@getarbiter/cli 0.5.0

package/dist/kit/measure.js

@@ -0,0 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+import{existsSync,lstatSync,readdirSync,readFileSync,statSync}from"node:fs";import{join,relative}from"node:path";import{toFsError}from"../utils/fs.js";let diagnosticErrors=0;const workflowCache=new Map,pkgCache=new Map;export function clearMeasureCache(){workflowCache.clear(),pkgCache.clear(),diagnosticErrors=0}const SKIP_DIRS=new Set(["node_modules",".git","dist","target","build",".gradle","vendor","__pycache__",".mypy_cache",".ruff_cache",".next","out","coverage",".nyc_output"]),EVIDENCE_CAP=20;function toPosixRelative(repoRoot,absPath){return relative(repoRoot,absPath).replace(/\\/g,"/")}function readPkgJson(repoRoot){const cached=pkgCache.get(repoRoot);if(cached!==void 0)return cached;const pkgPath=join(repoRoot,"package.json");if(!existsSync(pkgPath))return pkgCache.set(repoRoot,null),null;try{const raw=readFileSync(pkgPath,"utf8"),parsed=JSON.parse(raw);return pkgCache.set(repoRoot,parsed),parsed}catch{return pkgCache.set(repoRoot,null),null}}function hasDep(pkg,name){if(!pkg)return!1;const deps=pkg.dependencies??{},devDeps=pkg.devDependencies??{},peerDeps=pkg.peerDependencies??{};return name in deps||name in devDeps||name in peerDeps}function hasScript(pkg,key){if(!pkg)return!1;const scripts=pkg.scripts??{};return key in scripts}function fileContains(absPath,pattern){try{const st=statSync(absPath);if(!st.isFile()||st.size>1048576)return st.size>1048576&&process.stderr.write(`[measure] skipping large file: ${absPath}
+`),!1;const content=readFileSync(absPath,"utf8");return typeof pattern=="string"?content.includes(pattern):pattern.test(content)}catch{return!1}}function visitEntry(full,entry,matchFn,remainingDepth,results){let st;try{st=lstatSync(full)}catch{return}st.isDirectory()?findRecursive(full,matchFn,remainingDepth-1,results):matchFn(entry)&&results.push(full)}function findRecursive(dir,matchFn,remainingDepth=12,results=[]){if(remainingDepth<0||results.length>=EVIDENCE_CAP)return results;let entries;try{entries=readdirSync(dir)}catch{return results}for(const entry of entries){if(results.length>=EVIDENCE_CAP)break;SKIP_DIRS.has(entry)||visitEntry(join(dir,entry),entry,matchFn,remainingDepth,results)}return results}function checkAny(repoRoot,relPaths){const found=[];for(const rel of relPaths){if(found.length>=EVIDENCE_CAP)break;const abs=join(repoRoot,rel);existsSync(abs)&&found.push(rel.replace(/\\/g,"/"))}return found.length===0?{status:"missing",evidence:[]}:{status:"present",evidence:found}}function checkDir(repoRoot,relDir,extFilter){const abs=join(repoRoot,relDir);if(!existsSync(abs))return{status:"missing",evidence:[]};let entries;try{entries=readdirSync(abs)}catch{return{status:"missing",evidence:[]}}const matching=entries.filter(f=>extFilter?f.endsWith(extFilter):!0).filter(f=>{try{return statSync(join(abs,f)).isFile()}catch{return!1}}).slice(0,EVIDENCE_CAP).map(f=>toPosixRelative(repoRoot,join(abs,f)));return matching.length===0?{status:"missing",evidence:[]}:{status:"present",evidence:matching}}function readWorkflowFile(abs){try{const st=statSync(abs);return!st.isFile()||st.size>1048576?null:readFileSync(abs,"utf8")}catch{return null}}function workflowsMatchingPattern(repoRoot,pattern){let repoMap=workflowCache.get(repoRoot);if(!repoMap){repoMap=new Map;const wfDir=join(repoRoot,".github","workflows");if(existsSync(wfDir)){let entries;try{entries=readdirSync(wfDir).filter(f=>f.endsWith(".yml")||f.endsWith(".yaml"))}catch{entries=[]}for(const f of entries){const content=readWorkflowFile(join(wfDir,f));content!==null&&repoMap.set(f,content)}}workflowCache.set(repoRoot,repoMap)}const results=[];for(const[filename,content]of repoMap)(typeof pattern=="string"?content.includes(pattern):pattern.test(content))&&results.push(`.github/workflows/${filename}`);return results.sort()}function globWorkflows(repoRoot){const dir=join(repoRoot,".github","workflows");if(!existsSync(dir))return[];try{return readdirSync(dir).filter(f=>f.endsWith(".yml")||f.endsWith(".yaml")).sort().map(f=>toPosixRelative(repoRoot,join(dir,f)))}catch(err){return process.stderr.write(`[measure] readdirSync failed for ${dir}: ${toFsError(err,dir).message}
+`),[]}}function hasArchUnitDep(repoRoot){const pom=join(repoRoot,"pom.xml"),gradle=join(repoRoot,"build.gradle"),found=[];return fileContains(pom,"archunit")&&found.push("pom.xml"),fileContains(gradle,"archunit")&&found.push("build.gradle"),found}function findArchTestClasses(repoRoot){const testDir=join(repoRoot,"src","test");return existsSync(testDir)?findRecursive(testDir,name=>/ArchTest/i.test(name)&&name.endsWith(".java")).map(abs=>toPosixRelative(repoRoot,abs)):[]}function measureArchUnit(repoRoot){const depFiles=hasArchUnitDep(repoRoot);if(depFiles.length===0)return{status:"missing",evidence:[]};const testClasses=findArchTestClasses(repoRoot);return testClasses.length>0?{status:"present",evidence:[...depFiles,...testClasses].slice(0,EVIDENCE_CAP)}:{status:"partial",evidence:depFiles}}const DIM_HANDLERS={N01:measureArchUnit,N02:measureArchUnit,N03:measureArchUnit,N04:measureArchUnit,N05:measureArchUnit,N06:measureArchUnit,N07:r=>{const script=join(r,"scripts","check-circular-deps.mjs");if(existsSync(script))return{status:"present",evidence:["scripts/check-circular-deps.mjs"]};const pkg=readPkgJson(r);return hasDep(pkg,"madge")?