@deftai/directive-core 0.96.0 → 0.98.0

package/dist/test-boundary/evaluate.d.ts

@@ -0,0 +1,54 @@
+/**
+ * verify:test-boundary evaluation (#3145).
+ *
+ * Rejects recognized test artifacts under production roots and production
+ * references to test/fixture roots unless allowlisted or classified as
+ * production-liveness. Three-state exit: 0 clean / 1 violation / 2 config.
+ */
+import { type TestBoundaryPolicy } from "./policy.js";
+export type TestBoundaryViolationKind = "test-under-source-root" | "production-references-test-root";
+export interface TestBoundaryFinding {
+    readonly path: string;
+    readonly kind: TestBoundaryViolationKind;
+    readonly detail: string;
+    readonly remediation: string;
+}
+export interface TestBoundaryResult {
+    readonly exitCode: 0 | 1 | 2;
+    readonly findings: readonly TestBoundaryFinding[];
+    readonly message: string;
+    readonly policy: TestBoundaryPolicy | null;
+}
+export interface TestBoundaryOptions {
+    readonly policyPath?: string | null;
+    /** Inject policy for pure unit tests (skips disk load). */
+    readonly policy?: TestBoundaryPolicy;
+    /** Inject file list for pure unit tests. */
+    readonly files?: readonly string[];
+    /** Inject file contents for reference scanning (posix path -> text). */
+    readonly fileContents?: ReadonlyMap<string, string>;
+    /** Force enforcement mode override. */
+    readonly enforce?: boolean;
+    readonly quiet?: boolean;
+}
+/**
+ * Glob match with double-star as zero-or-more path segments.
+ * Plain fnmatchCase treats double-star as two greedy stars and fails nested
+ * colocated paths (e.g. packages/cli/src/foo/bar.test.ts vs packages star globs).
+ */
+export declare function matchPolicyGlob(relPath: string, pattern: string): boolean;
+/**
+ * Match repo-relative path against a policy root glob.
+ * Supports foo/**-style prefixes, packages star-src globs, and basename patterns.
+ */
+export declare function matchesRootGlob(relPath: string, rootGlob: string): boolean;
+/** True when basename/path matches a test-file pattern (fnmatch / ** globs). */
+export declare function matchesTestFilePattern(relPath: string, patterns: readonly string[]): boolean;
+/** Recognise conventional test basenames without full glob (fast path). */
+export declare function isRecognizedTestBasename(relPath: string): boolean;
+/**
+ * Evaluate test/source boundary for a project.
+ * Pure when `policy` + `files` (+ optional `fileContents`) are injected.
+ */
+export declare function evaluateTestBoundary(projectRoot: string, options?: TestBoundaryOptions): TestBoundaryResult;
+//# sourceMappingURL=evaluate.d.ts.map

package/dist/test-boundary/evaluate.js

@@ -0,0 +1,368 @@
+/**
+ * verify:test-boundary evaluation (#3145).
+ *
+ * Rejects recognized test artifacts under production roots and production
+ * references to test/fixture roots unless allowlisted or classified as
+ * production-liveness. Three-state exit: 0 clean / 1 violation / 2 config.
+ */
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { basename, resolve } from "node:path";
+import { GitCommandError, GitNotFoundError } from "../encoding/git.js";
+import { fnmatchCase } from "../encoding/text.js";
+import { loadTestBoundaryPolicy, } from "./policy.js";
+function gitTrackedFiles(projectRoot) {
+    const result = spawnSync("git", ["ls-files"], {
+        cwd: projectRoot,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"],
+    });
+    if (result.error !== undefined) {
+        const e = result.error;
+        if (e.code === "ENOENT") {
+            throw new GitNotFoundError("'git' executable not found on PATH");
+        }
+        throw new GitCommandError(`git ls-files failed: ${String(e.message)}`);
+    }
+    if ((result.status ?? 1) !== 0) {
+        const stderr = String(result.stderr ?? "").trim();
+        throw new GitCommandError(`git ls-files exited ${result.status ?? 1}${stderr ? `: ${stderr}` : ""}`);
+    }
+    return (result.stdout ?? "")
+        .split("\n")
+        .map((l) => l.replace(/\r$/, "").replace(/\\/g, "/"))
+        .filter((l) => l.trim().length > 0);
+}
+/** Normalize a root glob like `src/**` or `infra/**` to a path prefix matcher. */
+function rootPrefix(rootGlob) {
+    return rootGlob.replace(/\/\*\*$/, "/").replace(/\*\*$/, "");
+}
+/**
+ * Glob match with double-star as zero-or-more path segments.
