@descent-vtt/spec-harness 0.6.0 → 0.7.0

package/dist/setup.js

@@ -11,14 +11,14 @@
  * that exist and never replaces what a person wrote; a git hook the
  * repository already has is left alone, with the line to add printed instead.
  */
-import { existsSync } from 'node:fs';
+import { existsSync, statSync } from 'node:fs';
 import { chmod, mkdir, readFile } from 'node:fs/promises';
-import { dirname, join } from 'node:path';
+import { dirname, isAbsolute, join, relative, sep } from 'node:path';
 import { CONFIG_FILE } from './config.js';
-import { chooseBase, describeGraph, describeSkipped, enabledPlugin, graphReadsBriefs, GUARD_HOOK, holdsGuard, loadsPlugin, measuresArchive, mergeClaudeSettings, mergeMcp, mergeSpecBrief, mergeSpecGraph, PLUGIN, registersServer, SPEC_BRIEF_CONFIGS, SPEC_GRAPH_CONFIGS, } from './configure.js';
+import { chooseBase, describeGitHook, describeGraph, describeSkipped, enabledPlugin, GIT_HOOK_LINE, graphReadsBriefs, GUARD_HOOK, holdsGuard, loadsPlugin, measuresArchive, mergeClaudeSettings, mergeMcp, mergeSpecBrief, mergeSpecGraph, missingGitHook, PLUGIN, PROTECT_RULE_FILES, registersServer, SPEC_BRIEF_CONFIGS, SPEC_GRAPH_CONFIGS, } from './configure.js';
 import { readJsonObject as readJson, writeAtomic } from './fs.js';
-import { git, localBranches, remoteDefault } from './git.js';
-import { claudeSettings } from './round.js';
+import { hookPath, localBranches, remoteDefault } from './git.js';
+import { claudeSettings, pluginFile } from './round.js';
 import { runSibling } from './siblings.js';
 import { EXIT_ERROR, EXIT_OK, json, openWorkspace } from './workspace.js';
 function stringify(value) {
@@ -36,6 +36,30 @@ const PRE_COMMIT = `#!/bin/sh
 # spec-harness: refuse a commit that changes what the active brief protects.
 exec npx --no-install spec-harness hook git
 `;
+/** A path as a person finds it: from the root when it is inside it, POSIX-separated, and as it is otherwise. */
+function shown(root, path) {
+    const inside = relative(root, path);
+    return inside === '' || inside.startsWith('..') || isAbsolute(inside) ? path : inside.split(sep).join('/');
+}
+/**
+ * git's pre-commit hook, where git runs it from, and what is there: init and
+ * doctor both read it. `path` is `null` when git cannot say where its hooks
+ * are.
+ */
+export async function gitHook(root) {
+    const path = await hookPath('pre-commit', root);
+    if (path === null)
+        return { hook: { state: 'unknown', reason: 'git does not say where they are; spec-harness needs git 2.31 or later' }, path };
+    const file = shown(root, path);
+    if (!existsSync(path))
+        return { hook: { state: 'absent', file }, path };
+    if (!(await readFile(path, 'utf8')).includes('spec-harness'))
+        return { hook: { state: 'other', file }, path };
+    // git skips a hook it cannot execute, and says so only in a hint; Windows
+    // has no executable bit, and runs it.
+    const inert = process.platform !== 'win32' && (statSync(path).mode & 0o111) === 0;
+    return { hook: { state: inert ? 'inert' : 'runs', file }, path };
+}
 export async function plan(workspace, options, env) {
     const { root } = workspace;
     const steps = [];
@@ -76,7 +100,7 @@ export async function plan(workspace, options, env) {
                     const written = await readJson(created);
                     if (written === null || written === 'unreadable')
                         throw new Error('spec-brief init wrote no configuration JSON can read');
-                    const merged = mergeSpecBrief(written, base);
+                    const merged = mergeSpecBrief(written, base, pluginFile(root));
                     if (merged !== null)
                         await writeAtomic(created, stringify(merged));
                 },
@@ -102,14 +126,15 @@ export async function plan(workspace, options, env) {
             steps.push({ file: briefConfig, action: 'advise', detail: `cannot be read as JSON; add "plugins": ["${PLUGIN}"]${measure} by hand` });
         }
         else {
-            const merged = mergeSpecBrief(config, base);
+            const isPluginFile = pluginFile(root);
+            const merged = mergeSpecBrief(config, base, isPluginFile);
             const measured = measuresArchive(config);
             if (merged === null) {
                 const from = measured ? `, and the archive is measured from ${String(config['archiving']['base'])}` : '';
                 steps.push({ file: briefConfig, action: 'keep', detail: `spec-harness's plugin is loaded${from}` });
             }
             else {
-                const detail = specBriefDetail(!loadsPlugin(config), measured ? null : base);
+                const detail = specBriefDetail(!loadsPlugin(config, isPluginFile), measured ? null : base);
                 steps.push({ file: briefConfig, action: 'update', detail, apply: () => writeAtomic(file, stringify(merged)) });
             }
         }
@@ -204,33 +229,44 @@ export async function plan(workspace, options, env) {
                 apply: () => writeAtomic(mcpFile, stringify(merged)),
             });
     }
-    // git's hook, only when asked: it is configuration outside the tree.
-    if (options.gitHook) {
-        const hooksPath = (await git(['config', '--get', 'core.hooksPath'], root)).stdout.trim();
-        const hookFile = hooksPath === '' ? join(workspace.commonDir, 'hooks', 'pre-commit') : join(root, hooksPath, 'pre-commit');
-        if (existsSync(hookFile)) {
-            const text = await readFile(hookFile, 'utf8');
-            steps.push(text.includes('spec-harness')
-                ? { file: hookFile, action: 'keep', detail: 'already runs spec-harness' }
-                : { file: hookFile, action: 'advise', detail: 'a pre-commit hook exists; add the line "npx --no-install spec-harness hook git" to it' });
-        }
-        else {
-            steps.push({
-                file: hookFile,
-                action: 'create',
-                detail: 'refuse a commit that changes what the active brief protects',
-                apply: async () => {
-                    await mkdir(dirname(hookFile), { recursive: true });
-                    await writeAtomic(hookFile, PRE_COMMIT);
-                    await chmod(hookFile, 0o755);
-                },
-            });
-        }
+    // git's hook, where git runs it from: core.hooksPath as git reads it, and
+    // a linked worktree's shared hooks. It is the guard for a write the agent's
+    // hooks never see, one through a shell, so it is advised when not asked
+    // for; it is configuration outside the tree, so it is written only then.
+    const { hook, path: hookFile } = await gitHook(root);
+    if (hook.state === 'unknown' || hookFile === null) {
+        steps.push({ file: 'pre-commit', action: 'advise', detail: describeGitHook(hook) });
+    }
+    else if (hook.state === 'runs') {
+        steps.push({ file: hook.file, action: 'keep', detail: 'already runs spec-harness' });
+    }
+    else if (hook.state === 'inert') {
+        steps.push({ file: hook.file, action: 'advise', detail: describeGitHook(hook) });
+    }
+    else if (hook.state === 'other') {
+        steps.push({ file: hook.file, action: 'advise', detail: `a pre-commit hook exists; add the line "${GIT_HOOK_LINE}" to it` });
+    }
+    else if (options.gitHook) {
+        steps.push({
+            file: hook.file,
+            action: 'create',
+            detail: 'refuse a commit that changes what the active brief protects',
+            apply: async () => {
+                await mkdir(dirname(hookFile), { recursive: true });
+                await writeAtomic(hookFile, PRE_COMMIT);
+                await chmod(hookFile, 0o755);
+            },
+        });
+    }
+    else {
+        steps.push({ file: hook.file, action: 'advise', detail: missingGitHook(null) });
     }
+    // The file the configuration names, which a ruling's signature is checked
+    // against on the base branch (ADR-0006).
     steps.push({
-        file: '.github/allowed_signers',
+        file: workspace.config.rulings.allowedSigners,
         action: 'advise',
-        detail: 'rulings count only when signed by a key listed here on the base branch: one line per person, <email> namespaces="git" <public key>; protect it, the ADRs and the tool configurations with CODEOWNERS',
+        detail: `rulings count only when signed by a key listed here on the base branch: one line per person, <email> namespaces="git" <public key>. Where an agent runs as the person, make it a FIDO2 key, ssh-keygen -t ed25519-sk, whose signature needs a touch no process can supply. ${PROTECT_RULE_FILES}`,
     });
     return steps;
 }

