@eddacraft/anvil-runtime 0.1.0

package/dist/gate/checks/coverage.check.js

@@ -0,0 +1,81 @@
+import { BaseCheck } from '../check.interface.js';
+import { createDebugger } from '@eddacraft/anvil-core';
+import { readFileSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+const log = createDebugger('check');
+export class CoverageCheck extends BaseCheck {
+    name = 'coverage';
+    description = 'Check test coverage thresholds';
+    async run(context) {
+        log(`coverage check starting, workspace=${context.workspace_root}`);
+        try {
+            const coveragePath = join(context.workspace_root, 'coverage', 'coverage-summary.json');
+            if (!existsSync(coveragePath)) {
+                log(`coverage check: coverage report not found at ${coveragePath}`);
+                return this.createFailure('Coverage report not found', 'Run tests with coverage first');
+            }
+            const coverageData = JSON.parse(readFileSync(coveragePath, 'utf-8'));
+            const defaultThresholds = {
+                lines: 80,
+                functions: 80,
+                branches: 80,
+                statements: 80,
+            };
+            const thresholds = typeof context.check_config.thresholds === 'object' &&
+                context.check_config.thresholds !== null
+                ? context.check_config.thresholds
+                : defaultThresholds;
+            log('coverage check: thresholds', { thresholds });
+            const results = this.analyzeCoverage(coverageData, thresholds);
+            const overallScore = results.overall;
+            const minScore = typeof context.check_config.min_score === 'number' ? context.check_config.min_score : 80;
+            const passed = overallScore >= minScore;
+            log('coverage check result', {
+                passed,
+                overall: overallScore,
+                minScore,
+                failedChecks: results.failed_checks,
+            });
+            const message = passed
+                ? `Coverage passed: ${overallScore.toFixed(1)}% overall`
+                : `Coverage failed: ${overallScore.toFixed(1)}% overall (required: ${minScore}%)`;
+            return this.createResult(passed, message, overallScore, results);
+        }
+        catch (error) {
+            log(`coverage check error: ${error instanceof Error ? error.message : 'Unknown error'}`);
+            return this.createFailure('Coverage check failed', error instanceof Error ? error.message : 'Unknown error');
+        }
+    }
+    analyzeCoverage(coverageData, thresholds) {
+        const totals = coverageData.total;
+        const results = {
+            overall: 0,
+            details: {},
+            passed: true,
+            failed_checks: [],
+        };
+        // Calculate overall coverage as average of all metrics
+        const metrics = ['lines', 'functions', 'branches', 'statements'];
+        let totalCoverage = 0;
+        let validMetrics = 0;
+        for (const metric of metrics) {
+            if (totals[metric]) {
+                const coverage = totals[metric].pct;
+                const threshold = thresholds[metric] || 0;
+                results.details[metric] = {
+                    coverage,
+                    threshold,
+                    passed: coverage >= threshold,
+                };
+                totalCoverage += coverage;
+                validMetrics++;
+                if (coverage < threshold) {
+                    results.passed = false;
+                    results.failed_checks.push(`${metric}: ${coverage}% < ${threshold}%`);
+                }
+            }
+        }
+        results.overall = validMetrics > 0 ? totalCoverage / validMetrics : 0;
+        return results;
+    }
+}

package/dist/gate/checks/dependency.check.d.ts

@@ -0,0 +1,17 @@
+import { BaseCheck } from '../check.interface.js';
+import { CheckContext, GateResult } from '../../types/gate.types.js';
+export declare class DependencyCheck extends BaseCheck {
+    name: string;
+    description: string;
+    run(context: CheckContext): Promise<GateResult>;
+    private detectPackageManager;
+    private runAudit;
+    private normaliseAuditOutput;
+    private isNpmV7Format;
+    private normalisePnpmAudit;
+    private normaliseNpmV7Audit;
+    private normaliseYarnAudit;
+    private calculateScore;
+    private generateFixSuggestions;
+}
+//# sourceMappingURL=dependency.check.d.ts.map

package/dist/gate/checks/dependency.check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependency.check.d.ts","sourceRoot":"","sources":["../../../src/gate/checks/dependency.check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AA2JrE,qBAAa,eAAgB,SAAQ,SAAS;IAC5C,IAAI,SAAgB;IACpB,WAAW,SAAmE;IAExE,GAAG,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC;IA8HrD,OAAO,CAAC,oBAAoB;YAad,QAAQ;IAkDtB,OAAO,CAAC,oBAAoB;IAiB5B,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,kBAAkB;IAc1B,OAAO,CAAC,mBAAmB;IAyC3B,OAAO,CAAC,kBAAkB;IAyC1B,OAAO,CAAC,cAAc;IAWtB,OAAO,CAAC,sBAAsB;CAyC/B"}

