@delegance/claude-autopilot 5.0.0-alpha.2 → 5.0.0-alpha.3

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## [5.0.0-alpha.3] — 2026-04-24
+
+Final alpha before v5.0.0 GA. Closes every remaining GA blocker from the alpha cycle.
+
+### Added
+- **Compiled JS entrypoint** — `npm run build` emits `dist/src/**/*.js` via `tsc -p tsconfig.build.json`. The launcher at `bin/_launcher.js` prefers the compiled output when present (global installs), falls back to `src/` + `tsx` for dev workflows. Drops `tsx` from the runtime hot path for published installs. Uses TypeScript 6's `rewriteRelativeImportExtensions: true` to rewrite `.ts` → `.js` specifiers at emit time; includes a defensive post-build rewriter script that no-ops when tsc already did the work.
+- **`claude-autopilot migrate-v4` codemod** — `src/cli/migrate-v4.ts`. Scans a target repo for `@delegance/guardrail` and `guardrail <verb>` references, proposes replacements, applies with `--write` (creates `.v4-backup.<timestamp>` files and writes a restore manifest). `--undo` reads the manifest and restores by sha256 match — refuses to overwrite files modified after the migrate. Covers `package.json` (dependency sections with operator preservation), shell scripts, Makefiles, GitHub Actions yaml, Dockerfiles (including CMD-array `["guardrail", "verb"]` form). Skips `node_modules/`, `dist/`, and the tool's own `.claude-autopilot/` state dir.
+- **Tombstone `@delegance/guardrail@5.0.0`** package at `packages/guardrail-tombstone/`. Thin CLI wrapper that forwards argv / stdio / exit code / signal to `@delegance/claude-autopilot`. Resolves the child via `createRequire().resolve()` (works under npm / pnpm / yarn / PnP) with two relative-probe fallbacks and a last-resort PATH lookup. Emits a one-line deprecation notice on stderr (silenceable via `CLAUDE_AUTOPILOT_DEPRECATION=never`). Maps ENOENT to exit 127 with an actionable install hint.
+- **CI bin-parity workflow** at `.github/workflows/bin-parity.yml`. On every push to master + PR, runs matrix (ubuntu + macos × node 22 + 24) that packs a tarball, globally installs, then asserts: (a) both bins return semver, (b) deprecation notice is on stderr under `always`, (c) deprecation does not leak onto stdout, (d) exit codes match between `claude-autopilot` and `guardrail` on a non-zero-exit invocation. A second job installs from the published `@alpha` tag on push to master for real-world parity.
+- **Prefix-hygiene test** at `tests/no-legacy-prefix.test.ts` — asserts that `src/cli/**` uses `[claude-autopilot]` not `[guardrail]`, with an explicit allowlist for legitimate legacy references (bin wrappers, launcher).
+- `tsconfig.build.json` — separate build config with `rewriteRelativeImportExtensions: true` and explicit emit settings.
+- `scripts/post-build-rewrite-imports.mjs` — defensive rewriter for `.ts` → `.js` import specifiers in emitted JS. No-op when tsc emits correctly.
+- `prepublishOnly` script — runs `build && test` before any `npm publish`.
+- 14 new tests (migrate-v4: 7, tombstone-bin: 3, no-legacy-prefix: 1, others: 3).
+
+### Changed
+- **Error prefixes normalized** — every `[guardrail] ...` error message in `src/cli/index.ts` and `src/cli/preflight.ts` now uses `[claude-autopilot]` or the phase name (`[run]`, `[doctor]`). Legacy `[guardrail]` retained only in the bin-wrapper deprecation notice, `bin/_launcher.js`, and the tombstone package (where it legitimately refers to the deprecated package name).
+- **Welcome screen rewritten** — bare `claude-autopilot` invocation now leads with the pipeline pitch (`claude-autopilot brainstorm "..."`) and frames the review subcommands as the v4-compatible alternative. Previously sold the package as "LLM code review."
+- **Version resolution in `src/cli/index.ts`** — walks up from `import.meta.url` for the nearest `@delegance/claude-autopilot` `package.json` instead of a hardcoded `../../package.json`. Necessary because the compiled entrypoint lives at `dist/src/cli/index.js` where the old relative path resolved to `dist/package.json` (which doesn't exist).
+- **`package.json` `files` field** now includes `dist/` (new) and `scripts/post-build-rewrite-imports.mjs`.
+- `preflight.ts`: "Guardrail prerequisite check" heading → "claude-autopilot prerequisite check".
+
+### Fixed
+- (None — alpha.3 is feature work; no regressions surfaced by the compat matrix.)
+
+### Still manual for GA
+- Alex to publish `@delegance/guardrail@5.0.0` tombstone from `packages/guardrail-tombstone/`.
+- Alex to run `npm dist-tag add @delegance/claude-autopilot@5.0.0 latest` once 5.0.0 GA ships.
+- Alex to run `npm deprecate @delegance/claude-autopilot@"<5.0.0" "Use @delegance/claude-autopilot@alpha during alpha cycle, or @latest after GA"` to flag pre-rename versions.
+
 ## [5.0.0-alpha.2] — 2026-04-24
 
