@deftai/directive-core 0.79.3 → 0.80.0

package/dist/init-deposit/agent-hooks.js

@@ -1,8 +1,8 @@
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { assertDepositContained } from "../deposit/contain.js";
-import { DIRECT_WRITE_TOOL_NAMES } from "../hooks/tools.js";
-export const DIRECT_WRITE_HOOK_MATCHER = DIRECT_WRITE_TOOL_NAMES.join("|");
+import { DIRECT_WRITE_HOOK_MATCHER, SPAWN_HOOK_MATCHER } from "../hooks/tools.js";
+export { DIRECT_WRITE_HOOK_MATCHER, SPAWN_HOOK_MATCHER } from "../hooks/tools.js";
 export const DEFT_HOOK_COMMAND_MARKER = "deft hook:dispatch";
 export const AGENT_HOOK_PATHS = [
     ".claude/settings.json",
@@ -67,9 +67,9 @@ function isManagedCursorEntry(value) {
     const entry = object(value);
     return typeof entry?.command === "string" && entry.command.includes(DEFT_HOOK_COMMAND_MARKER);
 }
-function nestedGroup(host, event) {
+function nestedGroup(host, event, matcher) {
     return {
-        ...(event === "tool.before" ? { matcher: DIRECT_WRITE_HOOK_MATCHER } : {}),
+        ...(event === "tool.before" && matcher !== undefined ? { matcher } : {}),
         hooks: [
             {
                 type: "command",
@@ -79,18 +79,29 @@ function nestedGroup(host, event) {
         ],
     };
 }
-function mergeNestedConfig(config, path, host) {
+function mergeNestedConfig(config, path, host, options = {}) {
     const hooks = hooksObject(config, path);
     const session = eventArray(hooks, "SessionStart", path).filter((entry) => !isManagedNestedGroup(entry));
     const preTool = eventArray(hooks, "PreToolUse", path).filter((entry) => !isManagedNestedGroup(entry));
     hooks.SessionStart = [...session, nestedGroup(host, "session.start")];
-    hooks.PreToolUse = [...preTool, nestedGroup(host, "tool.before")];
+    hooks.PreToolUse = [
+        ...preTool,
+        nestedGroup(host, "tool.before", DIRECT_WRITE_HOOK_MATCHER),
+        nestedGroup(host, "tool.before", SPAWN_HOOK_MATCHER),
+    ];
+    if (options.compact) {
+        const preCompact = eventArray(hooks, "PreCompact", path).filter((entry) => !isManagedNestedGroup(entry));
+        const postCompact = eventArray(hooks, "PostCompact", path).filter((entry) => !isManagedNestedGroup(entry));
+        hooks.PreCompact = [...preCompact, nestedGroup(host, "session.compact")];
+        hooks.PostCompact = [...postCompact, nestedGroup(host, "session.compact")];
+    }
     return { ...config, hooks };
 }
 function mergeCursorConfig(config, path) {
     const hooks = hooksObject(config, path);
     const session = eventArray(hooks, "sessionStart", path).filter((entry) => !isManagedCursorEntry(entry));
     const preTool = eventArray(hooks, "preToolUse", path).filter((entry) => !isManagedCursorEntry(entry));
+    const preCompact = eventArray(hooks, "preCompact", path).filter((entry) => !isManagedCursorEntry(entry));
     hooks.sessionStart = [...session, { command: command("cursor", "session.start"), timeout: 5 }];
     hooks.preToolUse = [
         ...preTool,
@@ -100,7 +111,14 @@ function mergeCursorConfig(config, path) {
             failClosed: true,
             timeout: 5,
         },
+        {
+            command: command("cursor", "tool.before"),
+            matcher: SPAWN_HOOK_MATCHER,
+            failClosed: true,
+            timeout: 5,
+        },
     ];
+    hooks.preCompact = [...preCompact, { command: command("cursor", "session.compact"), timeout: 5 }];
     return { ...config, version: 1, hooks };
 }
 function writeJsonIfChanged(path, payload) {
@@ -119,16 +137,16 @@ export function writeAgentHookDeposit(projectRoot, io = { printf: () => undefine
     const definitions = [
         {
             path: AGENT_HOOK_PATHS[0],
-            merge: (config, path) => mergeNestedConfig(config, path, "claude"),
+            merge: (config, path) => mergeNestedConfig(config, path, "claude", { compact: true }),
         },
         {
             path: AGENT_HOOK_PATHS[1],
-            merge: (config, path) => mergeNestedConfig(config, path, "grok"),
+            merge: (config, path) => mergeNestedConfig(config, path, "grok", { compact: true }),
         },
         { path: AGENT_HOOK_PATHS[2], merge: mergeCursorConfig },
         {
             path: AGENT_HOOK_PATHS[3],
-            merge: (config, path) => mergeNestedConfig(config, path, "codex"),
+            merge: (config, path) => mergeNestedConfig(config, path, "codex", { compact: false }),
         },
     ];
     const prepared = definitions.map((definition) => {
@@ -150,7 +168,7 @@ export function writeAgentHookDeposit(projectRoot, io = { printf: () => undefine
     }
     return { changed: changedPaths.length > 0, changedPaths };
 }
-function hasNestedRegistration(config, host) {
+function hasNestedRegistration(config, host, options = {}) {
     const hooks = object(config.hooks);
     if (hooks === null)
         return false;
@@ -158,11 +176,24 @@ function hasNestedRegistration(config, host) {
     const preTool = Array.isArray(hooks.PreToolUse) ? hooks.PreToolUse : [];
     const sessionCommand = command(host, "session.start");
     const toolCommand = command(host, "tool.before");
-    return (session.some((entry) => nestedCommands(entry).includes(sessionCommand)) &&
+    const compactCommand = command(host, "session.compact");
+    const base = session.some((entry) => nestedCommands(entry).includes(sessionCommand)) &&
         preTool.some((entry) => {
             const group = object(entry);
             return (group?.matcher === DIRECT_WRITE_HOOK_MATCHER && nestedCommands(entry).includes(toolCommand));
