@deftai/directive-core 0.83.0 → 0.85.0

package/dist/check/cached-orchestrator.js

@@ -0,0 +1,76 @@
+import { spawnSync } from "node:child_process";
+import { join, resolve } from "node:path";
+import { lintShippedRegistry, resolveTaskContract, runWithCache, } from "../cache/task-cache/index.js";
+import { readCorePackageVersion } from "../engine-version.js";
+import { resolveCheckTarget } from "./context.js";
+import { checkGateId, checkGateSpawnArgs, gatesForCheckTarget } from "./gate-lists.js";
+function captureSpawn(taskBin, args, opts) {
+    const result = spawnSync(taskBin, args, {
+        cwd: opts.cwd,
+        encoding: "utf8",
+        env: opts.env ?? process.env,
+    });
+    return {
+        exitCode: result.status ?? 1,
+        stdout: result.stdout ?? "",
+        stderr: result.stderr ?? "",
+    };
+}
+/**
+ * Run check gates sequentially with content-hash caching (#1713).
+ * Falls back to fail-open execution for undeclared / non-cacheable gates.
+ */
+export function dispatchCachedTaskCheck(frameworkRoot, projectRoot, options = {}) {
+    const resolvedFramework = resolve(frameworkRoot);
+    const resolvedProject = resolve(projectRoot);
+    const taskfilePath = join(resolvedFramework, "Taskfile.yml");
+    const taskBin = options.taskBin ?? "task";
+    const target = resolveCheckTarget(resolvedFramework, resolvedProject);
+    const cwd = target === "check:framework-source" ? resolvedFramework : resolvedProject;
+    const gates = gatesForCheckTarget(target);
+    const codeVersion = readCorePackageVersion();
+    const registryLint = lintShippedRegistry();
+    if (!registryLint.ok) {
+        for (const finding of registryLint.findings.filter((f) => f.kind === "under-declared-input")) {
+            process.stderr.write(`check: task registry lint failed for ${finding.taskId}: ${finding.detail}\n`);
+        }
+        return 2;
+    }
+    if (gates.length === 0) {
+        process.stderr.write(`check: no gate list for target ${target}\n`);
+        return 2;
+    }
+    for (const gateSpec of gates) {
+        const gateId = checkGateId(gateSpec);
+        options.onGateStart?.(gateId);
+        const contract = resolveTaskContract(gateId);
+        const taskArgs = checkGateSpawnArgs(gateSpec, taskfilePath);
+        const result = runWithCache({
+            projectRoot: cwd,
+            contract,
+            codeVersion,
+            noCache: options.noCache,
+            runner: () => {
+                const spawned = options.gateSpawnFn
+                    ? options.gateSpawnFn(gateId, taskBin, taskArgs, {
+                        cwd,
+                        env: options.env,
+                    })
+                    : captureSpawn(taskBin, taskArgs, { cwd, env: options.env });
+                if (spawned.stdout.length > 0) {
+                    process.stdout.write(spawned.stdout);
+                }
+                if (spawned.stderr.length > 0) {
+                    process.stderr.write(spawned.stderr);
+                }
+                return spawned;
+            },
+        });
+        options.onGateComplete?.(gateId, result.exitCode, result.fromCache);
+        if (result.exitCode !== 0) {
+            return result.exitCode;
+        }
+    }
+    return 0;
+}
+//# sourceMappingURL=cached-orchestrator.js.map

package/dist/check/context.d.ts

@@ -0,0 +1,30 @@
+export interface CheckOrchestratorOptions {
+    readonly noCache?: boolean;
+    readonly useTaskCache?: boolean;
+}
+export interface CheckOrchestratorSeams extends CheckOrchestratorOptions {
+    /** Override the `task` binary path (default: "task"). */
+    readonly taskBin?: string;
+    /** Override the spawnSync implementation for unit testing. */
+    readonly spawnFn?: (cmd: string, args: string[], opts: {
+        cwd: string;
+        stdio: string;
+        env?: NodeJS.ProcessEnv;
+        timeoutMs?: number;
+    }) => {
+        status: number | null;
+        signal?: NodeJS.Signals | null;
+        error?: Error;
+    };
+    /** Child-process environment (default: process.env). */
+    readonly env?: NodeJS.ProcessEnv;
+    /** Wall-clock spawn timeout in milliseconds (default: none). */
+    readonly timeoutMs?: number;
+}
+/** True when `path` is the directive framework source checkout root. */
+export declare function isFrameworkRepoRoot(path: string): boolean;
+/** Return true when running in the framework's own source checkout (#1519). */
+export declare function isFrameworkSourceContext(frameworkRoot: string, projectRoot: string): boolean;
+/** Select the Taskfile target for the given context. */
+export declare function resolveCheckTarget(frameworkRoot: string, projectRoot: string): string;
+//# sourceMappingURL=context.d.ts.map