 ### Added

package/bin/_launcher.js

@@ -9,7 +9,19 @@ import * as path from 'node:path';
 import * as os from 'node:os';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const ENTRYPOINT = path.resolve(__dirname, '..', 'src', 'cli', 'index.ts');
+const COMPILED = path.resolve(__dirname, '..', 'dist', 'src', 'cli', 'index.js');
+const SOURCE = path.resolve(__dirname, '..', 'src', 'cli', 'index.ts');
+
+/**
+ * Pick the best available entrypoint. Compiled (dist/) is preferred for global
+ * installs — no tsx dependency, faster startup. Source+tsx is used in dev from the
+ * repo itself. Result determines the spawn strategy below.
+ */
+function resolveEntry() {
+  if (fs.existsSync(COMPILED)) return { kind: 'compiled', path: COMPILED };
+  if (fs.existsSync(SOURCE)) return { kind: 'source', path: SOURCE };
+  return null;
+}
 
 function findTsx() {
   const own = path.resolve(__dirname, '..', 'node_modules', '.bin', 'tsx');
@@ -72,6 +84,37 @@ export function launch(opts) {
       'Silence: set CLAUDE_AUTOPILOT_DEPRECATION=never\n',
     );
   }
-  const result = spawnSync(findTsx(), [ENTRYPOINT, ...process.argv.slice(2)], { stdio: 'inherit' });
+
+  const entry = resolveEntry();
+  if (!entry) {
+    process.stderr.write(
+      '[claude-autopilot] Could not find CLI entrypoint. Expected either\n' +
+      `  ${COMPILED} (compiled) or\n` +
+      `  ${SOURCE} (source)\n` +
+      'Reinstall: npm install -g @delegance/claude-autopilot@alpha\n',
+    );
+    process.exit(127);
+  }
+
+  let result;
+  if (entry.kind === 'compiled') {
+    // Fast path — plain node, no tsx dep. Used by global installs (ships dist/).
+    result = spawnSync(process.execPath, [entry.path, ...process.argv.slice(2)], { stdio: 'inherit' });
+  } else {
+    // Dev path — run source via tsx. Used from the repo itself, or by users who
+    // installed from git or linked a local copy.
+    result = spawnSync(findTsx(), [entry.path, ...process.argv.slice(2)], { stdio: 'inherit' });
+  }
+
+  if (result.error) {
+    // ENOENT or similar spawn failure — surface cleanly instead of hanging.
+    process.stderr.write(`[claude-autopilot] Failed to launch CLI: ${result.error.message}\n`);
+    process.exit(127);
+  }
+  if (result.signal) {
+    // Forward child signal by re-raising equivalently
+    process.kill(process.pid, result.signal);
+    return;
+  }
   process.exit(result.status ?? 1);
 }

package/dist/presets/go/rules/go-sql-injection.js

@@ -0,0 +1,60 @@
+import * as fs from 'node:fs/promises';
+// fmt.Sprintf directly in a DB call (single-line)
+const SPRINTF_IN_QUERY = /(?:Query|Exec|QueryRow)\w*\s*\([^)]*fmt\.Sprintf/;
+// fmt.Sprintf result assigned to variable then used in DB call (multi-line)
+const SPRINTF_ASSIGN = /\bfmt\.Sprintf\s*\(/;
+const DB_CALL = /(?:Query|Exec|QueryRow)\w*\s*\(\s*(\w+)/;
+export const goSqlInjectionRule = {
+    name: 'go-sql-injection',
+    severity: 'critical',
+    async check(touchedFiles) {
+        const findings = [];
+        const goFiles = touchedFiles.filter(f => f.endsWith('.go') && !f.endsWith('_test.go'));
+        for (const file of goFiles) {
+            try {
+                const content = await fs.readFile(file, 'utf8');
+                const lines = content.split('\n');
+                // Track variables assigned from fmt.Sprintf (multi-line detection)
+                const sprintfVars = new Set();
+                for (const line of lines) {
+                    const m = line.match(/^\s*(\w+)\s*(?::?=)\s*fmt\.Sprintf\s*\(/);
+                    if (m)
+                        sprintfVars.add(m[1]);
+                }
+                for (let i = 0; i < lines.length; i++) {
+                    const line = lines[i];
+                    let hit = false;
+                    // Direct inline: db.Query(fmt.Sprintf(...))
+                    if (SPRINTF_IN_QUERY.test(line))
+                        hit = true;
+                    // Indirect: variable from fmt.Sprintf passed to DB call
+                    if (!hit && sprintfVars.size > 0) {
+                        const dbMatch = line.match(DB_CALL);
+                        if (dbMatch && sprintfVars.has(dbMatch[1]))
+                            hit = true;
+                    }
+                    if (hit) {
+                        findings.push({
+                            id: `go-sql-injection:${file}:${i + 1}`,
+                            source: 'static-rules',
+                            severity: 'critical',
+                            category: 'go-sql-injection',
+                            file,
+                            line: i + 1,
+                            message: 'SQL injection risk: fmt.Sprintf used to build query string',
+                            suggestion: 'Use parameterized queries: db.Query("WHERE id = $1", id)',
+                            protectedPath: false,
+                            createdAt: new Date().toISOString(),
+                        });
+                    }
+                }
+            }
+            catch {
+                // unreadable — skip
+            }
+        }
+        return findings;
+    },
+};
+export default goSqlInjectionRule;
+//# sourceMappingURL=go-sql-injection.js.map

