@codyswann/lisa 2.281.0 → 2.282.0

package/dist/standards/capture.d.ts

@@ -0,0 +1,41 @@
+import type { ProjectType } from "../core/config.js";
+import { readConfinedMergedConfig } from "../cli/ui-confined-project-read.js";
+import { type StandardsProof } from "./contract.js";
+import { readStandardsGitState, requireStandardsBaseCommit } from "./git-state.js";
+import { resolveStandardsCheckPlan, type StandardsCheckSpec } from "./registry.js";
+import { writeStandardsProof } from "./storage.js";
+/** Bounded result from one standards command invocation. */
+export interface StandardsCommandOutcome {
+    readonly exitCode: number;
+    readonly output: string;
+}
+/** Injectable boundaries for focused capture verification. */
+export interface StandardsCaptureDependencies {
+    readonly readGitState: typeof readStandardsGitState;
+    readonly requireBaseCommit: typeof requireStandardsBaseCommit;
+    readonly readProjectTypes: (root: string) => Promise<readonly ProjectType[]>;
+    readonly readConfig: typeof readConfinedMergedConfig;
+    readonly resolvePlan: typeof resolveStandardsCheckPlan;
+    readonly runCommand: (root: string, check: StandardsCheckSpec) => Promise<StandardsCommandOutcome>;
+    readonly writeProof: typeof writeStandardsProof;
+    readonly lisaVersion: () => string;
+    readonly now: () => Date;
+    readonly onProgress: (message: string) => void;
+}
+/**
+ * Run every current applicable check and publish proof only after all pass and
+ * every bound input remains unchanged. This establishes automated standards
+ * conformance; it does not claim empirical product verification.
+ * @param projectRoot - Supported project repository
+ * @param dependencies - Injectable process boundaries
+ * @returns Strict proof written for the unchanged artifact
+ */
+export declare function captureStandardsProof(projectRoot: string, dependencies?: Partial<StandardsCaptureDependencies>): Promise<StandardsProof>;
+/**
+ * Execute one fixed argv with a deadline, no shell, and bounded private output.
+ * @param root - Canonical project repository
+ * @param check - Fixed registry check to execute
+ * @returns Exit status and bounded private output
+ */
+export declare function runStandardsCommand(root: string, check: StandardsCheckSpec): Promise<StandardsCommandOutcome>;
+//# sourceMappingURL=capture.d.ts.map

package/dist/standards/capture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capture.d.ts","sourceRoot":"","sources":["../../src/standards/capture.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,EAEL,KAAK,cAAc,EAEpB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAE3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,yBAAyB,EAEzB,KAAK,kBAAkB,EACxB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAMnD,4DAA4D;AAC5D,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,8DAA8D;AAC9D,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,YAAY,EAAE,OAAO,qBAAqB,CAAC;IACpD,QAAQ,CAAC,iBAAiB,EAAE,OAAO,0BAA0B,CAAC;IAC9D,QAAQ,CAAC,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAAC;IAC7E,QAAQ,CAAC,UAAU,EAAE,OAAO,wBAAwB,CAAC;IACrD,QAAQ,CAAC,WAAW,EAAE,OAAO,yBAAyB,CAAC;IACvD,QAAQ,CAAC,UAAU,EAAE,CACnB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,kBAAkB,KACtB,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,OAAO,mBAAmB,CAAC;IAChD,QAAQ,CAAC,WAAW,EAAE,MAAM,MAAM,CAAC;IACnC,QAAQ,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAChD;AAeD;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,WAAW,EAAE,MAAM,EACnB,YAAY,GAAE,OAAO,CAAC,4BAA4B,CAAM,GACvD,OAAO,CAAC,cAAc,CAAC,CA2DzB;AA8DD;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,uBAAuB,CAAC,CA2DlC"}

package/dist/standards/capture.js

@@ -0,0 +1,196 @@
+/** Explicit standards-proof capture orchestration. */
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { getPackageVersion } from "../cli/version.js";
+import { readConfinedDetectedStacks } from "../cli/ui-detected-stacks.js";
+import { readConfinedMergedConfig } from "../cli/ui-confined-project-read.js";
+import { STANDARDS_PROOF_ARTIFACT, } from "./contract.js";
+import { readStandardsGitState, requireStandardsBaseCommit, } from "./git-state.js";
+import { resolveStandardsCheckPlan, } from "./registry.js";
+import { writeStandardsProof } from "./storage.js";
+import { hasPositiveTestEvidence } from "./test-evidence.js";
+const execFileAsync = promisify(execFile);
+const MAX_CHECK_OUTPUT_BYTES = 1024 * 1024;
+const DEFAULT_DEPENDENCIES = {
+    readGitState: readStandardsGitState,
+    requireBaseCommit: requireStandardsBaseCommit,
+    readProjectTypes: readConfinedDetectedStacks,
+    readConfig: readConfinedMergedConfig,
+    resolvePlan: resolveStandardsCheckPlan,
+    runCommand: runStandardsCommand,
+    writeProof: writeStandardsProof,
+    lisaVersion: getPackageVersion,
+    now: () => new Date(),
+    onProgress: message => process.stdout.write(`${message}\n`),
+};
+/**
+ * Run every current applicable check and publish proof only after all pass and
+ * every bound input remains unchanged. This establishes automated standards
+ * conformance; it does not claim empirical product verification.
