@getarbiter/cli 0.5.0

package/dist/templates/static-analysis/spotbugs-exclude.xml.ejs

@@ -0,0 +1,120 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  <%= projectName %> SpotBugs exclude filter — generated by arbiter (M29)
+
+  POLICY:
+  - Security-category patterns are NEVER suppressed (injection, traversal, crypto, authentication).
+  - Framework false-positives (NP_NONNULL_FIELD, EI_EXPOSE_REP, MS_SHOULD_BE_FINAL) are narrowly
+    suppressed by class name pattern only, never by bug code alone.
+
+  Re-generate: arbiter update
+-->
+<FindBugsFilter>
+
+  <!--
+    Framework false-positives: Spring/CDI inject null checks
+    @Autowired / @Inject fields are initialized by DI container — SpotBugs cannot see this.
+    Suppressed ONLY for classes matching DI naming patterns.
+  -->
+  <Match>
+    <Bug code="NP_NONNULL_FIELD"/>
+    <Class name="~.*\.(service|handler|controller|repository|adapter|config|configuration)\.[A-Z].*"/>
+  </Match>
+
+  <!--
+    Framework false-positives: exposing mutable objects via getters
+    Collections returned from DI-managed beans are often intentionally mutable.
+    Suppressed ONLY for classes matching DI naming patterns.
+  -->
+  <Match>
+    <Bug code="EI_EXPOSE_REP"/>
+    <Class name="~.*\.(dto|model|entity|response|request)\.[A-Z].*"/>
+  </Match>
+  <Match>
+    <Bug code="EI_EXPOSE_REP2"/>
+    <Class name="~.*\.(dto|model|entity|response|request)\.[A-Z].*"/>
+  </Match>
+
+  <!--
+    Framework false-positives: static final fields initialized via static block
+    Lombok @FieldDefaults(level = AccessLevel.PRIVATE, makeFinal = true) patterns.
+  -->
+  <Match>
+    <Bug code="MS_SHOULD_BE_FINAL"/>
+    <Class name="~.*\.(constant|constants|config|configuration)\.[A-Z].*"/>
+  </Match>
+
+  <!--
+    Null safety with @NonNullApi annotations
+    Package-level @NonNullApi marks params non-null by default; Spring callbacks
+    and mapping methods may legally receive or pass null in specific patterns.
+    Suppressed ONLY for classes that explicitly document nullable parameters.
+  -->
+  <Match>
+    <Or>
+      <Class name="~.*\.(service|controller|adapter|mapper|config|entity|repository)\.[A-Z].*"/>
+    </Or>
+    <Or>
+      <Bug pattern="NP_NONNULL_PARAM_VIOLATION"/>
+      <Bug pattern="NP_PARAMETER_MUST_BE_NONNULL_BUT_MARKED_AS_NULLABLE"/>
+      <Bug pattern="RCN_REDUNDANT_NULLCHECK_OF_NONNULL_VALUE"/>
+    </Or>
+  </Match>
+
+  <!--
+    Optional.orElseThrow() and similar safe null-navigation patterns
+    SpotBugs cannot trace through Optional chains; these are safe by design.
+  -->
+  <Match>
+    <Or>
+      <Class name="~.*\.(service|controller)\.[A-Z].*"/>
+    </Or>
+    <Bug pattern="NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE"/>
+  </Match>
+
+  <!--
+    Constructor validation (Records, Value Objects, Services)
+    Throwing in compact record constructors and service precondition guards
+    is intentional fail-fast behaviour, not a bug.
+  -->
+  <Match>
+    <Or>
+      <Class name="~.*\.(domain\.model|domain\.vo|dto|request|response|command|query)\.[A-Z].*"/>
+    </Or>
+    <Bug pattern="CT_CONSTRUCTOR_THROW"/>
+  </Match>
+
+  <!--
+    Config/Properties unread fields
+    Spring Boot @ConfigurationProperties binds fields via reflection; PMD/SpotBugs
+    cannot see the binding and reports them as unread.
+  -->
+  <Match>
+    <Or>
+      <Class name="~.*\.(config|configuration|properties)\.[A-Z].*"/>
+    </Or>
+    <Bug pattern="URF_UNREAD_FIELD"/>
+  </Match>
+
+  <!--
+    Test helper utilities — targeted, not blanket
+    Test fixture/helper/config classes may have unread public fields used
+    only by test framework reflection (JUnit @Rule, Spring @MockBean, etc.).
+  -->
+  <Match>
+    <Or>
+      <Class name="~.*TestConfig"/>
+      <Class name="~.*TestHelper"/>
+      <Class name="~.*TestFixture"/>
+    </Or>
+    <Bug pattern="URF_UNREAD_PUBLIC_OR_PROTECTED_FIELD"/>
+  </Match>
+
+  <!--
+    SECURITY PATTERNS — NEVER SUPPRESSED
+    Injection, traversal, and all security-category bug codes must never appear
+    as Match entries in this file. Any suppression of security findings requires
+    a separate documented decision with an expiry date.
+  -->
+
+</FindBugsFilter>