package/dist/presets/go/rules/go-sql-injection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"go-sql-injection.js","sourceRoot":"","sources":["../../../../presets/go/rules/go-sql-injection.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAEvC,kDAAkD;AAClD,MAAM,gBAAgB,GAAG,kDAAkD,CAAC;AAC5E,4EAA4E;AAC5E,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAC7C,MAAM,OAAO,GAAG,yCAAyC,CAAC;AAE1D,MAAM,CAAC,MAAM,kBAAkB,GAAe;IAC5C,IAAI,EAAE,kBAAkB;IACxB,QAAQ,EAAE,UAAU;IACpB,KAAK,CAAC,KAAK,CAAC,YAAsB;QAChC,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QACvF,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAChD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAElC,mEAAmE;gBACnE,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;gBACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;oBAChE,IAAI,CAAC;wBAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;gBAChC,CAAC;gBAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;oBACvB,IAAI,GAAG,GAAG,KAAK,CAAC;oBAEhB,4CAA4C;oBAC5C,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;wBAAE,GAAG,GAAG,IAAI,CAAC;oBAE5C,wDAAwD;oBACxD,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;wBACjC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;wBACpC,IAAI,OAAO,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC;4BAAE,GAAG,GAAG,IAAI,CAAC;oBAC1D,CAAC;oBAED,IAAI,GAAG,EAAE,CAAC;wBACR,QAAQ,CAAC,IAAI,CAAC;4BACZ,EAAE,EAAE,oBAAoB,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE;4BACvC,MAAM,EAAE,cAAc;4BACtB,QAAQ,EAAE,UAAU;4BACpB,QAAQ,EAAE,kBAAkB;4BAC5B,IAAI;4BACJ,IAAI,EAAE,CAAC,GAAG,CAAC;4BACX,OAAO,EAAE,4DAA4D;4BACrE,UAAU,EAAE,0DAA0D;4BACtE,aAAa,EAAE,KAAK;4BACpB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;yBACpC,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB;YACtB,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,kBAAkB,CAAC"}

package/dist/presets/nextjs-supabase/rules/supabase-rls-bypass.js

@@ -0,0 +1,37 @@
+import * as fs from 'node:fs/promises';
+export const supabaseRlsBypassRule = {
+    name: 'supabase-rls-bypass',
+    severity: 'critical',
+    async check(touchedFiles) {
+        const findings = [];
+        const clientSideFiles = touchedFiles.filter(f => (f.endsWith('.tsx') || f.includes('/components/')) &&
+            !f.includes('/api/') && !f.includes('.test.') && !f.includes('__tests__'));
+        for (const file of clientSideFiles) {
+            let content;
+            try {
+                content = await fs.readFile(file, 'utf8');
+            }
+            catch {
+                continue;
+            }
+            if (!content.includes('createServiceRoleClient'))
+                continue;
+            const lineIndex = content.split('\n').findIndex(l => l.includes('createServiceRoleClient'));
+            findings.push({
+                id: `supabase-rls-bypass-${file}-${lineIndex}`,
+                source: 'static-rules',
+                severity: 'critical',
+                category: 'supabase-rls-bypass',
+                file,
+                line: lineIndex >= 0 ? lineIndex + 1 : undefined,
+                message: 'createServiceRoleClient() in client-side code — service role key is a RLS bypass',
+                suggestion: 'Use createServerSupabase in a server component or route handler',
+                protectedPath: true,
+                createdAt: new Date().toISOString(),
+            });
+        }
+        return findings;
+    },
+};
+export default supabaseRlsBypassRule;
+//# sourceMappingURL=supabase-rls-bypass.js.map

package/dist/presets/nextjs-supabase/rules/supabase-rls-bypass.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase-rls-bypass.js","sourceRoot":"","sources":["../../../../presets/nextjs-supabase/rules/supabase-rls-bypass.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAIvC,MAAM,CAAC,MAAM,qBAAqB,GAAe;IAC/C,IAAI,EAAE,qBAAqB;IAC3B,QAAQ,EAAE,UAAU;IAEpB,KAAK,CAAC,KAAK,CAAC,YAAsB;QAChC,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,eAAe,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAC9C,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;YAClD,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAC1E,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACnC,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBAAC,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,SAAS;YAAC,CAAC;YACtE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAC;gBAAE,SAAS;YAE3D,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC,CAAC;YAC5F,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,uBAAuB,IAAI,IAAI,SAAS,EAAE;gBAC9C,MAAM,EAAE,cAAc;gBACtB,QAAQ,EAAE,UAAU;gBACpB,QAAQ,EAAE,qBAAqB;gBAC/B,IAAI;gBACJ,IAAI,EAAE,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;gBAChD,OAAO,EAAE,kFAAkF;gBAC3F,UAAU,EAAE,iEAAiE;gBAC7E,aAAa,EAAE,IAAI;gBACnB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,qBAAqB,CAAC"}

