@dzhechkov/harness-core 0.3.121 → 0.3.123

package/README.md

@@ -10,6 +10,7 @@ and any other consumer.
 | `skills` | `loadSkillFromDir`, `listSkills`, `discoverSkillIds` | Read skill directories into `CanonicalSkill` objects |
 | `apply` | `applyEmitResult` | Write an adapter `EmitResult` to disk — **additively** |
 | `targets` | `TARGETS`, `TargetName`, `isTargetName` | `--target` name → platform adapter |
+| `guard` | `evaluateGuard`, `resolveRules`, `scanSecrets`, `DEFAULT_RULES` | Declarative HARD/SOFT constraint engine behind `dz guard` (publish/teach/consolidate pre-flight; fail-closed) |
 | `operations` | `runInit`, `runSync`, `runVerify`, `runDoctor` | The harness operations, returning structured reports |
 
 ## The additive guarantee

package/dist/guard.d.ts

@@ -0,0 +1,98 @@
+export type GuardSeverity = 'hard' | 'soft';
+export type GuardOp = 'publish' | 'teach' | 'consolidate' | 'reindex';
+export type GuardVerdict = 'pass' | 'warn' | 'block';
+/** A declarative rule. Built-in rules ship with a checker (below); config can only tune/disable them. */
+export interface GuardRule {
+    readonly id: string;
+    readonly severity: GuardSeverity;
+    readonly ops: readonly GuardOp[];
+    readonly description: string;
+    /** false ⇒ the rule is disabled (config override). */
+    readonly enabled?: boolean;
+}
+export interface Violation {
+    readonly rule: string;
+    readonly severity: GuardSeverity;
+    readonly detail: string;
+}
+export interface GuardResult {
+    readonly op: GuardOp;
+    readonly verdict: GuardVerdict;
+    readonly violations: readonly Violation[];
+    /** ids of the rules that ran for this op (so a report can show what was checked, not just what failed). */
+    readonly checked: readonly string[];
+}
+/** Facts the CLI injects; each rule reads only the fields it needs. Missing evidence ⇒ that rule is skipped. */
+export interface GuardFacts {
+    readonly op: GuardOp;
+    /** for no-workspace-star: each publishable package's deps map. */
+    readonly packages?: readonly {
+        readonly name: string;
+        readonly deps: Readonly<Record<string, string>>;
+    }[];
+    /** for no-skill-drift: the names that byte-drift between copies (from sweepSkillDrift). */
+    readonly drift?: readonly string[];
+    /** for no-secrets: labelled blobs to scan (lesson text, staged files). */
+    readonly secretTargets?: readonly {
+        readonly label: string;
+        readonly text: string;
+    }[];
+    /** for readme-consistency: labelled (a,b) count pairs that must be equal. */
+    readonly counts?: readonly {
+        readonly label: string;
+        readonly a: number;
+        readonly b: number;
+    }[];
+    /** for store-bloat-cap: current learned-store size vs its cap. */
+    readonly store?: {
+        readonly count: number;
+        readonly cap: number;
+    };
+    /** for readme-first: per publishable package, is a version bump staged without a README change? */
+    readonly readmeFirst?: readonly {
+        readonly name: string;
+        readonly versionBumped: boolean;
+        readonly readmeChanged: boolean;
+    }[];
+}
+/** The built-in rule set (works with no config). Ops are the mutating operations each rule guards. */
+export declare const DEFAULT_RULES: readonly GuardRule[];
+/**
+ * Secret patterns — high-signal, low-false-positive. Each is anchored to a real credential shape, so ordinary
+ * prose does not trip it. Extend deliberately (a broad `[A-Za-z0-9]{32}` would flag every hash).
+ */
+export declare const SECRET_PATTERNS: readonly {
+    readonly name: string;
+    readonly re: RegExp;
+}[];
+/** Scan text for secret shapes. Returns each match's pattern name (deduped) — never throws on hostile input. */
+export declare function scanSecrets(text: unknown): {
+    readonly name: string;
+}[];
+/** Merge a user config over the defaults: override severity, disable (enabled:false), never add an un-checked rule. */
+export declare function resolveRules(userRules?: readonly Partial<GuardRule>[]): GuardRule[];
+/**
+ * Evaluate the guard for one operation over injected facts. Fail-safe: a checker that throws is caught and
+ * DEMOTED to a HARD violation (a rule that cannot decide must not silently pass). Verdict: any hard violation
+ * ⇒ block; else any soft ⇒ warn; else pass.
+ */
+export declare function evaluateGuard(facts: GuardFacts, rules?: readonly GuardRule[]): GuardResult;
+/** An append-only audit record. `ts` is injected by the caller (no wall-clock here → deterministic tests). */
+export interface GuardAuditRecord {
+    readonly ts: string;
+    readonly op: GuardOp;
+    readonly verdict: GuardVerdict;
+    readonly violations: readonly Violation[];
+    /** set when the operator overrode a block with `--force <reason>` — the override is logged, never silent. */
+    readonly override?: {
+        readonly forced: true;
+        readonly reason: string;
+    };
+}
+/** Build the audit record for a guard evaluation (+ an optional forced-override reason). Pure. */
+export declare function auditRecord(result: GuardResult, ts: string, override?: {
+    reason: string;
+}): GuardAuditRecord;
+/** The exit-code contract: a block is non-zero unless forced; a warn/pass is zero. */
+export declare function guardExitCode(result: GuardResult, forced: boolean): number;
+//# sourceMappingURL=guard.d.ts.map

