@getarbiter/cli 0.5.0

package/dist/commands/explain.js

@@ -0,0 +1,19 @@
+// SPDX-License-Identifier: Apache-2.0
+import{existsSync}from"node:fs";import{dirname,join,resolve}from"node:path";import{fileURLToPath}from"node:url";import{INVARIANT_CATALOG}from"../invariants/catalog.js";import{ERROR_CATALOG}from"../utils/error-catalog.js";import{loadCanonEntries}from"../utils/canon-loader.js";import{ensureDir,writeFileTranslated,readFileTranslated}from"../utils/fs.js";import{loadConfig}from"../utils/config.js";import{slugifyProjectName}from"./init.js";const DOCS_ROOT=resolve(fileURLToPath(import.meta.url),"../../..","docs"),CANON_MD_PATH=join(DOCS_ROOT,"internal/SYSTEM/CANON.md"),TEMPLATES_DIR=join(dirname(fileURLToPath(import.meta.url)),"..","templates"),HANDOFF_TEMPLATE_PATH=join(TEMPLATES_DIR,"HANDOFF.template.md"),FLAG_CATALOG=new Map([["hasPublicApi",{summary:"Project exposes a public API (REST / GraphQL / gRPC).",detail:"Generates: OWASP ZAP DAST scan, an OpenAPI/contract test suite, and an API deprecation policy with a breaking-change gate. Also unlocks the contractType prompt."}],["isMultiTenant",{summary:"Project serves multiple tenants from one deployment.",detail:"Descriptive metadata input only \u2014 adds a risk-register entry for tenant data isolation (R-008). Does not generate isolation/auth machinery; isolation topology is user-determined (row-level, schema-per-tenant, DB-per-tenant, or file-per-tenant)."}],["contractType",{summary:"Contract-testing strategy for the public API.",detail:"Generates: a consumer/provider contract-test suite \u2014 Pact (rest-owned), OpenAPI-diff (rest-public), graphql-inspector (graphql), buf breaking (grpc), or schema-registry (message-queue) \u2014 wired into CI."}]]);function resolveFlagCode(code){const lower=code.toLowerCase();for(const key of FLAG_CATALOG.keys())if(key.toLowerCase()===lower)return key}export function runExplain(code,opts){if(opts.handoff!==void 0)return scaffoldHandoff(opts.handoff,opts.out);if(opts.list)return listAll(opts.format);if(!code)return{exitCode:1,output:"",error:`Usage: arbiter explain <code> [--format json] | --list
+`};const flagKey=resolveFlagCode(code);if(flagKey)return explainFlag(flagKey,opts.format);const normalized=code.toUpperCase();return normalized.startsWith("INV-")?explainInv(normalized,opts.format):normalized.startsWith("PROJ-")?explainProjectInvariant(normalized,opts.format):normalized.startsWith("CANON-")?explainCanon(normalized,opts.format):normalized.startsWith("E_")||ERROR_CATALOG.has(normalized)?explainError(normalized,opts.format):opts.format==="json"?{exitCode:1,output:JSON.stringify({error:`Unknown code: ${code}`},null,2),error:""}:{exitCode:1,output:"",error:`Unknown code: ${code}
+Run \`arbiter explain --list\` to see all known codes.
+`}}function scaffoldHandoff(topic,outDir){if(!topic.trim())return{exitCode:1,output:"",error:`Usage: arbiter explain --handoff <topic>
+`};const slug=slugifyProjectName(topic).toUpperCase(),targetDir=outDir??process.cwd(),filePath=join(targetDir,`HANDOFF-${slug}.md`);if(existsSync(filePath))return{exitCode:0,output:`${filePath} already exists \u2014 not overwritten (edit it directly).
+`,error:""};const template=readFileTranslated(HANDOFF_TEMPLATE_PATH,"utf-8"),date=new Date().toISOString().slice(0,10),content=template.replaceAll("{{TOPIC}}",topic).replaceAll("{{DATE}}",date);return ensureDir(targetDir),writeFileTranslated(filePath,content),{exitCode:0,output:`Scaffolded ${filePath}
+`,error:""}}function explainInv(id,format){const inv=INVARIANT_CATALOG.find(i=>i.id===id);if(!inv)return{exitCode:1,output:"",error:`Unknown invariant: ${id}
+`};if(format==="json"){const payload={code:inv.id,category:"INV",summary:inv.title,detail:inv.description,enforcement:inv.enforcement??"",tier:inv.tier,alwaysActive:inv.alwaysActive};return{exitCode:0,output:JSON.stringify(payload,null,2),error:""}}const lines=["",`${inv.id} \u2014 ${inv.title}`,"",`  ${inv.description}`,""];return inv.enforcement&&lines.push(`  Enforcement: ${inv.enforcement}`,""),lines.push(`  Tier: ${inv.tier}  |  Always active: ${inv.alwaysActive?"yes":"no"}`,""),lines.push("  Run `arbiter explain --list` to see all codes.",""),{exitCode:0,output:lines.join(`
+`),error:""}}function explainProjectInvariant(id,format){const inv=loadProjectInvariants().find(i=>i.id===id);if(!inv)return{exitCode:1,output:"",error:`Unknown invariant: ${id}
+`};if(format==="json"){const payload={code:inv.id,category:"PROJ",summary:inv.title,detail:inv.description,enforcement:inv.enforcement??"",tier:inv.tier,alwaysActive:inv.alwaysActive};return{exitCode:0,output:JSON.stringify(payload,null,2),error:""}}const lines=["",`${inv.id} \u2014 ${inv.title}`,"",`  ${inv.description}`,""];return inv.enforcement&&lines.push(`  Enforcement: ${inv.enforcement}`,""),lines.push(`  Tier: ${inv.tier}  |  Always active: ${inv.alwaysActive?"yes":"no"}`,""),lines.push("  Project-declared invariant (arbiter.json governance.projectInvariants).",""),lines.push("  Run `arbiter explain --list` to see all codes.",""),{exitCode:0,output:lines.join(`
+`),error:""}}function loadProjectInvariants(){return loadConfig(process.cwd())?.governance?.projectInvariants??[]}function explainCanon(id,format){const entry=loadCanonEntries(CANON_MD_PATH).find(e=>e.id===id);if(!entry)return{exitCode:1,output:"",error:`Unknown CANON rule: ${id}
+`};if(format==="json"){const payload={code:entry.id,category:"CANON",summary:entry.title,rule:entry.rule,why:entry.why,enforcement:entry.enforcement,sourceIssues:entry.sourceIssues,promotedTo:entry.promotedTo};return{exitCode:0,output:JSON.stringify(payload,null,2),error:""}}const lines=["",`${entry.id} \u2014 ${entry.title}`,"",`  Rule: ${entry.rule}`,"",`  Why: ${entry.why}`,"",`  Enforcement: ${entry.enforcement}`,""];return entry.sourceIssues&&lines.push(`  Source issues: ${entry.sourceIssues}`,""),entry.promotedTo&&lines.push(`  Promoted to: ${entry.promotedTo}`,""),{exitCode:0,output:lines.join(`
+`),error:""}}function explainError(code,format){const entry=ERROR_CATALOG.get(code);if(!entry)return{exitCode:1,output:"",error:`Unknown error code: ${code}
+`};if(format==="json"){const payload={code:entry.code,category:"ERROR",summary:entry.summary,detail:entry.detail,recovery:entry.recovery,docUrl:entry.docUrl};return{exitCode:0,output:JSON.stringify(payload,null,2),error:""}}const lines=["",`${entry.code} \u2014 ${entry.summary}`,"",`  ${entry.detail}`,"","  Recovery:",`    ${entry.recovery}`,""];return entry.docUrl&&lines.push(`  See: ${entry.docUrl}`,""),{exitCode:0,output:lines.join(`
+`),error:""}}function explainFlag(key,format){const entry=FLAG_CATALOG.get(key);if(!entry)return{exitCode:1,output:"",error:`Unknown flag: ${key}
+`};if(format==="json"){const payload={code:key,category:"FLAG",summary:entry.summary,detail:entry.detail};return{exitCode:0,output:JSON.stringify(payload,null,2),error:""}}return{exitCode:0,output:["",`${key} \u2014 ${entry.summary}`,"",`  ${entry.detail}`,"","  Run `arbiter explain --list` to see all codes.",""].join(`
+`),error:""}}function listAll(format){const errorCodes=Array.from(ERROR_CATALOG.keys()),invCodes=INVARIANT_CATALOG.map(i=>i.id),projInvariants=loadProjectInvariants(),canonEntries=loadCanonEntries(CANON_MD_PATH),canonCodes=canonEntries.map(e=>e.id);if(format==="json"){const items=[...errorCodes.map(c=>{const e=ERROR_CATALOG.get(c);return{code:c,category:"ERROR",summary:e?.summary??""}}),...INVARIANT_CATALOG.map(i=>({code:i.id,category:"INV",summary:i.title})),...projInvariants.map(i=>({code:i.id,category:"PROJ",summary:i.title})),...canonEntries.map(c=>({code:c.id,category:"CANON",summary:c.title})),...Array.from(FLAG_CATALOG.entries()).map(([code,e])=>({code,category:"FLAG",summary:e.summary}))];return{exitCode:0,output:JSON.stringify(items,null,2),error:""}}const flagCodes=Array.from(FLAG_CATALOG.keys());return{exitCode:0,output:["","ERROR codes:",...errorCodes.map(c=>`  ${c}`),"","INV codes:",...invCodes.map(c=>`  ${c}`),...projInvariants.length>0?["","PROJ codes (project-declared):"]:[],...projInvariants.map(i=>`  ${i.id}`),"","CANON rules:",...canonCodes.map(c=>`  ${c}`),"","FLAG codes (wizard answers):",...flagCodes.map(c=>`  ${c}`),"","Run `arbiter explain <code>` for details on any entry.",""].join(`
+`),error:""}}

package/dist/commands/gate-exec.js

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+import{existsSync}from"node:fs";import{closeDescriptorTranslated,ensureDir,openAppendDescriptorTranslated,unlinkTranslated}from"../utils/fs.js";import{createHash,randomBytes}from"node:crypto";import{tmpdir}from"node:os";import{join,resolve}from"node:path";import{runCli,runInteractive,CliError}from"../utils/run-cli.js";import{ArbiterError}from"../utils/errors.js";export function deriveGateKey(dir){const commonDir=runCli("git",["rev-parse","--git-common-dir"],{cwd:dir}).stdout.trim(),absolute=resolve(dir,commonDir);return createHash("sha256").update(absolute).digest("hex").slice(0,16)}export function gateLockPath(key,env=process.env){const base=env.XDG_RUNTIME_DIR??tmpdir(),dir=join(base,"arbiter");return ensureDir(dir),join(dir,`${key}-gate.lock`)}export function assertFlockAvailable(env=process.env){try{runCli("flock",["--version"],{env,timeoutMs:1e4})}catch(e){const detail=e instanceof CliError&&e.notFound?"not found on PATH":"not runnable";throw ArbiterError.fromKey("E_GATE_MUTEX_UNSUPPORTED","errors.E_GATE_MUTEX_UNSUPPORTED",{detail})}}export function gateExecArgv(lockPath,cmdArgs){return["flock","-o","--",lockPath,...cmdArgs]}const CHILD_LOCK_FD=3,DESCENDANT_SENTINEL_FD=4,SUPERVISOR_SCRIPT=`exec ${DESCENDANT_SENTINEL_FD}>>"$1" || exit $?; shift; flock ${CHILD_LOCK_FD} || exit $?; (exec ${CHILD_LOCK_FD}>&-; exec "$@")`;export function gateQueueAdvisory(dir,lockPath){const helperPath=resolve(dir,"scripts","lib","waiter-count.mjs");if(!existsSync(helperPath))return null;try{const{stdout}=runCli("node",[helperPath,lockPath],{timeoutMs:5e3}),count=Number(stdout.trim());return!Number.isFinite(count)||count<2?null:`gate-exec: ${count} process(es) already queued on this mutex \u2014 CI is authoritative; consider pushing instead of waiting: ARBITER_PREPUSH_BYPASS=true ARBITER_PREPUSH_BYPASS_REASON="<reason>" git push (see docs/REFERENCE/api.md)`}catch{return null}}export async function runGateExec(opts){const dir=opts.dir??process.cwd();assertFlockAvailable();const key=opts.key??deriveGateKey(dir),lockPath=gateLockPath(key);process.stderr.write(`gate-exec: mutex ${lockPath} (blocking until free)
+`);const advisory=gateQueueAdvisory(dir,lockPath);advisory&&process.stderr.write(`${advisory}
+`);const lockFd=openAppendDescriptorTranslated(lockPath),sentinelPath=`${lockPath}.${process.pid}-${randomBytes(4).toString("hex")}.sentinel`;try{const{exitCode}=await runInteractive("sh",["-c",SUPERVISOR_SCRIPT,"gate-exec-supervisor",sentinelPath,...opts.cmdArgs],{cwd:dir,env:{...process.env,ARBITER_GATE_MUTEX_HELD:lockPath},extraFds:[lockFd],detached:!0,teardownProcessGroupOnSignal:!0,teardownOnParentSignal:!0,trackedDescendantFdPath:sentinelPath});return exitCode}finally{closeDescriptorTranslated(lockFd,lockPath),existsSync(sentinelPath)&&unlinkTranslated(sentinelPath)}}

package/dist/commands/gold-audit.js

@@ -0,0 +1,14 @@
+// SPDX-License-Identifier: Apache-2.0
+import{fileURLToPath}from"node:url";import{resolve}from"node:path";import{runCli,CliError}from"../utils/run-cli.js";import{detectBrownfieldClass}from"../kit/brownfield-detect.js";import{paint,colorEnabled,asciiOnly}from"../utils/tty.js";import{jsonOutput}from"../utils/json-output.js";function packageRoot(){return resolve(fileURLToPath(import.meta.url),"../../..")}function resolveClass(repo,override){if(override)return override;try{return detectBrownfieldClass(repo,"multi").brownfieldClass}catch{return"gold"}}function renderReport(p){const lines=[],b=p.level,toNext=b.nextLevel===null?"":` \xB7 ${b.toNextLevel} to ${b.nextLevel}`;if(lines.push(`gold-audit: ${b.level} (${b.brownfieldClass}) \xB7 score ${p.score}${toNext} \xB7 Y ${p.yCount}/${p.totals.checks} \xB7 RISKY ${p.riskyCount}`),p.gaps.length===0)lines.push("  what's missing: nothing \u2014 all applicable checks are Y.");else{lines.push(`  what's missing (${p.gaps.length} family/families):`);for(const g of p.gaps){lines.push(`    ${g.dimension}:`);for(const c of g.checks){const file=c.evidence?.file??"",detail=c.evidence?.detail?`: ${c.evidence.detail}`:"",ev=file||detail?` [${file}${detail}]`:"";lines.push(`      ${c.verdict} ${c.id} ${c.title}${ev}`)}}}return lines.join(`
+`)+`
+`}const COCKPIT_GLYPH={unicode:{Y:"\u{1F7E2}",P:"\u{1F7E1}",N:"\u{1F534}",NA:"\xB7",NV:"\u2754"},ascii:{Y:"Y",P:"P",N:"N",NA:".",NV:"?"}},VERDICT_COLOR={Y:"green",P:"yellow",N:"red",NA:"dim",NV:"cyan"},FRESH_COLOR={FRESH:"green",PARTIAL:"yellow",STALE:"red"};function sanitize(s,ascii=!1){const noCtrl=(typeof s=="string"?s:"").replace(/[\x00-\x1f\x7f\u0085\u2028\u2029]/g,"");return ascii?noCtrl.replace(/[^\x20-\x7e]/g,""):noCtrl}function num(n){const x=Number(n);return Number.isFinite(x)?x:0}function clampScore(n){const x=Number(n);return Number.isFinite(x)?Math.max(0,Math.min(100,x)):0}function displayScore(n){return String(Math.round(clampScore(n)*10)/10)}function scoreColor(score){return score>=75?"green":score>=50?"yellow":"red"}function scoreBar(score,w,ascii){const filled=Math.max(0,Math.min(w,Math.round(clampScore(score)/100*w))),fill=ascii?"#":"\u2588",empty=ascii?".":"\u2591";return fill.repeat(filled)+empty.repeat(w-filled)}function verdictCell(verdict,ascii){const glyphs=ascii?COCKPIT_GLYPH.ascii:COCKPIT_GLYPH.unicode,v=typeof verdict=="string"?verdict:"NA",key=Object.hasOwn(glyphs,v)?v:"NA";return{glyph:glyphs[key]??glyphs.NA??"?",color:VERDICT_COLOR[key]??"dim"}}export function renderCockpit(p,fresh,opts){const{color,ascii}=opts,glyphs=ascii?COCKPIT_GLYPH.ascii:COCKPIT_GLYPH.unicode,sep=ascii?" | ":" \xB7 ",lines=[];if(fresh&&num(fresh.counts.total)>0){const c=fresh.counts,statusText=sanitize(fresh.status,ascii);lines.push(paint(`DATA ${statusText}`,FRESH_COLOR[statusText]??"dim",color)+`${sep}${num(c.fresh)}/${num(c.total)} report(s) within ${num(fresh.staleHours)}h`)}const b=p.level,toNext=b.nextLevel===null?"max level":`${num(b.toNextLevel)} to ${sanitize(b.nextLevel,ascii)}`;lines.push(paint(sanitize(b.level,ascii),scoreColor(clampScore(p.score)),color)+` (${sanitize(b.brownfieldClass,ascii)})${sep}score ${displayScore(p.score)}${sep}${toNext}${sep}Y ${num(p.yCount)}/${num(p.totals.checks)}`),lines.push("  "+paint(scoreBar(p.score,24,ascii),scoreColor(clampScore(p.score)),color)+` ${displayScore(p.score)}`),lines.push(""),lines.push("DIMENSIONS");const byDim=new Map;for(const c of p.checks){const dimKey=typeof c.dimension=="string"?c.dimension:"",arr=byDim.get(dimKey);arr?arr.push(c):byDim.set(dimKey,[c])}const rows=[...new Set([...Object.keys(p.dimensions),...byDim.keys()])].sort().map(id=>{const dim=p.dimensions[id]??{score:0,y:0},strip=(byDim.get(id)??[]).map(c=>{const cell=verdictCell(c.verdict,ascii);return paint(cell.glyph,cell.color,color)}).join(" ");return{label:sanitize(id,ascii),score:clampScore(dim.score),strip}}),w=rows.reduce((m,r)=>Math.max(m,r.label.length),0);for(const r of rows)lines.push(`  ${r.label.padEnd(w)}  ${paint(scoreBar(r.score,12,ascii),scoreColor(r.score),color)} ${displayScore(r.score).padStart(5)}  ${r.strip}`);if(num(p.riskyCount)>0){lines.push("");const dash=ascii?"--":"\u2014";lines.push(paint(`RISKY: ${num(p.riskyCount)} check(s) ${dash} false-gap meta-gate (scoring suppressed under --strict)`,"red",color))}return lines.push(""),lines.push(`legend: ${glyphs.Y} Y  ${glyphs.P} P  ${glyphs.N} N  ${glyphs.NA} NA  ${glyphs.NV} NV`),lines.join(`
+`)+`
+`}function runGoldAuditCheck(repo,script,cls,opts){const args=[script,"--check","--class",cls];opts.requireBaseline&&args.push("--require-baseline"),opts.stack&&args.push("--stack",opts.stack);try{const{stdout,stderr}=runCli("node",args,{cwd:repo});return stdout&&process.stdout.write(stdout),stderr&&process.stderr.write(stderr),{exitCode:0,payload:null}}catch(err){return err instanceof CliError?(err.stdout&&process.stdout.write(err.stdout),err.stderr&&process.stderr.write(err.stderr),{exitCode:err.exitCode===2?2:1,payload:null}):(process.stderr.write(`gold-audit: engine failed \u2014 ${String(err)}
+`),{exitCode:1,payload:null})}}function runGoldAuditCockpit(repo,script,cls,opts){const args=[script,"--cockpit-data","--class",cls];opts.stack&&args.push("--stack",opts.stack);let stdout;try{stdout=runCli("node",args,{cwd:repo}).stdout}catch(err){const detail=err instanceof CliError?err.message:String(err);return process.stderr.write(`gold-audit: engine failed \u2014 ${detail}
+`),{exitCode:1,payload:null}}const text=stdout.trim();if(!text.startsWith("{"))return opts.quiet||process.stdout.write(text+`
+`),{exitCode:0,payload:null};let env;try{env=JSON.parse(text)}catch(err){return process.stderr.write(`gold-audit: invalid cockpit JSON \u2014 ${err.message}
+`),{exitCode:1,payload:null}}if(!opts.quiet){const ascii=asciiOnly(!!opts.ascii),color=colorEnabled()&&!ascii;try{process.stdout.write(renderCockpit(env.payload,env.freshness??null,{color,ascii}))}catch(err){return process.stderr.write(`gold-audit: could not render cockpit \u2014 ${err.message}
+`),{exitCode:1,payload:env.payload}}}return{exitCode:0,payload:env.payload}}function emitGoldAuditResult(opts,result){opts.quiet||(opts.json?jsonOutput("gold-audit","ok",typeof result=="string"?{}:{...result}):typeof result=="string"?process.stdout.write(result+`
+`):process.stdout.write(renderReport(result)))}export function runGoldAudit(opts={}){const repo=opts.repo?resolve(opts.repo):process.cwd(),cls=resolveClass(repo,opts.class),script=resolve(packageRoot(),"scripts/gold-audit.mjs");if(opts.check)return runGoldAuditCheck(repo,script,cls,opts);if(opts.cockpit||opts.ascii)return runGoldAuditCockpit(repo,script,cls,opts);const args=["--json","--class",cls];opts.stack&&args.push("--stack",opts.stack);let stdout;try{stdout=runCli("node",[script,...args],{cwd:repo}).stdout}catch(err){const detail=err instanceof CliError?err.message:String(err);return opts.json?jsonOutput("gold-audit","error",{},[`gold-audit: engine failed \u2014 ${detail}`]):process.stderr.write(`gold-audit: engine failed \u2014 ${detail}
+`),{exitCode:1,payload:null}}const text=stdout.trim();if(!text.startsWith("{"))return emitGoldAuditResult(opts,text),{exitCode:0,payload:null};let payload;try{payload=JSON.parse(text)}catch(err){const message=`gold-audit: engine emitted invalid JSON \u2014 ${err.message}`;return opts.json?jsonOutput("gold-audit","error",{},[message]):process.stderr.write(message+`
+`),{exitCode:1,payload:null}}return emitGoldAuditResult(opts,payload),{exitCode:0,payload}}

