@fantasticit/sumi 0.0.0-stage → 0.5.0

package/node_modules/@sumi/plugins-governance/dist/index.js

@@ -0,0 +1,5 @@
+export * from './state.js';
+export * from './protected.js';
+export * from './semantic.js';
+export * from './guard.js';
+//# sourceMappingURL=index.js.map

package/node_modules/@sumi/plugins-governance/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC"}

package/node_modules/@sumi/plugins-governance/dist/plugins/protected-paths.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@sumi/plugins-governance/dist/plugins/protected-paths.js

@@ -0,0 +1,31 @@
+import { definePlugin, gitPaths, result } from '@sumi/plugin-sdk';
+import { configAt, protectedMatcher } from '../protected.js';
+/** 受保护路径：列出本次改动中的 control 变更（按基准与当前两边声明的并集），提醒推送前需要人工确认。 */
+await definePlugin((ctx) => {
+    const isProtected = protectedMatcher(configAt(ctx.repoRoot, ctx.base), configAt(ctx.repoRoot, null));
+    // 全量运行时 ctx.files 是全仓文件，这里只关心相对基准真正变化的文件。
+    const files = ctx.all && ctx.base
+        ? [
+            ...new Set([
+                ...gitPaths(ctx.repoRoot, ['diff', '--name-only', ctx.base]),
+                ...gitPaths(ctx.repoRoot, ['ls-files', '--others', '--exclude-standard']),
+            ]),
+        ].filter(Boolean)
+        : ctx.files;
+    const changed = files.filter((f) => isProtected(f));
+    // 只列出前几个文件，避免简报被大量 info 淹没；完整列表见 checked。
+    const findings = changed.slice(0, 5).map((file, i) => ({
+        id: `F${i + 1}`,
+        rule: 'control-change',
+        severity: 'info',
+        message: 'control 变更，推送前需要人工确认',
+        file,
+    }));
+    return result({
+        status: 'pass',
+        summary: changed.length ? `control 变更 ${changed.length} 个文件，推送前需要人工确认` : '没有 control 变更',
+        findings,
+        checked: files,
+    });
+});
+//# sourceMappingURL=protected-paths.js.map

package/node_modules/@sumi/plugins-governance/dist/plugins/protected-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protected-paths.js","sourceRoot":"","sources":["../../src/plugins/protected-paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAgB,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAE7D,4DAA4D;AAC5D,MAAM,YAAY,CAAC,CAAC,GAAG,EAAE,EAAE;IACzB,MAAM,WAAW,GAAG,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IACrG,0CAA0C;IAC1C,MAAM,KAAK,GACT,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI;QACjB,CAAC,CAAC;YACE,GAAG,IAAI,GAAG,CAAC;gBACT,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC5D,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,oBAAoB,CAAC,CAAC;aAC1E,CAAC;SACH,CAAC,MAAM,CAAC,OAAO,CAAC;QACnB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;IAChB,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,0CAA0C;IAC1C,MAAM,QAAQ,GAAc,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAChE,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE;QACf,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,sBAAsB;QAC/B,IAAI;KACL,CAAC,CAAC,CAAC;IACJ,OAAO,MAAM,CAAC;QACZ,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,OAAO,CAAC,MAAM,gBAAgB,CAAC,CAAC,CAAC,eAAe;QACxF,QAAQ;QACR,OAAO,EAAE,KAAK;KACf,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/node_modules/@sumi/plugins-governance/dist/pr-base.d.ts

@@ -0,0 +1,19 @@
+export interface PrBaseView {
+    headRefOid: string;
+    baseRefOid: string;
+    baseRefName: string;
+    url: string;
+}
+export interface GitResult {
+    status: number | null;
+    stdout: string;
+    stderr: string;
+}
+export type GitRunner = (args: string[]) => GitResult;
+/** PR URL 指向 base repository；从中构造无需依赖本地 remote 名称的 Git URL。 */
+export declare function baseRepositoryGitUrl(prUrl: string): string;
+/**
+ * 以 GitHub PR 返回的精确 base head 计算合并基础。缺对象时只补取 PR 基仓库的目标分支，
+ * 不读取或更新 origin/<base>，避免 fork remote 与陈旧 tracking ref 扭曲检查范围。
+ */
+export declare function resolvePrBase(view: PrBaseView, run: GitRunner): string;