{status:"partial",evidence:["package.json"]}:{status:"missing",evidence:[]}},N08:r=>{const abs=findRecursive(join(r,"src"),n=>/audit.*service|AuditEvent/i.test(n)).map(a=>toPosixRelative(r,a));return abs.length===0?{status:"missing",evidence:[]}:{status:"present",evidence:abs.slice(0,EVIDENCE_CAP)}},N73:r=>{const dirs=[join(r,"db","migrations"),join(r,"src","main","resources","db")],found=[];for(const d of dirs)existsSync(d)&&found.push(...findRecursive(d,n=>/audit/i.test(n)).map(a=>toPosixRelative(r,a)));return found.length===0?{status:"missing",evidence:[]}:{status:"present",evidence:found.slice(0,EVIDENCE_CAP)}},N74:r=>{const dirs=[join(r,"db","migrations"),join(r,"src","main","resources","db")],found=[];for(const d of dirs)existsSync(d)&&found.push(...findRecursive(d,n=>/trigger|audit_trigger/i.test(n)).map(a=>toPosixRelative(r,a)));return found.length===0?{status:"missing",evidence:[]}:{status:"present",evidence:found.slice(0,EVIDENCE_CAP)}},N75:r=>{const found=findRecursive(join(r,"src"),n=>/AuditEvent.*Repository|AppendOnly/i.test(n)).map(a=>toPosixRelative(r,a));return found.length===0?{status:"missing",evidence:[]}:{status:"present",evidence:found.slice(0,EVIDENCE_CAP)}},N09:r=>checkAny(r,[".eslintrc",".eslintrc.js",".eslintrc.cjs",".eslintrc.json",".eslintrc.yml",".eslintrc.yaml","eslint.config.js","eslint.config.mjs","eslint.config.cjs",".golangci.yml",".golangci.yaml","ruff.toml",".ruff.toml","setup.cfg",".clippy.toml"]),N10:r=>checkAny(r,[".prettierrc",".prettierrc.js",".prettierrc.cjs",".prettierrc.json",".prettierrc.yml",".prettierrc.yaml","prettier.config.js","prettier.config.cjs","prettier.config.mjs","spotless.gradle","rustfmt.toml"]),N11:r=>checkAny(r,["pmd.xml",".semgrep.yml",".semgrep.yaml","semgrep-rules"]),N12:r=>checkAny(r,["spotbugs.gradle","spotbugs-baseline.json"]),N13:()=>({status:"missing",evidence:[]}),N14:r=>{const fromFile=checkAny(r,["knip.json","scripts/check-no-unused-exports.mjs"]);if(fromFile.status==="present")return fromFile;const pkg=readPkgJson(r);return hasDep(pkg,"knip")?{status:"present",evidence:["package.json"]}:{status:"missing",evidence:[]}},N15:r=>{const fromFile=checkAny(r,[".jscpd.json"]);if(fromFile.status==="present")return fromFile;const pkg=readPkgJson(r);return hasDep(pkg,"jscpd")?{status:"present",evidence:["package.json"]}:{status:"missing",evidence:[]}},N16:r=>checkAny(r,["src/tokens","design-tokens.json","tailwind.config.js","tailwind.config.ts","tailwind.config.cjs","tailwind.config.mjs"]),N17:r=>checkAny(r,["vitest.config.ts","vitest.config.js","vitest.config.mjs","vitest.config.cjs","jest.config.ts","jest.config.js","jest.config.cjs","jest.config.mjs","pytest.ini","setup.cfg","Cargo.toml"]),N18:r=>{const candidates=["vitest.config.ts","vitest.config.js","vitest.config.mjs",".nycrc",".nycrc.json"],found=[];for(const rel of candidates){const abs=join(r,rel);existsSync(abs)&&fileContains(abs,/thresholds|coverage.*lines|branches|statements|functions/)&&found.push(rel)}return fileContains(join(r,"build.gradle"),"jacoco")&&found.push("build.gradle"),found.length===0?{status:"missing",evidence:[]}:{status:"present",evidence:found.slice(0,EVIDENCE_CAP)}},N19:r=>checkAny(r,["scripts/coverage-baseline.json",".coverage-baseline"]),N20:r=>{const fromFile=checkAny(r,["stryker.config.js","stryker.config.ts","stryker.config.mjs","stryker.config.cjs","stryker.config.json","stryker.conf.json",".mutmut.toml"]);if(fromFile.status==="present")return fromFile;const pkg=readPkgJson(r);return hasDep(pkg,"@stryker-mutator/core")||hasDep(pkg,"stryker")?{status:"present",evidence:["package.json"]}:fileContains(join(r,"pom.xml"),"pitest")||fileContains(join(r,"build.gradle"),"pitest")?{status:"present",evidence:[fileContains(join(r,"pom.xml"),"pitest")?"pom.xml":"build.gradle"]}:{status:"missing",evidence:[]}},N21:r=>{const candidates=["vitest.config.ts","vitest.config.js","vitest.config.mjs"];for(const rel of candidates){const abs=join(r,rel);if(existsSync(abs)&&fileContains(abs,/pool|poolOptions|threads|forks/))return{status:"present",evidence:[rel]}}return{status:"missing",evidence:[]}},N22:r=>checkAny(r,["scripts/check-test-naming.mjs"]),N23:r=>checkDir(r,".arbiter/evidence/tdd"),N24:r=>{const pkg=readPkgJson(r);if(hasScript(pkg,"test:unit"))return{status:"present",evidence:["package.json"]};const vitestCandidates=["vitest.config.ts","vitest.config.js","vitest.config.mjs"];for(const rel of vitestCandidates){const abs=join(r,rel);if(existsSync(abs)&&fileContains(abs,/exclude|testPathIgnorePatterns/))return{status:"partial",evidence:[rel]}}return{status:"missing",evidence:[]}},N25:r=>{const pkg=readPkgJson(r);if(hasScript(pkg,"test:integration"))return{status:"present",evidence:["package.json"]};const wfs=workflowsMatchingPattern(r,"integration");return wfs.length>0?{status:"partial",evidence:wfs.slice(0,EVIDENCE_CAP)}:{status:"missing",evidence:[]}},N26:r=>{const wfs=workflowsMatchingPattern(r,"schedule:");return wfs.length===0?{status:"missing",evidence:[]}:{status:"present",evidence:wfs.slice(0,EVIDENCE_CAP)}},N27:r=>{const fromDir=checkDir(r,"__tests__/integration");if(fromDir.status==="present")return fromDir;const javaTests=findRecursive(join(r,"src","test"),n=>n.endsWith("IT.java")).map(a=>toPosixRelative(r,a));return javaTests.length>0?