package/dist/commands/graph.js

@@ -0,0 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+import{existsSync,readFileSync,statSync}from"node:fs";import{dirname,join,resolve}from"node:path";import{ensureDir,writeFileTranslated}from"../utils/fs.js";import{INVARIANT_CATALOG}from"../invariants/catalog.js";import{loadConfig}from"../utils/config.js";import{buildInvNodes}from"../graph/builders/inv.js";import{buildAdrNodes}from"../graph/builders/adr.js";import{buildReqNodes}from"../graph/builders/req.js";import{buildAstNodes}from"../graph/builders/ast.js";import{buildTestNodes}from"../graph/builders/test-nodes.js";import{buildEvidenceNodes}from"../graph/builders/evidence.js";import{buildCanonNodes}from"../graph/builders/canon.js";import{GraphStore}from"../graph/store.js";import{toDot,toMermaid,toJson}from"../graph/query.js";export const GRAPH_RELATIVE_PATH=join(".arbiter","graph.json");export function runGraphBuild(opts={}){const dir=resolve(opts.dir??"."),format=opts.format??"json",defaultExt=format==="json"?"graph.json":`graph.${format}`,defaultOut=join(dir,".arbiter",defaultExt),outPath=opts.output!==void 0?resolve(opts.output):defaultOut,store=new GraphStore,stored=loadConfig(dir),invariants=stored?.governance?.projectInvariants!==void 0&&stored.governance.projectInvariants.length>0?[...INVARIANT_CATALOG,...stored.governance.projectInvariants]:INVARIANT_CATALOG;buildInvNodes(invariants,store),buildAdrNodes(store,{},dir),buildReqNodes(store,{},dir),buildAstNodes(store,{},dir),buildTestNodes(store,{},dir),buildEvidenceNodes(store,{},dir),buildCanonNodes(store,{},dir);const snapshot=store.snapshot();let rendered;format==="dot"?rendered=toDot(snapshot)+`
+`:format==="mermaid"?rendered=toMermaid(snapshot)+`
+`:rendered=toJson(snapshot)+`
+`;try{ensureDir(dirname(outPath)),writeFileTranslated(outPath,rendered)}catch(err){return{status:"error",exitCode:2,path:outPath,nodes:snapshot.nodes.length,edges:snapshot.edges.length,reason:`failed to write ${outPath}: ${err instanceof Error?err.message:String(err)}`}}return{status:"ok",exitCode:0,path:outPath,nodes:snapshot.nodes.length,edges:snapshot.edges.length}}export function runVerifyGraph(opts={}){const dir=resolve(opts.dir??"."),inPath=opts.input!==void 0?resolve(opts.input):join(dir,GRAPH_RELATIVE_PATH),loadResult=loadSnapshot(inPath);if("reason"in loadResult)return makeError(inPath,[],0,[],loadResult.reason);const snapshot=loadResult.snapshot,brokenRefFailures=checkBrokenRefs(snapshot),store=buildStoreFromSnapshot(snapshot),invNodes=store.nodesByKind("INV"),orphanInvFailures=checkOrphanInvariants(invNodes,store),orphanNodeFailures=checkOrphanNodes(store),missingEvidenceFailures=checkMissingEvidence(invNodes,store),staleProverFailures=checkStaleProvers(store,dir),allFailures=[...brokenRefFailures,...orphanInvFailures,...orphanNodeFailures,...missingEvidenceFailures,...staleProverFailures],orphans=orphanInvFailures.map(f=>({id:f.id,reason:f.reason}));return allFailures.length>0?{status:"error",exitCode:2,path:inPath,orphans,totalInv:invNodes.length,failures:allFailures,reason:summarizeFailures(allFailures)}:{status:"ok",exitCode:0,path:inPath,orphans:[],totalInv:invNodes.length,failures:[]}}function loadSnapshot(inPath){if(!existsSync(inPath))return{reason:`graph snapshot not found at ${inPath} \u2014 run \`arbiter graph build\` first`};let raw;try{raw=readFileSync(inPath,"utf-8")}catch(err){return{reason:`failed to read ${inPath}: ${err instanceof Error?err.message:String(err)}`}}let parsed;try{parsed=JSON.parse(raw)}catch(err){return{reason:`failed to parse ${inPath}: ${err instanceof Error?err.message:String(err)}`}}if(parsed===null||typeof parsed!="object")return{reason:`${inPath}: expected JSON object`};const obj=parsed;return!Array.isArray(obj.nodes)||!Array.isArray(obj.edges)?{reason:`${inPath}: missing nodes/edges arrays`}:{snapshot:parsed}}function buildStoreFromSnapshot(snapshot){const nodeIds=new Set(snapshot.nodes.map(n=>n.id)),store=new GraphStore;for(const node of snapshot.nodes)store.upsertNode(node);for(const edge of snapshot.edges)nodeIds.has(edge.from)&&nodeIds.has(edge.to)&&store.addEdge(edge);return store}function checkBrokenRefs(snapshot){const nodeIds=new Set(snapshot.nodes.map(n=>n.id)),failures=[];for(const edge of snapshot.edges){const edgeId=`${edge.from} -[${edge.kind}]-> ${edge.to}`;nodeIds.has(edge.from)||failures.push({kind:"broken-ref",id:edgeId,reason:`edge 'from' node "${edge.from}" does not exist`}),nodeIds.has(edge.to)||failures.push({kind:"broken-ref",id:edgeId,reason:`edge 'to' node "${edge.to}" does not exist`})}return failures}function checkOrphanInvariants(invNodes,store){return invNodes.filter(inv=>store.outgoing(inv.id,"enforces").length===0&&store.incoming(inv.id,"implements").length===0).map(inv=>({kind:"orphan-invariant",id:inv.id,reason:"no `enforces` edge and no incoming `implements` edge"}))}function checkOrphanNodes(store){return store.allNodes().filter(node=>node.kind!=="GATE"&&store.outgoing(node.id).length===0&&store.incoming(node.id).length===0).map(node=>({kind:"orphan-node",id:node.id,reason:`${node.kind} node has no edges`}))}function checkMissingEvidence(invNodes,store){const gateEvidenceEdges=store.allEdges().filter(e=>e.kind==="produces");if(gateEvidenceEdges.length===0)return[];const gatesWithEvidence=new Set(gateEvidenceEdges.map(e=>e.from)),failures=[];for(const inv of invNodes)for(const edge of store.outgoing(inv.id,"enforces"))if(!gatesWithEvidence.has(edge.to)){failures.push({kind:"missing-evidence",id:inv.id,reason:`INV enforces GATE "${edge.to}" but that GATE has no EVIDENCE node via produces edge`});break}return failures}function checkStaleProvers(store,dir){const failures=[];for(const testNode of store.nodesByKind("TEST")){const testPath=testNode.attrs.path;if(typeof testPath!="string")continue;let exists=!1;try{statSync(join(dir,testPath)),exists=!0}catch{}exists||failures.push({kind:"stale-prover",id:testNode.id,reason:`TEST node path "${testPath}" does not exist on disk`})}return failures}function makeError(path,orphans,totalInv,failures,reason){return{status:"error",exitCode:2,path,orphans,totalInv,failures,reason}}function summarizeFailures(failures){const byKind={};for(const f of failures){const bucket=byKind[f.kind]??[];bucket.push(f.id),byKind[f.kind]=bucket}return Object.entries(byKind).map(([k,ids])=>`${ids.length} ${k}(${ids.join(", ")})`).join(", ")}

package/dist/commands/init/build-arbiter-config.js

@@ -0,0 +1 @@
+import{DEFAULT_THRESHOLDS}from"../../config/schema.js";import{resolveCollaborationMode}from"../../config/collaboration-mode-defaults.js";function buildLanguageField(config){return config.language!=="unknown"?{language:config.language}:{}}function buildDatabaseFields(config){return{hasDatabase:config.hasDatabase,...config.databaseEngine!==void 0?{databaseEngine:config.databaseEngine}:{}}}function buildProviderFields(config){return{...config.observability!==void 0?{observability:config.observability}:{},...config.auth!==void 0?{auth:config.auth}:{},...config.frontend!==void 0?{frontend:config.frontend}:{}}}function buildCollapsedAxisFields(config){return{...config.runnerProfile!==void 0&&config.runnerProfile!=="fleet"?{runnerProfile:config.runnerProfile}:{},...config.industryOverlay!==void 0&&config.industryOverlay!=="none"?{industryOverlay:config.industryOverlay}:{},...config.deployTarget!==void 0&&config.deployTarget!=="none"?{deployTarget:config.deployTarget}:{}}}function buildOptionalAxisFields(config){return{...config.evidenceRetention!==void 0?{evidenceRetention:config.evidenceRetention}:{},...config.thresholdProfile!==void 0?{thresholdProfile:config.thresholdProfile}:{},...config.strictnessTier!==void 0?{strictnessTier:config.strictnessTier}:{},...buildCollapsedAxisFields(config),...config.basePackage!==void 0?{basePackage:config.basePackage}:{},...config.taxonomy!==void 0?{taxonomy:config.taxonomy}:{}}}function buildCollaborationOverrides(config){return{collaborationMode:resolveCollaborationMode(config),...config.solo!==void 0?{solo:config.solo}:{},...config.branchingStrategy!==void 0?{branchingStrategy:config.branchingStrategy}:{},automation:config.automation??{autonomy:"L0"}}}export function buildArbiterConfig(config){const level=config.governanceLevel,backend=config.decompositionBackend??(config.useGitHub?"github":"markdown");return{version:"0.2",projectName:config.projectName,tools:config.tools,governanceLevel:level,permitGitHub:config.useGitHub,decomposition:{backend},...buildLanguageField(config),packageManager:config.packageManager??"npm",features:{debtGates:config.enableDebtGates,suppressions:config.enableSuppressions,securityScanning:config.enableSecurityScanning,mutationTesting:config.enableMutationTesting!==!1,contractTesting:config.enableContractTesting!==!1,evidenceHarness:config.enableEvidenceHarness===!0,selfValidationHarness:config.enableSelfValidationHarness!==!1,auditToolchain:config.enableAuditToolchain===!0,fiveLaneCi:config.enableFiveLaneCi===!0,soloDevMode:config.enableSoloDevMode===!0,mcpFallback:config.enableMcpFallback===!0,noSkippedTests:config.enableNoSkippedTests!==!1,riskRegister:config.enableRiskRegister===!0,operationsHandbook:config.enableOperationsHandbook===!0,iso27001Mapping:config.enableIso27001Mapping===!0,nis2Mapping:config.enableNis2Mapping===!0,gdprMapping:config.enableGdprMapping===!0,codeownersNotify:config.enableCodeownersNotify===!0,taxonomy25d:config.enableTaxonomy25d===!0,perfTesting:config.enablePerfTesting===!0},...buildCollaborationOverrides(config),thresholds:config.thresholds??DEFAULT_THRESHOLDS[level],invariantTiers:config.invariantTiers,archetype:config.archetype,architectureStyle:config.architectureStyle,isMultiTenant:config.isMultiTenant,...buildDatabaseFields(config),hasPublicApi:config.hasPublicApi,...config.acceptBetaTools===!0?{acceptBetaTools:!0}:{},contractType:config.contractType,...buildOptionalAxisFields(config),...config.lanes.length>0?{lanes:config.lanes}:{},...config.taskTiers!==void 0?{taskTiers:config.taskTiers}:{},...buildProviderFields(config),...config.crossModelReview!==void 0?{crossModelReview:config.crossModelReview}:{},...config.preset!==void 0&&config.preset!=="none"?{preset:config.preset}:{},...config.projectInvariants!==void 0&&config.projectInvariants.length>0?{governance:{projectInvariants:config.projectInvariants,...config.liveSsot!==void 0?{liveSsot:config.liveSsot}:{}}}:config.liveSsot!==void 0?{governance:{liveSsot:config.liveSsot}}:{}}}