package/node_modules/@sumi/plugins-governance/dist/pr-base.js

@@ -0,0 +1,49 @@
+const oid = (value, label) => {
+    if (!/^[0-9a-f]{40,64}$/.test(value))
+        throw new Error(`GitHub 返回的 ${label} OID 无效：${value || '（空）'}`);
+    return value;
+};
+/** PR URL 指向 base repository；从中构造无需依赖本地 remote 名称的 Git URL。 */
+export function baseRepositoryGitUrl(prUrl) {
+    let parsed;
+    try {
+        parsed = new URL(prUrl);
+    }
+    catch {
+        throw new Error(`无法从 PR 地址确定基仓库：${prUrl}`);
+    }
+    const match = /^\/([^/]+)\/([^/]+)\/pull\/\d+\/?$/.exec(parsed.pathname);
+    if (!match)
+        throw new Error(`无法从 PR 地址确定基仓库：${prUrl}`);
+    const owner = encodeURIComponent(decodeURIComponent(match[1]));
+    const repo = encodeURIComponent(decodeURIComponent(match[2].replace(/\.git$/, '')));
+    return `${parsed.origin}/${owner}/${repo}.git`;
+}
+const hasCommit = (run, value) => run(['cat-file', '-e', `${value}^{commit}`]).status === 0;
+/**
+ * 以 GitHub PR 返回的精确 base head 计算合并基础。缺对象时只补取 PR 基仓库的目标分支，
+ * 不读取或更新 origin/<base>，避免 fork remote 与陈旧 tracking ref 扭曲检查范围。
+ */
+export function resolvePrBase(view, run) {
+    const head = oid(view.headRefOid, 'PR head');
+    const target = oid(view.baseRefOid, 'PR base head');
+    if (!view.baseRefName || view.baseRefName.startsWith('-'))
+        throw new Error(`GitHub 返回的目标分支名称无效：${view.baseRefName || '（空）'}`);
+    if (!hasCommit(run, target)) {
+        const repository = baseRepositoryGitUrl(view.url);
+        const fetched = run(['fetch', '--no-tags', repository, `refs/heads/${view.baseRefName}`]);
+        if (fetched.status !== 0) {
+            const detail = fetched.stderr.trim().split('\n')[0];
+            throw new Error(`无法从 PR 基仓库补取 ${view.baseRefName}${detail ? `：${detail}` : ''}`);
+        }
+        if (!hasCommit(run, target)) {
+            throw new Error(`补取后仍缺少 GitHub 返回的目标提交 ${target.slice(0, 8)}；目标分支可能已变化，请重新运行`);
+        }
+    }
+    const merged = run(['merge-base', target, head]);
+    const base = merged.status === 0 ? merged.stdout.trim() : '';
+    if (!base)
+        throw new Error(`PR 头提交与 GitHub 目标分支 ${view.baseRefName}（${target.slice(0, 8)}）没有共同祖先`);
+    return base;
+}
+//# sourceMappingURL=pr-base.js.map

package/node_modules/@sumi/plugins-governance/dist/pr-base.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pr-base.js","sourceRoot":"","sources":["../src/pr-base.ts"],"names":[],"mappings":"AAeA,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,KAAa,EAAU,EAAE;IACnD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,cAAc,KAAK,WAAW,KAAK,IAAI,KAAK,EAAE,CAAC,CAAC;IACtG,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,+DAA+D;AAC/D,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,KAAK,GAAG,oCAAoC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,kBAAkB,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,kBAAkB,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACrF,OAAO,GAAG,MAAM,CAAC,MAAM,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC;AACjD,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,GAAc,EAAE,KAAa,EAAW,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AAExH;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAgB,EAAE,GAAc;IAC5D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,CAAC,WAAW,IAAI,KAAK,EAAE,CAAC,CAAC;IAErE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC1F,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,kBAAkB,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;IACnG,OAAO,IAAI,CAAC;AACd,CAAC"}

package/node_modules/@sumi/plugins-governance/dist/pr-report-markers.d.ts

@@ -0,0 +1,4 @@
+export declare const PR_REPORT_MARKER = "<!-- sumi-pr-report -->";
+export declare function prReportHeadMarker(oid: string): string;
+export declare function prReportHead(body: string): string | null;
+export declare function isPrReport(body: string): boolean;

package/node_modules/@sumi/plugins-governance/dist/pr-report-markers.js

@@ -0,0 +1,11 @@
+export const PR_REPORT_MARKER = '<!-- sumi-pr-report -->';
+export function prReportHeadMarker(oid) {
+    return `<!-- sumi-pr-report-head:${oid} -->`;
+}
+export function prReportHead(body) {
+    return /<!-- sumi-pr-report-head:([0-9a-f]{40}) -->/i.exec(body)?.[1]?.toLowerCase() ?? null;
+}
+export function isPrReport(body) {
+    return body.startsWith(PR_REPORT_MARKER);
+}
+//# sourceMappingURL=pr-report-markers.js.map