package/dist/gate/checks/dependency.check.js

@@ -0,0 +1,342 @@
+import { BaseCheck } from '../check.interface.js';
+import { createDebugger } from '@eddacraft/anvil-core';
+import { exec } from 'node:child_process';
+import { promisify } from 'node:util';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { z } from 'zod';
+const log = createDebugger('check');
+const execAsync = promisify(exec);
+const YarnAdvisoryDataSchema = z.object({
+    id: z.number(),
+    title: z.string(),
+    module_name: z.string(),
+    severity: z.enum(['info', 'low', 'moderate', 'high', 'critical']),
+    url: z.string(),
+    cves: z.array(z.string()),
+    vulnerable_versions: z.string(),
+    patched_versions: z.string(),
+    recommendation: z.string(),
+    findings: z.array(z.object({ version: z.string(), paths: z.array(z.string()) })),
+});
+const YarnClassicAdvisorySchema = z.object({
+    type: z.literal('auditAdvisory'),
+    data: z.object({
+        advisory: YarnAdvisoryDataSchema,
+    }),
+});
+const YarnClassicSummarySchema = z.object({
+    type: z.literal('auditSummary'),
+    data: z.object({
+        vulnerabilities: z.object({
+            info: z.number(),
+            low: z.number(),
+            moderate: z.number(),
+            high: z.number(),
+            critical: z.number(),
+            total: z.number(),
+        }),
+    }),
+});
+const YarnAuditLineSchema = z.union([YarnClassicAdvisorySchema, YarnClassicSummarySchema]);
+const SEVERITY_SCORES = {
+    critical: 100,
+    high: 75,
+    moderate: 50,
+    low: 25,
+    info: 10,
+};
+const SEVERITY_ORDER = ['critical', 'high', 'moderate', 'low', 'info'];
+const VULNERABILITY_SCORE_PENALTIES = {
+    critical: 20,
+    high: 10,
+    moderate: 5,
+    low: 2,
+};
+export class DependencyCheck extends BaseCheck {
+    name = 'dependency';
+    description = 'Scan for dependency vulnerabilities using npm/yarn/pnpm audit';
+    async run(context) {
+        log(`dependency check starting, workspace=${context.workspace_root}`);
+        try {
+            // Check if package.json exists
+            const packageJsonPath = join(context.workspace_root, 'package.json');
+            if (!existsSync(packageJsonPath)) {
+                log('dependency check: no package.json found, skipping');
+                return this.createSuccess('No package.json found, skipping dependency check', 100);
+            }
+            // Detect package manager
+            const packageManager = this.detectPackageManager(context.workspace_root);
+            if (!packageManager) {
+                log('dependency check: no lock file found, skipping');
+                return this.createSuccess('No lock file found, skipping dependency check', 100);
+            }
+            log(`dependency check: detected package manager=${packageManager}`);
+            // Determine severity threshold from config (default: moderate)
+            const minSeverity = context.check_config.min_severity || 'moderate';
+            const severityIndex = SEVERITY_ORDER.indexOf(minSeverity);
+            // Run audit with detected package manager
+            const auditResult = await this.runAudit(context.workspace_root, packageManager);
+            if (!auditResult) {
+                log('dependency check: no vulnerabilities found');
+                return this.createSuccess('No vulnerabilities found', 100);
+            }
+            const advisories = Object.values(auditResult.advisories);
+            const metadata = auditResult.metadata.vulnerabilities;
+            log('dependency check: found advisories', {
+                count: advisories.length,
+                total: metadata.total,
+                critical: metadata.critical,
+                high: metadata.high,
+                moderate: metadata.moderate,
+                low: metadata.low,
+            });
+            // Filter vulnerabilities by severity threshold
+            const relevantVulns = advisories.filter((advisory) => {
+                const vulnSeverityIndex = SEVERITY_ORDER.indexOf(advisory.severity);
+                return vulnSeverityIndex <= severityIndex;
+            });
+            // Sort by severity (critical first)
+            relevantVulns.sort((a, b) => {
+                const aScore = SEVERITY_SCORES[a.severity];
+                const bScore = SEVERITY_SCORES[b.severity];
+                return bScore - aScore;
+            });
+            // Calculate score based on vulnerabilities
+            const criticalCount = metadata.critical;
+            const highCount = metadata.high;
+            const moderateCount = metadata.moderate;
+            const lowCount = metadata.low;
+            const score = this.calculateScore(criticalCount, highCount, moderateCount, lowCount);
+            // Determine if check passed
+            const failOnCritical = context.check_config.fail_on_critical !== false;
+            const failOnHigh = context.check_config.fail_on_high !== false;
+            const failOnModerate = context.check_config.fail_on_moderate === true;