+ * Plain fnmatchCase treats double-star as two greedy stars and fails nested
+ * colocated paths (e.g. packages/cli/src/foo/bar.test.ts vs packages star globs).
+ */
+export function matchPolicyGlob(relPath, pattern) {
+    const posix = relPath.replace(/\\/g, "/");
+    const g = pattern.replace(/\\/g, "/");
+    if (fnmatchCase(posix, g))
+        return true;
+    // Translate ** → «any path including empty», * → «any segment chars»
+    let reSrc = "";
+    for (let i = 0; i < g.length;) {
+        if (g.startsWith("**/", i)) {
+            reSrc += "(?:.*/)?";
+            i += 3;
+            continue;
+        }
+        if (g.startsWith("**", i)) {
+            reSrc += ".*";
+            i += 2;
+            continue;
+        }
+        const c = g.charAt(i);
+        i += 1;
+        if (c === "*") {
+            reSrc += "[^/]*";
+        }
+        else if (c === "?") {
+            reSrc += "[^/]";
+        }
+        else if ("\\.[]{}()+-^$|".includes(c)) {
+            reSrc += `\\${c}`;
+        }
+        else {
+            reSrc += c;
+        }
+    }
+    try {
+        return new RegExp(`^${reSrc}$`).test(posix);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Match repo-relative path against a policy root glob.
+ * Supports foo/**-style prefixes, packages star-src globs, and basename patterns.
+ */
+export function matchesRootGlob(relPath, rootGlob) {
+    const posix = relPath.replace(/\\/g, "/");
+    const g = rootGlob.replace(/\\/g, "/");
+    if (matchPolicyGlob(posix, g))
+        return true;
+    // Prefix form: src/** matches src/foo.py
+    if (g.endsWith("/**")) {
+        const prefix = g.slice(0, -3);
+        if (!prefix.includes("*")) {
+            return posix === prefix || posix.startsWith(`${prefix}/`);
+        }
+        // packages/*/src/** — match prefix with matchPolicyGlob against path or ancestors
+        if (matchPolicyGlob(posix, `${prefix}/**`) || matchPolicyGlob(posix, prefix)) {
+            return true;
+        }
+        // Any file under a matching prefix directory
+        const parts = posix.split("/");
+        for (let depth = 1; depth <= parts.length; depth += 1) {
+            const candidate = parts.slice(0, depth).join("/");
+            if (matchPolicyGlob(candidate, prefix)) {
+                return true;
+            }
+        }
+    }
+    if (g.includes("*")) {
+        return matchPolicyGlob(posix, g) || matchPolicyGlob(posix, g.endsWith("/**") ? g : `${g}/**`);
+    }
+    const prefix = rootPrefix(g);
+    return posix === prefix.replace(/\/$/, "") || posix.startsWith(prefix);
+}
+/** True when basename/path matches a test-file pattern (fnmatch / ** globs). */
+export function matchesTestFilePattern(relPath, patterns) {
+    const posix = relPath.replace(/\\/g, "/");
+    const base = basename(posix);
+    for (const pat of patterns) {
+        const p = pat.replace(/\\/g, "/");
+        if (matchPolicyGlob(posix, p) ||
+            matchPolicyGlob(base, p) ||
+            fnmatchCase(base, basename(p)) ||
+            fnmatchCase(posix, p)) {
+            return true;
+        }
+    }
+    return false;
+}
+function isUnderAnyRoot(relPath, roots) {
+    return roots.some((r) => matchesRootGlob(relPath, r));
+}
+function isAllowListed(relPath, allow) {
+    const posix = relPath.replace(/\\/g, "/");
+    for (const entry of allow) {
+        if (matchPolicyGlob(posix, entry.path) || matchesRootGlob(posix, entry.path)) {
+            return entry;
+        }
+    }
+    return null;
+}
+/** Recognise conventional test basenames without full glob (fast path). */
+export function isRecognizedTestBasename(relPath) {
+    const b = basename(relPath);
+    if (/^test_.+\.py$/i.test(b) || /.+_test\.py$/i.test(b))
