@flyingrobots/graft 0.5.0 → 0.6.0

package/dist/policy/evaluate.js

@@ -0,0 +1,153 @@
+import picomatch from "picomatch";
+import { ContentResult, OutlineResult, RefusedResult } from "./types.js";
+export const STATIC_THRESHOLDS = { lines: 150, bytes: 12288 };
+const SESSION_BYTE_CAPS = {
+    early: 20480,
+    mid: 10240,
+    late: 4096,
+};
+const BINARY_EXTENSIONS = new Set([
+    ".png", ".jpg", ".jpeg", ".gif", ".pdf", ".zip",
+    ".wasm", ".bin", ".sqlite", ".mp4", ".mov", ".ico",
+]);
+const LOCKFILE_NAMES = new Set([
+    "package-lock.json", "pnpm-lock.yaml", "yarn.lock",
+    "Gemfile.lock", "poetry.lock", "Cargo.lock",
+    "composer.lock", "Pipfile.lock",
+]);
+const BUILD_OUTPUT_PREFIXES = ["dist/", "build/", ".next/", "out/", "target/"];
+const SECRET_PATTERNS = [
+    (n) => n === ".env" || (n.startsWith(".env.") && !n.endsWith(".example")),
+    (n) => n.endsWith(".pem"),
+    (n) => n.endsWith(".key"),
+    (n) => n.startsWith("credentials."),
+];
+function basename(path) {
+    const i = path.lastIndexOf("/");
+    return i === -1 ? path : path.slice(i + 1);
+}
+function extname(path) {
+    const name = basename(path);
+    const i = name.lastIndexOf(".");
+    return i <= 0 ? "" : name.slice(i);
+}
+function checkBan(path) {
+    const name = basename(path);
+    const ext = extname(path).toLowerCase();
+    if (BINARY_EXTENSIONS.has(ext)) {
+        return {
+            reason: "BINARY",
+            reasonDetail: `Binary file (${ext}) cannot be usefully read`,
+            next: ["Use file_outline to see metadata", "Check for a text alternative"],
+        };
+    }
+    if (LOCKFILE_NAMES.has(name)) {
+        return {
+            reason: "LOCKFILE",
+            reasonDetail: `Lockfile ${name} is machine-generated and not useful to read`,
+            next: ["Read package.json for dependency info instead"],
+        };
+    }
+    if (name.endsWith(".min.js") || name.endsWith(".min.css")) {
+        return {
+            reason: "MINIFIED",
+            reasonDetail: `Minified file ${name} is not human-readable`,
+            next: ["Look for the unminified source"],
+        };
+    }
+    for (const prefix of BUILD_OUTPUT_PREFIXES) {
+        if (path.includes("/" + prefix) || path.startsWith(prefix)) {
+            return {
+                reason: "BUILD_OUTPUT",
+                reasonDetail: `Build output path ${prefix} contains generated files`,
+                next: ["Try reading src/ instead of dist/"],
+            };
+        }
+    }
+    for (const check of SECRET_PATTERNS) {
+        if (check(name)) {
+            return {
+                reason: "SECRET",
+                reasonDetail: `${name} may contain secrets and should not be read`,
+                next: ["Check for a .example or template version"],
+            };
+        }
+    }
+    return undefined;
+}
+export function evaluatePolicy(input, options) {
+    const { path, lines, bytes } = input;
+    const actual = { lines, bytes };
+    const thresholds = { ...STATIC_THRESHOLDS };
+    const sessionDepth = options?.sessionDepth;
+    // 1. Bans first
+    const ban = checkBan(path);
+    if (ban !== undefined) {
+        return new RefusedResult({
+            reason: ban.reason,
+            reasonDetail: ban.reasonDetail,
+            next: ban.next,
+            thresholds,
+            actual,
+            ...(sessionDepth !== undefined ? { sessionDepth } : {}),
+        });
+    }
+    // 2. Graftignore
+    const patterns = options?.graftignorePatterns;
+    if (patterns !== undefined && patterns.length > 0) {
+        const isMatch = picomatch(patterns);
+        if (isMatch(path)) {
+            return new RefusedResult({
+                reason: "GRAFTIGNORE",
+                reasonDetail: "File matches .graftignore pattern",
+                next: ["Check .graftignore if this file should be readable"],
+                thresholds,
+                actual,
+                ...(sessionDepth !== undefined ? { sessionDepth } : {}),
+            });
+        }
+    }
+    // 3. Determine effective byte cap
+    // When session depth is known (not "unknown"), the session cap replaces the static byte threshold.
+    // Static line threshold always applies.
+    const hasSessionCap = sessionDepth !== undefined && sessionDepth !== "unknown";
+    let effectiveByteCap = hasSessionCap
+        ? SESSION_BYTE_CAPS[sessionDepth] ?? STATIC_THRESHOLDS.bytes
+        : STATIC_THRESHOLDS.bytes;
+    // 4. Budget cap — no single read should exceed 5% of remaining budget
+    const MAX_READ_FRACTION = 0.05;
+    const budgetRemaining = options?.budgetRemaining;
+    const hasBudgetCap = budgetRemaining !== undefined && budgetRemaining >= 0;
+    let budgetTriggered = false;
+    if (hasBudgetCap) {
+        const budgetCap = Math.floor(budgetRemaining * MAX_READ_FRACTION);
+        if (budgetCap < effectiveByteCap) {
+            effectiveByteCap = budgetCap;
+            budgetTriggered = true;
+        }
+    }
+    const exceedsLines = lines > STATIC_THRESHOLDS.lines;
+    const exceedsBytes = bytes > effectiveByteCap;
+    if (!exceedsLines && !exceedsBytes) {
+        return new ContentResult({
+            thresholds,
+            actual,
+            ...(sessionDepth !== undefined ? { sessionDepth } : {}),
+        });
+    }
+    // Determine reason: BUDGET_CAP > SESSION_CAP > OUTLINE
+    const finalReason = exceedsLines && !exceedsBytes
+        ? "OUTLINE"
+        : exceedsBytes && budgetTriggered
+            ? "BUDGET_CAP"
+            : exceedsBytes && hasSessionCap
+                ? "SESSION_CAP"
+                : "OUTLINE";
+    return new OutlineResult({
+        reason: finalReason,
+        thresholds,
+        actual,
+        ...(sessionDepth !== undefined ? { sessionDepth } : {}),
+    });
+}
+//# sourceMappingURL=evaluate.js.map

