@codyswann/lisa 2.280.0 → 2.282.0

package/dist/standards/registry.js

@@ -0,0 +1,330 @@
+/** Closed standards-check registry shared by every supported harness. */
+import { createHash } from "node:crypto";
+import { realpath } from "node:fs/promises";
+import { projectPathKind, readProjectText } from "../health/read-only-fs.js";
+import { isJsonObject } from "../sync/json-path.js";
+import { inferTestEvidenceFormat, } from "./test-evidence.js";
+const STATIC_ANALYSIS = "static-analysis";
+const TYPESCRIPT_SCRIPT_CHECKS = [
+    {
+        id: "typescript.lint",
+        script: "lint",
+        category: "lint",
+        timeoutMs: 180_000,
+    },
+    {
+        id: "typescript.lint-slow",
+        script: "lint:slow",
+        category: "lint",
+        timeoutMs: 180_000,
+    },
+    {
+        id: "typescript.typecheck",
+        script: "typecheck",
+        category: STATIC_ANALYSIS,
+        timeoutMs: 180_000,
+    },
+    {
+        id: "typescript.build",
+        script: "build",
+        category: "guardrail",
+        timeoutMs: 600_000,
+    },
+    {
+        id: "typescript.test",
+        script: "test",
+        category: "test",
+        timeoutMs: 600_000,
+        requiresTestEvidence: true,
+    },
+    {
+        id: "typescript.test-unit",
+        script: "test:unit",
+        category: "test",
+        timeoutMs: 600_000,
+        requiresTestEvidence: true,
+    },
+    {
+        id: "typescript.test-coverage",
+        script: "test:cov",
+        category: "threshold",
+        timeoutMs: 900_000,
+        requiresTestEvidence: true,
+    },
+    {
+        id: "typescript.test-integration",
+        script: "test:integration",
+        category: "test",
+        timeoutMs: 600_000,
+        requiresTestEvidence: true,
+    },
+    {
+        id: "typescript.test-e2e",
+        script: "test:e2e",
+        category: "test",
+        timeoutMs: 900_000,
+        requiresTestEvidence: true,
+        optional: true,
+    },
+    {
+        id: "typescript.test-contract",
+        script: "test:contract",
+        category: "test",
+        timeoutMs: 600_000,
+        requiresTestEvidence: true,
+        optional: true,
+    },
+    {
+        id: "typescript.format",
+        script: "format:check",
+        category: "guardrail",
+        timeoutMs: 180_000,
+    },
+    {
+        id: "typescript.dead-code",
+        script: "knip:check",
+        category: STATIC_ANALYSIS,
+        timeoutMs: 300_000,
+    },
+    {
+        id: "typescript.ast-grep",
+        script: "sg:scan",
+        category: "guardrail",
+        timeoutMs: 180_000,
+    },
+    {
+        id: "typescript.mutation",
+        script: "test:mutation",
+        category: "guardrail",
+        timeoutMs: 1_800_000,
+        mutation: true,
+    },
+];
+const RAILS_CHECKS = [
+    direct("rails.rubocop", "lint", 300_000, "bundle", "exec", "rubocop"),
+    directTest("rails.rspec", 900_000, "rspec", "bundle", "exec", "rspec"),
+    direct("rails.reek", STATIC_ANALYSIS, 300_000, "bundle", "exec", "reek", "app/", "lib/"),
+    direct("rails.flog", STATIC_ANALYSIS, 300_000, "bundle", "exec", "flog", "--all", "--group", "app/", "lib/"),
+    direct("rails.flay", STATIC_ANALYSIS, 300_000, "bundle", "exec", "flay", "app/", "lib/"),
+    direct("rails.brakeman", "guardrail", 300_000, "bundle", "exec", "brakeman", "--no-pager", "--quiet"),
+    direct("rails.bundler-audit", "guardrail", 300_000, "bundle", "exec", "bundler-audit", "check", "--update"),
+    direct("rails.ast-grep", "guardrail", 180_000, "sg", "scan"),
+];
+/**
+ * Resolve the exact ordered union of checks for current detected stacks.
