@duckcodeailabs/dql-cli 1.4.3 → 1.4.4

package/commands/validate.js

@@ -0,0 +1,116 @@
+import { readdirSync, readFileSync, existsSync } from 'node:fs';
+import { join, extname, resolve } from 'node:path';
+import { Parser, analyze, loadSemanticLayerFromDir } from '@duckcodeailabs/dql-core';
+export async function runValidate(path, flags) {
+    const projectRoot = resolve(path ?? '.');
+    const diagnostics = [];
+    // Load semantic layer if present
+    let semanticLayer;
+    const semanticDir = join(projectRoot, 'semantic-layer');
+    if (existsSync(semanticDir)) {
+        try {
+            semanticLayer = loadSemanticLayerFromDir(semanticDir);
+        }
+        catch (err) {
+            diagnostics.push({
+                file: 'semantic-layer/',
+                severity: 'error',
+                message: `Failed to load semantic layer: ${err instanceof Error ? err.message : String(err)}`,
+            });
+        }
+    }
+    // Scan all .dql files in known directories
+    const dirs = ['blocks', 'dashboards', 'workbooks'];
+    let fileCount = 0;
+    for (const dir of dirs) {
+        const dirPath = join(projectRoot, dir);
+        if (!existsSync(dirPath))
+            continue;
+        for (const entry of readdirSync(dirPath, { withFileTypes: true })) {
+            if (!entry.isFile() || extname(entry.name) !== '.dql')
+                continue;
+            const filePath = join(dirPath, entry.name);
+            const relativePath = `${dir}/${entry.name}`;
+            fileCount++;
+            try {
+                const source = readFileSync(filePath, 'utf-8');
+                const parser = new Parser(source, relativePath);
+                const ast = parser.parse();
+                // Run semantic analysis
+                try {
+                    const diags = analyze(ast);
+                    for (const diag of diags) {
+                        diagnostics.push({
+                            file: relativePath,
+                            severity: diag.severity === 'error' ? 'error' : 'warning',
+                            message: diag.message,
+                            line: diag.span?.start?.line,
+                        });
+                    }
+                }
+                catch {
+                    // analyze may throw on some inputs
+                }
+                // Check semantic block metric references
+                for (const stmt of ast.statements) {
+                    if (stmt.kind !== 'BlockDecl')
+                        continue;
+                    const block = stmt;
+                    if (block.blockType === 'semantic' && block.metricRef) {
+                        if (semanticLayer) {
+                            const composed = semanticLayer.composeQuery({
+                                metrics: [block.metricRef],
+                                dimensions: [],
+                            });
+                            if (!composed) {
+                                diagnostics.push({
+                                    file: relativePath,
+                                    severity: 'error',
+                                    message: `Metric "${block.metricRef}" referenced in block "${block.name}" not found in semantic layer`,
+                                });
+                            }
+                        }
+                        else {
+                            diagnostics.push({
+                                file: relativePath,
+                                severity: 'warning',
+                                message: `Semantic block "${block.name}" references metric "${block.metricRef}" but no semantic-layer/ directory exists`,
+                            });
+                        }
+                    }
+                }
+            }
+            catch (err) {
+                diagnostics.push({
+                    file: relativePath,
+                    severity: 'error',
+                    message: `Parse error: ${err instanceof Error ? err.message : String(err)}`,
+                });
+            }
+        }
+    }
+    // Output
+    const errors = diagnostics.filter((d) => d.severity === 'error');
+    const warnings = diagnostics.filter((d) => d.severity === 'warning');
+    if (flags.format === 'json') {
+        console.log(JSON.stringify({ files: fileCount, diagnostics }, null, 2));
+    }
+    else {
+        console.log(`\n  Validated ${fileCount} DQL file(s)\n`);
+        if (diagnostics.length === 0) {
+            console.log('  All files are valid.\n');
+        }
+        else {
+            for (const d of diagnostics) {
+                const loc = d.line ? `:${d.line}` : '';
+                const icon = d.severity === 'error' ? 'ERROR' : 'WARN';
+                console.log(`  ${icon} ${d.file}${loc}: ${d.message}`);
+            }
+            console.log(`\n  ${errors.length} error(s), ${warnings.length} warning(s)\n`);
+        }
+    }
+    if (errors.length > 0) {
+        process.exitCode = 1;
+    }
+}
+//# sourceMappingURL=validate.js.map