package/dist/setup.js.map

@@ -1 +1 @@
-{"version":3,"file":"setup.js","sourceRoot":"","sources":["../src/setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,UAAU,EACV,aAAa,EACb,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,WAAW,EACX,eAAe,EACf,mBAAmB,EACnB,QAAQ,EACR,cAAc,EACd,cAAc,EACd,MAAM,EACN,eAAe,EACf,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,IAAI,QAAQ,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAA4C,MAAM,gBAAgB,CAAC;AAcpH,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED,MAAM,aAAa,GAAG,gCAAgC,MAAM,kHAAkH,CAAC;AAE/K,4EAA4E;AAC5E,SAAS,eAAe,CAAC,MAAe,EAAE,IAAmB;IAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,IAAI,IAAI,KAAK,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,4BAA4B,IAAI,gIAAgI,CAAC,CAAC;IAChM,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,GAAG;;;CAGlB,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,SAAoB,EAAE,OAAgB,EAAE,GAAiB;IAClF,MAAM,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC;IAC3B,MAAM,KAAK,GAAW,EAAE,CAAC;IAEzB,0EAA0E;IAC1E,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,YAAY,IAAI,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/H,MAAM,MAAM,GACV,OAAO,KAAK,YAAY,IAAI,SAAS,KAAK,IAAI;QAC5C,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,UAAU,CAAC,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9H,MAAM,IAAI,GAAG,SAAS,IAAI,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC;IAE/C,yEAAyE;IACzE,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACpF,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACtD,IAAI,MAAM,GAAG,QAAQ,CAAC;IACtB,IAAI,OAAO,GAAG,gBAAgB,CAAC;IAC/B,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;YAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;YAC/C,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,kBAAkB;gBACxB,MAAM,EAAE,KAAK;gBACb,MAAM,EAAE,+EAA+E;gBACvF,KAAK,EAAE,KAAK,IAAI,EAAE;oBAChB,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;oBACtD,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACtF,CAAC;aACF,CAAC,CAAC;YACH,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,kBAAkB;gBACxB,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC;gBACnC,KAAK,EAAE,KAAK,IAAI,EAAE;oBAChB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;oBACxC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,YAAY;wBAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;oBAC1H,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;oBAC7C,IAAI,MAAM,KAAK,IAAI;wBAAE,MAAM,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;gBACrE,CAAC;aACF,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;YAC/C,IAAI,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,QAAQ;gBAAE,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;YACpE,OAAO,GAAG,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,UAAU,CAAC;QAC5F,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,MAAM,qBAAqB,OAAO,GAAG,EAAE,CAAC,CAAC;QAC9G,2EAA2E;QAC3E,8CAA8C;QAC9C,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAC/C,MAAM,OAAO,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iCAAiC,IAAI,KAAK,CAAC;YAChF,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,4CAA4C,MAAM,KAAK,OAAO,UAAU,EAAE,CAAC,CAAC;QACxI,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC5C,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,sCAAsC,MAAM,CAAE,MAAM,CAAC,WAAW,CAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnH,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,kCAAkC,IAAI,EAAE,EAAE,CAAC,CAAC;YACtG,CAAC;iBAAM,CAAC;gBACN,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC7E,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;YACjH,CAAC;QACH,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,yEAAyE;IACzE,gDAAgD;IAChD,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACtD,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAChH,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,WAAW,GAAG,GAAG,OAAO,KAAK,CAAC;QACpC,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAClF,MAAM,QAAQ,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7F,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,YAAY,IAAI,YAAY,IAAI,QAAQ,EAAE,CAAC;YAC/E,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,qGAAqG,WAAW,oCAAoC,EAAE,CAAC,CAAC;QACvN,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,SAAS,IAAI,kBAAkB,CAAC;YAC7C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YACjD,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;gBAC7B,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,oDAAoD,WAAW,YAAY,EAAE,CAAC,CAAC;YAC9H,CAAC;iBAAM,CAAC;gBACN,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC;gBAC1D,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,gBAAgB,CAAC,OAAO,IAAI,EAAE,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC,CAAC;gBAC5G,IAAI,MAAM,KAAK,IAAI;oBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;;oBAC7D,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;YACnJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,wDAAwD;IACxD,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,2EAA2E,EAAE,CAAC,CAAC;IAC3I,CAAC;SAAM,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,4BAA4B,SAAS,EAAE,EAAE,CAAC,CAAC;IACrG,CAAC;SAAM,IAAI,IAAI,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,2CAA2C,EAAE,CAAC,CAAC;IAC7H,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAS,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3C,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IACtK,CAAC;IAED,2EAA2E;IAC3E,uEAAuE;IACvE,sCAAsC;IACtC,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC9C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IACxI,CAAC;SAAM,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,yFAAyF,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;IACjM,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,mBAAmB,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,MAAM,KAAK,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC,CAAC;;YAE1H,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,uBAAuB;gBAC7B,MAAM,EAAE,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;gBAC/C,MAAM,EAAE,0KAA0K;gBAClL,KAAK,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,YAAY,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;aAC1D,CAAC,CAAC;IACP,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7H,CAAC;SAAM,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,6DAA6D,EAAE,CAAC,CAAC;IAC7H,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QACnC,IAAI,MAAM,KAAK,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC,CAAC;;YAEtH,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,WAAW;gBACjB,MAAM,EAAE,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;gBAC1C,MAAM,EAAE,+IAA+I;gBACvJ,KAAK,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;aACrD,CAAC,CAAC;IACP,CAAC;IAED,qEAAqE;IACrE,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,gBAAgB,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACzF,MAAM,QAAQ,GAAG,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;QAC3H,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC9C,KAAK,CAAC,IAAI,CACR,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;gBAC3B,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,2BAA2B,EAAE;gBACzE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,uFAAuF,EAAE,CAC1I,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,6DAA6D;gBACrE,KAAK,EAAE,KAAK,IAAI,EAAE;oBAChB,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;oBACpD,MAAM,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;oBACxC,MAAM,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBAC/B,CAAC;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC;QACT,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,QAAQ;QAChB,MAAM,EACJ,sMAAsM;KACzM,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAgB,EAAE,EAAS;IAC3D,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC7B,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;gBACrB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,IAAI,CAAC,IAAI,KAAM,KAAe,CAAC,OAAO,IAAI,CAAC,CAAC;oBAC7E,OAAO,UAAU,CAAC;gBACpB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxI,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,aAAa,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;QAC9G,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC;YAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC;IAC9J,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["/**\n * `spec-harness init`: the family configured to agree, from the first day.\n *\n * The integration faults found when the tools were first run together were all\n * configuration: spec-graph read an archived brief as a retired decision and\n * reported every brief that depended on one; spec-guard executed an archived\n * brief's assertions. Each tool can be told the truth; `init` tells each of\n * them the same truth, derived from spec-brief's own settings.\n *\n * It prints a plan and changes nothing until `--write`. It merges into files\n * that exist and never replaces what a person wrote; a git hook the\n * repository already has is left alone, with the line to add printed instead.\n */\n\nimport { existsSync } from 'node:fs';\nimport { chmod, mkdir, readFile } from 'node:fs/promises';\nimport { dirname, join } from 'node:path';\n\nimport { CONFIG_FILE } from './config.js';\nimport {\n  chooseBase,\n  describeGraph,\n  describeSkipped,\n  enabledPlugin,\n  graphReadsBriefs,\n  GUARD_HOOK,\n  holdsGuard,\n  loadsPlugin,\n  measuresArchive,\n  mergeClaudeSettings,\n  mergeMcp,\n  mergeSpecBrief,\n  mergeSpecGraph,\n  PLUGIN,\n  registersServer,\n  SPEC_BRIEF_CONFIGS,\n  SPEC_GRAPH_CONFIGS,\n} from './configure.js';\nimport { readJsonObject as readJson, writeAtomic } from './fs.js';\nimport { git, localBranches, remoteDefault } from './git.js';\nimport { claudeSettings } from './round.js';\nimport { runSibling } from './siblings.js';\nimport { EXIT_ERROR, EXIT_OK, json, openWorkspace, type CliIO, type Options, type Workspace } from './workspace.js';\n\n/** `skip`: a file init would write, left alone because Claude Code's plugin brings what init would add. */\nexport type Action = 'create' | 'update' | 'keep' | 'skip' | 'run' | 'advise';\n\nexport interface Step {\n  readonly file: string;\n  readonly action: Action;\n  readonly detail: string;\n  apply?: () => Promise<void>;\n}\n\ntype Json = Record<string, unknown>;\n\nfunction stringify(value: unknown): string {\n  return `${JSON.stringify(value, null, 2)}\\n`;\n}\n\nconst PLUGIN_DETAIL = `load spec-harness's plugin, \"${PLUGIN}\": spec-brief's archive asks it whether a signed ruling allows a protected file, and refuses the file without it`;\n\n/** What init adds to spec-brief's configuration, said once for the plan. */\nfunction specBriefDetail(plugin: boolean, base: string | null): string {\n  const parts = plugin ? [PLUGIN_DETAIL] : [];\n  if (base !== null) parts.push(`measure the archive from ${base}, as spec-harness does: without a base, spec-brief's archive warns that the scope went unmeasured and checks no protected file`);\n  return parts.join('; ');\n}\n\nconst PRE_COMMIT = `#!/bin/sh\n# spec-harness: refuse a commit that changes what the active brief protects.\nexec npx --no-install spec-harness hook git\n`;\n\nexport async function plan(workspace: Workspace, options: Options, env: CliIO['env']): Promise<Step[]> {\n  const { root } = workspace;\n  const steps: Step[] = [];\n\n  // The base rounds merge into, decided once: spec-harness verifies rulings\n  // against the allowed signers on it, and spec-brief's archive measures the\n  // round from it. A base a person wrote, in either file, is kept.\n  const harnessFile = join(root, CONFIG_FILE);\n  const harness = await readJson(harnessFile);\n  const namedBase = harness !== null && harness !== 'unreadable' && typeof harness['base'] === 'string' ? harness['base'] : null;\n  const choice =\n    harness === 'unreadable' || namedBase !