@deftai/directive-core 0.108.0 → 0.109.0

package/dist/validate-content/deposit-required.js

@@ -0,0 +1,147 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+/**
+ * C1 declared deposit closure (#3601 / #3899).
+ *
+ * Required consumer-deposit paths are a closed typed declaration, not a
+ * regex over AGENTS.md RFC2119 prose. Existence checks reuse existsSync
+ * the same way validate-links.ts does, against a staged pack root (the
+ * prepack flatten), not the source checkout.
+ */
+export const DEPOSIT_REQUIRED_SCHEMA = "deft.deposit-required-paths.v1";
+export const DEPOSIT_REQUIRED_REL = "contracts/deposit-required-paths.json";
+export const DEPOSIT_PREFIX = ".deft/core/";
+/** Parser-visible field. Not a scan of ! / backtick paths. */
+const DEPOSIT_REQUIRED_COMMENT = /<!--\s*deposit-required:\s+(\S+)\s*-->/g;
+export function extractDepositRequiredComments(source) {
+    const out = [];
+    const re = new RegExp(DEPOSIT_REQUIRED_COMMENT.source, "g");
+    let match = re.exec(source);
+    while (match !== null) {
+        const path = match[1];
+        if (path !== undefined) {
+            out.push(path);
+        }
+        match = re.exec(source);
+    }
+    return out;
+}
+export function parseDepositRequiredDeclaration(jsonText) {
+    let _data;
+    let parsed;
+    try {
+        parsed = JSON.parse(jsonText);
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        throw new Error(`deposit-required: invalid JSON (${reason})`);
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new Error("deposit-required: expected an object");
+    }
+    const data = parsed;
+    if (data.schema !== DEPOSIT_REQUIRED_SCHEMA) {
+        throw new Error("deposit-required: expected schema " +
+            DEPOSIT_REQUIRED_SCHEMA +
+            ", got " +
+            String(data.schema));
+    }
+    if (!Array.isArray(data.paths) || data.paths.length === 0) {
+        throw new Error("deposit-required: paths must be a non-empty array of strings");
+    }
+    const paths = [];
+    for (const item of data.paths) {
+        if (typeof item !== "string" ||
+            !item.startsWith(DEPOSIT_PREFIX) ||
+            item.includes("\\") ||
+            item.includes("..")) {
+            throw new Error(`deposit-required: invalid path ${String(item)}`);
+        }
+        paths.push(item);
+    }
+    return { schema: DEPOSIT_REQUIRED_SCHEMA, paths };
+}
+export function packRelativeFromDepositPath(declared) {
+    if (!declared.startsWith(DEPOSIT_PREFIX)) {
+        throw new Error(`deposit-required: not a deposit path: ${declared}`);
+    }
+    return declared.slice(DEPOSIT_PREFIX.length);
+}
+/** Prepack mapping used by @deftai/directive-content. */
+export function sourcePathForPackRelative(repoRoot, packRelative) {
+    const rel = packRelative.replace(/\\/g, "/");
+    if (rel === "main.md" ||
+        rel === "SKILL.md" ||
+        rel === "Taskfile.yml" ||
+        rel.startsWith("tasks/") ||
+        rel.startsWith(".githooks/")) {
+        return join(repoRoot, ...rel.split("/"));
+    }
+    return join(repoRoot, "content", ...rel.split("/"));
+}
+export function evaluateDepositClosure(options) {
+    const missing = [];
+    for (const declared of options.paths) {
+        const rel = packRelativeFromDepositPath(declared);
+        const target = join(options.packRoot, ...rel.split("/"));
+        if (!existsSync(target)) {
+            missing.push(declared);
+        }
+    }
+    return { ok: missing.length === 0, missing, checked: options.paths.length };
+}
+export function loadDepositRequiredDeclaration(filePath) {
+    return parseDepositRequiredDeclaration(readFileSync(filePath, "utf8"));
+}
+export function resolveDeclarationFile(root) {
+    const underContent = join(root, "content", DEPOSIT_REQUIRED_REL);
+    if (existsSync(underContent)) {
+        return underContent;
+    }
+    const underRoot = join(root, DEPOSIT_REQUIRED_REL);
+    if (existsSync(underRoot)) {
+        return underRoot;
+    }
+    return null;
+}
+export function evaluateInstalledDepositClosure(projectRoot) {
+    const deftDir = join(projectRoot, ".deft", "core");
+    const declarationPath = resolveDeclarationFile(deftDir) ?? resolveDeclarationFile(projectRoot);
+    if (declarationPath === null) {
+        return { skipped: true, missing: [], declarationPath: null, error: null };
+    }
+    if (!existsSync(deftDir)) {
+        return { skipped: true, missing: [], declarationPath, error: null };
+    }
+    try {
+        const declaration = loadDepositRequiredDeclaration(declarationPath);
+        const result = evaluateDepositClosure({ packRoot: deftDir, paths: declaration.paths });
+        return { skipped: false, missing: result.missing, declarationPath, error: null };
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        return { skipped: false, missing: [], declarationPath, error: reason };
+    }
+}
+export function renderDeclaredDepositClosureLine(result) {
+    if (result.skipped) {
+        return "Deposit required-paths: skip -- no C1 declaration in this tree.";
+    }
+    if (result.error) {
+        return ("Deposit required-paths: fail -- could not read C1 declaration (" +
+            result.error +
+            "). Run directive update to refresh the deposit (#3601 C1).");
+    }
+    if (result.missing.length === 0) {
+        return "Deposit required-paths: ok -- declared C1 paths exist in .deft/core.";
+    }
+    const sample = result.missing.slice(0, 5).join(", ");
+    const extra = result.missing.length > 5 ? ` (+${String(result.missing.length - 5)} more)` : "";
+    return ("Deposit required-paths: fail -- " +
+        String(result.missing.length) +
+        " declared path(s) missing from .deft/core. Examples: " +
+        sample +
+        extra +
+        ". Run directive update to refresh the deposit (#3601 C1).");
+}
+//# sourceMappingURL=deposit-required.js.map