+        return true;
+    if (/.+Tests?\.cs$/i.test(b))
+        return true;
+    if (/\.(test|spec)\.(ts|tsx|js|jsx)$/i.test(b))
+        return true;
+    if (/.+_test\.go$/i.test(b))
+        return true;
+    return false;
+}
+function productionReferenceRemediation() {
+    return ("Move the reference under a declared test root, add a narrow allow entry " +
+        "with kind production-liveness (health/canary only), or set " +
+        "productionMayReferenceTestRoots=true after review. See content/docs/test-boundary.md.");
+}
+function testUnderSourceRemediation() {
+    return ("Move the test artifact under a declared test root (e.g. tests/**), " +
+        "or add a reviewed allow entry in plan.policy.testBoundary.allow / " +
+        ".deft/test-boundary.policy.json. See content/docs/test-boundary.md (#3145).");
+}
+function scanProductionReferences(relPath, content, policy) {
+    // Only scan non-test production-ish paths
+    if (matchesTestFilePattern(relPath, policy.testFilePatterns) ||
+        isRecognizedTestBasename(relPath)) {
+        return null;
+    }
+    if (isUnderAnyRoot(relPath, policy.testRoots) || isUnderAnyRoot(relPath, policy.fixtureRoots)) {
+        return null;
+    }
+    // Prefer production roots; also scan infra/deploy scripts (path segments only —
+    // do not match free-text tokens inside xbrief story slugs).
+    const underSource = isUnderAnyRoot(relPath, policy.sourceRoots);
+    const looksLikeDeploy = /(^|\/)(infra|deploy|deployment|terraform|bicep|cloudformation)(\/|$)/i.test(relPath) ||
+        /(^|\/)\.github\/workflows\//i.test(relPath) ||
+        /(^|\/)Dockerfile(\.|$)/i.test(relPath) ||
+        /(^|\/).*pipeline.*\.(ya?ml|json|sh|ps1)$/i.test(relPath);
+    if (!underSource && !looksLikeDeploy) {
+        return null;
+    }
+    const rootsToForbid = [...policy.testRoots, ...policy.fixtureRoots];
+    for (const root of rootsToForbid) {
+        // Only path-shaped roots (e.g. tests/**, tests/fixtures/**) — skip basename globs
+        // like **/*_test.go which are not importable path prefixes.
+        if (!root.includes("/") && !root.endsWith("/**")) {
+            continue;
+        }
+        const needle = rootPrefix(root).replace(/\/$/, "");
+        // Require at least "tests" length and a path separator in references so bare
+        // English "test" / CI job names do not false-positive.
+        if (needle.length < 4)
+            continue;
+        if (needle === "test" || needle.endsWith("/test")) {
+            // Bare test/ is too common in prose; only match test/fixtures-style
+            if (!/fixture/i.test(root))
+                continue;
+        }
+        // Path-like only: tests/…, "tests/foo", tests\foo — not the word "tests" alone
+        const patterns = [
+            new RegExp(`(?:^|["'\`\\s=,:(])${escapeRegExp(needle)}/`),
+            new RegExp(`(?:^|["'\`\\s=,:(])${escapeRegExp(needle.replace(/\//g, "\\\\"))}\\\\`),
+        ];
+        for (const re of patterns) {
+            if (re.test(content)) {
+                return {
+                    path: relPath,
+                    kind: "production-references-test-root",
+                    detail: `references test/fixture root '${needle}/' while productionMayReferenceTestRoots is false`,
+                    remediation: productionReferenceRemediation(),
+                };
+            }
+        }
+    }
+    return null;
+}
+function escapeRegExp(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function configError(message) {
+    return { exitCode: 2, findings: [], message, policy: null };
+}
+/**
+ * Evaluate test/source boundary for a project.
+ * Pure when `policy` + `files` (+ optional `fileContents`) are injected.
