@deftai/directive-core 0.104.0 → 0.105.0

package/dist/scope-provenance/digest.js

@@ -69,9 +69,18 @@ export function extractPlanId(payload) {
 export function approvedScopeDir(projectRoot) {
     return join(resolve(projectRoot), ...APPROVED_SCOPE_DIR.split("/"));
 }
+export function approvedScopeSafePlanId(planId) {
+    return planId.replace(/[^a-zA-Z0-9._-]/g, "_");
+}
 export function approvedScopeRecordPath(projectRoot, planId) {
-    const safe = planId.replace(/[^a-zA-Z0-9._-]/g, "_");
-    return join(approvedScopeDir(projectRoot), `${safe}.json`);
+    return join(approvedScopeDir(projectRoot), `${approvedScopeSafePlanId(planId)}.json`);
+}
+/** Repo-relative preimage path. */
+export function approvedScopeIntentRel(planId) {
+    return `.deft/approved-scope/${approvedScopeSafePlanId(planId)}.intent.json`;
+}
+export function approvedScopeIntentPath(projectRoot, planId) {
+    return join(approvedScopeDir(projectRoot), `${approvedScopeSafePlanId(planId)}.intent.json`);
 }
 /** Build an ApprovedScopeRecord from xBRIEF payload + metadata. */
 export function buildApprovedScopeRecord(input) {
@@ -87,17 +96,13 @@ export function buildApprovedScopeRecord(input) {
         fileScope,
         fileScopeDigest,
     };
+    const withIntent = input.intentDigest !== undefined
+        ? { ...record, intentDigest: input.intentDigest, digestAlgo: input.digestAlgo }
+        : record;
     if (input.humanApproval !== undefined) {
-        return {
-            ...record,
-            humanApproval: input.humanApproval,
-            xbriefBodyDigest: input.xbriefRawText !== undefined ? computeTextDigest(input.xbriefRawText) : undefined,
-        };
-    }
-    if (input.xbriefRawText !== undefined) {
-        return { ...record, xbriefBodyDigest: computeTextDigest(input.xbriefRawText) };
+        return { ...withIntent, humanApproval: input.humanApproval };
     }
-    return record;
+    return withIntent;
 }
 /** Persist approved-scope record (activation / renewed human approval). */
 export function writeApprovedScopeRecord(projectRoot, record) {

package/dist/scope-provenance/evaluate.d.ts

@@ -9,7 +9,7 @@
  * Migration: missing approved-scope records → warn (exit 0) unless --enforce.
  */
 import { type ApprovedScopeRecord } from "./digest.js";
-export type ScopeProvenanceViolationKind = "self-authorizing-scope-expansion" | "active-xbrief-modified-without-digest" | "digest-mismatch-without-renewal";
+export type ScopeProvenanceViolationKind = "self-authorizing-scope-expansion" | "active-xbrief-modified-without-digest" | "digest-mismatch-without-renewal" | "intent-drift" | "unclassified-key" | "intent-digest-mismatch" | "duplicate-key" | "duplicate-item-id" | "same-pr-intent-rewrite" | "first-activation-missing-intent-pin" | "legacy-intent-edit" | "intent-parse-error";
 export interface ScopeProvenanceFinding {
     readonly xbriefRelPath: string;
     readonly planId: string;
@@ -39,6 +39,10 @@ export interface ScopeProvenanceOptions {
     readonly approvedRecords?: readonly ApprovedScopeRecord[];
     /** Inject renewed-approval stamps keyed by planId (test seam). */
     readonly renewedApprovals?: ReadonlyMap<string, ApprovedScopeRecord["humanApproval"]>;
+    /** Inject `git show <base>:<rel>` (test seam; never working-tree). */
+    readonly readAtBase?: (relPath: string) => string | null;
+    /** Optional repo slug seed for live extract (mint uses resolveProjectRepo). */
+    readonly approvedReposSeed?: readonly string[];
 }
 /**
  * Resolve a PR-aware base ref. Bare `HEAD` only shows uncommitted changes, so