package/dist/commands/init/generate.js

@@ -0,0 +1,42 @@
+// SPDX-License-Identifier: Apache-2.0
+import{existsSync,readFileSync}from"node:fs";import{resolve,join,normalize,isAbsolute,relative,sep,basename}from"node:path";import{ArbiterError}from"../../utils/errors.js";import{t}from"../../i18n/index.js";import{getLogger}from"../../utils/logger.js";import{levelAtLeast}from"../../config/levels.js";import{buildRegistry,runGeneratorsFromRegistry}from"../../generators/registry.js";import{loadPlugin}from"../../utils/plugin-loader.js";import{renderFromAbsPath}from"../../utils/render.js";import{copyFileTranslated,unlinkTranslated,writeFile}from"../../utils/fs.js";import{runCli,CliError}from"../../utils/run-cli.js";import{buildArbiterConfig}from"./build-arbiter-config.js";import{runBackendSetup}from"./github-setup.js";import{loadConfig,saveConfig}from"../../utils/config.js";import{beginGenerationSession,endGenerationSession}from"../../utils/fs.js";import{loadGeneratedManifest,saveGeneratedManifest}from"../../state/generated-manifest.js";import{buildAdoptPredicate,recordLocalOverride}from"../adopt-policy.js";import{detectInstalledSkills}from"../../integrations/skill-detector.js";import{computeSkipReport,excludeOwnEmittedSkills}from"../../generators/skills.js";import{jsonOutput,statusToExitCode}from"../../utils/json-output.js";export function runGenerators(config){return runGeneratorsFromRegistry(buildRegistry(config),[],{dryRun:!1})}export async function generateAndFinalize(args){const{config,targetDir,initOptions,log,brownfieldDetected,packageManager}=args;log(`
+  Generating...`);const committed=[];try{const execution=await executeInitGeneration({config,targetDir,dryRun:!1,adoptGovernance:initOptions.adoptGovernance===!0,onAdopt:(key,priorContent,newContent)=>{recordLocalOverride(targetDir,{key,priorContent,newContent})}}),{results,errors:generatorErrors,mergedConfig,plugins}=execution;writeSkillAudit(targetDir,execution.installedSkills),saveGeneratedManifest(targetDir,{...execution.prevManifest,...execution.generatedHashes}),committed.push(...results);const newConfig=buildArbiterConfig(mergedConfig),backendResult=runBackendSetup(config,log);await saveConfig(targetDir,newConfig),committed.push(...await runPlugins(targetDir,plugins,newConfig)),initOptions.json||printResults(committed,targetDir),printBrownfieldConflicts(committed,initOptions,log),assertEmittedFilesPresent(committed),printGreenfieldConflicts(committed,initOptions,log);const created=committed.filter(result=>result.action==="created").length,skipped=committed.filter(result=>result.action==="skipped").length,brownfieldWarning=brownfieldDetected&&!initOptions.brownfield?t("cli.init.brownfield_route"):void 0;brownfieldWarning!==void 0&&!initOptions.json&&log(`
+  ${brownfieldWarning}`),log(`
+  Done! ${created} files created, ${skipped} skipped.`),maybeCaptureBaseline(config,targetDir,initOptions.brownfield,packageManager),activateGitHooks(targetDir,log);const setup=printInstallHint(config,targetDir,packageManager,initOptions.json);emitInitOutput(initOptions.json,generatorErrors.map(error=>`${error.key}: ${error.message}`),brownfieldWarning===void 0?backendResult.warnings:[...backendResult.warnings,brownfieldWarning],{created,skipped,setup})}catch(err){throw process.stderr.write(`
+  Generation failed \u2014 attempting rollback...
+`),rollbackGeneration(committed),process.stderr.write(`  Rollback complete. Review arbiter.json if it was partially written.
+`),err}finally{endGenerationSession()}}function detectSkillsForPlan(targetDir){const claudeHome=process.env.HOME?`${process.env.HOME}/.claude`:"";return excludeOwnEmittedSkills(detectInstalledSkills({targetDir,claudeHome}))}function writeSkillAudit(targetDir,installedSkills){installedSkills.length!==0&&writeFile(join(targetDir,".arbiter","detected-integrations.json"),JSON.stringify({detectedSkills:installedSkills,skippedGenerators:computeSkipReport(installedSkills)},null,2)+`
+`)}function printBrownfieldConflicts(committed,options,log){if(!options.brownfield||options.json)return;const conflicts=committed.filter(result=>result.action==="skipped");conflicts.length>0&&(log(`
+  Brownfield conflicts: ${conflicts.length} existing file(s) kept unchanged.`),log(`  Use --force to replace them with arbiter governance files.
+`))}function printGreenfieldConflicts(committed,options,log){if(options.brownfield||options.json)return;const skippedFiles=committed.filter(result=>result.action==="skipped"&&result.reason!=="not-applicable");if(skippedFiles.length>0){const names=skippedFiles.map(result=>basename(result.path)).join(", ");log(`
+  ${skippedFiles.length} file(s) already exist: ${names}`),log(`  Re-run with --force to overwrite existing files.
+`)}}function emitInitOutput(json,errorLines,warnings,result){const{created,skipped,setup}=result;if(json){const status=errorLines.length>0?"error":warnings.length>0?"warning":"ok";jsonOutput("init",status,{created,skipped,...setup===void 0?{}:{nextSteps:[setup]}},errorLines.length>0?errorLines:void 0,warnings.length>0?{warnings}:void 0),status!=="ok"&&process.exit(statusToExitCode(status));return}errorLines.length>0&&(process.stdout.write(`
+  Generator failures (${errorLines.length}):
+${errorLines.map(line=>`    - ${line}`).join(`
+`)}
+
+  See https://github.com/arbiter-framework/arbiter/issues/483 for context.
+`),process.exit(statusToExitCode("error"))),process.stdout.write(`${t("cli.init.verify_hint")}
+`)}function printInstallHint(config,targetDir,packageManager,json){const manager=packageManager??config.packageManager??"npm";if(existsSync(join(targetDir,"node_modules","@getarbiter","cli","dist","cli.js")))return localCliInstallStep(targetDir,manager,json);const callerSpec="$arbiter_spec",command=manager==="pnpm"?`pnpm add --save-dev --save-exact "${callerSpec}"`:manager==="yarn"?`yarn add --dev --exact "${callerSpec}"`:manager==="bun"?`COREPACK_ENABLE_PROJECT_SPEC=0 bun add --dev --exact --trust "${callerSpec}"`:`npm install --save-dev --save-exact "${callerSpec}"`,setup={command,requiresUserValue:!0};return json!==!0&&process.stdout.write(`${t("cli.init.local_arbiter_setup",{setupCommand:command})}
+`),setup}function localCliInstallStep(targetDir,manager,json){const missing=missingDevDependencies(targetDir);if(missing!==null&&missing.length===0)return;const installCommand=`${manager} install`,key=missing===null?"cli.init.install_first_hint_unreadable":"cli.init.install_first_hint";return json!==!0&&process.stdout.write(`${t(key,{installCommand})}
+`),{command:installCommand,requiresUserValue:!1}}function missingDevDependencies(targetDir){try{const manifest=JSON.parse(readFileSync(join(targetDir,"package.json"),"utf-8"));return Object.keys(manifest.devDependencies??{}).filter(name=>!existsSync(join(targetDir,"node_modules",name,"package.json")))}catch{return null}}function activateGitHooks(targetDir,log){if(!existsSync(join(targetDir,".githooks","pre-commit")))return;let current="";try{current=runCli("git",["config","--get","core.hooksPath"],{cwd:targetDir}).stdout.trim()}catch(err){if(err instanceof CliError&&err.notFound)return}if(current!==".githooks"){if(current!==""){getLogger().warn("init.hookspath_external",{current},`core.hooksPath is set to '${current}'; arbiter's hooks (.githooks) are NOT active. To use the gate guards, run: git config core.hooksPath .githooks`);return}try{runCli("git",["config","core.hooksPath",".githooks"],{cwd:targetDir}),log("  \u2713 Git hooks activated (core.hooksPath \u2192 .githooks) \u2014 the gate now guards every commit and push.")}catch{getLogger().warn("init.hookspath_set_failed",{},"Could not set core.hooksPath automatically. Activate manually: git config core.hooksPath .githooks")}}}function assertPathContained(resolvedPath,safeRoot,rawPath){if(!resolvedPath.startsWith(safeRoot+sep))throw new Error(`Plugin output path escapes target directory: ${rawPath}`)}export async function collectPluginInvariants(targetDir,plugins){const all=[];for(const pkg of plugins)try{const plugin=await loadPlugin(pkg,targetDir);plugin.invariants!==void 0&&all.push(...plugin.invariants)}catch(err){getLogger().warn("init.plugin_invariants_unavailable",{plugin:pkg},`Plugin "${pkg}" invariants unavailable: ${err instanceof Error?err.message:String(err)}`)}return all}export function mergeProjectInvariants(config,pluginInvariants){if(pluginInvariants.length===0)return config;const configIds=new Set((config.projectInvariants??[]).map(inv=>inv.id)),pluginOnly=pluginInvariants.filter(inv=>!configIds.has(inv.id));return{...config,projectInvariants:[...config.projectInvariants??[],...pluginOnly]}}export async function runPlugins(targetDir,plugins,storedConfig){const all=[],writtenPaths=new Set,failures=[];for(const pkg of plugins)try{const plugin=await loadPlugin(pkg,targetDir);if(plugin.detect&&!await plugin.detect(storedConfig))continue;const ctx={config:storedConfig,targetDir,renderTemplate(relPath,data){const safe=normalize(relPath);if(safe.startsWith("..")||isAbsolute(safe))throw new Error(`Invalid plugin template path: ${relPath}`);return renderFromAbsPath(join(plugin.templateRoot,safe),data)}},result=await plugin.generate(ctx);if(!Array.isArray(result.files)){getLogger().warn("init.plugin_invalid_result",{plugin:pkg},`Plugin "${pkg}" returned invalid result (no files array). Skipping.`);continue}for(const file of result.files){if(writtenPaths.has(file.path)){getLogger().warn("init.plugin_conflict",{plugin:pkg,path:file.path},`Plugin "${pkg}" conflict: "${file.path}" already written by a prior plugin. Skipping.`),all.push({path:file.path,action:"skipped"});continue}const resolvedFilePath=resolve(targetDir,file.path);assertPathContained(resolvedFilePath,resolve(targetDir),file.path),writtenPaths.add(file.path),all.push(writeFile(resolvedFilePath,file.content,{backup:file.action==="backup-and-replace",skipIfExists:file.action==="skip"}))}}catch(err){failures.push(`Plugin "${pkg}": ${err instanceof Error?err.message:String(err)}`)}if(failures.length>0)throw ArbiterError.fromKey("E_INIT_PLUGIN_FAILURES","errors.E_INIT_PLUGIN_FAILURES",{failures:failures.join(`
+  `)});return all}async function buildInitGenerationPlan(config,targetDir){const installedSkills=detectSkillsForPlan(targetDir),storedBefore=loadConfig(targetDir),plugins=Array.isArray(storedBefore?.plugins)?storedBefore.plugins:[],mergedConfig=mergeProjectInvariants(config,await collectPluginInvariants(targetDir,plugins));return{mergedConfig,specs:buildRegistry(mergedConfig,installedSkills),installedSkills,plugins,prevManifest:loadGeneratedManifest(targetDir)}}export async function executeInitGeneration(args){const{config,targetDir,dryRun}=args,plan=await buildInitGenerationPlan(config,targetDir);beginGenerationSession({targetDir,prevHashes:plan.prevManifest,adoptPredicate:buildAdoptPredicate({adoptGovernance:args.adoptGovernance===!0}),...dryRun||args.onAdopt===void 0?{}:{onAdopt:args.onAdopt}});const errors=[];let results,generatedHashes;try{results=runGeneratorsFromRegistry(plan.specs,errors,{dryRun})}finally{generatedHashes=endGenerationSession()}return{...plan,results,errors,generatedHashes}}export async function computeDryRunPreview(config){const{results}=await executeInitGeneration({config,targetDir:config.targetDir,dryRun:!0}),preview={created:[],modified:[],skipped:[]};for(const result of results){if(result.reason==="not-applicable")continue;const rel=relative(config.targetDir,result.path);result.action==="created"?preview.created.push(rel):result.action==="skipped"?preview.skipped.push(rel):preview.modified.push(rel)}return preview}function errMsg(err){return err instanceof Error?err.message:String(err)}export function rollbackGeneration(results){const rollbackErrors=[];for(const result of results)if(result.action==="created")try{existsSync(result.path)&&unlinkTranslated(result.path)}catch(err){rollbackErrors.push(`Could not remove ${result.path}: ${errMsg(err)}`)}else if(result.action==="backed-up-and-replaced"){const backup=`${result.path}.arbiter-backup`;try{existsSync(backup)&&(copyFileTranslated(backup,result.path),unlinkTranslated(backup))}catch(err){rollbackErrors.push(`Could not restore backup for ${result.path}: ${errMsg(err)}`)}}if(rollbackErrors.length>0){process.stderr.write(`  Rollback partial \u2014 manual cleanup required:
+`);for(const e of rollbackErrors)process.stderr.write(`    ${e}
+`)}}export function maybeCaptureBaseline(config,targetDir,brownfield,packageManager){const fatal=levelAtLeast(config.governanceLevel,"L3")&&config.enableDebtGates;if(shouldCaptureBaseline(fatal,brownfield,config.enableDebtGates)){if(typescriptDependenciesAreMissing(config,targetDir)){reportMissingTypescriptDependencies(config,packageManager);return}runBrownfieldCapture(targetDir,fatal?{fatal:!0}:void 0)}}function shouldCaptureBaseline(fatal,brownfield,debtGatesEnabled){return fatal||brownfield&&debtGatesEnabled}function typescriptDependenciesAreMissing(config,targetDir){return config.language==="typescript"&&!existsSync(join(targetDir,"node_modules"))}function reportMissingTypescriptDependencies(config,packageManager){const installCommand=`${packageManager??config.packageManager??"npm"} install`;process.stdout.write(`  Debt baseline NOT captured: node_modules is absent, so the collectors cannot measure this project yet. Run ${installCommand}, then: node scripts/capture-debt-baseline.mjs
+`)}function runBrownfieldCapture(targetDir,opts={fatal:!1}){process.stdout.write(`${t("cli.init.capturing_baseline")}
+`);try{runCli("node",["scripts/capture-debt-baseline.mjs"],{cwd:targetDir,timeoutMs:6e5}),process.stdout.write(`${t("cli.init.baseline_captured")}
+`)}catch(err){const msg=err instanceof Error?err.message:String(err);opts.fatal&&(process.stderr.write(`  GATE FAIL: Baseline capture failed (${msg}). Fix toolchain or run: node scripts/capture-debt-baseline.mjs
+`),process.exit(1)),getLogger().warn("init.baseline_capture_failed",{err:msg},`Baseline capture failed (${msg}). Re-run manually: node scripts/capture-debt-baseline.mjs`)}}export function assertEmittedFilesPresent(results){const missing=results.filter(r=>r.action!=="skipped"&&r.action!=="dry-run").filter(r=>!existsSync(r.path)).map(r=>r.path);if(missing.length>0)throw new Error(`Emission integrity check failed \u2014 ${missing.length} file(s) reported written but not found on disk:
+${missing.map(p=>`    - ${p}`).join(`
+`)}
+This is a generator bug (content silently dropped). Re-run init or file an issue.`)}export function printResults(results,targetDir){for(const result of results){if(result.reason==="not-applicable")continue;const icon=result.action==="skipped"?"\u2502  ":"\u251C\u2500\u2500",label=result.excluded==="ignored"?" \u2014 skipped (.arbiterignore)":result.excluded==="deselected"?" \u2014 skipped (outside --only)":result.action==="skipped"?" (skipped \u2014 already exists)":result.action==="backed-up-and-replaced"?" (backed up + replaced)":"",relPath=result.path.replace(targetDir+"/","");process.stdout.write(`${t("cli.init.file_entry",{icon,relPath,label})}
+`)}}export async function displayDryRunPreview(config){const preview=await computeDryRunPreview(config);if(process.stdout.write(`${t("cli.init.dry_run_notice_full")}
+`),preview.created.length>0){process.stdout.write(`${t("cli.init.dry_run_create_header")}
+`);for(const entry of preview.created)process.stdout.write(`${t("cli.init.dry_run_create_file",{entry})}
+`)}if(preview.modified.length>0){process.stdout.write(`${t("cli.init.dry_run_modify_header")}
+`);for(const entry of preview.modified)process.stdout.write(`${t("cli.init.dry_run_modify_file",{entry})}
+`)}if(preview.skipped.length>0){process.stdout.write(`${t("cli.init.dry_run_skip_header")}
+`);for(const entry of preview.skipped)process.stdout.write(`${t("cli.init.dry_run_skip_file",{entry})}
+`)}process.stdout.write(`${t("cli.init.dry_run_deferred_note")}
+`),process.stdout.write(`${t("cli.init.dry_run_run_hint")}
+`)}

package/dist/commands/init/github-setup.js

@@ -0,0 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+import{join}from"node:path";import{FatalError,ConfigError}from"../../utils/errors.js";import{provisionLabels}from"../../github/labels.js";import{applyBranchProtection}from"../../github/branch-protection.js";import{createProjectBoard}from"../../github/project-board.js";import{resolveCollaborationMode}from"../../config/collaboration-mode-defaults.js";import{ensureDir}from"../../utils/fs.js";function throwOnFatalOrConfig(kind,msg,warnings){if(kind==="fatal")throw new FatalError("E_GH_FATAL",msg,{recoverableContext:warnings});if(kind==="config")throw new ConfigError("E_GH_NOT_INSTALLED",msg)}function setupLabels(owner,repo,warnings,log){const labelResult=provisionLabels(owner,repo);labelResult.created.length>0&&log(`  \u2502   Created: ${labelResult.created.join(", ")}`),labelResult.updated.length>0&&log(`  \u2502   Updated: ${labelResult.updated.join(", ")}`);for(const e of labelResult.classifiedErrors)log(`  \u2502   Error: ${e.message}`),throwOnFatalOrConfig(e.kind,e.message,warnings),warnings.push(e.message)}function setupBranchProtection(owner,repo,collaborationMode,warnings,log){const bp=applyBranchProtection(owner,repo,collaborationMode);bp.applied?log("  \u2502   Branch protection applied."):bp.error?(bp.errorKind&&throwOnFatalOrConfig(bp.errorKind,`branch protection: ${bp.error}`,warnings),log(`  \u2502   Skipped (requires admin access): ${bp.error}`),warnings.push(`branch protection skipped: ${bp.error}`)):log("  \u2502   Skipped (requires admin access)."),bp.repoSettingsError&&(log(`  \u2502   Repo merge settings FAILED (INV-101): ${bp.repoSettingsError}`),warnings.push(`repo merge settings failed (INV-101): ${bp.repoSettingsError}`))}function setupProjectBoard(owner,repo,projectName,warnings,log){const pb=createProjectBoard(owner,repo,projectName);pb.created?log(`      Project board created: ${pb.projectUrl}`):pb.error?log(`      Skipped: ${pb.error}`):log(`      Already exists: ${pb.projectUrl??"unknown"}`);for(const e of pb.classifiedErrors)throwOnFatalOrConfig(e.kind,e.message,warnings),log(`      Warning: ${e.message}`),warnings.push(`project board: ${e.message}`)}export function runBackendSetup(config,log){if((config.decompositionBackend??(config.useGitHub?"github":"markdown"))==="github")return runGithubSetup(config,log);const workDir=join(config.targetDir,".arbiter","work");return ensureDir(workDir),log(`
+  Markdown backend: scaffolded .arbiter/work/`),{warnings:[]}}export function runGithubSetup(config,log=msg=>{process.stdout.write(`${msg}
+`)}){if(!config.useGitHub||!config.githubOwner||!config.githubRepo)return{warnings:[]};const warnings=[];return log(`
+  GitHub setup...`),log("  \u251C\u2500\u2500 Provisioning labels..."),setupLabels(config.githubOwner,config.githubRepo,warnings,log),log("  \u251C\u2500\u2500 Applying branch protection to main..."),setupBranchProtection(config.githubOwner,config.githubRepo,resolveCollaborationMode(config),warnings,log),log("  \u2514\u2500\u2500 Creating project board..."),setupProjectBoard(config.githubOwner,config.githubRepo,config.projectName,warnings,log),{warnings}}