+ */
+export function evaluateTestBoundary(projectRoot, options = {}) {
+    const root = resolve(projectRoot);
+    let policy;
+    try {
+        policy = options.policy ?? loadTestBoundaryPolicy(root, { policyPath: options.policyPath });
+    }
+    catch (err) {
+        return configError(`verify_test_boundary: policy load failed -- ${String(err.message)}\n` +
+            "  Recovery: fix .deft/test-boundary.policy.json or plan.policy.testBoundary, or omit for defaults.");
+    }
+    if (options.enforce === true) {
+        policy = { ...policy, enforcementMode: "enforce" };
+    }
+    else if (options.enforce === false) {
+        policy = { ...policy, enforcementMode: "warn" };
+    }
+    let files;
+    try {
+        files = options.files
+            ? [...options.files].map((f) => f.replace(/\\/g, "/"))
+            : gitTrackedFiles(root);
+    }
+    catch (err) {
+        if (err instanceof GitNotFoundError) {
+            return configError("verify_test_boundary: 'git' executable not found on PATH.\n" +
+                "  Recovery: install git or run inside a git working tree.");
+        }
+        if (err instanceof GitCommandError) {
+            const msg = err.message.toLowerCase();
+            // Only skip clean when the project is not a git repo (greenfield smoke).
+            // Other git operational failures fail closed (exit 2) — Greptile conf=0.
+            if (msg.includes("not a git repository") ||
+                msg.includes("outside repository") ||
+                msg.includes("not a git working tree")) {
+                return {
+                    exitCode: 0,
+                    findings: [],
+                    message: `verify_test_boundary: skipped -- not a git working tree (${err.message}). ` +
+                        "Initialize git, or inject files for offline evaluation (#3145).",
+                    policy,
+                };
+            }
+            return configError(`verify_test_boundary: git failed -- ${err.message}\n` +
+                "  Recovery: ensure --project-root points at a healthy git working tree.");
+        }
+        throw err;
+    }
+    const findings = [];
+    for (const rel of files) {
+        const allow = isAllowListed(rel, policy.allow);
+        if (allow !== null) {
+            continue;
+        }
+        const isTest = matchesTestFilePattern(rel, policy.testFilePatterns) || isRecognizedTestBasename(rel);
+        if (!isTest) {
+            continue;
+        }
+        // Test files under declared test roots are fine
+        if (isUnderAnyRoot(rel, policy.testRoots)) {
+            continue;
+        }
+        // Colocated under source root without test-root classification = violation
+        if (isUnderAnyRoot(rel, policy.sourceRoots)) {
+            findings.push({
+                path: rel,
+                kind: "test-under-source-root",
+                detail: `test file pattern under production source root`,
+                remediation: testUnderSourceRemediation(),
+            });
+        }
+    }
+    if (!policy.productionMayReferenceTestRoots) {
+        for (const rel of files) {
+            if (isAllowListed(rel, policy.allow) !== null)
+                continue;
+            // Skip binary-ish extensions
+            if (/\.(png|jpg|jpeg|gif|webp|ico|pdf|zip|gz|woff2?|ttf|eot|bin|exe|dll)$/i.test(rel)) {
+                continue;
+            }
+            let content;
+            if (options.fileContents !== undefined) {
+                content = options.fileContents.get(rel);
+            }
+            else {
+                const full = resolve(root, rel);
+                if (!existsSync(full))
+                    continue;
+                try {
+                    content = readFileSync(full, "utf8");
+                }
+                catch {
+                    continue;
+                }
+            }
+            if (content === undefined)
+                continue;
+            // Cap scan size
+            if (content.length > 512_000) {
+                content = content.slice(0, 512_000);
+            }
+            const finding = scanProductionReferences(rel, content, policy);
+            if (finding !== null) {
+                findings.push(finding);
+            }
+        }
+    }
+    if (findings.length === 0) {
+        return {
+            exitCode: 0,
+            findings,
+            policy,
+            message: `verify_test_boundary: clean (${files.length} file(s), policy source=${policy.source}, ` +
+                `mode=${policy.enforcementMode}) (#3145).`,
+        };
+    }
+    const header = policy.enforcementMode === "warn"
+        ? `verify_test_boundary: WARN ${findings.length} boundary finding(s) (migration/discovery mode; not failing) (#3145).`
+        : `verify_test_boundary: ${findings.length} boundary violation(s) (#3145).`;
+    // Cap diagnostic body so migration discovery does not flood task check logs.