-        }));
+        }) &&
+        preTool.some((entry) => {
+            const group = object(entry);
+            return group?.matcher === SPAWN_HOOK_MATCHER && nestedCommands(entry).includes(toolCommand);
+        });
+    if (!base)
+        return false;
+    if (!options.compact)
+        return true;
+    const preCompact = Array.isArray(hooks.PreCompact) ? hooks.PreCompact : [];
+    const postCompact = Array.isArray(hooks.PostCompact) ? hooks.PostCompact : [];
+    return (preCompact.some((entry) => nestedCommands(entry).includes(compactCommand)) &&
+        postCompact.some((entry) => nestedCommands(entry).includes(compactCommand)));
 }
 function hasCursorRegistration(config) {
     const hooks = object(config.hooks);
@@ -170,13 +201,21 @@ function hasCursorRegistration(config) {
         return false;
     const session = Array.isArray(hooks.sessionStart) ? hooks.sessionStart : [];
     const preTool = Array.isArray(hooks.preToolUse) ? hooks.preToolUse : [];
+    const preCompact = Array.isArray(hooks.preCompact) ? hooks.preCompact : [];
     return (session.some((entry) => object(entry)?.command === command("cursor", "session.start")) &&
         preTool.some((entry) => {
             const hook = object(entry);
             return (hook?.command === command("cursor", "tool.before") &&
                 hook.matcher === DIRECT_WRITE_HOOK_MATCHER &&
                 hook.failClosed === true);
-        }));
+        }) &&
+        preTool.some((entry) => {
+            const hook = object(entry);
+            return (hook?.command === command("cursor", "tool.before") &&
+                hook.matcher === SPAWN_HOOK_MATCHER &&
+                hook.failClosed === true);
+        }) &&
+        preCompact.some((entry) => object(entry)?.command === command("cursor", "session.compact")));
 }
 /** Read-only registration probe shared by verify and doctor. */
 export function inspectAgentHookDeposit(projectRoot) {
@@ -184,28 +223,40 @@ export function inspectAgentHookDeposit(projectRoot) {
         {
             host: "claude",
             path: AGENT_HOOK_PATHS[0],
-            valid: (config) => hasNestedRegistration(config, "claude"),
+            compactSupport: "deposited",
+            valid: (config) => hasNestedRegistration(config, "claude", { compact: true }),
         },
         {
             host: "grok",
             path: AGENT_HOOK_PATHS[1],
-            valid: (config) => hasNestedRegistration(config, "grok"),
+            compactSupport: "deposited",
+            valid: (config) => hasNestedRegistration(config, "grok", { compact: true }),
+        },
+        {
+            host: "cursor",
+            path: AGENT_HOOK_PATHS[2],
+            compactSupport: "deposited",
+            valid: hasCursorRegistration,
         },
-        { host: "cursor", path: AGENT_HOOK_PATHS[2], valid: hasCursorRegistration },
         {
             host: "codex",
             path: AGENT_HOOK_PATHS[3],
-            valid: (config) => hasNestedRegistration(config, "codex"),
+            compactSupport: "unsupported",
+            valid: (config) => hasNestedRegistration(config, "codex", { compact: false }),
         },
     ];
     return definitions.map((definition) => {
         const absolute = join(projectRoot, definition.path);
+        const compactNote = definition.compactSupport === "unsupported"
+            ? " Compact re-arm is not deposited for Codex (no native compact hook surface)."
+            : " PreCompact/PostCompact or preCompact compact re-arm is deposited.";
         if (!existsSync(absolute)) {
             return {
                 host: definition.host,
                 path: definition.path,
                 status: "missing",
-                detail: `${definition.path} is missing.`,
+                compactSupport: definition.compactSupport,
+                detail: `${definition.path} is missing.${compactNote}`,
             };
         }
         try {
@@ -215,14 +266,18 @@ export function inspectAgentHookDeposit(projectRoot) {
                     host: definition.host,
                     path: definition.path,
                     status: "healthy",
-                    detail: "SessionStart and direct-write PreToolUse registrations are current.",
+                    compactSupport: definition.compactSupport,
+                    detail: "SessionStart, direct-write + spawn PreToolUse, and compact re-arm registrations are current." +
+                        (definition.compactSupport === "unsupported" ? compactNote : ""),
                 };
             }
             return {
                 host: definition.host,
                 path: definition.path,
                 status: "drifted",
-                detail: "Directive SessionStart or direct-write PreToolUse registration is missing/drifted.",
+                compactSupport: definition.compactSupport,
+                detail: "Directive SessionStart, direct-write/spawn PreToolUse, or compact re-arm registration is missing/drifted." +
+                    compactNote,
             };
         }
         catch (cause) {
@@ -230,7 +285,8 @@ export function inspectAgentHookDeposit(projectRoot) {
                 host: definition.host,
                 path: definition.path,
                 status: "drifted",
-                detail: String(cause),
+                compactSupport: definition.compactSupport,
+                detail: `${String(cause)}${compactNote}`,
             };
         }
     });