package/commands/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/commands/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,wBAAwB,EAAyD,MAAM,0BAA0B,CAAC;AAU5I,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAmB,EAAE,KAAe;IACpE,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;IACzC,MAAM,WAAW,GAAiB,EAAE,CAAC;IAErC,iCAAiC;IACjC,IAAI,aAAwC,CAAC;IAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;IACxD,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,aAAa,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,IAAI,CAAC;gBACf,IAAI,EAAE,iBAAiB;gBACvB,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,kCAAkC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;aAC9F,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;IACnD,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,SAAS;QAEnC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM;gBAAE,SAAS;YAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3C,MAAM,YAAY,GAAG,GAAG,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YAC5C,SAAS,EAAE,CAAC;YAEZ,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAC/C,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;gBAChD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;gBAE3B,wBAAwB;gBACxB,IAAI,CAAC;oBACH,MAAM,KAAK,GAAqB,OAAO,CAAC,GAAG,CAAC,CAAC;oBAC7C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;wBACzB,WAAW,CAAC,IAAI,CAAC;4BACf,IAAI,EAAE,YAAY;4BAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;4BACzD,OAAO,EAAE,IAAI,CAAC,OAAO;4BACrB,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI;yBAC7B,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,mCAAmC;gBACrC,CAAC;gBAED,yCAAyC;gBACzC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;oBAClC,IAAK,IAAY,CAAC,IAAI,KAAK,WAAW;wBAAE,SAAS;oBACjD,MAAM,KAAK,GAAG,IAAW,CAAC;oBAC1B,IAAI,KAAK,CAAC,SAAS,KAAK,UAAU,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;wBACtD,IAAI,aAAa,EAAE,CAAC;4BAClB,MAAM,QAAQ,GAAG,aAAa,CAAC,YAAY,CAAC;gCAC1C,OAAO,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;gCAC1B,UAAU,EAAE,EAAE;6BACf,CAAC,CAAC;4BACH,IAAI,CAAC,QAAQ,EAAE,CAAC;gCACd,WAAW,CAAC,IAAI,CAAC;oCACf,IAAI,EAAE,YAAY;oCAClB,QAAQ,EAAE,OAAO;oCACjB,OAAO,EAAE,WAAW,KAAK,CAAC,SAAS,0BAA0B,KAAK,CAAC,IAAI,+BAA+B;iCACvG,CAAC,CAAC;4BACL,CAAC;wBACH,CAAC;6BAAM,CAAC;4BACN,WAAW,CAAC,IAAI,CAAC;gCACf,IAAI,EAAE,YAAY;gCAClB,QAAQ,EAAE,SAAS;gCACnB,OAAO,EAAE,mBAAmB,KAAK,CAAC,IAAI,wBAAwB,KAAK,CAAC,SAAS,2CAA2C;6BACzH,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,WAAW,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,YAAY;oBAClB,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,gBAAgB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;iBAC5E,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS;IACT,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;IAErE,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,iBAAiB,SAAS,gBAAgB,CAAC,CAAC;QACxD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;gBAC5B,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;gBACvD,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,GAAG,GAAG,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzD,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,MAAM,cAAc,QAAQ,CAAC,MAAM,eAAe,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}

package/commands/verify.d.ts

@@ -0,0 +1,11 @@
+/**
+ * `dql verify` — prove the on-disk manifest is reproducible from source.
+ *
+ * Recompiles the manifest in-memory and diffs it against `dql-manifest.json`.
+ * Returns a non-zero exit code (and prints a diff summary) on drift. Used by
+ * CI to ensure programmable artifacts (Apps, dashboards, blocks, RLS rules,
+ * schedules) stay in lock-step with their source files.
+ */
+import type { CLIFlags } from '../args.js';
+export declare function runVerify(_rest: string[], flags: CLIFlags): Promise<void>;
+//# sourceMappingURL=verify.d.ts.map

package/commands/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/commands/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAG3C,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CA8B/E"}

