@haystackeditor/cli 0.25.1 → 0.27.0

package/dist/commands/scaffold-provisional-universe.js

@@ -1,806 +0,0 @@
-import { closeSync, constants as fsConstants, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, renameSync, rmSync, writeFileSync, } from 'node:fs';
-import { createHash } from 'node:crypto';
-import { execFileSync } from 'node:child_process';
-import { basename, dirname, isAbsolute, join, normalize, parse as parsePath, relative, resolve, sep, } from 'node:path';
-import { stringify as stringifyYaml } from 'yaml';
-import { z } from 'zod';
-import { findGitRoot } from '../utils/hooks.js';
-import { VALIDATOR_CONTRACT_REVISION, validateUniverseArtifactTexts, } from './cloud-verifier-universe.js';
-const STABLE_ID = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-const SOURCE_COMMIT = /^[0-9a-f]{40}$/;
-const ARTIFACT_NAMES = ['universe.yml', 'evidence.yml', 'review.yml'];
-const PRIMARY_CALL_LIMIT = 48;
-const PRIMARY_ELAPSED_LIMIT_SECONDS = 900;
-const AUTHORITY_CALL_LIMIT = 6;
-const AUTHORITY_ELAPSED_LIMIT_SECONDS = 60;
-export const TOPOLOGY_PRESENCE_SURFACE_KINDS = [
-    'runtime-entrypoints',
-    'package-workspace-manifests',
-    'container-descriptors',
-    'deployment-descriptors',
-    'structured-capability-indexes',
-];
-export const PROVISIONAL_UNIVERSE_INPUT_MAX_BYTES = 256 * 1024;
-export const PROVISIONAL_ACCESS_REQUEST_FIELDS = [
-    'selected-application-id-and-environment-id',
-    'approved-replica-destination-policy-and-approval-ref',
-    'bounded-resource-kinds-opaque-catalog-handles-and-dependency-edges',
-    'artifact-runtime-and-non-secret-config-opaque-catalog-refs',
-    'external-integration-kinds-and-secret-reference-names',
-    'replica-capabilities-strategies-consistency-freshness-latency-and-cost-bounds',
-    'replica-only-golden-descriptor-and-lease-reference-contract',
-];
-const UNSAFE_VALUE_PATTERNS = [
-    [/[a-z][a-z0-9+.-]*:\/\//i, 'raw URLs are forbidden'],
-    [/(?:jdbc|postgres(?:ql)?|mysql|mariadb|redis|rediss|amqp|amqps|mongodb(?:\+srv)?|sqlserver):/i, 'connection strings are forbidden'],
-    [/\barn:(?:aws|aws-cn|aws-us-gov):/i, 'provider ARNs are forbidden'],
-    [/(?:^|[^a-z0-9])(?:acl|ami|eipalloc|eni|fs|i|igw|nat|rtb|sg|snap|subnet|vol|vpc|vpce)-[0-9a-f]{8,17}(?=$|[^a-z0-9])/i, 'raw provider resource IDs are forbidden'],
-    [/(?:^|[/])subscriptions\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}(?:[/]|$)/i, 'raw Azure resource IDs are forbidden'],
-    [/(?:^|[^a-z0-9])projects\/[^/\s]+\/(?:zones|regions|locations|instances|clusters|databases|buckets)(?:[/]|$)/i, 'raw Google Cloud resource IDs are forbidden'],
-    [/\bocid1\.[a-z0-9.-]+\.[a-z0-9.-]*[a-z0-9]\b/i, 'raw OCI resource IDs are forbidden'],
-    [/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/, 'credential values are forbidden'],
-    [/\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|sk_(?:live|test)_[A-Za-z0-9]+)\b/, 'credential values are forbidden'],
-    [/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/, 'credential values are forbidden'],
-    [/\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/, 'credential values are forbidden'],
-    [/\bBearer\s+[A-Za-z0-9._~+/-]+=*\b/i, 'credential values are forbidden'],
-    [/-----BEGIN [A-Z ]*PRIVATE KEY-----/, 'private key values are forbidden'],
-    [/(?:password|secret|token|api[_-]?key)\s*[:=]\s*[^\s,;]+/i, 'secret values are forbidden'],
-];
-function sanitizedStringSchema(schema, label) {
-    return schema.superRefine((value, context) => {
-        if (value.includes('\0')) {
-            context.addIssue({ code: 'custom', message: `${label} must not contain NUL` });
-        }
-        for (const [pattern, message] of UNSAFE_VALUE_PATTERNS) {
-            if (pattern.test(value)) {
-                context.addIssue({ code: 'custom', message: `${label}: ${message}` });
-            }
-        }
-    });