package/dist/init-deposit/xbrief-projections.d.ts

@@ -5,6 +5,13 @@
  * freshness. A current `.deft/core/VERSION` therefore cannot short-circuit
  * these repairs.
  */
+/** Rewrite legacy vbrief/.eval description paths for xbrief/schemas projection (#2670). */
+export declare function rewriteProjectedSchemaContent(content: string): string;
+/**
+ * Fail closed when a projected xbrief/schemas file still cites vbrief/.eval/.
+ * Upstream vbrief/schemas/ may keep legacy paths; consumer copies must not (#2670).
+ */
+export declare function assertProjectedSchemaDescriptionsRooted(projectDir: string, destinationDir: string): void;
 /**
  * Synchronize framework-owned xBRIEF schemas while preserving unknown consumer
  * files. The obsolete v0.6 root schema is the only destination-only file this

package/dist/init-deposit/xbrief-projections.js

@@ -13,6 +13,10 @@ import { DEV_FALLBACK } from "../platform/constants.js";
 import { MIGRATED_ARTIFACT_DIR } from "../xbrief-migrate/constants.js";
 const OBSOLETE_CORE_SCHEMA = "vbrief-core.schema.json";
 const CURRENT_CORE_SCHEMA = "xbrief-core-0.8.schema.json";
+/** Legacy lifecycle eval prefix in framework vbrief/schemas source copies. */
+const LEGACY_EVAL_PATH_PREFIX = "vbrief/.eval/";
+/** Consumer xbrief/schemas projection must root description paths here (#2670). */
+const XBRIEF_EVAL_PATH_PREFIX = "xbrief/.eval/";
 function normalizeVersion(version) {
     return version.trim().replace(/^v/, "");
 }
@@ -39,6 +43,28 @@ function collectSchemaFiles(root, dir = root, files = []) {
     }
     return files;
 }
+/** Rewrite legacy vbrief/.eval description paths for xbrief/schemas projection (#2670). */
+export function rewriteProjectedSchemaContent(content) {
+    return content.includes(LEGACY_EVAL_PATH_PREFIX)
+        ? content.replaceAll(LEGACY_EVAL_PATH_PREFIX, XBRIEF_EVAL_PATH_PREFIX)
+        : content;
+}
+/**
+ * Fail closed when a projected xbrief/schemas file still cites vbrief/.eval/.
+ * Upstream vbrief/schemas/ may keep legacy paths; consumer copies must not (#2670).
+ */
+export function assertProjectedSchemaDescriptionsRooted(projectDir, destinationDir) {
+    assertProjectionContained(projectDir, destinationDir);
+    if (!isDirectory(destinationDir))
+        return;
+    for (const rel of collectSchemaFiles(destinationDir)) {
+        const full = join(destinationDir, rel);
+        const text = readFileSync(full, "utf8");
+        if (text.includes(LEGACY_EVAL_PATH_PREFIX)) {
+            throw new Error(`projected xbrief schema still cites ${LEGACY_EVAL_PATH_PREFIX}: ${join(MIGRATED_ARTIFACT_DIR, "schemas", rel)}`);
+        }
+    }
+}
 function writeFileIfChanged(projectDir, target, content) {
     assertProjectionContained(projectDir, target);
     const desired = Buffer.isBuffer(content) ? content : Buffer.from(content, "utf8");
@@ -73,7 +99,8 @@ export function syncConsumerXbriefSchemas(projectDir, deftDir) {
             continue;
         const source = join(sourceDir, rel);
         const destination = join(destinationDir, rel);
-        changed = writeFileIfChanged(projectDir, destination, readFileSync(source)) || changed;
+        const projected = rewriteProjectedSchemaContent(readFileSync(source, "utf8"));
+        changed = writeFileIfChanged(projectDir, destination, projected) || changed;
     }
     const obsoleteDestination = join(destinationDir, OBSOLETE_CORE_SCHEMA);
     assertProjectionContained(projectDir, obsoleteDestination);
@@ -81,6 +108,7 @@ export function syncConsumerXbriefSchemas(projectDir, deftDir) {
         rmSync(obsoleteDestination, { force: true });
         changed = true;
     }
+    assertProjectedSchemaDescriptionsRooted(projectDir, destinationDir);
     return changed;
 }
 function syncBareVersionMarkerWithPolicy(projectDir, version, allowRootFallback) {

package/dist/integration-e2e/bootstrap-cache-module.d.ts

@@ -1,5 +1,3 @@
-import type { FetchAllReportImpl } from "../cache/fetch.js";
-import type { CacheModule } from "../triage/bootstrap/types.js";
-/** Adapt TS cache reports to the bootstrap `FetchAllReport` shape. */
-export declare function bootstrapCacheModule(cacheFetchAll: (options: Parameters<typeof import("../cache/fetch.js").cacheFetchAll>[0]) => FetchAllReportImpl): CacheModule;
+/** Re-export bootstrap TS cache adapter (canonical home: triage/bootstrap). */
+export { bootstrapCacheModule } from "../triage/bootstrap/cache-module.js";
 //# sourceMappingURL=bootstrap-cache-module.d.ts.map

package/dist/integration-e2e/bootstrap-cache-module.js

@@ -1,21 +1,3 @@
-/** Adapt TS cache reports to the bootstrap `FetchAllReport` shape. */
-export function bootstrapCacheModule(cacheFetchAll) {
-    return {
-        cacheFetchAll(kwargs) {
-            const report = cacheFetchAll({
-                source: kwargs.source,
-                repo: kwargs.repo,
-                batchSize: kwargs.batchSize,
-                delayMs: kwargs.delayMs,
-                cacheRoot: kwargs.cacheRoot,
-            });
-            return Promise.resolve({
-                succeeded: report.issuesWritten,
-                failed: report.issuesFailed,
-                skipped: report.alreadyFresh,
-                summaryLine: (source, repo) => report.summaryLine(source, repo),
-            });
-        },
-    };
-}
+/** Re-export bootstrap TS cache adapter (canonical home: triage/bootstrap). */
+export { bootstrapCacheModule } from "../triage/bootstrap/cache-module.js";
 //# sourceMappingURL=bootstrap-cache-module.js.map