+            const hasCritical = criticalCount > 0;
+            const hasHigh = highCount > 0;
+            const hasModerate = moderateCount > 0;
+            const passed = !(failOnCritical && hasCritical) &&
+                !(failOnHigh && hasHigh) &&
+                !(failOnModerate && hasModerate);
+            log(`dependency check result: passed=${passed}, score=${score}, relevant=${relevantVulns.length}, minSeverity=${minSeverity}`);
+            const totalRelevant = relevantVulns.length;
+            const message = passed
+                ? `Dependency check passed: ${metadata.total} vulnerabilities found (${criticalCount} critical, ${highCount} high, ${moderateCount} moderate, ${lowCount} low)`
+                : `Dependency check failed: ${totalRelevant} vulnerabilities exceed threshold (${criticalCount} critical, ${highCount} high, ${moderateCount} moderate)`;
+            // Generate fix suggestions
+            const fixSuggestions = this.generateFixSuggestions(relevantVulns, packageManager);
+            return this.createResult(passed, message, score, {
+                total: metadata.total,
+                critical: criticalCount,
+                high: highCount,
+                moderate: moderateCount,
+                low: lowCount,
+                info: metadata.info,
+                packageManager,
+                vulnerabilities: relevantVulns.map((adv) => ({
+                    id: adv.id,
+                    title: adv.title,
+                    severity: adv.severity,
+                    module: adv.module_name,
+                    cves: adv.cves,
+                    url: adv.url,
+                    vulnerableVersions: adv.vulnerable_versions,
+                    patchedVersions: adv.patched_versions,
+                    recommendation: adv.recommendation,
+                })),
+                fixSuggestions,
+            });
+        }
+        catch (error) {
+            // If audit command fails, it might be due to no vulnerabilities or command error
+            const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+            log(`dependency check error: ${errorMessage}`);
+            // pnpm audit exits with code 1 if vulnerabilities are found
+            // Check if it's a legitimate error or just vulnerabilities found
+            if (errorMessage.includes('EAUDITNOLOCK')) {
+                return this.createSuccess('No lock file found, skipping dependency check', 100);
+            }
+            return this.createFailure('Dependency check failed', errorMessage);
+        }
+    }
+    detectPackageManager(workspaceRoot) {
+        if (existsSync(join(workspaceRoot, 'pnpm-lock.yaml'))) {
+            return 'pnpm';
+        }
+        if (existsSync(join(workspaceRoot, 'yarn.lock'))) {
+            return 'yarn';
+        }
+        if (existsSync(join(workspaceRoot, 'package-lock.json'))) {
+            return 'npm';
+        }
+        return null;
+    }
+    async runAudit(workspaceRoot, packageManager) {
+        const auditCommand = `${packageManager} audit --json`;
+        try {
+            const { stdout } = await execAsync(auditCommand, {
+                cwd: workspaceRoot,
+                maxBuffer: 10 * 1024 * 1024,
+                timeout: 120_000,
+            });
+            return this.normaliseAuditOutput(stdout, packageManager);
+        }
+        catch (error) {
+            if (error && typeof error === 'object' && 'stdout' in error) {
+                const stdout = error.stdout;
+                if (stdout) {
+                    try {
+                        return this.normaliseAuditOutput(stdout, packageManager);
+                    }
+                    catch (parseError) {
+                        console.error(`[DependencyCheck] Failed to parse ${packageManager} audit output:`, parseError);
+                        return null;
+                    }
+                }
+            }
+            if (error &&
+                typeof error === 'object' &&
+                'stderr' in error &&
+                typeof error.stderr === 'string') {
+                const stderr = error.stderr;
+                if (stderr.includes('No known vulnerabilities found') ||
+                    stderr.includes('0 vulnerabilities') ||
+                    stderr.includes('found 0 vulnerabilities')) {
+                    return null;
+                }
+            }
+            throw error;
+        }
+    }
+    normaliseAuditOutput(stdout, packageManager) {
+        if (packageManager === 'yarn') {
+            return this.normaliseYarnAudit(stdout);
+        }
+        const parsed = JSON.parse(stdout);
+        if (packageManager === 'npm' && this.isNpmV7Format(parsed)) {
+            return this.normaliseNpmV7Audit(parsed);
+        }
+        return this.normalisePnpmAudit(parsed);
+    }
+    isNpmV7Format(parsed) {
+        return (typeof parsed === 'object' &&
+            parsed !== null &&
+            'auditReportVersion' in parsed &&