package/dist/policy/evaluate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate.js","sourceRoot":"","sources":["../../src/policy/evaluate.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAGzE,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAW,CAAC;AAEvE,MAAM,iBAAiB,GAA2B;IAChD,KAAK,EAAE,KAAK;IACZ,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,IAAI;CACX,CAAC;AAEF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAC/C,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CACnD,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,mBAAmB,EAAE,gBAAgB,EAAE,WAAW;IAClD,cAAc,EAAE,aAAa,EAAE,YAAY;IAC3C,eAAe,EAAE,cAAc;CAChC,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AAE/E,MAAM,eAAe,GAAkC;IACrD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACzE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC;CACpC,CAAC;AAEF,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAExC,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,YAAY,EAAE,gBAAgB,GAAG,2BAA2B;YAC5D,IAAI,EAAE,CAAC,kCAAkC,EAAE,8BAA8B,CAAC;SAC3E,CAAC;IACJ,CAAC;IAED,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,MAAM,EAAE,UAAU;YAClB,YAAY,EAAE,YAAY,IAAI,8CAA8C;YAC5E,IAAI,EAAE,CAAC,+CAA+C,CAAC;SACxD,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1D,OAAO;YACL,MAAM,EAAE,UAAU;YAClB,YAAY,EAAE,iBAAiB,IAAI,wBAAwB;YAC3D,IAAI,EAAE,CAAC,gCAAgC,CAAC;SACzC,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,qBAAqB,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,GAAG,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3D,OAAO;gBACL,MAAM,EAAE,cAAc;gBACtB,YAAY,EAAE,qBAAqB,MAAM,2BAA2B;gBACpE,IAAI,EAAE,CAAC,mCAAmC,CAAC;aAC5C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAChB,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,YAAY,EAAE,GAAG,IAAI,6CAA6C;gBAClE,IAAI,EAAE,CAAC,0CAA0C,CAAC;aACnD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAkB,EAAE,OAAuB;IACxE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACrC,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAChC,MAAM,UAAU,GAAG,EAAE,GAAG,iBAAiB,EAAE,CAAC;IAC5C,MAAM,YAAY,GAA8B,OAAO,EAAE,YAAY,CAAC;IAEtE,gBAAgB;IAChB,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,IAAI,aAAa,CAAC;YACvB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,UAAU;YACV,MAAM;YACN,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC,CAAC;IACL,CAAC;IAED,iBAAiB;IACjB,MAAM,QAAQ,GAAG,OAAO,EAAE,mBAAmB,CAAC;IAC9C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAClB,OAAO,IAAI,aAAa,CAAC;gBACvB,MAAM,EAAE,aAAa;gBACrB,YAAY,EAAE,mCAAmC;gBACjD,IAAI,EAAE,CAAC,oDAAoD,CAAC;gBAC5D,UAAU;gBACV,MAAM;gBACN,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,mGAAmG;IACnG,wCAAwC;IACxC,MAAM,aAAa,GAAG,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,CAAC;IAC/E,IAAI,gBAAgB,GAAG,aAAa;QAClC,CAAC,CAAC,iBAAiB,CAAC,YAAY,CAAC,IAAI,iBAAiB,CAAC,KAAK;QAC5D,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC;IAE5B,sEAAsE;IACtE,MAAM,iBAAiB,GAAG,IAAI,CAAC;IAC/B,MAAM,eAAe,GAAG,OAAO,EAAE,eAAe,CAAC;IACjD,MAAM,YAAY,GAAG,eAAe,KAAK,SAAS,IAAI,eAAe,IAAI,CAAC,CAAC;IAC3E,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,iBAAiB,CAAC,CAAC;QAClE,IAAI,SAAS,GAAG,gBAAgB,EAAE,CAAC;YACjC,gBAAgB,GAAG,SAAS,CAAC;YAC7B,eAAe,GAAG,IAAI,CAAC;QACzB,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC;IACrD,MAAM,YAAY,GAAG,KAAK,GAAG,gBAAgB,CAAC;IAE9C,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,EAAE,CAAC;QACnC,OAAO,IAAI,aAAa,CAAC;YACvB,UAAU;YACV,MAAM;YACN,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC,CAAC;IACL,CAAC;IAED,uDAAuD;IACvD,MAAM,WAAW,GAA6C,YAAY,IAAI,CAAC,YAAY;QACzF,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,YAAY,IAAI,eAAe;YAC/B,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,YAAY,IAAI,aAAa;gBAC7B,CAAC,CAAC,aAAa;gBACf,CAAC,CAAC,SAAS,CAAC;IAElB,OAAO,IAAI,aAAa,CAAC;QACvB,MAAM,EAAE,WAAW;QACnB,UAAU;QACV,MAAM;QACN,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC,CAAC;AACL,CAAC"}