== null\n      ? null\n      : chooseBase({ remoteDefault: await remoteDefault(root), branch: workspace.branch, branches: await localBranches(root) });\n  const base = namedBase ?? choice?.base ?? null;\n\n  // spec-brief first: every other setting is derived from its directories.\n  const briefConfig = SPEC_BRIEF_CONFIGS.find((name) => existsSync(join(root, name)));\n  const brief = workspace.siblings.locate('spec-brief');\n  let briefs = 'briefs';\n  let archive = 'briefs/archive';\n  if (briefConfig === undefined) {\n    if (brief.kind === 'found') {\n      const command = brief.command;\n      const created = join(root, '.spec-brief.json');\n      steps.push({\n        file: '.spec-brief.json',\n        action: 'run',\n        detail: 'spec-brief init: the brief and archive directories, every default spelled out',\n        apply: async () => {\n          const run = await runSibling(command, ['init'], root);\n          if (run.code !== 0) throw new Error(`spec-brief init failed: ${run.stderr.trim()}`);\n        },\n      });\n      steps.push({\n        file: '.spec-brief.json',\n        action: 'update',\n        detail: specBriefDetail(true, base),\n        apply: async () => {\n          const written = await readJson(created);\n          if (written === null || written === 'unreadable') throw new Error('spec-brief init wrote no configuration JSON can read');\n          const merged = mergeSpecBrief(written, base);\n          if (merged !== null) await writeAtomic(created, stringify(merged));\n        },\n      });\n    } else {\n      steps.push({ file: '.spec-brief.json', action: 'advise', detail: brief.reason });\n    }\n  } else {\n    const file = join(root, briefConfig);\n    const config = await readJson(file);\n    if (config !== null && config !== 'unreadable') {\n      if (typeof config['briefs'] === 'string') briefs = config['briefs'];\n      archive = typeof config['archive'] === 'string' ? config['archive'] : `${briefs}/archive`;\n    }\n    steps.push({ file: briefConfig, action: 'keep', detail: `briefs in ${briefs}/, the archive in ${archive}/` });\n    // spec-brief's archive learns that a signed ruling allows a protected file\n    // only from this package's plugin (ADR-0006).\n    if (config === 'unreadable' || config === null) {\n      const measure = base === null ? '' : `, and \"archiving\": { \"base\": \"${base}\" }`;\n      steps.push({ file: briefConfig, action: 'advise', detail: `cannot be read as JSON; add \"plugins\": [\"${PLUGIN}\"]${measure} by hand` });\n    } else {\n      const merged = mergeSpecBrief(config, base);\n      const measured = measuresArchive(config);\n      if (merged === null) {\n        const from = measured ? `, and the archive is measured from ${String((config['archiving'] as Json)['base'])}` : '';\n        steps.push({ file: briefConfig, action: 'keep', detail: `spec-harness's plugin is loaded${from}` });\n      } else {\n        const detail = specBriefDetail(!loadsPlugin(config), measured ? null : base);\n        steps.push({ file: briefConfig, action: 'update', detail, apply: () => writeAtomic(file, stringify(merged)) });\n      }\n    }\n  }\n\n  // spec-graph: an archived brief is a record, not a retired decision. Its\n  // configuration is the first of its files, then a key in package.json; a\n  // file written beside that key would shadow it.\n  const graph = workspace.siblings.locate('spec-graph');\n  if (graph.kind === 'outdated') steps.push({ file: '.spec-graph.json', action: 'advise', detail: graph.reason });\n  if (graph.kind === 'found') {\n    const archiveGlob = `${archive}/**`;\n    const graphName = SPEC_GRAPH_CONFIGS.find((name) => existsSync(join(root, name)));\n    const manifest = graphName === undefined ? await readJson(join(root, 'package.json')) : null;\n    if (manifest !== null && manifest !== 'unreadable' && 'spec-graph' in manifest) {\n      steps.push({ file: 'package.json', action: 'advise', detail: `spec-graph reads its configuration from the \"spec-graph\" key here, which init does not edit: add \"${archiveGlob}\" to its \"historyPatterns\" by hand` });\n    } else {\n      const file = graphName ?? '.spec-graph.json';\n      const current = await readJson(join(root, file));\n      if (current === 'unreadable') {\n        steps.push({ file, action: 'advise', detail: `cannot be read as JSON; add \"historyPatterns\": [\"${archiveGlob}\"] by hand` });\n      } else {\n        const merged = mergeSpecGraph(current ?? {}, archiveGlob);\n        const detail = describeGraph(archiveGlob, briefs, graphReadsBriefs(current ?? {}, briefs), merged !== null);\n        if (merged === null) steps.push({ file, action: 'keep', detail });\n        else steps.push({ file, action: current === null ? 'create' : 'update', detail, apply: () => writeAtomic(join(root, file), stringify(merged)) });\n      }\n    }\n  }\n\n  // spec-harness's own file, naming the base the rounds merge into: every\n  // ruling is verified against the allowed signers on it.\n  if (harness === 'unreadable') {\n    steps.push({ file: CONFIG_FILE, action: 'advise', detail: 'cannot be read as JSON; name the base rounds merge into as \"base\" by hand' });\n  } else if (namedBase !== null) {\n    steps.push({ file: CONFIG_FILE, action: 'keep', detail: `rounds are measured from ${namedBase}` });\n  } else if (base === null || choice === null) {\n    steps.push({ file: CONFIG_FILE, action: 'advise', detail: choice?.detail ?? 'name the base rounds merge into as \"base\"' });\n  } else {\n    const content: Json = { ...harness, base };\n    steps.push({ file: CONFIG_FILE, action: harness === null ? 'create' : 'update', detail: choice.detail, apply: () => writeAtomic(harnessFile, stringify(content)) });\n  }\n\n  // The agent's hooks and server, unless the plugin brings them: Claude Code\n  // runs a plugin's hook beside the same hook in settings, so both would\n  // guard every write twice (ADR-0012).\n  const plugin = enabledPlugin(await claudeSettings(root, env));\n  const settingsFile = join(root, '.claude', 'settings.json');\n  const settings = await readJson(settingsFile);\n  if (plugin !== null) {\n    const present = holdsGuard(settings);\n    steps.push({ file: '.claude/settings.json', action: present ? 'advise' : 'skip', detail: describeSkipped(plugin, 'hooks', present) });\n  } else if (settings === 'unreadable') {\n    steps.push({ file: '.claude/settings.json', action: 'advise', detail: `cannot be read as JSON; add the guard as a PreToolUse and a PostToolUse hook by hand: ${JSON.stringify(GUARD_HOOK)}` });\n  } else {\n    const merged = mergeClaudeSettings(settings ?? {});\n    if (merged === null) steps.push({ file: '.claude/settings.json', action: 'keep', detail: 'the guard hooks are installed' });\n    else\n      steps.push({\n        file: '.claude/settings.json',\n        action: settings === null ? 'create' : 'update',\n        detail: 'the guard hooks, run with node from the project\\'s install: a PreToolUse hook refuses writes to protected files; a PostToolUse hook warns about writes outside the scope',\n        apply: () => writeAtomic(settingsFile, stringify(merged)),\n      });\n  }\n  const mcpFile = join(root, '.mcp.json');\n  const mcp = await readJson(mcpFile);\n  if (plugin !== null) {\n    const present = registersServer(mcp);\n    steps.push({ file: '.mcp.json', action: present ? 'advise' : 'skip', detail: describeSkipped(plugin, 'server', present) });\n  } else if (mcp === 'unreadable') {\n    steps.push({ file: '.mcp.json', action: 'advise', detail: 'cannot be read as JSON; add the spec-harness server by hand' });\n  } else {\n    const merged = mergeMcp(mcp ?? {});\n    if (merged === null) steps.push({ file: '.mcp.json', action: 'keep', detail: 'the spec-harness server is registered' });\n    else\n      steps.push({\n        file: '.mcp.json',\n        action: mcp === null ? 'create' : 'update',\n        detail: 'the spec-harness MCP server, run with node from the project\\'s install: start_round, check_path, request_escalation, audit_round, list_rounds',\n        apply: () => writeAtomic(mcpFile, stringify(merged)),\n      });\n  }\n\n  // git's hook, only when asked: it is configuration outside the tree.\n  if (options.gitHook) {\n    const hooksPath = (await git(['config', '--get', 'core.hooksPath'], root)).stdout.trim();\n    const hookFile = hooksPath === '' ? join(workspace.commonDir, 'hooks', 'pre-commit') : join(root, hooksPath, 'pre-commit');\n    if (existsSync(hookFile)) {\n      const text = await readFile(hookFile, 'utf8');\n      steps.push(\n        text.includes('spec-harness')\n          ? { file: hookFile, action: 'keep', detail: 'already runs spec-harness' }\n          : { file: hookFile, action: 'advise', detail: 'a pre-commit hook exists; add the line \"npx --no-install spec-harness hook git\" to it' },\n      );\n    } else {\n      steps.push({\n        file: hookFile,\n        action: 'create',\n        detail: 'refuse a commit that changes what the active brief protects',\n        apply: async () => {\n          await mkdir(dirname(hookFile), { recursive: true });\n          await writeAtomic(hookFile, PRE_COMMIT);\n          await chmod(hookFile, 0o755);\n        },\n      });\n    }\n  }\n\n  steps.push({\n    file: '.github/allowed_signers',\n    action: 'advise',\n    detail:\n      'rulings count only when signed by a key listed here on the base branch: one line per person, <email> namespaces=\"git\" <public key>; protect it, the ADRs and the tool configurations with CODEOWNERS',\n  });\n  return steps;\n}\n\nexport async function initCommand(options: Options, io: CliIO): Promise<number> {\n  const workspace = await openWorkspace(options, io);\n  const steps = await plan(workspace, options, io.env);\n  if (options.write) {\n    for (const step of steps) {\n      if (step.apply !== undefined) {\n        try {\n          await step.apply();\n        } catch (error) {\n          io.stderr.write(`spec-harness: ${step.file}: ${(error as Error).message}\\n`);\n          return EXIT_ERROR;\n        }\n      }\n    }\n  }\n  if (options.format === 'json') {\n    io.stdout.write(json('init', { written: options.write, steps: steps.map(({ file, action, detail }) => ({ file, action, detail })) }));\n  } else {\n    for (const step of steps) io.stdout.write(`${step.action.padEnd(6)}  ${step.file}\\n        ${step.detail}\\n`);\n    if (!options.write && steps.some((step) => step.apply !== undefined)) io.stdout.write('\\nNothing was changed. Run again with --write to apply the plan.\\n');\n  }\n  return EXIT_OK;\n}\n"]}