package/dist/commands/init/maturity-gates.js

@@ -0,0 +1,10 @@
+// SPDX-License-Identifier: Apache-2.0
+import{t}from"../../i18n/index.js";import{levelAtLeast}from"../../config/levels.js";import{buildRegistry}from"../../generators/registry.js";import{resolveStyle}from"../../generators/github.js";import{resolveServiceBucket}from"../../utils/render.js";import{isL3Allowed,hasMatrixCell}from"../../utils/maturity-check.js";import{validateCollaborationCoherence,validateLanguageArchetypeCoherence}from"../wizard/coherence.js";function capabilitiesForGenerator(key,config){switch(key){case"mutation":return[{feature:"mutation",language:config.language}];case"contract-testing":return[{feature:"contract",language:config.language}];case"coverage":return[{feature:"coverage",language:config.language}];case"security":return[{feature:"security",language:config.language}];case"debt-gates":return[{feature:"static_analysis",language:config.language}];case"behavioral-tests":return[{feature:"bdd",language:config.language}];case"archunit":return[{feature:"architecture",language:config.language}];case"frontend-quality":return[{feature:"style_tokens",language:"typescript"}];case"playwright-ts":return[{feature:"a11y",language:"typescript"},{feature:"e2e",language:"typescript"}];case"playwright-python":return[{feature:"a11y",language:"python"},{feature:"e2e",language:"python"}];case"github":return deriveWorkflowCapabilities(config);default:return[]}}function resolveWorkflowLanguages(language){return language==="multi"?["typescript","java"]:[language]}export function deriveWorkflowCapabilities(config){if(!levelAtLeast(config.governanceLevel,"L3"))return[];const c=workflowCtx(config),langs=resolveWorkflowLanguages(config.language);return WORKFLOW_DIM_RULES.filter(r=>r.emit(c)).flatMap(r=>r.dims).flatMap(feature=>langs.map(language=>({feature,language})))}const WORKFLOW_DIM_RULES=[{dims:["license_scan"],emit:()=>!0},{dims:["secret_scan"],emit:c=>c.secScanning||c.style!=="starter"||c.cm==="trunk-solo"},{dims:["container_scan"],emit:c=>c.isService||c.deploy},{dims:["sbom","binary_signing"],emit:c=>c.style!=="starter"||c.deploy},{dims:["provenance"],emit:c=>c.style!=="starter"},{dims:["fuzz"],emit:c=>c.isScheduled},{dims:["dast"],emit:c=>c.isScheduled&&c.isService||c.deploy}];function workflowCtx(config){const style=resolveStyle(config),cm=config.collaborationMode??"peer-review";return{style,cm,deploy:(config.deployTarget??"none")!=="none",isService:resolveServiceBucket(config.archetype)==="service",isScheduled:style!=="starter"&&cm!=="trunk-solo",secScanning:config.enableSecurityScanning}}export function deriveL3MaturityChecks(config,specs){const seen=new Set,checks=[];for(const spec of specs)if(spec.enabled)for(const cap of capabilitiesForGenerator(spec.key,config)){if(!hasMatrixCell(cap.language,cap.feature))continue;const dedupeKey=`${cap.feature}:${cap.language}`;seen.has(dedupeKey)||(seen.add(dedupeKey),checks.push(cap))}return checks}export function checkL3MaturityGates(config){if(!levelAtLeast(config.governanceLevel,"L3"))return;const accept=config.acceptBetaTools??!1,blocked=[];for(const{feature,language}of deriveL3MaturityChecks(config,buildRegistry(config))){const result=isL3Allowed(language,feature,accept);!result.allowed&&result.errorMessage&&blocked.push(`  \u2022 ${result.errorMessage}`)}if(blocked.length>0){process.stderr.write(`${t("cli.init.gate_failed")}
+`);for(const msg of blocked)process.stderr.write(`${msg}
+`);process.stderr.write(`${t("cli.init.accept_beta_hint")}
+`),process.exit(1)}}export function checkCollaborationCoherenceGate(config){const langArch=validateLanguageArchetypeCoherence(config.language,config.archetype);if(langArch.severity==="WARN"&&process.stdout.write(`
+  \u26A0 ${langArch.message}
+`),config.collaborationMode===void 0)return;const result=validateCollaborationCoherence(config.collaborationMode,config.governanceLevel);result.severity==="CRITICAL"&&(process.stderr.write(`${t("cli.init.coherence_gate_failed")}
+`),process.stderr.write(`  \u2022 ${result.message}
+`),result.remediation!==void 0&&process.stderr.write(`  ${result.remediation}
+`),process.exit(1))}

package/dist/commands/init/resolve-config.js

@@ -0,0 +1,3 @@
+// SPDX-License-Identifier: Apache-2.0
+import{ArbiterError}from"../../utils/errors.js";import{detectLanguageWithSource,jvmRoot}from"../../detectors/language.js";import{detectBuildCommands}from"../../detectors/build.js";import{detectArchetypeHint,detectFramework}from"../../detectors/framework.js";import{detectGitInfo}from"../../detectors/git.js";import{detectExisting}from"../../detectors/existing.js";import{detectBasePackage}from"../../detectors/package.js";import{detectGithubAccess}from"../../detectors/github.js";import{detectExternalModel}from"../../detectors/external-model.js";import{getLanguageHooks}from"../../detectors/language-hooks.js";import{detectPackageManager}from"../../detectors/package-manager.js";import{detectLanes}from"../../detectors/lanes.js";import{runWizard}from"../../wizard/prompts.js";import{DEFAULT_THRESHOLDS}from"../../config/schema.js";import{levelAtLeast}from"../../config/levels.js";import{presetToTiers,defaultPresetForLevel}from"../../invariants/filter.js";import{applyPreset}from"../../wizard/presets.js";import{defaultContractType}from"../../wizard/archetype-defaults.js";import{SUPPORTED_AI_TOOLS}from"../../wizard/types.js";function githubAuthError(githubAccess){return ArbiterError.fromKey("E_INIT_GITHUB_UNAUTHENTICATED","errors.E_INIT_GITHUB_UNAUTHENTICATED",{error:githubAccess.error??"gh is not authenticated"})}function resolveUseGitHub(options,_recipe,githubAccess){if(options.backend!==void 0){if(options.backend==="github"&&!githubAccess.authenticated)throw githubAuthError(githubAccess);return options.backend==="github"}if(options.github){if(!githubAccess.authenticated)throw githubAuthError(githubAccess);return!0}const arbGhEnv=process.env.ARBITER_GITHUB;if(arbGhEnv!==void 0&&arbGhEnv!=="1"&&process.stderr.write(`Warning: ARBITER_GITHUB=${arbGhEnv} is not '1' \u2014 only ARBITER_GITHUB=1 activates GitHub API calls. Ignored.
+`),arbGhEnv==="1"){if(!githubAccess.authenticated)throw githubAuthError(githubAccess);return!0}return!1}function buildNonInteractiveConfig(args){const{options,recipe,targetDir,projectName,language,framework,buildCmds,packageManager,gitInfo,existing,githubAccess,lanes}=args,useGitHub=resolveUseGitHub(options,recipe,githubAccess),{tools,governanceLevel}=resolveToolsAndLevel(options,recipe),config=buildDefaultConfig({targetDir,projectName,language:recipe?.language??language,framework:recipe&&"framework"in recipe?recipe.framework??null:framework,buildCmds,packageManager,gitInfo,existing,tools,governanceLevel,useGitHub,acceptBetaTools:options.acceptBetaTools??!1,lanes,...options.archetype!==void 0?{archetypeOverride:options.archetype}:{},solo:options.solo===!0});return recipe&&applyRecipeOverrides(config,recipe),options.deployTarget!==void 0&&(config.deployTarget=options.deployTarget),config}export function formatLangHint(locked,source){return locked?"":source?` (detected from ${source})`:" (no markers found)"}export function detectProjectForInit(targetDir,options,log){const languageOverride=parseLanguage(options.language),languageLocked=languageOverride!==void 0,languageDetection=languageOverride===void 0?detectLanguageWithSource(targetDir):null,language=languageOverride??languageDetection?.language??"unknown",languageSource=languageDetection?.source??null,framework=detectFramework(targetDir,language),buildCmds=detectBuildCommands(targetDir,language),packageManager=detectPackageManager(targetDir),gitInfo=detectGitInfo(targetDir),existing=detectExisting(targetDir),githubAccess=detectGithubAccess(),externalModelAccess=detectExternalModel("codex"),lanes=detectLanes(targetDir).lanes;return log(`  \u251C\u2500\u2500 Language: ${language}${formatLangHint(languageLocked,languageSource)}${framework?` / ${framework}`:""}`),log(`  \u251C\u2500\u2500 Build: ${buildCmds.buildTool}`),log(`  \u251C\u2500\u2500 Package manager: ${packageManager.name} (${formatPackageManagerSource(packageManager)})${packageManager.isWorkspace?" \u2014 workspace":""}`),log(`  \u251C\u2500\u2500 Git: ${gitInfo.isGitRepo?"yes":"no"}${gitInfo.githubRepo?` (${gitInfo.githubOwner}/${gitInfo.githubRepo})`:""}`),githubAccess.authenticated&&log(`  \u251C\u2500\u2500 GitHub: authenticated as ${githubAccess.username??"unknown"}`),{language,languageLocked,languageSource,framework,buildCmds,packageManager,gitInfo,existing,githubAccess,externalModelAccess,lanes}}function formatPackageManagerSource(packageManager){if(packageManager.source==="packageManager-field")return"package.json#packageManager";if(packageManager.source==="default")return"default";switch(packageManager.name){case"pnpm":return"pnpm-lock.yaml";case"yarn":return"yarn.lock";case"bun":return"bun lockfile";case"npm":return"package-lock.json"}}function resolveToolsAndLevel(options,recipe){return{tools:options.tools?parseTools(options.tools):recipe?.tools??parseTools(void 0),governanceLevel:options.level?parseLevel(options.level):recipe?.governanceLevel??parseLevel(void 0)}}export async function resolveConfig(args){const{options,recipe,targetDir,projectName,language,framework,buildCmds,packageManager,gitInfo,existing,githubAccess,externalModelAccess,lanes,languageLocked,languageSource}=args,presetFastPath=options.preset!==void 0&&options.preset!=="none";if(options.yes||recipe!==void 0||presetFastPath)return buildNonInteractiveConfig({options,recipe,targetDir,projectName,language,framework,buildCmds,packageManager,gitInfo,existing,githubAccess,lanes});const wizardResult=await runWizard({targetDir,projectName,language,framework,buildCmds:{...buildCmds,packageManager},gitInfo,existing,githubAccess,externalModelAccess,detectedLanes:lanes,languageLocked,languageSource});return wizardResult===null?null:(wizardResult.basePackage===void 0&&Object.assign(wizardResult,detectedBasePackage(language,targetDir)),wizardResult.packageManager=packageManager,wizardResult)}function buildDefaultConfig(opts){const archetype=opts.archetypeOverride??detectArchetypeHint(opts.targetDir,opts.language,opts.framework)??"library",hasDatabase=archetype==="backend-web-db"||archetype==="data-pipeline",hasPublicApi=archetype==="backend-web-db";return{targetDir:opts.targetDir,projectName:opts.projectName,description:`${opts.projectName} project`,language:opts.language,framework:opts.framework,archetype,architectureStyle:"none",isMultiTenant:!1,hasDatabase,hasPublicApi,buildTool:opts.buildCmds.buildTool,packageManager:opts.packageManager,buildCommand:opts.buildCmds.buildCommand,testCommand:opts.buildCmds.testCommand,lintCommand:opts.buildCmds.lintCommand,formatCommand:opts.buildCmds.formatCommand,tools:opts.tools,governanceLevel:opts.governanceLevel,useGitHub:opts.useGitHub,decompositionBackend:opts.useGitHub?"github":"markdown",githubOwner:opts.gitInfo.githubOwner,githubRepo:opts.gitInfo.githubRepo,existing:opts.existing,languageHooks:getLanguageHooks(opts.language),enableDebtGates:opts.governanceLevel!=="L1",enableSuppressions:!0,enableSecurityScanning:opts.governanceLevel!=="L1",enableMutationTesting:levelAtLeast(opts.governanceLevel,"L3"),enableContractTesting:defaultContractType(archetype,hasPublicApi)!=="none",enableEvidenceHarness:opts.governanceLevel==="L4",enableSelfValidationHarness:!0,enableSoloDevMode:!1,collaborationMode:opts.solo===!0?"trunk-solo":"peer-review",automation:{autonomy:"L0"},invariantTiers:presetToTiers(defaultPresetForLevel(opts.governanceLevel)),acceptBetaTools:opts.acceptBetaTools??!1,contractType:defaultContractType(archetype,hasPublicApi),thresholds:DEFAULT_THRESHOLDS[opts.governanceLevel],lanes:opts.lanes??[],...detectedBasePackage(opts.language,opts.targetDir),...archetype==="frontend-spa"?inferFEFramework(opts.framework)!==void 0?{frontend:{framework:inferFEFramework(opts.framework)}}:{}:{}}}function inferFEFramework(framework){if(!framework)return;const lower=framework.toLowerCase();if(lower==="vue"||lower.endsWith("+vue")||lower.startsWith("vue+"))return"vue";if(lower==="svelte")return"svelte";if(lower==="react"||lower.includes("react"))return"react"}function applyRecipeOverrides(config,recipe){recipe.archetype!==void 0&&(config.archetype=recipe.archetype),recipe.architectureStyle!==void 0&&(config.architectureStyle=recipe.architectureStyle),recipe.isMultiTenant!==void 0&&(config.isMultiTenant=recipe.isMultiTenant),recipe.hasDatabase!==void 0&&(config.hasDatabase=recipe.hasDatabase),recipe.hasPublicApi!==void 0&&(config.hasPublicApi=recipe.hasPublicApi),recipe.enableDebtGates!==void 0&&(config.enableDebtGates=recipe.enableDebtGates),recipe.enableSuppressions!==void 0&&(config.enableSuppressions=recipe.enableSuppressions),recipe.enableSecurityScanning!==void 0&&(config.enableSecurityScanning=recipe.enableSecurityScanning),recipe.enableMutationTesting!==void 0&&(config.enableMutationTesting=recipe.enableMutationTesting),recipe.enableContractTesting!==void 0&&(config.enableContractTesting=recipe.enableContractTesting),recipe.enableSoloDevMode!==void 0&&(config.enableSoloDevMode=recipe.enableSoloDevMode),recipe.enableMcpFallback!==void 0&&(config.enableMcpFallback=recipe.enableMcpFallback),recipe.enableNoSkippedTests!==void 0&&(config.enableNoSkippedTests=recipe.enableNoSkippedTests),recipe.automation!==void 0&&(config.automation=recipeAutomation(recipe.automation)),applyRecipeAxisOverrides(config,recipe),applyRecipeCiOverrides(config,recipe),applyRecipeActivationOverrides(config,recipe)}function applyRecipeCiOverrides(config,recipe){recipe.enableAuditToolchain!==void 0&&(config.enableAuditToolchain=recipe.enableAuditToolchain),recipe.enableFiveLaneCi!==void 0&&(config.enableFiveLaneCi=recipe.enableFiveLaneCi)}function applyRecipeActivationOverrides(config,recipe){recipe.enableCodeownersNotify!==void 0&&(config.enableCodeownersNotify=recipe.enableCodeownersNotify),recipe.enableTaxonomy25d!==void 0&&(config.enableTaxonomy25d=recipe.enableTaxonomy25d),recipe.enablePerfTesting!==void 0&&(config.enablePerfTesting=recipe.enablePerfTesting),applyRecipeComplianceOverrides(config,recipe)}function applyRecipeComplianceOverrides(config,recipe){recipe.enableRiskRegister!==void 0&&(config.enableRiskRegister=recipe.enableRiskRegister),recipe.enableOperationsHandbook!==void 0&&(config.enableOperationsHandbook=recipe.enableOperationsHandbook),recipe.enableIso27001Mapping!==void 0&&(config.enableIso27001Mapping=recipe.enableIso27001Mapping),recipe.enableNis2Mapping!==void 0&&(config.enableNis2Mapping=recipe.enableNis2Mapping),recipe.enableGdprMapping!==void 0&&(config.enableGdprMapping=recipe.enableGdprMapping)}function applyRecipeAxisOverrides(config,recipe){recipe.databaseEngine!==void 0&&(config.databaseEngine=recipe.databaseEngine,config.hasDatabase=recipe.databaseEngine!=="none"),recipe.contractType!==void 0&&(config.contractType=recipe.contractType),recipe.lanes!==void 0&&(config.lanes=recipe.lanes),recipe.evidenceHarness!==void 0&&(config.enableEvidenceHarness=recipe.evidenceHarness),recipe.decomposition!==void 0&&(config.decompositionBackend=recipe.decomposition.backend)}function recipeAutomation(a){return{autonomy:a.autonomy,...a.maxParallelWorktrees!==void 0?{maxParallelWorktrees:a.maxParallelWorktrees}:{},...a.defaultGateLevel!==void 0?{defaultGateLevel:a.defaultGateLevel}:{}}}export function applyPresetOptions(options,config){applyPreset(options.preset??"none",config),options.authProvider!=null&&options.authProvider!=="none"&&(config.auth={provider:"none",...config.auth},config.auth.provider=options.authProvider),options.observabilityProvider!=null&&options.observabilityProvider!=="none"&&(config.observability={provider:"none",...config.observability},config.observability.provider=options.observabilityProvider)}function detectedBasePackage(language,targetDir){if(language!=="java"&&language!=="kotlin"&&language!=="multi")return{};const bp=detectBasePackage(jvmRoot(targetDir)??targetDir);return bp!==void 0?{basePackage:bp}:{}}function parseTools(tools){if(!tools)return["claude","codex"];const VALID=new Set(SUPPORTED_AI_TOOLS),parsed=tools.split(",").map(s=>s.trim()),invalid=parsed.filter(s=>!VALID.has(s));if(invalid.length>0)throw ArbiterError.fromKey("E_INVALID_TOOL","errors.E_INVALID_TOOL",{noun:invalid.length===1?"tool":"tools",tool:invalid.map(s=>`"${s}"`).join(", "),valid:[...VALID].join(", ")});return parsed}function parseLevel(level){if(level===void 0)return"L2";if(level==="L1"||level==="L2"||level==="L3"||level==="L4")return level;throw ArbiterError.fromKey("E_INVALID_LEVEL","errors.E_INVALID_LEVEL",{level},{hint:"Use L1 (fast), L2 (standard, default), L3 (audit-grade), or L4 (compliance-grade)."})}export function resolveAdoptionTier(tier){if(tier==="bootstrap")return{governanceLevel:"L1",brownfield:!0};if(tier==="L1"||tier==="L2"||tier==="L3"||tier==="L4")return{governanceLevel:tier,brownfield:!1};throw ArbiterError.fromKey("E_INVALID_LEVEL","errors.E_INVALID_LEVEL",{level:tier},{hint:"Use bootstrap (gentlest Day-1 on-ramp), L1, L2, L3, or L4."})}export function applyAdoptionTier(options){if(options.tier===void 0)return;const resolved=resolveAdoptionTier(options.tier);options.level=resolved.governanceLevel,resolved.brownfield&&(options.brownfield=!0)}export function parseLanguage(language){if(language===void 0)return;if(new Set(["typescript","java","kotlin","rust","python","go","multi"]).has(language))return language;throw ArbiterError.fromKey("E_INVALID_LANGUAGE","errors.E_INVALID_LANGUAGE",{language})}