package/dist/policy/graftignore.d.ts

@@ -0,0 +1,2 @@
+export declare function loadGraftignore(content: string): string[];
+//# sourceMappingURL=graftignore.d.ts.map

package/dist/policy/graftignore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"graftignore.d.ts","sourceRoot":"","sources":["../../src/policy/graftignore.ts"],"names":[],"mappings":"AAAA,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAKzD"}

package/dist/policy/graftignore.js

@@ -0,0 +1,7 @@
+export function loadGraftignore(content) {
+    return content
+        .split("\n")
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0 && !line.startsWith("#"));
+}
+//# sourceMappingURL=graftignore.js.map

package/dist/policy/graftignore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graftignore.js","sourceRoot":"","sources":["../../src/policy/graftignore.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO,OAAO;SACX,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AAChE,CAAC"}

package/dist/policy/types.d.ts

@@ -0,0 +1,104 @@
+export type ReasonCode = "CONTENT" | "OUTLINE" | "SESSION_CAP" | "BINARY" | "LOCKFILE" | "MINIFIED" | "BUILD_OUTPUT" | "SECRET" | "GRAFTIGNORE" | "BUDGET_CAP" | "UNSUPPORTED_LANGUAGE";
+export type GovernorDepth = "early" | "mid" | "late" | "unknown";
+export interface PolicyInput {
+    path: string;
+    lines: number;
+    bytes: number;
+}
+export interface PolicyOptions {
+    graftignorePatterns?: string[] | undefined;
+    sessionDepth?: GovernorDepth | undefined;
+    budgetRemaining?: number | undefined;
+}
+interface PolicyResultBase {
+    readonly thresholds: {
+        readonly lines: number;
+        readonly bytes: number;
+    };
+    readonly actual: {
+        readonly lines: number;
+        readonly bytes: number;
+    };
+    readonly sessionDepth?: GovernorDepth | undefined;
+}
+export declare class ContentResult implements PolicyResultBase {
+    readonly projection: "content";
+    readonly reason: "CONTENT";
+    readonly thresholds: {
+        readonly lines: number;
+        readonly bytes: number;
+    };
+    readonly actual: {
+        readonly lines: number;
+        readonly bytes: number;
+    };
+    readonly sessionDepth?: GovernorDepth | undefined;
+    constructor(opts: {
+        thresholds: {
+            lines: number;
+            bytes: number;
+        };
+        actual: {
+            lines: number;
+            bytes: number;
+        };
+        sessionDepth?: GovernorDepth | undefined;
+    });
+}
+export declare class OutlineResult implements PolicyResultBase {
+    readonly projection: "outline";
+    readonly reason: "OUTLINE" | "SESSION_CAP" | "BUDGET_CAP" | "UNSUPPORTED_LANGUAGE";
+    readonly thresholds: {
+        readonly lines: number;
+        readonly bytes: number;
+    };
+    readonly actual: {
+        readonly lines: number;
+        readonly bytes: number;
+    };
+    readonly sessionDepth?: GovernorDepth | undefined;
+    constructor(opts: {
+        reason: "OUTLINE" | "SESSION_CAP" | "BUDGET_CAP" | "UNSUPPORTED_LANGUAGE";
+        thresholds: {
+            lines: number;
+            bytes: number;
+        };
+        actual: {