+    const maxShown = policy.enforcementMode === "warn" ? 15 : 50;
+    const shown = findings.slice(0, maxShown);
+    const body = shown
+        .map((f) => `  ${f.path}\n    kind: ${f.kind}\n    detail: ${f.detail}\n    remediation: ${f.remediation}`)
+        .join("\n");
+    const truncated = findings.length > maxShown
+        ? `\n  … and ${findings.length - maxShown} more (re-run with authored policy to triage).`
+        : "";
+    const exitCode = policy.enforcementMode === "warn" ? 0 : 1;
+    return {
+        exitCode,
+        findings,
+        policy,
+        message: `${header}\n${body}${truncated}`,
+    };
+}
+//# sourceMappingURL=evaluate.js.map

package/dist/test-boundary/index.d.ts

@@ -0,0 +1,6 @@
+/**
+ * test-boundary package surface (#3145).
+ */
+export { evaluateTestBoundary, isRecognizedTestBasename, matchesRootGlob, matchesTestFilePattern, matchPolicyGlob, type TestBoundaryFinding, type TestBoundaryOptions, type TestBoundaryResult, type TestBoundaryViolationKind, } from "./evaluate.js";
+export { DEFAULT_FIXTURE_ROOTS, DEFAULT_SOURCE_ROOTS, DEFAULT_TEST_FILE_PATTERNS, DEFAULT_TEST_ROOTS, defaultTestBoundaryPolicy, FRAMEWORK_SELF_ALLOW, loadTestBoundaryPolicy, type TestBoundaryAllowEntry, type TestBoundaryPolicy, } from "./policy.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/test-boundary/index.js

@@ -0,0 +1,6 @@
+/**
+ * test-boundary package surface (#3145).
+ */
+export { evaluateTestBoundary, isRecognizedTestBasename, matchesRootGlob, matchesTestFilePattern, matchPolicyGlob, } from "./evaluate.js";
+export { DEFAULT_FIXTURE_ROOTS, DEFAULT_SOURCE_ROOTS, DEFAULT_TEST_FILE_PATTERNS, DEFAULT_TEST_ROOTS, defaultTestBoundaryPolicy, FRAMEWORK_SELF_ALLOW, loadTestBoundaryPolicy, } from "./policy.js";
+//# sourceMappingURL=index.js.map

package/dist/test-boundary/policy.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Typed test-boundary policy (#3145).
+ *
+ * Declares production vs test placement roots and conventional test-file
+ * patterns so verify:test-boundary can fail closed with concrete remediation.
+ */
+/** Explicit exception or production-liveness classification. */
+export interface TestBoundaryAllowEntry {
+    /** Glob or path prefix (POSIX, repo-relative). */
+    readonly path: string;
+    /** Human-readable reason recorded for review. */
+    readonly reason?: string;
+    /**
+     * `exception` = narrow reviewed carve-out;
+     * `production-liveness` = health probe / canary / operational evidence.
+     */
+    readonly kind?: "exception" | "production-liveness";
+}
+/** Machine-checked test/source boundary contract. */
+export interface TestBoundaryPolicy {
+    readonly sourceRoots: readonly string[];
+    readonly testRoots: readonly string[];
+    readonly fixtureRoots: readonly string[];
+    readonly testFilePatterns: readonly string[];
+    /** When false (default), production content must not reference test/fixture roots. */
+    readonly productionMayReferenceTestRoots: boolean;
+    readonly allow: readonly TestBoundaryAllowEntry[];
+    /**
+     * `warn` = discovery / migration (exit 0 with findings);
+     * `enforce` = fail closed (exit 1). Default `enforce` when policy is present,
+     * `warn` when only defaults are inferred (migration path).