+ * @param projectRoot - Supported project repository
+ * @param dependencies - Injectable process boundaries
+ * @returns Strict proof written for the unchanged artifact
+ */
+export async function captureStandardsProof(projectRoot, dependencies = {}) {
+    const deps = { ...DEFAULT_DEPENDENCIES, ...dependencies };
+    const before = await observeBoundInputs(projectRoot, deps);
+    if (!before.git.clean) {
+        throw new Error("Standards proof requires a clean tracked, staged, submodule, and nonignored worktree.");
+    }
+    await deps.requireBaseCommit(before.git.root);
+    const results = [];
+    for (const check of before.plan.checks) {
+        deps.onProgress(`standards-proof: running ${check.id}`);
+        const startedAt = deps.now().toISOString();
+        const outcome = await deps.runCommand(before.git.root, check);
+        const completedAt = deps.now().toISOString();
+        if (outcome.exitCode !== 0) {
+            throw new Error(`Standards check failed: ${check.id}.`);
+        }
+        if (check.testEvidence !== undefined &&
+            !hasPositiveTestEvidence(check.testEvidence, outcome.output)) {
+            throw new Error(`Standards check did not prove any executed tests: ${check.id}.`);
+        }
+        // eslint-disable-next-line functional/immutable-data -- bounded ordered check ledger is private until validation and atomic publication
+        results.push(Object.freeze({
+            check: check.id,
+            category: check.category,
+            status: "pass",
+            startedAt,
+            completedAt,
+        }));
+    }
+    const after = await observeBoundInputs(before.git.root, deps);
+    assertUnchanged(before, after);
+    // eslint-disable-next-line code-organization/enforce-statement-order -- capture time must be read only after unchanged-input validation
+    const capturedAt = deps.now().toISOString();
+    // eslint-disable-next-line code-organization/enforce-statement-order -- immutable proof assembly intentionally follows unchanged-input validation
+    const proof = {
+        schemaVersion: 1,
+        artifact: STANDARDS_PROOF_ARTIFACT,
+        lisaVersion: deps.lisaVersion(),
+        registryDigest: before.plan.registryDigest,
+        configDigest: before.plan.configDigest,
+        repository: {
+            identity: before.git.identity,
+            head: before.git.head,
+            tree: before.git.tree,
+        },
+        projectTypes: before.projectTypes,
+        applicableChecks: before.plan.checks.map(check => check.id),
+        capturedAt,
+        results,
+    };
+    return (await deps.writeProof(before.git.root, proof, deps.now())).proof;
+}
+/**
+ * Capture the exact stack/config/registry/git state around command execution.
+ * @param projectRoot - Supported project repository
+ * @param deps - Injectable process boundaries
+ * @returns Current proof-bound inputs
+ */
+async function observeBoundInputs(projectRoot, deps) {
+    const git = await deps.readGitState(projectRoot);
+    const [projectTypes, config] = await Promise.all([
+        deps.readProjectTypes(git.root),
+        deps.readConfig(git.root),
+    ]);
+    const plan = await deps.resolvePlan(git.root, projectTypes, config);
+    return Object.freeze({ git, projectTypes, plan });
+}
+/**
+ * Reject any before/after drift before storage mutation.
+ * @param before - Inputs observed before quality commands
+ * @param after - Inputs observed after quality commands
+ */
+function assertUnchanged(before, after) {
+    if (!after.git.clean) {
+        throw new Error("Repository changed while standards checks were running.");
+    }
+    const scalarPairs = [
+        ["identity", before.git.identity, after.git.identity],
+        ["HEAD", before.git.head, after.git.head],
+        ["tree", before.git.tree, after.git.tree],
+        ["registry", before.plan.registryDigest, after.plan.registryDigest],
+        ["config", before.plan.configDigest, after.plan.configDigest],
+    ];
+    const changed = scalarPairs.find(([_label, left, right]) => left !== right);
+    if (changed !== undefined) {
+        throw new Error(`Standards proof input changed during capture: ${changed[0]}.`);
+    }
+    if (JSON.stringify(before.projectTypes) !== JSON.stringify(after.projectTypes)) {
+        throw new Error("Standards proof project types changed during capture.");
+    }
+    if (JSON.stringify(before.plan.checks) !== JSON.stringify(after.plan.checks)) {
+        throw new Error("Standards proof check plan changed during capture.");
+    }
+}
+/**
+ * Execute one fixed argv with a deadline, no shell, and bounded private output.