package/dist/scope-provenance/evaluate.js

@@ -12,7 +12,9 @@ import { spawnSync } from "node:child_process";
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { GitCommandError, GitNotFoundError } from "../encoding/git.js";
-import { computeFileScopeDigest, extractFileScope, extractPlanId, isHumanApprovalStamp, listApprovedScopeRecords, normalizeFileScope, readApprovedScopeRecord, scopeExpansion, } from "./digest.js";
+import { approvedScopeIntentRel, computeFileScopeDigest, extractFileScope, extractPlanId, isHumanApprovalStamp, listApprovedScopeRecords, normalizeFileScope, readApprovedScopeRecord, scopeExpansion, } from "./digest.js";
+import { bodyDigestIsAuthority, evaluateIntentForXbrief } from "./intent-evaluate.js";
+import { recoverApprovedScopePairs } from "./mint-artifacts.js";
 function git(args, projectRoot) {
     const result = spawnSync("git", args, {
         cwd: projectRoot,
@@ -236,6 +238,8 @@ export function parseApprovedScopeRecordRaw(raw) {
         const expected = computeFileScopeDigest(scopePaths);
         if (rec.fileScopeDigest !== expected)
             return null;
+        // xbriefBodyDigest is never authority (#3385 F4 / R6) — ignored if present.
+        bodyDigestIsAuthority(data);
         return data;
     }
     catch {
@@ -379,6 +383,7 @@ export function evaluateOneScopeProvenance(input) {
 export function evaluateScopeProvenance(projectRoot, options = {}) {
     const root = resolve(projectRoot);
     const enforce = options.enforce ?? false;
+    recoverApprovedScopePairs(root);
     let changed;
     /** Merge-base ref used for changed-file discovery (null when files injected). */
     let discoveryBaseRef = null;
@@ -523,6 +528,17 @@ export function evaluateScopeProvenance(projectRoot, options = {}) {
                 return (n.includes("/approved-scope/") &&
                     (n.endsWith(`/${safe}.json`) || n.endsWith(`${safe}.json`)));
             });
+        const preimageRel = planId !== null ? approvedScopeIntentRel(planId) : null;
+        const preimageInGitChange = preimageRel !== null &&
+            [...changedSet].some((p) => {
+                const n = normalizeRepoRelPath(p);
+                if (n === preimageRel || n.endsWith(`/${preimageRel}`))
+                    return true;
+                if (planId === null)
+                    return false;
+                const safe = planId.replace(/[^a-zA-Z0-9._-]/g, "_");
+                return n.includes("/approved-scope/") && n.endsWith(`/${safe}.intent.json`);
+            });
         // Disk-only / concurrent-rewrite inference (#3205):
         // Authority is the *approval record on the merge base*, not whether the
         // active xBRIEF path existed there. pending→active leaves the active path
@@ -555,7 +571,7 @@ export function evaluateScopeProvenance(projectRoot, options = {}) {
                 }
             }
         }
-        const approvalRecordRewritten = approvalInGitChange || approvalDiskOnly;
+        const approvalRecordRewritten = approvalInGitChange || approvalDiskOnly || preimageInGitChange;
         const recordMatchesCurrent = approved !== null &&
             !approvalRecordRewritten &&
             approved.fileScopeDigest ===
@@ -570,11 +586,11 @@ export function evaluateScopeProvenance(projectRoot, options = {}) {
                 planId: planId ?? rel,
                 kind: "self-authorizing-scope-expansion",
                 expandedPaths: currentScope,
-                detail: "approved-scope record rewritten in the same change set as the active xBRIEF; " +
+                detail: "approved-scope record or preimage rewritten in the same change set as the active xBRIEF; " +
                     "cannot self-authorize via concurrent approval rewrite",
                 remediation: "Commit human approval via `task scope:record-approved-scope` on the merge base " +
                     "(or a prior PR), then activate/expand without rewriting the approval in this " +
-                    "change set. Same-PR approval rewrites do not authorize expansion (#3145 / #3205).",
+                    "change set. Same-PR approval rewrites do not authorize expansion (#3145 / #3205 / #3385).",
             });
             continue;
         }
@@ -586,6 +602,50 @@ export function evaluateScopeProvenance(projectRoot, options = {}) {
             enforce,
             renewedHumanApproval: renewed ?? (recordMatchesCurrent ? approved?.humanApproval : null),
         });
+        const readAtBase = (baseRel) => {
+            if (options.readAtBase !== undefined)
+                return options.readAtBase(baseRel);
+            if (discoveryBaseRef === null || discoveryBaseRef === "")
+                return null;
+            try {
+                return readRepoFileAtRef(root, discoveryBaseRef, baseRel);
+            }
+            catch {
+                return null;
+            }
+        };
+        const intentHits = evaluateIntentForXbrief({
+            projectRoot: root,
+            xbriefRelPath: rel,
+            liveRaw: raw,
+            livePayload: payload,
+            planId: planId ?? rel,
+            approved,
+            xbriefModified: modified,
+            approvalRewritten: approvalRecordRewritten,
+            preimageRewritten: preimageInGitChange,
+            currentScopeNonEmpty: normalizeFileScope(extractFileScope(payload)).length > 0,
+            baseRef: discoveryBaseRef,
+            changedFiles: changed,
+            readAtBase,
+            approvedReposSeed: options.approvedReposSeed,
+        });
+        for (const hit of intentHits) {
+            const mapped = {
+                xbriefRelPath: hit.xbriefRelPath,
+                planId: hit.planId,
+                kind: hit.kind,
+                expandedPaths: [],
+                detail: hit.detail,
+                remediation: hit.remediation,
+            };
+            if (hit.warnOnly) {
+                softFindings.push(mapped);
+            }
+            else {
+                findings.push(mapped);
+            }
+        }
         if (finding === null)
             continue;
         // Soft migration: body-only edits (empty file_scope) without digest when !enforce.