package/dist/templates/static-analysis/spotbugs.gradle.ejs

@@ -0,0 +1,18 @@
+// spotbugs.gradle — generated by arbiter
+// Task report configuration only. The plugin declaration AND the extension
+// config (effort/reportLevel/excludeFilter) live in the root build's
+// arbiter-managed block: applied scripts cannot declare plugins (Gradle forbids
+// the plugins DSL here) and cannot see the plugin classpath either
+// (script-plugin classloader isolation — the Effort/Confidence enums do not
+// resolve from this file).
+// Re-generate: arbiter update
+
+spotbugsMain {
+    reports {
+        xml {
+            required = true
+            outputLocation = layout.buildDirectory.file('reports/spotbugs/main.xml')
+        }
+        html { required = false }
+    }
+}

package/dist/templates/static-analysis/spotless.gradle.ejs

@@ -0,0 +1,38 @@
+// <%= projectName %> Spotless formatting — generated by arbiter (M29)
+// Wired automatically: arbiter declares the com.diffplug.spotless plugin in the
+// root build's plugins block and applies this script from the arbiter-managed
+// block (a plugins {} block here would be ILLEGAL — Gradle forbids the plugins
+// DSL inside applied scripts).
+// Gate: ./gradlew spotlessCheck (L1 — hard fail)
+// Fix: ./gradlew spotlessApply
+// Re-generate: arbiter update
+
+spotless {
+<%_ if (locals.spotlessRatchetFrom) { _%>
+    // Brownfield ratchet: enforce formatting ONLY on files changed since
+    // <%= spotlessRatchetFrom %>. Legacy files untouched since that ref pass the
+    // gate unformatted; touching one requires formatting it. Delete this line to
+    // enforce formatting repo-wide (after a one-off ./gradlew spotlessApply).
+    ratchetFrom '<%= spotlessRatchetFrom %>'
+<%_ } _%>
+    java {
+        // Google Java Format — production-grade formatting baseline
+        googleJavaFormat('1.22.0').aosp()
+
+        // Remove unused imports (complementary to Checkstyle)
+        removeUnusedImports()
+
+        // Trim trailing whitespace
+        trimTrailingWhitespace()
+
+        // Ensure newline at end of file
+        endWithNewline()
+
+        // Target all Java source sets
+        target 'src/**/*.java'
+    }
+}
+
+// Wire spotlessCheck into the standard check lifecycle
+// so that ./gradlew check enforces formatting
+check.dependsOn spotlessCheck