+ * Missing managed scripts and threshold tooling fail before any command runs.
+ * @param projectRoot - Canonical project root
+ * @param projectTypes - Expanded, canonical detected types
+ * @param config - Current bounded merged Lisa config
+ * @returns Closed current check plan
+ */
+// eslint-disable-next-line sonarjs/cognitive-complexity -- explicit stack gates preserve fail-closed requirements and command order
+export async function resolveStandardsCheckPlan(// eslint-disable-line max-lines-per-function -- the closed multi-stack registry is one auditable ordered plan
+projectRoot, projectTypes, config) {
+    const root = await realpath(projectRoot);
+    if (projectTypes.length === 0) {
+        throw new Error("No supported Lisa project type was detected.");
+    }
+    const checks = [];
+    if (projectTypes.includes("typescript")) {
+        const manifest = await readPackageManifest(root);
+        const scripts = isJsonObject(manifest.scripts) ? manifest.scripts : {};
+        const packageManager = await resolvePackageManager(root);
+        for (const check of TYPESCRIPT_SCRIPT_CHECKS) {
+            if (check.mutation === true && !mutationGateEnabled(config))
+                continue;
+            const script = scripts[check.script];
+            if (typeof script !== "string" || script.trim().length === 0) {
+                if (check.optional === true)
+                    continue;
+                throw new Error(`Required package script is missing: ${check.script}.`);
+            }
+            // eslint-disable-next-line functional/immutable-data -- the private ordered plan is frozen before it leaves this resolver
+            checks.push(Object.freeze({
+                id: check.id,
+                category: check.category,
+                argv: Object.freeze([
+                    packageManager,
+                    "run",
+                    check.script,
+                ]),
+                timeoutMs: check.timeoutMs,
+                ...(check.requiresTestEvidence === true
+                    ? { testEvidence: inferTestEvidenceFormat(script) }
+                    : {}),
+            }));
+        }
+    }
+    if (projectTypes.includes("rails")) {
+        // eslint-disable-next-line functional/immutable-data -- the private ordered plan is frozen before it leaves this resolver
+        checks.push(...RAILS_CHECKS);
+        if (mutationGateEnabled(config)) {
+            if ((await projectPathKind(root, "scripts/lisa-mutation.sh")) !== "file") {
+                throw new Error("Required Rails mutation command is missing: scripts/lisa-mutation.sh.");
+            }
+            // eslint-disable-next-line functional/immutable-data -- the private ordered plan is frozen before it leaves this resolver
+            checks.push(direct("rails.mutation", "guardrail", 1_800_000, "bash", "scripts/lisa-mutation.sh"));
+        }
+    }
+    if (projectTypes.includes("phaser")) {
+        if ((await projectPathKind(root, "scripts/check-verification-coverage.mjs")) !== "file") {
+            throw new Error("Required verification-coverage command is missing: scripts/check-verification-coverage.mjs.");
+        }
+        // eslint-disable-next-line functional/immutable-data -- the private ordered plan is frozen before it leaves this resolver
+        checks.push(Object.freeze({
+            ...direct("phaser.verification-coverage", "guardrail", 180_000, "node", "scripts/check-verification-coverage.mjs"),
+            environment: Object.freeze({
+                VERIFY_BASE_SHA: "HEAD^",
+                VERIFY_HEAD_SHA: "HEAD",
+            }),
+        }));
+    }
+    if ((await projectPathKind(root, "scripts/check-threshold-ratchet.mjs")) !==
+        "file") {
+        throw new Error("Required threshold command is missing: scripts/check-threshold-ratchet.mjs.");
+    }
+    // eslint-disable-next-line functional/immutable-data -- the private ordered plan is frozen before it leaves this resolver
+    checks.push(direct("shared.threshold-ratchet", "threshold", 180_000, "node", "scripts/check-threshold-ratchet.mjs", "--base", "HEAD^"));
+    if (new Set(checks.map(check => check.id)).size !== checks.length) {
+        throw new Error("Standards registry produced duplicate check identifiers.");
+    }
+    return freezePlan(checks, config);
+}
+/**
+ * Freeze the resolved checks and bind their registry and configuration digests.