package/dist/commands/init/toolchain.js

@@ -0,0 +1,10 @@
+// SPDX-License-Identifier: Apache-2.0
+import{runProbes}from"../../compatibility/probe.js";import{formatText}from"../../compatibility/report.js";import{t}from"../../i18n/index.js";export function verifyToolchainBeforeWrite(targetDir,options){options.noVerify||options.dryRun||runToolchainVerify(targetDir,!!options.json)}function runToolchainVerify(targetDir,jsonMode=!1){const writeHuman=message=>{jsonMode?process.stderr.write(message):process.stdout.write(message)};writeHuman(`${t("cli.init.verifying_toolchain")}
+`);let report;try{report=runProbes(targetDir)}catch(err){const message=err instanceof Error?err.message:String(err);process.stderr.write(`
+  Toolchain verification failed unexpectedly: ${message}
+  No files were generated or modified. Use --no-verify to skip verification.
+`),process.exit(1)}writeHuman(`${formatText(report)}
+`),report.hasFailures&&(process.stderr.write(`
+  arbiter init aborted: toolchain incompatibilities detected.
+  Fix the issues above and re-run, or use --no-verify to skip.
+`),process.exit(1))}

package/dist/commands/init/types.js

@@ -0,0 +1 @@
+export{};

package/dist/commands/init.js

@@ -0,0 +1,17 @@
+// SPDX-License-Identifier: Apache-2.0
+import{resolve,join}from"node:path";import{acquireLock}from"../utils/file-lock.js";import{UserFacingError,ArbiterError}from"../utils/errors.js";import{t}from"../i18n/index.js";import{jsonOutput}from"../utils/json-output.js";import{getLogger}from"../utils/logger.js";import{detectGitInfo,detectAdverseGitState}from"../detectors/git.js";import{isBrownfield}from"../detectors/existing.js";import{loadConfig}from"../utils/config.js";import{slugifyProjectName,resolveProjectName}from"../config/resolve-project-name.js";import{isWindows,isWSL2}from"../utils/platform.js";import{runCli}from"../utils/run-cli.js";import{showTelemetryBannerIfFirstRun}from"../utils/first-run.js";import{loadRecipe}from"../recipes/loader.js";import{resolveConfig,applyPresetOptions,applyAdoptionTier,resolveAdoptionTier,detectProjectForInit}from"./init/resolve-config.js";import{buildArbiterConfig}from"./init/build-arbiter-config.js";import{runGenerators,runPlugins,computeDryRunPreview,displayDryRunPreview,rollbackGeneration,assertEmittedFilesPresent,printResults,generateAndFinalize}from"./init/generate.js";import{ensureDir}from"../utils/fs.js";import{runGithubSetup}from"./init/github-setup.js";import{verifyToolchainBeforeWrite}from"./init/toolchain.js";import{checkL3MaturityGates,checkCollaborationCoherenceGate,deriveWorkflowCapabilities,deriveL3MaturityChecks}from"./init/maturity-gates.js";export{runGenerators,runPlugins,computeDryRunPreview,rollbackGeneration,assertEmittedFilesPresent,printResults,runGithubSetup,buildArbiterConfig,resolveAdoptionTier,deriveWorkflowCapabilities,deriveL3MaturityChecks};function assertNotNativeWindows(){if(isWindows()&&!isWSL2())throw ArbiterError.fromKey("E_INIT_WIN32","errors.E_INIT_WIN32")}function assertKnownLanguage(language){if(language==="unknown")throw ArbiterError.fromKey("E_INIT_UNKNOWN_LANGUAGE","errors.E_INIT_UNKNOWN_LANGUAGE")}function runPreMutationGitGuards(targetDir,options){detectGitInfo(targetDir).isGitRepo&&(guardAdverseGitState(targetDir,options.force),options.brownfield&&guardBrownfieldDirtyTree(targetDir,options.force))}export{slugifyProjectName,resolveProjectName};export async function runInit(options){const targetDir=resolve(options.dir??process.cwd()),projectName=slugifyProjectName(resolveProjectName(targetDir,loadConfig(targetDir))),log=options.json?()=>{}:msg=>{process.stdout.write(`${msg}
+`)};if(options.json&&!options.yes){jsonOutput("init","error",{},["--json requires --yes (interactive wizard is incompatible with machine-readable output)"],{errorClass:"config"}),process.exit(78);return}applyAdoptionTier(options),assertNotNativeWindows(),runPreMutationGitGuards(targetDir,options),verifyToolchainBeforeWrite(targetDir,options),ensureDir(join(targetDir,".arbiter"));const lock=await acquireLock(join(targetDir,".arbiter",".lock"));try{showTelemetryBannerIfFirstRun(void 0,options.quiet),log(`
+  Arbiter \u2014 AI Development Governance Framework
+`),log("  Detecting project...");const detection=detectProjectForInit(targetDir,options,log);options.json||logExistingDetections(detection.existing),detection.gitInfo.isGitRepo&&guardAdverseGitState(targetDir,options.force);const recipe=await loadRecipeFromOptions(options,log),config=await resolveConfig({options,recipe,targetDir,projectName,language:detection.language,framework:detection.framework,buildCmds:detection.buildCmds,packageManager:detection.packageManager.name,gitInfo:detection.gitInfo,existing:detection.existing,githubAccess:detection.githubAccess,externalModelAccess:detection.externalModelAccess,lanes:detection.lanes,languageLocked:detection.languageLocked,languageSource:detection.languageSource});if(config===null)return;if(applyPresetOptions(options,config),assertKnownLanguage(config.language),options.dryRun){await displayDryRunPreview(config);return}checkL3MaturityGates(config),checkCollaborationCoherenceGate(config),await generateAndFinalize({config,targetDir,initOptions:options,log,brownfieldDetected:isBrownfield(detection.existing),packageManager:detection.packageManager.name})}finally{await lock.release()}}async function loadRecipeFromOptions(options,log){if(!options.recipe)return;const recipe=await loadRecipe(options.recipe,options.recipeSha256!==void 0?{sha256:options.recipeSha256}:{});return options.json||log("  \u251C\u2500\u2500 Recipe: loaded"),recipe}function guardAdverseGitState(targetDir,force){const adverseState=detectAdverseGitState(targetDir);if(!adverseState)return;const warning=`
+  Warning: ${adverseState.message}
+  ${adverseState.suggestedFix}
+`;if(!force)throw new UserFacingError(`${adverseState.message}
+${adverseState.suggestedFix}
+${t("cli.shared.force_override_hint")}`);getLogger().warn("init.adverse_git_state",{message:adverseState.message,suggested_fix:adverseState.suggestedFix},warning)}export function guardBrownfieldDirtyTree(targetDir,force){try{if(runCli("git",["status","--porcelain"],{cwd:targetDir,timeoutMs:5e3}).stdout.trim()==="")return;if(!force)throw ArbiterError.fromKey("E_INIT_DIRTY_TREE","errors.E_INIT_DIRTY_TREE");getLogger().warn("init.dirty_tree",{},t("cli.init.dirty_tree_warn"))}catch(err){if(err instanceof UserFacingError)throw err;const code=err.code;if(code==="ENOENT"||code==="EACCES")return;throw err}}function logExistingDetections(existing){existing.agentsMd&&process.stdout.write(`${t("cli.init.existing_agents_md")}
+`),existing.claudeDir&&process.stdout.write(`${t("cli.init.existing_claude_dir")}
+`),existing.agentsDir&&process.stdout.write(`${t("cli.init.existing_agents_dir")}
+`),existing.geminiDir&&process.stdout.write(`${t("cli.init.existing_gemini_dir")}
+`),existing.windsurfRules&&process.stdout.write(`${t("cli.init.existing_windsurf")}
+`),existing.aiderConf&&process.stdout.write(`${t("cli.init.existing_aider")}
+`),existing.aiRulez&&process.stdout.write(`${t("cli.init.ai_rulez_detected")}
+`)}

package/dist/commands/method-interactive.js

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+import{resolve}from"node:path";import{loadConfig}from"../utils/config.js";import{runConfigure,parseValue}from"./configure.js";import{CLUSTERS,METHODOLOGY_CATALOG,probeAll}from"./method.js";function isBooleanPath(path){return path.startsWith("features.")}function currentString(values,path){const v=values[path];return v==null?"":Array.isArray(v)?v.join(","):typeof v=="string"?v:typeof v=="number"||typeof v=="boolean"?String(v):""}const VERDICT_HINT={wired:"on, files emitted",partial:"on, files NOT emitted",unverified:"on, emission uncheckable (no manifest)",off:"off"};async function promptFeature(clack,feature,status){const staged=[];for(const path of feature.configPaths){const before=currentString(status.values,path);if(isBooleanPath(path)){const next2=await clack.confirm({message:path,initialValue:status.values[path]===!0});if(clack.isCancel(next2))return null;String(next2)!==before&&staged.push(`${path}=${String(next2)}`);continue}const next=await clack.text({message:path,initialValue:before,validate:raw=>{const value=raw??"";if(value.trim()==="")return"Provide a value, or press Ctrl-C to cancel.";try{parseValue(path,value);return}catch(err){return err instanceof Error?err.message:String(err)}}});if(clack.isCancel(next))return null;next!==before&&staged.push(`${path}=${next}`)}return staged}async function promptCluster(clack,cluster,statuses){const rows=METHODOLOGY_CATALOG.filter(f=>f.cluster===cluster),byId=new Map(statuses.map(s=>[s.id,s])),picked=await clack.multiselect({message:`${cluster} \u2014 which features do you want to change?`,options:rows.map(f=>({value:f.id,label:f.name,hint:VERDICT_HINT[byId.get(f.id)?.verdict??"off"]})),required:!1});if(clack.isCancel(picked))return null;const staged=[];for(const id of picked){const feature=rows.find(f=>f.id===id),status=byId.get(id);if(!feature||!status)continue;const result=await promptFeature(clack,feature,status);if(result===null)return null;staged.push(...result)}return staged}export async function runInteractiveMethod(dir){const clack=await import("@clack/prompts"),targetDir=resolve(dir??process.cwd()),config=loadConfig(targetDir);if(!config){process.stderr.write("arbiter: no arbiter.json found. Run `arbiter init` first.\n"),process.exit(1);return}const statuses=probeAll(targetDir,config),wired=statuses.filter(s=>s.verdict==="wired").length,partial=statuses.filter(s=>s.verdict==="partial").length,off=statuses.filter(s=>s.verdict==="off").length;clack.intro("arbiter method"),clack.note(`wired ${wired}   partial ${partial}   off ${off}
+Full report: arbiter method status (or --json)`,"methodology");const cluster=await clack.select({message:"Which cluster do you want to tune?",options:CLUSTERS.map(c=>({value:c,label:c,hint:`${statuses.filter(s=>s.cluster===c&&s.verdict==="wired").length}/${statuses.filter(s=>s.cluster===c).length} wired`}))});if(clack.isCancel(cluster)){clack.cancel("Cancelled \u2014 nothing written.");return}const staged=await promptCluster(clack,cluster,statuses);if(staged===null){clack.cancel("Cancelled \u2014 nothing written.");return}if(staged.length===0){clack.outro("No changes.");return}clack.note(staged.join(`
+`),"staged changes");const apply=await clack.confirm({message:"Apply these changes?",initialValue:!0});if(clack.isCancel(apply)||!apply){clack.cancel("Cancelled \u2014 nothing written.");return}await runConfigure({dir:targetDir,sets:staged}),clack.outro("Applied via arbiter configure.")}

package/dist/commands/method.js

@@ -0,0 +1,11 @@
+// SPDX-License-Identifier: Apache-2.0
+import{existsSync}from"node:fs";import{join,resolve}from"node:path";import{loadConfig}from"../utils/config.js";import{jsonOutput}from"../utils/json-output.js";import{GENERATED_MANIFEST_FILE,loadGeneratedManifest}from"../state/generated-manifest.js";import{resolveSettingValue}from"./settings.js";export const CLUSTERS=["process-core","testing","gates-cli","engineering","agentic-harness","ssot-traceability","audit-evidence"];const DEFAULT_ON_PATHS=new Set(["features.contractTesting","features.mutationTesting","features.evidenceHarness"]);export const NON_METHODOLOGY_PATHS=new Map([["archetype","project shape \u2014 what the project is, not how it is built"],["architectureStyle","project shape"],["isMultiTenant","project shape"],["hasDatabase","project shape"],["hasPublicApi","project shape"],["contractType","project shape \u2014 the contract flavour, not whether contracts are tested"],["permitGitHub","access/integration switch, not a methodology dial"]]),METHODOLOGY_CATALOG=[{id:"M-PROC-01",cluster:"process-core",name:"Governance level",configPaths:["governanceLevel"]},{id:"M-PROC-02",cluster:"process-core",name:"Collaboration mode",configPaths:["collaborationMode"]},{id:"M-PROC-03",cluster:"process-core",name:"Branching strategy",configPaths:["branchingStrategy"]},{id:"M-PROC-04",cluster:"process-core",name:"Solo merge mode",configPaths:["solo.mergeMode"]},{id:"M-PROC-05",cluster:"process-core",name:"Solo-dev mode",configPaths:["features.soloDevMode"]},{id:"M-TEST-01",cluster:"testing",name:"Contract testing",configPaths:["features.contractTesting"]},{id:"M-TEST-02",cluster:"testing",name:"Mutation testing",configPaths:["features.mutationTesting","thresholds.mutationScore"]},{id:"M-TEST-03",cluster:"testing",name:"Performance testing",configPaths:["features.perfTesting"]},{id:"M-TEST-04",cluster:"testing",name:"Coverage floors",configPaths:["thresholds.lineCoverage","thresholds.branchCoverage"]},{id:"M-GATE-01",cluster:"gates-cli",name:"Debt ratchet gates",configPaths:["features.debtGates"],emits:["scripts/debt-lib.mjs","scripts/capture-debt-baseline.mjs","scripts/debt-report.mjs"]},{id:"M-GATE-02",cluster:"gates-cli",name:"Suppression ledger",configPaths:["features.suppressions"],emits:["suppressions/suppressions-schema.json","scripts/check-suppressions.mjs"]},{id:"M-GATE-03",cluster:"gates-cli",name:"Acceptance-criteria anchor",configPaths:["features.acceptanceAnchor"]},{id:"M-GATE-04",cluster:"gates-cli",name:"Default gate level",configPaths:["automation.defaultGateLevel"]},{id:"M-ENG-01",cluster:"engineering",name:"Complexity ceiling",configPaths:["thresholds.cyclomaticComplexity"]},{id:"M-ENG-02",cluster:"engineering",name:"Method size limits",configPaths:["thresholds.methodLength","thresholds.maxParams"]},{id:"M-AGENT-01",cluster:"agentic-harness",name:"AI tool harness",configPaths:["tools"]},{id:"M-AGENT-02",cluster:"agentic-harness",name:"Ship autonomy level",configPaths:["automation.autonomy"]},{id:"M-AGENT-03",cluster:"agentic-harness",name:"Parallel worktree cap",configPaths:["automation.maxParallelWorktrees"]},{id:"M-AGENT-04",cluster:"agentic-harness",name:"Cross-model review consent",configPaths:["crossModelReview.enabled","crossModelReview.diffEgressConsent","crossModelReview.providers","crossModelReview.slots.codeReview","crossModelReview.slots.redTeamReview","crossModelReview.timeoutMs","crossModelReview.onUnavailable"]},{id:"M-SSOT-01",cluster:"ssot-traceability",name:"25-dimension taxonomy",configPaths:["features.taxonomy25d"]},{id:"M-SSOT-02",cluster:"ssot-traceability",name:"CODEOWNERS notification",configPaths:["features.codeownersNotify"]},{id:"M-AUDIT-01",cluster:"audit-evidence",name:"Evidence harness",configPaths:["features.evidenceHarness"],emits:["scripts/done-evidence.mjs"]},{id:"M-AUDIT-02",cluster:"audit-evidence",name:"Security scanning",configPaths:["features.securityScanning"]},{id:"M-AUDIT-03",cluster:"audit-evidence",name:"Risk register",configPaths:["features.riskRegister"]},{id:"M-AUDIT-04",cluster:"audit-evidence",name:"Operations handbook",configPaths:["features.operationsHandbook"]},{id:"M-AUDIT-05",cluster:"audit-evidence",name:"ISO 27001 mapping",configPaths:["features.iso27001Mapping"]},{id:"M-AUDIT-06",cluster:"audit-evidence",name:"NIS2 mapping",configPaths:["features.nis2Mapping"]},{id:"M-AUDIT-07",cluster:"audit-evidence",name:"GDPR mapping",configPaths:["features.gdprMapping"]}];function pathActive(config,path){const value=resolveSettingValue(config,path);return value==null?DEFAULT_ON_PATHS.has(path):typeof value=="boolean"?value:Array.isArray(value)?value.length>0:typeof value=="string"?value!=="":!0}function resolveMissingEmits(declared,manifest,targetDir,manifestPresent){return!manifestPresent||declared.length===0?[]:declared.filter(key=>!(key in manifest)||!existsSync(join(targetDir,key)))}function resolveEmitFacet(declaredCount,manifestPresent,missingCount){return declaredCount===0?"n/a":manifestPresent?missingCount===0?"satisfied":"missing":"unknown"}function resolveVerdict(config,emit){return config==="inactive"?"off":emit==="missing"?"partial":emit==="unknown"?"unverified":"wired"}export function probeFeature(feature,config,manifest,targetDir,manifestPresent=!0){const configFacet=feature.configPaths.every(p=>pathActive(config,p))?"active":"inactive",values={};for(const p of feature.configPaths)values[p]=resolveSettingValue(config,p)??null;const declared=feature.emits??[],missingEmits=resolveMissingEmits(declared,manifest,targetDir,manifestPresent),emit=resolveEmitFacet(declared.length,manifestPresent,missingEmits.length),verdict=resolveVerdict(configFacet,emit);return{id:feature.id,cluster:feature.cluster,name:feature.name,verdict,config:configFacet,emit,values,missingEmits}}export function probeAll(targetDir,config){const manifestPresent=existsSync(join(targetDir,GENERATED_MANIFEST_FILE)),manifest=loadGeneratedManifest(targetDir);return METHODOLOGY_CATALOG.map(f=>probeFeature(f,config,manifest,targetDir,manifestPresent))}const GLYPH={wired:"OK  ",partial:"WARN",unverified:"?   ",off:"off "},EMIT_LABEL={satisfied:"Emit \u2713",missing:"Emit \u2717","n/a":"Emit n/a",unknown:"Emit ?"};function facets(s){return`Config ${s.config==="active"?"\u2713":"\u2717"} / ${EMIT_LABEL[s.emit]}`}export function runMethodStatus(opts={}){const targetDir=resolve(opts.dir??process.cwd()),config=loadConfig(targetDir);if(config==null){process.stderr.write("arbiter: no arbiter.json found. Run `arbiter init` first.\n"),process.exit(1);return}const statuses=probeAll(targetDir,config);if(opts.json){jsonOutput("method","ok",{clusters:CLUSTERS.map(cluster=>({cluster,features:statuses.filter(s=>s.cluster===cluster)})),summary:{wired:statuses.filter(s=>s.verdict==="wired").length,partial:statuses.filter(s=>s.verdict==="partial").length,unverified:statuses.filter(s=>s.verdict==="unverified").length,off:statuses.filter(s=>s.verdict==="off").length}});return}process.stdout.write(`
+arbiter method \u2014 methodology wiring status
+`);for(const cluster of CLUSTERS){const rows=statuses.filter(s=>s.cluster===cluster);if(rows.length!==0){process.stdout.write(`
+${cluster}
+`);for(const row of rows){process.stdout.write(`  ${GLYPH[row.verdict]} ${row.name.padEnd(30)} ${facets(row)}
+`);for(const missing of row.missingEmits)process.stdout.write(`         not emitted: ${missing}
+`)}}}const count=v=>statuses.filter(s=>s.verdict===v).length,unverified=count("unverified");process.stdout.write(`
+wired ${count("wired")}  partial ${count("partial")}  unverified ${unverified}  off ${count("off")}
+`),unverified>0&&process.stdout.write(`No ${GENERATED_MANIFEST_FILE} here \u2014 emission is uncheckable, not missing. Run \`arbiter update\` to generate one.
+`),process.stdout.write("Tune with `arbiter method` (interactive) \u2014 every write is delegated to `arbiter configure`.\n")}