-}
-function safeStringSchema(label) {
-    return sanitizedStringSchema(z.string().min(1, `${label} must not be empty`), label);
-}
-const stableIdSchema = sanitizedStringSchema(z.string().regex(STABLE_ID, 'must be a lowercase kebab-case stable ID'), 'stable ID');
-const sourceCommitSchema = sanitizedStringSchema(z.string().regex(SOURCE_COMMIT, 'must be a lowercase 40-character Git SHA'), 'source commit');
-const environmentScopeSchema = z.enum([
-    'hosted-production',
-    'production-reference',
-    'self-host-reference',
-    'local-development',
-    'example',
-    'unknown',
-]);
-const fidelityCeilingSchema = z.enum([
-    'production-reference-only',
-    'self-host-reference-only',
-    'local-development-only',
-    'unknown',
-]);
-const repositoryPathSchema = safeStringSchema('repository path').superRefine((value, context) => {
-    if (value.includes('\\') ||
-        value.startsWith('/') ||
-        value.endsWith('/') ||
-        normalize(value) !== value ||
-        value.split('/').some((component) => component === '..' || component === '')) {
-        context.addIssue({
-            code: 'custom',
-            message: 'must be a normalized repository-relative POSIX path',
-        });
-    }
-    if (value.split('/').includes('.haystack')) {
-        context.addIssue({
-            code: 'custom',
-            message: 'must not reference generated .haystack artifacts',
-        });
-    }
-});
-const evidenceSourceSchema = z
-    .object({
-    path: repositoryPathSchema,
-    anchor: safeStringSchema('source anchor'),
-    kind: stableIdSchema,
-    locatorKind: z.enum([
-        'symbol',
-        'exact-snippet',
-        'line-span',
-        'manifest-key',
-        'config-key',
-    ]),
-    lines: z
-        .object({
-        start: z.number().int().positive(),
-        end: z.number().int().positive(),
-    })
-        .strict()
-        .optional(),
-})
-    .strict()
-    .superRefine((source, context) => {
-    if (source.locatorKind === 'line-span') {
-        if (!source.lines || source.lines.end < source.lines.start) {
-            context.addIssue({
-                code: 'custom',
-                path: ['lines'],
-                message: 'must contain positive start/end positions with end >= start for locatorKind line-span',
-            });
-        }
-    }
-    else if (source.lines !== undefined) {
-        context.addIssue({
-            code: 'custom',
-            path: ['lines'],
-            message: 'is only valid for locatorKind line-span',
-        });
-    }
-});
-const evidenceRecordSchema = z
-    .object({
-    id: stableIdSchema,
-    subjectIds: z.array(stableIdSchema).min(1),
-    assertion: safeStringSchema('evidence assertion'),
-    environmentScope: environmentScopeSchema,
-    authority: z.enum(['authoritative', 'indicative', 'non-production']),
-    confidence: z.enum(['proven', 'strong', 'tentative']),
-    claimKind: z.literal('topology-presence-census').optional(),
-    sources: z.array(evidenceSourceSchema).min(1),
-})
-    .strict();
-const budgetUsageSchema = z
-    .object({
-    repositoryInspectionCallsUsed: z.number().int().nonnegative(),
-    elapsedSeconds: z.number().nonnegative(),
-})
-    .strict();
-const provisionalUniverseScaffoldInputSchema = z
-    .object({
-    sourceCommit: sourceCommitSchema,
-    application: z
-        .object({
-        id: stableIdSchema,
-        requestedScope: stableIdSchema,
-        evaluationMode: z.literal('real-production', {
-            error: 'must be "real-production" because this scaffold records missing real-production authority',
-        }),
-    })
-        .strict(),
-    repositoryTopology: z
-        .object({
-        id: stableIdSchema,
-        environmentScope: environmentScopeSchema,
-        fidelityCeiling: fidelityCeilingSchema,
-        evidenceIds: z.array(stableIdSchema).min(1),