+ * @param checks - Private ordered check accumulator
+ * @param config - Current bounded merged Lisa config
+ * @returns Frozen current check plan
+ */
+function freezePlan(checks, config) {
+    const frozen = Object.freeze(checks.map(check => Object.freeze(check)));
+    // eslint-disable-next-line max-lines -- this single closed registry keeps every supported stack command reviewable together
+    return Object.freeze({
+        checks: frozen,
+        registryDigest: digest({ version: 1, checks: frozen }),
+        configDigest: digestStandardsConfig(config),
+    });
+}
+/**
+ * Digest only configuration that changes standards applicability or policy.
+ * @param config - Current merged Lisa config
+ * @returns Canonical standards configuration digest
+ */
+export function digestStandardsConfig(config) {
+    return digest({
+        quality: config.quality ?? null,
+        thresholdRatchet: config.thresholdRatchet ?? null,
+    });
+}
+/**
+ * Return a canonical SHA-256 digest without retaining config values.
+ * @param value - JSON-like value to digest
+ * @returns Canonical SHA-256 digest
+ */
+export function digestStandardsValue(value) {
+    return digest(value);
+}
+/**
+ * Construct one fixed direct-command check.
+ * @param id - Stable check identifier
+ * @param category - Standards category
+ * @param timeoutMs - Command deadline in milliseconds
+ * @param command - Fixed no-shell argv
+ * @returns Frozen standards check
+ */
+function direct(id, category, timeoutMs, ...command) {
+    return Object.freeze({
+        id,
+        category,
+        argv: Object.freeze(command),
+        timeoutMs,
+    });
+}
+/**
+ * Construct one direct test check with positive runner-evidence semantics.
+ * @param id - Stable check identifier
+ * @param timeoutMs - Command deadline in milliseconds
+ * @param testEvidence - Positive test-evidence parser
+ * @param command - Fixed no-shell argv
+ * @returns Frozen standards test check
+ */
+function directTest(id, timeoutMs, testEvidence, ...command) {
+    return Object.freeze({
+        ...direct(id, "test", timeoutMs, ...command),
+        testEvidence,
+    });
+}
+/**
+ * Read a bounded package manifest and require its object shape.
+ * @param projectRoot - Canonical project repository
+ * @returns Parsed package manifest
+ */
+async function readPackageManifest(projectRoot) {
+    const payload = await readProjectText(projectRoot, "package.json");
+    if (payload === undefined) {
+        throw new Error("Required package manifest is missing: package.json.");
+    }
+    const parsed = JSON.parse(payload);
+    if (!isJsonObject(parsed)) {
+        throw new Error("package.json must contain a JSON object.");
+    }
+    return parsed;
+}
+/**
+ * Resolve one managed package runner in stable precedence order.
+ * @param projectRoot - Canonical project repository
+ * @returns Package runner selected by lockfile
+ */
+async function resolvePackageManager(projectRoot) {
+    const candidates = [
+        ["bun.lock", "bun"],
+        ["bun.lockb", "bun"],
+        ["pnpm-lock.yaml", "pnpm"],
+        ["yarn.lock", "yarn"],
+        ["package-lock.json", "npm"],
+    ];
+    for (const [lockfile, manager] of candidates) {
+        if ((await projectPathKind(projectRoot, lockfile)) === "file")
+            return manager;
+    }
+    return "npm";
+}
+/**
+ * Read the shared mutation-gate switch without treating absence as enabled.
+ * @param config - Current merged Lisa config
+ * @returns Whether mutation proof is required
+ */
+function mutationGateEnabled(config) {
+    return (isJsonObject(config.quality) &&
+        isJsonObject(config.quality.mutation) &&
+        isJsonObject(config.quality.mutation.gate) &&
+        config.quality.mutation.gate.enabled === true);
+}
+/**
+ * Stable recursive JSON serialization for registry/config digests.
+ * @param value - JSON-like value to digest
+ * @returns Canonical SHA-256 digest
+ */
+function digest(value) {
+    return `sha256:${createHash("sha256")
+        .update(canonicalJson(value))
+        .digest("hex")}`;
+}
+/**
+ * Serialize JSON-like input with recursively sorted object keys.