package/dist/validate-content/index.d.ts

@@ -1,5 +1,6 @@
 export { resolveCapacityAllocation } from "./capacity-policy.js";
 export { computeReport, renderReport } from "./capacity-show.js";
+export * as depositRequired from "./deposit-required.js";
 export { isDatePrefixedVbriefFilename } from "./filename.js";
 export { extractLinkTargets, shouldSkipLinkTarget } from "./link-parser.js";
 export * from "./types.js";

package/dist/validate-content/index.js

@@ -1,5 +1,6 @@
 export { resolveCapacityAllocation } from "./capacity-policy.js";
 export { computeReport, renderReport } from "./capacity-show.js";
+export * as depositRequired from "./deposit-required.js";
 export { isDatePrefixedVbriefFilename } from "./filename.js";
 export { extractLinkTargets, shouldSkipLinkTarget } from "./link-parser.js";
 export * from "./types.js";

package/dist/validate-content/validate-links.d.ts

@@ -18,8 +18,7 @@ export interface ValidateLinksOptions {
     readonly linkCheckStrict?: boolean;
     readonly argv?: readonly string[];
 }
-/**
- * Validate internal markdown links. Faithful to `scripts/validate-links.py`.
- */
+/** Collect broken internal markdown links under cwd. Used by packed-fixture tests (#3937). */
+export declare function collectBrokenLinks(cwd: string): BrokenLink[];
 export declare function evaluate(options?: ValidateLinksOptions): EvaluateResult;
 //# sourceMappingURL=validate-links.d.ts.map