package/dist/policy/index.d.ts

@@ -6,6 +6,8 @@ export * from "./disclosure.js";
 export * from "./plan-extensions.js";
 export * from "./policy-invocation.js";
 export * from "./resolve.js";
+export * from "./runtime-authority.js";
+export * from "./staleness-tickler.js";
 export * from "./value-feedback.js";
 export * from "./wip.js";
 export declare const FIELD_ALLOW_DIRECT_COMMITS = "plan.policy.allowDirectCommitsToMaster";

package/dist/policy/index.js

@@ -1,5 +1,7 @@
 import { readPlanPolicy } from "./plan-extensions.js";
 import { coerceLegacyNarrative, LEGACY_NARRATIVE_KEY, loadProjectDefinition } from "./resolve.js";
+import { FIELD_RUNTIME_AUTHORITY, FIELD_RUNTIME_AUTHORITY_CLI_ALIAS, inspectRuntimeAuthority, } from "./runtime-authority.js";
+import { FIELD_STALENESS_TICKLER, FIELD_STALENESS_TICKLER_CLI_ALIAS, inspectStalenessTickler, } from "./staleness-tickler.js";
 import { FIELD_VALUE_FEEDBACK, FIELD_VALUE_FEEDBACK_CLI_ALIAS, inspectValueFeedback, } from "./value-feedback.js";
 import { DEFAULT_WIP_CAP } from "./wip.js";
 export * from "./agents-md-advisory.js";
@@ -10,6 +12,8 @@ export * from "./disclosure.js";
 export * from "./plan-extensions.js";
 export * from "./policy-invocation.js";
 export * from "./resolve.js";
+export * from "./runtime-authority.js";
+export * from "./staleness-tickler.js";
 export * from "./value-feedback.js";
 export * from "./wip.js";
 export const FIELD_ALLOW_DIRECT_COMMITS = "plan.policy.allowDirectCommitsToMaster";
@@ -225,6 +229,24 @@ function inspectValueFeedbackField(data, projectRoot) {
         source: field.source,
     };
 }
+function inspectStalenessTicklerField(data) {
+    const field = inspectStalenessTickler(data);
+    return {
+        name: field.name,
+        current: field.current,
+        default: field.default,
+        source: field.source,
+    };
+}
+function inspectRuntimeAuthorityField(data) {
+    const field = inspectRuntimeAuthority(data);
+    return {
+        name: field.name,
+        current: field.current,
+        default: field.default,
+        source: field.source,
+    };
+}
 const REGISTERED_POLICIES = [
     inspectAllowDirectCommits,
     inspectWipCap,
@@ -237,6 +259,8 @@ const REGISTERED_POLICIES = [
         emptyIsTyped: true,
     }),
     inspectSwarmSubagentBackend,
+    inspectStalenessTicklerField,
+    inspectRuntimeAuthorityField,
     inspectValueFeedbackField,
 ];
 /** Walk registered inspectors and return one row per field (#1148). */
@@ -246,7 +270,13 @@ export function inspectAllPolicies(projectRoot) {
 }
 /** Look up a single registered field by canonical dotted-path name (or CLI alias). */
 export function inspectOnePolicy(name, projectRoot) {
-    const normalized = name === FIELD_VALUE_FEEDBACK_CLI_ALIAS ? FIELD_VALUE_FEEDBACK : name;
+    const normalized = name === FIELD_VALUE_FEEDBACK_CLI_ALIAS
+        ? FIELD_VALUE_FEEDBACK
+        : name === FIELD_STALENESS_TICKLER_CLI_ALIAS
+            ? FIELD_STALENESS_TICKLER
+            : name === FIELD_RUNTIME_AUTHORITY_CLI_ALIAS
+                ? FIELD_RUNTIME_AUTHORITY
+                : name;
     for (const field of inspectAllPolicies(projectRoot)) {
         if (field.name === normalized)
             return field;