package/node_modules/@sumi/plugins-governance/dist/pr-report-markers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pr-report-markers.js","sourceRoot":"","sources":["../src/pr-report-markers.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,gBAAgB,GAAG,yBAAyB,CAAC;AAE1D,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,OAAO,4BAA4B,GAAG,MAAM,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,8CAA8C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,CAAC;AAC/F,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;AAC3C,CAAC"}

package/node_modules/@sumi/plugins-governance/dist/pr-report-status.d.ts

@@ -0,0 +1,14 @@
+export interface CommandResult {
+    status: number | null;
+    stdout: string;
+    stderr: string;
+    error?: Error;
+}
+export type CommandRunner = (command: string, args: string[], cwd: string) => CommandResult;
+export interface PrReportStatus {
+    pass: boolean;
+    message?: string;
+    pr?: number;
+}
+/** 只读核验当前分支开放 PR 的 Sumi 报告是否绑定当前 head。 */
+export declare function checkPrReportStatus(root: string, run?: CommandRunner): PrReportStatus;

package/node_modules/@sumi/plugins-governance/dist/pr-report-status.js

@@ -0,0 +1,97 @@
+import { PROJECT_SUMI, spawnCommandSync } from '@sumi/plugin-sdk';
+import { isPrReport, prReportHead } from './pr-report-markers.js';
+const defaultRunner = (command, args, cwd) => {
+    const result = spawnCommandSync(command, args, { cwd, encoding: 'utf8', windowsHide: true });
+    return {
+        status: result.status,
+        stdout: result.stdout ?? '',
+        stderr: result.stderr ?? '',
+        error: result.error,
+    };
+};
+function detail(result) {
+    return result.error?.message ?? (`${result.stderr}${result.stdout}`.trim() || `退出码 ${result.status ?? '未知'}`);
+}
+function json(result, action) {
+    try {
+        return JSON.parse(result.stdout);
+    }
+    catch {
+        throw new Error(`${action} 返回了无效 JSON`);
+    }
+}
+function block(message, pr) {
+    return { pass: false, message, ...(pr === undefined ? {} : { pr }) };
+}
+/** 只读核验当前分支开放 PR 的 Sumi 报告是否绑定当前 head。 */
+export function checkPrReportStatus(root, run = defaultRunner) {
+    const headResult = run('git', ['rev-parse', '--verify', 'HEAD'], root);
+    if (headResult.status !== 0)
+        return block(`无法读取本地 HEAD：${detail(headResult)}`);
+    const head = headResult.stdout.trim().toLowerCase();
+    const branchResult = run('git', ['symbolic-ref', '--quiet', '--short', 'HEAD'], root);
+    if (branchResult.status !== 0)
+        return block('当前检出处于 detached HEAD，无法可靠判断对应的开放 PR');
+    const branch = branchResult.stdout.trim();
+    const auth = run('gh', ['auth', 'status'], root);
+    if (auth.status !== 0)
+        return block(`无法验证 GitHub 登录状态：${detail(auth)}。请先运行 gh auth login`);
+    const fields = 'number,headRefOid,url,comments,state';
+    let view = run('gh', ['pr', 'view', '--json', fields], root);
+    let pr = null;
+    if (view.status === 0) {
+        try {
+            const candidate = json(view, 'gh pr view');
+            if (candidate.state && candidate.state !== 'OPEN')
+                return { pass: true };
+            pr = candidate;
+        }
+        catch (error) {
+            return block(error.message);
+        }
+    }
+    else {
+        const listed = run('gh', ['pr', 'list', '--state', 'open', '--head', branch, '--json', 'number,headRefOid,url'], root);
+        if (listed.status !== 0)
+            return block(`无法查询当前分支的开放 PR：${detail(listed)}`);
+        let candidates;
+        try {
+            candidates = json(listed, 'gh pr list');
+        }
+        catch (error) {
+            return block(error.message);
+        }
+        if (candidates.length === 0)
+            return { pass: true };
+        if (candidates.length > 1)
+            return block(`分支 ${branch} 对应 ${candidates.length} 个开放 PR，无法唯一判断报告状态`);
+        const candidate = candidates[0];
+        view = run('gh', ['pr', 'view', String(candidate.number), '--json', fields], root);
+        if (view.status !== 0)
+            return block(`无法读取 PR #${candidate.number}：${detail(view)}`, candidate.number);
+        try {
+            pr = json(view, `gh pr view ${candidate.number}`);
+        }
+        catch (error) {
+            return block(error.message, candidate.number);
+        }
+    }
+    if (!pr || !Number.isInteger(pr.number) || !/^[0-9a-f]{40}$/i.test(pr.headRefOid ?? '')) {
+        return block('GitHub 返回的 PR 信息不完整，无法可靠判断报告状态');
+    }
+    const prHead = pr.headRefOid.toLowerCase();
+    if (head !== prHead) {
+        return block(`PR #${pr.number} 的头提交是 ${prHead.slice(0, 8)}，本地 HEAD 是 ${head.slice(0, 8)}。请先推送当前提交或切回 PR 头提交`, pr.number);
+    }
+    const report = (pr.comments ?? []).map((comment) => comment.body ?? '').find(isPrReport);
+    if (!report)
+        return block(`PR #${pr.number} 缺少 Sumi 审查报告。请运行：${PROJECT_SUMI} pr-report ${pr.number}`, pr.number);
+    const reportHead = prReportHead(report);
+    if (!reportHead)
+        return block(`PR #${pr.number} 的 Sumi 报告没有完整 head OID，已过期。请运行：${PROJECT_SUMI} pr-report ${pr.number}`, pr.number);
+    if (reportHead !== prHead) {
+        return block(`PR #${pr.number} 的 Sumi 报告绑定 ${reportHead.slice(0, 8)}，当前 head 为 ${prHead.slice(0, 8)}，报告已过期。请运行：${PROJECT_SUMI} pr-report ${pr.number}`, pr.number);
+    }
+    return { pass: true, pr: pr.number };
+}
+//# sourceMappingURL=pr-report-status.js.map