package/dist/validate-content/validate-links.js

@@ -1,5 +1,6 @@
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join, relative, resolve, sep } from "node:path";
+import { evaluateLiveProcedureTargets, formatLiveProcedureFailure, } from "../deposit/live-procedure-targets.js";
 import { NON_PRODUCT_DIRS } from "../fs/non-product-dirs.js";
 import { extractLinkTargets, shouldSkipLinkTarget } from "./link-parser.js";
 /**
@@ -43,7 +44,8 @@ function collectMarkdownFiles(root) {
     walk(root, []);
     return out.sort();
 }
-function findBrokenLinks(cwd) {
+/** Collect broken internal markdown links under cwd. Used by packed-fixture tests (#3937). */
+export function collectBrokenLinks(cwd) {
     const broken = [];
     const root = resolve(cwd);
     for (const md of collectMarkdownFiles(root)) {
@@ -82,13 +84,38 @@ function findBrokenLinks(cwd) {
 /**
  * Validate internal markdown links. Faithful to `scripts/validate-links.py`.
  */
+function contentRootForC3(cwd) {
+    const underContent = join(cwd, "content");
+    return existsSync(underContent) ? underContent : cwd;
+}
+function extraMarkdownForC3(cwd) {
+    const extras = [];
+    for (const name of ["main.md", "SKILL.md"]) {
+        const absolutePath = join(cwd, name);
+        if (existsSync(absolutePath)) {
+            extras.push({ relativePath: name, absolutePath });
+        }
+    }
+    return extras;
+}
 export function evaluate(options = {}) {
     const cwd = resolve(options.cwd ?? ".");
     const strict = options.strict === true ||
         options.linkCheckStrict === true ||
         (options.argv ?? []).includes("--strict") ||
         process.env.LINK_CHECK_STRICT === "1";
-    const broken = findBrokenLinks(cwd);
+    const c3 = evaluateLiveProcedureTargets({
+        stagedRoot: contentRootForC3(cwd),
+        extraFiles: extraMarkdownForC3(cwd),
+    });
+    if (c3.uniqueTargets.length > 0) {
+        return {
+            code: 1,
+            message: formatLiveProcedureFailure(c3),
+            stream: "stdout",
+        };
+    }
+    const broken = collectBrokenLinks(cwd);
     if (broken.length === 0) {
         return {
             code: 0,

package/dist/vbrief-activate/activate.d.ts

@@ -6,8 +6,13 @@ export interface ActivateOptions {
     readonly now?: Date;
 }
 /**
- * Pure activator — returns ``{ exitCode, message }``. Faithful to
- * ``scripts/vbrief_activate.py::activate``.
+ * Pure activator -- returns ``{ exitCode, message }``. Ported from
+ * ``scripts/vbrief_activate.py::activate`` under the #1782 byte-identical
+ * parity contract, with one deliberate divergence: the Python oracle created a
+ * ``vBRIEFInfo`` when the artifact carried no envelope, and that behaviour is
+ * NOT preserved (#3933). Envelope handling now follows the shared lifecycle
+ * policy -- stamp whichever envelope exists, refuse an envelope-less artifact
+ * by name.
  */
 export declare function activate(vbriefPath: string, options?: ActivateOptions): ActivateResult;
 //# sourceMappingURL=activate.d.ts.map

package/dist/vbrief-activate/activate.js

@@ -2,6 +2,7 @@ import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, unli
 import { basename, dirname, resolve } from "node:path";
 import { containedWrite } from "../fs/contained-write.js";
 import { assertProjectionContained, ProjectionContainmentError, } from "../fs/projection-containment.js";
+import { BRIEF_ENVELOPE_KEYS, missingEnvelopeMessage, stampExistingEnvelopes, } from "../lifecycle/brief-envelope.js";
 import { evaluateEffortActivateGate } from "../scope/effort-activate-gate.js";
 import { utcNowIso } from "../scope/vbrief-json.js";
 import { pythonJsonPretty } from "../vbrief-build/json.js";
@@ -57,8 +58,13 @@ function loadVbrief(vbriefPath) {
     return { payload: payload, error: null };
 }
 /**
- * Pure activator — returns ``{ exitCode, message }``. Faithful to
- * ``scripts/vbrief_activate.py::activate``.
+ * Pure activator -- returns ``{ exitCode, message }``. Ported from
+ * ``scripts/vbrief_activate.py::activate`` under the #1782 byte-identical
+ * parity contract, with one deliberate divergence: the Python oracle created a
+ * ``vBRIEFInfo`` when the artifact carried no envelope, and that behaviour is
+ * NOT preserved (#3933). Envelope handling now follows the shared lifecycle
+ * policy -- stamp whichever envelope exists, refuse an envelope-less artifact
+ * by name.
  */
 export function activate(vbriefPath, options = {}) {
     const now = options.now ?? new Date();
@@ -143,19 +149,26 @@ export function activate(vbriefPath, options = {}) {
         }
         throw err;
     }
-    planObj.status = TARGET_STATUS;
-    let info = payload.vBRIEFInfo;
-    if (info === undefined) {
-        info = {};
-        payload.vBRIEFInfo = info;
+    for (const key of BRIEF_ENVELOPE_KEYS) {
+        if (!(key in payload)) {
+            continue;
+        }
+        const env = payload[key];
+        if (env === null || typeof env !== "object" || Array.isArray(env)) {
+            return {
+                exitCode: 1,
+                message: `vBRIEF at ${vbriefPath} has a non-object \`${key}\` -- malformed.`,
+            };
+        }
     }
-    if (info === null || typeof info !== "object" || Array.isArray(info)) {
-        return {
-            exitCode: 1,
-            message: `vBRIEF at ${vbriefPath} has a non-object \`vBRIEFInfo\` -- malformed.`,
-        };
+    // #3933: stamp the envelope the brief already carries; never create one. A
+    // manufactured version-less `vBRIEFInfo` wins schema resolution over a valid
+    // `xBRIEFInfo`, so the brief this verb just moved would fail validation.
+    const stampedEnvelopes = stampExistingEnvelopes(payload, utcNowIso(now));
+    if (stampedEnvelopes.length === 0) {
+        return { exitCode: 1, message: missingEnvelopeMessage(`vBRIEF at ${vbriefPath}`) };
     }
-    info.updated = utcNowIso(now);
+    planObj.status = TARGET_STATUS;
     try {
         mkdirSync(activeDir, { recursive: true });
     }