-        topologyPresenceCensus: z
-            .object({
-            status: z.literal('no-production-capable-topology'),
-            subjectId: stableIdSchema,
-            inspectedSurfaceKinds: z.tuple([
-                z.literal(TOPOLOGY_PRESENCE_SURFACE_KINDS[0]),
-                z.literal(TOPOLOGY_PRESENCE_SURFACE_KINDS[1]),
-                z.literal(TOPOLOGY_PRESENCE_SURFACE_KINDS[2]),
-                z.literal(TOPOLOGY_PRESENCE_SURFACE_KINDS[3]),
-                z.literal(TOPOLOGY_PRESENCE_SURFACE_KINDS[4]),
-            ]),
-            productionCapableSurfaceCount: z.literal(0),
-            evidenceIds: z.array(stableIdSchema).min(1),
-        })
-            .strict(),
-    })
-        .strict(),
-    missingAuthority: z
-        .object({
-        id: stableIdSchema,
-        kind: stableIdSchema,
-        requiredFor: stableIdSchema,
-        status: z.literal('unavailable-in-repository'),
-        evidenceIds: z.array(stableIdSchema).min(1),
-    })
-        .strict(),
-    accessRequest: z
-        .object({
-        id: stableIdSchema,
-        source: stableIdSchema,
-        reason: stableIdSchema,
-    })
-        .strict(),
-    evidence: z.array(evidenceRecordSchema).min(1),
-    coverage: z
-        .object({
-        scannedRoots: z.array(repositoryPathSchema).min(1),
-        sourceKinds: z.array(stableIdSchema).min(1),
-    })
-        .strict(),
-    budget: z
-        .object({
-        primaryDiscovery: budgetUsageSchema,
-        authorityGate: budgetUsageSchema,
-        overrunBlockerIds: z
-            .object({
-            primaryDiscovery: stableIdSchema.optional(),
-            authorityGate: stableIdSchema.optional(),
-        })
-            .strict()
-            .optional(),
-    })
-        .strict(),
-    authorityBlocker: z
-        .object({
-        id: stableIdSchema,
-        kind: z.enum([
-            'missing-authoritative-source',
-            'production-authority-access-required',
-        ]),
-        evidenceIds: z.array(stableIdSchema).min(1),
-    })
-        .strict(),
-})
-    .strict();
-function assertUnique(values, label) {
-    const seen = new Set();
-    for (const value of values) {
-        if (seen.has(value))
-            throw new Error(`${label} contains duplicate stable ID "${value}"`);
-        seen.add(value);
-    }
-}
-function requireEvidenceSupport(references, evidenceById, subjectId, label) {
-    for (const reference of references) {
-        const evidence = evidenceById.get(reference);
-        if (!evidence) {
-            throw new Error(`${label} references unknown evidence ID "${reference}"`);
-        }
-        if (!evidence.subjectIds.includes(subjectId)) {
-            throw new Error(`${label} evidence "${reference}" must include supported subject ID "${subjectId}"`);
-        }
-    }
-}
-function validateLinkedInput(input) {
-    const evidenceIds = input.evidence.map((record) => record.id);
-    assertUnique(evidenceIds, 'evidence');
-    const evidenceById = new Map(input.evidence.map((record) => [record.id, record]));
-    if (input.budget.primaryDiscovery.repositoryInspectionCallsUsed >
-        PRIMARY_CALL_LIMIT) {
-        throw new Error('budget.primaryDiscovery.repositoryInspectionCallsUsed must not exceed the scaffold\'s selected 48-call wave');
-    }
-    if (input.budget.authorityGate.repositoryInspectionCallsUsed >
-        AUTHORITY_CALL_LIMIT) {
-        throw new Error('budget.authorityGate.repositoryInspectionCallsUsed must not exceed the 6-call authority ceiling');
-    }
-    const primaryOverrun = input.budget.primaryDiscovery.elapsedSeconds > PRIMARY_ELAPSED_LIMIT_SECONDS;
-    const authorityOverrun = input.budget.authorityGate.elapsedSeconds > AUTHORITY_ELAPSED_LIMIT_SECONDS;
-    const configuredOverrunIds = input.budget.overrunBlockerIds;
-    if (primaryOverrun !== (configuredOverrunIds?.primaryDiscovery !== undefined)) {