package/node_modules/@sumi/plugins-governance/dist/pr-report-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pr-report-status.js","sourceRoot":"","sources":["../src/pr-report-status.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAwBlE,MAAM,aAAa,GAAkB,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;IAC1D,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7F,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;AACJ,CAAC,CAAC;AAEF,SAAS,MAAM,CAAC,MAAqB;IACnC,OAAO,MAAM,CAAC,KAAK,EAAE,OAAO,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,OAAO,MAAM,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;AAChH,CAAC;AAED,SAAS,IAAI,CAAI,MAAqB,EAAE,MAAc;IACpD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAM,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,aAAa,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,OAAe,EAAE,EAAW;IACzC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,MAAqB,aAAa;IAClF,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IACvE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,eAAe,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpD,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IACtF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACnF,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAE1C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;IACjD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,oBAAoB,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAE3F,MAAM,MAAM,GAAG,sCAAsC,CAAC;IACtD,IAAI,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IAC7D,IAAI,EAAE,GAAuB,IAAI,CAAC;IAClC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAmC,IAAI,EAAE,YAAY,CAAC,CAAC;YAC7E,IAAI,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,KAAK,KAAK,MAAM;gBAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACzE,EAAE,GAAG,SAAS,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,KAAK,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,uBAAuB,CAAC,EAAE,IAAI,CAAC,CAAC;QACvH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,kBAAkB,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1E,IAAI,UAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,CAAgB,MAAM,EAAE,YAAY,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,KAAK,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACnD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC,MAAM,MAAM,OAAO,UAAU,CAAC,MAAM,oBAAoB,CAAC,CAAC;QAClG,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAE,CAAC;QACjC,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;QACnF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,YAAY,SAAS,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QACtG,IAAI,CAAC;YACH,EAAE,GAAG,IAAI,CAAc,IAAI,EAAE,cAAc,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,KAAK,CAAE,KAAe,CAAC,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;QACxF,OAAO,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,MAAM,GAAG,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;IAC3C,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,OAAO,KAAK,CACV,OAAO,EAAE,CAAC,MAAM,UAAU,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,qBAAqB,EAC/F,EAAE,CAAC,MAAM,CACV,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzF,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,qBAAqB,YAAY,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IACjH,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU;QACb,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,mCAAmC,YAAY,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IACpH,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;QAC1B,OAAO,KAAK,CACV,OAAO,EAAE,CAAC,MAAM,gBAAgB,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,cAAc,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,cAAc,YAAY,cAAc,EAAE,CAAC,MAAM,EAAE,EACzI,EAAE,CAAC,MAAM,CACV,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC;AACvC,CAAC"}