+ * @param value - JSON-like value to serialize
+ * @returns Canonical JSON text
+ */
+function canonicalJson(value) {
+    if (Array.isArray(value)) {
+        return `[${value.map(item => canonicalJson(item)).join(",")}]`;
+    }
+    if (isJsonObject(value)) {
+        return `{${Object.keys(value)
+            .sort((left, right) => left.localeCompare(right))
+            .map(key => `${JSON.stringify(key)}:${canonicalJson(value[key])}`)
+            .join(",")}}`;
+    }
+    return JSON.stringify(value) ?? "null";
+}
+//# sourceMappingURL=registry.js.map

package/dist/standards/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/standards/registry.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAmB,MAAM,sBAAsB,CAAC;AAErE,OAAO,EACL,uBAAuB,GAExB,MAAM,oBAAoB,CAAC;AA8B5B,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAE1C,MAAM,wBAAwB,GAA2B;IACvD;QACE,EAAE,EAAE,iBAAiB;QACrB,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,OAAO;KACnB;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,OAAO;KACnB;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,eAAe;QACzB,SAAS,EAAE,OAAO;KACnB;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE,OAAO;KACnB;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,OAAO;QAClB,oBAAoB,EAAE,IAAI;KAC3B;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,OAAO;QAClB,oBAAoB,EAAE,IAAI;KAC3B;IACD;QACE,EAAE,EAAE,0BAA0B;QAC9B,MAAM,EAAE,UAAU;QAClB,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE,OAAO;QAClB,oBAAoB,EAAE,IAAI;KAC3B;IACD;QACE,EAAE,EAAE,6BAA6B;QACjC,MAAM,EAAE,kBAAkB;QAC1B,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,OAAO;QAClB,oBAAoB,EAAE,IAAI;KAC3B;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,MAAM,EAAE,UAAU;QAClB,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,OAAO;QAClB,oBAAoB,EAAE,IAAI;QAC1B,QAAQ,EAAE,IAAI;KACf;IACD;QACE,EAAE,EAAE,0BAA0B;QAC9B,MAAM,EAAE,eAAe;QACvB,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,OAAO;QAClB,oBAAoB,EAAE,IAAI;QAC1B,QAAQ,EAAE,IAAI;KACf;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,MAAM,EAAE,cAAc;QACtB,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE,OAAO;KACnB;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,MAAM,EAAE,YAAY;QACpB,QAAQ,EAAE,eAAe;QACzB,SAAS,EAAE,OAAO;KACnB;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE,OAAO;KACnB;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,MAAM,EAAE,eAAe;QACvB,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE,SAAS;QACpB,QAAQ,EAAE,IAAI;KACf;CACO,CAAC;AAEX,MAAM,YAAY,GAAkC;IAClD,MAAM,CAAC,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC;IACrE,UAAU,CAAC,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC;IACtE,MAAM,CACJ,YAAY,EACZ,eAAe,EACf,OAAO,EACP,QAAQ,EACR,MAAM,EACN,MAAM,EACN,MAAM,EACN,MAAM,CACP;IACD,MAAM,CACJ,YAAY,EACZ,eAAe,EACf,OAAO,EACP,QAAQ,EACR,MAAM,EACN,MAAM,EACN,OAAO,EACP,SAAS,EACT,MAAM,EACN,MAAM,CACP;IACD,MAAM,CACJ,YAAY,EACZ,eAAe,EACf,OAAO,EACP,QAAQ,EACR,MAAM,EACN,MAAM,EACN,MAAM,EACN,MAAM,CACP;IACD,MAAM,CACJ,gBAAgB,EAChB,WAAW,EACX,OAAO,EACP,QAAQ,EACR,MAAM,EACN,UAAU,EACV,YAAY,EACZ,SAAS,CACV;IACD,MAAM,CACJ,qBAAqB,EACrB,WAAW,EACX,OAAO,EACP,QAAQ,EACR,MAAM,EACN,eAAe,EACf,OAAO,EACP,UAAU,CACX;IACD,MAAM,CAAC,gBAAgB,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC;CACpD,CAAC;AAEX;;;;;;;GAOG;AACH,oIAAoI;AACpI,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAE,8GAA8G;AAC7J,WAAmB,EACnB,YAAoC,EACpC,MAAkB;IAElB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC;IACzC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,IAAI,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC;QACzD,KAAK,MAAM,KAAK,IAAI,wBAAwB,EAAE,CAAC;YAC7C,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC;gBAAE,SAAS;YACtE,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACrC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7D,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI;oBAAE,SAAS;gBACtC,MAAM,IAAI,KAAK,CAAC,uCAAuC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YAC1E,CAAC;YACD,0HAA0H;YAC1H,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,MAAM,CAAC;gBACZ,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