+            lines: number;
+            bytes: number;
+        };
+        sessionDepth?: GovernorDepth | undefined;
+    });
+}
+export declare class RefusedResult implements PolicyResultBase {
+    readonly projection: "refused";
+    readonly reason: ReasonCode;
+    readonly reasonDetail: string;
+    readonly next: readonly string[];
+    readonly thresholds: {
+        readonly lines: number;
+        readonly bytes: number;
+    };
+    readonly actual: {
+        readonly lines: number;
+        readonly bytes: number;
+    };
+    readonly sessionDepth?: GovernorDepth | undefined;
+    constructor(opts: {
+        reason: ReasonCode;
+        reasonDetail: string;
+        next: string[];
+        thresholds: {
+            lines: number;
+            bytes: number;
+        };
+        actual: {
+            lines: number;
+            bytes: number;
+        };
+        sessionDepth?: GovernorDepth | undefined;
+    });
+}
+export type PolicyResult = ContentResult | OutlineResult | RefusedResult;
+export {};
+//# sourceMappingURL=types.d.ts.map

package/dist/policy/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/policy/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAClB,SAAS,GACT,SAAS,GACT,aAAa,GACb,QAAQ,GACR,UAAU,GACV,UAAU,GACV,cAAc,GACd,QAAQ,GACR,aAAa,GACb,YAAY,GACZ,sBAAsB,CAAC;AAE3B,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;AAEjE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,mBAAmB,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC3C,YAAY,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IACzC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAGD,UAAU,gBAAgB;IACxB,QAAQ,CAAC,UAAU,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACxE,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;CACnD;AAED,qBAAa,aAAc,YAAW,gBAAgB;IACpD,QAAQ,CAAC,UAAU,EAAG,SAAS,CAAU;IACzC,QAAQ,CAAC,MAAM,EAAG,SAAS,CAAU;IACrC,QAAQ,CAAC,UAAU,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACxE,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;gBAEtC,IAAI,EAAE;QAAE,UAAU,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,MAAM,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,YAAY,CAAC,EAAE,aAAa,GAAG,SAAS,CAAA;KAAE;CAMvJ;AAED,qBAAa,aAAc,YAAW,gBAAgB;IACpD,QAAQ,CAAC,UAAU,EAAG,SAAS,CAAU;IACzC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,aAAa,GAAG,YAAY,GAAG,sBAAsB,CAAC;IACnF,QAAQ,CAAC,UAAU,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACxE,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;gBAEtC,IAAI,EAAE;QAAE,MAAM,EAAE,SAAS,GAAG,aAAa,GAAG,YAAY,GAAG,sBAAsB,CAAC;QAAC,UAAU,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,MAAM,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,YAAY,CAAC,EAAE,aAAa,GAAG,SAAS,CAAA;KAAE;CAOlO;AAED,qBAAa,aAAc,YAAW,gBAAgB;IACpD,QAAQ,CAAC,UAAU,EAAG,SAAS,CAAU;IACzC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACxE,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;gBAEtC,IAAI,EAAE;QAAE,MAAM,EAAE,UAAU,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,MAAM,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,YAAY,CAAC,EAAE,aAAa,GAAG,SAAS,CAAA;KAAE;CASjN;AAGD,MAAM,MAAM,YAAY,GAAG,aAAa,GAAG,aAAa,GAAG,aAAa,CAAC"}