+            parsed.auditReportVersion >= 2);
+    }
+    normalisePnpmAudit(parsed) {
+        if (!parsed.advisories || !parsed.metadata?.vulnerabilities) {
+            return null;
+        }
+        return {
+            advisories: parsed.advisories,
+            metadata: { vulnerabilities: parsed.metadata.vulnerabilities },
+        };
+    }
+    normaliseNpmV7Audit(parsed) {
+        if (!parsed.vulnerabilities || !parsed.metadata?.vulnerabilities) {
+            return null;
+        }
+        const advisories = {};
+        let idCounter = 1;
+        for (const [moduleName, vuln] of Object.entries(parsed.vulnerabilities)) {
+            const viaDetails = vuln.via.find((v) => typeof v === 'object' && v !== null);
+            advisories[String(idCounter)] = {
+                id: idCounter,
+                title: viaDetails?.title || `Vulnerability in ${moduleName}`,
+                severity: vuln.severity,
+                url: viaDetails?.url || '',
+                cves: viaDetails?.cwe || [],
+                module_name: moduleName,
+                vulnerable_versions: vuln.range,
+                patched_versions: typeof vuln.fixAvailable === 'object' ? `>=${vuln.fixAvailable.version}` : '',
+                recommendation: typeof vuln.fixAvailable === 'object'
+                    ? `Update to ${vuln.fixAvailable.name}@${vuln.fixAvailable.version}`
+                    : vuln.fixAvailable
+                        ? 'Run npm audit fix'
+                        : 'No fix available',
+                findings: vuln.nodes.map((node) => ({ version: vuln.range, paths: [node] })),
+            };
+            idCounter++;
+        }
+        return {
+            advisories,
+            metadata: { vulnerabilities: parsed.metadata.vulnerabilities },
+        };
+    }
+    normaliseYarnAudit(stdout) {
+        const lines = stdout.trim().split('\n');
+        const advisories = {};
+        let metadata = {
+            info: 0,
+            low: 0,
+            moderate: 0,
+            high: 0,
+            critical: 0,
+            total: 0,
+        };
+        for (const line of lines) {
+            if (!line.trim())
+                continue;
+            try {
+                const parseResult = YarnAuditLineSchema.safeParse(JSON.parse(line));
+                if (!parseResult.success) {
+                    continue;
+                }
+                const parsed = parseResult.data;
+                if (parsed.type === 'auditAdvisory') {
+                    const advisory = parsed.data.advisory;
+                    advisories[String(advisory.id)] = advisory;
+                }
+                else if (parsed.type === 'auditSummary') {
+                    metadata = parsed.data.vulnerabilities;
+                }
+            }
+            catch (parseError) {
+                console.error('[DependencyCheck] Failed to parse Yarn audit line:', parseError);
+                continue;
+            }
+        }
+        if (Object.keys(advisories).length === 0 && metadata.total === 0) {
+            return null;
+        }
+        return { advisories, metadata: { vulnerabilities: metadata } };
+    }
+    calculateScore(critical, high, moderate, low) {
+        let score = 100;
+        score -= critical * VULNERABILITY_SCORE_PENALTIES.critical;
+        score -= high * VULNERABILITY_SCORE_PENALTIES.high;
+        score -= moderate * VULNERABILITY_SCORE_PENALTIES.moderate;
+        score -= low * VULNERABILITY_SCORE_PENALTIES.low;
+        return Math.max(0, score);
+    }
+    generateFixSuggestions(vulnerabilities, packageManager) {
+        const suggestions = [];
+        // Group by module
+        const moduleMap = new Map();
+        for (const vuln of vulnerabilities) {
+            const existing = moduleMap.get(vuln.module_name) || [];
+            existing.push(vuln);
+            moduleMap.set(vuln.module_name, existing);
+        }
+        // Generate suggestions for each module
+        for (const [module, vulns] of Array.from(moduleMap.entries())) {
+            const highestSeverity = vulns[0].severity; // Already sorted by severity
+            const patchedVersions = vulns[0].patched_versions;
+            if (patchedVersions && patchedVersions !== '<0.0.0') {
+                suggestions.push(`Update ${module} to ${patchedVersions} (fixes ${vulns.length} ${highestSeverity} vulnerability(ies))`);
+            }
+            else {
+                suggestions.push(`Review ${module}: No patch available for ${vulns.length} ${highestSeverity} vulnerability(ies)`);
+            }
+        }
+        // Add package manager-specific fix command
+        if (suggestions.length > 0) {
+            const fixCommand = packageManager === 'yarn'
+                ? `${packageManager} audit fix` // yarn uses 'audit fix'
+                : `${packageManager} audit fix`; // npm and pnpm both use 'audit fix'
+            suggestions.push(`Run \`${fixCommand}\` to automatically apply available patches`);
+        }
+        return suggestions;
+    }
+}