package/dist/check/context.js

@@ -0,0 +1,28 @@
+import { existsSync } from "node:fs";
+import { join, resolve, sep } from "node:path";
+/** True when `path` is the directive framework source checkout root. */
+export function isFrameworkRepoRoot(path) {
+    const root = resolve(path);
+    return (existsSync(join(root, "packages", "cli", "package.json")) &&
+        existsSync(join(root, "biome.json")) &&
+        existsSync(join(root, "Taskfile.yml")));
+}
+/** Return true when running in the framework's own source checkout (#1519). */
+export function isFrameworkSourceContext(frameworkRoot, projectRoot) {
+    const fw = resolve(frameworkRoot);
+    const pr = resolve(projectRoot);
+    if (fw === pr) {
+        return true;
+    }
+    if (!isFrameworkRepoRoot(fw)) {
+        return false;
+    }
+    return pr.startsWith(`${fw}${sep}`);
+}
+/** Select the Taskfile target for the given context. */
+export function resolveCheckTarget(frameworkRoot, projectRoot) {
+    return isFrameworkSourceContext(frameworkRoot, projectRoot)
+        ? "check:framework-source"
+        : "check:consumer";
+}
+//# sourceMappingURL=context.js.map

package/dist/check/gate-lists.d.ts

@@ -0,0 +1,18 @@
+/** Gate execution order mirrors Taskfile.yml check targets (#1713 dogfood). */
+/**
+ * A check gate is either a bare Taskfile task name, or a public task plus CLI
+ * args (after `--`). Framework-only shims that are `internal: true` in
+ * Taskfile.yml cannot be shelled by name under go-task 3.50 (#2791) — use the
+ * public surface with the shim's flags instead.
+ */
+export type CheckGateSpec = string | {
+    readonly task: string;
+    readonly args?: readonly string[];
+};
+export declare function checkGateId(spec: CheckGateSpec): string;
+/** Args for `task … --taskfile <path>` (optional `--` + public CLI flags). */
+export declare function checkGateSpawnArgs(spec: CheckGateSpec, taskfilePath: string): string[];
+export declare const FRAMEWORK_CHECK_GATES: readonly CheckGateSpec[];
+export declare const CONSUMER_CHECK_GATES: readonly CheckGateSpec[];
+export declare function gatesForCheckTarget(target: string): readonly CheckGateSpec[];
+//# sourceMappingURL=gate-lists.d.ts.map