package/dist/scope-provenance/extract-intent.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Extract intent preimage from a live xBRIEF (#3376 R1–R5 / #3385 F1–F2).
+ *
+ * Unknown plan.* keys are extracted (pinned), not rejected. Known-machine keys
+ * are omitted. plan.tags is machine; plan.edges is extracted.
+ */
+import { GITHUB_ISSUE_REF_TYPES } from "../intake/reconcile-issues.js";
+import { INTENT_DIGEST_ALGO } from "./intent-digest.js";
+export declare const INTENT_PREIMAGE_SCHEMA: 1;
+export interface IntentPreimage {
+    readonly schemaVersion: typeof INTENT_PREIMAGE_SCHEMA;
+    readonly algo: typeof INTENT_DIGEST_ALGO;
+    readonly plan: Record<string, unknown>;
+    readonly approvedRepos: readonly string[];
+    /** Paths classified unknown at extract (for verify unclassified-key). */
+    readonly unknownPaths: readonly string[];
+}
+export interface ExtractIntentOk {
+    readonly ok: true;
+    readonly preimage: IntentPreimage;
+}
+export interface ExtractIntentErr {
+    readonly ok: false;
+    readonly error: string;
+}
+export type ExtractIntentResult = ExtractIntentOk | ExtractIntentErr;
+export interface ExtractIntentOptions {
+    readonly projectRoot?: string;
+    readonly approvedReposSeed?: readonly string[];
+    readonly readFile?: (absPath: string) => string | null;
+}
+export declare function slugFromGithubIssueUri(uri: string): string | null;
+export declare function resolveParentPlanId(planRef: string, projectRoot: string, readFile?: (absPath: string) => string | null): {
+    id: string;
+} | {
+    error: string;
+};
+/** Extract from a parsed payload (tokenizer already applied). */
+export declare function extractIntentFromPayload(payload: unknown, options?: ExtractIntentOptions): ExtractIntentResult;
+/** Parse raw text (duplicate-key reject) then extract. */
+export declare function extractIntentFromRaw(raw: string, options?: ExtractIntentOptions): ExtractIntentResult;
+export { GITHUB_ISSUE_REF_TYPES };
+//# sourceMappingURL=extract-intent.d.ts.map