package/dist/gate/checks/eslint.check.d.ts

@@ -0,0 +1,14 @@
+import { BaseCheck } from '../check.interface.js';
+import { CheckContext, GateResult } from '../../types/gate.types.js';
+export declare class ESLintCheck extends BaseCheck {
+    name: string;
+    description: string;
+    run(context: CheckContext): Promise<GateResult>;
+    private getFilesFromPlan;
+    private isLintableFile;
+    /**
+     * Get all lintable files for full codebase scan
+     */
+    private getFilesForFullScan;
+}
+//# sourceMappingURL=eslint.check.d.ts.map

package/dist/gate/checks/eslint.check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eslint.check.d.ts","sourceRoot":"","sources":["../../../src/gate/checks/eslint.check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAuB,MAAM,2BAA2B,CAAC;AAM1F,qBAAa,WAAY,SAAQ,SAAS;IACxC,IAAI,SAAY;IAChB,WAAW,SAAoC;IAEzC,GAAG,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC;IAqErD,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,cAAc;IAKtB;;OAEG;YACW,mBAAmB;CAKlC"}

package/dist/gate/checks/eslint.check.js

@@ -0,0 +1,79 @@
+import { BaseCheck } from '../check.interface.js';
+import { getFilesFromContext } from '../../types/gate.types.js';
+import { createDebugger } from '@eddacraft/anvil-core';
+import { ESLint } from 'eslint';
+const log = createDebugger('check');
+export class ESLintCheck extends BaseCheck {
+    name = 'eslint';
+    description = 'Run ESLint code quality checks';
+    async run(context) {
+        log(`eslint check starting, workspace=${context.workspace_root}, fullScan=${context.fullScan}`);
+        try {
+            const eslint = new ESLint({
+                cwd: context.workspace_root,
+            });
+            // Get files to lint - either from plan or full codebase scan
+            const files = context.fullScan
+                ? await this.getFilesForFullScan(context.workspace_root)
+                : this.getFilesFromPlan(context);
+            if (files.length === 0) {
+                log('eslint check: no lintable files found');
+                return this.createSuccess('No files to lint', 100);
+            }
+            log(`eslint check: linting ${files.length} file(s)`);
+            const results = await eslint.lintFiles(files);
+            const errorCount = results.reduce((acc, result) => acc + result.errorCount, 0);
+            const warningCount = results.reduce((acc, result) => acc + result.warningCount, 0);
+            const fixableCount = results.reduce((acc, result) => acc + result.fixableErrorCount + result.fixableWarningCount, 0);
+            const totalIssues = errorCount + warningCount;
+            const score = totalIssues === 0 ? 100 : Math.max(0, 100 - (errorCount * 10 + warningCount * 2));
+            const minScore = typeof context.check_config.min_score === 'number' ? context.check_config.min_score : 80;
+            const passed = errorCount === 0 && score >= minScore;
+            log('eslint check result', {
+                passed,
+                score,
+                errors: errorCount,
+                warnings: warningCount,
+                fixable: fixableCount,
+                filesLinted: results.length,
+            });
+            const message = passed
+                ? `ESLint passed: ${errorCount} errors, ${warningCount} warnings`
+                : `ESLint failed: ${errorCount} errors, ${warningCount} warnings`;
+            return this.createResult(passed, message, score, {
+                errorCount,
+                warningCount,
+                fixableCount,
+                results: results.map((r) => ({
+                    filePath: r.filePath,
+                    errorCount: r.errorCount,
+                    warningCount: r.warningCount,
+                    messages: r.messages,
+                })),
+            });
+        }
+        catch (error) {
+            log(`eslint check error: ${error instanceof Error ? error.message : 'Unknown error'}`);
+            return this.createFailure('ESLint check failed', error instanceof Error ? error.message : 'Unknown error');
+        }
+    }
+    getFilesFromPlan(context) {
+        // Use unified helper for both planless and plan-based modes
+        // This ensures consistent path normalisation and existence checking
+        return getFilesFromContext(context, {
+            filter: (f) => this.isLintableFile(f),
+        });
+    }
+    isLintableFile(filePath) {
+        const lintableExtensions = ['.js', '.ts', '.jsx', '.tsx', '.mjs', '.cjs'];
+        return lintableExtensions.some((ext) => filePath.endsWith(ext));
+    }
+    /**
+     * Get all lintable files for full codebase scan
+     */
+    async getFilesForFullScan(workspaceRoot) {
+        // Use ESLint's file resolution - pass the workspace root
+        // ESLint will use its own config to determine which files to lint
+        return [workspaceRoot];
+    }
+}