+{"version":3,"file":"setup.js","sourceRoot":"","sources":["../src/setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAErE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,UAAU,EACV,eAAe,EACf,aAAa,EACb,eAAe,EACf,aAAa,EACb,aAAa,EAEb,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,WAAW,EACX,eAAe,EACf,mBAAmB,EACnB,QAAQ,EACR,cAAc,EACd,cAAc,EACd,cAAc,EACd,MAAM,EACN,kBAAkB,EAClB,eAAe,EACf,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,IAAI,QAAQ,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAA4C,MAAM,gBAAgB,CAAC;AAcpH,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED,MAAM,aAAa,GAAG,gCAAgC,MAAM,kHAAkH,CAAC;AAE/K,4EAA4E;AAC5E,SAAS,eAAe,CAAC,MAAe,EAAE,IAAmB;IAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,IAAI,IAAI,KAAK,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,4BAA4B,IAAI,gIAAgI,CAAC,CAAC;IAChM,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,GAAG;;;CAGlB,CAAC;AAEF,gHAAgH;AAChH,SAAS,KAAK,CAAC,IAAY,EAAE,IAAY;IACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACpC,OAAO,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7G,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAY;IACxC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,uEAAuE,EAAE,EAAE,IAAI,EAAE,CAAC;IAChJ,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC;IACxE,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC;IAC9G,0EAA0E;IAC1E,sCAAsC;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAClF,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC;AACnE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,SAAoB,EAAE,OAAgB,EAAE,GAAiB;IAClF,MAAM,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC;IAC3B,MAAM,KAAK,GAAW,EAAE,CAAC;IAEzB,0EAA0E;IAC1E,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,YAAY,IAAI,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/H,MAAM,MAAM,GACV,OAAO,KAAK,YAAY,IAAI,SAAS,KAAK,IAAI;QAC5C,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,UAAU,CAAC,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9H,MAAM,IAAI,GAAG,SAAS,IAAI,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC;IAE/C,yEAAyE;IACzE,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACpF,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACtD,IAAI,MAAM,GAAG,QAAQ,CAAC;IACtB,IAAI,OAAO,GAAG,gBAAgB,CAAC;IAC/B,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;YAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;YAC/C,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,kBAAkB;gBACxB,MAAM,EAAE,KAAK;gBACb,MAAM,EAAE,+EAA+E;gBACvF,KAAK,EAAE,KAAK,IAAI,EAAE;oBAChB,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;oBACtD,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACtF,CAAC;aACF,CAAC,CAAC;YACH,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,kBAAkB;gBACxB,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC;gBACnC,KAAK,EAAE,KAAK,IAAI,EAAE;oBAChB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;oBACxC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,YAAY;wBAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;oBAC1H,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;oBAC/D,IAAI,MAAM,KAAK,IAAI;wBAAE,MAAM,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;gBACrE,CAAC;aACF,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;YAC/C,IAAI,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,QAAQ;gBAAE,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;YACpE,OAAO,GAAG,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,UAAU,CAAC;QAC5F,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,MAAM,qBAAqB,OAAO,GAAG,EAAE,CAAC,CAAC;QAC9G,2EAA2E;QAC3E,8CAA8C;QAC9C,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAC/C,MAAM,OAAO,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iCAAiC,IAAI,KAAK,CAAC;YAChF,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,4CAA4C,MAAM,KAAK,OAAO,UAAU,EAAE,CAAC,CAAC;QACxI,CAAC;aAAM,CAAC;YACN,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;YAC1D,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,sCAAsC,MAAM,CAAE,MAAM,CAAC,WAAW,CAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnH,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,kCAAkC,IAAI,EAAE,EAAE,CAAC,CAAC;YACtG,CAAC;iBAAM,CAAC;gBACN,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC3F,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;YACjH,CAAC;QACH,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,yEAAyE;IACzE,gDAAgD;IAChD,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACtD,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAChH,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,WAAW,GAAG,GAAG,OAAO,KAAK,CAAC;QACpC,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAClF,MAAM,QAAQ,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7F,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,YAAY,IAAI,YAAY,IAAI,QAAQ,EAAE,CAAC;YAC/E,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,qGAAqG,WAAW,oCAAoC,EAAE,CAAC,CAAC;QACvN,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,SAAS,IAAI,kBAAkB,CAAC;YAC7C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YACjD,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;gBAC7B,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,oDAAoD,WAAW,YAAY,EAAE,CAAC,CAAC;YAC9H,CAAC;iBAAM,CAAC;gBACN,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC;gBAC1D,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,gBAAgB,CAAC,OAAO,IAAI,EAAE,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC,CAAC;gBAC5G,IAAI,MAAM,KAAK,IAAI;oBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;;oBAC7D,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;YACnJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,wDAAwD;IACxD,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,2EAA2E,EAAE,CAAC,CAAC;IAC3I,CAAC;SAAM,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,4BAA4B,SAAS,EAAE,EAAE,CAAC,CAAC;IACrG,CAAC;SAAM,IAAI,IAAI,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,2CAA2C,EAAE,CAAC,CAAC;IAC7H,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAS,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3C,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IACtK,CAAC;IAED,2EAA2E;IAC3E,uEAAuE;IACvE,sCAAsC;IACtC,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC9C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IACxI,CAAC;SAAM,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,yFAAyF,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;IACjM,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,mBAAmB,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,MAAM,KAAK,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC,CAAC;;YAE1H,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,uBAAuB;gBAC7B,MAAM,EAAE,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;gBAC/C,MAAM,EAAE,0KAA0K;gBAClL,KAAK,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,YAAY,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;aAC1D,CAAC,CAAC;IACP,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7H,CAAC;SAAM,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,6DAA6D,EAAE,CAAC,CAAC;IAC7H,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QACnC,IAAI,MAAM,KAAK,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC,CAAC;;YAEtH,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,WAAW;gBACjB,MAAM,EAAE,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;gBAC1C,MAAM,EAAE,+IAA+I;gBACvJ,KAAK,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;aACrD,CAAC,CAAC;IACP,CAAC;IAED,0EAA0E;IAC1E,4EAA4E;IAC5E,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtF,CAAC;SAAM,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC,CAAC;IACvF,CAAC;SAAM,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;SAAM,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,2CAA2C,aAAa,SAAS,EAAE,CAAC,CAAC;IAC/H,CAAC;SAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,6DAA6D;YACrE,KAAK,EAAE,KAAK,IAAI,EAAE;gBAChB,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpD,MAAM,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;gBACxC,MAAM,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC/B,CAAC;SACF,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,0EAA0E;IAC1E,yCAAyC;IACzC,KAAK,CAAC,IAAI,CAAC;QACT,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc;QAC7C,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,8QAA8Q,kBAAkB,EAAE;KAC3S,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAgB,EAAE,EAAS;IAC3D,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC7B,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;gBACrB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,IAAI,CAAC,IAAI,KAAM,KAAe,CAAC,OAAO,IAAI,CAAC,CAAC;oBAC7E,OAAO,UAAU,CAAC;gBACpB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxI,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,aAAa,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;QAC9G,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC;YAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC;IAC9J,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["/**\n * `spec-harness init`: the family configured to agree, from the first day.\n *\n * The integration faults found when the tools were first run together were all\n * configuration: spec-graph read an archived brief as a retired decision and\n * reported every brief that depended on one; spec-guard executed an archived\n * brief's assertions. Each tool can be told the truth; `init` tells each of\n * them the same truth, derived from spec-brief's own settings.\n *\n * It prints a plan and changes nothing until `--write`. It merges into files\n * that exist and never replaces what a person wrote; a git hook the\n * repository already has is left alone, with the line to add printed instead.\n */\n\nimport { existsSync, statSync } from 'node:fs';\nimport { chmod, mkdir, readFile } from 'node:fs/promises';\nimport { dirname, isAbsolute, join, relative, sep } from 'node:path';\n\nimport { CONFIG_FILE } from './config.js';\nimport {\n  chooseBase,\n  describeGitHook,\n  describeGraph,\n  describeSkipped,\n  enabledPlugin,\n  GIT_HOOK_LINE,\n  type GitHookState,\n  graphReadsBriefs,\n  GUARD_HOOK,\n  holdsGuard,\n  loadsPlugin,\n  measuresArchive,\n  mergeClaudeSettings,\n  mergeMcp,\n  mergeSpecBrief,\n  mergeSpecGraph,\n  missingGitHook,\n  PLUGIN,\n  PROTECT_RULE_FILES,\n  registersServer,\n  SPEC_BRIEF_CONFIGS,\n  SPEC_GRAPH_CONFIGS,\n} from './configure.js';\nimport { readJsonObject as readJson, writeAtomic } from './fs.js';\nimport { hookPath, localBranches, remoteDefault } from './git.js';\nimport { claudeSettings, pluginFile } from './round.js';\nimport { runSibling } from './siblings.js';\nimport { EXIT_ERROR, EXIT_OK, json, openWorkspace, type CliIO, type Options, type Workspace } from './workspace.js';\n\n/** `skip`: a file init would write, left alone because Claude Code's plugin brings what init would add. */\nexport type Action = 'create' | 'update' | 'keep' | 'skip' | 'run' | 'advise';\n\nexport interface Step {\n  readonly file: string;\n  readonly action: Action;\n  readonly detail: string;\n  apply?: () => Promise<void>;\n}\n\ntype Json = Record<string, unknown>;\n\nfunction stringify(value: unknown): string {\n  return `${JSON.stringify(value, null, 2)}\\n`;\n}\n\nconst PLUGIN_DETAIL = `load spec-harness's plugin, \"${PLUGIN}\": spec-brief's archive asks it whether a signed ruling allows a protected file, and refuses the file without it`;\n\n/** What init adds to spec-brief's configuration, said once for the plan. */\nfunction specBriefDetail(plugin: boolean, base: string | null): string {\n  const parts = plugin ? [PLUGIN_DETAIL] : [];\n  if (base !== null) parts.push(`measure the archive from ${base}, as spec-harness does: without a base, spec-brief's archive warns that the scope went unmeasured and checks no protected file`);\n  return parts.join('; ');\n}\n\nconst PRE_COMMIT = `#!/bin/sh\n# spec-harness: refuse a commit that changes what the active brief protects.\nexec npx --no-install spec-harness hook git\n`;\n\n/** A path as a person finds it: from the root when it is inside it, POSIX-separated, and as it is otherwise. */\nfunction shown(root: string, path: string): string {\n  const inside = relative(root, path);\n  return inside === '' || inside.startsWith('..') || isAbsolute(inside) ? path : inside.split(sep).join('/');\n}\n\n/**\n * git's pre-commit hook, where git runs it from, and what is there: init and\n * doctor both read it. `path` is `null` when git cannot say where its hooks\n * are.\n */\nexport async function gitHook(root: string): Promise<{ readonly hook: GitHookState; readonly path: string | null }> {\n  const path = await hookPath('pre-commit', root);\n  if (path === null) return { hook: { state: 'unknown', reason: 'git does not say where they are; spec-harness needs git 2.31 or later' }, path };\n  const file = shown(root, path);\n  if (!existsSync(path)) return { hook: { state: 'absent', file }, path };\n  if (!(await readFile(path, 'utf8')).includes('spec-harness')) return { hook: { state: 'other', file }, path };\n  // git skips a hook it cannot execute, and says so only in a hint; Windows\n  // has no executable bit, and runs it.\n  const inert = process.platform !== 'win32' && (statSync(path).mode & 0o111) === 0;\n  return { hook: { state: inert ? 