package/dist/templates/static-analysis/stylelintrc.json.ejs

@@ -0,0 +1,16 @@
+<%# #352 stylelint design-token enforcement (HARD). Core stylelint rules only —
+    no `extends`/plugins — so it enforces tokens without flooding a brownfield
+    project with general-CSS findings. Emitted by frontend-quality.ts for
+    frontend-spa / frontend-lane targets; the lint:css gate runs it (gate-on-present). -%>
+{
+  "rules": {
+    "color-no-hex": [
+      true,
+      {
+        "message": "Use a var(--color-*) token from src/styles/theme.css, not a raw hex color. See docs/PRODUCT/UI-UX-STANDARDS.md."
+      }
+    ],
+    "length-zero-no-unit": true,
+    "custom-property-no-missing-var-function": true
+  }
+}

package/dist/templates/suppressions/archunit-baseline.json.ejs

@@ -0,0 +1 @@
+[]

package/dist/templates/suppressions/consumer-audit-allowlist.json.ejs

@@ -0,0 +1 @@
+[]

package/dist/templates/suppressions/gitleaksignore.ejs

@@ -0,0 +1,20 @@
+# <%= projectName %> — Gitleaks suppression list
+# Managed by arbiter. Do not remove this file.
+#
+# MANDATORY FORMAT: every suppression fingerprint MUST be immediately preceded by
+# a metadata comment in this exact format (pipe-separated, single line):
+#
+#   # reason: <10+ chars — include a tracking issue URL> | owner: @github-handle | expiresAt: YYYY-MM-DD | scope: commit-hash-or-all
+#   <fingerprint-or-commit-hash>
+#
+# Rules enforced by scripts/check-suppressions.mjs on every L1 commit:
+# - All four fields (reason, owner, expiresAt, scope) are mandatory
+# - expiresAt must be a future date — expired entries block the gate
+# - Warnings appear for entries expiring within 30 days
+# - There are no permanent suppressions — max recommended expiry: 12 months
+#
+# To add a suppression:
+# 1. Run: gitleaks detect --report-format json | jq '.[].Fingerprint'
+# 2. Add the metadata comment immediately before the fingerprint
+# 3. Set expiresAt to when the fixture/test secret will be removed (≤12 months)
+# 4. Reference the tracking issue in reason

package/dist/templates/suppressions/pii-allowlist.json.ejs

@@ -0,0 +1 @@
+[]

package/dist/templates/suppressions/suppressions-schema.json.ejs

@@ -0,0 +1,39 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "suppressions-schema.json",
+  "title": <%- JSON.stringify(`${projectName} Suppressions`) %>,
+  "description": "Schema for pii-allowlist.json and archunit-baseline.json: a top-level array of suppression entries. All entry fields are mandatory. Expiry is enforced by check-suppressions.mjs on every L1 commit.",
+  "type": "array",
+  "items": {
+    "$ref": "#/definitions/SuppressionEntry"
+  },
+  "definitions": {
+    "SuppressionEntry": {
+      "type": "object",
+      "required": ["reason", "owner", "expiresAt", "scope"],
+      "additionalProperties": false,
+      "properties": {
+        "reason": {
+          "type": "string",
+          "minLength": 10,
+          "description": "Why this suppression exists. Include a tracking issue URL."
+        },
+        "owner": {
+          "type": "string",
+          "pattern": "^@[a-zA-Z0-9-]+$",
+          "description": "GitHub handle of the person responsible for this suppression."
+        },
+        "expiresAt": {
+          "type": "string",
+          "format": "date",
+          "description": "ISO 8601 date (YYYY-MM-DD) after which this suppression must be removed or renewed."
+        },
+        "scope": {
+          "type": "string",
+          "minLength": 1,
+          "description": "What this suppression covers (package name, CVE ID, class pattern, or 'all')."
+        }
+      }
+    }
+  }
+}