+ * @param root - Canonical project repository
+ * @param check - Fixed registry check to execute
+ * @returns Exit status and bounded private output
+ */
+export async function runStandardsCommand(root, check) {
+    const [command, ...args] = check.argv;
+    try {
+        const { stdout, stderr } = await execFileAsync(command, args, {
+            cwd: root,
+            timeout: check.timeoutMs,
+            maxBuffer: MAX_CHECK_OUTPUT_BYTES,
+            encoding: "utf8",
+            env: {
+                ...getProcessEnvironment(),
+                GIT_ALTERNATE_OBJECT_DIRECTORIES: undefined,
+                GIT_CONFIG: undefined,
+                GIT_CONFIG_PARAMETERS: undefined,
+                GIT_CONFIG_COUNT: undefined,
+                GIT_OBJECT_DIRECTORY: undefined,
+                GIT_DIR: undefined,
+                GIT_WORK_TREE: undefined,
+                GIT_IMPLICIT_WORK_TREE: undefined,
+                GIT_GRAFT_FILE: undefined,
+                GIT_INDEX_FILE: undefined,
+                GIT_NO_REPLACE_OBJECTS: undefined,
+                GIT_REPLACE_REF_BASE: undefined,
+                GIT_PREFIX: undefined,
+                GIT_SHALLOW_FILE: undefined,
+                GIT_COMMON_DIR: undefined,
+                GIT_OPTIONAL_LOCKS: "0",
+                CI: "1",
+                VERIFY_BASE_SHA: undefined,
+                VERIFY_HEAD_SHA: undefined,
+                VERIFY_BASE_REF: undefined,
+                VERIFY_CHANGE_TYPES: undefined,
+                VERIFY_LABELS: undefined,
+                VERIFY_PR_NUMBER: undefined,
+                VERIFY_GITHUB_REPOSITORY: undefined,
+                VERIFY_GITHUB_TOKEN: undefined,
+                ...check.environment,
+            },
+        });
+        return Object.freeze({ exitCode: 0, output: `${stdout}\n${stderr}` });
+    }
+    catch (error) {
+        const failure = error;
+        if (failure.code === "ENOENT") {
+            throw new Error(`Required standards tool is unavailable for ${check.id}.`);
+        }
+        if (failure.killed === true) {
+            throw new Error(`Standards check timed out: ${check.id}.`);
+        }
+        return Object.freeze({
+            exitCode: typeof failure.code === "number" ? failure.code : 1,
+            output: `${failure.stdout ?? ""}\n${failure.stderr ?? ""}`,
+        });
+    }
+}
+/**
+ * Read the explicit CLI process environment for child quality commands.
+ * @returns Current process environment
+ */
+function getProcessEnvironment() {
+    // eslint-disable-next-line no-restricted-syntax -- explicit operator command must inherit the configured project toolchain
+    return process.env;
+}
+//# sourceMappingURL=capture.js.map

package/dist/standards/capture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capture.js","sourceRoot":"","sources":["../../src/standards/capture.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,EACL,wBAAwB,GAGzB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,qBAAqB,EACrB,0BAA0B,GAE3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,yBAAyB,GAG1B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAC1C,MAAM,sBAAsB,GAAG,IAAI,GAAG,IAAI,CAAC;AAyB3C,MAAM,oBAAoB,GAAiC;IACzD,YAAY,EAAE,qBAAqB;IACnC,iBAAiB,EAAE,0BAA0B;IAC7C,gBAAgB,EAAE,0BAA0B;IAC5C,UAAU,EAAE,wBAAwB;IACpC,WAAW,EAAE,yBAAyB;IACtC,UAAU,EAAE,mBAAmB;IAC/B,UAAU,EAAE,mBAAmB;IAC/B,WAAW,EAAE,iBAAiB;IAC9B,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;IACrB,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC;CAC5D,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,WAAmB,EACnB,eAAsD,EAAE;IAExD,MAAM,IAAI,GAAG,EAAE,GAAG,oBAAoB,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACvC,IAAI,CAAC,UAAU,CAAC,4BAA4B,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC9D,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QAC7C,IAAI,OAAO,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;QAC1D,CAAC;QACD,IACE,KAAK,CAAC,YAAY,KAAK,SAAS;YAChC,CAAC,uBAAuB,CAAC,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,EAC5D,CAAC;YACD,MAAM,IAAI,KAAK,CACb,qDAAqD,KAAK,CAAC,EAAE,GAAG,CACjE,CAAC;QACJ,CAAC;QACD,wIAAwI;QACxI,OAAO,CAAC,IAAI,CACV,MAAM,CAAC,MAAM,CAAC;YACZ,KAAK,EAAE,KAAK,CAAC,EAAE;YACf,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,MAAM;YACd,SAAS;YACT,WAAW;SACZ,CAAC,CACH,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9D,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC/B,wIAAwI;IACxI,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,kJAAkJ;IAClJ,MAAM,KAAK,GAAG;QACZ,aAAa,EAAE,CAAC;QAChB,QAAQ,EAAE,wBAAwB;QAClC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;QAC/B,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc;QAC1C,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY;QACtC,UAAU,EAAE;YACV,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ;YAC7B,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI;YACrB,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI;SACtB;QACD,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3D,UAAU;QACV,OAAO;KACC,CAAC;IACX,OAAO,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AAC3E,CAAC;AASD;;;;;GAKG;AACH,KAAK,UAAU,kBAAkB,CAC/B,WAAmB,EACnB,IAAkC;IAElC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IACjD,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC/C,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;KAC1B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;IACpE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,MAAmB,EAAE,KAAkB;IAC9D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,WAAW,GAAG;QAClB,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;QACrD,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;QACzC,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;QACzC,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC;QACnE,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC;KACrD,CAAC;IACX,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;IAC5E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,iDAAiD,OAAO,CAAC,CAAC,CAAC,GAAG,CAC/D,CAAC;IACJ,CAAC;IACD,IACE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,EAC1E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,IACE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EACxE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAY,EACZ,KAAyB;IAEzB,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE;YAC5D,GAAG,EAAE,IAAI;YACT,OAAO,EAAE,KAAK,CAAC,SAAS;YACxB,SAAS,EAAE,sBAAsB;YACjC,QAAQ,EAAE,MAAM;YAChB,GAAG,EAAE;gBACH,GAAG,qBAAqB,EAAE;gBAC1B,gCAAgC,EAAE,SAAS;gBAC3C,UAAU,EAAE,SAAS;gBACrB,qBAAqB,EAAE,SAAS;gBAChC,gBAAgB,EAAE,SAAS;gBAC3B,oBAAoB,EAAE,SAAS;gBAC/B,OAAO,EAAE,SAAS;gBAClB,aAAa,EAAE,SAAS;gBACxB,sBAAsB,EAAE,SAAS;gBACjC,cAAc,EAAE,SAAS;gBACzB,cAAc,EAAE,SAAS;gBACzB,sBAAsB,EAAE,SAAS;gBACjC,oBAAoB,EAAE,SAAS;gBAC/B,UAAU,EAAE,SAAS;gBACrB,gBAAgB,EAAE,SAAS;gBAC3B,cAAc,EAAE,SAAS;gBACzB,kBAAkB,EAAE,GAAG;gBACvB,EAAE,EAAE,GAAG;gBACP,eAAe,EAAE,SAAS;gBAC1B,eAAe,EAAE,SAAS;gBAC1B,eAAe,EAAE,SAAS;gBAC1B,mBAAmB,EAAE,SAAS;gBAC9B,aAAa,EAAE,SAAS;gBACxB,gBAAgB,EAAE,SAAS;gBAC3B,wBAAwB,EAAE,SAAS;gBACnC,mBAAmB,EAAE,SAAS;gBAC9B,GAAG,KAAK,CAAC,WAAW;aACrB;SACF,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,MAAM,EAAE,EAAE,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAKf,CAAC;QACF,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,8CAA8C,KAAK,CAAC,EAAE,GAAG,CAC1D,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,8BAA8B,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,QAAQ,EAAE,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC7D,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,KAAK,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE;SAC3D,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB;IAC5B,2HAA2H;IAC3H,OAAO,OAAO,CAAC,GAAG,CAAC;AACrB,CAAC"}

package/dist/standards/contract.d.ts

@@ -0,0 +1,45 @@
+/** Strict, agent-neutral contract for one standards-conformance proof. */
+import type { ProjectType } from "../core/config.js";
+export declare const STANDARDS_PROOF_PATH = ".lisa/standards/latest.json";
+export declare const STANDARDS_PROOF_ARTIFACT = "lisa-standards-proof";
+export declare const STANDARDS_PROOF_SCHEMA_VERSION = 1;
+export declare const STANDARDS_CHECK_CATEGORIES: readonly ["lint", "static-analysis", "test", "guardrail", "threshold"];
+/** Closed category names accepted in standards proof results. */
+export type StandardsCheckCategory = (typeof STANDARDS_CHECK_CATEGORIES)[number];
+/** One successful bounded check, without stdout, stderr, or environment data. */
+export interface StandardsProofResult {
+    readonly check: string;
+    readonly category: StandardsCheckCategory;
+    readonly status: "pass";
+    readonly startedAt: string;
+    readonly completedAt: string;
+}
+/** Git artifact identity established by a standards run. */
+export interface StandardsRepositoryProof {
+    readonly identity: string;
+    readonly head: string;
+    readonly tree: string;
+}
+/** Complete immutable proof envelope. */
+export interface StandardsProof {
+    readonly schemaVersion: 1;
+    readonly artifact: typeof STANDARDS_PROOF_ARTIFACT;
+    readonly lisaVersion: string;
+    readonly registryDigest: string;
+    readonly configDigest: string;
+    readonly repository: StandardsRepositoryProof;
+    readonly projectTypes: readonly ProjectType[];
+    readonly applicableChecks: readonly string[];
+    readonly capturedAt: string;
+    readonly results: readonly StandardsProofResult[];
+}
+/**
+ * Validate untrusted proof data into a detached, deeply frozen envelope.