package/dist/scope-provenance/extract-intent.js

@@ -0,0 +1,262 @@
+/**
+ * Extract intent preimage from a live xBRIEF (#3376 R1–R5 / #3385 F1–F2).
+ *
+ * Unknown plan.* keys are extracted (pinned), not rejected. Known-machine keys
+ * are omitted. plan.tags is machine; plan.edges is extracted.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { basename, join } from "node:path";
+import { GITHUB_ISSUE_REF_TYPES } from "../intake/reconcile-issues.js";
+import { stripArtifactSuffix } from "../layout/resolve.js";
+import { resolveParentPathFromRef } from "../scope/parent-lineage.js";
+import { extractPlanId } from "./digest.js";
+import { INTENT_DIGEST_ALGO } from "./intent-digest.js";
+import { parseJsonRejectingDuplicateKeys } from "./json-tokenizer.js";
+import { classifyItemKey, classifyPlanPath, classifyReferenceKey, ITEM_EXTRACT_KEYS, } from "./known-machine.js";
+export const INTENT_PREIMAGE_SCHEMA = 1;
+const ISSUE_URL_RE = /https?:\/\/(?:www\.)?github\.com\/([^/\s]+)\/([^/\s]+)\/issues\/(\d+)/i;
+export function slugFromGithubIssueUri(uri) {
+    const m = ISSUE_URL_RE.exec(uri);
+    if (m === null)
+        return null;
+    return `${m[1]}/${m[2]}`.toLowerCase();
+}
+function asRecord(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return null;
+    return value;
+}
+function itemId(item) {
+    return typeof item.id === "string" ? item.id : "";
+}
+function readText(abs, reader) {
+    if (reader !== undefined)
+        return reader(abs);
+    if (!existsSync(abs))
+        return null;
+    try {
+        return readFileSync(abs, "utf8");
+    }
+    catch {
+        return null;
+    }
+}
+export function resolveParentPlanId(planRef, projectRoot, readFile) {
+    const roots = [join(projectRoot, "xbrief"), join(projectRoot, "vbrief")];
+    for (const lifecycleRoot of roots) {
+        const resolved = resolveParentPathFromRef(planRef, lifecycleRoot);
+        if (resolved.path === null)
+            continue;
+        const raw = readText(resolved.path, readFile);
+        if (raw === null)
+            continue;
+        let payload;
+        try {
+            payload = JSON.parse(raw);
+        }
+        catch {
+            return { error: `unresolvable parent at mint: ${planRef} is not valid JSON` };
+        }
+        const id = extractPlanId(payload) ?? stripArtifactSuffix(basename(resolved.path));
+        if (id.trim().length === 0) {
+            return { error: `unresolvable parent at mint: ${planRef} has no plan.id` };
+        }
+        return { id: id.trim() };
+    }
+    return { error: `unresolvable parent at mint: ${planRef}` };
+}
+function extractReferences(refs) {
+    if (!Array.isArray(refs))
+        return { refs: [] };
+    const out = [];
+    for (const ref of refs) {
+        const rec = asRecord(ref);
+        if (rec === null)
+            continue;
+        const extracted = {};
+        for (const [key, value] of Object.entries(rec)) {
+            const cls = classifyReferenceKey(key);
+            if (cls === "machine")
+                continue;
+            extracted[key] = value;
+        }
+        out.push(extracted);
+    }
+    return { refs: out };
+}
+function extractItems(items, projectRoot, readFile, unknownPaths) {
+    if (!Array.isArray(items))
+        return { items: [] };
+    const out = [];
+    const ids = new Set();
+    for (const item of items) {
+        const rec = asRecord(item);
+        if (rec === null)
+            continue;
+        const extracted = {};
+        for (const key of ITEM_EXTRACT_KEYS) {
+            if (rec[key] !== undefined)
+                extracted[key] = rec[key];
+        }
+        for (const [key, value] of Object.entries(rec)) {
+            if (ITEM_EXTRACT_KEYS.includes(key))
+                continue;
+            const cls = classifyItemKey(key);
+            if (cls === "machine")
+                continue;
+            extracted[key] = value;
+            unknownPaths.push(`items[].${key}`);
+        }
+        if (typeof rec.planRef === "string" && rec.planRef.trim().length > 0) {
+            if (projectRoot === undefined) {
+                return { items: [], error: `unresolvable parent at mint: ${rec.planRef}` };
+            }
+            const parent = resolveParentPlanId(rec.planRef, projectRoot, readFile);
+            if ("error" in parent)
+                return { items: [], error: parent.error };
+            extracted.parentId = parent.id;
+        }
+        const id = itemId(extracted);
+        if (id.length > 0) {
+            if (ids.has(id)) {
+                return { items: [], error: `duplicate items[].id ${JSON.stringify(id)}` };
+            }
+            ids.add(id);
+        }
+        out.push(extracted);
+    }
+    out.sort((a, b) => itemId(a).localeCompare(itemId(b)));
+    return { items: out };
+}