package/dist/check/gate-lists.js

@@ -0,0 +1,68 @@
+/** Gate execution order mirrors Taskfile.yml check targets (#1713 dogfood). */
+export function checkGateId(spec) {
+    return typeof spec === "string" ? spec : spec.task;
+}
+/** Args for `task … --taskfile <path>` (optional `--` + public CLI flags). */
+export function checkGateSpawnArgs(spec, taskfilePath) {
+    const task = checkGateId(spec);
+    const extra = typeof spec === "string" ? undefined : spec.args;
+    if (extra !== undefined && extra.length > 0) {
+        return [task, "--taskfile", taskfilePath, "--", ...extra];
+    }
+    return [task, "--taskfile", taskfilePath];
+}
+export const FRAMEWORK_CHECK_GATES = [
+    "ts:check-lane",
+    "toolchain:check",
+    "verify:stubs",
+    "verify:links",
+    "verify:rule-ownership",
+    "verify:biome-config",
+    "verify:content-manifest",
+    "verify:skill-external-fetch-gate",
+    "verify:contract-drift",
+    "verify:cursor-tier1",
+    "verify:go-freeze",
+    "verify:bridge-drift",
+    "verify:branch",
+    "verify:encoding",
+    "verify:forward-coverage",
+    "verify:vbrief-conformance",
+    "verify:destructive-gh-verbs",
+    "verify:scm-boundary",
+    "verify:xbrief-drift",
+    "verify:no-task-runtime",
+    "verify:cache-fresh",
+    "verify:pack-drift",
+    // Public surface for Taskfile verify-wip-cap-framework-self-check (#1124 / #2791)
+    { task: "verify:wip-cap", args: ["--allow-over-cap"] },
+    "verify:orphan-active",
+    "verify:agents-md-budget",
+    // Public surfaces for internal eval-relocation framework shims (#2791)
+    { task: "verify:eval-health-relocation", args: ["--base-ref", "origin/master"] },
+    { task: "verify:eval-triggers-relocation", args: ["--base-ref", "origin/master"] },
+    "vbrief:validate",
+    "codebase:validate-structure",
+    "verify:codebase-map-fresh",
+    "verify-strategy-output",
+];
+export const CONSUMER_CHECK_GATES = [
+    "doctor",
+    "toolchain:check-consumer",
+    "verify:branch",
+    "verify:cache-fresh",
+    "verify:wip-cap",
+    "verify:orphan-active",
+    "vbrief:validate",
+    "verify-strategy-output",
+];
+export function gatesForCheckTarget(target) {
+    if (target === "check:framework-source") {
+        return FRAMEWORK_CHECK_GATES;
+    }
+    if (target === "check:consumer") {
+        return CONSUMER_CHECK_GATES;
+    }
+    return [];
+}
+//# sourceMappingURL=gate-lists.js.map

package/dist/check/index.d.ts

@@ -1,3 +1,6 @@
-export type { CheckOrchestratorSeams } from "./orchestrator.js";
+export { dispatchCachedTaskCheck } from "./cached-orchestrator.js";
+export { type CheckGateSpec, CONSUMER_CHECK_GATES, checkGateId, checkGateSpawnArgs, FRAMEWORK_CHECK_GATES, gatesForCheckTarget, } from "./gate-lists.js";
+export type { CheckOrchestratorOptions, CheckOrchestratorSeams } from "./orchestrator.js";
 export { dispatchTaskCheck, isFrameworkRepoRoot, isFrameworkSourceContext, resolveCheckTarget, } from "./orchestrator.js";
+export { detectTestRunner, type RunnerDetectResult, runnerDetectionTable, type TestRunnerKind, } from "./runner-detect.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/check/index.js

@@ -1,2 +1,5 @@
+export { dispatchCachedTaskCheck } from "./cached-orchestrator.js";
+export { CONSUMER_CHECK_GATES, checkGateId, checkGateSpawnArgs, FRAMEWORK_CHECK_GATES, gatesForCheckTarget, } from "./gate-lists.js";
 export { dispatchTaskCheck, isFrameworkRepoRoot, isFrameworkSourceContext, resolveCheckTarget, } from "./orchestrator.js";
+export { detectTestRunner, runnerDetectionTable, } from "./runner-detect.js";
 //# sourceMappingURL=index.js.map

package/dist/check/orchestrator.d.ts

@@ -11,51 +11,9 @@
  *   1 -- one or more gates failed
  *   2 -- config error (missing args, task spawn error, etc.)
  */
-/** Seams for test isolation (allow injecting a custom task runner). */
-export interface CheckOrchestratorSeams {
-    /** Override the `task` binary path (default: "task"). */
-    readonly taskBin?: string;
-    /** Override the spawnSync implementation for unit testing. */
-    readonly spawnFn?: (cmd: string, args: string[], opts: {
-        cwd: string;
-        stdio: string;
-        env?: NodeJS.ProcessEnv;
-        timeoutMs?: number;
-    }) => {
-        status: number | null;
-        signal?: NodeJS.Signals | null;
-        error?: Error;
-    };
-    /** Child-process environment (default: process.env). */
-    readonly env?: NodeJS.ProcessEnv;
-    /** Wall-clock spawn timeout in milliseconds (default: none). */
-    readonly timeoutMs?: number;
-}
-/**
- * True when `path` is the directive framework source checkout root (not a
- * vendored `.deft/core` content deposit). Used to distinguish a maintainer
- * running `task check` from a subdirectory (#2220) from a consumer install.
- */
-export declare function isFrameworkRepoRoot(path: string): boolean;
-/**
- * Return true when running in the framework's own source checkout (#1519).
- *
- * Mirrors `is_framework_source_context` from _project_context.py with one
- * extension (#2220): when the Taskfile lives at the framework repo root,
- * `task check` may be invoked from a subdirectory (`USER_WORKING_DIR` !=
- * `TASKFILE_DIR`). Those invocations must still route to
- * `check:framework-source` so the biome lane runs. We do NOT resolve
- * symlinks on the framework root -- a consumer project may symlink
- * `.deft/core` to a local framework checkout and should still run the
- * consumer-safe gate (the deposit path lacks `packages/cli`).
- */
-export declare function isFrameworkSourceContext(frameworkRoot: string, projectRoot: string): boolean;
-/**
- * Select the Taskfile target for the given context.
- *
- * Mirrors _project_context.py::dispatch_task_check target selection.
- */
-export declare function resolveCheckTarget(frameworkRoot: string, projectRoot: string): string;
+import { type CheckOrchestratorSeams } from "./context.js";
+export type { CheckOrchestratorOptions, CheckOrchestratorSeams } from "./context.js";
+export { isFrameworkRepoRoot, isFrameworkSourceContext, resolveCheckTarget } from "./context.js";
 /**
  * Dispatch to the context-appropriate `task check` aggregate target.
  *