package/dist/commands/obsidian.js

@@ -0,0 +1,2 @@
+// SPDX-License-Identifier: Apache-2.0
+import{existsSync}from"node:fs";import{resolve,join}from"node:path";import{runCli,CliError}from"../utils/run-cli.js";const GEN_WIKI_REL=join("scripts","gen-wiki.mjs"),CHECK_WIKI_LINT_REL=join("scripts","check-wiki-lint.mjs"),UPDATE_HINT="vault scripts not found \u2014 run 'arbiter update' to (re)generate them";function resolveMode(opts){return[opts.validateOnly,opts.sync,opts.write,opts.dryRun].filter(Boolean).length>1?"conflict":opts.validateOnly?"validate":opts.sync?"sync":opts.write?"write":"dry-run"}function errorResult(mode,vaultDir,reason){return{status:"error",exitCode:2,mode,contractVersion:1,vaultDir,reason}}function parseLintOutput(output){const brokenLinks=(output.match(/\[broken-link\]/g)??[]).length,orphans=(output.match(/\[orphan\]/g)??[]).length,stale=(output.match(/\[stale\]/g)??[]).length,citation=(output.match(/\[citation\]/g)??[]).length,total=brokenLinks+orphans+stale+citation;return{brokenLinks,orphans,stale,ok:total===0}}function runLint(repoDir,vaultAbsDir,mode,vaultDir){try{const r=runCli("node",[CHECK_WIKI_LINT_REL,"--wiki-dir",vaultAbsDir,"--assert-stale"],{cwd:repoDir});return parseLintOutput(r.stdout+r.stderr)}catch(err){return err instanceof CliError&&!err.notFound?parseLintOutput(err.stdout+err.stderr):errorResult(mode,vaultDir,`check-wiki-lint.mjs failed to launch: ${err instanceof Error?err.message:String(err)}`)}}function runGenRegen(repoDir,vaultAbsDir,mode,vaultDir){try{return runCli("node",[GEN_WIKI_REL,"--wiki-dir",vaultAbsDir],{cwd:repoDir}),{ok:!0}}catch(err){const detail=err instanceof CliError?err.stdout+err.stderr:String(err);return errorResult(mode,vaultDir,`gen-wiki.mjs regen failed: ${detail||String(err)}`)}}function isObsidianResult(v){return"status"in v}function handleValidateMode(repoDir,vaultAbsDir,mode,vaultDir){const validation=runLint(repoDir,vaultAbsDir,mode,vaultDir);return isObsidianResult(validation)?validation:validation.ok?{status:"ok",exitCode:0,mode,contractVersion:1,vaultDir,validation}:{status:"error",exitCode:1,mode,contractVersion:1,vaultDir,validation,reason:"vault validation found violations"}}function handleSyncMode(repoDir,vaultAbsDir,mode,vaultDir){const regen=runGenRegen(repoDir,vaultAbsDir,mode,vaultDir);if(isObsidianResult(regen))return regen;const validation=runLint(repoDir,vaultAbsDir,mode,vaultDir);return isObsidianResult(validation)?validation:validation.ok?{status:"ok",exitCode:0,mode,contractVersion:1,vaultDir,regenerated:!0,validation}:{status:"error",exitCode:1,mode,contractVersion:1,vaultDir,regenerated:!0,validation,reason:"vault validation found violations after regeneration"}}export function runObsidian(opts={}){const repoDir=resolve(opts.dir??process.cwd()),vaultDir=opts.vaultPath??"wiki",vaultAbsDir=resolve(repoDir,vaultDir),mode=resolveMode(opts);if(mode==="conflict")return errorResult("dry-run",vaultDir,"conflicting mode flags \u2014 pass only one of --sync, --validate-only, --write, --dry-run");const genWikiPath=join(repoDir,GEN_WIKI_REL),lintPath=join(repoDir,CHECK_WIKI_LINT_REL);return!existsSync(genWikiPath)||!existsSync(lintPath)?errorResult(mode,vaultDir,UPDATE_HINT):mode==="dry-run"||mode==="write"?{status:"ok",exitCode:0,mode,contractVersion:1,vaultDir}:mode==="validate"?handleValidateMode(repoDir,vaultAbsDir,mode,vaultDir):handleSyncMode(repoDir,vaultAbsDir,mode,vaultDir)}

package/dist/commands/plugin.js

@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: Apache-2.0
+import{resolve,join}from"node:path";import{loadConfig,saveConfig}from"../utils/config.js";import{loadPlugin}from"../utils/plugin-loader.js";import{detectPackageManager}from"../detectors/package-manager.js";import{runCli}from"../utils/run-cli.js";import{acquireLock}from"../utils/file-lock.js";import{ensureDir}from"../utils/fs.js";import{jsonOutput}from"../utils/json-output.js";import{ArbiterError}from"../utils/errors.js";import{t}from"../i18n/index.js";function isLocalSpec(pkg){return pkg.startsWith(".")||pkg.startsWith("/")}function packageNameOf(spec){const at=spec.startsWith("@")?spec.indexOf("@",1):spec.indexOf("@");return at===-1?spec:spec.slice(0,at)}const INSTALL_ARGS={npm:spec=>["install","--save-dev",spec],pnpm:spec=>["add","--save-dev",spec],yarn:spec=>["add","--dev",spec],bun:spec=>["add","--dev",spec]};function requireConfig(targetDir,command,json){const stored=loadConfig(targetDir);if(stored)return stored;throw json&&(jsonOutput(command,"error",{},[t("cli.plugin.no_config")]),process.exit(1)),ArbiterError.fromKey("E_CONFIG_NOT_FOUND","errors.E_CONFIG_NOT_FOUND",{},{hint:"Run `arbiter init` to initialize governance in this directory."})}async function requireLoadable(name,targetDir,json){try{await loadPlugin(name,targetDir);return}catch(err){const message=err instanceof Error?err.message:String(err);throw json&&(jsonOutput("plugin add","error",{name},[message]),process.exit(1)),ArbiterError.fromKey("E_PLUGIN_UNRESOLVABLE","cli.plugin.load_error",{name,message,hint:"Verify the package name or path is correct and that it is installed."})}}async function persistPlugins(targetDir,stored,plugins){ensureDir(join(targetDir,".arbiter"));const lock=await acquireLock(join(targetDir,".arbiter",".lock"));try{await saveConfig(targetDir,{...stored,plugins})}finally{await lock.release()}}export async function runPluginAdd(options){const targetDir=resolve(options.dir??process.cwd()),json=options.json===!0,stored=requireConfig(targetDir,"plugin add",json),spec=options.pkg,local=isLocalSpec(spec),name=local?spec:packageNameOf(spec);if(!local&&options.install){const pm=detectPackageManager(targetDir);runCli(pm.name,INSTALL_ARGS[pm.name](spec),{cwd:targetDir,timeoutMs:18e4})}await requireLoadable(name,targetDir,json);const existing=stored.plugins??[],added=!existing.includes(name),plugins=added?[...existing,name].sort((a,b)=>a.localeCompare(b)):existing;if(added&&await persistPlugins(targetDir,stored,plugins),json){jsonOutput("plugin add","ok",{name,added,plugins});return}if(!added){process.stdout.write(`${t("cli.plugin.already_configured",{name})}
+`);return}process.stdout.write(`${t("cli.plugin.added",{name})}
+`),process.stdout.write(`${t("cli.plugin.security_advisory",{name})}
+`)}async function loadStatus(name,targetDir){try{return await loadPlugin(name,targetDir),"loaded"}catch(err){const message=err instanceof Error?err.message:String(err);return/not found/i.test(message)?"not found":"error"}}export async function runPluginList(options){const targetDir=resolve(options.dir??process.cwd()),names=requireConfig(targetDir,"plugin list",options.json===!0).plugins??[],plugins=[];for(const name of names)plugins.push({name,status:await loadStatus(name,targetDir)});if(options.json){jsonOutput("plugin list","ok",{plugins});return}if(plugins.length===0){process.stdout.write(`${t("cli.plugin.no_plugins")}
+`);return}process.stdout.write(`${t("cli.plugin.plugins_header")}
+`);for(const p of plugins)process.stdout.write(`${t("cli.plugin.plugin_row",{name:p.name,status:p.status})}
+`)}

package/dist/commands/pr-merged.js

@@ -0,0 +1,2 @@
+// SPDX-License-Identifier: Apache-2.0
+const FAILED_CONCLUSIONS=new Set(["FAILURE","TIMED_OUT","CANCELLED"]);export function failingCheckNames(pr){return(pr.statusCheckRollup??[]).filter(check=>FAILED_CONCLUSIONS.has(check.conclusion??"")).map(check=>check.name??check.context??"(unnamed check)")}function unmergedDetail(pr){const failing=failingCheckNames(pr),merge=pr.mergeStateStatus===void 0?"":`, mergeStateStatus ${pr.mergeStateStatus}`,checks=failing.length>0?` Failing checks: ${failing.join(", ")}.`:" No check has reported a red conclusion yet.";return`PR #${pr.number} is ${pr.state}${merge}, not MERGED.${checks} Watch it to green and merge it (\`node scripts/pr-merge-watch.mjs <owner/repo> ${pr.number}\`), or pass --no-pr if this repo lands by direct push.`}export function evaluateMerged(prs,branch,explicitPr,candidateSha,qualification){if(candidateSha!==void 0)return evaluateQualifiedMerged(prs,candidateSha,explicitPr,qualification);if(explicitPr!==void 0){const named=prs.find(pr=>pr.number===explicitPr);return named===void 0?{merged:!1,detail:`PR #${explicitPr} was not found on branch "${branch}" (\`gh pr list --head ${branch} --state all\` returned ${prs.length} PR(s)).`}:named.state==="MERGED"?{merged:!0,number:named.number}:{merged:!1,detail:unmergedDetail(named)}}const merged=prs.find(pr=>pr.state==="MERGED");if(merged!==void 0)return{merged:!0,number:merged.number};const[first]=prs;return first===void 0?{merged:!1,detail:`no PR exists for branch "${branch}". Open one and drive it to green before completing, or pass --no-pr if this repo lands by direct push.`}:{merged:!1,detail:unmergedDetail(first)}}function evaluateQualifiedMerged(prs,candidateSha,explicitPr,qualification){return evaluateQualifiedCompletionInternal(prs,candidateSha,qualification?.policy??"exact-pr",{explicitPr,requireMainBase:qualification?.requireMainBase??!1,mergeReachableFromMain:qualification?.mergeReachableFromMain??!0})}function evaluateQualifiedCompletionInternal(prs,candidateSha,policy,options){const candidate=prs.find(pr=>isQualifiedCandidate(pr,candidateSha,options.explicitPr));if(!hasMergeCommit(candidate))return{merged:!1,detail:"Merged PR does not carry the qualified candidate head and merge refs."};const prerequisiteFailure=qualificationPrerequisiteFailure(candidate,policy,options);if(prerequisiteFailure!==void 0)return{merged:!1,detail:prerequisiteFailure};const cutoff=Date.parse(candidate.mergedAt??"");return!Number.isFinite(cutoff)||!successfulCiAtMerge(candidate.statusCheckRollup??[],cutoff)?{merged:!1,detail:"Candidate CI cannot establish successful qualification before merge."}:{merged:!0,number:candidate.number}}function hasMergeCommit(candidate){return candidate?.mergeCommit?.oid!==void 0}function isQualifiedCandidate(pr,candidateSha,explicitPr){return pr.state==="MERGED"&&pr.headRefOid===candidateSha&&(explicitPr===void 0||pr.number===explicitPr)}function qualificationPrerequisiteFailure(candidate,policy,options){if(options.requireMainBase&&candidate.baseRefName!=="main")return"Merged PR does not target main.";if(!options.mergeReachableFromMain)return"Merged PR commit is not reachable from current origin/main.";if(policy==="exact-pr"&&candidate.mergeCommit.oid!==candidate.headRefOid)return"Merged PR head/merge refs do not match the qualified candidate SHA."}function finishedBeforeMerge(check,cutoff){const time=Date.parse((check.checkSuite?check.completedAt:check.createdAt)??"");return Number.isFinite(time)&&time<=cutoff}function ciCreatedAt(check){return Date.parse(check.checkSuite?.createdAt??check.createdAt??"")}function successfulCiAtMerge(checks,cutoff){let success=!1;for(const check of checks){const created=ciCreatedAt(check);if(!Number.isFinite(created))return!1;if(created>cutoff){if(!check.checkSuite)return!1;continue}const outcome=check.conclusion??check.state??"";if(!["SUCCESS","SKIPPED","NEUTRAL"].includes(outcome)||!finishedBeforeMerge(check,cutoff))return!1;outcome==="SUCCESS"&&(success=!0)}return success}

package/dist/commands/retire-policy.js

@@ -0,0 +1,3 @@
+// SPDX-License-Identifier: Apache-2.0
+import{existsSync,readFileSync}from"node:fs";import{createHash}from"node:crypto";import{join}from"node:path";import{manifestKey}from"../state/generated-manifest.js";import{RETIRED_RENDERS}from"../state/retired-renders.js";import{isSafetyClassKey}from"../generators/safety-class.js";import{unlinkTranslated}from"../utils/fs.js";const byKey=(a,b)=>a<b?-1:a>b?1:0;export function diskHasher(targetDir){return key=>{const path=join(targetDir,key);if(!existsSync(path))return null;try{return createHash("sha256").update(readFileSync(path)).digest("hex")}catch{return null}}}export function planRetirement(opts){const plan={retire:[],orphans:[],stale:[]};if(!opts.fullRegistryRun)return plan;const visited=new Set(opts.results.map(r=>manifestKey(opts.targetDir,r.path)).filter(k=>k!==null)),candidates=new Set([...Object.keys(opts.prevManifest),...Object.keys(RETIRED_RENDERS)]);for(const key of candidates){if(visited.has(key))continue;const onDisk=opts.diskHash(key);onDisk!==null&&(isSafetyClassKey(key)?onDisk===opts.prevManifest[key]||(RETIRED_RENDERS[key]??[]).includes(onDisk)?plan.retire.push(key):plan.orphans.push(key):plan.stale.push(key))}return plan.retire.sort(byKey),plan.orphans.sort(byKey),plan.stale.sort(byKey),plan}export function applyRetirement(targetDir,plan){for(const key of[...plan.retire])try{unlinkTranslated(join(targetDir,key))}catch{plan.retire=plan.retire.filter(k=>k!==key),plan.orphans=[...plan.orphans,key].sort(byKey)}}export function retirementWarning(plan){const sections=[];return plan.retire.length>0&&sections.push(`Retired ${plan.retire.length} arbiter-owned file(s) this version no longer emits (unmodified since arbiter wrote them, so removal is lossless): ${plan.retire.join(", ")}`),plan.orphans.length>0&&sections.push(`Warning: ${plan.orphans.length} arbiter-owned file(s) are no longer emitted but were edited locally, so they were left in place \u2014 delete them by hand once you have salvaged your changes: ${plan.orphans.join(", ")}`),plan.stale.length>0&&sections.push(`Note: ${plan.stale.length} previously generated file(s) were not emitted by this run (a retired template, or a generator this config no longer selects). They are left untouched \u2014 review before deleting: ${plan.stale.join(", ")}`),sections.length>0?sections.join(`
+`):null}