package/dist/guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAaA,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,CAAC;AAC5C,MAAM,MAAM,OAAO,GAAG,SAAS,GAAG,OAAO,GAAG,aAAa,GAAG,SAAS,CAAC;AACtE,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAErD,yGAAyG;AACzG,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,SAAS,OAAO,EAAE,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,sDAAsD;IACtD,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,CAAC;IAC1C,2GAA2G;IAC3G,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,gHAAgH;AAChH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;KAAE,EAAE,CAAC;IAC1G,2FAA2F;IAC3F,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,0EAA0E;IAC1E,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACtF,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAChG,kEAAkE;IAClE,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAClE,mGAAmG;IACnG,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;CAC/H;AAED,sGAAsG;AACtG,eAAO,MAAM,aAAa,EAAE,SAAS,SAAS,EAO7C,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,EAQpF,CAAC;AAEF,gHAAgH;AAChH,wBAAgB,WAAW,CAAC,IAAI,EAAE,OAAO,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,CAKtE;AAwDD,uHAAuH;AACvH,wBAAgB,YAAY,CAAC,SAAS,CAAC,EAAE,SAAS,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,SAAS,EAAE,CAanF;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,GAAE,SAAS,SAAS,EAAkB,GAAG,WAAW,CA2BzG;AAED,8GAA8G;AAC9G,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,CAAC;IAC1C,6GAA6G;IAC7G,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACxE;AAED,kGAAkG;AAClG,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,gBAAgB,CAQ5G;AAED,sFAAsF;AACtF,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,CAE1E"}