package/dist/templates/suppressions/trivyignore.ejs

@@ -0,0 +1,17 @@
+# .trivyignore — Trivy vulnerability suppressions
+# Generated by arbiter. Edit to add project-specific suppressions.
+#
+# POLICY — The following vulnerability categories MUST NOT be suppressed
+# without a documented security exception approved by the security team:
+#   SQL_INJECTION, XSS, COMMAND_INJECTION, LDAP_INJECTION, HARD_CODE_PASSWORD
+#
+# MANDATORY FORMAT (INV-31): every suppression entry MUST be a single line —
+#   <CVE-ID> exp:<YYYY-MM-DD> # reason=<10+ chars, reference a tracking issue> owner=@<github-handle>
+#
+# The check-suppressions.mjs gate validates every entry on every L1 commit.
+# Entries with a past exp: date fail the gate — there are no permanent
+# suppressions. Entries missing reason/owner fail the gate too.
+#
+# Example:
+# CVE-2023-XXXXX exp:2026-12-31 # reason=False positive, only affects containerized deployments (#1234) owner=@yourhandle
+

package/dist/templates/testing/test-taxonomy.md.ejs

@@ -0,0 +1,120 @@
+# Test Taxonomy — <%= projectName %>
+
+<!-- arbiter-managed: test-pyramid-profile-26d (INV-89, #883) -->
+<!-- Archetype: <%= archetype %> -->
+
+This document defines the 26-dimension test taxonomy for **<%= projectName %>**.
+Each level maps to a CI stage in `ci.yml` and a check in `scripts/check-all.mjs`.
+
+---
+
+## Pyramid Levels
+
+| Level | Description | Tools |
+|-------|-------------|-------|
+<% for (const level of levels) { -%>
+| **<%= level.name %>** | <%= level.description %> | `<%= level.tools %>` |
+<% } %>
+
+---
+
+## Conventions
+
+- **L1 tests** run on every commit (pre-commit hook via `scripts/check-all.mjs L1`).
+- **L2+ tests** run on push/PR (`scripts/check-all.mjs L2`).
+- Test files live next to the code they test (co-located) or in a top-level `tests/` directory.
+- Every public function/method must have at least one test.
+<% if (hasContainerIntegration) { %>
+- Testcontainers are the preferred integration harness — no mocked DB connections in integration tests.
+<% } %><% if (hasPropertyTests) { %>
+- Property-based tests must cover all public API inputs. Use `fast-check` / `Hypothesis` / `proptest`.
+<% } %><% if (hasE2ETests) { %>
+- E2E tests run headless in CI (Playwright recommended).
+<% } %>
+
+---
+
+## Test Type Codes
+
+| Code | Name | Description |
+|------|------|-------------|
+| **UT** | Unit Test | Pure function / class isolation — no I/O, no DB (INV-26) |
+| **IT** | Integration Test | Two or more real collaborators (DB, queue, cache) — Testcontainers where applicable |
+| **AU** | API / Contract Unit | HTTP boundary — input validation, error contracts, OpenAPI parity (INV-47) |
+| **ST** | System / E2E Test | Full stack — real infra, real browser (Playwright) where applicable |
+| **SC** | Scenario / BDD Test | Gherkin scenarios — cross-module behavior from the user's perspective |
+| **SN** | Snapshot Test | Golden-file / snapshot regressions — UI, serialisation, report output |
+| **E2E** | End-to-End Test | Alias for ST; used when framing is user-journey centric |
+
+---
+
+## Universal Quality Dimensions (26)
+
+Every test level must address the applicable subset of the 26 universal dimensions below.
+Primary codes indicate which test type most naturally covers each dimension.
+
+### Core (1–17)
+
+| # | Dimension | Primary Code | INV Reference |
+|---|-----------|-------------|---------------|
+| 1 | Owner isolation — tenant/user data cannot bleed across boundaries | IT / AU | INV-19 |
+| 2 | RBAC — role permissions enforced at every endpoint and query | AU / IT | INV-19 |
+| 3 | Input validation — all public inputs validated; invalid inputs rejected with correct status | AU / UT | INV-47 |
+| 4 | Error contracts — error codes, messages, and HTTP status are stable and documented | AU | INV-47 |