package/dist/check/orchestrator.js

@@ -12,52 +12,10 @@
  *   2 -- config error (missing args, task spawn error, etc.)
  */
 import { spawnSync } from "node:child_process";
-import { existsSync } from "node:fs";
-import { join, resolve, sep } from "node:path";
-/**
- * True when `path` is the directive framework source checkout root (not a
- * vendored `.deft/core` content deposit). Used to distinguish a maintainer
- * running `task check` from a subdirectory (#2220) from a consumer install.
- */
-export function isFrameworkRepoRoot(path) {
-    const root = resolve(path);
-    return (existsSync(join(root, "packages", "cli", "package.json")) &&
-        existsSync(join(root, "biome.json")) &&
-        existsSync(join(root, "Taskfile.yml")));
-}
-/**
- * Return true when running in the framework's own source checkout (#1519).
- *
- * Mirrors `is_framework_source_context` from _project_context.py with one
- * extension (#2220): when the Taskfile lives at the framework repo root,
- * `task check` may be invoked from a subdirectory (`USER_WORKING_DIR` !=
- * `TASKFILE_DIR`). Those invocations must still route to
- * `check:framework-source` so the biome lane runs. We do NOT resolve
- * symlinks on the framework root -- a consumer project may symlink
- * `.deft/core` to a local framework checkout and should still run the
- * consumer-safe gate (the deposit path lacks `packages/cli`).
- */
-export function isFrameworkSourceContext(frameworkRoot, projectRoot) {
-    const fw = resolve(frameworkRoot);
-    const pr = resolve(projectRoot);
-    if (fw === pr) {
-        return true;
-    }
-    if (!isFrameworkRepoRoot(fw)) {
-        return false;
-    }
-    return pr.startsWith(`${fw}${sep}`);
-}
-/**
- * Select the Taskfile target for the given context.
- *
- * Mirrors _project_context.py::dispatch_task_check target selection.
- */
-export function resolveCheckTarget(frameworkRoot, projectRoot) {
-    return isFrameworkSourceContext(frameworkRoot, projectRoot)
-        ? "check:framework-source"
-        : "check:consumer";
-}
+import { join, resolve } from "node:path";
+import { dispatchCachedTaskCheck } from "./cached-orchestrator.js";
+import { resolveCheckTarget } from "./context.js";
+export { isFrameworkRepoRoot, isFrameworkSourceContext, resolveCheckTarget } from "./context.js";
 /**
  * Dispatch to the context-appropriate `task check` aggregate target.
  *
@@ -69,6 +27,10 @@ export function resolveCheckTarget(frameworkRoot, projectRoot) {
 export function dispatchTaskCheck(frameworkRoot, projectRoot, seams = {}) {
     const resolvedFramework = resolve(frameworkRoot);
     const resolvedProject = resolve(projectRoot);
+    const useTaskCache = seams.useTaskCache !== false && !seams.noCache;
+    if (useTaskCache) {
+        return dispatchCachedTaskCheck(resolvedFramework, resolvedProject, seams);
+    }
     const taskfilePath = join(resolvedFramework, "Taskfile.yml");
     const taskBin = seams.taskBin ?? "task";
     const target = resolveCheckTarget(resolvedFramework, resolvedProject);