package/dist/commands/review-diff.js

@@ -0,0 +1,3 @@
+// SPDX-License-Identifier: Apache-2.0
+import{storeFromSnapshot}from"../graph/store.js";export function runReviewDiff(opts){const baseStore=storeFromSnapshot(opts.base),headStore=storeFromSnapshot(opts.head),enforcementChanges=diffEnforcement(baseStore,headStore),removedProvers=diffProvers(baseStore,headStore),adrSupersessions=diffAdrSupersessions(baseStore,headStore),hasWeakening=enforcementChanges.some(c=>c.direction==="weakened"),hasLostProvers=removedProvers.length>0,block=hasWeakening||hasLostProvers,recommendation=block?"BLOCK":"PASS",riskDelta=hasWeakening||hasLostProvers?"increased":enforcementChanges.some(c=>c.direction==="strengthened")?"decreased":"unchanged",lines=[];if(enforcementChanges.length>0){lines.push(`Enforcement changes: ${enforcementChanges.length}`);for(const c of enforcementChanges)lines.push(`  ${c.inv}: ${c.direction} (${c.added.length} added, ${c.removed.length} removed)`)}removedProvers.length>0&&lines.push(`Removed last provers: ${removedProvers.join(", ")}`),adrSupersessions.length>0&&lines.push(`ADR supersessions: ${adrSupersessions.map(s=>s.adr).join(", ")}`),lines.length===0&&lines.push("No semantic changes detected.");const summary=`[${recommendation}] ${lines[0]}`;return{status:"ok",exitCode:block?2:0,recommendation,risk_delta:riskDelta,changes:{enforcement_changes:enforcementChanges,removed_provers:removedProvers,adr_supersessions:adrSupersessions},summary}}function diffEnforcement(base,head){const changes=[],allInvIds=new Set([...base.nodesByKind("INV").map(n=>n.id),...head.nodesByKind("INV").map(n=>n.id)]);for(const invId of allInvIds){const baseGates=new Set(base.outgoing(invId,"enforces").map(e=>e.to)),headGates=new Set(head.outgoing(invId,"enforces").map(e=>e.to)),added=[...headGates].filter(g=>!baseGates.has(g)),removed=[...baseGates].filter(g=>!headGates.has(g));if(added.length===0&&removed.length===0)continue;const direction=removed.length>0?"weakened":"strengthened";changes.push({inv:invId,direction,added,removed})}return changes}function diffProvers(base,head){const removedLastProverInvs=[];for(const inv of base.nodesByKind("INV")){if(base.incoming(inv.id,"proves").length===0)continue;head.incoming(inv.id,"proves").length===0&&removedLastProverInvs.push(inv.id)}return removedLastProverInvs.sort()}function diffAdrSupersessions(base,head){const supersessions=[];for(const adr of base.nodesByKind("ADR")){const baseImplementors=base.incoming(adr.id,"implements").map(e=>e.from);if(baseImplementors.length===0)continue;const headImplementors=new Set(head.incoming(adr.id,"implements").map(e=>e.from)),removed=baseImplementors.filter(id=>!headImplementors.has(id));removed.length>0&&supersessions.push({adr:adr.id,removedImplementors:removed})}return supersessions}export function renderMarkdown(result){const lines=[`## Semantic Review: ${result.recommendation==="PASS"?"PASS":"BLOCK"}`,"",`**Risk delta:** ${result.risk_delta}`,`**Recommendation:** ${result.recommendation}`,""],{enforcement_changes,removed_provers,adr_supersessions}=result.changes;if(enforcement_changes.length>0){lines.push("### Enforcement Changes");for(const c of enforcement_changes){const dir=c.direction==="weakened"?"WEAKENED":"strengthened";lines.push(`- **${c.inv}**: ${dir}`),c.added.length>0&&lines.push(`  - Added: ${c.added.join(", ")}`),c.removed.length>0&&lines.push(`  - Removed: ${c.removed.join(", ")}`)}lines.push("")}if(removed_provers.length>0){lines.push("### Removed Provers (BLOCK)");for(const inv of removed_provers)lines.push(`- **${inv}**: last test prover removed`);lines.push("")}if(adr_supersessions.length>0){lines.push("### Implicit ADR Supersessions");for(const s of adr_supersessions)lines.push(`- **${s.adr}**: implementors removed: ${s.removedImplementors.join(", ")}`);lines.push("")}return enforcement_changes.length===0&&removed_provers.length===0&&adr_supersessions.length===0&&lines.push("No semantic changes detected."),lines.join(`
+`)}

package/dist/commands/settings.js

@@ -0,0 +1,7 @@
+// SPDX-License-Identifier: Apache-2.0
+import{loadConfig}from"../utils/config.js";import{jsonOutput}from"../utils/json-output.js";export const SETTINGS_CATALOG=[{group:"Collaboration",fields:[{path:"collaborationMode",label:"Collaboration mode"},{path:"solo.mergeMode",label:"Solo merge mode"},{path:"branchingStrategy",label:"Branching strategy"}]},{group:"Governance",fields:[{path:"governanceLevel",label:"Governance level"},{path:"permitGitHub",label:"Permit GitHub integration"}]},{group:"Tools",fields:[{path:"tools",label:"AI tools"}]},{group:"Project shape",fields:[{path:"archetype",label:"Archetype"},{path:"architectureStyle",label:"Architecture style"},{path:"contractType",label:"Contract type"},{path:"isMultiTenant",label:"Multi-tenant"},{path:"hasDatabase",label:"Has database"},{path:"hasPublicApi",label:"Has public API"}]},{group:"Features",fields:[{path:"features.debtGates",label:"Debt gates"},{path:"features.suppressions",label:"Suppressions"},{path:"features.securityScanning",label:"Security scanning"},{path:"features.mutationTesting",label:"Mutation testing"},{path:"features.contractTesting",label:"Contract testing"},{path:"features.evidenceHarness",label:"Evidence harness"},{path:"features.acceptanceAnchor",label:"Acceptance-criteria anchor gate (INV-138)"},{path:"features.soloDevMode",label:"Solo dev mode (deprecated)"},{path:"features.codeownersNotify",label:"CODEOWNERS post-merge email notify (L2+)"},{path:"features.taxonomy25d",label:"26-dimension compliance test taxonomy"},{path:"features.perfTesting",label:"k6 performance testing ecosystem"},{path:"features.riskRegister",label:"Risk register doc"},{path:"features.operationsHandbook",label:"Operations handbook doc"},{path:"features.iso27001Mapping",label:"ISO 27001 control mapping"},{path:"features.nis2Mapping",label:"NIS2 control mapping"},{path:"features.gdprMapping",label:"GDPR control mapping"}]},{group:"Automation",fields:[{path:"automation.autonomy",label:"Ship autonomy level (absent = L0)"},{path:"automation.maxParallelWorktrees",label:"Max parallel wave worktrees"},{path:"automation.defaultGateLevel",label:"Default gate level (L1|L2)"}]},{group:"Cross-model review",fields:[{path:"crossModelReview.enabled",label:"Cross-model review enabled"},{path:"crossModelReview.diffEgressConsent",label:"Diff egress consent"},{path:"crossModelReview.providers",label:"Review providers"},{path:"crossModelReview.slots.codeReview",label:"Code-review slots"},{path:"crossModelReview.slots.redTeamReview",label:"Red-team-review slots"},{path:"crossModelReview.timeoutMs",label:"Review timeout (ms)"},{path:"crossModelReview.onUnavailable",label:"Unavailable-provider policy"}]},{group:"Thresholds",fields:[{path:"thresholds.lineCoverage",label:"Line coverage %"},{path:"thresholds.branchCoverage",label:"Branch coverage %"},{path:"thresholds.mutationScore",label:"Mutation score %"},{path:"thresholds.cyclomaticComplexity",label:"Cyclomatic complexity"},{path:"thresholds.methodLength",label:"Method length"},{path:"thresholds.maxParams",label:"Max parameters"}]}],SETTINGS_PATHS=new Set(SETTINGS_CATALOG.flatMap(g=>g.fields.map(f=>f.path)));export function resolveSettingValue(config,path){let cursor=config;for(const segment of path.split(".")){if(cursor==null||typeof cursor!="object")return;cursor=cursor[segment]}return cursor}function formatValue(value){return value===void 0?"(unset)":Array.isArray(value)?value.length?value.join(", "):"(none)":typeof value=="string"?value:typeof value=="number"||typeof value=="boolean"||typeof value=="bigint"?String(value):JSON.stringify(value)}export function runSettings(opts={}){const dir=opts.dir??process.cwd(),config=loadConfig(dir);if(config==null&&(process.stderr.write("arbiter: no arbiter.json found. Run `arbiter init` first.\n"),process.exit(1)),opts.json){const out=SETTINGS_CATALOG.map(g=>({group:g.group,fields:g.fields.map(f=>({path:f.path,label:f.label,value:resolveSettingValue(config,f.path)??null}))}));jsonOutput("settings","ok",{groups:out});return}process.stdout.write(`
+arbiter settings \u2014 current configuration
+`);for(const group of SETTINGS_CATALOG){process.stdout.write(`
+${group.group}
+`);for(const field of group.fields){const value=formatValue(resolveSettingValue(config,field.path));process.stdout.write(`  ${field.path.padEnd(34)} ${value}
+`)}}process.stdout.write("\nEdit with `arbiter configure` (interactive) or `arbiter configure --set <path>=<value>`.\n")}

package/dist/commands/ship-config.js

@@ -0,0 +1,2 @@
+// SPDX-License-Identifier: Apache-2.0
+import{loadConfig}from"../utils/config.js";export function shipConfigFor(root){try{return loadConfig(root)?.ship}catch{return}}export function permitsGitHubCalls(root){try{return loadConfig(root)?.permitGitHub===!0}catch{return!1}}

package/dist/commands/ship-profile.js

@@ -0,0 +1,2 @@
+// SPDX-License-Identifier: Apache-2.0
+import{existsSync,readFileSync}from"node:fs";import{join}from"node:path";import{homedir}from"node:os";import{loadConfig}from"../utils/config.js";import{resolveCompanions}from"../integrations/companions.js";import{resolveLanguage}from"../detectors/language.js";import{getLogger}from"../utils/logger.js";import{resolveCollaborationMode,resolveDefaultMergeMode}from"../config/collaboration-mode-defaults.js";import{resolveSetting}from"../config/override-resolver.js";import{assertOverridablePath,parseValue}from"./configure.js";import{writeOverride}from"./task-state.js";import{AUTONOMY_LEVELS,VALID_GATE_LEVELS}from"../config/schema.js";const AUTONOMY_PATH="automation.autonomy",DEFAULT_GATE_LEVEL_PATH="automation.defaultGateLevel",AUTO_ADVANCE_BEHAVIOR="auto-advance",AUTO_MERGE_BEHAVIOR="auto-merge";export function buildShipOverrides(root,input){const overrides={};input.autonomy!==void 0&&(overrides[AUTONOMY_PATH]=input.autonomy);for(const assignment of input.sets??[]){const eqIdx=assignment.indexOf("=");if(eqIdx<0)throw new Error(`Invalid --set "${assignment}" \u2014 expected <path>=<value>.`);const path=assignment.slice(0,eqIdx),rawValue=assignment.slice(eqIdx+1);assertOverridablePath(path),parseValue(path,rawValue),overrides[path]=rawValue}for(const[path,value]of Object.entries(overrides))assertOverridablePath(path),writeOverride(root,path,value);return overrides}function buildOverrides(opts){const merged={...opts.overrides??{}};return opts.autonomyOverride!==void 0&&merged[AUTONOMY_PATH]===void 0&&(merged[AUTONOMY_PATH]=opts.autonomyOverride),Object.keys(merged).length>0?merged:void 0}const ARBITER_SELF_PACKAGE="@getarbiter/cli";export const SELF_ONLY_GATES=["template-authoring","selfOnly-invariants","matrix-fixtures"];const AUTONOMY_GRANTS={L0:new Set,L1:new Set([AUTO_ADVANCE_BEHAVIOR,AUTO_MERGE_BEHAVIOR]),L2:new Set([AUTO_ADVANCE_BEHAVIOR,AUTO_MERGE_BEHAVIOR,"fix-on-red-attempt"]),L3:new Set([AUTO_ADVANCE_BEHAVIOR,AUTO_MERGE_BEHAVIOR,"fix-on-red-attempt","wave-batch","fix-on-red-autopush","subagent-auto-spawn"])};export function autonomyAllows(level,behavior){return AUTONOMY_GRANTS[level].has(behavior)}function isAutonomyLevel(v){return AUTONOMY_LEVELS.includes(v)}export const CONSUMER_DEFAULT_PROFILE={isArbiterSelf:!1,collaborationMode:"peer-review",mergeMode:"pr-ff",governanceLevel:"L2",autonomy:"L0",defaultGateLevel:"L1",companions:[]};export function isArbiterSelf(root){const pkgPath=join(root,"package.json");if(!existsSync(pkgPath))return!1;try{return JSON.parse(readFileSync(pkgPath,"utf-8")).name===ARBITER_SELF_PACKAGE}catch{return!1}}export function resolveShipProfile(root,opts={}){const overrides=buildOverrides(opts),self=isArbiterSelf(root);let config;try{config=loadConfig(root)}catch(err){getLogger().warn("ship.config_unreadable",{root},`could not read arbiter.json (${err instanceof Error?err.message:String(err)}); using consumer-safe ship defaults`),config=null}const autonomy=resolveAutonomy(root,overrides,config?.automation?.autonomy),prefs=resolveProfilePrefs(root,overrides,config?.automation),crossModelReview=resolveCrossModelReview(root,overrides,config?.crossModelReview),companions=profileCompanions(root,self,opts,config);return config===null?{...CONSUMER_DEFAULT_PROFILE,isArbiterSelf:self,autonomy,...prefs,companions}:{...collaborationProfile(config),isArbiterSelf:self,autonomy,...prefs,companions,...crossModelReview!==void 0?{crossModelReview}:{}}}function profileCompanions(root,self,opts,config){return resolveCompanions({self,claudeHome:opts.claudeHome??join(homedir(),".claude"),language:resolveLanguage(root,config??void 0),...config?.companions?{overrides:config.companions}:{}})}function collaborationProfile(config){const collaborationMode=resolveCollaborationMode({...config.collaborationMode!==void 0?{collaborationMode:config.collaborationMode}:{},...config.features.soloDevMode===!0?{enableSoloDevMode:!0}:{}});return{collaborationMode,mergeMode:config.solo?.mergeMode??resolveDefaultMergeMode(collaborationMode),governanceLevel:config.governanceLevel}}function resolveProfilePrefs(root,overrides,profile){const gateRaw=resolveSetting(DEFAULT_GATE_LEVEL_PATH,{root,...overrides!==void 0?{overrides}:{},...profile?.defaultGateLevel!==void 0?{profileValue:profile.defaultGateLevel}:{}});return{defaultGateLevel:VALID_GATE_LEVELS.includes(gateRaw)?gateRaw:"L1"}}function resolveAutonomy(root,overrides,profileValue){const resolved=resolveSetting(AUTONOMY_PATH,{root,...overrides!==void 0?{overrides}:{},...profileValue!==void 0?{profileValue}:{}});return isAutonomyLevel(resolved)?resolved:"L0"}function resolveCrossModelReview(root,overrides,profile){if(profile===void 0)return;const enabled=resolveSetting("crossModelReview.enabled",{root,...overrides!==void 0?{overrides}:{},profileValue:String(profile.enabled)})==="true";return{...profile,enabled}}

package/dist/commands/ship-review.js

@@ -0,0 +1 @@
+export const DEFAULT_REVIEW_MAX_ROUNDS=2;export function resolveReviewMaxRounds(ship){return ship?.review?.maxRounds??2}export function evaluateReviewRound(signals){return signals.forced?{allowed:!0}:signals.rounds<signals.maxRounds?{allowed:!0}:{allowed:!1,detail:`this task has already had ${signals.rounds} review round(s) and the cap is ${signals.maxRounds}. Land it with the remaining findings parked (\`arbiter note\` each one, then ONE follow-up issue), or pass --force-review to take another round deliberately.`}}export function reviewScopeLine(base,rounds,maxRounds){return`git diff ${base}..HEAD (round ${rounds} of ${maxRounds}) \xB7 reviewer findings below HIGH do not block landing; AC-fit verdicts still require all-PASS`}

package/dist/commands/ship-tier.js

@@ -0,0 +1,2 @@
+// SPDX-License-Identifier: Apache-2.0
+import{existsSync,statSync}from"node:fs";import{join}from"node:path";import{readUnifiedState}from"./task-state.js";import{runCliJson}from"../utils/run-cli.js";import{readFileTranslated}from"../utils/fs.js";const TIER_RANK={XS:0,S:1,Standard:2},WAVE_OR_EPIC=/^(?:wave|epic)(?:\/.*)?$/i,GRAPH_MAX_BYTES=256*1024*1024,ALLOWED_RELATIONS=new Set(["imports","imports_from","calls","references","re_exports","implements","inherits","extends","uses","depends_on"]),BLAST_RADIUS_S=25,BLAST_RADIUS_STANDARD=75;export function normTier(tier){return tier==="XS"||tier==="S"?tier:"Standard"}export function widenTier(base,signals){let result=base;const widenTo=floor=>{TIER_RANK[floor]>TIER_RANK[result]&&(result=floor)};(signals.milestoneBundled||signals.labels.some(label=>WAVE_OR_EPIC.test(label)))&&widenTo("Standard");const blastRadius=signals.blastRadius;return typeof blastRadius=="number"&&Number.isFinite(blastRadius)&&blastRadius>=0&&(blastRadius>=BLAST_RADIUS_STANDARD?widenTo("Standard"):blastRadius>=BLAST_RADIUS_S&&widenTo("S")),result}export function gatherTierSignals(root,taskId){try{return{...gatherIssueSignals(root,taskId),blastRadius:gatherBlastRadius(root)}}catch{return{blastRadius:null,labels:[],milestoneBundled:!1}}}function gatherIssueSignals(root,taskId){const issueNumber=taskId?.replace(/^#/,"");if(issueNumber===void 0||!/^\d+$/.test(issueNumber))return{labels:[],milestoneBundled:!1};try{const response=runCliJson("gh",["issue","view",issueNumber,"--json","labels,milestone"],{cwd:root,timeoutMs:1e4});return isIssueResponse(response)?{labels:response.labels.map(label=>label.name.toLowerCase()),milestoneBundled:response.milestone!==null}:{labels:[],milestoneBundled:!1}}catch{return{labels:[],milestoneBundled:!1}}}function gatherBlastRadius(root){try{const manifest=readPlanManifest(root);if(manifest===null||manifest.size===0)return null;const graphPath=join(root,"graphify-out","graph.json");if(!existsSync(graphPath))return null;const graphStat=statSync(graphPath);if(graphStat.size>GRAPH_MAX_BYTES)return null;for(const file of manifest){const path=join(root,file);if(existsSync(path)&&graphStat.mtimeMs<statSync(path).mtimeMs)return null}return countBlastRadius(JSON.parse(readFileTranslated(graphPath,"utf-8")),manifest)}catch{return null}}function readPlanManifest(root){const plan=readUnifiedState(root)?.plan;if(typeof plan!="string"||!isRepoRelativePosixPath(plan))return null;const files=parsePlanFilesManifest(readFileTranslated(join(root,plan),"utf-8"));return files===null||files.length===0?null:new Set(files)}function parsePlanFilesManifest(plan){const frontMatter=plan.match(/^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/)?.[1];if(frontMatter===void 0)return null;const lines=frontMatter.split(/\r?\n/),filesIndex=lines.findIndex(line=>/^files:\s*$/.test(line));if(filesIndex===-1)return null;const files=[];for(const line of lines.slice(filesIndex+1)){if(/^[A-Za-z][A-Za-z0-9_-]*:\s*/.test(line))break;if(line.trim()==="")continue;const file=line.match(/^\s+-\s+(.+?)\s*$/)?.[1];if(file===void 0||!isRepoRelativePosixPath(file))return null;files.push(file)}return files}function countBlastRadius(graph,manifest){if(!isRecord(graph)||!Array.isArray(graph.nodes)||!Array.isArray(graph.links))return null;const sourceFiles=graphNodeSourceFiles(graph.nodes),dependents=new Set;for(const link of graph.links){const files=allowlistedEdgeFiles(link,sourceFiles);files!==null&&addDependentFiles(manifest,dependents,files)}return dependents.size}function graphNodeSourceFiles(nodes){const sourceFiles=new Map;for(const node of nodes)isGraphNode(node)&&sourceFiles.set(node.id,node.source_file);return sourceFiles}function isGraphNode(value){return isRecord(value)&&typeof value.id=="string"&&typeof value.source_file=="string"}function allowlistedEdgeFiles(link,sourceFiles){if(!isRecord(link))return null;const{source,target,relation}=link;if(typeof source!="string"||typeof target!="string"||typeof relation!="string"||!ALLOWED_RELATIONS.has(relation))return null;const sourceFile=sourceFiles.get(source),targetFile=sourceFiles.get(target);return sourceFile===void 0||targetFile===void 0?null:[sourceFile,targetFile]}function addDependentFiles(manifest,dependents,[source,target]){manifest.has(source)&&!manifest.has(target)&&dependents.add(target),manifest.has(target)&&!manifest.has(source)&&dependents.add(source)}function isIssueResponse(value){return isRecord(value)&&Array.isArray(value.labels)&&value.labels.every(label=>isRecord(label)&&typeof label.name=="string")&&Object.hasOwn(value,"milestone")}function isRecord(value){return typeof value=="object"&&value!==null}function isRepoRelativePosixPath(value){return value.length>0&&!value.startsWith("/")&&!value.includes("\\")&&!value.split("/").some(segment=>segment===""||segment==="."||segment==="..")}

