@gate-forge/core 0.1.0

package/dist/config/index.js

@@ -0,0 +1,523 @@
+/**
+ * `.gateforge.yml` loading and validation (pin #6).
+ *
+ * Fail-closed by design: a missing file, unparsable YAML, an unknown
+ * `schemaVersion`, or any schema violation raises
+ * {@link GateforgeConfigError} carrying actionable diagnostics — each
+ * with the source file, a JSON path, and expected-vs-got detail.
+ * Exit code for this failure class is 2 (config/usage error).
+ */
+import { readFileSync } from 'node:fs';
+import { parse as parseYaml } from 'yaml';
+import { SchemaVersionField, TransportSchema } from '../schemas/common.js';
+import { CoveragePolicySchema } from '../schemas/coverage-policy.js';
+import { z } from 'zod';
+/**
+ * A plugin entry in `.gateforge.yml`. Unlike a run-manifest plugin
+ * registration, a config entry also declares HOW to launch the plugin:
+ * `subprocess` plugins get `command` (argv, run without network);
+ * `in-process` plugins get `module` (a TS module specifier).
+ */
+export const ConfigPluginSchema = z
+    .object({
+    /** Plugin id, e.g. `gateforge.pack-sqlalchemy`. */
+    id: z.string().min(1),
+    /** Declared plugin version (handshake-checked at spawn, pin #5). */
+    version: z.string().min(1),
+    /** Transport over the plugin boundary (ADR 0002). */
+    transport: TransportSchema,
+    /** argv to spawn (subprocess transport only), executed with no network. */
+    command: z.array(z.string().min(1)).min(1).optional(),
+    /** Module specifier to import (in-process transport only). */
+    module: z.string().min(1).optional(),
+})
+    .strict()
+    .superRefine((plugin, ctx) => {
+    // Issuer reservation (ADR 0003 D2/D6): `gateforge.core` is the
+    // ENGINE's suppressive-signal authority. A plugin configured under
+    // that id would let ordinary plugin output forge engine-issued
+    // declarations, so the id is reserved at config validation — the
+    // engine is not a configurable plugin.
+    if (plugin.id === 'gateforge.core') {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['id'],
+            message: "plugin id 'gateforge.core' is reserved: suppressive classification authority is engine-issued, never plugin-issued",
+        });
+    }
+    if (plugin.transport === 'subprocess') {
+        if (plugin.command === undefined) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['command'],
+                message: `subprocess plugin '${plugin.id}' requires 'command' (argv to spawn)`,
+            });
+        }
+        if (plugin.module !== undefined) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['module'],
+                message: `subprocess plugin '${plugin.id}' must not declare 'module' (in-process only)`,
+            });
+        }
+    }
+    else {
+        if (plugin.module === undefined) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['module'],
+                message: `in-process plugin '${plugin.id}' requires 'module' (module specifier to import)`,
+            });
+        }
+        if (plugin.command !== undefined) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['command'],
+                message: `in-process plugin '${plugin.id}' must not declare 'command' (subprocess only)`,
+            });
+        }
+    }
+});
+/**
+ * Enforcement-mode configuration (plan 2026-09-13 §3.4/§3.3, ADR 0005
+ * D1/D4). OPTIONAL and off by default — enabling strict E2E is an
+ * explicit, tracked owner decision.
+ */
+export const EnforcementConfigSchema = z
+    .object({
+    /**
+     * `standard` = local hook + mandatory trusted server check (honest
+     * about --no-verify); `managed` = authoritative commit broker outside
+     * the agent's write/process boundary. Later phases enforce this; the
+     * value is recorded here from Phase 0 on.
+     */
+    mode: z.enum(['standard', 'managed']).default('standard'),
+    /**
+     * Strict E2E mode (plan §3.3): when true, a waived or baselined
+     * in-scope E2E obligation is NOT proof and cannot authorize the
+     * change — the gate reports it blocking (ENFORCEMENT_UNTRUSTED), and
+     * required contracts whose proof channel is unavailable fail the
+     * setup closed (preflight capability validation).