+ * Timestamps are audit metadata only: they must be ordered and not in the
+ * future, but proof freshness is established by recomputed bound inputs.
+ * @param candidate - Untrusted proof candidate
+ * @param now - Observation time used only to reject future timestamps
+ * @returns Strict immutable proof
+ */
+export declare function validateStandardsProof(candidate: unknown, now?: Date): StandardsProof;
+//# sourceMappingURL=contract.d.ts.map

package/dist/standards/contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../src/standards/contract.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAWrD,eAAO,MAAM,oBAAoB,gCAAgC,CAAC;AAClE,eAAO,MAAM,wBAAwB,yBAAyB,CAAC;AAC/D,eAAO,MAAM,8BAA8B,IAAI,CAAC;AAEhD,eAAO,MAAM,0BAA0B,wEAM7B,CAAC;AACX,iEAAiE;AACjE,MAAM,MAAM,sBAAsB,GAChC,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9C,iFAAiF;AACjF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,4DAA4D;AAC5D,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,yCAAyC;AACzC,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,OAAO,wBAAwB,CAAC;IACnD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,wBAAwB,CAAC;IAC9C,QAAQ,CAAC,YAAY,EAAE,SAAS,WAAW,EAAE,CAAC;IAC9C,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACnD;AAqCD;;;;;;;GAOG;AAEH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,OAAO,EAClB,GAAG,GAAE,IAAiB,GACrB,cAAc,CA6EhB"}

package/dist/standards/contract.js

@@ -0,0 +1,175 @@
+import { hasUnsafeTextCharacter, readStrictDenseArray, readStrictProperty as read, requireBoundedMachineId, requireCanonicalUtcTimestamp, requireClosedString, requireStrictRecord, } from "../health/strict-validation.js";
+export const STANDARDS_PROOF_PATH = ".lisa/standards/latest.json";
+export const STANDARDS_PROOF_ARTIFACT = "lisa-standards-proof";
+export const STANDARDS_PROOF_SCHEMA_VERSION = 1;
+export const STANDARDS_CHECK_CATEGORIES = [
+    "lint",
+    "static-analysis",
+    "test",
+    "guardrail",
+    "threshold",
+];
+const PROOF_FIELDS = [
+    "schemaVersion",
+    "artifact",
+    "lisaVersion",
+    "registryDigest",
+    "configDigest",
+    "repository",
+    "projectTypes",
+    "applicableChecks",
+    "capturedAt",
+    "results",
+];
+const REPOSITORY_FIELDS = ["identity", "head", "tree"];
+const RESULT_FIELDS = [
+    "check",
+    "category",
+    "status",
+    "startedAt",
+    "completedAt",
+];
+const PROJECT_TYPES = [
+    "typescript",
+    "npm-package",
+    "harper-fabric",
+    "phaser",
+    "expo",
+    "nestjs",
+    "cdk",
+    "rails",
+];
+const MAX_CHECKS = 64;
+const SHA = /^[0-9a-f]{40}(?:[0-9a-f]{24})?$/u;
+const DIGEST = /^sha256:[0-9a-f]{64}$/u;
+const REPOSITORY_IDENTITY = /^[a-z\d.-]+(?::\d+)?\/[a-z\d._/-]+$/u;
+/**
+ * Validate untrusted proof data into a detached, deeply frozen envelope.
+ * Timestamps are audit metadata only: they must be ordered and not in the
+ * future, but proof freshness is established by recomputed bound inputs.