package/dist/policy/runtime-authority.d.ts

@@ -0,0 +1,54 @@
+export declare const FIELD_RUNTIME_AUTHORITY = "plan.policy.runtimeAuthority";
+export declare const FIELD_RUNTIME_AUTHORITY_CLI_ALIAS = "runtimeAuthority";
+/** Graduated permission scopes (#1394 steipete ladder). */
+export interface RuntimeAuthorityScopes {
+    /** Direct edit/write tools (PreToolUse classifiable today). */
+    readonly edits: boolean;
+    /** git push / tag push — enforced only when Shell payload is classifiable (host gap). */
+    readonly push: boolean;
+    /** merge / close / release — enforced only when Shell payload is classifiable (host gap). */
+    readonly merge: boolean;
+}
+export interface RuntimeAuthorityPolicy {
+    readonly enabled: boolean;
+    /** When non-empty, write targets must match at least one pattern. Empty = allow all paths. */
+    readonly allowPaths: readonly string[];
+    /** Deny wins over allow. */
+    readonly denyPaths: readonly string[];
+    readonly scopes: RuntimeAuthorityScopes;
+}
+export declare const DEFAULT_RUNTIME_AUTHORITY_SCOPES: RuntimeAuthorityScopes;
+/** Safe default: opt-in only — existing consumers see no runtime authority until enabled. */
+export declare const DEFAULT_RUNTIME_AUTHORITY_POLICY: RuntimeAuthorityPolicy;
+export interface RuntimeAuthorityPolicyField {
+    readonly name: string;
+    readonly current: RuntimeAuthorityPolicy;
+    readonly default: RuntimeAuthorityPolicy;
+    readonly source: string;
+}
+export declare function resolveRuntimeAuthorityPolicy(raw: unknown): RuntimeAuthorityPolicy;
+export declare function validateRuntimeAuthority(value: unknown): string[];
+/** Inspector row for `policy:show --field=runtimeAuthority`. */
+export declare function inspectRuntimeAuthority(data: Record<string, unknown> | null): RuntimeAuthorityPolicyField;
+/** Resolve typed runtime authority policy from PROJECT-DEFINITION. */
+export declare function loadRuntimeAuthorityPolicy(data: Record<string, unknown> | null): RuntimeAuthorityPolicy;
+/** Load runtime authority from a project root (PROJECT-DEFINITION on disk). */
+export declare function loadRuntimeAuthorityFromProject(projectRoot: string): RuntimeAuthorityPolicy;
+export type RuntimeAuthorityPathVerdict = "allow" | "deny-allowlist" | "deny-denylist";
+/** Evaluate a project-relative POSIX path against allow/deny globs. */
+export declare function evaluateRuntimeAuthorityPath(policy: RuntimeAuthorityPolicy, relPathPosix: string): RuntimeAuthorityPathVerdict;
+export interface RuntimeAuthorityDirectWriteInput {
+    readonly policy: RuntimeAuthorityPolicy;
+    readonly relPathPosix: string | null;
+}
+export interface RuntimeAuthorityDirectWriteResult {
+    readonly allowed: boolean;
+    readonly reason: string | null;
+    readonly code: "runtime-policy-deny-scope" | "runtime-policy-deny-path" | null;
+}
+/**
+ * Evaluate direct-write runtime authority after ritual/scope gates (#1394).
+ * Unclassifiable paths (null) pass — host gap documented for Shell/MCP.
+ */
+export declare function evaluateRuntimeAuthorityDirectWrite(input: RuntimeAuthorityDirectWriteInput): RuntimeAuthorityDirectWriteResult;
+//# sourceMappingURL=runtime-authority.d.ts.map