+     */
+    strictE2E: z.boolean().default(false),
+    /**
+     * The OWNER-APPROVED policy revision digest (ADR 0005 D6 enforcement):
+     * the `trustedPolicyDigest` value the owner pinned as the approved
+     * policy revision. Gates compare the candidate's recomputed digest
+     * against it, so a candidate that edits classifiers, exclusions,
+     * waivers, baselines, or coverage cannot authorize its own weaker
+     * checks.
+     *
+     * TRUST BOUNDARY: this value must NEVER come from candidate-controlled
+     * files in strict mode. It is honored only when the config document
+     * carrying it lives OUTSIDE the candidate repository (loaded through
+     * the explicit `GATEFORGE_TRUSTED_CONFIG` path) or when the digest is
+     * provisioned through `GATEFORGE_APPROVED_POLICY_DIGEST` /
+     * `--approved-policy-digest`. Declaring it in the candidate's own
+     * `.gateforge.yml` is never a trusted source: strict gates block with
+     * ENFORCEMENT_UNTRUSTED instead of honoring it.
+     */
+    approvedPolicyDigest: z
+        .string()
+        .regex(/^[0-9a-f]{64}$/, 'approvedPolicyDigest must be 64-char lowercase hex')
+        .optional(),
+})
+    .strict();
+/**
+ * One configured diagnostic suite (plan 2026-09-13 §3.5, phase 2 item
+ * 8): an EXISTING suite the owner registers for the advisory "red means
+ * inspect this" alarm. Gateforge never discovers suites on its own — no
+ * directory scans, no executing commands found on disk; everything comes
+ * from this explicit, tracked configuration.
+ *
+ * Only `pytest` is accepted today: other runners stay explicitly
+ * unsupported until an adapter exists (plan phase 2 item 6) — a typo'd
+ * or aspirational runner name must fail the config load, not silently
+ * disable a suite.
+ */
+export const DiagnosticSuiteSchema = z
+    .object({
+    /** Suite name used in reports and commands, e.g. `backend-pytest`. */
+    name: z.string().min(1),
+    /** The only runner with an adapter today (fail closed otherwise). */
+    runner: z.enum(['pytest']),
+    /** Repo-root-relative working directory the argv runs in. */
+    cwd: z.string().min(1),
+    /**
+     * Interpreter + args, e.g. `['python', '-m', 'pytest']`. The adapter
+     * appends collection/report flags; it never executes anything beyond
+     * this configured argv.
+     */
+    argv: z.array(z.string().min(1)).min(1),
+    /**
+     * Paths handed to the runner VERBATIM (suite-`cwd`-relative), e.g.
+     * `['tests']`. The adapter never widens them: gateforge never scans
+     * directories the owner did not name here.
+     */
+    testPaths: z.array(z.string().min(1)).min(1),
+    /** Finite wall-clock bound for one adapter invocation (seconds). */
+    timeoutMs: z.number().int().min(1),
+})
+    .strict();
+/**
+ * The `diagnostics` config section (plan §3.5): registered diagnostic
+ * suites. ABSENT = no diagnostic suites (the default; the alarm is
+ * opt-in and never a commit blocker by itself).
+ */
+export const DiagnosticsConfigSchema = z
+    .object({
+    /** Explicitly registered diagnostic suites. */
+    suites: z.array(DiagnosticSuiteSchema),
+})
+    .strict()
+    .superRefine((diagnostics, ctx) => {
+    // Duplicate suite names would make `tests diagnose --suite <name>`
+    // and per-suite reporting ambiguous — reject at config load.
+    const seen = new Set();
+    for (let index = 0; index < diagnostics.suites.length; index += 1) {
+        const name = diagnostics.suites[index]?.name;
+        if (name === undefined)
+            continue;
+        if (seen.has(name)) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['suites', index, 'name'],
+                message: `duplicate diagnostic suite name '${name}': suite selection must be unambiguous`,
+            });
+        }
+        seen.add(name);
+    }
+});
+/**
+ * The `.gateforge.yml` document schema (pin #6). All paths are
+ * repo-root-relative. Unknown keys are rejected — a typo must fail the
+ * config load, not silently disable a subsystem.