package/dist/presets/python-fastapi/rules/fastapi-missing-auth.js

@@ -0,0 +1,49 @@
+import * as fs from 'node:fs/promises';
+// Routes that are decorated with state-mutating HTTP verbs but lack a Depends() auth call
+const MUTATION_DECORATOR = /@(app|router)\.(post|put|patch|delete)\s*\(/i;
+const HAS_AUTH_DEP = /Depends\s*\(\s*(?:get_current_user|require_auth|authenticate|verify_token)/i;
+export const fastapiMissingAuthRule = {
+    name: 'fastapi-missing-auth',
+    severity: 'critical',
+    async check(touchedFiles) {
+        const findings = [];
+        const pyFiles = touchedFiles.filter(f => f.endsWith('.py'));
+        for (const file of pyFiles) {
+            try {
+                const content = await fs.readFile(file, 'utf8');
+                const lines = content.split('\n');
+                // Check whether any router-level dependency covers the whole file
+                const fileHasRouterAuth = HAS_AUTH_DEP.test(content.slice(0, 2000));
+                if (fileHasRouterAuth)
+                    continue;
+                for (let i = 0; i < lines.length; i++) {
+                    const line = lines[i];
+                    if (!MUTATION_DECORATOR.test(line))
+                        continue;
+                    // Scan up to 40 lines after the decorator for per-endpoint auth
+                    const block = lines.slice(i, i + 40).join('\n');
+                    if (!HAS_AUTH_DEP.test(block)) {
+                        findings.push({
+                            id: `fastapi-missing-auth:${file}:${i + 1}`,
+                            source: 'static-rules',
+                            severity: 'critical',
+                            category: 'fastapi-missing-auth',
+                            file,
+                            line: i + 1,
+                            message: 'Mutation endpoint may be missing auth dependency',
+                            suggestion: 'Add current_user: User = Depends(get_current_user) to the route parameters',
+                            protectedPath: false,
+                            createdAt: new Date().toISOString(),
+                        });
+                    }
+                }
+            }
+            catch {
+                // unreadable — skip
+            }
+        }
+        return findings;
+    },
+};
+export default fastapiMissingAuthRule;
+//# sourceMappingURL=fastapi-missing-auth.js.map

package/dist/presets/python-fastapi/rules/fastapi-missing-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fastapi-missing-auth.js","sourceRoot":"","sources":["../../../../presets/python-fastapi/rules/fastapi-missing-auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAEvC,0FAA0F;AAC1F,MAAM,kBAAkB,GAAG,8CAA8C,CAAC;AAC1E,MAAM,YAAY,GAAG,6EAA6E,CAAC;AAEnG,MAAM,CAAC,MAAM,sBAAsB,GAAe;IAChD,IAAI,EAAE,sBAAsB;IAC5B,QAAQ,EAAE,UAAU;IACpB,KAAK,CAAC,KAAK,CAAC,YAAsB;QAChC,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5D,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAChD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAClC,kEAAkE;gBAClE,MAAM,iBAAiB,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;gBACpE,IAAI,iBAAiB;oBAAE,SAAS;gBAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;oBACvB,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;wBAAE,SAAS;oBAC7C,gEAAgE;oBAChE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAChD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC9B,QAAQ,CAAC,IAAI,CAAC;4BACZ,EAAE,EAAE,wBAAwB,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE;4BAC3C,MAAM,EAAE,cAAc;4BACtB,QAAQ,EAAE,UAAU;4BACpB,QAAQ,EAAE,sBAAsB;4BAChC,IAAI;4BACJ,IAAI,EAAE,CAAC,GAAG,CAAC;4BACX,OAAO,EAAE,kDAAkD;4BAC3D,UAAU,EAAE,4EAA4E;4BACxF,aAAa,EAAE,KAAK;4BACpB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;yBACpC,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB;YACtB,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,sBAAsB,CAAC"}

package/dist/presets/rails-postgres/rules/rails-sql-injection.js

@@ -0,0 +1,39 @@
+import * as fs from 'node:fs/promises';
+const INTERPOLATED_WHERE = /\.where\s*\(\s*["'`][^"'`]*#\{/;
+const INTERPOLATED_ORDER = /\.order\s*\(\s*["'`][^"'`]*#\{/;
+export const railsSqlInjectionRule = {
+    name: 'rails-sql-injection',
+    severity: 'critical',
+    async check(touchedFiles) {
+        const findings = [];
+        const rubyFiles = touchedFiles.filter(f => f.endsWith('.rb'));
+        for (const file of rubyFiles) {
+            try {
+                const lines = (await fs.readFile(file, 'utf8')).split('\n');
+                for (let i = 0; i < lines.length; i++) {
+                    const line = lines[i];
+                    if (INTERPOLATED_WHERE.test(line) || INTERPOLATED_ORDER.test(line)) {
+                        findings.push({
+                            id: `rails-sql-injection:${file}:${i + 1}`,
+                            source: 'static-rules',
+                            severity: 'critical',
+                            category: 'rails-sql-injection',
+                            file,
+                            line: i + 1,
+                            message: 'SQL injection risk: string interpolation in Active Record query',
+                            suggestion: 'Use parameterized queries: .where("name = ?", params[:name])',
+                            protectedPath: false,
+                            createdAt: new Date().toISOString(),
+                        });
+                    }
+                }
+            }
+            catch {
+                // unreadable — skip
+            }
+        }
+        return findings;
+    },
+};
+export default railsSqlInjectionRule;
+//# sourceMappingURL=rails-sql-injection.js.map