'inert' : 'runs', file }, path };\n}\n\nexport async function plan(workspace: Workspace, options: Options, env: CliIO['env']): Promise<Step[]> {\n  const { root } = workspace;\n  const steps: Step[] = [];\n\n  // The base rounds merge into, decided once: spec-harness verifies rulings\n  // against the allowed signers on it, and spec-brief's archive measures the\n  // round from it. A base a person wrote, in either file, is kept.\n  const harnessFile = join(root, CONFIG_FILE);\n  const harness = await readJson(harnessFile);\n  const namedBase = harness !== null && harness !== 'unreadable' && typeof harness['base'] === 'string' ? harness['base'] : null;\n  const choice =\n    harness === 'unreadable' || namedBase !== null\n      ? null\n      : chooseBase({ remoteDefault: await remoteDefault(root), branch: workspace.branch, branches: await localBranches(root) });\n  const base = namedBase ?? choice?.base ?? null;\n\n  // spec-brief first: every other setting is derived from its directories.\n  const briefConfig = SPEC_BRIEF_CONFIGS.find((name) => existsSync(join(root, name)));\n  const brief = workspace.siblings.locate('spec-brief');\n  let briefs = 'briefs';\n  let archive = 'briefs/archive';\n  if (briefConfig === undefined) {\n    if (brief.kind === 'found') {\n      const command = brief.command;\n      const created = join(root, '.spec-brief.json');\n      steps.push({\n        file: '.spec-brief.json',\n        action: 'run',\n        detail: 'spec-brief init: the brief and archive directories, every default spelled out',\n        apply: async () => {\n          const run = await runSibling(command, ['init'], root);\n          if (run.code !== 0) throw new Error(`spec-brief init failed: ${run.stderr.trim()}`);\n        },\n      });\n      steps.push({\n        file: '.spec-brief.json',\n        action: 'update',\n        detail: specBriefDetail(true, base),\n        apply: async () => {\n          const written = await readJson(created);\n          if (written === null || written === 'unreadable') throw new Error('spec-brief init wrote no configuration JSON can read');\n          const merged = mergeSpecBrief(written, base, pluginFile(root));\n          if (merged !== null) await writeAtomic(created, stringify(merged));\n        },\n      });\n    } else {\n      steps.push({ file: '.spec-brief.json', action: 'advise', detail: brief.reason });\n    }\n  } else {\n    const file = join(root, briefConfig);\n    const config = await readJson(file);\n    if (config !== null && config !== 'unreadable') {\n      if (typeof config['briefs'] === 'string') briefs = config['briefs'];\n      archive = typeof config['archive'] === 'string' ? config['archive'] : `${briefs}/archive`;\n    }\n    steps.push({ file: briefConfig, action: 'keep', detail: `briefs in ${briefs}/, the archive in ${archive}/` });\n    // spec-brief's archive learns that a signed ruling allows a protected file\n    // only from this package's plugin (ADR-0006).\n    if (config === 'unreadable' || config === null) {\n      const measure = base === null ? '' : `, and \"archiving\": { \"base\": \"${base}\" }`;\n      steps.push({ file: briefConfig, action: 'advise', detail: `cannot be read as JSON; add \"plugins\": [\"${PLUGIN}\"]${measure} by hand` });\n    } else {\n      const isPluginFile = pluginFile(root);\n      const merged = mergeSpecBrief(config, base, isPluginFile);\n      const measured = measuresArchive(config);\n      if (merged === null) {\n        const from = measured ? `, and the archive is measured from ${String((config['archiving'] as Json)['base'])}` : '';\n        steps.push({ file: briefConfig, action: 'keep', detail: `spec-harness's plugin is loaded${from}` });\n      } else {\n        const detail = specBriefDetail(!loadsPlugin(config, isPluginFile), measured ? null : base);\n        steps.push({ file: briefConfig, action: 'update', detail, apply: () => writeAtomic(file, stringify(merged)) });\n      }\n    }\n  }\n\n  // spec-graph: an archived brief is a record, not a retired decision. Its\n  // configuration is the first of its files, then a key in package.json; a\n  // file written beside that key would shadow it.\n  const graph = workspace.siblings.locate('spec-graph');\n  if (graph.kind === 'outdated') steps.push({ file: '.spec-graph.json', action: 'advise', detail: graph.reason });\n  if (graph.kind === 'found') {\n    const archiveGlob = `${archive}/**`;\n    const graphName = SPEC_GRAPH_CONFIGS.find((name) => existsSync(join(root, name)));\n    const manifest = graphName === undefined ? await readJson(join(root, 'package.json')) : null;\n    if (manifest !== null && manifest !== 'unreadable' && 'spec-graph' in manifest) {\n      steps.push({ file: 'package.json', action: 'advise', detail: `spec-graph reads its configuration from the \"spec-graph\" key here, which init does not edit: add \"${archiveGlob}\" to its \"historyPatterns\" by hand` });\n    } else {\n      const file = graphName ?? '.spec-graph.json';\n      const current = await readJson(join(root, file));\n      if (current === 'unreadable') {\n        steps.push({ file, action: 'advise', detail: `cannot be read as JSON; add \"historyPatterns\": [\"${archiveGlob}\"] by hand` });\n      } else {\n        const merged = mergeSpecGraph(current ?? {}, archiveGlob);\n        const detail = describeGraph(archiveGlob, briefs, graphReadsBriefs(current ?? {}, briefs), merged !== null);\n        if (merged === null) steps.push({ file, action: 'keep', detail });\n        else steps.push({ file, action: current === null ? 'create' : 'update', detail, apply: () => writeAtomic(join(root, file), stringify(merged)) });\n      }\n    }\n  }\n\n  // spec-harness's own file, naming the base the rounds merge into: every\n  // ruling is verified against the allowed signers on it.\n  if (harness === 'unreadable') {\n    steps.push({ file: CONFIG_FILE, action: 'advise', detail: 'cannot be read as JSON; name the base rounds merge into as \"base\" by hand' });\n  } else if (namedBase !== null) {\n    steps.push({ file: CONFIG_FILE, action: 'keep', detail: `rounds are measured from ${namedBase}` });\n  } else if (base === null || choice === null) {\n    steps.push({ file: CONFIG_FILE, action: 'advise', detail: choice?.detail ?? 'name the base rounds merge into as \"base\"' });\n  } else {\n    const content: Json = { ...harness, base };\n    steps.push({ file: CONFIG_FILE, action: harness === null ? 'create' : 'update', detail: choice.detail, apply: () => writeAtomic(harnessFile, stringify(content)) });\n  }\n\n  // The agent's hooks and server, unless the plugin brings them: Claude Code\n  // runs a plugin's hook beside the same hook in settings, so both would\n  // guard every write twice (ADR-0012).\n  const plugin = enabledPlugin(await claudeSettings(root, env));\n  const settingsFile = join(root, '.claude', 'settings.json');\n  const settings = await readJson(settingsFile);\n  if (plugin !== null) {\n    const present = holdsGuard(settings);\n    steps.push({ file: '.claude/settings.json', action: present ? 'advise' : 'skip', detail: describeSkipped(plugin, 'hooks', present) });\n  } else if (settings === 'unreadable') {\n    steps.push({ file: '.claude/settings.json', action: 'advise', detail: `cannot be read as JSON; add the guard as a PreToolUse and a PostToolUse hook by hand: ${JSON.stringify(GUARD_HOOK)}` });\n  } else {\n    const merged = mergeClaudeSettings(settings ?? {});\n    if (merged === null) steps.push({ file: '.claude/settings.json', action: 'keep', detail: 'the guard hooks are installed' });\n    else\n      steps.push({\n        file: '.claude/settings.json',\n        action: settings === null ? 'create' : 'update',\n        detail: 'the guard hooks, run with node from the project\\'s install: a PreToolUse hook refuses writes to protected files; a PostToolUse hook warns about writes outside the scope',\n        apply: () => writeAtomic(settingsFile, stringify(merged)),\n      });\n  }\n  const mcpFile = join(root, '.mcp.json');\n  const mcp = await readJson(mcpFile);\n  if (plugin !== null) {\n    const present = registersServer(mcp);\n    steps.push({ file: '.mcp.json', action: present ? 'advise' : 'skip', detail: describeSkipped(plugin, 'server', present) });\n  } else if (mcp === 'unreadable') {\n    steps.push({ file: '.mcp.json', action: 'advise', detail: 'cannot be read as JSON; add the spec-harness server by hand' });\n  } else {\n    const merged = mergeMcp(mcp ?? {});\n    if (merged === null) steps.push({ file: '.mcp.json', action: 'keep', detail: 'the spec-harness server is registered' });\n    else\n      steps.push({\n        file: '.mcp.json',\n        action: mcp === null ? 'create' : 'update',\n        detail: 'the spec-harness MCP server, run with node from the project\\'s install: start_round, check_path, request_escalation, audit_round, list_rounds',\n        apply: () => writeAtomic(mcpFile, stringify(merged)),\n      });\n  }\n\n  // git's hook, where git runs it from: core.hooksPath as git reads it, and\n  // a linked worktree's shared hooks. It is the guard for a write the agent's\n  // hooks never see, one through a shell, so it is advised when not asked\n  // for; it is configuration outside the tree, so it is written only then.\n  const { hook, path: hookFile } = await gitHook(root);\n  if (hook.state === 'unknown' || hookFile === null) {\n    steps.push({ file: 'pre-commit', action: 'advise', detail: describeGitHook(hook) });\n  } else if (hook.state === 'runs') {\n    steps.push({ file: hook.file, action: 'keep', detail: 'already runs spec-harness' });\n  } else if (hook.state === 'inert') {\n    steps.push({ file: hook.file, action: 'advise', detail: describeGitHook(hook) });\n  } else if (hook.state === 'other') {\n    steps.push({ file: hook.file, action: 'advise', detail: `a pre-commit hook exists; add the line \"${GIT_HOOK_LINE}\" to it` });\n  } else if (options.gitHook) {\n    steps.push({\n      file: hook.file,\n      action: 'create',\n      detail: 'refuse a commit that changes what the active brief protects',\n      apply: async () => {\n        await mkdir(dirname(hookFile), { recursive: true });\n        await writeAtomic(hookFile, PRE_COMMIT);\n        await chmod(hookFile, 0o755);\n      },\n    });\n  } else {\n    steps.push({ file: hook.file, action: 'advise', detail: missingGitHook(null) });\n  }\n\n  // The file the configuration names, which a ruling's signature is checked\n  // against on the base branch (ADR-0006).\n  steps.push({\n    file: workspace.config.rulings.allowedSigners,\n    action: 'advise',\n    detail: `rulings count only when signed by a key listed here on the base branch: one line per person, <email> namespaces=\"git\" <public key>. Where an agent runs as the person, make it a FIDO2 key, ssh-keygen -t ed25519-sk, whose signature needs a touch no process can supply. ${PROTECT_RULE_FILES}`,\n  });\n  return steps;\n}\n\nexport async function initCommand(options: Options, io: CliIO): Promise<number> {\n  const workspace = await openWorkspace(options, io);\n  const steps = await plan(workspace, options, io.env);\n  if (options.write) {\n    for (const step of steps) {\n      if (step.apply !== undefined) {\n        try {\n          await step.apply();\n        } catch (error) {\n          io.stderr.write(`spec-harness: ${step.file}: ${(error as Error).message}\\n`);\n          return EXIT_ERROR;\n        }\n      }\n    }\n  }\n  if (options.format === 'json') {\n    io.stdout.write(json('init', { written: options.write, steps: steps.map(({ file, action, detail }) => ({ file, action, detail })) }));\n  } else {\n    for (const step of steps) io.stdout.write(`${step.action.padEnd(6)}  ${step.file}\\n        ${step.detail}\\n`);\n    if (!options.write && steps.some((step) => step.apply !== undefined)) io.stdout.write('\\nNothing was changed. Run again with --write to apply the plan.\\n');\n  }\n  return EXIT_OK;\n}\n"]}