+| 5 | OpenAPI parity — generated/written spec matches actual handler behaviour | AU | INV-47 |
+| 6 | Pagination — list endpoints honour page/limit/cursor; no unbounded scans | AU / IT | INV-14 |
+| 7 | Idempotency — mutating operations safe to retry (PUT / PATCH / DELETE) | AU / IT | INV-14 |
+| 8 | Migration integrity — DB migrations are reversible and tested in CI | IT | INV-30 |
+| 9 | Observability — structured logs emitted for all error paths; spans created for I/O | UT / IT | INV-17 |
+| 10 | Perf / N+1 — no N+1 queries; latency budgets asserted in integration layer | IT | INV-14 |
+| 11 | Failure recovery — circuit-breakers, retries, and fallbacks exercised | IT / ST | INV-17 |
+| 12 | DTO roundtrip — serialise → deserialise identity holds for every public DTO | UT / AU | INV-47 |
+| 13 | Entity–schema parity — ORM entity fields match DB column types | IT | INV-30 |
+| 14 | Cross-module ref integrity — FK/ref constraints never violated in test fixtures | IT | INV-30 |
+| 15 | Profile security — user profile data never returned to wrong owner | AU / IT | INV-19 |
+| 16 | Backward compat — existing clients unaffected by new release (schema + API) | AU / ST | INV-47 |
+| 17 | Contract test coverage — published consumer contracts verified per deploy | AU | INV-48 |
+
+### Compliance & Industrial (18–25)
+
+| # | Dimension | Primary Code | Reference |
+|---|-----------|-------------|-----------|
+| 18 | Audit trail — state-mutation events logged with actor, resource, and timestamp | IT / AU | GDPR Art.30, ISO 27001 A.12.4 |
+| 19 | PII masking — sensitive data absent from logs, traces, and error responses | IT / UT | GDPR Art.5, INV-19 |
+| 20 | Rate limiting — throttle limits enforced at endpoint boundary; burst and sustained tested | AU / IT | OWASP ASVS 4.0 §13 |
+| 21 | Session / token lifecycle — tokens expire, rotate, and invalidate on logout | AU / IT | OWASP ASVS 3.x |
+| 22 | Event delivery — async consumers are idempotent; dead-letter queue routing tested | IT | NIS2 Art.21 |
+| 23 | Graceful degradation — circuit-breaker/fallback responses when external dependencies fail | IT / ST | INV-17 |
+| 24 | SLA assertion — p95 latency within declared budget under sustained load | ST | ISO 27001 A.12.1.3 |
+| 25 | Security surface — OWASP Top-10 attack inputs rejected at each public endpoint | AU / ST | OWASP Top-10, INV-19 |
+| 26 | Concurrency — race-free state mutation; deadlock and livelock detection; lock ordering discipline; concurrent data-structure correctness | IT / UT | INV-14 |
+
+<% const _domainDims = (typeof domainDims !== 'undefined' && Array.isArray(domainDims)) ? domainDims : [] %><% if (_domainDims.length > 0) { %>
+
+### Domain-Specific Dimensions
+
+The following dimensions are project-specific (sourced from `arbiter.json` `taxonomy.domainDims[]`):
+
+<% for (const dim of _domainDims) { %>- `<%= dim %>`
+<% } %>
+<% } %>
+
+---
+
+## Decision Matrix — Change Type → Required Dimensions
+
+| Change Type | Mandatory Dimensions | Recommended Codes |
+|-------------|----------------------|-------------------|
+| New API endpoint | 1–5, 16, 25 | AU + IT |
+| New DB entity / migration | 8, 13, 14 | IT |
+| Auth / permission change | 1, 2, 15, 21, 25 | AU + IT |
+| New list / search endpoint | 6, 10 | AU + IT |
+| Mutating endpoint (create/update/delete) | 7, 14, 18 | AU + IT |
+| New public DTO / schema | 4, 5, 12, 16 | AU + UT |
+| External service integration | 11, 22, 23 | IT + ST |
+| Background job / worker | 9, 11, 22 | IT |
+| UI feature | 3, 4, 19 | SN + ST |
+| Cross-module feature | 14, 15 | IT + SC |
+| Compliance / audit feature | 18, 19, 25 | IT + AU |
+| High-traffic endpoint | 20, 24 | AU + ST |
+| Shared-state / concurrent feature | 26 | IT + UT |