+ */
+export const GateforgeConfigSchema = z
+    .object({
+    schemaVersion: SchemaVersionField,
+    /** Project-wide discovery settings. */
+    project: z
+        .object({
+        /** Languages detectors should run for, e.g. ['python']. */
+        languages: z.array(z.string().min(1)).min(1),
+        /** Path filters applied to discovery. */
+        paths: z
+            .object({
+            /** Globs to include. */
+            include: z.array(z.string().min(1)).min(1),
+            /** Globs to exclude. */
+            exclude: z.array(z.string().min(1)),
+        })
+            .strict(),
+    })
+        .strict(),
+    /** Plugin set: subprocess (GPP/3) and in-process detectors. */
+    plugins: z.array(ConfigPluginSchema),
+    /** Path to the policies YAML document. */
+    policies: z.string().min(1),
+    /**
+     * Path to the classification-policy YAML document (plan phase 5,
+     * ADR 0003 D5): repository-wide deterministic classification rules.
+     * Effective classifications are computed from detector signals on
+     * every run; there is no manual classifications document.
+     */
+    classificationPolicy: z.string().min(1),
+    /** Directory of reviewed evidence adapters (.mjs, engine-loaded). */
+    adapters: z.string().min(1),
+    /** Directory of waiver documents. */
+    waivers: z.string().min(1),
+    /** Path to the baseline document (`.gateforge/baselines/obligations.json`). */
+    baselines: z.string().min(1),
+    /** Changed-file provider selection (architecture contract 5). */
+    changed: z
+        .object({
+        provider: z.enum(['auto', 'local-staged', 'github-pr', 'gitlab-mr']),
+    })
+        .strict(),
+    /** Witness service bounds. */
+    witness: z
+        .object({
+        /** Upper bound for a single witness call, in seconds. */
+        maxDurationSeconds: z.number().int().min(1),
+    })
+        .strict(),
+    /** Clock selection: system time, or a fixed instant for determinism. */
+    clock: z
+        .object({
+        mode: z.enum(['system', 'fixed']),
+        /** Required with mode 'fixed'; meaningless otherwise (rejected). */
+        fixedAt: z.iso.datetime().optional(),
+    })
+        .strict()
+        .superRefine((clock, ctx) => {
+        if (clock.mode === 'fixed' && clock.fixedAt === undefined) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['fixedAt'],
+                message: "clock.mode 'fixed' requires 'fixedAt' (ISO-8601 instant)",
+            });
+        }
+        if (clock.mode === 'system' && clock.fixedAt !== undefined) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['fixedAt'],
+                message: "'fixedAt' is only valid with clock.mode 'fixed'",
+            });
+        }
+    }),
+    /**
+     * Enforcement modes (plan 2026-09-13 §3.3/§3.4, ADR 0005 D1/D4).
+     * ABSENT = feature off (standard mode, strict E2E off) so existing
+     * configs keep their exact behavior; enabling strict E2E is opt-in.
+     */
+    enforcement: EnforcementConfigSchema.optional(),
+    /**
+     * Closed-world CRUD coverage policy (plan 2026-09-13 §3.6, ADR 0005
+     * D5): tracked, owner-owned enumeration of user-facing tables with
+     * required operations and owner dispositions. ABSENT/empty = feature
+     * off (opt-in). Validated against the current run's resource
+     * inventory on every run when present.
+     */
+    coveragePolicy: CoveragePolicySchema.optional(),
+    /**
+     * Registered diagnostic suites (plan 2026-09-13 §3.5). ABSENT = no
+     * suites; the advisory alarm is opt-in via explicit, tracked
+     * configuration — gateforge never scans for or launches anything the
+     * owner did not register here.
+     */
+    diagnostics: DiagnosticsConfigSchema.optional(),
+})
+    .strict();
+/** Error raised for any fail-closed config problem. */
+export class GateforgeConfigError extends Error {
+    /** All collected diagnostics (first is the primary cause). */
+    diagnostics;
+    /**
+     * Builds the error from diagnostics.
+     *
+     * Args:
+     *   diagnostics: nonempty list of actionable diagnostics.
+     */
+    constructor(diagnostics) {
+        super(formatDiagnostics(diagnostics));
+        this.name = 'GateforgeConfigError';
+        this.diagnostics = diagnostics;
+    }
+}
+/**
+ * Renders a diagnostic input value compactly for `got` fields.