package/commands/verify.js

@@ -0,0 +1,74 @@
+/**
+ * `dql verify` — prove the on-disk manifest is reproducible from source.
+ *
+ * Recompiles the manifest in-memory and diffs it against `dql-manifest.json`.
+ * Returns a non-zero exit code (and prints a diff summary) on drift. Used by
+ * CI to ensure programmable artifacts (Apps, dashboards, blocks, RLS rules,
+ * schedules) stay in lock-step with their source files.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { buildManifest } from '@duckcodeailabs/dql-core';
+import { findProjectRoot } from '../local-runtime.js';
+export async function runVerify(_rest, flags) {
+    const projectRoot = findProjectRoot(process.cwd());
+    const manifestPath = join(projectRoot, 'dql-manifest.json');
+    if (!existsSync(manifestPath)) {
+        throw new Error(`dql-manifest.json not found at ${manifestPath}. Run \`dql compile\` first.`);
+    }
+    const onDisk = JSON.parse(readFileSync(manifestPath, 'utf-8'));
+    const fresh = buildManifest({ projectRoot });
+    const drift = diffManifest(onDisk, fresh);
+    const json = flags.format === 'json';
+    if (drift.length === 0) {
+        if (json) {
+            console.log(JSON.stringify({ ok: true }));
+        }
+        else {
+            console.log('  ✓ Manifest verified — no drift between source tree and dql-manifest.json.');
+        }
+        return;
+    }
+    if (json) {
+        console.log(JSON.stringify({ ok: false, drift }, null, 2));
+    }
+    else {
+        console.error(`  ✗ Manifest drift detected:`);
+        for (const item of drift)
+            console.error(`    - ${item}`);
+        console.error('\n  Run `dql compile` to regenerate, then commit.');
+    }
+    process.exit(1);
+}
+function diffManifest(a, b) {
+    const drift = [];
+    diffMap('blocks', new Set(Object.keys(a.blocks)), new Set(Object.keys(b.blocks)), drift);
+    diffMap('notebooks', new Set(Object.keys(a.notebooks)), new Set(Object.keys(b.notebooks)), drift);
+    diffMap('apps', new Set(Object.keys(a.apps ?? {})), new Set(Object.keys(b.apps ?? {})), drift);
+    diffMap('dashboards', new Set(Object.keys(a.dashboards ?? {})), new Set(Object.keys(b.dashboards ?? {})), drift);
+    diffMap('metrics', new Set(Object.keys(a.metrics)), new Set(Object.keys(b.metrics)), drift);
+    diffMap('dimensions', new Set(Object.keys(a.dimensions)), new Set(Object.keys(b.dimensions)), drift);
+    diffMap('sources', new Set(Object.keys(a.sources)), new Set(Object.keys(b.sources)), drift);
+    // Block-level drift: shape changes that matter for downstream readers.
+    for (const [name, block] of Object.entries(a.blocks)) {
+        const other = b.blocks[name];
+        if (!other)
+            continue;
+        if (block.sql !== other.sql)
+            drift.push(`blocks/${name}: SQL drift`);
+        if ((block.status ?? '') !== (other.status ?? ''))
+            drift.push(`blocks/${name}: status drift (${block.status} → ${other.status})`);
+        if ((block.domain ?? '') !== (other.domain ?? ''))
+            drift.push(`blocks/${name}: domain drift`);
+    }
+    return drift;
+}
+function diffMap(label, a, b, into) {
+    for (const k of a)
+        if (!b.has(k))
+            into.push(`${label}: removed "${k}"`);
+    for (const k of b)
+        if (!a.has(k))
+            into.push(`${label}: added "${k}"`);
+}
+//# sourceMappingURL=verify.js.map

package/commands/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/commands/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAoB,MAAM,0BAA0B,CAAC;AAE3E,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAe,EAAE,KAAe;IAC9D,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACnD,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IAC5D,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,kCAAkC,YAAY,8BAA8B,CAAC,CAAC;IAChG,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAgB,CAAC;IAC9E,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;IAE7C,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAI,KAA6B,CAAC,MAAM,KAAK,MAAM,CAAC;IAE9D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7D,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC9C,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,OAAO,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QACzD,OAAO,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,YAAY,CAAC,CAAc,EAAE,CAAc;IAClD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,OAAO,CAAC,QAAQ,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACzF,OAAO,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAClG,OAAO,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/F,OAAO,CAAC,YAAY,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACjH,OAAO,CAAC,SAAS,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5F,OAAO,CAAC,YAAY,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACrG,OAAO,CAAC,SAAS,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAE5F,uEAAuE;IACvE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,IAAI,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;YAAE,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,aAAa,CAAC,CAAC;QACrE,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,mBAAmB,KAAK,CAAC,MAAM,MAAM,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QAClI,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,gBAAgB,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CAAC,KAAa,EAAE,CAAc,EAAE,CAAc,EAAE,IAAc;IAC5E,KAAK,MAAM,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,cAAc,CAAC,GAAG,CAAC,CAAC;IACxE,KAAK,MAAM,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,YAAY,CAAC,GAAG,CAAC,CAAC;AACxE,CAAC"}