package/dist/verify-ac/evaluate.d.ts

@@ -44,6 +44,15 @@ export declare const VERIFY_AC_CHECK_ID_PREFIX = "verify:ac";
 export declare function verifyAcCheckId(scopeKey?: string | null): string;
 /** Test seam: isolate stdout-dest buffer across cases. */
 export declare function resetInProcessVerificationBuffer(): void;
+/**
+ * Product-oracle outcome for one acceptance walk (#3615).
+ *
+ * A safety refusal is not a measurement. All-refused walks emit nothing.
+ * Mixed refused + executed-pass walks emit nothing (filtering refusals then
+ * classifying the remainder would be a false green). Any executed fail still
+ * emits fail. flag.ts is unchanged.
+ */
+export declare function productOracleOutcomeForWalk(runs: readonly LiteralAcceptanceRunResult[]): "pass" | "fail" | null;
 /**
  * Record one walk-level verification event for the executed command set (#3322 / #3397).
  * Fail and pass use the same method_fingerprint shape (command list + cwd hash).

package/dist/verify-ac/evaluate.js

@@ -10,6 +10,7 @@
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
+import { isSafetyRefusalRun } from "../literal-acceptance/run.js";
 import { parseRunSummaryJsonl, RunSummaryEmitter, resolveRunSummaryDestination, } from "../run-summary/index.js";
 import { flagPassAfterFailWithMethodChange, readVerificationAttempts, unresolvedMethodChangePasses, } from "./flag.js";
 function formatUnresolved(flag) {
@@ -57,6 +58,25 @@ function inProcessVerificationText() {
     }
     return inProcessVerificationLines.join("\n");
 }
+/**
+ * Product-oracle outcome for one acceptance walk (#3615).
+ *
+ * A safety refusal is not a measurement. All-refused walks emit nothing.
+ * Mixed refused + executed-pass walks emit nothing (filtering refusals then
+ * classifying the remainder would be a false green). Any executed fail still
+ * emits fail. flag.ts is unchanged.
+ */
+export function productOracleOutcomeForWalk(runs) {
+    const refused = runs.filter(isSafetyRefusalRun);
+    const executed = runs.filter((run) => !isSafetyRefusalRun(run));
+    if (executed.length === 0) {
+        return null;
+    }
+    if (refused.length > 0 && executed.every((run) => run.ok)) {
+        return null;
+    }
+    return executed.every((run) => run.ok) ? "pass" : "fail";
+}
 /**
  * Record one walk-level verification event for the executed command set (#3322 / #3397).
  * Fail and pass use the same method_fingerprint shape (command list + cwd hash).
@@ -69,6 +89,10 @@ export function emitVerifyAcAttempts(options) {
     if (options.runs.length === 0) {
         return;
     }
+    const outcome = productOracleOutcomeForWalk(options.runs);
+    if (outcome === null) {
+        return;
+    }
     try {
         const env = options.env ?? process.env;
         const projectRoot = resolve(options.projectRoot);
@@ -85,16 +109,15 @@ export function emitVerifyAcAttempts(options) {
             component: "verify-ac",
             writeStdout: options.writeStdout,
         });
-        // One walk-level event: the method is the command set, not each command.
-        // Per-command emit was blind to a shrinking list that kept the first command (#3397).
-        const commands = options.runs.map((run) => run.command);
-        const firstCwd = options.runs[0]?.cwd ?? "";
-        // Hash the cwd key (joined only when cwds differ) so cwd paths never enter
-        // the fingerprint; commandCountFromFingerprint can still count commands.
-        const cwdKey = options.runs.every((run) => run.cwd === firstCwd)
+        // Method identity is the executed command set. Refused rows are not
+        // measurements; including them would make a later same-command product
+        // fix look like a method change (#3615 Greptile P1).
+        const executed = options.runs.filter((run) => !isSafetyRefusalRun(run));
+        const commands = executed.map((run) => run.command);
+        const firstCwd = executed[0]?.cwd ?? "";
+        const cwdKey = executed.every((run) => run.cwd === firstCwd)
             ? firstCwd
-            : options.runs.map((run) => run.cwd).join("\0");
-        const outcome = options.runs.every((run) => run.ok) ? "pass" : "fail";
+            : executed.map((run) => run.cwd).join("\0");
         const emitted = emitter.emitVerification({
             check_id: checkId,
             method_fingerprint: methodFingerprintForWalk(commands, cwdKey),