package/dist/gate/checks/policy.check.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Policy Check - Evaluate OPA/Rego policies against plans
+ */
+import { BaseCheck } from '../check.interface.js';
+import { CheckContext, GateResult } from '../../types/gate.types.js';
+/**
+ * Configuration for policy check
+ */
+export interface PolicyCheckConfig {
+    /** Policy directory relative to workspace root */
+    policy_dir?: string;
+    /** Minimum severity to fail the check */
+    severity_threshold?: 'error' | 'warning' | 'info';
+    /** Policies to enable (if empty, all are enabled) */
+    enabled_policies?: string[];
+    /** Policies to disable */
+    disabled_policies?: string[];
+    /** Custom query (default: data.anvil.policies) */
+    query?: string;
+    /** Timeout in milliseconds */
+    timeout?: number;
+    /** Require policy tests to pass before evaluating policies */
+    require_policy_tests?: boolean;
+    /** Include git context in OPA input for repository-aware policies */
+    include_git_context?: boolean;
+}
+/**
+ * Policy check that evaluates OPA/Rego policies against plans
+ */
+export declare class PolicyCheck extends BaseCheck {
+    name: string;
+    description: string;
+    private policyLoader;
+    constructor();
+    run(context: CheckContext): Promise<GateResult>;
+    /**
+     * Parse and validate check configuration
+     */
+    private parseConfig;
+    /**
+     * Build OPA input from check context
+     */
+    private buildOPAInput;
+    /**
+     * Bridges ArchitectureCheck output to PolicyCheck OPA input.
+     * Enables Rego policies to query architecture context via input.architecture
+     */
+    private buildArchitectureInput;
+    /**
+     * Get git context for repository-aware policies
+     */
+    private getGitContext;
+    /**
+     * Get CI context from environment variables
+     */
+    private getCIContext;
+    /**
+     * Extract PR number from GitHub ref (e.g., refs/pull/123/merge)
+     */
+    private extractPRNumber;
+    /**
+     * Run policy tests and return results
+     */
+    private runPolicyTests;
+    /**
+     * Calculate score based on violations
+     */
+    private calculateScore;
+    /**
+     * Check if a severity level should block the check
+     */
+    private isBlockingSeverity;
+    /**
+     * Build human-readable message
+     */
+    private buildMessage;
+}
+//# sourceMappingURL=policy.check.d.ts.map

package/dist/gate/checks/policy.check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.check.d.ts","sourceRoot":"","sources":["../../../src/gate/checks/policy.check.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAarE;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,kDAAkD;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,kBAAkB,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IAClD,qDAAqD;IACrD,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,0BAA0B;IAC1B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8BAA8B;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8DAA8D;IAC9D,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,qEAAqE;IACrE,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAgBD;;GAEG;AACH,qBAAa,WAAY,SAAQ,SAAS;IACxC,IAAI,SAAY;IAChB,WAAW,SAA8C;IAEzD,OAAO,CAAC,YAAY,CAAe;;IAO7B,GAAG,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC;IA4IrD;;OAEG;IACH,OAAO,CAAC,WAAW;IAuBnB;;OAEG;IACH,OAAO,CAAC,aAAa;IA8DrB;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IA+C9B;;OAEG;IACH,OAAO,CAAC,aAAa;IAyDrB;;OAEG;IACH,OAAO,CAAC,YAAY;IA+CpB;;OAEG;IACH,OAAO,CAAC,eAAe;IAMvB;;OAEG;YACW,cAAc;IAmC5B;;OAEG;IACH,OAAO,CAAC,cAAc;IAsCtB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAQ1B;;OAEG;IACH,OAAO,CAAC,YAAY;CAqBrB"}