+function copyUnknownSubtree(value) {
+    return value;
+}
+function extractMetadata(metadata, unknownPaths) {
+    const out = {};
+    for (const [key, value] of Object.entries(metadata)) {
+        const path = `metadata.${key}`;
+        const cls = classifyPlanPath(path);
+        if (cls === "machine")
+            continue;
+        if (key === "swarm") {
+            const swarm = asRecord(value);
+            if (swarm === null)
+                continue;
+            const swarmOut = {};
+            for (const [sKey, sVal] of Object.entries(swarm)) {
+                const sPath = `metadata.swarm.${sKey}`;
+                const sCls = classifyPlanPath(sPath);
+                if (sCls === "machine")
+                    continue;
+                swarmOut[sKey] = sVal;
+                if (sCls === "unknown")
+                    unknownPaths.push(sPath);
+            }
+            if (Object.keys(swarmOut).length > 0)
+                out.swarm = swarmOut;
+            continue;
+        }
+        if (cls === "unknown") {
+            out[key] = copyUnknownSubtree(value);
+            unknownPaths.push(path);
+            continue;
+        }
+        out[key] = value;
+    }
+    return out;
+}
+function seedApprovedRepos(seed, refs) {
+    const out = new Set();
+    for (const s of seed ?? []) {
+        const t = s.trim().toLowerCase();
+        if (t.includes("/"))
+            out.add(t);
+    }
+    for (const ref of refs) {
+        if (typeof ref.uri !== "string")
+            continue;
+        const slug = slugFromGithubIssueUri(ref.uri);
+        if (slug !== null)
+            out.add(slug);
+    }
+    return [...out].sort((a, b) => a.localeCompare(b));
+}
+/** Extract from a parsed payload (tokenizer already applied). */
+export function extractIntentFromPayload(payload, options = {}) {
+    const root = asRecord(payload);
+    if (root === null)
+        return { ok: false, error: "xBRIEF is not an object" };
+    const plan = asRecord(root.plan);
+    if (plan === null)
+        return { ok: false, error: "xBRIEF plan is missing" };
+    const unknownPaths = [];
+    const extracted = {};
+    if (typeof plan.planRef === "string" && plan.planRef.trim().length > 0) {
+        if (options.projectRoot === undefined) {
+            return { ok: false, error: `unresolvable parent at mint: ${plan.planRef}` };
+        }
+        const parent = resolveParentPlanId(plan.planRef, options.projectRoot, options.readFile);
+        if ("error" in parent)
+            return { ok: false, error: parent.error };
+        extracted.parentId = parent.id;
+    }
+    for (const [key, value] of Object.entries(plan)) {
+        const cls = classifyPlanPath(key);
+        if (cls === "machine")
+            continue;
+        if (key === "items") {
+            const items = extractItems(value, options.projectRoot, options.readFile, unknownPaths);
+            if (items.error !== undefined)
+                return { ok: false, error: items.error };
+            extracted.items = items.items;
+            continue;
+        }
+        if (key === "references") {
+            const refs = extractReferences(value);
+            if (refs.error !== undefined)
+                return { ok: false, error: refs.error };
+            extracted.references = refs.refs;
+            continue;
+        }
+        if (key === "metadata") {
+            const meta = asRecord(value);
+            if (meta === null)
+                continue;
+            const extractedMeta = extractMetadata(meta, unknownPaths);
+            if (Object.keys(extractedMeta).length > 0)
+                extracted.metadata = extractedMeta;
+            continue;
+        }
+        if (cls === "unknown") {
+            extracted[key] = copyUnknownSubtree(value);
+            unknownPaths.push(key);
+            continue;
+        }
+        extracted[key] = value;
+    }
+    const refs = Array.isArray(extracted.references)
+        ? extracted.references
+        : [];
+    const approvedRepos = seedApprovedRepos(options.approvedReposSeed, refs);
+    const uniqueUnknown = [...new Set(unknownPaths)].sort((a, b) => a.localeCompare(b));
+    return {
+        ok: true,
+        preimage: {
+            schemaVersion: INTENT_PREIMAGE_SCHEMA,
+            algo: INTENT_DIGEST_ALGO,
+            plan: extracted,
+            approvedRepos,
+            unknownPaths: uniqueUnknown,
+        },
+    };
+}
+/** Parse raw text (duplicate-key reject) then extract. */
+export function extractIntentFromRaw(raw, options = {}) {
+    const parsed = parseJsonRejectingDuplicateKeys(raw);
+    if (!parsed.ok) {
+        return { ok: false, error: parsed.error };
+    }
+    return extractIntentFromPayload(parsed.value, options);
+}
+export { GITHUB_ISSUE_REF_TYPES };
+//# sourceMappingURL=extract-intent.js.map