package/dist/policy/runtime-authority.js

@@ -0,0 +1,180 @@
+import { matchAny } from "../orchestration/pathspec.js";
+import { readPlanPolicy } from "./plan-extensions.js";
+import { loadProjectDefinition } from "./resolve.js";
+export const FIELD_RUNTIME_AUTHORITY = "plan.policy.runtimeAuthority";
+export const FIELD_RUNTIME_AUTHORITY_CLI_ALIAS = "runtimeAuthority";
+export const DEFAULT_RUNTIME_AUTHORITY_SCOPES = {
+    edits: true,
+    push: false,
+    merge: false,
+};
+/** Safe default: opt-in only — existing consumers see no runtime authority until enabled. */
+export const DEFAULT_RUNTIME_AUTHORITY_POLICY = {
+    enabled: false,
+    allowPaths: [],
+    denyPaths: [],
+    scopes: DEFAULT_RUNTIME_AUTHORITY_SCOPES,
+};
+function readBoolean(rec, key, fallback) {
+    if (key in rec && typeof rec[key] === "boolean") {
+        return rec[key];
+    }
+    return fallback;
+}
+function readStringArray(raw) {
+    if (!Array.isArray(raw))
+        return [];
+    return raw.filter((item) => typeof item === "string" && item.trim().length > 0);
+}
+function readScopes(raw) {
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+        return DEFAULT_RUNTIME_AUTHORITY_SCOPES;
+    }
+    const rec = raw;
+    return {
+        edits: readBoolean(rec, "edits", DEFAULT_RUNTIME_AUTHORITY_SCOPES.edits),
+        push: readBoolean(rec, "push", DEFAULT_RUNTIME_AUTHORITY_SCOPES.push),
+        merge: readBoolean(rec, "merge", DEFAULT_RUNTIME_AUTHORITY_SCOPES.merge),
+    };
+}
+export function resolveRuntimeAuthorityPolicy(raw) {
+    if (raw === null || raw === undefined) {
+        return DEFAULT_RUNTIME_AUTHORITY_POLICY;
+    }
+    if (typeof raw !== "object" || Array.isArray(raw)) {
+        return DEFAULT_RUNTIME_AUTHORITY_POLICY;
+    }
+    const rec = raw;
+    return {
+        enabled: readBoolean(rec, "enabled", DEFAULT_RUNTIME_AUTHORITY_POLICY.enabled),
+        allowPaths: readStringArray(rec.allowPaths),
+        denyPaths: readStringArray(rec.denyPaths),
+        scopes: readScopes(rec.scopes),
+    };
+}
+export function validateRuntimeAuthority(value) {
+    if (value === null || value === undefined) {
+        return [];
+    }
+    if (typeof value !== "object" || Array.isArray(value)) {
+        return [`${FIELD_RUNTIME_AUTHORITY} must be an object; got ${typeof value}`];
+    }
+    const rec = value;
+    const errors = [];
+    if ("enabled" in rec && typeof rec.enabled !== "boolean") {
+        errors.push(`${FIELD_RUNTIME_AUTHORITY}.enabled must be a boolean`);
+    }
+    for (const key of ["allowPaths", "denyPaths"]) {
+        if (key in rec && !Array.isArray(rec[key])) {
+            errors.push(`${FIELD_RUNTIME_AUTHORITY}.${key} must be an array of path globs`);
+        }
+    }
+    if ("scopes" in rec) {
+        const scopes = rec.scopes;
+        if (typeof scopes !== "object" || scopes === null || Array.isArray(scopes)) {
+            errors.push(`${FIELD_RUNTIME_AUTHORITY}.scopes must be an object`);
+        }
+        else {
+            for (const key of ["edits", "push", "merge"]) {
+                if (key in scopes &&
+                    typeof scopes[key] !== "boolean") {
+                    errors.push(`${FIELD_RUNTIME_AUTHORITY}.scopes.${key} must be a boolean`);
+                }
+            }
+        }
+    }
+    return errors;
+}
+function fieldFromResolved(resolved, source) {
+    return {
+        name: FIELD_RUNTIME_AUTHORITY,
+        current: resolved,
+        default: DEFAULT_RUNTIME_AUTHORITY_POLICY,
+        source,