package/node_modules/@sumi/plugins-governance/dist/protected.d.ts

@@ -0,0 +1,22 @@
+/** 默认受保护路径：control 层、判例层、配置、入口文档、AI 工具适配、工具配置、包清单与锁文件。 */
+export declare const DEFAULT_PROTECTED: string[];
+export interface GovernanceConfig {
+    protected?: string[];
+    zones?: {
+        control?: string[];
+    };
+    gate?: {
+        flow?: string;
+        tier?: string;
+        prepare?: string[];
+        defaultBranch?: string;
+    };
+}
+export declare function parseConfig(text: string | null): GovernanceConfig | null;
+/** 读取某个提交（或工作区，ref 为 null）中的项目配置；不存在时返回 null。 */
+export declare function configAt(root: string, ref: string | null): GovernanceConfig | null;
+export declare function protectedGlobs(config: GovernanceConfig | null): string[];
+/** 受保护路径集合按两边声明的并集计算，缩小保护范围本身也会被当作 control 变更。 */
+export declare function protectedMatcher(...configs: (GovernanceConfig | null)[]): (file: string) => boolean;
+/** 文件系统路径用的受保护判断：Windows 与 macOS 默认不区分大小写，`Control/config.yaml` 指向的就是 control 区。 */
+export declare function protectedPathMatcher(configs: (GovernanceConfig | null)[], platform?: NodeJS.Platform): (file: string) => boolean;

package/node_modules/@sumi/plugins-governance/dist/protected.js

@@ -0,0 +1,65 @@
+import { execFileSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { CONFIG_FILES, configFile } from '@sumi/plugin-sdk';
+import picomatch from 'picomatch';
+import { parse } from 'yaml';
+/** 默认受保护路径：control 层、判例层、配置、入口文档、AI 工具适配、工具配置、包清单与锁文件。 */
+export const DEFAULT_PROTECTED = [
+    'control/**',
+    'precedents/**',
+    'sumi.config.yaml',
+    'AGENTS.md',
+    'CLAUDE.md',
+    '.claude/**',
+    '.agents/**',
+    '.cursor/**',
+    'eslint.config.*',
+    '.prettierrc*',
+    'tsconfig*.json',
+    'vitest.config.*',
+    'package.json',
+    '**/package.json',
+    'pnpm-lock.yaml',
+    'package-lock.json',
+    'yarn.lock',
+];
+export function parseConfig(text) {
+    if (text === null)
+        return null;
+    return (parse(text) ?? {});
+}
+/** 读取某个提交（或工作区，ref 为 null）中的项目配置；不存在时返回 null。 */
+export function configAt(root, ref) {
+    if (ref === null) {
+        const rel = configFile(root);
+        return rel ? parseConfig(readFileSync(join(root, rel), 'utf8')) : null;
+    }
+    for (const rel of CONFIG_FILES) {
+        try {
+            return parseConfig(execFileSync('git', ['show', `${ref}:${rel}`], {
+                cwd: root,
+                encoding: 'utf8',
+                stdio: ['ignore', 'pipe', 'ignore'],
+                windowsHide: true,
+            }));
+        }
+        catch {
+            // 该提交中没有这个位置的配置，尝试下一个。
+        }
+    }
+    return null;
+}
+export function protectedGlobs(config) {
+    // 配置登记的 control 区一律受保护：纳管时登记进来的规则目录无需另行声明。
+    return [...DEFAULT_PROTECTED, ...(config?.zones?.control ?? []), ...(config?.protected ?? [])];
+}
+/** 受保护路径集合按两边声明的并集计算，缩小保护范围本身也会被当作 control 变更。 */
+export function protectedMatcher(...configs) {
+    return picomatch([...new Set(configs.flatMap(protectedGlobs))], { dot: true });
+}
+/** 文件系统路径用的受保护判断：Windows 与 macOS 默认不区分大小写，`Control/config.yaml` 指向的就是 control 区。 */
+export function protectedPathMatcher(configs, platform = process.platform) {
+    return picomatch([...new Set(configs.flatMap(protectedGlobs))], { dot: true, nocase: platform === 'win32' || platform === 'darwin' });
+}
+//# sourceMappingURL=protected.js.map