package/dist/test/example.behavioral.test.js

@@ -0,0 +1,2 @@
+// SPDX-License-Identifier: Apache-2.0
+import{describe,it,expect}from"vitest";describe("exampleSubject",()=>{describe("given a valid input",()=>{it("when processed, returns the expected result",()=>{const result="hello".toUpperCase();expect(result).toBe("HELLO")}),it("when chained, transforms correctly",()=>{const result="  hello  ".trim().toUpperCase();expect(result).toBe("HELLO")})}),describe("given an empty input",()=>{it("when processed, returns empty string",()=>{const result="".toUpperCase();expect(result).toBe("")})})});

package/dist/types/memory.d.ts

@@ -0,0 +1,19 @@
+/**
+ * ArbiterMemoryPlugin — interface for pluggable memory backends.
+ *
+ * @beta API is public but not stable. Breaking changes possible before v1.0.
+ *
+ * This interface is plugin-only: core arbiter modules must not import it.
+ * Implement this interface in a plugin package and inject it via PluginContext.
+ */
+export interface ArbiterMemoryPlugin {
+    /** Persist a value under the given key. */
+    store(key: string, value: unknown): Promise<void>;
+    /** Retrieve a previously stored value, or undefined if not found. */
+    retrieve(key: string): Promise<unknown>;
+    /** Search stored entries by a string query; returns matching key/value pairs. */
+    search(query: string): Promise<Array<{
+        key: string;
+        value: unknown;
+    }>>;
+}

package/dist/types/memory.js

@@ -0,0 +1 @@
+export{};

package/dist/types/plan.d.ts

@@ -0,0 +1,102 @@
+import { z } from 'zod';
+export declare const PlanJsonV1: z.ZodObject<{
+    task_id: z.ZodString;
+    scope: z.ZodObject<{
+        track: z.ZodEnum<{
+            C: "C";
+            A: "A";
+            B: "B";
+            D: "D";
+        }>;
+        boundaries: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        paths: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>;
+    files: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        operation: z.ZodEnum<{
+            create: "create";
+            modify: "modify";
+            delete: "delete";
+        }>;
+        changes: z.ZodOptional<z.ZodObject<{
+            adds_ui_strings: z.ZodOptional<z.ZodBoolean>;
+            ui_strings: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            adds_tests: z.ZodOptional<z.ZodBoolean>;
+            modifies_tests: z.ZodOptional<z.ZodBoolean>;
+            skip_patterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            adds_todos: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    invariants: z.ZodOptional<z.ZodObject<{
+        ui_language: z.ZodOptional<z.ZodLiteral<"EN">>;
+        no_skips: z.ZodOptional<z.ZodLiteral<true>>;
+    }, z.core.$strip>>;
+    invariant_ids: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    notes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    review_bridge: z.ZodObject<{
+        enabled: z.ZodBoolean;
+        reviewer: z.ZodDefault<z.ZodString>;
+        fail_on_warn: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type PlanJsonV1 = z.infer<typeof PlanJsonV1>;
+export declare const ReviewStatus: z.ZodEnum<{
+    APPROVED: "APPROVED";
+    REJECTED: "REJECTED";
+    SKIPPED: "SKIPPED";
+    ERROR: "ERROR";
+}>;
+export type ReviewStatus = z.infer<typeof ReviewStatus>;
+declare const ViolationSchema: z.ZodObject<{
+    rule_id: z.ZodString;
+    severity: z.ZodEnum<{
+        WARN: "WARN";
+        ERROR: "ERROR";
+    }>;
+    message: z.ZodString;
+    ssot_pointer: z.ZodNullable<z.ZodObject<{
+        path: z.ZodString;
+        anchor: z.ZodString;
+    }, z.core.$strip>>;
+    evidence: z.ZodObject<{
+        paths: z.ZodArray<z.ZodString>;
+        match: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type Violation = z.infer<typeof ViolationSchema>;
+export declare const ReviewJsonV1: z.ZodObject<{
+    timestamp: z.ZodString;
+    task_id: z.ZodString;
+    run_id: z.ZodString;
+    status: z.ZodEnum<{
+        APPROVED: "APPROVED";
+        REJECTED: "REJECTED";
+        SKIPPED: "SKIPPED";
+        ERROR: "ERROR";
+    }>;
+    reviewer: z.ZodString;
+    verification: z.ZodObject<{
+        ok: z.ZodBoolean;
+        violations: z.ZodArray<z.ZodObject<{
+            rule_id: z.ZodString;
+            severity: z.ZodEnum<{
+                WARN: "WARN";
+                ERROR: "ERROR";
+            }>;
+            message: z.ZodString;
+            ssot_pointer: z.ZodNullable<z.ZodObject<{
+                path: z.ZodString;
+                anchor: z.ZodString;
+            }, z.core.$strip>>;
+            evidence: z.ZodObject<{
+                paths: z.ZodArray<z.ZodString>;
+                match: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>;
+        }, z.core.$strip>>;
+        notes: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>;
+    blocking: z.ZodBoolean;
+    blocking_reason: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type ReviewJsonV1 = z.infer<typeof ReviewJsonV1>;
+export {};