package/digest.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Digest build helper — resolves block sources + SHAs and drives digest-emitter.
+ *
+ * Runs outside compile() so the narrative (potentially LLM-backed) stays an
+ * async post-process step and doesn't push async up through the core compiler.
+ */
+import { type CompilationOutput, type DigestBuildResult, type DigestLLMProvider } from '@duckcodeailabs/dql-compiler';
+export declare function isDigestOutput(output: CompilationOutput): boolean;
+export declare function runDigestBuild(output: CompilationOutput, projectRoot: string, llm?: DigestLLMProvider): Promise<DigestBuildResult>;
+//# sourceMappingURL=digest.d.ts.map

package/digest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"digest.d.ts","sourceRoot":"","sources":["../src/digest.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,EAGL,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACvB,MAAM,8BAA8B,CAAC;AAEtC,wBAAgB,cAAc,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAEjE;AAED,wBAAsB,cAAc,CAClC,MAAM,EAAE,iBAAiB,EACzB,WAAW,EAAE,MAAM,EACnB,GAAG,CAAC,EAAE,iBAAiB,GACtB,OAAO,CAAC,iBAAiB,CAAC,CAsB5B"}

package/digest.js

@@ -0,0 +1,83 @@
+/**
+ * Digest build helper — resolves block sources + SHAs and drives digest-emitter.
+ *
+ * Runs outside compile() so the narrative (potentially LLM-backed) stays an
+ * async post-process step and doesn't push async up through the core compiler.
+ */
+import { execSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { buildManifest } from '@duckcodeailabs/dql-core';
+import { buildDigest, } from '@duckcodeailabs/dql-compiler';
+export function isDigestOutput(output) {
+    return Boolean(output.metadata?.narrative);
+}
+export async function runDigestBuild(output, projectRoot, llm) {
+    const narrative = output.metadata?.narrative;
+    if (!narrative) {
+        throw new Error('runDigestBuild called on non-digest output');
+    }
+    const sources = loadBlockSources(projectRoot, narrative.sources);
+    const digestIR = {
+        title: output.metadata.title,
+        narrative,
+        // The digest-emitter only needs `title` + `narrative` + `sources` for
+        // narrative composition; the dashboard HTML is threaded in separately.
+        charts: [],
+        filters: [],
+        params: [],
+        notifications: output.metadata.notifications ?? [],
+        alerts: output.metadata.alerts ?? [],
+        layout: { type: 'grid', columns: 12, items: [] },
+        variables: {},
+    };
+    return buildDigest(digestIR, output.html, sources, llm);
+}
+function loadBlockSources(projectRoot, sourceNames) {
+    const manifest = loadOrBuildManifest(projectRoot);
+    const sources = new Map();
+    for (const name of sourceNames) {
+        const block = manifest?.blocks?.[name];
+        if (!block) {
+            sources.set(name, { path: name, description: undefined });
+            continue;
+        }
+        sources.set(name, {
+            path: block.filePath,
+            description: block.description,
+            gitCommitSha: resolveGitSha(projectRoot, block.filePath),
+        });
+    }
+    return sources;
+}
+function loadOrBuildManifest(projectRoot) {
+    const cached = join(projectRoot, 'dql-manifest.json');
+    if (existsSync(cached)) {
+        try {
+            return JSON.parse(readFileSync(cached, 'utf-8'));
+        }
+        catch {
+            // fall through to fresh build
+        }
+    }
+    try {
+        return buildManifest({ projectRoot, dqlVersion: '0.0.0' });
+    }
+    catch {
+        return null;
+    }
+}
+function resolveGitSha(projectRoot, filePath) {
+    try {
+        const sha = execSync(`git log -1 --format=%H -- "${filePath}"`, {
+            cwd: projectRoot,
+            encoding: 'utf-8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        }).trim();
+        return sha.length > 0 ? sha : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=digest.js.map