package/dist/signers.d.ts

@@ -0,0 +1,43 @@
+/**
+ * The allowed-signers file, read as OpenSSH reads it (ssh-keygen(1), ALLOWED
+ * SIGNERS), to say which signers sign with a key that is not FIDO2.
+ *
+ * A line is `principals [options] keytype key [comment]`: principals a
+ * comma-separated list, quoted or not; options a comma-separated list with no
+ * space outside quotes, such as `cert-authority`, `namespaces="git"` or
+ * `valid-after="20260101"`. A `cert-authority` line holds the key of a
+ * certificate authority, not a person's: the keys it certifies are not in the
+ * file, so their type cannot be read from it.
+ *
+ * Pure: doctor reads the file from the base and passes the text.
+ */
+/** The key types of a FIDO2 security key: a signature needs a touch no process can supply (ADR-0006). */
+export declare const FIDO2_KEY_TYPES: readonly string[];
+export interface AllowedSigner {
+    /** 1-based. */
+    readonly line: number;
+    readonly principals: readonly string[];
+    /** Whether the key is a certificate authority's. */
+    readonly certAuthority: boolean;
+    /** The namespaces the key may sign in, or `null` for any. */
+    readonly namespaces: readonly string[] | null;
+    readonly validAfter: string | null;
+    readonly validBefore: string | null;
+    readonly keyType: string;
+    readonly key: string;
+}
+export interface SignersRead {
+    readonly signers: readonly AllowedSigner[];
+    /** Lines that are not a signer, with why. */
+    readonly problems: readonly {
+        readonly line: number;
+        readonly message: string;
+    }[];
+}
+/** Reads the file's text: every signer, and every line that is not one. */
+export declare function readAllowedSigners(text: string): SignersRead;
+/**
+ * The signers whose own key is not a FIDO2 security key's. A certificate
+ * authority's line is left out: the keys it vouches for are not in the file.
+ */
+export declare function notFido2(signers: readonly AllowedSigner[]): AllowedSigner[];