+     */
+    readonly enforcementMode: "warn" | "enforce";
+    /** Where the policy was loaded from (for diagnostics). */
+    readonly source: "file" | "project-definition" | "defaults";
+}
+export declare const DEFAULT_TEST_FILE_PATTERNS: readonly string[];
+export declare const DEFAULT_SOURCE_ROOTS: readonly string[];
+export declare const DEFAULT_TEST_ROOTS: readonly string[];
+export declare const DEFAULT_FIXTURE_ROOTS: readonly string[];
+/** Built-in allow entries for framework self-check (colocated language tests). */
+export declare const FRAMEWORK_SELF_ALLOW: readonly TestBoundaryAllowEntry[];
+/** Default inferred policy (migration / discovery). */
+export declare function defaultTestBoundaryPolicy(enforcementMode?: "warn" | "enforce"): TestBoundaryPolicy;
+/**
+ * Load policy from explicit path, then `.deft/test-boundary.policy.json`,
+ * then `plan.policy.testBoundary` in PROJECT-DEFINITION, else defaults (warn).
+ */
+export declare function loadTestBoundaryPolicy(projectRoot: string, options?: {
+    readonly policyPath?: string | null;
+}): TestBoundaryPolicy;
+//# sourceMappingURL=policy.d.ts.map

package/dist/test-boundary/policy.js

@@ -0,0 +1,182 @@
+/**
+ * Typed test-boundary policy (#3145).
+ *
+ * Declares production vs test placement roots and conventional test-file
+ * patterns so verify:test-boundary can fail closed with concrete remediation.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+export const DEFAULT_TEST_FILE_PATTERNS = [
+    "**/test_*.py",
+    "**/*_test.py",
+    "**/*Tests.cs",
+    "**/*Test.cs",
+    "**/*.test.ts",
+    "**/*.test.tsx",
+    "**/*.test.js",
+    "**/*.test.jsx",
+    "**/*.spec.ts",
+    "**/*.spec.tsx",
+    "**/*.spec.js",
+    "**/*.spec.jsx",
+    "**/*_test.go",
+];
+export const DEFAULT_SOURCE_ROOTS = [
+    "src/**",
+    "infra/**",
+    "packages/*/src/**",
+    "cmd/**",
+    "Tools/**",
+];
+export const DEFAULT_TEST_ROOTS = [
+    "tests/**",
+    "test/**",
+    "**/__tests__/**",
+    "packages/*/test/**",
+    // Language-idiomatic colocated tests (not production pollution)
+    "packages/*/src/**/*.test.*",
+    "packages/*/src/**/*.spec.*",
+    "cmd/**/*_test.go",
+    "**/*_test.go",
+];
+export const DEFAULT_FIXTURE_ROOTS = [
+    "tests/fixtures/**",
+    "test/fixtures/**",
+    "**/fixtures/**",
+];
+/** Built-in allow entries for framework self-check (colocated language tests). */
+export const FRAMEWORK_SELF_ALLOW = [
+    {
+        path: "packages/*/src/**/*.test.ts",
+        reason: "Directive colocated unit tests under packages/*/src",
+        kind: "exception",
+    },
+    {
+        path: "packages/*/src/**/*.test.tsx",
+        reason: "Directive colocated unit tests under packages/*/src",
+        kind: "exception",
+    },
+    {
+        path: "packages/*/src/**/*.spec.ts",
+        reason: "Directive colocated unit tests under packages/*/src",
+        kind: "exception",
+    },
+    {
+        path: "cmd/**/*_test.go",
+        reason: "Go colocated package tests (language convention)",
+        kind: "exception",
+    },
+    {
+        path: "**/*_test.go",
+        reason: "Go colocated package tests (language convention)",
+        kind: "exception",
+    },
+];
+function asStringArray(raw) {
+    if (!Array.isArray(raw))
+        return [];
+    return raw
+        .filter((x) => typeof x === "string" && x.trim().length > 0)
+        .map((s) => s.trim());
+}
+function asAllowEntries(raw) {
+    if (!Array.isArray(raw))
+        return [];
+    const out = [];
+    for (const item of raw) {
+        if (typeof item === "string" && item.trim().length > 0) {
+            out.push({ path: item.trim(), kind: "exception" });
+            continue;
+        }
+        if (item !== null && typeof item === "object" && !Array.isArray(item)) {
+            const rec = item;
+            const path = typeof rec.path === "string" ? rec.path.trim() : "";