package/dist/guard.js

@@ -0,0 +1,162 @@
+// `dz guard` — a declarative constraint layer that runs BEFORE self-mutating operations (publish, teach,
+// consolidate, reindex) and refuses when a HARD invariant is violated. Convergent shape from two RuvNet sources
+// (SAFLA's Safety & Validation Framework + daa-rules v0.2.1): declarative rules + a pure evaluator + an
+// append-only audit log. We DEPEND ON NEITHER — the engine is dz-native and reuses dz's own existing checks
+// (skill-drift, publish gate) rather than reinventing them.
+//
+// COMPLEX INSIDE, SIMPLE OUTSIDE: the engine below is a fail-safe, op-scoped, HARD/SOFT rule evaluator; the CLI
+// surface is just `dz guard check --op <op>` with built-in defaults that need zero configuration. `.dz/guard.json`
+// only exists if you want to override a severity, disable a rule, or tune a parameter.
+//
+// PURE: `evaluateGuard` operates over INJECTED FACTS (package.json deps, a drift result, lesson text, README
+// counts, store size) that the CLI gathers. No filesystem here → deterministic + unit-testable without a repo.
+/** The built-in rule set (works with no config). Ops are the mutating operations each rule guards. */
+export const DEFAULT_RULES = [
+    { id: 'no-workspace-star', severity: 'hard', ops: ['publish'], description: 'a published package.json must carry no workspace:* dep (npm ships it verbatim → the install breaks)' },
+    { id: 'no-skill-drift', severity: 'hard', ops: ['publish', 'consolidate'], description: 'no unexpected byte-drift between shared skill copies' },
+    { id: 'no-secrets', severity: 'hard', ops: ['teach', 'publish'], description: 'no private key or API token in lesson text or a published file' },
+    { id: 'readme-consistency', severity: 'soft', ops: ['publish'], description: 'README counts agree (CJM header vs All Commands, etc.)' },
+    { id: 'readme-first', severity: 'soft', ops: ['publish'], description: 'a package with a staged version bump must update its own README.md in the same change (README-first)' },
+    { id: 'store-bloat-cap', severity: 'soft', ops: ['teach', 'consolidate'], description: 'the learned store is within its size cap' },
+];
+/**
+ * Secret patterns — high-signal, low-false-positive. Each is anchored to a real credential shape, so ordinary
+ * prose does not trip it. Extend deliberately (a broad `[A-Za-z0-9]{32}` would flag every hash).
+ */
+export const SECRET_PATTERNS = [
+    { name: 'private-key-pem', re: /-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP |ENCRYPTED )?PRIVATE KEY-----/ },
+    { name: 'openai-key', re: /\bsk-[A-Za-z0-9_-]{20,}\b/ },
+    { name: 'stripe-key', re: /\bsk_(?:live|test)_[A-Za-z0-9]{16,}\b/ },
+    { name: 'github-token', re: /\bgh[pousr]_[A-Za-z0-9]{36,}\b/ },
+    { name: 'aws-access-key', re: /\bAKIA[0-9A-Z]{16}\b/ },
+    { name: 'slack-token', re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/ },
+    { name: 'google-api-key', re: /\bAIza[0-9A-Za-z_-]{35}\b/ },
+];
+/** Scan text for secret shapes. Returns each match's pattern name (deduped) — never throws on hostile input. */
+export function scanSecrets(text) {
+    if (typeof text !== 'string' || text.length === 0)
+        return [];
+    const hits = new Set();
+    for (const p of SECRET_PATTERNS)
+        if (p.re.test(text))
+            hits.add(p.name);
+    return [...hits].map((name) => ({ name }));
+}
+/** Per-rule pure checkers. Each returns the violations it found (empty ⇒ clean). Missing evidence ⇒ []. */
+const CHECKERS = {
+    'no-workspace-star': (f, sev) => {
+        const out = [];
+        for (const p of f.packages ?? []) {
+            for (const [dep, spec] of Object.entries(p.deps ?? {})) {
+                if (typeof spec === 'string' && spec.startsWith('workspace:')) {
+                    out.push({ rule: 'no-workspace-star', severity: sev, detail: `${p.name}: ${dep} = "${spec}" (a published package must pin a real semver, not workspace:*)` });
+                }
+            }
+        }
+        return out;
+    },
+    'no-skill-drift': (f, sev) => {
+        const drifted = Array.isArray(f.drift) ? f.drift.filter((d) => typeof d === 'string') : [];
+        return drifted.length === 0 ? [] : [{ rule: 'no-skill-drift', severity: sev, detail: `${drifted.length} skill(s) drift between copies: ${drifted.slice(0, 8).join(', ')}${drifted.length > 8 ? '…' : ''} — heal with dz sync-canonical` }];
+    },
+    'no-secrets': (f, sev) => {
+        const out = [];
+        for (const t of f.secretTargets ?? []) {
+            for (const hit of scanSecrets(t.text)) {
+                out.push({ rule: 'no-secrets', severity: sev, detail: `${t.label}: looks like a ${hit.name} — do not teach/publish a credential` });
+            }
+        }
+        return out;
+    },
+    'readme-consistency': (f, sev) => {
+        const out = [];
+        for (const c of f.counts ?? []) {
+            if (Number.isFinite(c.a) && Number.isFinite(c.b) && c.a !== c.b) {
+                out.push({ rule: 'readme-consistency', severity: sev, detail: `${c.label}: ${c.a} ≠ ${c.b} (README counts disagree)` });
+            }
+        }
+        return out;
+    },
+    'readme-first': (f, sev) => {
+        // The 2026-07-18 violation shape, mechanized: a package about to publish (version bumped in the diff)
+        // whose own README.md is untouched in the same diff. SOFT: some republishes legitimately need no doc
+        // change — the point is that skipping the README becomes a VISIBLE decision, not a silent lapse.
+        const out = [];
+        for (const p of f.readmeFirst ?? []) {
+            if (p && p.versionBumped === true && p.readmeChanged !== true) {
+                out.push({ rule: 'readme-first', severity: sev, detail: `${p.name}: version bumped but its README.md is untouched in this change — README-first: document the change (or consciously proceed; this warning is the record)` });
+            }
+        }
+        return out;
+    },
+    'store-bloat-cap': (f, sev) => {
+        const s = f.store;
+        if (!s || !Number.isFinite(s.count) || !Number.isFinite(s.cap) || s.cap <= 0)
+            return [];
+        return s.count <= s.cap ? [] : [{ rule: 'store-bloat-cap', severity: sev, detail: `learned store has ${s.count} patterns, over the cap of ${s.cap} — run dz consolidate --prune-noise` }];
+    },
+};
+/** Merge a user config over the defaults: override severity, disable (enabled:false), never add an un-checked rule. */
+export function resolveRules(userRules) {
+    const byId = new Map(DEFAULT_RULES.map((r) => [r.id, r]));
+    for (const u of Array.isArray(userRules) ? userRules : []) {
+        if (!u || typeof u.id !== 'string')
+            continue;
+        const base = byId.get(u.id);
+        if (!base)
+            continue; // a config rule with no built-in checker is ignored (fail-safe: no un-enforceable rules)
+        byId.set(u.id, {
+            ...base,
+            ...(u.severity === 'hard' || u.severity === 'soft' ? { severity: u.severity } : {}),
+            ...(typeof u.enabled === 'boolean' ? { enabled: u.enabled } : {}),
+        });
+    }
+    return [...byId.values()];
+}
+/**
+ * Evaluate the guard for one operation over injected facts. Fail-safe: a checker that throws is caught and
+ * DEMOTED to a HARD violation (a rule that cannot decide must not silently pass). Verdict: any hard violation
+ * ⇒ block; else any soft ⇒ warn; else pass.
+ */
+export function evaluateGuard(facts, rules = DEFAULT_RULES) {
+    const op = facts.op;
+    // Type-guarded filter: hostile rule entries (null, ops not an array, missing id) are DROPPED here rather
+    // than throwing mid-filter — the never-throws contract holds against a malformed rules array too.
+    const active = (Array.isArray(rules) ? rules : []).filter((r) => !!r && typeof r === 'object' && typeof r.id === 'string' && r.enabled !== false && Array.isArray(r.ops) && r.ops.includes(op));
+    const violations = [];
+    const checked = [];
+    for (const r of active) {
+        checked.push(r.id);
+        const checker = CHECKERS[r.id];
+        if (!checker) {
+            // A rule the caller asked for that has no checker CANNOT silently pass while reporting as checked —
+            // that is the smuggled-rule hole. Fail closed: unenforceable ⇒ a HARD violation.
+            violations.push({ rule: r.id, severity: 'hard', detail: 'no built-in checker for this rule — cannot enforce (fail-closed)' });
+            continue;
+        }
+        try {
+            violations.push(...checker(facts, r.severity));
+        }
+        catch (e) {
+            // `e` may be ANYTHING (throw null / throw 'str') — format it without touching .message on a non-Error.
+            violations.push({ rule: r.id, severity: 'hard', detail: `rule check errored (fail-closed): ${e instanceof Error ? e.message : String(e)}` });
+        }
+    }
+    const verdict = violations.some((v) => v.severity === 'hard') ? 'block' : violations.length > 0 ? 'warn' : 'pass';
+    return { op, verdict, violations, checked };
+}
+/** Build the audit record for a guard evaluation (+ an optional forced-override reason). Pure. */
+export function auditRecord(result, ts, override) {
+    return {
+        ts,
+        op: result.op,
+        verdict: result.verdict,
+        violations: result.violations,
+        ...(override && typeof override.reason === 'string' ? { override: { forced: true, reason: override.reason } } : {}),
+    };
+}
+/** The exit-code contract: a block is non-zero unless forced; a warn/pass is zero. */
+export function guardExitCode(result, forced) {
+    return result.verdict === 'block' && !forced ? 1 : 0;
+}
+//# sourceMappingURL=guard.js.map