+    };
+}
+/** Inspector row for `policy:show --field=runtimeAuthority`. */
+export function inspectRuntimeAuthority(data) {
+    if (data === null) {
+        return fieldFromResolved(DEFAULT_RUNTIME_AUTHORITY_POLICY, "default");
+    }
+    const policyBlock = readPlanPolicy(data.plan);
+    if (typeof policyBlock !== "object" ||
+        policyBlock === null ||
+        Array.isArray(policyBlock) ||
+        !("runtimeAuthority" in policyBlock)) {
+        return fieldFromResolved(DEFAULT_RUNTIME_AUTHORITY_POLICY, "default");
+    }
+    const resolved = resolveRuntimeAuthorityPolicy(policyBlock.runtimeAuthority);
+    return fieldFromResolved(resolved, "typed");
+}
+/** Resolve typed runtime authority policy from PROJECT-DEFINITION. */
+export function loadRuntimeAuthorityPolicy(data) {
+    if (data === null) {
+        return DEFAULT_RUNTIME_AUTHORITY_POLICY;
+    }
+    const policyBlock = readPlanPolicy(data.plan);
+    if (typeof policyBlock !== "object" ||
+        policyBlock === null ||
+        Array.isArray(policyBlock) ||
+        !("runtimeAuthority" in policyBlock)) {
+        return DEFAULT_RUNTIME_AUTHORITY_POLICY;
+    }
+    return resolveRuntimeAuthorityPolicy(policyBlock.runtimeAuthority);
+}
+/** Load runtime authority from a project root (PROJECT-DEFINITION on disk). */
+export function loadRuntimeAuthorityFromProject(projectRoot) {
+    const [data] = loadProjectDefinition(projectRoot);
+    return loadRuntimeAuthorityPolicy(data);
+}
+/** Evaluate a project-relative POSIX path against allow/deny globs. */
+export function evaluateRuntimeAuthorityPath(policy, relPathPosix) {
+    if (!policy.enabled)
+        return "allow";
+    if (matchAny(policy.denyPaths, relPathPosix))
+        return "deny-denylist";
+    if (policy.allowPaths.length > 0 && !matchAny(policy.allowPaths, relPathPosix)) {
+        return "deny-allowlist";
+    }
+    return "allow";
+}
+/**
+ * Evaluate direct-write runtime authority after ritual/scope gates (#1394).
+ * Unclassifiable paths (null) pass — host gap documented for Shell/MCP.
+ */
+export function evaluateRuntimeAuthorityDirectWrite(input) {
+    const { policy, relPathPosix } = input;
+    if (!policy.enabled) {
+        return { allowed: true, reason: null, code: null };
+    }
+    if (!policy.scopes.edits) {
+        return {
+            allowed: false,
+            code: "runtime-policy-deny-scope",
+            reason: "Directive denied this direct write: plan.policy.runtimeAuthority.scopes.edits is false. " +
+                "Grant the edits scope in PROJECT-DEFINITION or disable runtimeAuthority.",
+        };
+    }
+    if (relPathPosix === null) {
+        return { allowed: true, reason: null, code: null };
+    }
+    const pathVerdict = evaluateRuntimeAuthorityPath(policy, relPathPosix);
+    if (pathVerdict === "deny-denylist") {
+        return {
+            allowed: false,
+            code: "runtime-policy-deny-path",
+            reason: `Directive denied this direct write: path ${relPathPosix} matches ` +
+                "plan.policy.runtimeAuthority.denyPaths.",
+        };
+    }
+    if (pathVerdict === "deny-allowlist") {
+        return {
+            allowed: false,
+            code: "runtime-policy-deny-path",
+            reason: `Directive denied this direct write: path ${relPathPosix} is outside ` +
+                "plan.policy.runtimeAuthority.allowPaths.",
+        };
+    }
+    return { allowed: true, reason: null, code: null };
+}
+//# sourceMappingURL=runtime-authority.js.map