{status:"present",evidence:javaTests.slice(0,EVIDENCE_CAP)}:{status:"missing",evidence:[]}},N28:r=>{const fromDir=checkDir(r,"__tests__/contract");if(fromDir.status==="present")return fromDir;const pkg=readPkgJson(r);return hasDep(pkg,"@pact-foundation/pact")||hasDep(pkg,"pact")?{status:"present",evidence:["package.json"]}:fileContains(join(r,"pom.xml"),"spring-cloud-contract")||fileContains(join(r,"build.gradle"),"spring-cloud-contract")?{status:"present",evidence:[fileContains(join(r,"pom.xml"),"spring-cloud-contract")?"pom.xml":"build.gradle"]}:{status:"missing",evidence:[]}},N29:r=>{const fromBehavioral=checkDir(r,"__tests__/behavioral");if(fromBehavioral.status==="present")return fromBehavioral;const fromFeatures=checkDir(r,"features");if(fromFeatures.status==="present")return fromFeatures;const pkg=readPkgJson(r);return hasDep(pkg,"@cucumber/cucumber")||hasDep(pkg,"cucumber")||hasDep(pkg,"pytest-bdd")?{status:"present",evidence:["package.json"]}:{status:"missing",evidence:[]}},N30:r=>{const depFiles=hasArchUnitDep(r);if(depFiles.length===0)return{status:"missing",evidence:[]};const testClasses=findArchTestClasses(r);return testClasses.length>0?{status:"present",evidence:[...depFiles,...testClasses].slice(0,EVIDENCE_CAP)}:{status:"missing",evidence:[]}},N31:r=>{const fromDir=checkDir(r,"fuzz");if(fromDir.status==="present")return fromDir;const fuzzFiles=findRecursive(join(r,"src","test"),n=>/Fuzz/i.test(n)).map(a=>toPosixRelative(r,a));return fuzzFiles.length>0?{status:"present",evidence:fuzzFiles.slice(0,EVIDENCE_CAP)}:{status:"missing",evidence:[]}},N32:r=>{const pkg=readPkgJson(r);return hasDep(pkg,"fast-check")||hasDep(pkg,"hypothesis")||hasDep(pkg,"proptest")?{status:"present",evidence:["package.json"]}:{status:"missing",evidence:[]}},N33:r=>{const fromSnapshots=checkDir(r,"__tests__/__snapshots__");if(fromSnapshots.status==="present")return fromSnapshots;const fromSrcSnapshots=checkDir(r,"src/__snapshots__");return fromSrcSnapshots.status==="present"?fromSrcSnapshots:checkAny(r,["scripts/check-api-snapshot.mjs"])},N34:r=>{const workflows=globWorkflows(r);return workflows.length<2?{status:"missing",evidence:[]}:{status:"present",evidence:workflows.slice(0,EVIDENCE_CAP)}},N35:r=>{const wfs=workflowsMatchingPattern(r,"pull_request");return wfs.length===0?{status:"missing",evidence:[]}:{status:"present",evidence:wfs.slice(0,EVIDENCE_CAP)}},N36:r=>{const wfs=workflowsMatchingPattern(r,/push[\s\S]*?tags|release:/);return wfs.length===0?{status:"missing",evidence:[]}:{status:"present",evidence:wfs.slice(0,EVIDENCE_CAP)}},N37:r=>{const matching=workflowsMatchingPattern(r,"schedule:").filter(f=>/nightly/i.test(f)||fileContains(join(r,f),/cron:.*"0 [0-5]/));return matching.length===0?{status:"missing",evidence:[]}:{status:"present",evidence:matching.slice(0,EVIDENCE_CAP)}},N38:r=>{const matching=workflowsMatchingPattern(r,"schedule:").filter(f=>/weekly/i.test(f)||fileContains(join(r,f),/cron:.*"0 \d+ \* \* 0/));return matching.length===0?{status:"missing",evidence:[]}:{status:"present",evidence:matching.slice(0,EVIDENCE_CAP)}},N39:r=>{const wfs=workflowsMatchingPattern(r,"CI_BUILD_RUNNER_LABEL");if(wfs.length>0)return{status:"present",evidence:wfs.slice(0,EVIDENCE_CAP)};const allWfs=globWorkflows(r);return allWfs.length>0?{status:"partial",evidence:allWfs.slice(0,EVIDENCE_CAP)}:{status:"missing",evidence:[]}},N40:r=>{const wfs=workflowsMatchingPattern(r,/attest-build-provenance|cosign/);if(wfs.length>0)return{status:"present",evidence:wfs.slice(0,EVIDENCE_CAP)};const pkg=readPkgJson(r);return hasDep(pkg,"cosign")?{status:"present",evidence:["package.json"]}:{status:"missing",evidence:[]}},N41:r=>checkAny(r,["playwright.config.ts","playwright.config.js","playwright.config.mjs","__tests__/e2e"]),N42:r=>checkAny(r,["k6","locustfile.py","gatling/simulations"]),N43:r=>{const wfs=workflowsMatchingPattern(r,/zap-|nuclei/);return wfs.length===0?{status:"missing",evidence:[]}:{status:"present",evidence:wfs.slice(0,EVIDENCE_CAP)}},N44:r=>{const pkg=readPkgJson(r);if(hasDep(pkg,"keycloak-js")||hasDep(pkg,"keycloak-connect"))return{status:"present",evidence:["package.json"]};const testFiles=findRecursive(join(r,"__tests__"),n=>/keycloak/i.test(n)).map(a=>toPosixRelative(r,a));return testFiles.length>0?{status:"present",evidence:testFiles.slice(0,EVIDENCE_CAP)}:fileContains(join(r,"pom.xml"),"keycloak")||fileContains(join(r,"build.gradle"),"keycloak")?{status:"present",evidence:[fileContains(join(r,"pom.xml"),"keycloak")?"pom.xml":"build.gradle"]}:{status:"missing",evidence:[]}},N45:r=>{const fromScript=checkAny(r,["scripts/check-format.mjs","scripts/check-format.sh"]);if(fromScript.status==="present")return fromScript;const pkg=readPkgJson(r);return hasScript(pkg,"format")||hasScript(pkg,"lint:format")||hasScript(pkg,"fmt")?{status:"present",evidence:["package.json"]}:{status:"missing",evidence:[]}},N46:r=>checkAny(r,["scripts/check-spdx-headers.mjs"]),N47:r=>checkAny(r,["scripts/check-no-orphan-todo.mjs"]),N48:r=>checkAny(r,["scripts/check-no-placeholders.mjs"]),N49:r=>checkAny(r,["scripts/check-doc-links.mjs"]),N50:r=>checkAny(r,["scripts/check-bloat-ratchet.mjs"]),N51:r=>checkAny(r,["scripts/debt-report.mjs","debt-baseline.json"]),N52:r=>checkAny(r,["scripts/check-self-dogfood.mjs"]),N53:r=>checkAny(r,["scripts/check-api-snapshot.mjs","api-snapshot.json"]),N54:r=>{const fromScript=checkAny(r,["scripts/check-circular-deps.mjs"]);if(fromScript.status==="present")return fromScript;const pkg=readPkgJson(r);return hasDep(pkg,"madge")?