package/dist/guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA,yGAAyG;AACzG,gHAAgH;AAChH,wGAAwG;AACxG,4GAA4G;AAC5G,4DAA4D;AAC5D,EAAE;AACF,gHAAgH;AAChH,mHAAmH;AACnH,uFAAuF;AACvF,EAAE;AACF,6GAA6G;AAC7G,+GAA+G;AA+C/G,sGAAsG;AACtG,MAAM,CAAC,MAAM,aAAa,GAAyB;IACjD,EAAE,EAAE,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,qGAAqG,EAAE;IACnL,EAAE,EAAE,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,WAAW,EAAE,sDAAsD,EAAE;IAChJ,EAAE,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,WAAW,EAAE,gEAAgE,EAAE;IAChJ,EAAE,EAAE,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,wDAAwD,EAAE;IACvI,EAAE,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,sGAAsG,EAAE;IAC/K,EAAE,EAAE,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,WAAW,EAAE,0CAA0C,EAAE;CACpI,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAA8D;IACxF,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,wEAAwE,EAAE;IACzG,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,2BAA2B,EAAE;IACvD,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,uCAAuC,EAAE;IACnE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,gCAAgC,EAAE;IAC9D,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,sBAAsB,EAAE;IACtD,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,kCAAkC,EAAE;IAC/D,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,2BAA2B,EAAE;CAC5D,CAAC;AAEF,gHAAgH;AAChH,MAAM,UAAU,WAAW,CAAC,IAAa;IACvC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC7D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,eAAe;QAAE,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACvE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,2GAA2G;AAC3G,MAAM,QAAQ,GAAuE;IACnF,mBAAmB,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;QAC9B,MAAM,GAAG,GAAgB,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YACjC,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;gBACvD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;oBAC9D,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,KAAK,GAAG,OAAO,IAAI,iEAAiE,EAAE,CAAC,CAAC;gBAChK,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,gBAAgB,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;QAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,mCAAmC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,gCAAgC,EAAE,CAAC,CAAC;IAC7O,CAAC;IACD,YAAY,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;QACvB,MAAM,GAAG,GAAgB,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;YACtC,KAAK,MAAM,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,kBAAkB,GAAG,CAAC,IAAI,sCAAsC,EAAE,CAAC,CAAC;YACtI,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,oBAAoB,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;QAC/B,MAAM,GAAG,GAAgB,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YAC/B,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,2BAA2B,EAAE,CAAC,CAAC;YAC1H,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,cAAc,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;QACzB,sGAAsG;QACtG,qGAAqG;QACrG,iGAAiG;QACjG,MAAM,GAAG,GAAgB,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC9D,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,yJAAyJ,EAAE,CAAC,CAAC;YAChO,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,iBAAiB,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;QAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;QAClB,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC;QACxF,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,qBAAqB,CAAC,CAAC,KAAK,8BAA8B,CAAC,CAAC,GAAG,qCAAqC,EAAE,CAAC,CAAC;IAC5L,CAAC;CACF,CAAC;AAEF,uHAAuH;AACvH,MAAM,UAAU,YAAY,CAAC,SAAyC;IACpE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAoB,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC1D,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;YAAE,SAAS;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI;YAAE,SAAS,CAAC,yFAAyF;QAC9G,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACb,GAAG,IAAI;YACP,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnF,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAiB,EAAE,QAA8B,aAAa;IAC1F,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;IACpB,yGAAyG;IACzG,kGAAkG;IAClG,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CACvD,CAAC,CAAC,EAAkB,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CACrJ,CAAC;IACF,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACnB,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,oGAAoG;YACpG,iFAAiF;YACjF,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,kEAAkE,EAAE,CAAC,CAAC;YAC9H,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,uGAAuG;YACvG,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,qCAAqC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/I,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAiB,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IAChI,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AAC9C,CAAC;AAYD,kGAAkG;AAClG,MAAM,UAAU,WAAW,CAAC,MAAmB,EAAE,EAAU,EAAE,QAA6B;IACxF,OAAO;QACL,EAAE;QACF,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,GAAG,CAAC,QAAQ,IAAI,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpH,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,aAAa,CAAC,MAAmB,EAAE,MAAe;IAChE,OAAO,MAAM,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC"}