package/node_modules/@sumi/plugins-governance/dist/protected.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protected.js","sourceRoot":"","sources":["../src/protected.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,SAAS,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAE7B,0DAA0D;AAC1D,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,YAAY;IACZ,eAAe;IACf,kBAAkB;IAClB,WAAW;IACX,WAAW;IACX,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,iBAAiB;IACjB,cAAc;IACd,gBAAgB;IAChB,iBAAiB;IACjB,cAAc;IACd,iBAAiB;IACjB,gBAAgB;IAChB,mBAAmB;IACnB,WAAW;CACZ,CAAC;AAQF,MAAM,UAAU,WAAW,CAAC,IAAmB;IAC7C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,OAAO,CAAE,KAAK,CAAC,IAAI,CAAsB,IAAI,EAAE,CAAqB,CAAC;AACvE,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,GAAkB;IACvD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC7B,OAAO,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzE,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,OAAO,WAAW,CAChB,YAAY,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC,EAAE;gBAC7C,GAAG,EAAE,IAAI;gBACT,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;gBACnC,WAAW,EAAE,IAAI;aAClB,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,uBAAuB;QACzB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAA+B;IAC5D,2CAA2C;IAC3C,OAAO,CAAC,GAAG,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,gBAAgB,CAAC,GAAG,OAAoC;IACtE,OAAO,SAAS,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,oBAAoB,CAClC,OAAoC,EACpC,WAA4B,OAAO,CAAC,QAAQ;IAE5C,OAAO,SAAS,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC,CAAC;AACxI,CAAC"}

package/node_modules/@sumi/plugins-governance/dist/push-base.d.ts

@@ -0,0 +1,9 @@
+export interface PushUpstream {
+    name: string;
+    oid: string;
+}
+/**
+ * 解析被推送本地分支的 Git upstream，并证明它位于安全的祖先链上。
+ * existingRemoteOid 为 null 表示新建远端 ref；已有 ref 还要求 upstream 覆盖远端旧历史。
+ */
+export declare function resolvePushUpstream(root: string, localRef: string, candidateOid: string, existingRemoteOid: string | null): PushUpstream | null;

package/node_modules/@sumi/plugins-governance/dist/push-base.js

@@ -0,0 +1,42 @@
+import { execFileSync, spawnSync } from 'node:child_process';
+function tryGit(root, args) {
+    try {
+        return execFileSync('git', args, {
+            cwd: root,
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'pipe'],
+            windowsHide: true,
+        }).trim();
+    }
+    catch {
+        return null;
+    }
+}
+function isAncestor(root, ancestor, descendant) {
+    return (spawnSync('git', ['merge-base', '--is-ancestor', ancestor, descendant], {
+        cwd: root,
+        windowsHide: true,
+    }).status === 0);
+}
+/**
+ * 解析被推送本地分支的 Git upstream，并证明它位于安全的祖先链上。
+ * existingRemoteOid 为 null 表示新建远端 ref；已有 ref 还要求 upstream 覆盖远端旧历史。
+ */
+export function resolvePushUpstream(root, localRef, candidateOid, existingRemoteOid) {
+    if (!localRef.startsWith('refs/heads/')) {
+        return null;
+    }
+    const ref = tryGit(root, ['for-each-ref', '--format=%(upstream)', '--count=1', localRef]);
+    if (!ref) {
+        return null;
+    }
+    const oid = tryGit(root, ['rev-parse', '--verify', '--quiet', `${ref}^{commit}`]);
+    if (!oid || !isAncestor(root, oid, candidateOid)) {
+        return null;
+    }
+    if (existingRemoteOid && !isAncestor(root, existingRemoteOid, oid)) {
+        return null;
+    }
+    return { name: ref.replace(/^refs\/remotes\//, ''), oid };
+}
+//# sourceMappingURL=push-base.js.map

package/node_modules/@sumi/plugins-governance/dist/push-base.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"push-base.js","sourceRoot":"","sources":["../src/push-base.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAO7D,SAAS,MAAM,CAAC,IAAY,EAAE,IAAc;IAC1C,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;YAC/B,GAAG,EAAE,IAAI;YACT,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC,IAAI,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,QAAgB,EAAE,UAAkB;IACpE,OAAO,CACL,SAAS,CAAC,KAAK,EAAE,CAAC,YAAY,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE;QACtE,GAAG,EAAE,IAAI;QACT,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC,MAAM,KAAK,CAAC,CAChB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAY,EACZ,QAAgB,EAChB,YAAoB,EACpB,iBAAgC;IAEhC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,cAAc,EAAE,sBAAsB,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC1F,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC;IAClF,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,iBAAiB,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,iBAAiB,EAAE,GAAG,CAAC,EAAE,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC;AAC5D,CAAC"}

package/node_modules/@sumi/plugins-governance/dist/semantic.d.ts

@@ -0,0 +1,5 @@
+/**
+ * control 变更的语义摘要：步骤增删、必需性与条件变化、保护范围增减、基线变化、依赖版本变化，
+ * 以及其余受保护文件的变化。展示给确认的人看，帮助识别"弱化"。
+ */
+export declare function semanticChanges(root: string, base: string | null, candidate: string, files: string[]): string[];