{status:"present",evidence:["package.json"]}:{status:"missing",evidence:[]}},N55:r=>{const fromConfig=checkAny(r,[".gitleaks.toml",".gitleaks.config.toml"]);if(fromConfig.status==="present")return fromConfig;const wfs=workflowsMatchingPattern(r,"gitleaks");return wfs.length>0?{status:"partial",evidence:wfs.slice(0,EVIDENCE_CAP)}:{status:"missing",evidence:[]}},N56:r=>{const fromConfig=checkAny(r,[".trivyignore","owasp-suppressions.xml",".audit-ci.json"]);if(fromConfig.status==="present")return fromConfig;const wfs=workflowsMatchingPattern(r,"npm audit");return wfs.length>0?{status:"partial",evidence:wfs.slice(0,EVIDENCE_CAP)}:{status:"missing",evidence:[]}},N57:r=>{const fromConfig=checkAny(r,[".trivyignore"]);if(fromConfig.status==="present")return fromConfig;const wfs=workflowsMatchingPattern(r,/trivy|aquasecurity/);return wfs.length>0?{status:"present",evidence:wfs.slice(0,EVIDENCE_CAP)}:{status:"missing",evidence:[]}},N58:r=>{const fromFile=checkAny(r,[".fossa.yml",".fossa.yaml"]);if(fromFile.status==="present")return fromFile;const pkg=readPkgJson(r);return hasDep(pkg,"licensee")?{status:"present",evidence:["package.json"]}:{status:"missing",evidence:[]}},N59:r=>checkAny(r,["commitlint.config.js","commitlint.config.ts","commitlint.config.cjs","commitlint.config.mjs",".commitlintrc",".commitlintrc.js",".commitlintrc.json",".commitlintrc.yml",".commitlintrc.yaml"]),N60:r=>{const fromScript=checkAny(r,["scripts/check-branch-name.mjs"]);return fromScript.status==="present"?fromScript:fileContains(join(r,"AGENTS.md"),/branch.*convention|branch.*format|branch.*pattern/i)?{status:"partial",evidence:["AGENTS.md"]}:{status:"missing",evidence:[]}},N61:r=>checkAny(r,[".github/pull_request_template.md",".github/PULL_REQUEST_TEMPLATE.md"]),N62:r=>checkDir(r,".github/ISSUE_TEMPLATE"),N63:r=>checkAny(r,["AGENTS.md",".claude/CLAUDE.md"]),N64:r=>checkAny(r,["docs/REFERENCE/ci-developer-reference.md","docs/ci-reference.md","docs/ci-developer-reference.md"]),N65:r=>{const fromDirLower=checkDir(r,"docs/adr");if(fromDirLower.status==="present")return fromDirLower;const fromDirUpper=checkDir(r,"docs/ADR");return fromDirUpper.status==="present"?fromDirUpper:checkAny(r,["docs/SYSTEM/DECISIONS.md"])},N66:r=>checkAny(r,["openapi.yaml","openapi.json","swagger.yaml","swagger.json","api-spec.yaml","api-spec.json"]),N67:r=>{const fromDir=checkDir(r,"docs/runbooks");return fromDir.status==="present"?fromDir:checkAny(r,["RUNBOOK.md","docs/runbook.md","docs/RUNBOOK.md"])},N68:r=>checkAny(r,["docs/METHOD/KNOWLEDGE_MAP.md","scripts/check-knowledge-map.mjs"]),N69:r=>checkAny(r,[".nvmrc",".node-version",".tool-versions"]),N70:r=>{const abs=join(r,".env.example");if(existsSync(abs))return{status:"present",evidence:[".env.example"]};let entries;try{entries=readdirSync(r)}catch{return{status:"missing",evidence:[]}}const found=entries.filter(f=>f.startsWith(".env")&&f.includes("example"));return found.length>0?{status:"present",evidence:found.slice(0,EVIDENCE_CAP)}:{status:"missing",evidence:[]}},N71:r=>checkAny(r,["src/experimental/registry.ts","src/feature-flags.ts"]),N72:r=>checkAny(r,["docker-compose.staging.yml","docker-compose.staging.yaml","config/dev","config/prod"]),N76:r=>{const pkg=readPkgJson(r);return hasDep(pkg,"axe-core")||hasDep(pkg,"@axe-core/playwright")||hasDep(pkg,"pa11y")||hasDep(pkg,"pa11y-ci")?{status:"present",evidence:["package.json"]}:checkAny(r,[".lighthouserc.js",".lighthouserc.json",".lighthouserc.yml"])},N77:r=>{if(!(fileContains(join(r,"pom.xml"),"spring-modulith")||fileContains(join(r,"build.gradle"),"spring-modulith")))return{status:"missing",evidence:[]};const src=fileContains(join(r,"pom.xml"),"spring-modulith")?"pom.xml":"build.gradle",verifyFiles=findRecursive(join(r,"src","test"),n=>n.endsWith(".java")).filter(abs=>fileContains(abs,"ApplicationModules"));return verifyFiles.length>0?{status:"present",evidence:[src,...verifyFiles.map(a=>toPosixRelative(r,a))].slice(0,EVIDENCE_CAP)}:{status:"present",evidence:[src]}},N78:r=>{const fromGuide=checkAny(r,["docs/GOVERNANCE/RESILIENCE.md"]);if(fromGuide.status==="present")return fromGuide;const pkg=readPkgJson(r);return hasDep(pkg,"cockatiel")||hasDep(pkg,"opossum")?{status:"present",evidence:["package.json"]}:fileContains(join(r,"pom.xml"),"resilience4j")||fileContains(join(r,"build.gradle"),"resilience4j")?{status:"present",evidence:[fileContains(join(r,"pom.xml"),"resilience4j")?"pom.xml":"build.gradle"]}:fileContains(join(r,"requirements.txt"),"tenacity")?{status:"present",evidence:["requirements.txt"]}:{status:"missing",evidence:[]}}};export function measureDim(dim,repoRoot){if(!existsSync(repoRoot))return{status:"missing",evidence:[]};try{const handler=DIM_HANDLERS[dim.id];if(!handler)return{status:"missing",evidence:[]};const raw=handler(repoRoot),evidence=Array.from(new Set(raw.evidence)).sort();return{status:raw.status,evidence}}catch(err){return diagnosticErrors++,process.stderr.write(`[measure] measureDim failed for ${dim.id}: ${String(err)}
+`),{status:"missing",evidence:[]}}}export function getMeasureDiagnosticErrors(){return diagnosticErrors}