package/dist/scope-provenance/index.d.ts

@@ -1,6 +1,12 @@
 /**
  * scope-provenance package surface (#3145).
  */
-export { APPROVED_SCOPE_DIR, type ApprovedScopeRecord, approvedScopeDir, approvedScopeRecordPath, buildApprovedScopeRecord, computeFileScopeDigest, computeTextDigest, extractFileScope, extractPlanId, isHumanApprovalStamp, listApprovedScopeRecords, normalizeFileScope, readApprovedScopeRecord, scopeExpansion, writeApprovedScopeRecord, } from "./digest.js";
+export { compareExtractedIntent } from "./compare-intent.js";
+export { APPROVED_SCOPE_DIR, type ApprovedScopeRecord, approvedScopeDir, approvedScopeIntentPath, approvedScopeIntentRel, approvedScopeRecordPath, buildApprovedScopeRecord, computeFileScopeDigest, computeTextDigest, extractFileScope, extractPlanId, isHumanApprovalStamp, listApprovedScopeRecords, normalizeFileScope, readApprovedScopeRecord, scopeExpansion, writeApprovedScopeRecord, } from "./digest.js";
 export { baseApprovalAuthorizesCurrent, evaluateOneScopeProvenance, evaluateScopeProvenance, parseApprovedScopeRecordRaw, resolveDefaultBaseRef, type ScopeProvenanceFinding, type ScopeProvenanceOptions, type ScopeProvenanceResult, type ScopeProvenanceViolationKind, } from "./evaluate.js";
+export { extractIntentFromPayload, extractIntentFromRaw, GITHUB_ISSUE_REF_TYPES, type IntentPreimage, } from "./extract-intent.js";
+export { computeIntentDigest, INTENT_DIGEST_ALGO } from "./intent-digest.js";
+export { parseJsonRejectingDuplicateKeys } from "./json-tokenizer.js";
+export { allKnownMachineLeaves, KNOWN_MACHINE_WRITERS } from "./known-machine.js";
+export { mintApprovedScopeArtifacts, recoverApprovedScopePairs, recoverIncompleteApprovedScopePair, } from "./mint-artifacts.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/scope-provenance/index.js

@@ -1,6 +1,12 @@
 /**
  * scope-provenance package surface (#3145).
  */
-export { APPROVED_SCOPE_DIR, approvedScopeDir, approvedScopeRecordPath, buildApprovedScopeRecord, computeFileScopeDigest, computeTextDigest, extractFileScope, extractPlanId, isHumanApprovalStamp, listApprovedScopeRecords, normalizeFileScope, readApprovedScopeRecord, scopeExpansion, writeApprovedScopeRecord, } from "./digest.js";
+export { compareExtractedIntent } from "./compare-intent.js";
+export { APPROVED_SCOPE_DIR, approvedScopeDir, approvedScopeIntentPath, approvedScopeIntentRel, approvedScopeRecordPath, buildApprovedScopeRecord, computeFileScopeDigest, computeTextDigest, extractFileScope, extractPlanId, isHumanApprovalStamp, listApprovedScopeRecords, normalizeFileScope, readApprovedScopeRecord, scopeExpansion, writeApprovedScopeRecord, } from "./digest.js";
 export { baseApprovalAuthorizesCurrent, evaluateOneScopeProvenance, evaluateScopeProvenance, parseApprovedScopeRecordRaw, resolveDefaultBaseRef, } from "./evaluate.js";
+export { extractIntentFromPayload, extractIntentFromRaw, GITHUB_ISSUE_REF_TYPES, } from "./extract-intent.js";
+export { computeIntentDigest, INTENT_DIGEST_ALGO } from "./intent-digest.js";
+export { parseJsonRejectingDuplicateKeys } from "./json-tokenizer.js";
+export { allKnownMachineLeaves, KNOWN_MACHINE_WRITERS } from "./known-machine.js";
+export { mintApprovedScopeArtifacts, recoverApprovedScopePairs, recoverIncompleteApprovedScopePair, } from "./mint-artifacts.js";
 //# sourceMappingURL=index.js.map