+ *
+ * Args:
+ *   value: the offending value from the parsed document.
+ *
+ * Returns:
+ *   string: single-line, length-capped rendering of the value.
+ */
+function renderGot(value) {
+    let rendered;
+    if (typeof value === 'string') {
+        rendered = JSON.stringify(value);
+    }
+    else if (value === undefined) {
+        rendered = 'undefined';
+    }
+    else {
+        try {
+            rendered = JSON.stringify(value) ?? String(value);
+        }
+        catch {
+            rendered = String(value);
+        }
+    }
+    return rendered.length > 80 ? `${rendered.slice(0, 77)}...` : rendered;
+}
+/**
+ * Converts a zod issue path to a JSONPath-style string (`$.a.b[0]`).
+ *
+ * Args:
+ *   path: zod issue path segments.
+ *
+ * Returns:
+ *   string: JSON path with a leading `$`.
+ */
+export function jsonPathFor(path) {
+    let out = '$';
+    for (const segment of path) {
+        out += typeof segment === 'number' ? `[${String(segment)}]` : `.${String(segment)}`;
+    }
+    return out;
+}
+/**
+ * Reads the offending value out of the original document by issue path.
+ * Zod v4 issues do not carry the rejected input, so we recover it here.
+ *
+ * Args:
+ *   input: the original parsed document handed to the schema.
+ *   path: zod issue path segments.
+ *
+ * Returns:
+ *   unknown: the value at the path, or undefined when unreachable.
+ */
+function valueAtPath(input, path) {
+    let current = input;
+    for (const segment of path) {
+        if (current === null || typeof current !== 'object') {
+            return undefined;
+        }
+        current = current[segment];
+    }
+    return current;
+}
+/**
+ * Extracts the "expected" detail from a zod issue when available:
+ * enum/literal issues carry `values`, type issues carry `expected`.
+ *
+ * Args:
+ *   issue: the zod issue.
+ *
+ * Returns:
+ *   string | undefined: rendered expectation, when the issue has one.
+ */
+function expectedFromIssue(issue) {
+    const record = issue;
+    const values = record['values'];
+    if (Array.isArray(values) && values.length > 0) {
+        return values.map((value) => JSON.stringify(value)).join(' | ');
+    }
+    return typeof record['expected'] === 'string' ? record['expected'] : undefined;
+}
+/**
+ * Converts zod issues into actionable config diagnostics.
+ *
+ * Args:
+ *   error: failed zod result error.
+ *   file: file name to attach to every diagnostic.
+ *   input: the original parsed document, used to recover got-values.
+ *
+ * Returns:
+ *   ConfigDiagnostic[]: one diagnostic per issue, same order.
+ */
+export function diagnosticsFromZodError(error, file, input) {
+    return error.issues.map((issue) => {
+        const gotValue = input === undefined ? undefined : valueAtPath(input, issue.path);
+        return {
+            file,
+            jsonPath: jsonPathFor(issue.path),
+            message: issue.message,
+            expected: expectedFromIssue(issue),
+            got: gotValue === undefined ? undefined : renderGot(gotValue),
+        };
+    });
+}
+/**
+ * Formats diagnostics into the multi-line message users see.
+ *
+ * Args:
+ *   diagnostics: diagnostics to render.
+ *
+ * Returns:
+ *   string: human-readable, single-cause-first listing.
+ */
+export function formatDiagnostics(diagnostics) {
+    const head = diagnostics.length === 1
+        ? 'invalid gateforge config (1 error)'
+        : `invalid gateforge config (${String(diagnostics.length)} errors)`;
+    const lines = diagnostics.map((diagnostic) => {
+        const parts = [diagnostic.file, diagnostic.jsonPath, diagnostic.message];
+        if (diagnostic.expected !== undefined) {
+            parts.push(`expected: ${diagnostic.expected}`);
+        }
+        if (diagnostic.got !== undefined) {
+            parts.push(`got: ${diagnostic.got}`);
+        }
+        return `  - ${parts.filter((part) => part.length > 0).join(': ')}`;
+    });
+    return [head, ...lines].join('\n');
+}
+/**
+ * Validates an already-parsed config document against the schema.