package/dist/presets/rails-postgres/rules/rails-sql-injection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rails-sql-injection.js","sourceRoot":"","sources":["../../../../presets/rails-postgres/rules/rails-sql-injection.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAEvC,MAAM,kBAAkB,GAAG,gCAAgC,CAAC;AAC5D,MAAM,kBAAkB,GAAG,gCAAgC,CAAC;AAE5D,MAAM,CAAC,MAAM,qBAAqB,GAAe;IAC/C,IAAI,EAAE,qBAAqB;IAC3B,QAAQ,EAAE,UAAU;IACpB,KAAK,CAAC,KAAK,CAAC,YAAsB;QAChC,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9D,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC5D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;oBACvB,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBACnE,QAAQ,CAAC,IAAI,CAAC;4BACZ,EAAE,EAAE,uBAAuB,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE;4BAC1C,MAAM,EAAE,cAAc;4BACtB,QAAQ,EAAE,UAAU;4BACpB,QAAQ,EAAE,qBAAqB;4BAC/B,IAAI;4BACJ,IAAI,EAAE,CAAC,GAAG,CAAC;4BACX,OAAO,EAAE,iEAAiE;4BAC1E,UAAU,EAAE,8DAA8D;4BAC1E,aAAa,EAAE,KAAK;4BACpB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;yBACpC,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB;YACtB,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,qBAAqB,CAAC"}

package/dist/presets/t3/rules/t3-server-only.js

@@ -0,0 +1,34 @@
+import * as fs from 'node:fs/promises';
+export const t3ServerOnlyRule = {
+    name: 't3-server-only',
+    severity: 'critical',
+    async check(touchedFiles) {
+        const findings = [];
+        for (const file of touchedFiles) {
+            if (!file.includes('src/server/') && !file.endsWith('.server.ts'))
+                continue;
+            try {
+                const content = await fs.readFile(file, 'utf8');
+                if (!content.includes("'server-only'") && !content.includes('"server-only"')) {
+                    findings.push({
+                        id: `t3-server-only:${file}`,
+                        source: 'static-rules',
+                        severity: 'critical',
+                        category: 't3-server-only',
+                        file,
+                        message: 'Server utility missing `server-only` import guard',
+                        suggestion: "Add `import 'server-only'` at the top of this file",
+                        protectedPath: false,
+                        createdAt: new Date().toISOString(),
+                    });
+                }
+            }
+            catch {
+                // file unreadable — skip
+            }
+        }
+        return findings;
+    },
+};
+export default t3ServerOnlyRule;
+//# sourceMappingURL=t3-server-only.js.map

package/dist/presets/t3/rules/t3-server-only.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"t3-server-only.js","sourceRoot":"","sources":["../../../../presets/t3/rules/t3-server-only.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAEvC,MAAM,CAAC,MAAM,gBAAgB,GAAe;IAC1C,IAAI,EAAE,gBAAgB;IACtB,QAAQ,EAAE,UAAU;IACpB,KAAK,CAAC,KAAK,CAAC,YAAsB;QAChC,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAAE,SAAS;YAC5E,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAChD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;oBAC7E,QAAQ,CAAC,IAAI,CAAC;wBACZ,EAAE,EAAE,kBAAkB,IAAI,EAAE;wBAC5B,MAAM,EAAE,cAAc;wBACtB,QAAQ,EAAE,UAAU;wBACpB,QAAQ,EAAE,gBAAgB;wBAC1B,IAAI;wBACJ,OAAO,EAAE,mDAAmD;wBAC5D,UAAU,EAAE,oDAAoD;wBAChE,aAAa,EAAE,KAAK;wBACpB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;qBACpC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,yBAAyB;YAC3B,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,gBAAgB,CAAC"}

package/dist/src/adapters/base.js

@@ -0,0 +1,8 @@
+// src/adapters/base.ts
+export const CORE_ADAPTER_API_VERSION_MAJOR = 1;
+export function checkApiVersionCompatibility(adapterApiVersion) {
+    const parts = adapterApiVersion.split('.');
+    const major = parseInt(parts[0] ?? '0', 10);
+    return major === CORE_ADAPTER_API_VERSION_MAJOR;
+}
+//# sourceMappingURL=base.js.map

package/dist/src/adapters/base.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.js","sourceRoot":"","sources":["../../../src/adapters/base.ts"],"names":[],"mappings":"AAAA,uBAAuB;AAYvB,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC;AAEhD,MAAM,UAAU,4BAA4B,CAAC,iBAAyB;IACpE,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;IAC5C,OAAO,KAAK,KAAK,8BAA8B,CAAC;AAClD,CAAC"}

