC,MAAM,EACnB,8BAA8B,EAC9B,cAAc,EACd,OAAO,CACR;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC;IAC/B,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAc,CAAC;IAC3C,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAE1F,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC3F,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5F,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;AAC/F,CAAC"}

package/dist/agent/verify/index.d.ts

@@ -0,0 +1,87 @@
+import type { AgentDiagnostic, AgentProfile, AgentTarget } from "../types.js";
+import type { VerifyConfig, VersionBound } from "./config.js";
+import { treeMatches } from "./compare.js";
+/**
+ * Checks that the agent-facing files committed in a repository are still what
+ * the bundles they came from render, and that the toolchain doing the checking
+ * is the one the repository pinned.
+ *
+ * Pins are asserted against the *running* CLI rather than against provenance
+ * recorded in the tree. Together with byte equality that proves the tree was
+ * produced by a conforming cairn, without requiring a provenance document to
+ * exist — which matters, because an install manifest records a generator
+ * version but neither a profile schema version nor a documentation revision.
+ * Provenance found at a destination is corroboration only, and never decides
+ * the verdict.
+ */
+export type PinStatus = "satisfied" | "violated" | "unpinned";
+export interface PinReport<T> {
+    declared: T | null;
+    actual: string;
+    status: PinStatus;
+}
+export interface VerifyPinsReport {
+    cli: PinReport<VersionBound>;
+    profileSchemaVersion: PinReport<string>;
+    targets: Array<{
+        target: AgentTarget;
+    } & PinReport<VersionBound>>;
+}
+export interface VerifyProvenance {
+    source: string;
+    generator: {
+        name: string;
+        version: string;
+    } | null;
+    profileSchemaVersion: string | null;
+    status: "matching" | "older" | "newer" | "malformed";
+}
+export interface VerifyEntryReport {
+    name: string;
+    bundle: string;
+    target: AgentTarget;
+    profile: AgentProfile;
+    scope: string;
+    layout: string;
+    destination: string;
+    mode: string;
+    expected: number;
+    missing: string[];
+    changed: string[];
+    orphaned: string[];
+    unmanaged: string[];
+    provenance?: VerifyProvenance;
+    ok: boolean;
+}
+export interface VerifyReport {
+    config: {
+        path: string;
+        entries: number;
+    };
+    generator: {
+        name: string;
+        version: string;
+    };
+    profileSchemaVersion: string;
+    pins: VerifyPinsReport;
+    entries: VerifyEntryReport[];
+    counts: {
+        entries: number;
+        ok: number;
+        missing: number;
+        changed: number;
+        orphaned: number;
+        unmanaged: number;
+    };
+}
+export declare function evaluatePins(config: VerifyConfig, targets: readonly AgentTarget[]): {
+    report: VerifyPinsReport;
+    diagnostics: AgentDiagnostic[];
+};
+export declare function runVerify(config: VerifyConfig): {
+    report: VerifyReport;
+    diagnostics: AgentDiagnostic[];
+    targets: AgentTarget[];
+    profiles: AgentProfile[];
+};
+export { treeMatches };