package/dist/kit/redaction.js

@@ -0,0 +1,3 @@
+// SPDX-License-Identifier: Apache-2.0
+export function scanForRedactedTokens(text,lexicon){const matches=[],lines=text.split(`
+`);for(let i=0;i<lines.length;i++){const lineContent=lines[i]??"";for(const entry of lexicon)lineContent.includes(entry.token)&&(entry.allowContext!==void 0&&lineContent.includes(entry.allowContext)||matches.push({token:entry.token,line:i+1,lineContent}))}return matches}

package/dist/kit/schema.js

@@ -0,0 +1,2 @@
+// SPDX-License-Identifier: Apache-2.0
+import{z}from"zod";import{VALID_TML,VALID_GATES,VALID_STACKS}from"./taxonomy.js";export{VALID_STACKS}from"./taxonomy.js";const reasonSchema=z.string().min(40,"reason must be at least 40 characters"),KitOverlayCellSchema=z.discriminatedUnion("kind",[z.object({kind:z.literal("tool"),tool:z.string().min(1),matrixCategory:z.string().min(1)}),z.object({kind:z.literal("equivalent"),arbiterSlot:z.string().min(1),reason:reasonSchema}),z.object({kind:z.literal("na-by-archetype"),archetypes:z.array(z.string()).min(1),reason:reasonSchema}),z.object({kind:z.literal("na-by-paradigm"),reason:reasonSchema}),z.object({kind:z.literal("gap"),suggestedTool:z.string().optional(),suggestedGenerator:z.string().optional(),followupIssue:z.number().int().positive().optional(),reason:reasonSchema}).refine(v=>v.suggestedTool!==void 0||v.suggestedGenerator!==void 0||v.followupIssue!==void 0,{message:"gap cell must have at least one of: suggestedTool, suggestedGenerator, followupIssue"})]),DerivedCellSchema=z.union([KitOverlayCellSchema,z.object({kind:z.literal("gap")})]),KitDimensionSchema=z.object({id:z.string().regex(/^N(0[1-9]|[1-6]\d|7[0-8])$/,"id must be N01..N78"),name:z.string().min(1),tml:z.enum(VALID_TML),gate:z.enum(VALID_GATES),categoryRef:z.string().min(1),archetypeGating:z.object({applies:z.array(z.string()),excludes:z.array(z.string())}),conditionalFlag:z.string().optional(),invLink:z.string().optional(),generatorLink:z.string().optional(),kitThreshold:z.number().optional(),arbiterThreshold:z.number().optional(),requiresDbEngine:z.array(z.string()).optional(),status:z.enum(["covered","partial","missing-tracked","missing"]),followupIssue:z.number().int().positive().optional(),note:z.string().optional()});export const KitCatalogSchema=z.array(KitDimensionSchema);const DerivedKitDimSchema=KitDimensionSchema.extend({perStack:z.record(z.enum(VALID_STACKS),DerivedCellSchema)});export const DerivedKitSchema=z.array(DerivedKitDimSchema);

package/dist/kit/taxonomy.js

@@ -0,0 +1,2 @@
+// SPDX-License-Identifier: Apache-2.0
+export const VALID_TML=["L1","L2","L3","L4"],VALID_GATES=["BLOCKING","ADVISORY","REFERENCE"],VALID_STACKS=["java","typescript","python","go","rust"];

package/dist/kit/thresholds.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Brownfield class: characterizes how mature a repository is.
+ * Determines which column of the threshold matrix to apply for existing code.
+ * New code always uses the `new_code` column (gold-grade), regardless of class.
+ *
+ * Classification heuristics (from brownfield-detect.ts):
+ *   gold   → greenfield or already-mature repo (< 50 source files)
+ *   light  → 50–500 source files, coverage > 30 %
+ *   medium → 500–2 000 source files, coverage 5–30 %
+ *   heavy  → 2 000+ source files, coverage < 5 %
+ */
+export type BrownfieldClass = 'gold' | 'light' | 'medium' | 'heavy';

package/dist/kit/thresholds.js

@@ -0,0 +1,2 @@
+// SPDX-License-Identifier: Apache-2.0
+export{};

package/dist/kit/wave-engine.js

@@ -0,0 +1 @@
+const WAVE_GOALS={W0:cls=>`Bootstrap \u2014 confirm existing coverage (brownfield: ${cls})`,W1:cls=>`Enforcement \u2014 close partial gaps (brownfield: ${cls})`,W2:()=>"Advanced \u2014 implement missing tooling",W3:()=>"Gold \u2014 achieve full quality-gate parity"};export function buildWavePlan(assessments,brownfieldClass){const applicable=assessments.filter(a=>(a.applicability??"applicable")!=="na"),byStatus={Y:[],P:[],N:[],NA:[]};for(const a of applicable)byStatus[a.status].push(a);const toEntries=list=>list.map(({dimId,status,category})=>({dimId,status,category})),waves=[{label:"W0",goal:WAVE_GOALS.W0(brownfieldClass),dimensions:toEntries(byStatus.Y)},{label:"W1",goal:WAVE_GOALS.W1(brownfieldClass),dimensions:toEntries(byStatus.P)},{label:"W2",goal:WAVE_GOALS.W2(brownfieldClass),dimensions:toEntries(byStatus.N)},{label:"W3",goal:WAVE_GOALS.W3(brownfieldClass),dimensions:[]}],totalDims=waves.reduce((s,w)=>s+w.dimensions.length,0),byWave={};for(const w of waves)byWave[w.label]=w.dimensions.length;return{brownfieldClass,waves,summary:{totalDims,byWave}}}

package/dist/recipes/loader.js

@@ -0,0 +1,6 @@
+// SPDX-License-Identifier: Apache-2.0
+import{statSync}from"node:fs";import{createHash}from"node:crypto";import{RecipeSchema}from"./schema.js";import{readFileTranslated}from"../utils/fs.js";const MAX_BYTES=256*1024;export async function loadRecipe(source,opts={}){if(source.startsWith("http://"))throw new Error(`Recipe URL must use https:// \u2014 plain http:// is not allowed (supply-chain risk). Got: ${source}`);const raw=source.startsWith("https://")?await fetchRecipe(source):readLocalRecipe(source);if(opts.sha256){const actual=createHash("sha256").update(raw).digest("hex");if(actual!==opts.sha256)throw new Error(`Recipe sha256 checksum mismatch.
+  expected: ${opts.sha256}
+  actual:   ${actual}`)}let parsed;try{parsed=JSON.parse(raw.toString("utf-8"))}catch(err){const msg=err instanceof Error?err.message:String(err);throw new Error(`Recipe JSON parse error: ${msg}`,{cause:err})}const result=RecipeSchema.safeParse(parsed);if(!result.success){const issues=result.error.issues.map(i=>`  ${i.path.join(".")}: ${i.message}`).join(`
+`);throw new Error(`Recipe validation failed:
+${issues}`)}return result.data}function readLocalRecipe(source){const filePath=source.startsWith("file://")?new URL(source).pathname:source,stat=statSync(filePath);if(stat.size>MAX_BYTES)throw new Error(`Recipe file size ${stat.size} bytes exceeds limit of ${MAX_BYTES} bytes (256 KB). Reduce the recipe file size.`);return readFileTranslated(filePath)}function assertResponseOk(response,url){if(response.status>=300&&response.status<400)throw new Error(`Recipe URL was redirected \u2014 supply the final HTTPS URL directly. Got redirect from: ${url}`);if(!response.ok)throw new Error(`Recipe fetch returned HTTP ${response.status}: ${url}`)}function wrapFetchError(err){if(err instanceof Error&&err.message.startsWith("Recipe"))throw err;const msg=err instanceof Error?err.message:String(err);throw new Error(`Recipe fetch failed: ${msg}`,{cause:err})}async function fetchRecipe(url){const controller=new AbortController,timeout=setTimeout(()=>{controller.abort()},1e4);try{const response=await fetch(url,{signal:controller.signal,redirect:"manual"});assertResponseOk(response,url);const contentLength=response.headers.get("content-length");if(contentLength!==null&&parseInt(contentLength,10)>MAX_BYTES)throw new Error(`Recipe response Content-Length ${contentLength} bytes exceeds limit of ${MAX_BYTES} bytes (256 KB).`);const buf=Buffer.from(await response.arrayBuffer());if(buf.length>MAX_BYTES)throw new Error(`Recipe response body size ${buf.length} bytes exceeds limit of ${MAX_BYTES} bytes (256 KB).`);return buf}catch(err){wrapFetchError(err)}finally{clearTimeout(timeout)}}