package/digest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"digest.js","sourceRoot":"","sources":["../src/digest.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAoB,MAAM,0BAA0B,CAAC;AAC3E,OAAO,EACL,WAAW,GAKZ,MAAM,8BAA8B,CAAC;AAEtC,MAAM,UAAU,cAAc,CAAC,MAAyB;IACtD,OAAO,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAyB,EACzB,WAAmB,EACnB,GAAuB;IAEvB,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC;IAC7C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,WAAW,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG;QACf,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK;QAC5B,SAAS;QACT,sEAAsE;QACtE,uEAAuE;QACvE,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,EAAE;QACV,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,aAAa,IAAI,EAAE;QAClD,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE;QACpC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QACzD,SAAS,EAAE,EAAE;KACd,CAAC;IAEF,OAAO,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,gBAAgB,CAAC,WAAmB,EAAE,WAAqB;IAClE,MAAM,QAAQ,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAClD,MAAM,OAAO,GAAmB,IAAI,GAAG,EAAE,CAAC;IAE1C,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,QAAQ,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;YAC1D,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE;YAChB,IAAI,EAAE,KAAK,CAAC,QAAQ;YACpB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,aAAa,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC;SACzD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,mBAAmB,CAAC,WAAmB;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IACtD,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAgB,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,8BAA8B;QAChC,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,aAAa,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,WAAmB,EAAE,QAAgB;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,QAAQ,CAAC,8BAA8B,QAAQ,GAAG,EAAE;YAC9D,GAAG,EAAE,WAAW;YAChB,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACpC,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/git-service.d.ts

@@ -0,0 +1,17 @@
+export interface RepoContext {
+    /** Absolute path to the repository root (where `.git` lives). */
+    dir: string;
+    /** Relative path of the requested file from the repo root, POSIX-separated. */
+    relpath: string;
+}
+/**
+ * Locate the git repository containing `absPath`. Walks upward looking
+ * for a `.git` directory. Returns `null` when no repository is found.
+ */
+export declare function findRepoContext(absPath: string): RepoContext | null;
+/**
+ * Read the HEAD-committed contents of `relpath` as a UTF-8 string. Returns
+ * `null` if HEAD has no such file (newly added in the working copy).
+ */
+export declare function readHeadBlob(ctx: RepoContext): Promise<string | null>;
+//# sourceMappingURL=git-service.d.ts.map

package/git-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-service.d.ts","sourceRoot":"","sources":["../src/git-service.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,WAAW;IAC1B,iEAAiE;IACjE,GAAG,EAAE,MAAM,CAAC;IACZ,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAcnE;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAc3E"}

package/git-service.js

@@ -0,0 +1,54 @@
+// Thin isomorphic-git wrapper used by `dql diff <path>` to resolve the
+// HEAD blob for a file inside a git repo.
+import { statSync } from 'node:fs';
+import { join, relative, resolve } from 'node:path';
+import git from 'isomorphic-git';
+import * as fs from 'node:fs';
+/**
+ * Locate the git repository containing `absPath`. Walks upward looking
+ * for a `.git` directory. Returns `null` when no repository is found.
+ */
+export function findRepoContext(absPath) {
+    let dir = resolve(absPath);
+    if (!statSync(dir, { throwIfNoEntry: false })?.isDirectory()) {
+        dir = resolve(dir, '..');
+    }
+    while (true) {
+        if (statSync(join(dir, '.git'), { throwIfNoEntry: false })) {
+            const rel = relative(dir, absPath).split(/[\\/]/).join('/');
+            return { dir, relpath: rel };
+        }
+        const parent = resolve(dir, '..');
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+/**
+ * Read the HEAD-committed contents of `relpath` as a UTF-8 string. Returns
+ * `null` if HEAD has no such file (newly added in the working copy).
+ */
+export async function readHeadBlob(ctx) {
+    try {
+        const commitSha = await git.resolveRef({ fs, dir: ctx.dir, ref: 'HEAD' });
+        const { blob } = await git.readBlob({
+            fs,
+            dir: ctx.dir,
+            oid: commitSha,
+            filepath: ctx.relpath,
+        });
+        return new TextDecoder('utf-8').decode(blob);
+    }
+    catch (error) {
+        if (isNotFoundError(error))
+            return null;
+        throw error;
+    }
+}
+function isNotFoundError(error) {
+    if (!error || typeof error !== 'object')
+        return false;
+    const code = error.code;
+    return code === 'NotFoundError' || code === 'ENOENT';
+}
+//# sourceMappingURL=git-service.js.map