package/dist/policy/types.js

@@ -0,0 +1,49 @@
+export class ContentResult {
+    projection = "content";
+    reason = "CONTENT";
+    thresholds;
+    actual;
+    sessionDepth;
+    constructor(opts) {
+        this.thresholds = Object.freeze({ ...opts.thresholds });
+        this.actual = Object.freeze({ ...opts.actual });
+        if (opts.sessionDepth !== undefined)
+            this.sessionDepth = opts.sessionDepth;
+        Object.freeze(this);
+    }
+}
+export class OutlineResult {
+    projection = "outline";
+    reason;
+    thresholds;
+    actual;
+    sessionDepth;
+    constructor(opts) {
+        this.reason = opts.reason;
+        this.thresholds = Object.freeze({ ...opts.thresholds });
+        this.actual = Object.freeze({ ...opts.actual });
+        if (opts.sessionDepth !== undefined)
+            this.sessionDepth = opts.sessionDepth;
+        Object.freeze(this);
+    }
+}
+export class RefusedResult {
+    projection = "refused";
+    reason;
+    reasonDetail;
+    next;
+    thresholds;
+    actual;
+    sessionDepth;
+    constructor(opts) {
+        this.reason = opts.reason;
+        this.reasonDetail = opts.reasonDetail;
+        this.next = Object.freeze([...opts.next]);
+        this.thresholds = Object.freeze({ ...opts.thresholds });
+        this.actual = Object.freeze({ ...opts.actual });
+        if (opts.sessionDepth !== undefined)
+            this.sessionDepth = opts.sessionDepth;
+        Object.freeze(this);
+    }
+}
+//# sourceMappingURL=types.js.map

package/dist/policy/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/policy/types.ts"],"names":[],"mappings":"AAkCA,MAAM,OAAO,aAAa;IACf,UAAU,GAAG,SAAkB,CAAC;IAChC,MAAM,GAAG,SAAkB,CAAC;IAC5B,UAAU,CAAqD;IAC/D,MAAM,CAAqD;IAC3D,YAAY,CAA6B;IAElD,YAAY,IAA0I;QACpJ,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;YAAE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QAC3E,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;CACF;AAED,MAAM,OAAO,aAAa;IACf,UAAU,GAAG,SAAkB,CAAC;IAChC,MAAM,CAAoE;IAC1E,UAAU,CAAqD;IAC/D,MAAM,CAAqD;IAC3D,YAAY,CAA6B;IAElD,YAAY,IAAqN;QAC/N,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;YAAE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QAC3E,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;CACF;AAED,MAAM,OAAO,aAAa;IACf,UAAU,GAAG,SAAkB,CAAC;IAChC,MAAM,CAAa;IACnB,YAAY,CAAS;IACrB,IAAI,CAAoB;IACxB,UAAU,CAAqD;IAC/D,MAAM,CAAqD;IAC3D,YAAY,CAA6B;IAElD,YAAY,IAAoM;QAC9M,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;YAAE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QAC3E,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;CACF"}

package/dist/ports/codec.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Portable JSON codec interface. Core logic imports this port, not
+ * JSON.stringify/JSON.parse directly. Implementations control key
+ * ordering, whitespace, and determinism.
+ */
+export interface JsonCodec {
+    encode(value: unknown): string;
+    decode(data: string): unknown;
+}
+//# sourceMappingURL=codec.d.ts.map