;oBAClB,cAAc;oBACd,KAAK;oBACL,KAAK,CAAC,MAAM;iBACb,CAAmC;gBACpC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,GAAG,CAAC,KAAK,CAAC,oBAAoB,KAAK,IAAI;oBACrC,CAAC,CAAC,EAAE,YAAY,EAAE,uBAAuB,CAAC,MAAM,CAAC,EAAE;oBACnD,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,0HAA0H;QAC1H,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;QAC7B,IAAI,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,IACE,CAAC,MAAM,eAAe,CAAC,IAAI,EAAE,0BAA0B,CAAC,CAAC,KAAK,MAAM,EACpE,CAAC;gBACD,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;YACJ,CAAC;YACD,0HAA0H;YAC1H,MAAM,CAAC,IAAI,CACT,MAAM,CACJ,gBAAgB,EAChB,WAAW,EACX,SAAS,EACT,MAAM,EACN,0BAA0B,CAC3B,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,IACE,CAAC,MAAM,eAAe,CACpB,IAAI,EACJ,yCAAyC,CAC1C,CAAC,KAAK,MAAM,EACb,CAAC;YACD,MAAM,IAAI,KAAK,CACb,6FAA6F,CAC9F,CAAC;QACJ,CAAC;QACD,0HAA0H;QAC1H,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,MAAM,CAAC;YACZ,GAAG,MAAM,CACP,8BAA8B,EAC9B,WAAW,EACX,OAAO,EACP,MAAM,EACN,yCAAyC,CAC1C;YACD,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC;gBACzB,eAAe,EAAE,OAAO;gBACxB,eAAe,EAAE,MAAM;aACxB,CAAC;SACH,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IACE,CAAC,MAAM,eAAe,CAAC,IAAI,EAAE,qCAAqC,CAAC,CAAC;QACpE,MAAM,EACN,CAAC;QACD,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,0HAA0H;IAC1H,MAAM,CAAC,IAAI,CACT,MAAM,CACJ,0BAA0B,EAC1B,WAAW,EACX,OAAO,EACP,MAAM,EACN,qCAAqC,EACrC,QAAQ,EACR,OAAO,CACR,CACF,CAAC;IACF,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CACjB,MAAqC,EACrC,MAAkB;IAElB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxE,4HAA4H;IAC5H,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM;QACd,cAAc,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACtD,YAAY,EAAE,qBAAqB,CAAC,MAAM,CAAC;KAC5C,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAkB;IACtD,OAAO,MAAM,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;QAC/B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,IAAI;KAClD,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,MAAM,CACb,EAAU,EACV,QAAgC,EAChC,SAAiB,EACjB,GAAG,OAA0B;IAE7B,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE;QACF,QAAQ;QACR,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAmC;QAC9D,SAAS;KACV,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,UAAU,CACjB,EAAU,EACV,SAAiB,EACjB,YAAgC,EAChC,GAAG,OAA0B;IAE7B,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;QAC5C,YAAY;KACb,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,mBAAmB,CAAC,WAAmB;IACpD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IACnE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAY,CAAC;IAC9C,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,qBAAqB,CAAC,WAAmB;IACtD,MAAM,UAAU,GAAG;QACjB,CAAC,UAAU,EAAE,KAAK,CAAC;QACnB,CAAC,WAAW,EAAE,KAAK,CAAC;QACpB,CAAC,gBAAgB,EAAE,MAAM,CAAC;QAC1B,CAAC,WAAW,EAAE,MAAM,CAAC;QACrB,CAAC,mBAAmB,EAAE,KAAK,CAAC;KACpB,CAAC;IACX,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,UAAU,EAAE,CAAC;QAC7C,IAAI,CAAC,MAAM,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,KAAK,MAAM;YAC3D,OAAO,OAAO,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,MAAkB;IAC7C,OAAO,CACL,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC;QAC5B,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;QACrC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC1C,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,CAC9C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC;SAClC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;SAC5B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACjE,CAAC;IACD,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;aAC1B,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;aAChD,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;aACjE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC;AACzC,CAAC"}

package/dist/standards/storage-reasons.d.ts

@@ -0,0 +1,15 @@
+/** Finite, sanitized public reasons for standards-proof read failures. */
+export declare const MALFORMED_STANDARDS_PROOF_REASON = "malformed standards proof";
+/**
+ * Classify only errors emitted after strict contract validation begins.