package/dist/src/adapters/council/claude.js

@@ -0,0 +1,40 @@
+import Anthropic from '@anthropic-ai/sdk';
+import { GuardrailError } from "../../core/errors.js";
+import { classifyError } from "../review-engine/prompt-builder.js";
+const SYSTEM_PROMPT = `You are a technical advisor reviewing a software design decision. Evaluate the provided context and question critically. Be direct and specific. Surface tradeoffs, risks, and your recommendation.`;
+const MAX_OUTPUT_TOKENS = 2048;
+export function makeClaudeCouncilAdapter(model, label) {
+    return {
+        label,
+        async consult(prompt, context) {
+            const apiKey = process.env.ANTHROPIC_API_KEY;
+            if (!apiKey) {
+                throw new GuardrailError('ANTHROPIC_API_KEY not set', { code: 'auth', provider: 'claude' });
+            }
+            const client = new Anthropic({ apiKey });
+            let response;
+            try {
+                response = await client.messages.create({
+                    model,
+                    max_tokens: MAX_OUTPUT_TOKENS,
+                    system: SYSTEM_PROMPT,
+                    messages: [{ role: 'user', content: `## Context\n\n${context}\n\n## Question\n\n${prompt}` }],
+                });
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                const code = classifyError(message);
+                throw new GuardrailError(`Claude council call failed: ${message}`, {
+                    code,
+                    provider: 'claude',
+                    retryable: code === 'rate_limit',
+                });
+            }
+            return response.content
+                .filter(b => b.type === 'text')
+                .map(b => b.text)
+                .join('');
+        },
+    };
+}
+//# sourceMappingURL=claude.js.map

package/dist/src/adapters/council/claude.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude.js","sourceRoot":"","sources":["../../../../src/adapters/council/claude.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AAGnE,MAAM,aAAa,GAAG,qMAAqM,CAAC;AAC5N,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAE/B,MAAM,UAAU,wBAAwB,CAAC,KAAa,EAAE,KAAa;IACnE,OAAO;QACL,KAAK;QACL,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,OAAe;YAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;YAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,cAAc,CAAC,2BAA2B,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YACzC,IAAI,QAA2B,CAAC;YAChC,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACtC,KAAK;oBACL,UAAU,EAAE,iBAAiB;oBAC7B,MAAM,EAAE,aAAa;oBACrB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,OAAO,sBAAsB,MAAM,EAAE,EAAE,CAAC;iBAC9F,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACjE,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;gBACpC,MAAM,IAAI,cAAc,CAAC,+BAA+B,OAAO,EAAE,EAAE;oBACjE,IAAI;oBACJ,QAAQ,EAAE,QAAQ;oBAClB,SAAS,EAAE,IAAI,KAAK,YAAY;iBACjC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,QAAQ,CAAC,OAAO;iBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;iBAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAE,CAAyB,CAAC,IAAI,CAAC;iBACzC,IAAI,CAAC,EAAE,CAAC,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/src/adapters/council/openai.js

@@ -0,0 +1,39 @@
+import OpenAI from 'openai';
+import { GuardrailError } from "../../core/errors.js";
+import { classifyError } from "../review-engine/prompt-builder.js";
+const SYSTEM_PROMPT = `You are a technical advisor reviewing a software design decision. Evaluate the provided context and question critically. Be direct and specific. Surface tradeoffs, risks, and your recommendation.`;
+const MAX_OUTPUT_TOKENS = 2048;
+export function makeOpenAICouncilAdapter(model, label) {
+    return {
+        label,
+        async consult(prompt, context) {
+            const apiKey = process.env.OPENAI_API_KEY;
+            if (!apiKey) {
+                throw new GuardrailError('OPENAI_API_KEY not set', { code: 'auth', provider: 'openai' });
+            }
+            const client = new OpenAI({ apiKey });
+            let response;
+            try {
+                response = await client.chat.completions.create({
+                    model,
+                    max_tokens: MAX_OUTPUT_TOKENS,
+                    messages: [
+                        { role: 'system', content: SYSTEM_PROMPT },
+                        { role: 'user', content: `## Context\n\n${context}\n\n## Question\n\n${prompt}` },
+                    ],
+                });
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                const code = classifyError(message);
+                throw new GuardrailError(`OpenAI council call failed: ${message}`, {
+                    code,
+                    provider: 'openai',
+                    retryable: code === 'rate_limit',
+                });
+            }
+            return response.choices[0]?.message?.content ?? '';
+        },
+    };
+}
+//# sourceMappingURL=openai.js.map

package/dist/src/adapters/council/openai.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openai.js","sourceRoot":"","sources":["../../../../src/adapters/council/openai.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AAGnE,MAAM,aAAa,GAAG,qMAAqM,CAAC;AAC5N,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAE/B,MAAM,UAAU,wBAAwB,CAAC,KAAa,EAAE,KAAa;IACnE,OAAO;QACL,KAAK;QACL,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,OAAe;YAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;YAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,cAAc,CAAC,wBAAwB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YACtC,IAAI,QAA+B,CAAC;YACpC,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;oBAC9C,KAAK;oBACL,UAAU,EAAE,iBAAiB;oBAC7B,QAAQ,EAAE;wBACR,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE;wBAC1C,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,OAAO,sBAAsB,MAAM,EAAE,EAAE;qBAClF;iBACF,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACjE,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;gBACpC,MAAM,IAAI,cAAc,CAAC,+BAA+B,OAAO,EAAE,EAAE;oBACjE,IAAI;oBACJ,QAAQ,EAAE,QAAQ;oBAClB,SAAS,EAAE,IAAI,KAAK,YAAY;iBACjC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC;QACrD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/src/adapters/council/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/adapters/council/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/adapters/council/types.ts"],"names":[],"mappings":""}