package/dist/scope-provenance/intent-digest.d.ts

@@ -0,0 +1,12 @@
+/**
+ * intent-extract-v1 digest (#3376 R2 / #3385).
+ *
+ * sortKeysDeep, items[] by id (done at extract), NFC, compact stringify, sha256.
+ */
+export declare const INTENT_DIGEST_ALGO: "intent-extract-v1";
+export declare function nfcString(value: string): string;
+/** Deep-sort object keys and NFC-normalize strings. Arrays keep order. */
+export declare function sortKeysDeep(value: unknown): unknown;
+/** sha256 hex of the canonical preimage. */
+export declare function computeIntentDigest(preimage: unknown): string;
+//# sourceMappingURL=intent-digest.d.ts.map

package/dist/scope-provenance/intent-digest.js

@@ -0,0 +1,33 @@
+/**
+ * intent-extract-v1 digest (#3376 R2 / #3385).
+ *
+ * sortKeysDeep, items[] by id (done at extract), NFC, compact stringify, sha256.
+ */
+import { createHash } from "node:crypto";
+export const INTENT_DIGEST_ALGO = "intent-extract-v1";
+export function nfcString(value) {
+    return value.normalize("NFC");
+}
+/** Deep-sort object keys and NFC-normalize strings. Arrays keep order. */
+export function sortKeysDeep(value) {
+    if (typeof value === "string")
+        return nfcString(value);
+    if (Array.isArray(value))
+        return value.map(sortKeysDeep);
+    if (value !== null && typeof value === "object") {
+        const rec = value;
+        const out = {};
+        for (const key of Object.keys(rec).sort((a, b) => a.localeCompare(b))) {
+            out[key] = sortKeysDeep(rec[key]);
+        }
+        return out;
+    }
+    return value;
+}
+/** sha256 hex of the canonical preimage. */
+export function computeIntentDigest(preimage) {
+    const canonical = sortKeysDeep(preimage);
+    const payload = JSON.stringify(canonical);
+    return createHash("sha256").update(payload, "utf8").digest("hex");
+}
+//# sourceMappingURL=intent-digest.js.map

package/dist/scope-provenance/intent-evaluate.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Verify-time intent pin evaluation (#3376 R2–R6 / #3385).
+ *
+ * Reads base-committed record + preimage (never working-tree copies).
+ * Legacy records (no intentDigest) authorize paths only; intent edits warn.
+ * xbriefBodyDigest is never authority.
+ */
+import { type ApprovedScopeRecord } from "./digest.js";
+import { type IntentPreimage } from "./extract-intent.js";
+export type IntentViolationKind = "intent-drift" | "unclassified-key" | "intent-digest-mismatch" | "duplicate-key" | "duplicate-item-id" | "same-pr-intent-rewrite" | "first-activation-missing-intent-pin" | "legacy-intent-edit" | "intent-parse-error";
+export interface IntentFinding {
+    readonly kind: IntentViolationKind;
+    readonly planId: string;
+    readonly xbriefRelPath: string;
+    readonly detail: string;
+    readonly remediation: string;
+    readonly warnOnly: boolean;
+}
+export interface IntentEvaluateInput {
+    readonly projectRoot: string;
+    readonly xbriefRelPath: string;
+    readonly liveRaw: string;
+    readonly livePayload: unknown;
+    readonly planId: string;
+    readonly approved: ApprovedScopeRecord | null;
+    readonly xbriefModified: boolean;
+    readonly approvalRewritten: boolean;
+    readonly preimageRewritten: boolean;
+    readonly currentScopeNonEmpty: boolean;
+    readonly baseRef: string | null;
+    readonly changedFiles: readonly string[];
+    readonly readAtBase?: (relPath: string) => string | null;
+    readonly approvedReposSeed?: readonly string[];
+}
+export declare function parseIntentPreimageRaw(raw: string): IntentPreimage | null;
+/**
+ * Evaluate intent pin for one modified active xBRIEF.
+ * Returns [] when intent is not in play (unmodified, or nothing to check).
+ */
+export declare function evaluateIntentForXbrief(input: IntentEvaluateInput): IntentFinding[];
+/** Explicit: never treat xbriefBodyDigest as authority. */
+export declare function bodyDigestIsAuthority(_rec: ApprovedScopeRecord | null): false;
+//# sourceMappingURL=intent-evaluate.d.ts.map