package/dist/ports/codec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codec.d.ts","sourceRoot":"","sources":["../../src/ports/codec.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC;IAC/B,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;CAC/B"}

package/dist/ports/codec.js

@@ -0,0 +1,5 @@
+// ---------------------------------------------------------------------------
+// JsonCodec port — hexagonal boundary for JSON serialization
+// ---------------------------------------------------------------------------
+export {};
+//# sourceMappingURL=codec.js.map

package/dist/ports/codec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codec.js","sourceRoot":"","sources":["../../src/ports/codec.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,6DAA6D;AAC7D,8EAA8E"}

package/dist/ports/filesystem.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Portable filesystem interface. Core logic imports this port, not node:fs.
+ * Node adapter implements it; tests can substitute a mock.
+ */
+export interface FileSystem {
+    readFile(path: string, encoding: "utf-8"): Promise<string>;
+    readFile(path: string): Promise<Buffer>;
+    readdir(path: string): Promise<string[]>;
+    writeFile(path: string, data: string, encoding: "utf-8"): Promise<void>;
+    appendFile(path: string, data: string, encoding: "utf-8"): Promise<void>;
+    mkdir(path: string, options: {
+        recursive: true;
+    }): Promise<void>;
+    stat(path: string): Promise<{
+        size: number;
+    }>;
+    readFileSync(path: string, encoding: "utf-8"): string;
+}
+//# sourceMappingURL=filesystem.d.ts.map

package/dist/ports/filesystem.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem.d.ts","sourceRoot":"","sources":["../../src/ports/filesystem.ts"],"names":[],"mappings":"AAIA;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACzC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,SAAS,EAAE,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9C,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;CACvD"}

package/dist/ports/filesystem.js

@@ -0,0 +1,5 @@
+// ---------------------------------------------------------------------------
+// FileSystem port — hexagonal boundary for file I/O
+// ---------------------------------------------------------------------------
+export {};
+//# sourceMappingURL=filesystem.js.map

package/dist/ports/filesystem.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem.js","sourceRoot":"","sources":["../../src/ports/filesystem.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,oDAAoD;AACpD,8EAA8E"}

package/dist/ports/git.d.ts

@@ -0,0 +1,11 @@
+import type { ProcessRunResult } from "./process-runner.js";
+export interface GitRunRequest {
+    readonly args: readonly string[];
+    readonly cwd: string;
+    readonly timeoutMs?: number;
+    readonly maxBufferBytes?: number;
+}
+export interface GitClient {
+    run(request: GitRunRequest): Promise<ProcessRunResult>;
+}
+//# sourceMappingURL=git.d.ts.map

package/dist/ports/git.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../../src/ports/git.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,SAAS;IACxB,GAAG,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACxD"}

package/dist/ports/git.js

@@ -0,0 +1,5 @@
+// ---------------------------------------------------------------------------
+// GitClient port — hexagonal boundary for git command execution
+// ---------------------------------------------------------------------------
+export {};
+//# sourceMappingURL=git.js.map

package/dist/ports/git.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.js","sourceRoot":"","sources":["../../src/ports/git.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,gEAAgE;AAChE,8EAA8E"}

package/dist/ports/guards.d.ts

@@ -0,0 +1,15 @@
+import type { FileSystem } from "./filesystem.js";
+import type { JsonCodec } from "./codec.js";
+/**
+ * Validate that an object satisfies the FileSystem port contract at
+ * runtime. Call this at adapter construction boundaries to catch
+ * broken mocks and incomplete implementations early.
+ */
+export declare function assertFileSystem(impl: unknown): asserts impl is FileSystem;
+/**
+ * Validate that an object satisfies the JsonCodec port contract at
+ * runtime. Call this at adapter construction boundaries to catch
+ * broken mocks and incomplete implementations early.
+ */
+export declare function assertJsonCodec(impl: unknown): asserts impl is JsonCodec;
+//# sourceMappingURL=guards.d.ts.map

package/dist/ports/guards.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guards.d.ts","sourceRoot":"","sources":["../../src/ports/guards.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AA4B5C;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,IAAI,UAAU,CAW1E;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,IAAI,SAAS,CAWxE"}