package/node_modules/@sumi/plugins-governance/dist/semantic.js

@@ -0,0 +1,105 @@
+import { CONFIG_FILES } from '@sumi/plugin-sdk';
+import { execFileSync } from 'node:child_process';
+import { parse } from 'yaml';
+import { configAt, protectedGlobs } from './protected.js';
+function show(root, ref, path) {
+    if (ref === null)
+        return null;
+    try {
+        return execFileSync('git', ['show', `${ref}:${path}`], {
+            cwd: root,
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+            windowsHide: true,
+        });
+    }
+    catch {
+        return null;
+    }
+}
+function flowSteps(text) {
+    const steps = new Map();
+    if (!text)
+        return steps;
+    const raw = parse(text)?.steps ?? [];
+    for (const s of raw) {
+        const use = String(s.use);
+        const id = typeof s.id === 'string' ? s.id : use;
+        steps.set(id, { id, use, required: s.required !== false, when: typeof s.when === 'string' ? s.when : '' });
+    }
+    return steps;
+}
+function dependencies(text) {
+    if (!text)
+        return new Map();
+    const pkg = JSON.parse(text);
+    return new Map(Object.entries({ ...pkg.dependencies, ...pkg.devDependencies }));
+}
+/**
+ * control 变更的语义摘要：步骤增删、必需性与条件变化、保护范围增减、基线变化、依赖版本变化，
+ * 以及其余受保护文件的变化。展示给确认的人看，帮助识别"弱化"。
+ */
+export function semanticChanges(root, base, candidate, files) {
+    const out = [];
+    const handled = new Set();
+    for (const file of files.filter((f) => /^control\/flows\/.+\.flow\.yaml$/.test(f))) {
+        handled.add(file);
+        const before = flowSteps(show(root, base, file));
+        const after = flowSteps(show(root, candidate, file));
+        for (const id of before.keys())
+            if (!after.has(id))
+                out.push(`删除步骤 ${id}（${file}）`);
+        for (const [id, s] of after) {
+            const old = before.get(id);
+            if (!old)
+                out.push(`新增步骤 ${id}（${file}）`);
+            else {
+                if (old.required && !s.required)
+                    out.push(`步骤 ${id} 改为非必需`);
+                if (!old.required && s.required)
+                    out.push(`步骤 ${id} 改为必需`);
+                if (old.when !== s.when)
+                    out.push(`步骤 ${id} 的条件由 "${old.when}" 改为 "${s.when}"`);
+            }
+        }
+    }
+    const configChanged = CONFIG_FILES.filter((f) => files.includes(f));
+    if (configChanged.length) {
+        for (const f of configChanged)
+            handled.add(f);
+        const before = new Set(protectedGlobs(configAt(root, base)));
+        const after = new Set(protectedGlobs(configAt(root, candidate)));
+        for (const g of before)
+            if (!after.has(g))
+                out.push(`缩小保护范围：移除 ${g}`);
+        for (const g of after)
+            if (!before.has(g))
+                out.push(`扩大保护范围：加入 ${g}`);
+        out.push(`项目配置有变化（${configChanged.join('、')}）`);
+    }
+    for (const file of files.filter((f) => f.startsWith('control/baselines/') && f.endsWith('metrics.yaml'))) {
+        handled.add(file);
+        const before = parse(show(root, base, file) ?? '') ?? {};
+        const after = parse(show(root, candidate, file) ?? '') ?? {};
+        for (const key of new Set([...Object.keys(before), ...Object.keys(after)])) {
+            if (before[key] !== after[key])
+                out.push(`基线 ${key}：${before[key] ?? '无'} → ${after[key] ?? '删除'}`);
+        }
+    }
+    for (const file of files.filter((f) => f.endsWith('package.json'))) {
+        handled.add(file);
+        const before = dependencies(show(root, base, file));
+        const after = dependencies(show(root, candidate, file));
+        for (const [name, v] of after)
+            if (before.get(name) !== v)
+                out.push(`依赖 ${name}：${before.get(name) ?? '无'} → ${v}（${file}）`);
+        for (const name of before.keys())
+            if (!after.has(name))
+                out.push(`移除依赖 ${name}（${file}）`);
+    }
+    const rest = files.filter((f) => !handled.has(f));
+    if (rest.length)
+        out.push(`其他受保护文件变化：${rest.slice(0, 10).join('、')}${rest.length > 10 ? ` 等 ${rest.length} 个` : ''}`);
+    return out;
+}
+//# sourceMappingURL=semantic.js.map