package/dist/verify-source/deposit-closure.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Check 1 -- staged-pack deposit closure (#3900 / #3601 C1).
+ *
+ * Resolves the C1 declaration against a staged pack root. Does not infer
+ * required paths from AGENTS.md prose. Reuses evaluateDepositClosure.
+ *
+ * Three-state: 0 clean / 1 missing declared paths / 2 config.
+ */
+import { type DepositClosureResult, type DepositRequiredDeclaration } from "../validate-content/deposit-required.js";
+export interface StagedDepositClosureResult {
+    readonly code: 0 | 1 | 2;
+    readonly message: string;
+    readonly stream: "stdout" | "stderr";
+    readonly missing: readonly string[];
+    readonly checked: number;
+}
+/** Copy declared C1 paths into dest using the content-package mapping. */
+export declare function stageDeclaredPack(repoRoot: string, destPackRoot: string): DepositRequiredDeclaration;
+export declare function formatStagedDepositClosureLine(result: DepositClosureResult): string;
+export declare function evaluateStagedDepositClosure(packRoot: string, paths: readonly string[]): StagedDepositClosureResult;
+export declare function evaluateDepositClosureFromRepo(repoRoot: string): StagedDepositClosureResult;
+export declare function evaluateDepositClosureAtRoot(root: string, packRootExplicit: boolean): StagedDepositClosureResult;
+//# sourceMappingURL=deposit-closure.d.ts.map