package/dist/check/runner-detect.d.ts

@@ -0,0 +1,20 @@
+export type TestRunnerKind = "vitest" | "jest" | "go" | "pytest" | "none";
+export interface RunnerDetectResult {
+    readonly kind: TestRunnerKind;
+    readonly affectedArgs: readonly string[];
+    readonly source: "config" | "heuristic" | "fallback";
+    readonly message?: string;
+}
+export interface RunnerDetectOptions {
+    readonly projectRoot: string;
+    readonly override?: TestRunnerKind;
+}
+/** Auto-detect consumer test runner with explicit override (#1713). */
+export declare function detectTestRunner(options: RunnerDetectOptions): RunnerDetectResult;
+/** Human-readable detection table rows for docs. */
+export declare function runnerDetectionTable(): ReadonlyArray<{
+    runner: TestRunnerKind;
+    detection: string;
+    affectedConvention: string;
+}>;
+//# sourceMappingURL=runner-detect.d.ts.map

package/dist/check/runner-detect.js

@@ -0,0 +1,131 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { projectDefinitionPath } from "../policy/index.js";
+const RUNNER_AFFECTED = {
+    vitest: ["--changed"],
+    jest: ["--onlyChanged"],
+    go: [],
+    pytest: ["--testmon"],
+};
+function affectedArgsFor(kind) {
+    if (kind === "none") {
+        return [];
+    }
+    return RUNNER_AFFECTED[kind];
+}
+function readJson(path) {
+    try {
+        return JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+function detectFromPolicy(projectRoot) {
+    try {
+        const planPath = projectDefinitionPath(projectRoot);
+        const plan = readJson(planPath);
+        const raw = plan?.plan?.policy?.testRunner;
+        if (raw === "vitest" || raw === "jest" || raw === "go" || raw === "pytest" || raw === "none") {
+            return raw;
+        }
+    }
+    catch {
+        return null;
+    }
+    return null;
+}
+function detectFromHeuristics(projectRoot) {
+    const root = resolve(projectRoot);
+    if (existsSync(join(root, "go.mod"))) {
+        return "go";
+    }
+    const pkgPath = join(root, "package.json");
+    if (existsSync(pkgPath)) {
+        const pkg = readJson(pkgPath);
+        const deps = { ...(pkg?.dependencies ?? {}), ...(pkg?.devDependencies ?? {}) };
+        if ("vitest" in deps) {
+            return "vitest";
+        }
+        if ("jest" in deps || "@jest/core" in deps) {
+            return "jest";
+        }
+    }
+    if (existsSync(join(root, "pytest.ini")) ||
+        existsSync(join(root, "pyproject.toml")) ||
+        existsSync(join(root, "requirements.txt"))) {
+        return "pytest";
+    }
+    return null;
+}
+/** Auto-detect consumer test runner with explicit override (#1713). */
+export function detectTestRunner(options) {
+    if (options.override !== undefined) {
+        if (options.override === "none") {
+            return {
+                kind: "none",
+                affectedArgs: [],
+                source: "config",
+                message: "Runner override set to full-suite-only.",
+            };
+        }
+        return {
+            kind: options.override,
+            affectedArgs: affectedArgsFor(options.override),
+            source: "config",
+        };
+    }
+    const fromPolicy = detectFromPolicy(options.projectRoot);
+    if (fromPolicy !== null) {
+        return {
+            kind: fromPolicy,
+            affectedArgs: affectedArgsFor(fromPolicy),
+            source: "config",
+        };
+    }
+    const fromHeuristics = detectFromHeuristics(options.projectRoot);
+    if (fromHeuristics !== null) {
+        return {
+            kind: fromHeuristics,
+            affectedArgs: affectedArgsFor(fromHeuristics),
+            source: "heuristic",
+        };
+    }
+    return {
+        kind: "none",
+        affectedArgs: [],
+        source: "fallback",
+        message: "No supported test runner detected — merge gate uses the full suite.",
+    };
+}
+/** Human-readable detection table rows for docs. */
+export function runnerDetectionTable() {
+    return [
+        {
+            runner: "vitest",
+            detection: "package.json lists vitest, or plan.policy.testRunner = vitest",
+            affectedConvention: "vitest --changed",
+        },
+        {
+            runner: "jest",
+            detection: "package.json lists jest / @jest/core, or plan.policy.testRunner = jest",
+            affectedConvention: "jest --onlyChanged",
+        },
+        {
+            runner: "go",
+            detection: "go.mod present, or plan.policy.testRunner = go",
+            affectedConvention: "go test (native package cache)",
+        },
+        {
+            runner: "pytest",
+            detection: "pytest.ini / pyproject.toml / requirements.txt, or plan.policy.testRunner = pytest",
+            affectedConvention: "pytest --testmon",
+        },
+        {
+            runner: "none",
+            detection: "No match after config + heuristics",
+            affectedConvention: "Full suite at merge gate",
+        },
+    ];
+}
+//# sourceMappingURL=runner-detect.js.map