package/dist/index.d.ts

@@ -91,4 +91,5 @@ export * from './challenge-panel.js';
 export * from './routing-outcomes.js';
 export * from './bto-optimize.js';
 export * from './discrimination-gate.js';
+export * from './guard.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,mFAAmF;AACnF,eAAO,MAAM,oBAAoB,EAAE,MACiD,CAAC;AAErF,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC7E,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAClH,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACtH,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACvE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACpG,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAC1H,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,SAAS,EAAE,aAAa,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,aAAa,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,cAAc,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,aAAa,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,UAAU,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACthB,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,oBAAoB,EAAE,WAAW,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,UAAU,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAClW,OAAO,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AACtK,YAAY,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC9K,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,EACpB,eAAe,EACf,YAAY,EACZ,UAAU,EACV,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EACX,SAAS,EACT,eAAe,EACf,aAAa,EACb,oBAAoB,EACpB,YAAY,EACZ,gBAAgB,EAChB,SAAS,EACT,aAAa,EACb,oBAAoB,EACpB,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAC3H,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACjH,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAClG,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAChO,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAClG,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACvN,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC/F,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAChF,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EACL,SAAS,EACT,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACb,SAAS,EACT,qBAAqB,EACrB,iBAAiB,EACjB,UAAU,EACV,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EACV,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC/E,YAAY,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvE,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClE,YAAY,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,oBAAoB,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACxG,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAClG,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAClG,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AACpF,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,eAAe,EACf,qBAAqB,EACrB,yBAAyB,EACzB,gCAAgC,EAChC,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACrG,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,iCAAiC,EACjC,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,+BAA+B,EAC/B,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,qBAAqB,EACrB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,WAAW,EAAE,gBAAgB,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACxN,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAChE,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAChF,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACrG,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EACL,YAAY,EACZ,UAAU,EACV,cAAc,EACd,SAAS,EACT,cAAc,EACd,cAAc,EACd,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,YAAY,EACZ,eAAe,EACf,QAAQ,EACR,UAAU,EACV,cAAc,EACd,YAAY,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACxF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,EACnB,cAAc,EACd,QAAQ,GACT,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,eAAe,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACzH,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACzE,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,SAAS,EACT,YAAY,EACZ,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,UAAU,EACV,aAAa,EACb,UAAU,EACV,WAAW,EACX,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC7D,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACrG,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,gBAAgB,EAChB,SAAS,EACT,cAAc,EACd,WAAW,EACX,YAAY,EACZ,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,UAAU,EACV,UAAU,EACV,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC1B,kCAAkC,GACnC,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAChG,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,sBAAsB,EACtB,mBAAmB,EACnB,yBAAyB,EACzB,4BAA4B,EAC5B,sBAAsB,EACtB,eAAe,EACf,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,aAAa,EACb,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,mFAAmF;AACnF,eAAO,MAAM,oBAAoB,EAAE,MACiD,CAAC;AAErF,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC7E,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAClH,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACtH,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACvE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACpG,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAC1H,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,SAAS,EAAE,aAAa,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,aAAa,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,cAAc,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,aAAa,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,UAAU,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACthB,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,oBAAoB,EAAE,WAAW,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,UAAU,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAClW,OAAO,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AACtK,YAAY,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC9K,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,EACpB,eAAe,EACf,YAAY,EACZ,UAAU,EACV,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EACX,SAAS,EACT,eAAe,EACf,aAAa,EACb,oBAAoB,EACpB,YAAY,EACZ,gBAAgB,EAChB,SAAS,EACT,aAAa,EACb,oBAAoB,EACpB,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAC3H,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACjH,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAClG,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAChO,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAClG,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACvN,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC/F,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAChF,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EACL,SAAS,EACT,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACb,SAAS,EACT,qBAAqB,EACrB,iBAAiB,EACjB,UAAU,EACV,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EACV,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC/E,YAAY,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvE,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClE,YAAY,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,oBAAoB,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACxG,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAClG,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAClG,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AACpF,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,eAAe,EACf,qBAAqB,EACrB,yBAAyB,EACzB,gCAAgC,EAChC,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACrG,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,iCAAiC,EACjC,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,+BAA+B,EAC/B,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,qBAAqB,EACrB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,WAAW,EAAE,gBAAgB,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACxN,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAChE,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAChF,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACrG,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EACL,YAAY,EACZ,UAAU,EACV,cAAc,EACd,SAAS,EACT,cAAc,EACd,cAAc,EACd,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,YAAY,EACZ,eAAe,EACf,QAAQ,EACR,UAAU,EACV,cAAc,EACd,YAAY,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACxF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,EACnB,cAAc,EACd,QAAQ,GACT,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,eAAe,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACzH,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACzE,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,SAAS,EACT,YAAY,EACZ,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,UAAU,EACV,aAAa,EACb,UAAU,EACV,WAAW,EACX,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC7D,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACrG,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,gBAAgB,EAChB,SAAS,EACT,cAAc,EACd,WAAW,EACX,YAAY,EACZ,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,UAAU,EACV,UAAU,EACV,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC1B,kCAAkC,GACnC,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAChG,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,sBAAsB,EACtB,mBAAmB,EACnB,yBAAyB,EACzB,4BAA4B,EAC5B,sBAAsB,EACtB,eAAe,EACf,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,aAAa,EACb,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,0BAA0B,CAAC;AACzC,cAAc,YAAY,CAAC"}