+ * @param candidate - Untrusted proof candidate
+ * @param now - Observation time used only to reject future timestamps
+ * @returns Strict immutable proof
+ */
+// eslint-disable-next-line max-lines-per-function -- exact closed-field validation remains one auditable transaction
+export function validateStandardsProof(candidate, now = new Date()) {
+    const input = requireStrictRecord(candidate, PROOF_FIELDS, "StandardsProof");
+    if (read(input, "schemaVersion") !== STANDARDS_PROOF_SCHEMA_VERSION) {
+        throw new Error("Invalid standards proof schemaVersion: expected 1");
+    }
+    if (read(input, "artifact") !== STANDARDS_PROOF_ARTIFACT) {
+        throw new Error("Invalid standards proof artifact identity");
+    }
+    const lisaVersion = requireText(read(input, "lisaVersion"), "lisaVersion", 64);
+    const registryDigest = requireDigest(read(input, "registryDigest"), "registryDigest");
+    const configDigest = requireDigest(read(input, "configDigest"), "configDigest");
+    const repository = requireRepository(read(input, "repository"));
+    const projectTypes = readStrictDenseArray(read(input, "projectTypes"), 1, PROJECT_TYPES.length, "projectTypes").map((value, index) => requireClosedString(value, PROJECT_TYPES, `projectTypes[${index}]`));
+    if (new Set(projectTypes).size !== projectTypes.length) {
+        throw new Error("Invalid projectTypes: entries must be unique");
+    }
+    const applicableChecks = readStrictDenseArray(read(input, "applicableChecks"), 1, MAX_CHECKS, "applicableChecks").map((value, index) => requireBoundedMachineId(value, `applicableChecks[${index}]`, 128));
+    if (new Set(applicableChecks).size !== applicableChecks.length) {
+        throw new Error("Invalid applicableChecks: entries must be unique");
+    }
+    const capturedAt = requireCanonicalUtcTimestamp(read(input, "capturedAt"), "capturedAt");
+    if (capturedAt > now.toISOString()) {
+        throw new Error("Invalid capturedAt: standards proof is from the future");
+    }
+    const results = readStrictDenseArray(read(input, "results"), 1, MAX_CHECKS, "results").map((value, index) => requireResult(value, index, capturedAt));
+    if (results.length !== applicableChecks.length ||
+        results.some((result, index) => result.check !== applicableChecks[index])) {
+        throw new Error("Invalid standards proof results: checks must exactly match applicableChecks");
+    }
+    return Object.freeze({
+        schemaVersion: 1,
+        artifact: STANDARDS_PROOF_ARTIFACT,
+        lisaVersion,
+        registryDigest,
+        configDigest,
+        repository,
+        projectTypes: Object.freeze(projectTypes),
+        applicableChecks: Object.freeze(applicableChecks),
+        capturedAt,
+        results: Object.freeze(results),
+    });
+}
+/**
+ * Validate one result row and its bounded, ordered timestamps.
+ * @param candidate - Untrusted result candidate
+ * @param index - Result position used in validation messages
+ * @param capturedAt - Proof capture timestamp that bounds completion
+ * @returns Strict immutable result row
+ */
+function requireResult(candidate, index, capturedAt) {
+    const input = requireStrictRecord(candidate, RESULT_FIELDS, `results[${index}]`);
+    const startedAt = requireCanonicalUtcTimestamp(read(input, "startedAt"), `results[${index}].startedAt`);
+    const completedAt = requireCanonicalUtcTimestamp(read(input, "completedAt"), `results[${index}].completedAt`);
+    if (completedAt < startedAt || completedAt > capturedAt) {
+        throw new Error(`Invalid results[${index}] timestamp order`);
+    }
+    return Object.freeze({
+        check: requireBoundedMachineId(read(input, "check"), `results[${index}].check`, 128),
+        category: requireClosedString(read(input, "category"), STANDARDS_CHECK_CATEGORIES, `results[${index}].category`),
+        status: requireClosedString(read(input, "status"), ["pass"], `results[${index}].status`),
+        startedAt,
+        completedAt,
+    });
+}
+/**
+ * Validate the normalized remote identity and exact Git object IDs.
+ * @param candidate - Untrusted repository proof candidate
+ * @returns Strict immutable repository proof
+ */
+function requireRepository(candidate) {
+    const input = requireStrictRecord(candidate, REPOSITORY_FIELDS, "repository");
+    const identity = requireText(read(input, "identity"), "repository.identity", 512);
+    if (!REPOSITORY_IDENTITY.test(identity) || identity.endsWith(".git")) {
+        throw new Error("Invalid repository.identity: expected normalized remote identity");
+    }
+    const head = requireSha(read(input, "head"), "repository.head");
+    const tree = requireSha(read(input, "tree"), "repository.tree");
+    return Object.freeze({ identity, head, tree });
+}
+/**
+ * Require one SHA-1 or SHA-256 Git object identifier.