package/dist/doctor/checks.js

@@ -1,6 +1,6 @@
 import { join } from "node:path";
 import { CANONICAL_GITIGNORE_BASELINE } from "../init-deposit/gitignore.js";
-import { detectLegacyLayout, legacyLayoutSignpostLine, } from "../init-deposit/legacy-detect.js";
+import { detectDualLayout, detectLegacyLayout, dualLayoutSignpostLine, legacyLayoutSignpostLine, } from "../init-deposit/legacy-detect.js";
 import { detectCanonicalVendoredManifest, isNpmManaged, NPM_MANAGED_SENTINEL_KEY, NPM_MANAGED_SENTINEL_VALUE, } from "../init-deposit/migrate.js";
 import { resolveLifecycleRoot } from "../layout/resolve.js";
 import { findSkillPathsInText } from "../text/redos-safe.js";
@@ -300,6 +300,21 @@ export function checkLegacyLayout(projectRoot, seams = {}) {
         ...(seams.isFile ? { isFile: seams.isFile } : {}),
         ...(seams.isDir ? { isDir: seams.isDir } : {}),
     };
+    const dualLayout = detectDualLayout(projectRoot, legacySeams);
+    if (dualLayout !== null) {
+        return {
+            name: "legacy-layout",
+            status: "fail",
+            detail: dualLayoutSignpostLine(dualLayout),
+            data: {
+                legacy_layout: true,
+                legacy_layout_kind: dualLayout.kind,
+                evidence: [...dualLayout.evidence],
+                upgrading_doc_url: UPGRADING_DOC_URL,
+                go_bridge_releases_url: GO_BRIDGE_RELEASES_URL,
+            },
+        };
+    }
     const detection = detectLegacyLayout(projectRoot, legacySeams);
     if (!detection.legacy) {
         return {

package/dist/doctor/constants.d.ts

@@ -10,6 +10,8 @@ export declare const TASKFILE_INCLUDE_SNIPPET = "version: '3'\n\nincludes:\n  de
 export declare const DOCTOR_ALLOWED_FLAGS: readonly ["--session", "--fix", "--repair", "--repair-taskfile", "--json", "--quiet", "--full", "--network", "--project-root", "-h", "--help"];
 /** npm consumer deposit after #2022 Phase 3 -- Python scripts/ tree is intentionally absent. */
 export declare const NPM_PACKAGE_NAME = "@deftai/directive";
+export declare const PUBLIC_NPM_REGISTRY = "https://registry.npmjs.org/";
+export declare const NPM_REGISTRY_MIRROR_DOC_URL = "https://github.com/deftai/directive/blob/master/content/UPGRADING.md#corporate-or-mirrored-npm-registry";
 export declare const NETWORK_DISCLOSURE_LINE: string;
 export declare const PAYLOAD_STALENESS_OFFLINE_SKIP_MESSAGE: string;
 export declare const EXPECTED_FRAMEWORK_DIRS: readonly ["tasks", "scripts", "vbrief"];