+ * @param error - Strict validator failure
+ * @returns Finite public validation reason
+ */
+export declare function safeStandardsValidationReason(error: unknown): string;
+/**
+ * Classify only failures from confined bounded filesystem operations.
+ * @param error - Storage read failure
+ * @returns Finite public storage reason
+ */
+export declare function safeStandardsStorageReason(error: unknown): string;
+//# sourceMappingURL=storage-reasons.d.ts.map

package/dist/standards/storage-reasons.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-reasons.d.ts","sourceRoot":"","sources":["../../src/standards/storage-reasons.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAE1E,eAAO,MAAM,gCAAgC,8BAA8B,CAAC;AAE5E;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAmCpE;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAOjE"}

package/dist/standards/storage-reasons.js

@@ -0,0 +1,48 @@
+/** Finite, sanitized public reasons for standards-proof read failures. */
+export const MALFORMED_STANDARDS_PROOF_REASON = "malformed standards proof";
+/**
+ * Classify only errors emitted after strict contract validation begins.
+ * @param error - Strict validator failure
+ * @returns Finite public validation reason
+ */
+export function safeStandardsValidationReason(error) {
+    const message = error instanceof Error ? error.message : "unknown";
+    if (message === "Invalid standards proof schemaVersion: expected 1") {
+        return "unsupported standards proof schema";
+    }
+    if (message === "Invalid standards proof artifact identity" ||
+        message.startsWith("Invalid repository")) {
+        return "invalid standards proof identity";
+    }
+    if (message.startsWith("Invalid projectTypes") ||
+        message.startsWith("Invalid applicableChecks")) {
+        return "invalid standards proof check membership";
+    }
+    if (message ===
+        "Invalid standards proof results: checks must exactly match applicableChecks" ||
+        message.startsWith("Invalid results:") ||
+        /^Invalid results\[\d+\](?: fields|:|\.(?:check|category|status):)/u.test(message)) {
+        return "invalid standards proof check results";
+    }
+    if (message.startsWith("Invalid capturedAt:") ||
+        /^Invalid results\[\d+\]\.(?:startedAt|completedAt):/u.test(message) ||
+        /^Invalid results\[\d+\] timestamp order$/u.test(message)) {
+        return "invalid standards proof timestamps";
+    }
+    return MALFORMED_STANDARDS_PROOF_REASON;
+}
+/**
+ * Classify only failures from confined bounded filesystem operations.