package/dist/commands/ship-train.js

@@ -0,0 +1,2 @@
+// SPDX-License-Identifier: Apache-2.0
+import{normalizeChainId}from"./task-state.js";export const DEFAULT_TRAIN_LIMITS={maxChain:10,maxAgeMinutes:480};export function resolveTrainLimits(ship){return{maxChain:ship?.train?.maxChain??DEFAULT_TRAIN_LIMITS.maxChain,maxAgeMinutes:ship?.train?.maxAgeMinutes??DEFAULT_TRAIN_LIMITS.maxAgeMinutes}}export function splitTrainIds(positional,explicitId,chain){const primary=explicitId??positional[0],extras=explicitId===void 0?positional.slice(1):positional,bare=id=>id.replace(/^#/,""),chainIds=[...extras,...chain].filter(id=>primary===void 0||bare(id)!==bare(primary));return{...primary!==void 0?{taskId:primary}:{},chainIds}}export function appendChainIds(existing,additions){const result=[...existing],seen=new Set(existing);for(const raw of additions){const id=normalizeChainId(raw);seen.has(id)||(seen.add(id),result.push(id))}return result}function ageMinutes(openedAt,now){if(openedAt===void 0)return null;const opened=Date.parse(openedAt);return Number.isNaN(opened)?null:(now.getTime()-opened)/6e4}export function evaluateSeal(signals,limits){if(signals.explicitSeal)return{sealed:!0,reason:"explicit",detail:"sealed on explicit request (--seal)"};if(signals.widenedTier==="Standard")return{sealed:!0,reason:"risk",detail:"the issue being added widens the tier to Standard \u2014 a risk-bearing issue rides its own train"};if(signals.chainSize>=limits.maxChain)return{sealed:!0,reason:"max-chain",detail:`the train already carries ${signals.chainSize} issue(s), the limit is ${limits.maxChain}`};const age=ageMinutes(signals.openedAt,signals.now);return age!==null&&age>limits.maxAgeMinutes?{sealed:!0,reason:"max-age",detail:`the train has been open ${Math.round(age)} min, the budget is ${limits.maxAgeMinutes} min`}:{sealed:!1}}export function hasShipTaskId(taskId){return taskId!==void 0&&taskId.length>0}export function shipTaskChanged(existing,taskId){return existing===null||taskId===void 0||existing.taskId.length===0||taskId.length===0?!1:existing.taskId.replace(/^#/,"")!==taskId.replace(/^#/,"")}function seedPrimaryCount(existing,taskId,taskChanged){return hasShipTaskId(taskId)||!taskChanged&&hasShipTaskId(existing?.taskId)?1:0}function seedChainIds(existing,chainIds,taskChanged){return chainIds??(taskChanged?[]:existing?.chainIds??[])}function seedProjectedSize(existing,taskId,chainIds){if(chainIds===void 0&&taskId===void 0)return null;const taskChanged=shipTaskChanged(existing,taskId);return seedPrimaryCount(existing,taskId,taskChanged)+seedChainIds(existing,chainIds,taskChanged).length}export function evaluateSeedSize(existing,taskId,chainIds,limits){const projectedSize=seedProjectedSize(existing,taskId,chainIds);return projectedSize===null||projectedSize<=limits.maxChain?{ok:!0}:{ok:!1,detail:`the requested seed would make the train carry ${projectedSize} issue(s), the limit is ${limits.maxChain}`}}

package/dist/commands/task-mark.js

@@ -0,0 +1,2 @@
+// SPDX-License-Identifier: Apache-2.0
+import{writeUnifiedState,appendLog}from"./task-state.js";export function runTaskMark(opts={}){const root=opts.dir??process.cwd(),cursor={};opts.tddPhase!==void 0&&(cursor.tddPhase=opts.tddPhase),opts.last!==void 0&&(cursor.lastAction=opts.last),opts.next!==void 0&&(cursor.nextAction=opts.next);const patch={cursor};opts.taskId!==void 0&&opts.taskId.length>0&&(patch.taskId=opts.taskId),writeUnifiedState(root,patch);const digest=opts.digest??(opts.next?`mark \u2192 next: ${opts.next}`:"mark");appendLog(root,digest)}

package/dist/commands/task-note.js

@@ -0,0 +1,3 @@
+// SPDX-License-Identifier: Apache-2.0
+import{join}from"node:path";import{createHash,randomBytes}from"node:crypto";import{sanitizeTaskId}from"../utils/task-id.js";import{readTaskId}from"./task-state.js";import{currentBranch,headSha}from"../evidence/git-checks.js";import{appendFileTranslated,ensureDir}from"../utils/fs.js";const NOTE_KINDS=["dup","smell","risk","debt","note"],NOTE_SEVERITIES=["low","med","high","info"];function resolveShard(opts,dir){if(opts.shardOverride!==void 0&&opts.shardOverride.length>0)return sanitizeTaskId(opts.shardOverride);const taskId=readTaskId(dir);if(taskId!==void 0&&taskId.length>0)return sanitizeTaskId(taskId);const branch=currentBranch(dir);return branch!=="unknown"&&branch.length>0?sanitizeTaskId(branch):"anon-"+randomBytes(4).toString("hex")}function normalizeWhitespace(s){return s.trim().replace(/\s+/g," ")}function normalizePath(file){return file===void 0||file.length===0?"":file.replace(/\\/g,"/").replace(/^\.\//,"")}function computeFingerprint(parts){const material=[parts.kind,normalizePath(parts.file),parts.symbol,normalizeWhitespace(parts.note)].join("\0");return createHash("sha1").update(material).digest("hex")}function buildEntry(opts,dir,note){const kind=opts.kind??"note",file=opts.file??"",symbol=opts.symbol??"",entry={ts:new Date().toISOString(),note,kind,severity:opts.severity??"info",foundDuring:readTaskId(dir)??"unknown",file:normalizePath(file),line:opts.line??null,sha:opts.shaOverride??headSha(dir),fingerprint:computeFingerprint({kind,file,symbol,note})};return opts.graphNode!==void 0&&opts.graphNode.length>0&&(entry.graphNode=opts.graphNode),entry}export function runTaskNote(opts){const dir=opts.dir??process.cwd(),note=opts.note.trim();if(note.length===0)return{ok:!1,reason:"note text must not be empty"};if(opts.kind!==void 0&&!NOTE_KINDS.includes(opts.kind))return{ok:!1,reason:`invalid --kind "${opts.kind}" (expected one of: ${NOTE_KINDS.join("|")})`};if(opts.severity!==void 0&&!NOTE_SEVERITIES.includes(opts.severity))return{ok:!1,reason:`invalid --severity "${opts.severity}" (expected one of: ${NOTE_SEVERITIES.join("|")})`};const entry=buildEntry(opts,dir,note),shard=resolveShard(opts,dir),findingsDir=join(dir,".arbiter","findings"),spoolPath=join(findingsDir,`${shard}.jsonl`);try{ensureDir(findingsDir),appendFileTranslated(spoolPath,JSON.stringify(entry)+`
+`)}catch(err){return{ok:!1,reason:`findings spool write failed: ${err instanceof Error?err.message:String(err)}`}}return{ok:!0,spoolPath,fingerprint:entry.fingerprint}}

package/dist/commands/task-record-red.js

@@ -0,0 +1,2 @@
+// SPDX-License-Identifier: Apache-2.0
+import{dirname}from"node:path";import{runCli}from"../utils/run-cli.js";import{combineTestOutput,extractFailureSignature,repositoryRelativeLog,writeTddEvidence}from"../evidence/tdd.js";import{blobShaInCommit,currentBranch,hasDirtyTestPaths,pathExistsInCommit}from"../evidence/git-checks.js";import{normalizeChainId,readTaskId,readUnifiedState}from"./task-state.js";import{loadConfig}from"../utils/config.js";import{detectLanguage}from"../detectors/language.js";export const DEFAULT_RECORD_RED_TIMEOUT_MS=6e4,MAX_RECORD_RED_TIMEOUT_MS=6e5;function clampTimeout(ms){return ms===void 0?DEFAULT_RECORD_RED_TIMEOUT_MS:!Number.isFinite(ms)||ms<1e3?1e3:ms>MAX_RECORD_RED_TIMEOUT_MS?MAX_RECORD_RED_TIMEOUT_MS:Math.floor(ms)}function toGoPackageDir(dir){return dir===""||dir==="."?".":dir.startsWith("./")||dir.startsWith("/")||dir.startsWith("../")?dir:`./${dir}`}function resolveLanguage(dir){const stored=loadConfig(dir);return stored?.language?stored.language:detectLanguage(dir)}function selectRunner(language,testPath){if(/\.(test|spec)\.[cm]?[jt]sx?$/.test(testPath))return["npx","vitest","run",testPath];switch(language){case"go":return["go","test",toGoPackageDir(dirname(testPath))];case"python":return["pytest",testPath];default:return["npx","vitest","run",testPath]}}function isCliOutputError(err){return err!==null&&typeof err=="object"&&"stdout"in err&&typeof err.stdout=="string"&&"stderr"in err&&typeof err.stderr=="string"}function testCommandLaunchFailure(err){return{ok:!1,reason:`test command failed to launch: ${err instanceof Error?err.message:String(err)}`}}function captureTestOutput(cmd,args,dir,timeoutMs){try{const r=runCli(cmd,args,{cwd:dir,timeoutMs});return{log:combineTestOutput(r.stdout,r.stderr),exitCode:r.exitCode}}catch(err){return isCliOutputError(err)&&typeof err.exitCode=="number"&&err.exitCode>0&&err.timedOut!==!0&&err.notFound!==!0?{log:combineTestOutput(err.stdout,err.stderr),exitCode:err.exitCode}:testCommandLaunchFailure(err)}}function resolveHeadSha(dir,timeoutMs){try{return runCli("git",["rev-parse","HEAD"],{cwd:dir,timeoutMs}).stdout.trim()}catch(err){return{ok:!1,reason:`git rev-parse HEAD failed: ${err instanceof Error?err.message:String(err)}`}}}function checkTestCommitIntegrity(opts,sha,dir){return opts.force?null:hasDirtyTestPaths(dir)?{ok:!1,reason:"commit the RED test first \u2014 evidence must point at the commit that contains it (__tests__/** has uncommitted changes). Pass --force to override."}:pathExistsInCommit(sha,opts.testPath,dir)?null:{ok:!1,reason:`test_path "${opts.testPath}" not found in HEAD (${sha}) \u2014 evidence must point at a commit that contains the RED test. Pass --force to override.`}}export function taskIdFromBranch(branch){const m=branch.match(/^task\/#?(\d+)(?:-.*)?$/);return m?`#${m[1]}`:void 0}function resolveSelectedTaskId(requestedTaskId,activeTaskId,dir){if(requestedTaskId===void 0)return{taskId:activeTaskId};let taskId;try{taskId=normalizeChainId(requestedTaskId)}catch(err){return{ok:!1,reason:err instanceof Error?err.message:String(err)}}const chainIds=readUnifiedState(dir)?.chainIds??[];return taskId===activeTaskId||chainIds.some(id=>id===taskId)?{taskId}:{ok:!1,reason:`task ${taskId} is not the active task or a declared train secondary \u2014 add it with \`arbiter ship --chain-add ${taskId}\` before recording its RED evidence.`}}function resolveActiveTaskId(dir,requestedTaskId){const docTaskId=readTaskId(dir),branch=currentBranch(dir),branchTaskId=taskIdFromBranch(branch);if(branchTaskId!==void 0&&docTaskId!==void 0&&branchTaskId!==docTaskId)return{ok:!1,reason:`branch/task-document mismatch \u2014 refusing to guess which task's evidence to record. branch "${branch}" resolves to task ${branchTaskId}; the task document (.claude/.task/status.json) says ${docTaskId}. Run \`arbiter task init --id ${branchTaskId}\` to realign the task document with the current branch (or switch to the intended branch).`};const taskId=branchTaskId??docTaskId;if(taskId===void 0){if(requestedTaskId!==void 0)try{return{taskId:normalizeChainId(requestedTaskId)}}catch(err){return{ok:!1,reason:err instanceof Error?err.message:String(err)}}return{ok:!1,reason:"no active task \u2014 run `arbiter task init --id #NNN` (or `/task #NNN`) to initialise the task first"}}return resolveSelectedTaskId(requestedTaskId,taskId,dir)}export function runTaskRecordRed(opts){const dir=opts.dir??process.cwd(),timeoutMs=clampTimeout(opts.timeoutMs),resolution=resolveActiveTaskId(dir,opts.taskId);if("reason"in resolution)return resolution;const taskId=resolution.taskId,shaOrErr=resolveHeadSha(dir,5e3);if(typeof shaOrErr=="object")return shaOrErr;const sha=shaOrErr,integrityFailure=checkTestCommitIntegrity(opts,sha,dir);if(integrityFailure)return integrityFailure;const testCmd=opts.testCmd??selectRunner(resolveLanguage(dir),opts.testPath),outputOrErr=captureTestOutput(String(testCmd[0]),testCmd.slice(1),dir,timeoutMs);if("ok"in outputOrErr)return outputOrErr;if(outputOrErr.exitCode===0)return{ok:!1,reason:"test command exited 0 (suite passed) \u2014 a RED phase requires a failing run; refusing to mint RED evidence"};const log=repositoryRelativeLog(outputOrErr.log,dir),sig=extractFailureSignature(log);if(sig===null)return{ok:!1,reason:"no recognised failure signature in test output \u2014 the test appears to pass or produced unrecognised output. Tests must be RED before recording evidence."};const blob=blobShaInCommit(sha,opts.testPath,dir),evidence={$schemaVersion:1,task_id:taskId,test_path:opts.testPath,test_commit_sha:sha,...blob!==null?{test_blob_sha:blob}:{},test_run_log:log,observed_failure:sig.match,recorded_at:new Date().toISOString(),test_command:[...testCmd]};return saveEvidence(dir,evidence,sig.framework)}function saveEvidence(dir,evidence,framework){try{return{ok:!0,evidencePath:writeTddEvidence({repoDir:dir,evidence}),framework}}catch(err){return{ok:!1,reason:err instanceof Error?err.message:String(err)}}}

package/dist/commands/task-record-tech-debt.js

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+import{join}from"node:path";import{sanitizeTaskId}from"../utils/task-id.js";import{createGhIssue,appendTechDebtIssue}from"../utils/github-issue-helper.js";import{readTaskId}from"./task-state.js";import{appendFileTranslated,ensureDir}from"../utils/fs.js";function buildIssueBody(description,taskId){return["## Background","",`This issue was filed automatically by \`arbiter task record-tech-debt\` (triggered by ${taskId}).`,"","## Finding","",description,"","## Risk","","Unaddressed tech-debt may cause regressions or impede future feature work.","","## Remediation","","Review and address in a follow-up task.","","## Related","",`- Triggered by: ${taskId}`].join(`
+`)}function resolveTaskId(opts,dir){return opts.triggeredBy?opts.triggeredBy:readTaskId(dir)??{ok:!1,reason:"no task-id: neither --triggered-by nor an active task found"}}export function runTaskRecordTechDebt(opts){const dir=opts.dir??process.cwd(),taskIdResult=resolveTaskId(opts,dir);if(typeof taskIdResult=="object")return taskIdResult;const taskId=taskIdResult,description=opts.description.trim();if(!description)return{ok:!1,reason:"--description must not be empty"};const ghResult=createGhIssue(dir,{title:`tech-debt: ${description}`,body:buildIssueBody(description,taskId),labels:["tech-debt","follow-up"]});if(!ghResult.ok)return ghResult;const issueNumber=ghResult.issueNumber,evidenceDir=join(dir,".arbiter","evidence",sanitizeTaskId(taskId));try{ensureDir(evidenceDir),appendTechDebtIssue(evidenceDir,issueNumber);const timestamp=new Date().toISOString().slice(0,16).replace("T"," ");appendFileTranslated(join(evidenceDir,"log.md"),[`## ${timestamp} \u2014 tech-debt issue #${issueNumber}`,`- ${description}`,`- triggered-by: ${taskId}`,""].join(`
+`))}catch(err){return{ok:!1,reason:`evidence write failed: ${err instanceof Error?err.message:String(err)}`}}return{ok:!0,issueNumber}}