package/dist/src/adapters/loader.js

@@ -0,0 +1,92 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import * as path from 'node:path';
+import { GuardrailError } from "../core/errors.js";
+import { checkApiVersionCompatibility } from "./base.js";
+const BUILTIN_PATHS = {
+    'review-engine': {
+        codex: './review-engine/codex.ts',
+        claude: './review-engine/claude.ts',
+        gemini: './review-engine/gemini.ts',
+        'openai-compatible': './review-engine/openai-compatible.ts',
+        auto: './review-engine/auto.ts',
+    },
+    'vcs-host': { github: './vcs-host/github.ts' },
+    'migration-runner': { supabase: './migration-runner/supabase.ts' },
+    'review-bot-parser': { cursor: './review-bot-parser/cursor.ts' },
+};
+const REQUIRED_BY_POINT = {
+    'review-engine': ['review', 'estimateTokens'],
+    'vcs-host': ['getPrDiff', 'getPrMetadata', 'postComment', 'getReviewComments', 'replyToComment', 'createPr', 'push'],
+    'migration-runner': ['discover', 'dryRun', 'apply', 'ledger', 'alreadyApplied'],
+    'review-bot-parser': ['detect', 'fetchFindings', 'detectDismissal'],
+};
+function isPathRef(ref) {
+    return ref.startsWith('./') || ref.startsWith('/') || ref.startsWith('../') || ref.endsWith('.ts') || ref.endsWith('.js');
+}
+export async function loadAdapter(options) {
+    const { point, ref } = options;
+    let modulePath;
+    if (isPathRef(ref)) {
+        if (!options.unsafeAllowLocalAdapters) {
+            throw new GuardrailError(`Path-based adapter refs require unsafeAllowLocalAdapters:true — set this only for trusted local adapters`, { code: 'invalid_config', details: { point, ref } });
+        }
+        modulePath = path.resolve(ref);
+    }
+    else {
+        const builtin = BUILTIN_PATHS[point]?.[ref];
+        if (!builtin) {
+            throw new GuardrailError(`Unknown built-in ${point} adapter: "${ref}"`, {
+                code: 'invalid_config',
+                details: { point, ref, available: Object.keys(BUILTIN_PATHS[point] ?? {}) },
+            });
+        }
+        modulePath = new URL(builtin, import.meta.url).pathname;
+    }
+    let mod;
+    try {
+        mod = (await import(__rewriteRelativeImportExtension(modulePath)));
+    }
+    catch (err) {
+        throw new GuardrailError(`Failed to import adapter from ${modulePath}`, {
+            code: 'invalid_config',
+            details: { point, ref, modulePath, cause: err instanceof Error ? err.message : String(err) },
+        });
+    }
+    const adapter = ('default' in mod ? mod.default : mod);
+    if (!adapter || typeof adapter !== 'object') {
+        throw new GuardrailError(`Adapter module did not export a valid adapter object`, {
+            code: 'invalid_config',
+            details: { point, ref, modulePath },
+        });
+    }
+    validateShape(adapter, point, modulePath);
+    if (!checkApiVersionCompatibility(adapter.apiVersion)) {
+        throw new GuardrailError(`Adapter apiVersion ${adapter.apiVersion} incompatible with core`, {
+            code: 'invalid_config',
+            details: { point, ref, adapterApiVersion: adapter.apiVersion },
+        });
+    }
+    return adapter;
+}
+function validateShape(adapter, point, modulePath) {
+    const missing = [];
+    const required = ['getCapabilities', ...REQUIRED_BY_POINT[point]];
+    for (const method of required) {
+        if (typeof adapter[method] !== 'function')
+            missing.push(method);
+    }
+    if (typeof adapter.name !== 'string' || typeof adapter.apiVersion !== 'string') {
+        missing.push('name/apiVersion');
+    }
+    if (missing.length > 0) {
+        throw new GuardrailError(`Adapter at ${modulePath} missing required methods: ${missing.join(', ')}`, { code: 'invalid_config', details: { point, modulePath, missing } });
+    }
+}
+//# sourceMappingURL=loader.js.map