+            if (path.length === 0)
+                continue;
+            const kind = rec.kind === "production-liveness" || rec.kind === "exception" ? rec.kind : "exception";
+            const reason = typeof rec.reason === "string" ? rec.reason : undefined;
+            out.push({ path, kind, reason });
+        }
+    }
+    return out;
+}
+function parsePolicyObject(raw, source, defaultMode) {
+    const sourceRoots = asStringArray(raw.sourceRoots);
+    const testRoots = asStringArray(raw.testRoots);
+    const fixtureRoots = asStringArray(raw.fixtureRoots);
+    const testFilePatterns = asStringArray(raw.testFilePatterns);
+    const productionMayReferenceTestRoots = typeof raw.productionMayReferenceTestRoots === "boolean"
+        ? raw.productionMayReferenceTestRoots
+        : false;
+    const allow = asAllowEntries(raw.allow);
+    let enforcementMode = defaultMode;
+    if (raw.enforcementMode === "warn" || raw.enforcementMode === "enforce") {
+        enforcementMode = raw.enforcementMode;
+    }
+    return {
+        sourceRoots: sourceRoots.length > 0 ? sourceRoots : DEFAULT_SOURCE_ROOTS,
+        testRoots: testRoots.length > 0 ? testRoots : DEFAULT_TEST_ROOTS,
+        fixtureRoots: fixtureRoots.length > 0 ? fixtureRoots : DEFAULT_FIXTURE_ROOTS,
+        testFilePatterns: testFilePatterns.length > 0 ? testFilePatterns : DEFAULT_TEST_FILE_PATTERNS,
+        productionMayReferenceTestRoots,
+        allow,
+        enforcementMode,
+        source,
+    };
+}
+/** Default inferred policy (migration / discovery). */
+export function defaultTestBoundaryPolicy(enforcementMode = "warn") {
+    return {
+        sourceRoots: DEFAULT_SOURCE_ROOTS,
+        testRoots: DEFAULT_TEST_ROOTS,
+        fixtureRoots: DEFAULT_FIXTURE_ROOTS,
+        testFilePatterns: DEFAULT_TEST_FILE_PATTERNS,
+        productionMayReferenceTestRoots: false,
+        allow: [...FRAMEWORK_SELF_ALLOW],
+        enforcementMode,
+        source: "defaults",
+    };
+}
+/**
+ * Load policy from explicit path, then `.deft/test-boundary.policy.json`,
+ * then `plan.policy.testBoundary` in PROJECT-DEFINITION, else defaults (warn).
+ */
+export function loadTestBoundaryPolicy(projectRoot, options = {}) {
+    const root = resolve(projectRoot);
+    if (options.policyPath !== null && options.policyPath !== undefined) {
+        const p = resolve(options.policyPath);
+        if (!existsSync(p)) {
+            throw new Error(`test-boundary policy file not found: ${p}`);
+        }
+        const raw = JSON.parse(readFileSync(p, "utf8"));
+        if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+            throw new Error(`test-boundary policy must be a JSON object: ${p}`);
+        }
+        return parsePolicyObject(raw, "file", "enforce");
+    }
+    const deftPolicy = join(root, ".deft", "test-boundary.policy.json");
+    if (existsSync(deftPolicy)) {
+        const raw = JSON.parse(readFileSync(deftPolicy, "utf8"));
+        if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+            throw new Error(`test-boundary policy must be a JSON object: ${deftPolicy}`);
+        }
+        return parsePolicyObject(raw, "file", "enforce");
+    }
+    const pdPath = join(root, "xbrief", "PROJECT-DEFINITION.xbrief.json");
+    if (existsSync(pdPath)) {
+        try {
+            const pd = JSON.parse(readFileSync(pdPath, "utf8"));
+            const plan = pd.plan;
+            const policy = plan?.policy;
+            const tb = policy?.testBoundary;
+            if (tb !== undefined && tb !== null && typeof tb === "object" && !Array.isArray(tb)) {
+                return parsePolicyObject(tb, "project-definition", "enforce");
+            }
+        }
+        catch {
+            // fall through to defaults
+        }
+    }
+    return defaultTestBoundaryPolicy("warn");
+}
+//# sourceMappingURL=policy.js.map