package/dist/signers.js

@@ -0,0 +1,105 @@
+/**
+ * The allowed-signers file, read as OpenSSH reads it (ssh-keygen(1), ALLOWED
+ * SIGNERS), to say which signers sign with a key that is not FIDO2.
+ *
+ * A line is `principals [options] keytype key [comment]`: principals a
+ * comma-separated list, quoted or not; options a comma-separated list with no
+ * space outside quotes, such as `cert-authority`, `namespaces="git"` or
+ * `valid-after="20260101"`. A `cert-authority` line holds the key of a
+ * certificate authority, not a person's: the keys it certifies are not in the
+ * file, so their type cannot be read from it.
+ *
+ * Pure: doctor reads the file from the base and passes the text.
+ */
+/** The key types of a FIDO2 security key: a signature needs a touch no process can supply (ADR-0006). */
+export const FIDO2_KEY_TYPES = ['sk-ssh-ed25519@openssh.com', 'sk-ecdsa-sha2-nistp256@openssh.com'];
+/**
+ * A key as the file writes it: base64 of the key's wire form, which starts
+ * with the four-byte length of its type's name, so with `AAAA`. OpenSSH tells
+ * options from a key type by trying to read a key after it; a key type is
+ * followed by a key, and options by a key type, which is not one. So a key
+ * type OpenSSH adds later is read as one, as OpenSSH reads it.
+ */
+const KEY = /^AAAA[A-Za-z0-9+/]+={0,2}$/;
+/** The next field and what follows it: up to the first space outside double quotes. */
+function field(text) {
+    let quoted = false;
+    let i = 0;
+    for (; i < text.length; i += 1) {
+        const ch = text.charAt(i);
+        if (ch === '"')
+            quoted = !quoted;
+        else if (!quoted && (ch === ' ' || ch === '\t'))
+            break;
+    }
+    return { value: text.slice(0, i), rest: text.slice(i).trimStart() };
+}
+/** Splits on commas outside double quotes. */
+function commas(text) {
+    const parts = [];
+    let quoted = false;
+    let start = 0;
+    for (let i = 0; i < text.length; i += 1) {
+        const ch = text.charAt(i);
+        if (ch === '"')
+            quoted = !quoted;
+        else if (ch === ',' && !quoted) {
+            parts.push(text.slice(start, i));
+            start = i + 1;
+        }
+    }
+    parts.push(text.slice(start));
+    return parts;
+}
+function unquote(value) {
+    return value.length >= 2 && value.startsWith('"') && value.endsWith('"') ? value.slice(1, -1) : value;
+}
+/** Reads the file's text: every signer, and every line that is not one. */
+export function readAllowedSigners(text) {
+    const signers = [];
+    const problems = [];
+    text.split(/\r?\n/).forEach((raw, index) => {
+        const line = index + 1;
+        const content = raw.trim();
+        if (content === '' || content.startsWith('#'))
+            return;
+        const principals = field(content);
+        let type = field(principals.rest);
+        let options = [];
+        if (!KEY.test(field(type.rest).value)) {
+            options = commas(type.value);
+            type = field(type.rest);
+        }
+        const key = field(type.rest).value;
+        if (type.value === '' || !KEY.test(key)) {
+            problems.push({ line, message: 'a signer is its principals, any options, a key type and a key' });
+            return;
+        }
+        const option = (name) => {
+            const found = options.find((item) => item.toLowerCase().startsWith(`${name}=`));
+            return found === undefined ? null : unquote(found.slice(name.length + 1));
+        };
+        const namespaces = option('namespaces');
+        signers.push({
+            line,
+            principals: commas(unquote(principals.value))
+                .map((principal) => principal.trim())
+                .filter((principal) => principal !== ''),
+            certAuthority: options.some((item) => item.toLowerCase() === 'cert-authority'),
+            namespaces: namespaces === null ? null : namespaces.split(',').map((name) => name.trim()),
+            validAfter: option('valid-after'),
+            validBefore: option('valid-before'),
+            keyType: type.value,
+            key,
+        });
+    });
+    return { signers, problems };
+}
+/**
+ * The signers whose own key is not a FIDO2 security key's. A certificate
+ * authority's line is left out: the keys it vouches for are not in the file.
+ */
+export function notFido2(signers) {
+    return signers.filter((signer) => !signer.certAuthority && !FIDO2_KEY_TYPES.includes(signer.keyType));
+}
+//# sourceMappingURL=signers.js.map

package/dist/signers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signers.js","sourceRoot":"","sources":["../src/signers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,yGAAyG;AACzG,MAAM,CAAC,MAAM,eAAe,GAAsB,CAAC,4BAA4B,EAAE,oCAAoC,CAAC,CAAC;AAsBvH;;;;;;GAMG;AACH,MAAM,GAAG,GAAG,4BAA4B,CAAC;AAEzC,uFAAuF;AACvF,SAAS,KAAK,CAAC,IAAY;IACzB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,EAAE,KAAK,GAAG;YAAE,MAAM,GAAG,CAAC,MAAM,CAAC;aAC5B,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,CAAC;YAAE,MAAM;IACzD,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC;AACtE,CAAC;AAED,8CAA8C;AAC9C,SAAS,MAAM,CAAC,IAAY;IAC1B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,EAAE,KAAK,GAAG;YAAE,MAAM,GAAG,CAAC,MAAM,CAAC;aAC5B,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACjC,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACxG,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAwC,EAAE,CAAC;IACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC;QACvB,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO;QACtD,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,OAAO,GAAa,EAAE,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACtC,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC7B,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC;QACnC,IAAI,IAAI,CAAC,KAAK,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,+DAA+D,EAAE,CAAC,CAAC;YAClG,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,IAAY,EAAiB,EAAE;YAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;YAChF,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5E,CAAC,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC;YACX,IAAI;YACJ,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;iBAC1C,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;iBACpC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,EAAE,CAAC;YAC1C,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,gBAAgB,CAAC;YAC9E,UAAU,EAAE,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACzF,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC;YACjC,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC;YACnC,OAAO,EAAE,IAAI,CAAC,KAAK;YACnB,GAAG;SACJ,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAiC;IACxD,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;AACxG,CAAC","sourcesContent":["/**\n * The allowed-signers file, read as OpenSSH reads it (ssh-keygen(1), ALLOWED\n * SIGNERS), to say which signers sign with a key that is not FIDO2.\n *\n * A line is `principals [options] keytype key [comment]`: principals a\n * comma-separated list, quoted or not; options a comma-separated list with no\n * space outside quotes, such as `cert-authority`, `namespaces=\"git\"` or\n * `valid-after=\"20260101\"`. A `cert-authority` line holds the key of a\n * certificate authority, not a person's: the keys it certifies are not in the\n * file, so their type cannot be read from it.\n *\n * Pure: doctor reads the file from the base and passes the text.\n */\n\n/** The key types of a FIDO2 security key: a signature needs a touch no process can supply (ADR-0006). */\nexport const FIDO2_KEY_TYPES: readonly string[] = ['sk-ssh-ed25519@openssh.com', 'sk-ecdsa-sha2-nistp256@openssh.com'];\n\nexport interface AllowedSigner {\n  /** 1-based. */\n  readonly line: number;\n  readonly principals: readonly string[];\n  /** Whether the key is a certificate authority's. */\n  readonly certAuthority: boolean;\n  /** The namespaces the key may sign in, or `null` for any. */\n  readonly namespaces: readonly string[] | null;\n  readonly validAfter: string | null;\n  readonly validBefore: string | null;\n  readonly keyType: string;\n  readonly key: string;\n}\n\nexport interface SignersRead {\n  readonly signers: readonly AllowedSigner[];\n  /** Lines that are not a signer, with why. */\n  readonly problems: readonly { readonly line: number; readonly message: string }[];\n}\n\n/**\n * A key as the file writes it: base64 of the key's wire form, which starts\n * with the four-byte length of its type's name, so with `AAAA`. OpenSSH tells\n * options from a key type by trying to read a key after it; a key type is\n * followed by a key, and options by a key type, which is not one. So a key\n * type OpenSSH adds later is read as one, as OpenSSH reads it.\n */\nconst KEY = /^AAAA[A-Za-z0-9+/]+={0,2}$/;\n\n/** The next field and what follows it: up to the first space outside double quotes. */\nfunction field(text: string): { value: string; rest: string } {\n  let quoted = false;\n  let i = 0;\n  for (; i < text.length; i += 1) {\n    const ch = text.charAt(i);\n    if (ch === '\"') quoted = !quoted;\n    else if (!quoted && (ch === ' ' || ch === '\\t')) break;\n  }\n  return { value: text.slice(0, i), rest: text.slice(i).trimStart() };\n}\n\n/** Splits on commas outside double quotes. */\nfunction commas(text: string): string[] {\n  const parts: string[] = [];\n  let quoted = false;\n  let start = 0;\n  for (let i = 0; i < text.length; i += 1) {\n    const ch = text.charAt(i);\n    if (ch === '\"') quoted = !quoted;\n    else if (ch === ',' && !quoted) {\n      parts.push(text.slice(start, i));\n      start = i + 1;\n    }\n  }\n  parts.push(text.slice(start));\n  return parts;\n}\n\nfunction unquote(value: string): string {\n  return value.length >= 2 && value.startsWith('\"') && value.endsWith('\"') ? value.slice(1, -1) : value;\n}\n\n/** Reads the file's text: every signer, and every line that is not one. */\nexport function readAllowedSigners(text: string): SignersRead {\n  const signers: AllowedSigner[] = [];\n  const problems: { line: number; message: string }[] = [];\n  text.split(/\\r?\\n/).forEach((raw, index) => {\n    const line = index + 1;\n    const content = raw.trim();\n    if (content === '' || content.startsWith('#')) return;\n    const principals = field(content);\n    let type = field(principals.rest);\n    let options: string[] = [];\n    if (!KEY.test(field(type.rest).value)) {\n      options = commas(type.value);\n      type = field(type.rest);\n    }\n    const key = field(type.rest).value;\n    if (type.value === '' || !KEY.test(key)) {\n      problems.push({ line, message: 'a signer is its principals, any options, a key type and a key' });\n      return;\n    }\n    const option = (name: string): string | null => {\n      const found = options.find((item) => item.toLowerCase().startsWith(`${name}=`));\n      return found === undefined ? null : unquote(found.slice(name.length + 1));\n    };\n    const namespaces = option('namespaces');\n    signers.push({\n      line,\n      principals: commas(unquote(principals.value))\n        .map((principal) => principal.trim())\n        .filter((principal) => principal !== ''),\n      certAuthority: options.some((item) => item.toLowerCase() === 'cert-authority'),\n      namespaces: namespaces === null ? null : namespaces.split(',').map((name) => name.trim()),\n      validAfter: option('valid-after'),\n      validBefore: option('valid-before'),\n      keyType: type.value,\n      key,\n    });\n  });\n  return { signers, problems };\n}\n\n/**\n * The signers whose own key is not a FIDO2 security key's. A certificate\n * authority's line is left out: the keys it vouches for are not in the file.\n */\nexport function notFido2(signers: readonly AllowedSigner[]): AllowedSigner[] {\n  return signers.filter((signer) => !signer.certAuthority && !FIDO2_KEY_TYPES.includes(signer.keyType));\n}\n"]}