-        throw new Error(primaryOverrun
-            ? 'budget.overrunBlockerIds.primaryDiscovery is required for the exceeded budget.primary_discovery path'
-            : 'budget.overrunBlockerIds.primaryDiscovery is unsupported when budget.primary_discovery is within limits');
-    }
-    if (authorityOverrun !== (configuredOverrunIds?.authorityGate !== undefined)) {
-        throw new Error(authorityOverrun
-            ? 'budget.overrunBlockerIds.authorityGate is required for the exceeded budget.primary_discovery.authority_gate path'
-            : 'budget.overrunBlockerIds.authorityGate is unsupported when the authority gate is within limits');
-    }
-    if (input.budget.authorityGate.repositoryInspectionCallsUsed >
-        input.budget.primaryDiscovery.repositoryInspectionCallsUsed ||
-        input.budget.authorityGate.elapsedSeconds > input.budget.primaryDiscovery.elapsedSeconds) {
-        throw new Error('authority-gate usage must not exceed total primary-discovery usage');
-    }
-    const universeIds = [
-        input.application.id,
-        input.repositoryTopology.id,
-        input.missingAuthority.id,
-        input.accessRequest.id,
-        input.authorityBlocker.id,
-        ...(configuredOverrunIds?.primaryDiscovery
-            ? [configuredOverrunIds.primaryDiscovery]
-            : []),
-        ...(configuredOverrunIds?.authorityGate ? [configuredOverrunIds.authorityGate] : []),
-        ...evidenceIds,
-    ];
-    assertUnique(universeIds, 'scaffold input');
-    const evidenceSubjectIds = new Set([
-        input.application.id,
-        input.repositoryTopology.id,
-        input.missingAuthority.id,
-    ]);
-    input.evidence.forEach((record) => {
-        assertUnique(record.subjectIds, `evidence record "${record.id}" subjectIds`);
-        record.subjectIds.forEach((subjectId) => {
-            if (!evidenceSubjectIds.has(subjectId)) {
-                throw new Error(`evidence record "${record.id}" references unknown universe subject ID "${subjectId}"`);
-            }
-        });
-    });
-    requireEvidenceSupport(input.repositoryTopology.evidenceIds, evidenceById, input.repositoryTopology.id, 'repositoryTopology.evidenceIds');
-    const presenceCensus = input.repositoryTopology.topologyPresenceCensus;
-    if (presenceCensus.subjectId !== input.repositoryTopology.id) {
-        throw new Error('repositoryTopology.topologyPresenceCensus.subjectId must equal repositoryTopology.id');
-    }
-    requireEvidenceSupport(presenceCensus.evidenceIds, evidenceById, presenceCensus.subjectId, 'repositoryTopology.topologyPresenceCensus.evidenceIds');
-    if (!presenceCensus.evidenceIds.some((evidenceId) => {
-        const record = evidenceById.get(evidenceId);
-        return (record?.claimKind === 'topology-presence-census' &&
-            record.subjectIds.length === 1 &&
-            record.subjectIds[0] === presenceCensus.subjectId);
-    })) {
-        throw new Error('repositoryTopology.topologyPresenceCensus.evidenceIds must include an exact topology-presence-census claim for repositoryTopology.id');
-    }
-    requireEvidenceSupport(input.missingAuthority.evidenceIds, evidenceById, input.missingAuthority.id, 'missingAuthority.evidenceIds');
-    requireEvidenceSupport(input.authorityBlocker.evidenceIds, evidenceById, input.missingAuthority.id, 'authorityBlocker.evidenceIds');
-    assertUnique(input.repositoryTopology.evidenceIds, 'repositoryTopology.evidenceIds');
-    assertUnique(presenceCensus.evidenceIds, 'repositoryTopology.topologyPresenceCensus.evidenceIds');
-    assertUnique(input.missingAuthority.evidenceIds, 'missingAuthority.evidenceIds');
-    assertUnique(input.authorityBlocker.evidenceIds, 'authorityBlocker.evidenceIds');
-    assertUnique(input.coverage.scannedRoots, 'coverage.scannedRoots');
-    assertUnique(input.coverage.sourceKinds, 'coverage.sourceKinds');
-}