package/git-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-service.js","sourceRoot":"","sources":["../src/git-service.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,0CAA0C;AAE1C,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,GAAG,MAAM,gBAAgB,CAAC;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAS9B;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,IAAI,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3B,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC;QAC7D,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YAC3D,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC5D,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QAC/B,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAChC,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAgB;IACjD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC;YAClC,EAAE;YACF,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,GAAG,EAAE,SAAS;YACd,QAAQ,EAAE,GAAG,CAAC,OAAO;SACtB,CAAC,CAAC;QACH,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,eAAe,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,IAAI,GAAI,KAA2B,CAAC,IAAI,CAAC;IAC/C,OAAO,IAAI,KAAK,eAAe,IAAI,IAAI,KAAK,QAAQ,CAAC;AACvD,CAAC"}

package/governance-runtime.d.ts

@@ -0,0 +1,15 @@
+import { type AppDocument } from '@duckcodeailabs/dql-core';
+import { type AccessLevel, type DataClassification } from '@duckcodeailabs/dql-governance';
+export declare class DQLAccessDeniedError extends Error {
+    constructor(message: string);
+}
+export declare function runtimeVariables(base: Record<string, unknown> | undefined): Record<string, unknown>;
+export declare function activePersonaAppId(): string | undefined;
+export declare function loadRuntimeApp(projectRoot: string, appId: string | undefined | null): AppDocument | null;
+export declare function assertAppAccess(opts: {
+    app: AppDocument | null;
+    domain?: string | null;
+    classification?: DataClassification | null;
+    level?: AccessLevel;
+}): void;
+//# sourceMappingURL=governance-runtime.d.ts.map

package/governance-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"governance-runtime.d.ts","sourceRoot":"","sources":["../src/governance-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAgB,KAAK,WAAW,EAAqB,KAAK,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAM5H,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM;CAI5B;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEnG;AAED,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAEvD;AAED,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,WAAW,GAAG,IAAI,CAOxG;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,GAAG,EAAE,WAAW,GAAG,IAAI,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,cAAc,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAC3C,KAAK,CAAC,EAAE,WAAW,CAAC;CACrB,GAAG,IAAI,CAcP"}

package/governance-runtime.js

@@ -0,0 +1,50 @@
+import { loadAppDocument, findAppDocuments, } from '@duckcodeailabs/dql-core';
+import { PolicyEngine } from '@duckcodeailabs/dql-governance';
+import { defaultPersonaRegistry, mergePersonaVariables, } from '@duckcodeailabs/dql-project';
+export class DQLAccessDeniedError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'DQLAccessDeniedError';
+    }
+}
+export function runtimeVariables(base) {
+    return mergePersonaVariables(base ?? {}, defaultPersonaRegistry.active);
+}
+export function activePersonaAppId() {
+    return defaultPersonaRegistry.active?.appId;
+}
+export function loadRuntimeApp(projectRoot, appId) {
+    if (!appId)
+        return null;
+    for (const p of findAppDocuments(projectRoot)) {
+        const { document } = loadAppDocument(p);
+        if (document?.id === appId)
+            return document;
+    }
+    return null;
+}
+export function assertAppAccess(opts) {
+    const app = opts.app;
+    if (!app)
+        return;
+    const user = defaultPersonaRegistry.toUserContext();
+    const engine = new PolicyEngine(app.policies.map(toAccessPolicy));
+    const result = engine.checkAccess(user, opts.domain ?? app.domain, opts.classification ?? 'internal', opts.level ?? 'execute');
+    if (!result.allowed) {
+        throw new DQLAccessDeniedError(result.reason ?? 'Not authorized');
+    }
+}
+function toAccessPolicy(policy) {
+    return {
+        id: policy.id,
+        name: policy.id,
+        description: policy.description ?? policy.id,
+        domain: policy.domain,
+        minClassification: policy.minClassification,
+        allowedRoles: policy.allowedRoles,
+        allowedUsers: policy.allowedUsers ?? [],
+        accessLevel: policy.accessLevel,
+        enabled: policy.enabled !== false,
+    };
+}
+//# sourceMappingURL=governance-runtime.js.map