+ * @param value - Candidate object identifier
+ * @param field - Field name used in validation messages
+ * @returns Validated object identifier
+ */
+function requireSha(value, field) {
+    if (typeof value !== "string" || !SHA.test(value)) {
+        throw new Error(`Invalid ${field}: expected a Git object identifier`);
+    }
+    return value;
+}
+/**
+ * Require one prefixed SHA-256 digest.
+ * @param value - Candidate digest
+ * @param field - Field name used in validation messages
+ * @returns Validated digest
+ */
+function requireDigest(value, field) {
+    if (typeof value !== "string" || !DIGEST.test(value)) {
+        throw new Error(`Invalid ${field}: expected sha256 digest`);
+    }
+    return value;
+}
+/**
+ * Require compact printable scalar text.
+ * @param value - Candidate scalar
+ * @param field - Field name used in validation messages
+ * @param maximumBytes - Maximum UTF-8 byte length
+ * @returns Validated text
+ */
+function requireText(value, field, maximumBytes) {
+    if (typeof value !== "string" ||
+        value.trim() !== value ||
+        value.length === 0 ||
+        Buffer.byteLength(value, "utf8") > maximumBytes ||
+        hasUnsafeTextCharacter(value)) {
+        throw new Error(`Invalid ${field}: expected bounded text`);
+    }
+    return value;
+}
+//# sourceMappingURL=contract.js.map

package/dist/standards/contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract.js","sourceRoot":"","sources":["../../src/standards/contract.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,IAAI,IAAI,EAC1B,uBAAuB,EACvB,4BAA4B,EAC5B,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,gCAAgC,CAAC;AAExC,MAAM,CAAC,MAAM,oBAAoB,GAAG,6BAA6B,CAAC;AAClE,MAAM,CAAC,MAAM,wBAAwB,GAAG,sBAAsB,CAAC;AAC/D,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC;AAEhD,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,MAAM;IACN,iBAAiB;IACjB,MAAM;IACN,WAAW;IACX,WAAW;CACH,CAAC;AAmCX,MAAM,YAAY,GAAG;IACnB,eAAe;IACf,UAAU;IACV,aAAa;IACb,gBAAgB;IAChB,cAAc;IACd,YAAY;IACZ,cAAc;IACd,kBAAkB;IAClB,YAAY;IACZ,SAAS;CACD,CAAC;AACX,MAAM,iBAAiB,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAU,CAAC;AAChE,MAAM,aAAa,GAAG;IACpB,OAAO;IACP,UAAU;IACV,QAAQ;IACR,WAAW;IACX,aAAa;CACL,CAAC;AACX,MAAM,aAAa,GAAG;IACpB,YAAY;IACZ,aAAa;IACb,eAAe;IACf,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,KAAK;IACL,OAAO;CACkC,CAAC;AAC5C,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,GAAG,GAAG,kCAAkC,CAAC;AAC/C,MAAM,MAAM,GAAG,wBAAwB,CAAC;AACxC,MAAM,mBAAmB,GAAG,sCAAsC,CAAC;AAEnE;;;;;;;GAOG;AACH,qHAAqH;AACrH,MAAM,UAAU,sBAAsB,CACpC,SAAkB,EAClB,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,KAAK,GAAG,mBAAmB,CAAC,SAAS,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC;IAC7E,IAAI,IAAI,CAAC,KAAK,EAAE,eAAe,CAAC,KAAK,8BAA8B,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,KAAK,wBAAwB,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,WAAW,GAAG,WAAW,CAC7B,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,EAC1B,aAAa,EACb,EAAE,CACH,CAAC;IACF,MAAM,cAAc,GAAG,aAAa,CAClC,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAC7B,gBAAgB,CACjB,CAAC;IACF,MAAM,YAAY,GAAG,aAAa,CAChC,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,EAC3B,cAAc,CACf,CAAC;IACF,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;IAChE,MAAM,YAAY,GAAG,oBAAoB,CACvC,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,EAC3B,CAAC,EACD,aAAa,CAAC,MAAM,EACpB,cAAc,CACf,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACrB,mBAAmB,CAAC,KAAK,EAAE,aAAa,EAAE,gBAAgB,KAAK,GAAG,CAAC,CACpE,CAAC;IACF,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,gBAAgB,GAAG,oBAAoB,CAC3C,IAAI,CAAC,KAAK,EAAE,kBAAkB,CAAC,EAC/B,CAAC,EACD,UAAU,EACV,kBAAkB,CACnB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACrB,uBAAuB,CAAC,KAAK,EAAE,oBAAoB,KAAK,GAAG,EAAE,GAAG,CAAC,CAClE,CAAC;IACF,IAAI,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,MAAM,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,UAAU,GAAG,4BAA4B,CAC7C,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,EACzB,YAAY,CACb,CAAC;IACF,IAAI,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,OAAO,GAAG,oBAAoB,CAClC