package/dist/recipes/schema.js

@@ -0,0 +1,2 @@
+// SPDX-License-Identifier: Apache-2.0
+import{z}from"zod";const AiToolSchema=z.enum(["claude","codex"]),GovernanceLevelSchema=z.enum(["L1","L2","L3","L4"]),LanguageSchema=z.enum(["typescript","java","kotlin","rust","python","go","multi"]),ArchetypeSchema=z.enum(["backend-web-db","cli","library","data-pipeline","frontend-spa","embedded"]),ArchitectureStyleSchema=z.enum(["hexagonal","layered","modular-monolith","none"]),DatabaseEngineSchema=z.enum(["postgresql","mysql","mongodb","sqlite","other","none"]),ContractTypeSchema=z.enum(["rest-owned","rest-public","graphql","grpc","message-queue","none"]),LaneSchema=z.enum(["frontend","backend","docs"]),DecompositionBackendSchema=z.enum(["github","markdown"]);export const RecipeSchema=z.object({tools:z.array(AiToolSchema).min(1).optional(),governanceLevel:GovernanceLevelSchema.optional(),language:LanguageSchema.optional(),framework:z.string().nullable().optional(),archetype:ArchetypeSchema.optional(),architectureStyle:ArchitectureStyleSchema.optional(),useGitHub:z.boolean().optional(),isMultiTenant:z.boolean().optional(),hasDatabase:z.boolean().optional(),hasPublicApi:z.boolean().optional(),databaseEngine:DatabaseEngineSchema.optional(),contractType:ContractTypeSchema.optional(),lanes:z.array(LaneSchema).optional(),evidenceHarness:z.boolean().optional(),decomposition:z.object({backend:DecompositionBackendSchema}).optional(),enableDebtGates:z.boolean().optional(),enableSuppressions:z.boolean().optional(),enableSecurityScanning:z.boolean().optional(),enableMutationTesting:z.boolean().optional(),enableContractTesting:z.boolean().optional(),enableSoloDevMode:z.boolean().optional(),enableMcpFallback:z.boolean().optional(),enableNoSkippedTests:z.boolean().optional(),enableAuditToolchain:z.boolean().optional(),enableFiveLaneCi:z.boolean().optional(),enableCodeownersNotify:z.boolean().optional(),enableTaxonomy25d:z.boolean().optional(),enablePerfTesting:z.boolean().optional(),enableRiskRegister:z.boolean().optional(),enableOperationsHandbook:z.boolean().optional(),enableIso27001Mapping:z.boolean().optional(),enableNis2Mapping:z.boolean().optional(),enableGdprMapping:z.boolean().optional(),automation:z.object({autonomy:z.enum(["L0","L1","L2","L3"]),maxParallelWorktrees:z.number().int().positive().optional(),defaultGateLevel:z.enum(["L1","L2"]).optional()}).strict().optional()});

package/dist/risk/classifier.js

@@ -0,0 +1,2 @@
+// SPDX-License-Identifier: Apache-2.0
+export const UNCLASSIFIED_LEVEL="R-unknown";const RULES={typescript:[{pattern:/(^|\/)migrations?\//i,level:"R0"},{pattern:/\.sql$/i,level:"R0"},{pattern:/(^|\/)auth\//i,level:"R1"},{pattern:/(^|\/)payment(s)?\//i,level:"R1"},{pattern:/(^|\/)api\//i,level:"R2"},{pattern:/(^|\/)server\//i,level:"R2"},{pattern:/(^|\/)components?\//i,level:"R3"},{pattern:/(^|\/)pages?\//i,level:"R3"},{pattern:/\.md$/i,level:"R4"},{pattern:/(^|\/)docs?\//i,level:"R4"},{pattern:/(^|\/)__tests__\//,level:"R4"}],python:[{pattern:/(^|\/)alembic\/versions\//i,level:"R0"},{pattern:/(^|\/)migrations?\//i,level:"R0"},{pattern:/(^|\/)auth\//i,level:"R1"},{pattern:/(^|\/)api\//i,level:"R2"},{pattern:/(^|\/)tests?\//i,level:"R4"},{pattern:/\.md$/i,level:"R4"}],rust:[{pattern:/unsafe/i,level:"R0"},{pattern:/(^|\/)migrations?\//i,level:"R0"},{pattern:/\.rs$/i,level:"R2"},{pattern:/\.md$/i,level:"R4"}],java:[{pattern:/(^|\/)migration(s)?\/.*\.sql$/i,level:"R0"},{pattern:/(^|\/)security\//i,level:"R1"},{pattern:/\.md$/i,level:"R4"}],go:[{pattern:/(^|\/)migrations?\//i,level:"R0"},{pattern:/(^|\/)auth\//i,level:"R1"},{pattern:/\.go$/i,level:"R2"},{pattern:/\.md$/i,level:"R4"}]};export function classifyPath(path,stack){try{if(typeof path!="string"||path.trim()==="")return UNCLASSIFIED_LEVEL;const rules=RULES[stack];if(!rules)return UNCLASSIFIED_LEVEL;const norm=path.replace(/\\/g,"/");for(const rule of rules)if(rule.pattern.test(norm))return rule.level;return UNCLASSIFIED_LEVEL}catch{return UNCLASSIFIED_LEVEL}}const RISK_ORDER=["R0","R1","R2","R3","R4"];export function highestRisk(levels){if(levels.length===0)return UNCLASSIFIED_LEVEL;let best=null;for(const l of levels){if(l===UNCLASSIFIED_LEVEL)return UNCLASSIFIED_LEVEL;(best===null||RISK_ORDER.indexOf(l)<RISK_ORDER.indexOf(best))&&(best=l)}return best??UNCLASSIFIED_LEVEL}

package/dist/risk/sha-check.js

@@ -0,0 +1,2 @@
+// SPDX-License-Identifier: Apache-2.0
+import{createHash}from"node:crypto";function canonicalise(value){if(Array.isArray(value))return value.map(canonicalise);if(value!==null&&typeof value=="object"){const obj=value,sortedKeys=Object.keys(obj).sort(),out={};for(const k of sortedKeys)out[k]=canonicalise(obj[k]);return out}return value}export function computeSummarySha(body){const{sha:_ignored,...rest}=body,canonical=JSON.stringify(canonicalise(rest));return createHash("sha256").update(canonical).digest("hex")}export function verifySummarySha(body){const stored=body.sha;if(typeof stored!="string")return{ok:!1,reason:"missing or non-string sha field"};const expected=computeSummarySha(body);return expected!==stored?{ok:!1,expected,actual:stored,reason:"sha mismatch"}:{ok:!0,expected,actual:stored}}