package/dist/types.d.ts

@@ -8,6 +8,13 @@ export interface Finding {
     readonly hint: string;
     readonly file?: string | undefined;
     readonly line?: number | undefined;
+    /**
+     * What the finding is about - an assertion, a ruling, a dependency, a name -
+     * in words that stay the same while it stays the same finding. With the rule
+     * and the file it is the finding's identity, which a GitLab fingerprint is
+     * made of; the message, the hint and the line never are.
+     */
+    readonly subject?: string | undefined;
 }
 /** A brief as `spec-brief list --format json` reports it. */
 export interface BriefRow {

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,mEAAmE","sourcesContent":["/** Types shared across modules. Type-only: compiles to nothing. */\n\nexport type Severity = 'error' | 'warning' | 'note';\n\n/** One thing a command found, where to fix it, and what to do next (spec-core ADR-0005). */\nexport interface Finding {\n  readonly rule: string;\n  readonly severity: Severity;\n  readonly message: string;\n  readonly hint: string;\n  readonly file?: string | undefined;\n  readonly line?: number | undefined;\n}\n\n/** A brief as `spec-brief list --format json` reports it. */\nexport interface BriefRow {\n  readonly id: string;\n  /** Repository-relative POSIX path. */\n  readonly file: string;\n  readonly title: string | null;\n  readonly phase: 'live' | 'archived';\n  readonly status: string | null;\n  readonly type: string | null;\n  readonly wave: number | null;\n  readonly dependsOn: readonly string[];\n  readonly affectedFiles: readonly string[];\n  readonly protectedFiles: readonly string[];\n  readonly tasks: { readonly total: number; readonly checked: number };\n  readonly ready: boolean;\n  readonly waitingOn: readonly string[];\n}\n\n/** A file a range of commits changed, as `git diff --name-status` reports it. */\nexport interface FileChange {\n  readonly status: 'A' | 'M' | 'D' | 'R' | 'C' | 'T';\n  readonly path: string;\n  /** The path it came from, for a rename or a copy. */\n  readonly from?: string | undefined;\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,mEAAmE","sourcesContent":["/** Types shared across modules. Type-only: compiles to nothing. */\n\nexport type Severity = 'error' | 'warning' | 'note';\n\n/** One thing a command found, where to fix it, and what to do next (spec-core ADR-0005). */\nexport interface Finding {\n  readonly rule: string;\n  readonly severity: Severity;\n  readonly message: string;\n  readonly hint: string;\n  readonly file?: string | undefined;\n  readonly line?: number | undefined;\n  /**\n   * What the finding is about - an assertion, a ruling, a dependency, a name -\n   * in words that stay the same while it stays the same finding. With the rule\n   * and the file it is the finding's identity, which a GitLab fingerprint is\n   * made of; the message, the hint and the line never are.\n   */\n  readonly subject?: string | undefined;\n}\n\n/** A brief as `spec-brief list --format json` reports it. */\nexport interface BriefRow {\n  readonly id: string;\n  /** Repository-relative POSIX path. */\n  readonly file: string;\n  readonly title: string | null;\n  readonly phase: 'live' | 'archived';\n  readonly status: string | null;\n  readonly type: string | null;\n  readonly wave: number | null;\n  readonly dependsOn: readonly string[];\n  readonly affectedFiles: readonly string[];\n  readonly protectedFiles: readonly string[];\n  readonly tasks: { readonly total: number; readonly checked: number };\n  readonly ready: boolean;\n  readonly waitingOn: readonly string[];\n}\n\n/** A file a range of commits changed, as `git diff --name-status` reports it. */\nexport interface FileChange {\n  readonly status: 'A' | 'M' | 'D' | 'R' | 'C' | 'T';\n  readonly path: string;\n  /** The path it came from, for a rename or a copy. */\n  readonly from?: string | undefined;\n}\n"]}

package/dist/vendor/spec-core/markdown/frontmatter.d.ts

@@ -87,7 +87,17 @@ export declare function readFrontMatter(source: string, options?: ReadOptions):
 export declare function parseInline(text: string): YamlValue;
 /** Null in the YAML 1.2 core schema: empty, `~` or `null` in any of its three spellings. */
 export declare function isNull(scalar: YamlScalar): boolean;
-/** Renders a string as a scalar that reads back as the same string. */
+/**
+ * Renders a string as a scalar that reads back as the same string.
+ *
+ * Plain only as a YAML plain scalar that reads back as itself: a letter
+ * first, of any script, then letters, marks, digits, spaces and `._/+-` - so
+ * a status of `封存` or `已接受` is written as it is typed - with no space at
+ * the end, and none of `true`, `false`, `null`, `yes`, `no`, `on`, `off` or
+ * `~` in any case, which YAML 1.2 or 1.1 reads as a boolean or a null.
+ * Anything else is quoted: an indicator, `: ` or ` #`, a number, a space at
+ * either end, a full-width space or punctuation.
+ */
 export declare function renderScalar(value: string): string;
 export declare function findEntry(frontMatter: FrontMatter | null, key: string): FrontMatterEntry | undefined;
 /**

package/dist/vendor/spec-core/markdown/frontmatter.js

@@ -30,7 +30,14 @@ export function frontMatterKind(firstLine) {
 export function frontMatterCloses(line, kind) {
     return (kind === 'yaml' ? YAML_CLOSE : TOML_FENCE).test(line);
 }
-const KEY = /^([A-Za-z_][\w.-]*)[ \t]*:(?:[ \t]+(.*))?$/;
+/**
+ * A key and what follows its colon. A key is a word of any script, as a YAML
+ * plain key may be: a letter or `_` first, then letters, marks, digits and
+ * `_.-`, so `狀態` and `状态` are keys as `status` is. Nothing else is one: a
+ * digit or a mark first, a space, punctuation, and a full-width colon, which
+ * YAML does not read as one.
+ */
+const KEY = /^([\p{L}_][\p{L}\p{M}\p{N}_.-]*)[ \t]*:(?:[ \t]+(.*))?$/u;
 const SEQUENCE_ITEM = /^([ \t]*)-(?:[ \t]+(.*))?$/;
 const BLANK_OR_COMMENT = /^[ \t]*(?:#.*)?$/;
 export function keyName(key) {
@@ -415,10 +422,20 @@ function parseFlowSequence(text) {
 export function isNull(scalar) {
     return !scalar.quoted && ['', '~', 'null', 'Null', 'NULL'].includes(scalar.text);
 }
-/** Renders a string as a scalar that reads back as the same string. */
+/**
+ * Renders a string as a scalar that reads back as the same string.
+ *
+ * Plain only as a YAML plain scalar that reads back as itself: a letter
+ * first, of any script, then letters, marks, digits, spaces and `._/+-` - so
+ * a status of `封存` or `已接受` is written as it is typed - with no space at
+ * the end, and none of `true`, `false`, `null`, `yes`, `no`, `on`, `off` or
+ * `~` in any case, which YAML 1.2 or 1.1 reads as a boolean or a null.
+ * Anything else is quoted: an indicator, `: ` or ` #`, a number, a space at
+ * either end, a full-width space or punctuation.
+ */
 export function renderScalar(value) {
     const reserved = /^(?:true|false|null|yes|no|on|off|~)$/i.test(value);
-    const plain = /^[A-Za-z][A-Za-z0-9 ._/+-]*$/.test(value) && !value.endsWith(' ');
+    const plain = /^\p{L}[\p{L}\p{M}\p{N} ._/+-]*$/u.test(value) && !value.endsWith(' ');
     return plain && !reserved ? value : JSON.stringify(value);
 }
 export function findEntry(frontMatter, key) {