package/dist/ports/guards.js

@@ -0,0 +1,43 @@
+// ---------------------------------------------------------------------------
+// Port runtime guards — construction-time validation for port adapters
+// ---------------------------------------------------------------------------
+const FILESYSTEM_METHODS = [
+    "readFile",
+    "readdir",
+    "writeFile",
+    "appendFile",
+    "mkdir",
+    "stat",
+    "readFileSync",
+];
+const CODEC_METHODS = ["encode", "decode"];
+function assertMethodsPresent(portName, impl, methods) {
+    for (const method of methods) {
+        if (typeof impl[method] !== "function") {
+            throw new TypeError(`${portName} adapter missing method: ${method} (got ${typeof impl[method]})`);
+        }
+    }
+}
+/**
+ * Validate that an object satisfies the FileSystem port contract at
+ * runtime. Call this at adapter construction boundaries to catch
+ * broken mocks and incomplete implementations early.
+ */
+export function assertFileSystem(impl) {
+    if (impl === null || typeof impl !== "object") {
+        throw new TypeError(`FileSystem adapter must be an object (got ${impl === null ? "null" : typeof impl})`);
+    }
+    assertMethodsPresent("FileSystem", impl, FILESYSTEM_METHODS);
+}
+/**
+ * Validate that an object satisfies the JsonCodec port contract at
+ * runtime. Call this at adapter construction boundaries to catch
+ * broken mocks and incomplete implementations early.
+ */
+export function assertJsonCodec(impl) {
+    if (impl === null || typeof impl !== "object") {
+        throw new TypeError(`JsonCodec adapter must be an object (got ${impl === null ? "null" : typeof impl})`);
+    }
+    assertMethodsPresent("JsonCodec", impl, CODEC_METHODS);
+}
+//# sourceMappingURL=guards.js.map

package/dist/ports/guards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guards.js","sourceRoot":"","sources":["../../src/ports/guards.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,uEAAuE;AACvE,8EAA8E;AAK9E,MAAM,kBAAkB,GAAG;IACzB,UAAU;IACV,SAAS;IACT,WAAW;IACX,YAAY;IACZ,OAAO;IACP,MAAM;IACN,cAAc;CACN,CAAC;AAEX,MAAM,aAAa,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAEpD,SAAS,oBAAoB,CAC3B,QAAgB,EAChB,IAA6B,EAC7B,OAA0B;IAE1B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC;YACvC,MAAM,IAAI,SAAS,CACjB,GAAG,QAAQ,4BAA4B,MAAM,SAAS,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAC7E,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAa;IAC5C,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAI,SAAS,CACjB,6CAA6C,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,GAAG,CACrF,CAAC;IACJ,CAAC;IACD,oBAAoB,CAClB,YAAY,EACZ,IAA+B,EAC/B,kBAAkB,CACnB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAa;IAC3C,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAI,SAAS,CACjB,4CAA4C,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,GAAG,CACpF,CAAC;IACJ,CAAC;IACD,oBAAoB,CAClB,WAAW,EACX,IAA+B,EAC/B,aAAa,CACd,CAAC;AACJ,CAAC"}

package/dist/ports/process-runner.d.ts

@@ -0,0 +1,17 @@
+export interface ProcessRunRequest {
+    readonly command: string;
+    readonly args: readonly string[];
+    readonly cwd: string;
+    readonly timeoutMs?: number;
+    readonly maxBufferBytes?: number;
+}
+export interface ProcessRunResult {
+    readonly status: number | null;
+    readonly stdout: string;
+    readonly stderr: string;
+    readonly error?: Error;
+}
+export interface ProcessRunner {
+    run(request: ProcessRunRequest): ProcessRunResult;
+}
+//# sourceMappingURL=process-runner.d.ts.map

package/dist/ports/process-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-runner.d.ts","sourceRoot":"","sources":["../../src/ports/process-runner.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,OAAO,EAAE,iBAAiB,GAAG,gBAAgB,CAAC;CACnD"}

package/dist/ports/process-runner.js

@@ -0,0 +1,5 @@
+// ---------------------------------------------------------------------------
+// ProcessRunner port — hexagonal boundary for command execution
+// ---------------------------------------------------------------------------
+export {};
+//# sourceMappingURL=process-runner.js.map

package/dist/ports/process-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-runner.js","sourceRoot":"","sources":["../../src/ports/process-runner.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,gEAAgE;AAChE,8EAA8E"}