package/dist/state/backups.js

@@ -0,0 +1,2 @@
+// SPDX-License-Identifier: Apache-2.0
+import{existsSync,readdirSync,statSync}from"node:fs";import{copyFileTranslated,unlinkTranslated}from"../utils/fs.js";import{basename,dirname,join}from"node:path";export const DEFAULT_BACKUP_CAP=10;function isoTimestamp(){return new Date().toISOString().replace(/[:.]/g,"-")}function backupSuffix(path){const base=basename(path).replace(/[.+*?^$()[\]{}|\\]/g,"\\$&");return new RegExp(`^${base}\\.bak\\.`)}export function listBackups(path){const dir=dirname(path);if(!existsSync(dir))return[];const re=backupSuffix(path);return readdirSync(dir).filter(f=>re.test(f)).map(f=>join(dir,f)).sort((a,b)=>statSync(a).mtimeMs-statSync(b).mtimeMs)}export function rotateBackup(path,opts={}){const cap=opts.cap??DEFAULT_BACKUP_CAP;if(!existsSync(path))return null;const backupPath=`${path}.bak.${isoTimestamp()}`;copyFileTranslated(path,backupPath);const all=listBackups(path);if(all.length>cap){const overflow=all.slice(0,all.length-cap);for(const old of overflow)try{unlinkTranslated(old)}catch{}}return backupPath}

package/dist/state/envelope.js

@@ -0,0 +1,2 @@
+// SPDX-License-Identifier: Apache-2.0
+import{createHash}from"node:crypto";export const CURRENT_SNAPSHOT_VERSION=1;export function canonicalJson(value){return JSON.stringify(value,sortedReplacer,2)}function sortedReplacer(_key,value){if(value!==null&&typeof value=="object"&&!Array.isArray(value)){const entries=Object.entries(value).sort(([a],[b])=>a<b?-1:a>b?1:0);return Object.fromEntries(entries)}return value}export function computeChecksum(envelope){return createHash("sha256").update(canonicalJson(envelope)).digest("hex")}export function wrapSnapshot(config){const envelope={$schemaVersion:CURRENT_SNAPSHOT_VERSION,config};return{".checksum":computeChecksum(envelope),...envelope}}export class SnapshotChecksumError extends Error{expected;actual;constructor(expected,actual){super(`snapshot checksum mismatch: expected ${expected.slice(0,12)}\u2026, got ${actual.slice(0,12)}\u2026. Run \`arbiter doctor --repair-state\` to re-derive from arbiter.json.`),this.name="SnapshotChecksumError",this.expected=expected,this.actual=actual}}export class SnapshotShapeError extends Error{constructor(message){super(message),this.name="SnapshotShapeError"}}function isRecord(v){return typeof v=="object"&&v!==null&&!Array.isArray(v)}export function unwrapSnapshot(raw){if(!isRecord(raw))throw new SnapshotShapeError("snapshot is not a JSON object");const checksum=raw[".checksum"],version=raw.$schemaVersion,config=raw.config;if(typeof checksum!="string")throw new SnapshotShapeError('snapshot missing ".checksum" string');if(typeof version!="number")throw new SnapshotShapeError('snapshot missing "$schemaVersion" number');if(config===void 0)throw new SnapshotShapeError('snapshot missing "config" payload');const envelope={$schemaVersion:version,config},actual=computeChecksum(envelope);if(actual!==checksum)throw new SnapshotChecksumError(checksum,actual);return{envelope,checksum}}

package/dist/state/generated-manifest.js

@@ -0,0 +1,3 @@
+// SPDX-License-Identifier: Apache-2.0
+import{existsSync}from"node:fs";export{manifestKey}from"./manifest-key.js";import{ensureDir,renameTranslated,unlinkTranslated,writeFileTranslated,readFileTranslated}from"../utils/fs.js";import{join,dirname}from"node:path";import{randomBytes}from"node:crypto";import{FatalError}from"../utils/errors.js";export const GENERATED_MANIFEST_FILE=".arbiter-generated-manifest.json";const CURRENT_MANIFEST_VERSION=1;export function loadGeneratedManifest(dir){const path=join(dir,GENERATED_MANIFEST_FILE);if(!existsSync(path))return{};const raw=readFileTranslated(path,"utf-8");let parsed;try{parsed=JSON.parse(raw)}catch(err){throw new FatalError("E_MANIFEST_CORRUPT",`${GENERATED_MANIFEST_FILE} is present but unparseable (${err instanceof Error?err.message:String(err)}). Refusing to treat a corrupt manifest as empty (would silently withhold template fixes). Fix the JSON or delete the file to re-baseline on the next \`arbiter update\`.`)}if(!isManifestShape(parsed))throw new FatalError("E_MANIFEST_SHAPE",`${GENERATED_MANIFEST_FILE} has an invalid shape or unsupported $schemaVersion (expected { "$schemaVersion": ${CURRENT_MANIFEST_VERSION}, "files": { <path>: <sha256> } }). Fix or delete the file to re-baseline on the next \`arbiter update\`.`);return parsed.files}export function loadUnwiredGuards(dir){const path=join(dir,GENERATED_MANIFEST_FILE);if(!existsSync(path))return[];const raw=readFileTranslated(path,"utf-8");let parsed;try{parsed=JSON.parse(raw)}catch(err){throw new FatalError("E_MANIFEST_CORRUPT",`${GENERATED_MANIFEST_FILE} is present but unparseable (${err instanceof Error?err.message:String(err)}).`)}if(!isManifestShape(parsed))throw new FatalError("E_MANIFEST_SHAPE",`${GENERATED_MANIFEST_FILE} has an invalid shape or unsupported $schemaVersion.`);return parsed.unwiredGuards??[]}export function loadWithheldSafety(dir){const path=join(dir,GENERATED_MANIFEST_FILE);if(!existsSync(path))return[];const raw=readFileTranslated(path,"utf-8");let parsed;try{parsed=JSON.parse(raw)}catch(err){throw new FatalError("E_MANIFEST_CORRUPT",`${GENERATED_MANIFEST_FILE} is present but unparseable (${err instanceof Error?err.message:String(err)}).`)}if(!isManifestShape(parsed))throw new FatalError("E_MANIFEST_SHAPE",`${GENERATED_MANIFEST_FILE} has an invalid shape or unsupported $schemaVersion.`);return parsed.withheldSafety??[]}function isManifestShape(v){if(typeof v!="object"||v===null)return!1;const obj=v;if(obj.$schemaVersion!==CURRENT_MANIFEST_VERSION)return!1;const files=obj.files;if(typeof files!="object"||files===null||Array.isArray(files)||!Object.values(files).every(h=>typeof h=="string"))return!1;const unwired=obj.unwiredGuards;if(unwired!==void 0&&(!Array.isArray(unwired)||!unwired.every(s=>typeof s=="string")))return!1;const withheldSafety=obj.withheldSafety;return!(withheldSafety!==void 0&&(!Array.isArray(withheldSafety)||!withheldSafety.every(s=>typeof s=="string")))}export function saveGeneratedManifest(dir,files,unwiredGuards=[],withheldSafety=[]){const path=join(dir,GENERATED_MANIFEST_FILE),sorted=Object.fromEntries(Object.entries(files).sort(([a],[b])=>a<b?-1:a>b?1:0)),envelope={$schemaVersion:CURRENT_MANIFEST_VERSION,files:sorted};unwiredGuards.length>0&&(envelope.unwiredGuards=[...new Set(unwiredGuards)].sort((a,b)=>a<b?-1:a>b?1:0)),withheldSafety.length>0&&(envelope.withheldSafety=[...new Set(withheldSafety)].sort((a,b)=>a<b?-1:a>b?1:0));const body=JSON.stringify(envelope,null,2)+`
+`;ensureDir(dirname(path));const tmp=`${path}.arbiter-tmp-${randomBytes(4).toString("hex")}`;try{writeFileTranslated(tmp,body),renameTranslated(tmp,path)}catch(err){try{unlinkTranslated(tmp)}catch{}throw err}}