package/dist/doctor/constants.js

@@ -28,12 +28,16 @@ export const DOCTOR_ALLOWED_FLAGS = [
 ];
 /** npm consumer deposit after #2022 Phase 3 -- Python scripts/ tree is intentionally absent. */
 export const NPM_PACKAGE_NAME = "@deftai/directive";
+export const PUBLIC_NPM_REGISTRY = "https://registry.npmjs.org/";
+export const NPM_REGISTRY_MIRROR_DOC_URL = `${UPGRADING_DOC_URL}#corporate-or-mirrored-npm-registry`;
 // #2182: payload-staleness is the only doctor check that can reach a network
 // endpoint (git ls-remote verifies the pinned ref and `npm view` compares a
-// release-tag install with the latest stable package). It is OFF by default (offline tier)
-// and requires the explicit `--network` flag; this line discloses exactly
-// which tool + registry class it may contact BEFORE the check runs, and the
-// skip line tells an offline run how to opt in.
+// release-tag install with the latest stable package). The #2808 baseline
+// registry-routing check uses only offline `npm config get` reads.
+// Payload-staleness is OFF by default (offline tier) and requires the explicit
+// `--network` flag; this line discloses exactly which tool + registry class it
+// may contact BEFORE the check runs, and the skip line tells an offline run how
+// to opt in.
 export const NETWORK_DISCLOSURE_LINE = "[deft doctor] --network: this run may contact your git remote (framework " +
     "repo host) and the npm registry (registry.npmjs.org) to " +
     `look up the latest ${NPM_PACKAGE_NAME} version.`;

package/dist/doctor/index.d.ts

@@ -6,6 +6,7 @@ export * from "./flags.js";
 export * from "./json.js";
 export * from "./main.js";
 export * from "./manifest.js";
+export * from "./npm-registry.js";
 export * from "./paths.js";
 export * from "./payload-staleness.js";
 export * from "./release-availability.js";

package/dist/doctor/index.js

@@ -6,6 +6,7 @@ export * from "./flags.js";
 export * from "./json.js";
 export * from "./main.js";
 export * from "./manifest.js";
+export * from "./npm-registry.js";
 export * from "./paths.js";
 export * from "./payload-staleness.js";
 export * from "./release-availability.js";

package/dist/doctor/main.js

@@ -14,6 +14,7 @@ import { decideThrottle, formatIsoZ, readState, renderDoctorStatusLine, writeSta
 import { formatAllowedFlagsHint, formatUnknownFlagsError, parseDoctorFlags } from "./flags.js";
 import { pythonJsonDump } from "./json.js";
 import { parseInstallRootFromAgentsMd } from "./manifest.js";
+import { runNpmRegistryMirrorCheck } from "./npm-registry.js";
 import { createPlainSink } from "./output.js";
 import { readTextSafe, resolveDefaultFrameworkRoot, resolvePath, resolveVersion, runningInsideDeftRepo, } from "./paths.js";
 import { runPayloadStalenessCheck } from "./payload-staleness.js";
@@ -90,7 +91,7 @@ export function cmdDoctor(args, seams = {}) {
             }
             const signpostWarnings = throttleFindings.filter((f) => f.severity === "warning").length;
             if (signpostWarnings > 0 && !jsonMode) {
-                throttleSink.finalWarn(`Signpost advisory: ${signpostWarnings} local layout / npm-migration note(s) above (throttle-skipped full probe).`);
+                throttleSink.finalWarn(`Signpost advisory: ${signpostWarnings} local configuration / layout note(s) above (throttle-skipped full probe).`);
             }
             return decision.dirty ? 1 : 0;
         }
@@ -165,12 +166,20 @@ export function cmdDoctor(args, seams = {}) {
     }
     sink.info("Checking agent-host hook registration...");
     runAgentHooksHealthCheck(projectRoot, consumerContext, sink, addFinding, seams);
+    if (consumerContext) {
+        if (!jsonMode) {
+            sink.blank();
+        }
+        sink.info("Checking npm registry routing...");
+        runNpmRegistryMirrorCheck(projectRoot, sink, addFinding, seams);
+    }
     if (!jsonMode) {
         sink.blank();
     }
-    // #2182: payload-staleness is the only doctor check that can reach a
-    // registry (git verifies the pin; npm compares stable release availability).
-    // It stays in the OFFLINE
+    // #2182: payload-staleness is the only doctor check that can reach a network
+    // endpoint (git verifies the pin; npm compares stable release availability).
+    // The baseline #2808 registry-routing diagnostic above is an offline
+    // `npm config get` read. Payload-staleness stays in the OFFLINE
     // tier (skipped) unless the operator explicitly opts into the NETWORK tier
     // via `--network`, and the tool + registry class is disclosed BEFORE the
     // check runs -- never silently, never as a side effect of a read-only