package/dist/policy/staleness-tickler.d.ts

@@ -0,0 +1,20 @@
+import type { StalenessTicklerPolicy, StalenessTicklerSnoozePolicy, StalenessTicklerTierThresholds, StalenessTicklerWeights } from "../staleness-tickler/types.js";
+export declare const FIELD_STALENESS_TICKLER = "plan.policy.stalenessTickler";
+export declare const FIELD_STALENESS_TICKLER_CLI_ALIAS = "stalenessTickler";
+export declare const DEFAULT_STALENESS_TICKLER_WEIGHTS: StalenessTicklerWeights;
+export declare const DEFAULT_STALENESS_TICKLER_TIERS: StalenessTicklerTierThresholds;
+export declare const DEFAULT_STALENESS_TICKLER_SNOOZE: StalenessTicklerSnoozePolicy;
+export declare const DEFAULT_STALENESS_TICKLER_POLICY: StalenessTicklerPolicy;
+export interface StalenessTicklerPolicyField {
+    readonly name: string;
+    readonly current: StalenessTicklerPolicy;
+    readonly default: StalenessTicklerPolicy;
+    readonly source: string;
+}
+export declare function resolveStalenessTicklerPolicy(raw: unknown): StalenessTicklerPolicy;
+export declare function validateStalenessTickler(value: unknown): string[];
+/** Inspector row for `policy:show --field=stalenessTickler`. */
+export declare function inspectStalenessTickler(data: Record<string, unknown> | null): StalenessTicklerPolicyField;
+/** Resolve typed staleness tickler policy from PROJECT-DEFINITION. */
+export declare function loadStalenessTicklerPolicy(data: Record<string, unknown> | null): StalenessTicklerPolicy;
+//# sourceMappingURL=staleness-tickler.d.ts.map