package/dist/index.js

@@ -57,4 +57,5 @@ export * from './challenge-panel.js';
 export * from './routing-outcomes.js';
 export * from './bto-optimize.js';
 export * from './discrimination-gate.js';
+export * from './guard.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,mFAAmF;AACnF,MAAM,CAAC,MAAM,oBAAoB,GAC9B,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,iBAAiB,CAAyB,CAAC,OAAO,CAAC;AAErF,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAElH,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEvE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAC1H,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,SAAS,EAAE,aAAa,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,aAAa,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,cAAc,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,aAAa,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,UAAU,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEthB,OAAO,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAEtK,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,EACpB,eAAe,EACf,YAAY,EACZ,UAAU,EACV,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAyB1B,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAC3H,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEjH,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAEhO,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAEvN,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAEhF,OAAO,EACL,SAAS,EACT,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACb,SAAS,EACT,qBAAqB,EACrB,iBAAiB,EACjB,UAAU,EACV,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EACV,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAK7C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,oBAAoB,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAExG,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAElG,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE7D,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,eAAe,EACf,qBAAqB,EACrB,yBAAyB,EACzB,gCAAgC,EAChC,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,iCAAiC,EACjC,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,+BAA+B,EAC/B,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAW3B,OAAO,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,WAAW,EAAE,gBAAgB,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACxN,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnD,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EACL,YAAY,EACZ,UAAU,EACV,cAAc,EACd,SAAS,EACT,cAAc,EACd,cAAc,EACd,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAS3B,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,EACnB,cAAc,EACd,QAAQ,GACT,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAkBzE,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,gBAAgB,EAChB,SAAS,EACT,cAAc,EACd,WAAW,EACX,YAAY,EACZ,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,UAAU,EACV,UAAU,EACV,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC1B,kCAAkC,GACnC,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,sBAAsB,EACtB,mBAAmB,EACnB,yBAAyB,EACzB,4BAA4B,EAC5B,sBAAsB,EACtB,eAAe,EACf,eAAe,GAChB,MAAM,YAAY,CAAC;AAYpB,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,0BAA0B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,mFAAmF;AACnF,MAAM,CAAC,MAAM,oBAAoB,GAC9B,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,iBAAiB,CAAyB,CAAC,OAAO,CAAC;AAErF,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAElH,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEvE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAC1H,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,SAAS,EAAE,aAAa,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,aAAa,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,cAAc,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,aAAa,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,UAAU,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEthB,OAAO,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAEtK,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,EACpB,eAAe,EACf,YAAY,EACZ,UAAU,EACV,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAyB1B,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAC3H,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEjH,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAEhO,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAEvN,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAEhF,OAAO,EACL,SAAS,EACT,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACb,SAAS,EACT,qBAAqB,EACrB,iBAAiB,EACjB,UAAU,EACV,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EACV,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAK7C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,oBAAoB,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAExG,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAElG,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE7D,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,eAAe,EACf,qBAAqB,EACrB,yBAAyB,EACzB,gCAAgC,EAChC,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,iCAAiC,EACjC,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,+BAA+B,EAC/B,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAW3B,OAAO,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,WAAW,EAAE,gBAAgB,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACxN,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnD,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EACL,YAAY,EACZ,UAAU,EACV,cAAc,EACd,SAAS,EACT,cAAc,EACd,cAAc,EACd,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAS3B,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,EACnB,cAAc,EACd,QAAQ,GACT,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAkBzE,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,gBAAgB,EAChB,SAAS,EACT,cAAc,EACd,WAAW,EACX,YAAY,EACZ,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,UAAU,EACV,UAAU,EACV,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC1B,kCAAkC,GACnC,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,sBAAsB,EACtB,mBAAmB,EACnB,yBAAyB,EACzB,4BAA4B,EAC5B,sBAAsB,EACtB,eAAe,EACf,eAAe,GAChB,MAAM,YAAY,CAAC;AAYpB,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,0BAA0B,CAAC;AACzC,cAAc,YAAY,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/harness-core",
-  "version": "0.3.121",
+  "version": "0.3.123",
   "description": "Shared harness logic - skill loading, additive apply, and the init/sync/verify/doctor operations.",
   "type": "module",
   "license": "MIT",
@@ -30,11 +30,11 @@
     "@dzhechkov/adapter-openclaude": "^0.1.0",
     "@dzhechkov/adapter-opencode": "^0.2.0",
     "yaml": "^2.0.0",
-    "@dzhechkov/adapter-gemini": "0.1.1",
     "@dzhechkov/adapter-copilot": "0.1.1",
-    "@dzhechkov/adapter-agents-md": "0.1.1",
     "@dzhechkov/adapter-cursor": "0.1.1",
     "@dzhechkov/adapter-windsurf": "0.1.1",
+    "@dzhechkov/adapter-gemini": "0.1.1",
+    "@dzhechkov/adapter-agents-md": "0.1.1",
     "@dzhechkov/core": "0.2.14",
     "@dzhechkov/memory": "0.2.9"
   },