package/dist/verify-source/deposit-closure.js

@@ -0,0 +1,162 @@
+/**
+ * Check 1 -- staged-pack deposit closure (#3900 / #3601 C1).
+ *
+ * Resolves the C1 declaration against a staged pack root. Does not infer
+ * required paths from AGENTS.md prose. Reuses evaluateDepositClosure.
+ *
+ * Three-state: 0 clean / 1 missing declared paths / 2 config.
+ */
+import { cpSync, existsSync, mkdirSync, mkdtempSync, rmSync, statSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { evaluateDepositClosure, loadDepositRequiredDeclaration, packRelativeFromDepositPath, resolveDeclarationFile, sourcePathForPackRelative, } from "../validate-content/deposit-required.js";
+const EXIT_OK = 0;
+const EXIT_MISSING = 1;
+const EXIT_CONFIG = 2;
+const REMEDIATION = "Recovery: restore the declared files in content/ (or root harness files) so they survive content-package prepack. Do not infer paths from AGENTS.md prose (#3601 C1 / #3900).";
+function keepPackFile(src) {
+    const posix = src.replace(/\\/g, "/");
+    if (posix.includes("__pycache__"))
+        return false;
+    if (posix.endsWith(".pyc") || posix.endsWith(".py"))
+        return false;
+    return true;
+}
+/** Copy declared C1 paths into dest using the content-package mapping. */
+export function stageDeclaredPack(repoRoot, destPackRoot) {
+    const declarationPath = resolveDeclarationFile(repoRoot);
+    if (declarationPath === null) {
+        throw new Error("deposit-closure: C1 declaration missing (contracts/deposit-required-paths.json).");
+    }
+    const declaration = loadDepositRequiredDeclaration(declarationPath);
+    mkdirSync(destPackRoot, { recursive: true });
+    for (const declared of declaration.paths) {
+        const rel = packRelativeFromDepositPath(declared);
+        const from = sourcePathForPackRelative(repoRoot, rel);
+        if (!existsSync(from)) {
+            continue;
+        }
+        if (!keepPackFile(from)) {
+            continue;
+        }
+        const to = join(destPackRoot, ...rel.split("/"));
+        mkdirSync(dirname(to), { recursive: true });
+        cpSync(from, to);
+    }
+    return declaration;
+}
+export function formatStagedDepositClosureLine(result) {
+    if (result.ok) {
+        return ("Deposit required-paths: ok -- " +
+            String(result.checked) +
+            " declared C1 path(s) exist in the staged pack.");
+    }
+    const sample = result.missing.slice(0, 5).join(", ");
+    const extra = result.missing.length > 5 ? " (+" + String(result.missing.length - 5) + " more)" : "";
+    return ("Deposit required-paths: fail -- " +
+        String(result.missing.length) +
+        " declared path(s) missing from staged pack. Examples: " +
+        sample +
+        extra +
+        ". " +
+        REMEDIATION);
+}
+export function evaluateStagedDepositClosure(packRoot, paths) {
+    const root = resolve(packRoot);
+    let isDir = false;
+    try {
+        isDir = statSync(root).isDirectory();
+    }
+    catch {
+        isDir = false;
+    }
+    if (!isDir) {
+        return {
+            code: EXIT_CONFIG,
+            message: "verify_deposit_closure: --pack-root is not a directory: " +
+                root +
+                "\n  Recovery: pass a staged pack root or framework checkout.",
+            stream: "stderr",
+            missing: [],
+            checked: 0,
+        };
+    }
+    const result = evaluateDepositClosure({ packRoot: root, paths });
+    if (result.ok) {
+        return {
+            code: EXIT_OK,
+            message: formatStagedDepositClosureLine(result),
+            stream: "stdout",
+            missing: result.missing,
+            checked: result.checked,
+        };
+    }
+    return {
+        code: EXIT_MISSING,
+        message: formatStagedDepositClosureLine(result),
+        stream: "stderr",
+        missing: result.missing,
+        checked: result.checked,
+    };
+}
+export function evaluateDepositClosureFromRepo(repoRoot) {
+    const root = resolve(repoRoot);
+    const declarationPath = resolveDeclarationFile(root);
+    if (declarationPath === null) {
+        return {
+            code: EXIT_CONFIG,
+            message: "verify_deposit_closure: C1 declaration missing.\n  Recovery: add content/contracts/deposit-required-paths.json (#3601 C1).",
+            stream: "stderr",
+            missing: [],
+            checked: 0,
+        };
+    }
+    const tmp = mkdtempSync(join(tmpdir(), "deft-3900-pack-"));
+    try {
+        const declaration = stageDeclaredPack(root, tmp);
+        return evaluateStagedDepositClosure(tmp, declaration.paths);
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        return {
+            code: EXIT_CONFIG,
+            message: "verify_deposit_closure: " + reason + "\n  " + REMEDIATION,
+            stream: "stderr",
+            missing: [],
+            checked: 0,
+        };
+    }
+    finally {
+        rmSync(tmp, { recursive: true, force: true });
+    }
+}
+export function evaluateDepositClosureAtRoot(root, packRootExplicit) {
+    if (packRootExplicit) {
+        const declarationPath = resolveDeclarationFile(root);
+        if (declarationPath === null) {
+            return {
+                code: EXIT_CONFIG,
+                message: "verify_deposit_closure: C1 declaration missing under the given pack root.\n  Recovery: stage contracts/deposit-required-paths.json with the pack (#3601 C1).",
+                stream: "stderr",
+                missing: [],
+                checked: 0,
+            };
+        }
+        try {
+            const declaration = loadDepositRequiredDeclaration(declarationPath);
+            return evaluateStagedDepositClosure(root, declaration.paths);
+        }
+        catch (err) {
+            const reason = err instanceof Error ? err.message : String(err);
+            return {
+                code: EXIT_CONFIG,
+                message: "verify_deposit_closure: " + reason + "\n  " + REMEDIATION,
+                stream: "stderr",
+                missing: [],
+                checked: 0,
+            };
+        }
+    }
+    return evaluateDepositClosureFromRepo(root);
+}
+//# sourceMappingURL=deposit-closure.js.map