+ * @param error - Storage read failure
+ * @returns Finite public storage reason
+ */
+export function safeStandardsStorageReason(error) {
+    const message = error instanceof Error ? error.message : "unknown";
+    if (message.includes("128 KiB"))
+        return "standards proof exceeds size limit";
+    if (message.includes("Unsafe") || message.includes("changed during read")) {
+        return "unsafe standards proof storage";
+    }
+    return MALFORMED_STANDARDS_PROOF_REASON;
+}
+//# sourceMappingURL=storage-reasons.js.map

package/dist/standards/storage-reasons.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-reasons.js","sourceRoot":"","sources":["../../src/standards/storage-reasons.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAE1E,MAAM,CAAC,MAAM,gCAAgC,GAAG,2BAA2B,CAAC;AAE5E;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAAC,KAAc;IAC1D,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,IAAI,OAAO,KAAK,mDAAmD,EAAE,CAAC;QACpE,OAAO,oCAAoC,CAAC;IAC9C,CAAC;IACD,IACE,OAAO,KAAK,2CAA2C;QACvD,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC,EACxC,CAAC;QACD,OAAO,kCAAkC,CAAC;IAC5C,CAAC;IACD,IACE,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC;QAC1C,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAC9C,CAAC;QACD,OAAO,0CAA0C,CAAC;IACpD,CAAC;IACD,IACE,OAAO;QACL,6EAA6E;QAC/E,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC;QACtC,oEAAoE,CAAC,IAAI,CACvE,OAAO,CACR,EACD,CAAC;QACD,OAAO,uCAAuC,CAAC;IACjD,CAAC;IACD,IACE,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC;QACzC,sDAAsD,CAAC,IAAI,CAAC,OAAO,CAAC;QACpE,2CAA2C,CAAC,IAAI,CAAC,OAAO,CAAC,EACzD,CAAC;QACD,OAAO,oCAAoC,CAAC;IAC9C,CAAC;IACD,OAAO,gCAAgC,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACvD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,oCAAoC,CAAC;IAC7E,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;QAC1E,OAAO,gCAAgC,CAAC;IAC1C,CAAC;IACD,OAAO,gCAAgC,CAAC;AAC1C,CAAC"}

package/dist/standards/storage.d.ts

@@ -0,0 +1,36 @@
+import { type StandardsProof } from "./contract.js";
+export declare const MAX_STANDARDS_PROOF_BYTES: number;
+/** Closed result of reading a standards proof artifact. */
+export type StandardsProofReadResult = {
+    readonly status: "available";
+    readonly proof: StandardsProof;
+} | {
+    readonly status: "missing";
+} | {
+    readonly status: "unreadable";
+    readonly reason: string;
+};
+/** Test-only timing boundary used to exercise post-open file growth. */
+export interface StandardsProofReadDependencies {
+    readonly afterOpen?: (target: string) => Promise<void>;
+}
+/**
+ * Read strict proof state without throwing for runtime-state faults.
+ * @param projectRoot - Project directory containing the proof
+ * @param now - Observation time for future-timestamp rejection
+ * @param dependencies - Test-only timing dependencies
+ * @returns Closed proof read result
+ */
+export declare function readStandardsProof(projectRoot: string, now?: Date, dependencies?: StandardsProofReadDependencies): Promise<StandardsProofReadResult>;
+/**
+ * Validate and atomically replace the proof only after capture succeeds.
+ * @param projectRoot - Project directory that owns the proof
+ * @param candidate - Untrusted proof candidate
+ * @param now - Validation time for future-timestamp rejection
+ * @returns Stored path and immutable proof
+ */
+export declare function writeStandardsProof(projectRoot: string, candidate: unknown, now?: Date): Promise<{
+    readonly path: string;
+    readonly proof: StandardsProof;
+}>;
+//# sourceMappingURL=storage.d.ts.map

package/dist/standards/storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/standards/storage.ts"],"names":[],"mappings":"AAOA,OAAO,EAEL,KAAK,cAAc,EAEpB,MAAM,eAAe,CAAC;AAOvB,eAAO,MAAM,yBAAyB,QAAa,CAAC;AAMpD,2DAA2D;AAC3D,MAAM,MAAM,wBAAwB,GAChC;IAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAA;CAAE,GAChE;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/D,wEAAwE;AACxE,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACxD;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,EACnB,GAAG,GAAE,IAAiB,EACtB,YAAY,GAAE,8BAAmC,GAChD,OAAO,CAAC,wBAAwB,CAAC,CAanC;AAsDD;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,OAAO,EAClB,GAAG,GAAE,IAAiB,GACrB,OAAO,CAAC;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAA;CAAE,CAAC,CA0BpE"}