package/src/guard.ts

@@ -0,0 +1,219 @@
+// `dz guard` — a declarative constraint layer that runs BEFORE self-mutating operations (publish, teach,
+// consolidate, reindex) and refuses when a HARD invariant is violated. Convergent shape from two RuvNet sources
+// (SAFLA's Safety & Validation Framework + daa-rules v0.2.1): declarative rules + a pure evaluator + an
+// append-only audit log. We DEPEND ON NEITHER — the engine is dz-native and reuses dz's own existing checks
+// (skill-drift, publish gate) rather than reinventing them.
+//
+// COMPLEX INSIDE, SIMPLE OUTSIDE: the engine below is a fail-safe, op-scoped, HARD/SOFT rule evaluator; the CLI
+// surface is just `dz guard check --op <op>` with built-in defaults that need zero configuration. `.dz/guard.json`
+// only exists if you want to override a severity, disable a rule, or tune a parameter.
+//
+// PURE: `evaluateGuard` operates over INJECTED FACTS (package.json deps, a drift result, lesson text, README
+// counts, store size) that the CLI gathers. No filesystem here → deterministic + unit-testable without a repo.
+
+export type GuardSeverity = 'hard' | 'soft';
+export type GuardOp = 'publish' | 'teach' | 'consolidate' | 'reindex';
+export type GuardVerdict = 'pass' | 'warn' | 'block';
+
+/** A declarative rule. Built-in rules ship with a checker (below); config can only tune/disable them. */
+export interface GuardRule {
+  readonly id: string;
+  readonly severity: GuardSeverity;
+  readonly ops: readonly GuardOp[];
+  readonly description: string;
+  /** false ⇒ the rule is disabled (config override). */
+  readonly enabled?: boolean;
+}
+
+export interface Violation {
+  readonly rule: string;
+  readonly severity: GuardSeverity;
+  readonly detail: string;
+}
+
+export interface GuardResult {
+  readonly op: GuardOp;
+  readonly verdict: GuardVerdict;
+  readonly violations: readonly Violation[];
+  /** ids of the rules that ran for this op (so a report can show what was checked, not just what failed). */
+  readonly checked: readonly string[];
+}
+
+/** Facts the CLI injects; each rule reads only the fields it needs. Missing evidence ⇒ that rule is skipped. */
+export interface GuardFacts {
+  readonly op: GuardOp;
+  /** for no-workspace-star: each publishable package's deps map. */
+  readonly packages?: readonly { readonly name: string; readonly deps: Readonly<Record<string, string>> }[];
+  /** for no-skill-drift: the names that byte-drift between copies (from sweepSkillDrift). */
+  readonly drift?: readonly string[];
+  /** for no-secrets: labelled blobs to scan (lesson text, staged files). */
+  readonly secretTargets?: readonly { readonly label: string; readonly text: string }[];
+  /** for readme-consistency: labelled (a,b) count pairs that must be equal. */
+  readonly counts?: readonly { readonly label: string; readonly a: number; readonly b: number }[];
+  /** for store-bloat-cap: current learned-store size vs its cap. */
+  readonly store?: { readonly count: number; readonly cap: number };
+  /** for readme-first: per publishable package, is a version bump staged without a README change? */
+  readonly readmeFirst?: readonly { readonly name: string; readonly versionBumped: boolean; readonly readmeChanged: boolean }[];
+}
+
+/** The built-in rule set (works with no config). Ops are the mutating operations each rule guards. */
+export const DEFAULT_RULES: readonly GuardRule[] = [
+  { id: 'no-workspace-star', severity: 'hard', ops: ['publish'], description: 'a published package.json must carry no workspace:* dep (npm ships it verbatim → the install breaks)' },
+  { id: 'no-skill-drift', severity: 'hard', ops: ['publish', 'consolidate'], description: 'no unexpected byte-drift between shared skill copies' },
+  { id: 'no-secrets', severity: 'hard', ops: ['teach', 'publish'], description: 'no private key or API token in lesson text or a published file' },
+  { id: 'readme-consistency', severity: 'soft', ops: ['publish'], description: 'README counts agree (CJM header vs All Commands, etc.)' },
+  { id: 'readme-first', severity: 'soft', ops: ['publish'], description: 'a package with a staged version bump must update its own README.md in the same change (README-first)' },
+  { id: 'store-bloat-cap', severity: 'soft', ops: ['teach', 'consolidate'], description: 'the learned store is within its size cap' },
+];
+
+/**
+ * Secret patterns — high-signal, low-false-positive. Each is anchored to a real credential shape, so ordinary
+ * prose does not trip it. Extend deliberately (a broad `[A-Za-z0-9]{32}` would flag every hash).
+ */
+export const SECRET_PATTERNS: readonly { readonly name: string; readonly re: RegExp }[] = [
+  { name: 'private-key-pem', re: /-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP |ENCRYPTED )?PRIVATE KEY-----/ },
+  { name: 'openai-key', re: /\bsk-[A-Za-z0-9_-]{20,}\b/ },
+  { name: 'stripe-key', re: /\bsk_(?:live|test)_[A-Za-z0-9]{16,}\b/ },
+  { name: 'github-token', re: /\bgh[pousr]_[A-Za-z0-9]{36,}\b/ },
+  { name: 'aws-access-key', re: /\bAKIA[0-9A-Z]{16}\b/ },
+  { name: 'slack-token', re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/ },
+  { name: 'google-api-key', re: /\bAIza[0-9A-Za-z_-]{35}\b/ },
+];
+
+/** Scan text for secret shapes. Returns each match's pattern name (deduped) — never throws on hostile input. */
+export function scanSecrets(text: unknown): { readonly name: string }[] {
+  if (typeof text !== 'string' || text.length === 0) return [];
+  const hits = new Set<string>();
+  for (const p of SECRET_PATTERNS) if (p.re.test(text)) hits.add(p.name);
+  return [...hits].map((name) => ({ name }));
+}
+
+/** Per-rule pure checkers. Each returns the violations it found (empty ⇒ clean). Missing evidence ⇒ []. */
+const CHECKERS: Record<string, (f: GuardFacts, sev: GuardSeverity) => Violation[]> = {
+  'no-workspace-star': (f, sev) => {
+    const out: Violation[] = [];
+    for (const p of f.packages ?? []) {
+      for (const [dep, spec] of Object.entries(p.deps ?? {})) {
+        if (typeof spec === 'string' && spec.startsWith('workspace:')) {
+          out.push({ rule: 'no-workspace-star', severity: sev, detail: `${p.name}: ${dep} = "${spec}" (a published package must pin a real semver, not workspace:*)` });
+        }
+      }
+    }
+    return out;
+  },