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,EACtB,CAAC,EACD,UAAU,EACV,SAAS,CACV,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;IACjE,IACE,OAAO,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM;QAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,gBAAgB,CAAC,KAAK,CAAC,CAAC,EACzE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,aAAa,EAAE,CAAC;QAChB,QAAQ,EAAE,wBAAwB;QAClC,WAAW;QACX,cAAc;QACd,YAAY;QACZ,UAAU;QACV,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;QACzC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC;QACjD,UAAU;QACV,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;KAChC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CACpB,SAAkB,EAClB,KAAa,EACb,UAAkB;IAElB,MAAM,KAAK,GAAG,mBAAmB,CAC/B,SAAS,EACT,aAAa,EACb,WAAW,KAAK,GAAG,CACpB,CAAC;IACF,MAAM,SAAS,GAAG,4BAA4B,CAC5C,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,EACxB,WAAW,KAAK,aAAa,CAC9B,CAAC;IACF,MAAM,WAAW,GAAG,4BAA4B,CAC9C,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,EAC1B,WAAW,KAAK,eAAe,CAChC,CAAC;IACF,IAAI,WAAW,GAAG,SAAS,IAAI,WAAW,GAAG,UAAU,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,mBAAmB,KAAK,mBAAmB,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,uBAAuB,CAC5B,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EACpB,WAAW,KAAK,SAAS,EACzB,GAAG,CACJ;QACD,QAAQ,EAAE,mBAAmB,CAC3B,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,EACvB,0BAA0B,EAC1B,WAAW,KAAK,YAAY,CAC7B;QACD,MAAM,EAAE,mBAAmB,CACzB,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,EACrB,CAAC,MAAM,CAAU,EACjB,WAAW,KAAK,UAAU,CAC3B;QACD,SAAS;QACT,WAAW;KACZ,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,SAAkB;IAC3C,MAAM,KAAK,GAAG,mBAAmB,CAAC,SAAS,EAAE,iBAAiB,EAAE,YAAY,CAAC,CAAC;IAC9E,MAAM,QAAQ,GAAG,WAAW,CAC1B,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,EACvB,qBAAqB,EACrB,GAAG,CACJ,CAAC;IACF,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,KAAc,EAAE,KAAa;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,oCAAoC,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,0BAA0B,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAClB,KAAc,EACd,KAAa,EACb,YAAoB;IAEpB,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK;QACtB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,YAAY;QAC/C,sBAAsB,CAAC,KAAK,CAAC,EAC7B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,yBAAyB,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/standards/git-state.d.ts

@@ -0,0 +1,30 @@
+/** Exact repository state bound into a proof. */
+export interface StandardsGitState {
+    readonly root: string;
+    readonly identity: string;
+    readonly head: string;
+    readonly tree: string;
+    readonly clean: boolean;
+}
+/**
+ * Read canonical identity, commit/tree objects, and complete nonignored dirt.
+ * Git optional locks and fsmonitor are disabled because UI observation must be
+ * read-only and safe to repeat.
+ * @param projectRoot - Path within the repository
+ * @returns Bounded repository state
+ */
+export declare function readStandardsGitState(projectRoot: string): Promise<StandardsGitState>;
+/**
+ * Require a parent commit for the non-vacuous threshold-ratchet comparison.
+ * @param projectRoot - Canonical repository root
+ * @returns Parent commit object identifier
+ */
+export declare function requireStandardsBaseCommit(projectRoot: string): Promise<string>;
+/**
+ * Normalize HTTPS, SSH URL, and SCP-like remotes to host[:port]/owner/repo.
+ * Credentials are never retained and default transport ports are removed.
+ * @param remote - One configured origin URL
+ * @returns Stable lowercase repository identity
+ */
+export declare function normalizeGitRemoteIdentity(remote: string): string;
+//# sourceMappingURL=git-state.d.ts.map

package/dist/standards/git-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-state.d.ts","sourceRoot":"","sources":["../../src/standards/git-state.ts"],"names":[],"mappings":"AASA,iDAAiD;AACjD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,iBAAiB,CAAC,CA8C5B;AAED;;;;GAIG;AACH,wBAAsB,0BAA0B,CAC9C,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,CAgBjB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAmBjE"}