package/dist/verify-source/index.d.ts

@@ -5,10 +5,12 @@ export * from "./contained-writes.js";
 export * from "./content-manifest.js";
 export { CANONICAL_SCHEMA_REL, type ContractDriftOptions, type ContractDriftResult, evaluateContractDrift, PUBLISHED_SCHEMA_REL, } from "./contract-drift.js";
 export * from "./cursor-tier1.js";
+export * from "./deposit-closure.js";
 export * from "./openclaw-tier1.js";
 export * from "./python-call-scan.js";
 export * from "./rule-ownership-lint.js";
 export * from "./scm-boundary.js";
+export * from "./semantic-single-source.js";
 export * from "./skill-external-fetch-gate.js";
 export * from "./verify-stubs.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/verify-source/index.js

@@ -5,10 +5,12 @@ export * from "./contained-writes.js";
 export * from "./content-manifest.js";
 export { CANONICAL_SCHEMA_REL, evaluateContractDrift, PUBLISHED_SCHEMA_REL, } from "./contract-drift.js";
 export * from "./cursor-tier1.js";
+export * from "./deposit-closure.js";
 export * from "./openclaw-tier1.js";
 export * from "./python-call-scan.js";
 export * from "./rule-ownership-lint.js";
 export * from "./scm-boundary.js";
+export * from "./semantic-single-source.js";
 export * from "./skill-external-fetch-gate.js";
 export * from "./verify-stubs.js";
 //# sourceMappingURL=index.js.map

package/dist/verify-source/semantic-single-source.d.ts

@@ -0,0 +1,36 @@
+/**
+ * C2 — semantic single-source conformance (#3600 / #3899).
+ *
+ * Shipped guidance must name one value where the framework has one value.
+ * The 0.6-versus-0.8 defect lives inside a file that resolves perfectly, so
+ * pointer existence (C1) cannot see it. This oracle is not a link checker.
+ *
+ * Evaluates a staged pack root (flattened consumer deposit) or a source
+ * checkout (content/ prefix + root main.md). Three-state: 0 clean / 1 drift / 2 config.
+ */
+/** Closed, typed current-authoring surfaces (#3600 AC / #3899 C2). */
+export declare const C2_AUTHORING_SURFACES: readonly ["main.md", "skills/deft-directive-setup/SKILL.md", "skills/deft-directive-build/SKILL.md", "skills/deft-directive-interview/SKILL.md", "skills/deft-directive-refinement/SKILL.md", "skills/deft-directive-sync/SKILL.md", "templates/project.md.template", "templates/make-spec.md", "conventions/references.md", "commands.md"];
+export type C2AuthoringSurface = (typeof C2_AUTHORING_SURFACES)[number];
+export interface SemanticSingleSourceViolation {
+    readonly path: string;
+    readonly line: number;
+    readonly version: string;
+    readonly excerpt: string;
+}
+export interface SemanticSingleSourceResult {
+    readonly code: 0 | 1 | 2;
+    readonly message: string;
+    readonly stream: "stdout" | "stderr";
+    readonly setupWriteVersion: string | null;
+    readonly violations: readonly SemanticSingleSourceViolation[];
+    readonly currentWriteVersions: readonly string[];
+}
+/**
+ * Resolve a closed-list surface against a flattened pack root or a source
+ * checkout (content/ prefix for everything except root harness main.md).
+ */
+export declare function resolveAuthoringSurface(packRoot: string, rel: string): string | null;
+export declare function extractQuotedVersions(line: string): string[];
+export declare function extractSetupWriteVersion(setupText: string): string | null;
+export declare function evaluateSemanticSingleSource(packRoot: string): SemanticSingleSourceResult;
+//# sourceMappingURL=semantic-single-source.d.ts.map