+  'no-skill-drift': (f, sev) => {
+    const drifted = Array.isArray(f.drift) ? f.drift.filter((d) => typeof d === 'string') : [];
+    return drifted.length === 0 ? [] : [{ rule: 'no-skill-drift', severity: sev, detail: `${drifted.length} skill(s) drift between copies: ${drifted.slice(0, 8).join(', ')}${drifted.length > 8 ? '…' : ''} — heal with dz sync-canonical` }];
+  },
+  'no-secrets': (f, sev) => {
+    const out: Violation[] = [];
+    for (const t of f.secretTargets ?? []) {
+      for (const hit of scanSecrets(t.text)) {
+        out.push({ rule: 'no-secrets', severity: sev, detail: `${t.label}: looks like a ${hit.name} — do not teach/publish a credential` });
+      }
+    }
+    return out;
+  },
+  'readme-consistency': (f, sev) => {
+    const out: Violation[] = [];
+    for (const c of f.counts ?? []) {
+      if (Number.isFinite(c.a) && Number.isFinite(c.b) && c.a !== c.b) {
+        out.push({ rule: 'readme-consistency', severity: sev, detail: `${c.label}: ${c.a} ≠ ${c.b} (README counts disagree)` });
+      }
+    }
+    return out;
+  },
+  'readme-first': (f, sev) => {
+    // The 2026-07-18 violation shape, mechanized: a package about to publish (version bumped in the diff)
+    // whose own README.md is untouched in the same diff. SOFT: some republishes legitimately need no doc
+    // change — the point is that skipping the README becomes a VISIBLE decision, not a silent lapse.
+    const out: Violation[] = [];
+    for (const p of f.readmeFirst ?? []) {
+      if (p && p.versionBumped === true && p.readmeChanged !== true) {
+        out.push({ rule: 'readme-first', severity: sev, detail: `${p.name}: version bumped but its README.md is untouched in this change — README-first: document the change (or consciously proceed; this warning is the record)` });
+      }
+    }
+    return out;
+  },
+  'store-bloat-cap': (f, sev) => {
+    const s = f.store;
+    if (!s || !Number.isFinite(s.count) || !Number.isFinite(s.cap) || s.cap <= 0) return [];
+    return s.count <= s.cap ? [] : [{ rule: 'store-bloat-cap', severity: sev, detail: `learned store has ${s.count} patterns, over the cap of ${s.cap} — run dz consolidate --prune-noise` }];
+  },
+};
+
+/** Merge a user config over the defaults: override severity, disable (enabled:false), never add an un-checked rule. */
+export function resolveRules(userRules?: readonly Partial<GuardRule>[]): GuardRule[] {
+  const byId = new Map<string, GuardRule>(DEFAULT_RULES.map((r) => [r.id, r]));
+  for (const u of Array.isArray(userRules) ? userRules : []) {
+    if (!u || typeof u.id !== 'string') continue;
+    const base = byId.get(u.id);
+    if (!base) continue; // a config rule with no built-in checker is ignored (fail-safe: no un-enforceable rules)
+    byId.set(u.id, {
+      ...base,
+      ...(u.severity === 'hard' || u.severity === 'soft' ? { severity: u.severity } : {}),
+      ...(typeof u.enabled === 'boolean' ? { enabled: u.enabled } : {}),
+    });
+  }
+  return [...byId.values()];
+}
+
+/**
+ * Evaluate the guard for one operation over injected facts. Fail-safe: a checker that throws is caught and
+ * DEMOTED to a HARD violation (a rule that cannot decide must not silently pass). Verdict: any hard violation
+ * ⇒ block; else any soft ⇒ warn; else pass.
+ */
+export function evaluateGuard(facts: GuardFacts, rules: readonly GuardRule[] = DEFAULT_RULES): GuardResult {
+  const op = facts.op;
+  // Type-guarded filter: hostile rule entries (null, ops not an array, missing id) are DROPPED here rather
+  // than throwing mid-filter — the never-throws contract holds against a malformed rules array too.
+  const active = (Array.isArray(rules) ? rules : []).filter(
+    (r): r is GuardRule => !!r && typeof r === 'object' && typeof r.id === 'string' && r.enabled !== false && Array.isArray(r.ops) && r.ops.includes(op),
+  );
+  const violations: Violation[] = [];
+  const checked: string[] = [];
+  for (const r of active) {
+    checked.push(r.id);
+    const checker = CHECKERS[r.id];
+    if (!checker) {
+      // A rule the caller asked for that has no checker CANNOT silently pass while reporting as checked —
+      // that is the smuggled-rule hole. Fail closed: unenforceable ⇒ a HARD violation.
+      violations.push({ rule: r.id, severity: 'hard', detail: 'no built-in checker for this rule — cannot enforce (fail-closed)' });
+      continue;
+    }
+    try {
+      violations.push(...checker(facts, r.severity));
+    } catch (e) {
+      // `e` may be ANYTHING (throw null / throw 'str') — format it without touching .message on a non-Error.
+      violations.push({ rule: r.id, severity: 'hard', detail: `rule check errored (fail-closed): ${e instanceof Error ? e.message : String(e)}` });
+    }
+  }
+  const verdict: GuardVerdict = violations.some((v) => v.severity === 'hard') ? 'block' : violations.length > 0 ? 'warn' : 'pass';
+  return { op, verdict, violations, checked };
+}
+
+/** An append-only audit record. `ts` is injected by the caller (no wall-clock here → deterministic tests). */
+export interface GuardAuditRecord {
+  readonly ts: string;
+  readonly op: GuardOp;
+  readonly verdict: GuardVerdict;
+  readonly violations: readonly Violation[];
+  /** set when the operator overrode a block with `--force <reason>` — the override is logged, never silent. */
+  readonly override?: { readonly forced: true; readonly reason: string };
+}
+
+/** Build the audit record for a guard evaluation (+ an optional forced-override reason). Pure. */
+export function auditRecord(result: GuardResult, ts: string, override?: { reason: string }): GuardAuditRecord {
+  return {
+    ts,
+    op: result.op,
+    verdict: result.verdict,
+    violations: result.violations,
+    ...(override && typeof override.reason === 'string' ? { override: { forced: true, reason: override.reason } } : {}),
+  };
+}
+
+/** The exit-code contract: a block is non-zero unless forced; a warn/pass is zero. */
+export function guardExitCode(result: GuardResult, forced: boolean): number {
+  return result.verdict === 'block' && !forced ? 1 : 0;
+}

package/src/index.ts

@@ -272,3 +272,4 @@ export * from './challenge-panel.js';
 export * from './routing-outcomes.js';
 export * from './bto-optimize.js';
 export * from './discrimination-gate.js';
+export * from './guard.js';