+ *
+ * Args:
+ *   input: parsed YAML/JSON document (an unknown value).
+ *   file: source file name for diagnostics (default '<inline>').
+ *
+ * Returns:
+ *   GateforgeConfig: the validated config.
+ *
+ * Raises:
+ *   GateforgeConfigError: on any schema violation, including unknown
+ *   schemaVersion (never migrated) and unknown keys (typos fail loud).
+ */
+export function parseConfig(input, { file = '<inline>' } = {}) {
+    // Migration diagnostic (plan phase 5): the authoritative manual
+    // classifications document was removed in the automatic-classification
+    // cutover. Fail with the exact migration steps, never a generic
+    // unknown-key error.
+    if (input !== null && typeof input === 'object' && 'classifications' in input) {
+        throw new GateforgeConfigError([
+            {
+                file,
+                jsonPath: '$.classifications',
+                message: "config key 'classifications' was removed: classification is now automatic. " +
+                    "Delete the key and add `classificationPolicy: .gateforge/classification-policy.yml` " +
+                    '(create it with `gateforge init`); its scanRoots gate every closed-world proof. ' +
+                    'Per-resource entries became `gateforge classify --write-snapshot` output ' +
+                    '(a derived artifact — never authoritative input) or source declarations.',
+            },
+        ]);
+    }
+    const result = GateforgeConfigSchema.safeParse(input);
+    if (result.success) {
+        return result.data;
+    }
+    throw new GateforgeConfigError(diagnosticsFromZodError(result.error, file, input));
+}
+/**
+ * Loads and validates `.gateforge.yml` from disk. Fail-closed: a missing
+ * file, unparsable YAML, or schema violations all raise
+ * {@link GateforgeConfigError} with actionable diagnostics.
+ *
+ * Args:
+ *   path: config file path (default '.gateforge.yml').
+ *
+ * Returns:
+ *   GateforgeConfig: the validated config.
+ *
+ * Raises:
+ *   GateforgeConfigError: for missing/unreadable/unparsable/invalid config.
+ */
+export function loadConfig(path = '.gateforge.yml') {
+    let raw;
+    try {
+        raw = readFileSync(path, 'utf8');
+    }
+    catch (cause) {
+        const code = cause.code ?? 'UNKNOWN';
+        const hint = code === 'ENOENT'
+            ? 'run the init command or pass an explicit config path'
+            : 'check file permissions';
+        throw new GateforgeConfigError([
+            {
+                file: path,
+                jsonPath: '$',
+                message: `cannot read config file (${code}); ${hint}`,
+            },
+        ]);
+    }
+    let document;
+    try {
+        document = parseYaml(raw);
+    }
+    catch (cause) {
+        throw new GateforgeConfigError([
+            {
+                file: path,
+                jsonPath: '$',
+                message: `invalid YAML: ${cause.message.split('\n')[0] ?? 'parse error'}`,
+            },
+        ]);
+    }
+    return parseConfig(document, { file: path });
+}
+//# sourceMappingURL=index.js.map

package/dist/config/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,mDAAmD;IACnD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,oEAAoE;IACpE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,qDAAqD;IACrD,SAAS,EAAE,eAAe;IAC1B,2EAA2E;IAC3E,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrD,8DAA8D;IAC9D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrC,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC3B,+DAA+D;IAC/D,mEAAmE;IACnE,+DAA+D;IAC/D,iEAAiE;IACjE,uCAAuC;IACvC,IAAI,MAAM,CAAC,EAAE,KAAK,gBAAgB,EAAE,CAAC;QACnC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,IAAI,CAAC;YACZ,OAAO,EACL,oHAAoH;SACvH,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,YAAY,EAAE,CAAC;QACtC,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACjC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,SAAS,CAAC;gBACjB,OAAO,EAAE,sBAAsB,MAAM,CAAC,EAAE,sCAAsC;aAC/E,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,QAAQ,CAAC;gBAChB,OAAO,EAAE,sBAAsB,MAAM,CAAC,EAAE,+CAA+C;aACxF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,QAAQ,CAAC;gBAChB,OAAO,EAAE,sBAAsB,MAAM,CAAC,EAAE,kDAAkD;aAC3F,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACjC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,SAAS,CAAC;gBACjB,OAAO,EAAE,sBAAsB,MAAM,CAAC,EAAE,gDAAgD;aACzF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAKL;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN;;;;;OAKG;IACH,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IACzD;;;;;;OAMG;IACH,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACrC;;;;;;;;;;;;;;;;OAgBG;IACH,oBAAoB,EAAE,CAAC;SACpB,MAAM,EAAE;SACR,KAAK,CAAC,gBAAgB,EAAE,oDAAoD,CAAC;SAC7E,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,sEAAsE;IACtE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,qEAAqE;IACrE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC1B,6DAA6D;IAC7D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB;;;;OAIG;IACH,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC;;;;OAIG;IACH,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,oEAAoE;IACpE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACnC,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,+CAA+C;IAC/C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;CACvC,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE;IAChC,mEAAmE;IACnE,6DAA6D;IAC7D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC;QAC7C,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QACjC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC;gBAC/B,OAAO,EAAE,oCAAoC,IAAI,wCAAwC;aAC1F,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;AACH,CAAC,CAAC,CAAC;AAKL;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,aAAa,EAAE,kBAAkB;IACjC,uCAAuC;IACvC,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,2DAA2D;QAC3D,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5C,yCAAyC;QACzC,KAAK,EAAE,CAAC;aACL,MAAM,CAAC;YACN,wBAAwB;YACxB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1C,wBAAwB;YACxB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACpC,CAAC;aACD,MAAM,EAAE;KACZ,CAAC;SACD,MAAM,EAAE;IACX,+DAA+D;IAC/D,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;IACpC,0CAA0C;IAC1C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B;;;;;OAKG;IACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,qEAAqE;IACrE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,qCAAqC;IACrC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,+EAA+E;IAC/E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,iEAAiE;IACjE,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;KACrE,CAAC;SACD,MAAM,EAAE;IACX,8BAA8B;IAC9B,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,yDAAyD;QACzD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC5C,CAAC;SACD,MAAM,EAAE;IACX,wEAAwE;IACxE,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjC,oEAAoE;QACpE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KACrC,CAAC;SACD,MAAM,EAAE;SACR,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1B,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,SAAS,CAAC;gBACjB,OAAO,EAAE,0DAA0D;aACpE,CAAC,CAAC;QACL,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC3D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,SAAS,CAAC;gBACjB,OAAO,EAAE,iDAAiD;aAC3D,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IACJ;;;;OAIG;IACH,WAAW,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAC/C;;;;;;OAMG;IACH,cAAc,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IAC/C;;;;;OAKG;IACH,WAAW,EAAE,uBAAuB,CAAC,QAAQ,EAAE;CAChD,CAAC;KACD,MAAM,EAAE,CAAC;AAqBZ,uDAAuD;AACvD,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,8DAA8D;IACrD,WAAW,CAAqB;IAEzC;;;;;OAKG;IACH,YAAY,WAA+B;QACzC,KAAK,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,QAAgB,CAAC;IACrB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;SAAM,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,QAAQ,GAAG,WAAW,CAAC;IACzB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AACzE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,IAAmB;IAC7C,IAAI,GAAG,GAAG,GAAG,CAAC;IACd,KAAK,MAAM,OAAO,IAAI,IAAI,EAAE,CAAC;QAC3B,GAAG,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;IACtF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,WAAW,CAAC,KAAc,EAAE,IAAmB;IACtD,IAAI,OAAO,GAAY,KAAK,CAAC;IAC7B,KAAK,MAAM,OAAO,IAAI,IAAI,EAAE,CAAC;QAC3B,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,GAAI,OAAwC,CAAC,OAAO,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,iBAAiB,CAAC,KAAiB;IAC1C,MAAM,MAAM,GAAG,KAA2C,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACjF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAAiB,EACjB,IAAY,EACZ,KAAe;IAEf,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAChC,MAAM,QAAQ,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAClF,OAAO;YACL,IAAI;YACJ,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC;YACjC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,iBAAiB,CAAC,KAAK,CAAC;YAClC,GAAG,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC;SAC9D,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAA+B;IAC/D,MAAM,IAAI,GACR,WAAW,CAAC,MAAM,KAAK,CAAC;QACtB,CAAC,CAAC,oCAAoC;QACtC,CAAC,CAAC,6BAA6B,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC;IACxE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;QACzE,IAAI,UAAU,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,aAAa,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,UAAU,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,QAAQ,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACrE,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,WAAW,CACzB,KAAc,EACd,EAAE,IAAI,GAAG,UAAU,KAAwB,EAAE;IAE7C,gEAAgE;IAChE,uEAAuE;IACvE,gEAAgE;IAChE,qBAAqB;IACrB,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,IAAI,KAAK,EAAE,CAAC;QAC9E,MAAM,IAAI,oBAAoB,CAAC;YAC7B;gBACE,IAAI;gBACJ,QAAQ,EAAE,mBAAmB;gBAC7B,OAAO,EACL,6EAA6E;oBAC7E,sFAAsF;oBACtF,kFAAkF;oBAClF,2EAA2E;oBAC3E,0EAA0E;aAC7E;SACF,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IACD,MAAM,IAAI,oBAAoB,CAAC,uBAAuB,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AACrF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,UAAU,CAAC,IAAI,GAAG,gBAAgB;IAChD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,IAAI,SAAS,CAAC;QAChE,MAAM,IAAI,GACR,IAAI,KAAK,QAAQ;YACf,CAAC,CAAC,sDAAsD;YACxD,CAAC,CAAC,wBAAwB,CAAC;QAC/B,MAAM,IAAI,oBAAoB,CAAC;YAC7B;gBACE,IAAI,EAAE,IAAI;gBACV,QAAQ,EAAE,GAAG;gBACb,OAAO,EAAE,4BAA4B,IAAI,MAAM,IAAI,EAAE;aACtD;SACF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,oBAAoB,CAAC;YAC7B;gBACE,IAAI,EAAE,IAAI;gBACV,QAAQ,EAAE,GAAG;gBACb,OAAO,EAAE,iBAAkB,KAAe,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,aAAa,EAAE;aACrF;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,WAAW,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAC/C,CAAC"}

package/dist/fingerprints.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Obligation fingerprint (pin #2): the stable identity a baseline stores.
+ *
+ * `fingerprint(obligation-ish) = sha256(GF-canonical-JSON of
+ * {resourceId, contract, policyId, lifecycle})` where `lifecycle` is the
+ * classification lifecycle relevant to that contract. Key order in the
+ * input is irrelevant — canonical JSON sorts keys before hashing.
+ */
+import { z } from 'zod';
+import { type BlockingEntry } from './policy/evaluate.js';
+/** Exactly the identity fields hashed into an obligation fingerprint. */
+export declare const FingerprintInputSchema: z.ZodObject<{
+    resourceId: z.ZodString;
+    contract: z.ZodString;
+    policyId: z.ZodString;
+    lifecycle: z.ZodObject<{
+        create: z.ZodBoolean;
+        read: z.ZodBoolean;
+        update: z.ZodBoolean;
+        delete: z.ZodBoolean;
+        deleteSemantics: z.ZodOptional<z.ZodEnum<{
+            hard: "hard";
+            archive: "archive";
+        }>>;
+        archiveFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+        updateableFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+/** Inferred fingerprint-input shape. */
+export type FingerprintInput = z.infer<typeof FingerprintInputSchema>;
+/**
+ * Computes the obligation fingerprint (pin #2).
+ *
+ * Args:
+ *   input: the obligation identity — resourceId, contract, policyId,
+ *     and the relevant lifecycle attributes.
+ *
+ * Returns:
+ *   string: 64-char lowercase sha256 hex over the GF-canonical-JSON of
+ *   the identity object. Stable across key order and process runs.
+ */
+export declare function fingerprint(input: FingerprintInput): string;
+/**
+ * The BLOCKING-ENTRY fingerprint (phase 8 workstream C): the stable
+ * identity a baseline stores for gate red that is not an obligation —
+ * unclassified/unresolved resources, detector/graph findings, and stale
+ * references. sha256 over the GF-canonical-JSON of the whole entry
+ * (kind, resourceId, name, detail, location): any change to the cause —
+ * including wording or location of the underlying problem — mints a NEW
+ * fingerprint, which the baseline does not contain, which blocks again.