package/node_modules/@sumi/plugins-governance/dist/semantic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"semantic.js","sourceRoot":"","sources":["../src/semantic.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAE1D,SAAS,IAAI,CAAC,IAAY,EAAE,GAAkB,EAAE,IAAY;IAC1D,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,EAAE;YACrD,GAAG,EAAE,IAAI;YACT,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AASD,SAAS,SAAS,CAAC,IAAmB;IACpC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,GAAG,GAAI,KAAK,CAAC,IAAI,CAAkD,EAAE,KAAK,IAAI,EAAE,CAAC;IACvF,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QACjD,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,KAAK,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7G,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,IAAmB;IACvC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuD,CAAC;IACnF,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,GAAG,CAAC,YAAY,EAAE,GAAG,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;AAClF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,IAAmB,EAAE,SAAiB,EAAE,KAAe;IACnG,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kCAAkC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;QACrD,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,GAAG,CAAC,CAAC;QACpF,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC3B,IAAI,CAAC,GAAG;gBAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,GAAG,CAAC,CAAC;iBACrC,CAAC;gBACJ,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ;oBAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC5D,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ;oBAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAC3D,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;oBAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,GAAG,CAAC,IAAI,SAAS,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,IAAI,aAAa,CAAC,MAAM,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,aAAa;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7D,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;QACjE,KAAK,MAAM,CAAC,IAAI,MAAM;YAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QACtE,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QACtE,GAAG,CAAC,IAAI,CAAC,WAAW,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;QACzG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,MAAM,MAAM,GAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAmC,IAAI,EAAE,CAAC;QAC5F,MAAM,KAAK,GAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,CAAmC,IAAI,EAAE,CAAC;QAChG,KAAK,MAAM,GAAG,IAAI,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACtG,CAAC;IACH,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;QACnE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;QACxD,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,KAAK;YAAE,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;QAC7H,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,IAAI,GAAG,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,MAAM;QAAE,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACtH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/node_modules/@sumi/plugins-governance/dist/state.d.ts

@@ -0,0 +1,48 @@
+/** 共享状态目录：由 git 公共目录定位，所有 worktree 共用，不在工作树中、不随提交传播。 */
+export declare function stateDir(root: string): string;
+export interface ApprovalRequest {
+    id: string;
+    kind: string;
+    binding: Record<string, unknown>;
+    /** 给人看的说明，确认时展示。 */
+    summary: string[];
+    createdAt: string;
+}
+export declare function bindingKey(kind: string, binding: Record<string, unknown>): string;
+export declare function isApproved(root: string, kind: string, binding: Record<string, unknown>): boolean;
+/** 登记待确认请求（同一对象重复登记得到同一 id），返回请求 id。 */
+export declare function registerRequest(root: string, kind: string, binding: Record<string, unknown>, summary: string[]): string;
+export declare function readRequest(root: string, id: string): ApprovalRequest | null;
+export declare function recordApproval(root: string, request: ApprovalRequest): void;
+/**
+ * 需要人工确认时的统一入口：已确认返回 null；否则登记请求并返回 ask-human 所需的请求 id。
+ * 评审与判例插件也通过它请求确认。
+ */
+export declare function requireApproval(root: string, kind: string, binding: Record<string, unknown>, summary: string[]): string | null;
+export interface UnlockWindow {
+    until: string;
+}
+export declare function unlockActive(root: string, now?: number): boolean;
+export declare function writeUnlock(root: string, minutes: number): string;
+export interface ControlTerminalPaths {
+    input: string;
+    output: string;
+}
+export interface ControlTerminal {
+    readFd: number;
+    writeFd: number;
+    write: (text: string) => Promise<void>;
+    close: () => void;
+}
+type OpenControlFile = (path: string, flags: 'r' | 'r+' | 'w') => number;
+type CloseControlFile = (fd: number) => void;
+/** Windows 控制台输入、输出是两个设备；POSIX 的 /dev/tty 可双向复用。 */
+export declare function controlTerminalPaths(platform?: NodeJS.Platform): ControlTerminalPaths;
+/** 打开当前进程所属的控制终端；调用者必须执行返回值的 close。 */
+export declare function openControlTerminal(platform?: NodeJS.Platform, open?: OpenControlFile, close?: CloseControlFile): ControlTerminal;
+/**
+ * 在控制终端上与人交互：展示内容和随机短码，从控制台输入设备读取输入。
+ * 无法打开控制终端或读写失败时抛错。确认只表达交互意图，不作为身份认证。
+ */
+export declare function confirmOnTty(lines: string[]): Promise<boolean>;
+export {};