package/dist/types/plan.js

@@ -0,0 +1,2 @@
+// SPDX-License-Identifier: Apache-2.0
+import{z}from"zod";const FileChanges=z.object({adds_ui_strings:z.boolean().optional(),ui_strings:z.array(z.string()).optional(),adds_tests:z.boolean().optional(),modifies_tests:z.boolean().optional(),skip_patterns:z.array(z.string()).optional(),adds_todos:z.array(z.string()).optional()}),PlanFile=z.object({path:z.string(),operation:z.enum(["create","modify","delete"]),changes:FileChanges.optional()}),ReviewBridge=z.object({enabled:z.boolean(),reviewer:z.string().default("bridge-reviewer"),fail_on_warn:z.boolean().default(!1)});export const PlanJsonV1=z.object({task_id:z.string().regex(/^#\d+$/),scope:z.object({track:z.enum(["A","B","C","D"]),boundaries:z.array(z.string()).optional(),paths:z.array(z.string()).optional()}),files:z.array(PlanFile),invariants:z.object({ui_language:z.literal("EN").optional(),no_skips:z.literal(!0).optional()}).optional(),invariant_ids:z.array(z.string().regex(/^INV-\d+$/)).optional(),notes:z.array(z.string()).optional(),review_bridge:ReviewBridge}),ReviewStatus=z.enum(["APPROVED","REJECTED","SKIPPED","ERROR"]);const ViolationSchema=z.object({rule_id:z.string(),severity:z.enum(["ERROR","WARN"]),message:z.string(),ssot_pointer:z.object({path:z.string(),anchor:z.string()}).nullable(),evidence:z.object({paths:z.array(z.string()),match:z.string().optional()})});export const ReviewJsonV1=z.object({timestamp:z.string(),task_id:z.string(),run_id:z.string(),status:ReviewStatus,reviewer:z.string(),verification:z.object({ok:z.boolean(),violations:z.array(ViolationSchema),notes:z.array(z.string())}),blocking:z.boolean(),blocking_reason:z.string().nullable()});