package/dist/ports/warp.d.ts

@@ -0,0 +1,45 @@
+export interface WarpObserverLens {
+    readonly match: string | readonly string[];
+    readonly expose?: readonly string[] | undefined;
+    readonly redact?: readonly string[] | undefined;
+}
+export interface WarpObserverOptions {
+    readonly source?: {
+        readonly kind: "live";
+        readonly ceiling: number | null;
+    } | undefined;
+}
+export interface WarpEdge {
+    readonly from: string;
+    readonly to: string;
+    readonly label: string;
+}
+export interface WarpObserver {
+    getNodes(): Promise<string[]>;
+    getNodeProps(nodeId: string): Promise<Record<string, unknown> | null>;
+    getEdges(): Promise<readonly WarpEdge[]>;
+}
+export interface WarpPatchBuilder {
+    addNode(id: string): unknown;
+    setProperty(id: string, key: string, value: unknown): unknown;
+    addEdge(from: string, to: string, label: string): unknown;
+    removeNode(id: string): unknown;
+    removeEdge(from: string, to: string, label: string): unknown;
+}
+export interface WarpMaterializeReceiptOp {
+    readonly op: string;
+    readonly result: string;
+    readonly target: string;
+}
+export interface WarpMaterializeReceipt {
+    readonly lamport: number;
+    readonly ops: readonly WarpMaterializeReceiptOp[];
+}
+export interface WarpHandle {
+    hasNode(nodeId: string): Promise<boolean>;
+    observer(lens: WarpObserverLens, options?: WarpObserverOptions): Promise<WarpObserver>;
+    patch(build: (patch: WarpPatchBuilder) => void | Promise<void>): Promise<string>;
+    materialize(): Promise<void>;
+    materializeReceipts(): Promise<readonly WarpMaterializeReceipt[]>;
+}
+//# sourceMappingURL=warp.d.ts.map

package/dist/ports/warp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"warp.d.ts","sourceRoot":"","sources":["../../src/ports/warp.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CACjD;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;KACjC,GAAG,SAAS,CAAC;CACf;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9B,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IACtE,QAAQ,IAAI,OAAO,CAAC,SAAS,QAAQ,EAAE,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;IAC7B,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;IAC9D,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1D,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;IAChC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAC9D;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,SAAS,wBAAwB,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,gBAAgB,EAAE,OAAO,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACvF,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjF,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,mBAAmB,IAAI,OAAO,CAAC,SAAS,sBAAsB,EAAE,CAAC,CAAC;CACnE"}

package/dist/ports/warp.js

@@ -0,0 +1,5 @@
+// ---------------------------------------------------------------------------
+// WARP port — hexagonal boundary for graph reads and writes
+// ---------------------------------------------------------------------------
+export {};
+//# sourceMappingURL=warp.js.map

package/dist/ports/warp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"warp.js","sourceRoot":"","sources":["../../src/ports/warp.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,4DAA4D;AAC5D,8EAA8E"}

package/dist/release/security-gate.d.ts

@@ -0,0 +1,24 @@
+export interface SecurityGateViolation {
+    readonly id: number;
+    readonly moduleName: string;
+    readonly severity: "high" | "critical";
+    readonly title: string;
+    readonly advisoryId: string | null;
+    readonly recommendation: string;
+    readonly paths: readonly string[];
+    readonly versions: readonly string[];
+}
+export interface SecurityGateResult {
+    readonly blocking: boolean;
+    readonly counts: {
+        readonly info: number;
+        readonly low: number;
+        readonly moderate: number;
+        readonly high: number;
+        readonly critical: number;
+    };
+    readonly blockingFindings: readonly SecurityGateViolation[];
+}
+export declare function evaluateSecurityGate(report: unknown): SecurityGateResult;
+export declare function formatSecurityGateResult(result: SecurityGateResult): string;
+//# sourceMappingURL=security-gate.d.ts.map

package/dist/release/security-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-gate.d.ts","sourceRoot":"","sources":["../../src/release/security-gate.ts"],"names":[],"mappings":"AA4BA,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF,QAAQ,CAAC,gBAAgB,EAAE,SAAS,qBAAqB,EAAE,CAAC;CAC7D;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,kBAAkB,CAyBxE;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CAuB3E"}