-function yamlText(value) {
-    return stringifyYaml(value, { lineWidth: 0, aliasDuplicateObjects: false });
-}
-function renderArtifacts(input) {
-    const budgetBlockers = [];
-    const overrunIds = input.budget.overrunBlockerIds;
-    if (overrunIds?.primaryDiscovery) {
-        budgetBlockers.push({
-            id: overrunIds.primaryDiscovery,
-            kind: 'budget-exhausted',
-            budget_path: 'budget.primary_discovery',
-        });
-    }
-    if (overrunIds?.authorityGate) {
-        budgetBlockers.push({
-            id: overrunIds.authorityGate,
-            kind: 'budget-exhausted',
-            budget_path: 'budget.primary_discovery.authority_gate',
-        });
-    }
-    const universe = {
-        version: 1,
-        map_revision: {
-            source_commit: input.sourceCommit,
-            previous_source_commit: null,
-            mode: 'full-scan',
-            changed_scope_ids: [],
-        },
-        application: {
-            id: input.application.id,
-            requested_scope: input.application.requestedScope,
-            selected_production_scope: null,
-            scope_status: 'provisional',
-            evaluation_mode: input.application.evaluationMode,
-        },
-        production_basis: {
-            repository_proven_topology: {
-                environment_scope: input.repositoryTopology.environmentScope,
-                fidelity_ceiling: input.repositoryTopology.fidelityCeiling,
-                evidence_ids: input.repositoryTopology.evidenceIds,
-                topology_presence_census: {
-                    status: input.repositoryTopology.topologyPresenceCensus.status,
-                    subject_id: input.repositoryTopology.topologyPresenceCensus.subjectId,
-                    inspected_surface_kinds: [
-                        ...input.repositoryTopology.topologyPresenceCensus
-                            .inspectedSurfaceKinds,
-                    ],
-                    production_capable_surface_count: input.repositoryTopology.topologyPresenceCensus
-                        .productionCapableSurfaceCount,
-                    evidence_ids: input.repositoryTopology.topologyPresenceCensus.evidenceIds,
-                },
-            },
-            authoritative_sources: [],
-            missing_authoritative_sources: [
-                {
-                    id: input.missingAuthority.id,
-                    kind: input.missingAuthority.kind,
-                    required_for: input.missingAuthority.requiredFor,
-                    status: input.missingAuthority.status,
-                    evidence_ids: input.missingAuthority.evidenceIds,
-                },
-            ],
-            access_request: {
-                id: input.accessRequest.id,
-                access: 'read-only',
-                source: input.accessRequest.source,
-                fields: [...PROVISIONAL_ACCESS_REQUEST_FIELDS],
-                reason: input.accessRequest.reason,
-            },
-            alternate_topologies: [
-                {
-                    id: input.repositoryTopology.id,
-                    environment_scope: input.repositoryTopology.environmentScope,
-                    selected: false,
-                    evidence_ids: input.repositoryTopology.evidenceIds,
-                },
-            ],
-        },
-        deployment_profiles: [],
-        artifacts: [],
-        services: [],
-        interfaces: [],
-        physical_bindings: [],
-        resources: [],
-        external_dependencies: [],
-        consistency_groups: [],
-        unresolved: [],
-    };
-    const evidence = {
-        version: 1,
-        coverage: {
-            scanned_roots: input.coverage.scannedRoots,
-            excluded_paths: [],
-            source_kinds: input.coverage.sourceKinds,
-            external_integration_scope: {