package/dist/types/plugin.d.ts

@@ -0,0 +1,45 @@
+import type { ArbiterConfig } from '../utils/config.js';
+import type { VerifyPlanRule } from '../verify/rules/types.js';
+import type { ArbiterMemoryPlugin } from './memory.js';
+import type { Invariant } from '../invariants/types.js';
+/**
+ * @beta API is public but not stable. Breaking changes possible before v1.0.
+ */
+export interface ArbiterPlugin {
+    name: string;
+    apiVersion: '1';
+    templateRoot: string;
+    detect?(config: ArbiterConfig): boolean | Promise<boolean>;
+    generate(ctx: PluginContext): PluginResult | Promise<PluginResult>;
+    verifyPlanRules?: VerifyPlanRule[];
+    /**
+     * #2035 (TC-5): stack-preset invariants contributed by the plugin (PROJ-NN
+     * namespace). Merged into the project's invariants by the host (config-declared
+     * projectInvariants win on id conflict — deterministic precedence).
+     */
+    invariants?: Invariant[];
+}
+/**
+ * @beta API is public but not stable. Breaking changes possible before v1.0.
+ */
+export interface PluginContext {
+    config: ArbiterConfig;
+    targetDir: string;
+    renderTemplate(relPath: string, data: Record<string, unknown>): string;
+    /** Optional memory backend injected by the host when a memory plugin is configured. */
+    memory?: ArbiterMemoryPlugin;
+}
+/**
+ * @beta API is public but not stable. Breaking changes possible before v1.0.
+ */
+export interface PluginFile {
+    path: string;
+    content: string;
+    action?: 'create' | 'backup-and-replace' | 'skip';
+}
+/**
+ * @beta API is public but not stable. Breaking changes possible before v1.0.
+ */
+export interface PluginResult {
+    files: PluginFile[];
+}

package/dist/types/plugin.js

@@ -0,0 +1 @@
+export{};

package/dist/utils/canon-loader.js

@@ -0,0 +1,2 @@
+// SPDX-License-Identifier: Apache-2.0
+import{readFileSync}from"node:fs";export function loadCanonEntries(canonMdPath){let raw;try{raw=readFileSync(canonMdPath,"utf-8")}catch(err){if(err.code==="ENOENT")return[];throw new Error(`Failed to read CANON.md at ${canonMdPath}: ${err instanceof Error?err.message:String(err)}`,{cause:err})}const entries=[],sections=raw.split(/\n(?=## CANON-\d+)/);for(const section of sections){const headerMatch=section.match(/^## (CANON-\d+) — (.+)/);if(!headerMatch)continue;const id=headerMatch[1]??"",title=(headerMatch[2]??"").trim(),entry={id,title,rule:extractField(section,"Rule"),why:extractField(section,"Why"),enforcement:extractField(section,"Enforcement")},si=extractOptionalField(section,"Source issues");si!==void 0&&(entry.sourceIssues=si);const pt=extractOptionalField(section,"Promoted to");pt!==void 0&&(entry.promotedTo=pt),entries.push(entry)}return entries}function extractField(section,fieldName){const safeField=fieldName.replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),pattern=new RegExp(`\\*\\*${safeField}:\\*\\*\\s*([\\s\\S]*?)(?=\\n\\*\\*|\\n---\\n|$)`,"i"),match=section.match(pattern);return match?(match[1]??"").trim():""}function extractOptionalField(section,fieldName){const value=extractField(section,fieldName);return value.length>0?value:void 0}

package/dist/utils/channel.js

@@ -0,0 +1 @@
+const VALID_CHANNELS=new Set(["latest","beta","canary"]);export const CHANNEL_STABILITY={latest:0,beta:1,canary:2};function assertValidChannel(value,context){if(!VALID_CHANNELS.has(value))throw new Error(`invalid channel ${context}: "${value}" \u2014 must be one of latest, beta, canary`)}export function resolveChannel(opts){return opts.flag!==void 0?(assertValidChannel(opts.flag,"flag"),{value:opts.flag,source:"flag"}):opts.config!==void 0?(assertValidChannel(opts.config,"config"),{value:opts.config,source:"config"}):{value:"latest",source:"default"}}export function needsDowngradeWarn(opts){return opts.flag===void 0||opts.configChannel===void 0?!1:CHANNEL_STABILITY[opts.flag]>CHANNEL_STABILITY[opts.configChannel]}