package/dist/src/adapters/loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../../src/adapters/loader.ts"],"names":[],"mappings":";;;;;;;;AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,4BAA4B,EAAoB,MAAM,WAAW,CAAC;AAY3E,MAAM,aAAa,GAAqD;IACtE,eAAe,EAAE;QACf,KAAK,EAAE,0BAA0B;QACjC,MAAM,EAAE,2BAA2B;QACnC,MAAM,EAAE,2BAA2B;QACnC,mBAAmB,EAAE,sCAAsC;QAC3D,IAAI,EAAE,yBAAyB;KAChC;IACD,UAAU,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE;IAC9C,kBAAkB,EAAE,EAAE,QAAQ,EAAE,gCAAgC,EAAE;IAClE,mBAAmB,EAAE,EAAE,MAAM,EAAE,+BAA+B,EAAE;CACjE,CAAC;AAEF,MAAM,iBAAiB,GAAuC;IAC5D,eAAe,EAAE,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IAC7C,UAAU,EAAE,CAAC,WAAW,EAAE,eAAe,EAAE,aAAa,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,CAAC;IACpH,kBAAkB,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,CAAC;IAC/E,mBAAmB,EAAE,CAAC,QAAQ,EAAE,eAAe,EAAE,iBAAiB,CAAC;CACpE,CAAC;AAEF,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC5H,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAwB,OAA2B;IAClF,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IAC/B,IAAI,UAAkB,CAAC;IAEvB,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE,CAAC;YACtC,MAAM,IAAI,cAAc,CACtB,0GAA0G,EAC1G,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CACpD,CAAC;QACJ,CAAC;QACD,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CAAC,oBAAoB,KAAK,cAAc,GAAG,GAAG,EAAE;gBACtE,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE;aAC5E,CAAC,CAAC;QACL,CAAC;QACD,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC1D,CAAC;IAED,IAAI,GAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,GAAG,GAAG,CAAC,MAAM,MAAM,kCAAC,UAAU,EAAC,CAAwB,CAAC;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,cAAc,CAAC,iCAAiC,UAAU,EAAE,EAAE;YACtE,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SAC7F,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAM,CAAC;IAC5D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,cAAc,CAAC,sDAAsD,EAAE;YAC/E,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE;SACpC,CAAC,CAAC;IACL,CAAC;IAED,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;IAE1C,IAAI,CAAC,4BAA4B,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,cAAc,CAAC,sBAAsB,OAAO,CAAC,UAAU,yBAAyB,EAAE;YAC1F,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,iBAAiB,EAAE,OAAO,CAAC,UAAU,EAAE;SAC/D,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,OAAoB,EAAE,KAAuB,EAAE,UAAkB;IACtF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,CAAC,iBAAiB,EAAE,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;IAClE,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,IAAI,OAAQ,OAA8C,CAAC,MAAM,CAAC,KAAK,UAAU;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1G,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC/E,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,cAAc,CACtB,cAAc,UAAU,8BAA8B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC1E,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,CACpE,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/src/adapters/migration-runner/supabase.js

@@ -0,0 +1,50 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { runSafe } from "../../core/shell.js";
+export const supabaseAdapter = {
+    name: 'supabase',
+    apiVersion: '1.0.0',
+    getCapabilities() {
+        return { structuredOutput: false, streaming: false, maxContextTokens: 0, inlineComments: false };
+    },
+    discover(touchedFiles) {
+        const sqlFiles = touchedFiles.filter(f => f.match(/data\/deltas\/[^/]+\.sql$/));
+        return sqlFiles.map(p => ({
+            name: path.basename(p, '.sql'),
+            path: p,
+        }));
+    },
+    async dryRun(migration) {
+        try {
+            const content = migration.content ?? fs.readFileSync(migration.path, 'utf8');
+            if (!content.trim())
+                return { ok: false, errors: ['Migration file is empty'] };
+            return { ok: true };
+        }
+        catch (err) {
+            return { ok: false, errors: [err instanceof Error ? err.message : String(err)] };
+        }
+    },
+    async apply(migration, env) {
+        const start = Date.now();
+        const envFlag = env === 'prod' ? '--prod' : env === 'qa' ? '--qa' : '';
+        const args = ['tsx', 'scripts/supabase/migrate.ts', migration.path];
+        if (envFlag)
+            args.push(envFlag);
+        const result = runSafe('npx', args);
+        if (result === null) {
+            return { ok: false, errors: [`Migration apply failed for ${migration.name} on ${env}`] };
+        }
+        return { ok: true, durationMs: Date.now() - start };
+    },
+    async ledger(_env) {
+        // alpha.1: full ledger query lands in alpha.2
+        return [];
+    },
+    async alreadyApplied(migration, _env) {
+        const result = runSafe('npx', ['tsx', 'scripts/supabase/migrate.ts', migration.path, '--inspect']);
+        return result !== null && result.includes('already applied');
+    },
+};
+export default supabaseAdapter;
+//# sourceMappingURL=supabase.js.map

package/dist/src/adapters/migration-runner/supabase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase.js","sourceRoot":"","sources":["../../../../src/adapters/migration-runner/supabase.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAI9C,MAAM,CAAC,MAAM,eAAe,GAAoB;IAC9C,IAAI,EAAE,UAAU;IAChB,UAAU,EAAE,OAAO;IAEnB,eAAe;QACb,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IACnG,CAAC;IAED,QAAQ,CAAC,YAAsB;QAC7B,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC;QAChF,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACxB,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;YAC9B,IAAI,EAAE,CAAC;SACR,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAoB;QAC/B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC7E,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,yBAAyB,CAAC,EAAE,CAAC;YAC/E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACnF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,SAAoB,EAAE,GAAiB;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,6BAA6B,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACpE,IAAI,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACpC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,8BAA8B,SAAS,CAAC,IAAI,OAAO,GAAG,EAAE,CAAC,EAAE,CAAC;QAC3F,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAkB;QAC7B,8CAA8C;QAC9C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,SAAoB,EAAE,IAAkB;QAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,6BAA6B,EAAE,SAAS,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;QACnG,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAC/D,CAAC;CACF,CAAC;AAEF,eAAe,eAAe,CAAC"}

package/dist/src/adapters/migration-runner/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/adapters/migration-runner/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/adapters/migration-runner/types.ts"],"names":[],"mappings":""}