package/governance-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"governance-runtime.js","sourceRoot":"","sources":["../src/governance-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,gBAAgB,GAEjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,YAAY,EAAgE,MAAM,gCAAgC,CAAC;AAC5H,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,6BAA6B,CAAC;AAErC,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAyC;IACxE,OAAO,qBAAqB,CAAC,IAAI,IAAI,EAAE,EAAE,sBAAsB,CAAC,MAAM,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,sBAAsB,CAAC,MAAM,EAAE,KAAK,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,WAAmB,EAAE,KAAgC;IAClF,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,KAAK,MAAM,CAAC,IAAI,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9C,MAAM,EAAE,QAAQ,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,QAAQ,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO,QAAQ,CAAC;IAC9C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAK/B;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,IAAI,CAAC,GAAG;QAAE,OAAO;IACjB,MAAM,IAAI,GAAG,sBAAsB,CAAC,aAAa,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAC/B,IAAI,EACJ,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,EACzB,IAAI,CAAC,cAAc,IAAI,UAAU,EACjC,IAAI,CAAC,KAAK,IAAI,SAAS,CACxB,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,oBAAoB,CAAC,MAAM,CAAC,MAAM,IAAI,gBAAgB,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,MAAuC;IAC7D,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,IAAI,EAAE,MAAM,CAAC,EAAE;QACf,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,EAAE;QAC5C,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;QACvC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,MAAM,CAAC,OAAO,KAAK,KAAK;KAClC,CAAC;AACJ,CAAC"}

package/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=index.d.ts.map

package/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}

package/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,MAAM,IAAI,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmDZ,CAAC;AAEF,SAAS,UAAU;IACjB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/E,OAAO,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAExE,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,OAAO,UAAU,EAAE,EAAE,CAAC,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,CAAC,IAAI,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,UAAU,IAAI,OAAO,KAAK,UAAU,IAAI,OAAO,KAAK,UAAU,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QACzS,OAAO,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAAC;QAChF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,CAAC;QACH,QAAQ,OAAO,EAAE,CAAC;YAChB,KAAK,MAAM;gBACT,MAAM,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC3B,MAAM;YACR,KAAK,KAAK;gBACR,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;gBAChC,MAAM;YACR,KAAK,OAAO;gBACV,MAAM,QAAQ,CAAC,IAAK,EAAE,KAAK,CAAC,CAAC;gBAC7B,MAAM;YACR,KAAK,QAAQ;gBACX,MAAM,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC7B,MAAM;YACR,KAAK,OAAO;gBACV,MAAM,QAAQ,CAAC,IAAK,EAAE,KAAK,CAAC,CAAC;gBAC7B,MAAM;YACR,KAAK,SAAS;gBACZ,MAAM,UAAU,CAAC,IAAK,EAAE,KAAK,CAAC,CAAC;gBAC/B,MAAM;YACR,KAAK,OAAO;gBACV,MAAM,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC5B,MAAM;YACR,KAAK,MAAM;gBACT,MAAM,OAAO,CAAC,IAAK,EAAE,KAAK,CAAC,CAAC;gBAC5B,MAAM;YACR,KAAK,SAAS;gBACZ,MAAM,UAAU,CAAC,IAAK,EAAE,KAAK,CAAC,CAAC;gBAC/B,MAAM;YACR,KAAK,MAAM;gBACT,MAAM,OAAO,CAAC,IAAK,EAAE,KAAK,CAAC,CAAC;gBAC5B,MAAM;YACR,KAAK,SAAS;gBACZ,MAAM,UAAU,CAAC,IAAK,EAAE,KAAK,CAAC,CAAC;gBAC/B,MAAM;YACR,KAAK,KAAK;gBACR,MAAM,MAAM,CAAC,IAAK,EAAE,KAAK,CAAC,CAAC;gBAC3B,MAAM;YACR,KAAK,UAAU;gBACb,MAAM,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC/B,MAAM;YACR,KAAK,UAAU;gBACb,MAAM,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC/B,MAAM;YACR,KAAK,UAAU;gBACb,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;gBACrC,MAAM;YACR,KAAK,SAAS;gBACZ,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;gBACpC,MAAM;YACR,KAAK,MAAM;gBACT,MAAM,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;gBACjC,MAAM;YACR,KAAK,SAAS;gBACZ,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;gBACpC,MAAM;YACR,KAAK,MAAM;gBACT,MAAM,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;gBACjC,MAAM;YACR,KAAK,KAAK;gBACR,MAAM,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC1B,MAAM;YACR,KAAK,KAAK;gBACR,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;gBAChC,MAAM;YACR,KAAK,UAAU;gBACb,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;gBACrC,MAAM;YACR,KAAK,OAAO;gBACV,MAAM,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;gBAClC,MAAM;YACR,KAAK,OAAO;gBACV,MAAM,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;gBAClC,MAAM;YACR,KAAK,QAAQ;gBACX,MAAM,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC7B,MAAM;YACR;gBACE,OAAO,CAAC,KAAK,CAAC,oBAAoB,OAAO,+BAA+B,CAAC,CAAC;gBAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC"}