+ * That is the fail-closed direction: the adoption baseline forgives the
+ * debt exactly as it stood at adoption; anything that shifts must be
+ * re-proven, never re-forgiven (the baseline is shrink-only).
+ */
+export declare function blockingEntryFingerprint(entry: BlockingEntry): string;
+//# sourceMappingURL=fingerprints.d.ts.map

package/dist/fingerprints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprints.d.ts","sourceRoot":"","sources":["../src/fingerprints.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE/E,yEAAyE;AACzE,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;kBAcxB,CAAC;AAEZ,wCAAwC;AACxC,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAE3D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAErE"}

package/dist/fingerprints.js

@@ -0,0 +1,59 @@
+/**
+ * Obligation fingerprint (pin #2): the stable identity a baseline stores.
+ *
+ * `fingerprint(obligation-ish) = sha256(GF-canonical-JSON of
+ * {resourceId, contract, policyId, lifecycle})` where `lifecycle` is the
+ * classification lifecycle relevant to that contract. Key order in the
+ * input is irrelevant — canonical JSON sorts keys before hashing.
+ */
+import { z } from 'zod';
+import { sha256Canonical } from './canonical-json.js';
+import { ContractNameSchema } from './schemas/common.js';
+import { LifecycleSchema } from './schemas/classification.js';
+import { BlockingEntrySchema } from './policy/evaluate.js';
+/** Exactly the identity fields hashed into an obligation fingerprint. */
+export const FingerprintInputSchema = z
+    .object({
+    /** Resource the obligation attaches to (no colons). */
+    resourceId: z
+        .string()
+        .min(1)
+        .regex(/^[^:]+$/, "resourceId must not contain ':'"),
+    /** Contract name, e.g. `crud:update`. */
+    contract: ContractNameSchema,
+    /** Policy id that generated the obligation. */
+    policyId: z.string().min(1),
+    /** Classification lifecycle attributes relevant to the contract. */
+    lifecycle: LifecycleSchema,
+})
+    .strict();
+/**
+ * Computes the obligation fingerprint (pin #2).
+ *
+ * Args:
+ *   input: the obligation identity — resourceId, contract, policyId,
+ *     and the relevant lifecycle attributes.
+ *
+ * Returns:
+ *   string: 64-char lowercase sha256 hex over the GF-canonical-JSON of
+ *   the identity object. Stable across key order and process runs.
+ */
+export function fingerprint(input) {
+    return sha256Canonical(FingerprintInputSchema.parse(input));
+}
+/**
+ * The BLOCKING-ENTRY fingerprint (phase 8 workstream C): the stable
+ * identity a baseline stores for gate red that is not an obligation —
+ * unclassified/unresolved resources, detector/graph findings, and stale
+ * references. sha256 over the GF-canonical-JSON of the whole entry
+ * (kind, resourceId, name, detail, location): any change to the cause —
+ * including wording or location of the underlying problem — mints a NEW
+ * fingerprint, which the baseline does not contain, which blocks again.
+ * That is the fail-closed direction: the adoption baseline forgives the
+ * debt exactly as it stood at adoption; anything that shifts must be
+ * re-proven, never re-forgiven (the baseline is shrink-only).
+ */
+export function blockingEntryFingerprint(entry) {
+    return sha256Canonical(BlockingEntrySchema.parse(entry));
+}
+//# sourceMappingURL=fingerprints.js.map

package/dist/fingerprints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprints.js","sourceRoot":"","sources":["../src/fingerprints.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAsB,MAAM,sBAAsB,CAAC;AAE/E,yEAAyE;AACzE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,uDAAuD;IACvD,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,KAAK,CAAC,SAAS,EAAE,iCAAiC,CAAC;IACtD,yCAAyC;IACzC,QAAQ,EAAE,kBAAkB;IAC5B,+CAA+C;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,oEAAoE;IACpE,SAAS,EAAE,eAAe;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ;;;;;;;;;;GAUG;AACH,MAAM,UAAU,WAAW,CAAC,KAAuB;IACjD,OAAO,eAAe,CAAC,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAoB;IAC3D,OAAO,eAAe,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AAC3D,CAAC"}