package/dist/state/manifest-key.js

@@ -0,0 +1,2 @@
+// SPDX-License-Identifier: Apache-2.0
+import{relative,isAbsolute}from"node:path";export function manifestKey(targetDir,filePath){const rel=relative(targetDir,filePath).replace(/\\/g,"/");return rel===""||rel.startsWith("../")||rel===".."||isAbsolute(rel)?null:rel}

package/dist/state/migrations/index.js

@@ -0,0 +1 @@
+import{migrateV0ToV1}from"./v0-to-v1.js";function isRecord(v){return typeof v=="object"&&v!==null&&!Array.isArray(v)}function looksLikeEnvelope(raw){return typeof raw.$schemaVersion=="number"&&"config"in raw}export function migrateState(raw){if(!isRecord(raw))throw new Error("snapshot must be a non-null JSON object");if(looksLikeEnvelope(raw)){const version=raw.$schemaVersion;if(version!==1)throw new Error(`unsupported snapshot $schemaVersion=${String(version)} (max supported: 1)`);return{envelope:{$schemaVersion:1,config:raw.config},migrated:!1}}return{envelope:migrateV0ToV1(raw),migrated:!0}}

package/dist/state/migrations/v0-to-v1.js

@@ -0,0 +1,2 @@
+// SPDX-License-Identifier: Apache-2.0
+export function migrateV0ToV1(raw){return{$schemaVersion:1,config:raw}}

package/dist/state/retired-renders.js

@@ -0,0 +1,2 @@
+// SPDX-License-Identifier: Apache-2.0
+export const RETIRED_RENDERS={".claude/hooks/pre-task-track-detect.mjs":["ef079009f8e6fbab3dce3528bbb5cb2e95ccd2644f020a307099e5d2deac6140"]};

package/dist/templates/.nvmrc.ejs

@@ -0,0 +1 @@
+<%- nodeVersion %>

package/dist/templates/HANDOFF.template.md

@@ -0,0 +1,45 @@
+# Handoff: {{TOPIC}}
+
+**Date:** {{DATE}} · **Author:** _fill in — model + session that authored this_
+**Source truth:** _fill in — path(s) to the evidence this handoff summarizes (audit report, plan doc, ADR, commit range)_
+**Executor:** any competent model. Name a stronger tier per-task below only where a task genuinely requires judgment, not execution.
+**Prime directive:** this file is memory for a COLD model with zero prior context. It must be executable without re-derivation — every task below carries its own AC and verification command.
+
+---
+
+## Context
+
+_Fill in — 2-4 sentences: what was found, why it matters, and the evidence backing the claim (link a commit, issue, or report; do not just assert)._
+
+## Evidence pointers
+
+- _path/URL to primary evidence #1_
+- _path/URL to primary evidence #2_
+
+## Tasks (execute in strict order — each depends on the previous landing)
+
+### 1. _Atomic task title_
+
+- **What:** _one concrete paragraph — no "and also consider" scope creep._
+- **Where:** _files/dirs touched._
+- **AC:** _observable, falsifiable acceptance criterion._
+- **Verify:** `<exact command that proves the AC — test run, build, or script>`
+- **Suggested tier:** cheap (execution) — bump to expensive only if this task is root-cause/architecture judgment, not execution.
+
+### 2. _Next atomic task title_
+
+- **What:** …
+- **Where:** …
+- **AC:** …
+- **Verify:** `…`
+- **Suggested tier:** …
+
+_(repeat one numbered section per atomic task; keep them small enough that a cold model can finish one per turn)_
+
+## Non-goals
+
+_Fill in — what this handoff explicitly excludes, so the executing model does not scope-creep into adjacent work._
+
+---
+
+_Model-pyramid note (see AGENTS.md, "Model-Pyramid: 90/10 Guidance"): most tasks above should need only a cheap model executing this plan as written. If an expensive model ends up doing more than a judgment call on one of them, the task description was under-specified — fix the task, not the model tier._

package/dist/templates/__tests__/contract/error-shape.contract.test.ts.ejs

@@ -0,0 +1,47 @@
+import { describe, it, expect } from "vitest";
+import supertest from "supertest";
+import express from "express";
+import { correlationIdMiddleware } from "../../src/middleware/correlation-id.js";
+import { errorHandler, AppError } from "../../src/middleware/error-handler.js";
+
+const app = express();
+app.use(correlationIdMiddleware);
+app.get("/error", (_req, _res, next) => {
+  next(new AppError(422, "Validation Error", "field 'email' is required"));
+});
+app.get("/unknown-error", (_req, _res, next) => {
+  next(new Error("something unexpected"));
+});
+app.use(errorHandler);
+
+describe("RFC 7807 error shape contract", () => {
+  it("AppError produces problem+json with correct shape", async () => {
+    const res = await supertest(app).get("/error");
+    expect(res.status).toBe(422);
+    expect(res.headers["content-type"]).toMatch(/application\/problem\+json/);
+    const body = res.body as Record<string, unknown>;
+    expect(body).toHaveProperty("type");
+    expect(body).toHaveProperty("title");
+    expect(body).toHaveProperty("status", 422);
+    expect(body).toHaveProperty("correlationId");
+    expect(body).not.toHaveProperty("stack");
+  });
+
+  it("unknown error produces 500 with problem+json shape", async () => {
+    const res = await supertest(app).get("/unknown-error");
+    expect(res.status).toBe(500);
+    const body = res.body as Record<string, unknown>;
+    expect(body).toHaveProperty("status", 500);
+    expect(body).toHaveProperty("correlationId");
+    expect(body).not.toHaveProperty("stack");
+  });
+
+  it("correlationId echoed in response header", async () => {
+    const res = await supertest(app)
+      .get("/error")
+      .set("X-Correlation-ID", "test-id-123");
+    expect(res.headers["x-correlation-id"]).toBe("test-id-123");
+    const body = res.body as Record<string, unknown>;
+    expect(body["correlationId"]).toBe("test-id-123");
+  });
+});