package/llm/index.d.ts

@@ -0,0 +1,4 @@
+import type { AgentRunner, ProviderId } from './types.js';
+export { type AgentRunRequest, type AgentRunner, type AgentTurn, type BlockProposal, type ChatTurn, type LLMProvider, type ProviderId, } from './types.js';
+export declare function getRunner(provider: ProviderId): AgentRunner | null;
+//# sourceMappingURL=index.d.ts.map

package/llm/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/llm/index.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE1D,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,UAAU,GAChB,MAAM,YAAY,CAAC;AAepB,wBAAgB,SAAS,CAAC,QAAQ,EAAE,UAAU,GAAG,WAAW,GAAG,IAAI,CAElE"}

package/llm/index.js

@@ -0,0 +1,19 @@
+import { claudeAgentSdkRunner } from './providers/claude-agent-sdk.js';
+import { claudeCodeRunner } from './providers/claude-code.js';
+import { createDqlAgentProviderRunner } from './providers/dql-agent-provider.js';
+/**
+ * Registry of available LLM providers. Claude keeps the tool-use loop; the
+ * OpenAI/Gemini/Ollama adapters reuse `@duckcodeailabs/dql-agent` providers
+ * and emit the same AgentTurn SSE envelope for notebook Chat.
+ */
+const RUNNERS = {
+    'claude-agent-sdk': claudeAgentSdkRunner,
+    'claude-code': claudeCodeRunner,
+    openai: createDqlAgentProviderRunner('openai'),
+    gemini: createDqlAgentProviderRunner('gemini'),
+    ollama: createDqlAgentProviderRunner('ollama'),
+};
+export function getRunner(provider) {
+    return RUNNERS[provider] ?? null;
+}
+//# sourceMappingURL=index.js.map

package/llm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/llm/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AAajF;;;;GAIG;AACH,MAAM,OAAO,GAAoC;IAC/C,kBAAkB,EAAE,oBAAoB;IACxC,aAAa,EAAE,gBAAgB;IAC/B,MAAM,EAAE,4BAA4B,CAAC,QAAQ,CAAC;IAC9C,MAAM,EAAE,4BAA4B,CAAC,QAAQ,CAAC;IAC9C,MAAM,EAAE,4BAA4B,CAAC,QAAQ,CAAC;CAC/C,CAAC;AAEF,MAAM,UAAU,SAAS,CAAC,QAAoB;IAC5C,OAAO,OAAO,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;AACnC,CAAC"}

package/llm/providers/claude-agent-sdk.d.ts

@@ -0,0 +1,3 @@
+import type { AgentRunner } from '../types.js';
+export declare const claudeAgentSdkRunner: AgentRunner;
+//# sourceMappingURL=claude-agent-sdk.d.ts.map

package/llm/providers/claude-agent-sdk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-agent-sdk.d.ts","sourceRoot":"","sources":["../../../src/llm/providers/claude-agent-sdk.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAmB,WAAW,EAA4B,MAAM,aAAa,CAAC;AAsL1F,eAAO,MAAM,oBAAoB,EAAE,WAiBlC,CAAC"}