-                method: 'not-entered-before-production-authority',
-                status: 'partial',
-                uncovered: ['active-hosted-integrations-and-secret-reference-names'],
-            },
-            inventory_closure: {
-                runtime_roles: {
-                    status: 'partial',
-                    candidates: [],
-                    structured_registry_discovery: {
-                        status: 'partial',
-                        evidence_ids: input.repositoryTopology.evidenceIds,
-                        registries: [],
-                        uncovered: ['hosted-production-runtime-registries'],
-                    },
-                    uncovered: ['hosted-production-launch-surfaces'],
-                },
-                stateful_resources: {
-                    status: 'partial',
-                    candidates: [],
-                    state_surface_discovery: {
-                        status: 'partial',
-                        evidence_ids: input.repositoryTopology.evidenceIds,
-                        entries: [],
-                        uncovered: ['hosted-production-state-surfaces'],
-                    },
-                    logical_state_census: {
-                        status: 'partial',
-                        evidence_ids: input.repositoryTopology.evidenceIds,
-                        entries: [],
-                        uncovered: ['hosted-production-logical-state-identities'],
-                    },
-                    structured_registry_discovery: {
-                        status: 'partial',
-                        evidence_ids: input.repositoryTopology.evidenceIds,
-                        registries: [],
-                        uncovered: ['hosted-production-state-registries'],
-                    },
-                    uncovered: ['hosted-production-state'],
-                },
-                external_dependencies: {
-                    status: 'partial',
-                    candidates: [],
-                    structured_registry_discovery: {
-                        status: 'partial',
-                        evidence_ids: input.repositoryTopology.evidenceIds,
-                        registries: [],
-                        uncovered: ['hosted-production-integration-registries'],
-                    },
-                    uncovered: ['hosted-production-egress'],
-                },
-            },
-            operational_surface_census: {
-                status: 'partial',
-                evidence_ids: input.repositoryTopology.evidenceIds,
-                frontier_receipts: [
-                    {
-                        frontier: 'deployment-runtime-units',
-                        status: 'partial',
-                        surface_ids: [],
-                        evidence_ids: input.repositoryTopology.evidenceIds,
-                        uncovered: ['hosted-production-runtime-units'],
-                    },
-                    {
-                        frontier: 'state-materialization-identities',
-                        status: 'partial',
-                        surface_ids: [],
-                        evidence_ids: input.repositoryTopology.evidenceIds,
-                        uncovered: ['hosted-production-state-identities'],
-                    },
-                    {
-                        frontier: 'outbound-host-operation-contracts',
-                        status: 'partial',
-                        surface_ids: [],
-                        evidence_ids: input.repositoryTopology.evidenceIds,
-                        uncovered: ['hosted-production-outbound-host-operations'],
-                    },
-                    {
-                        frontier: 'required-inbound-pull-contracts',
-                        status: 'partial',
-                        surface_ids: [],
-                        evidence_ids: input.repositoryTopology.evidenceIds,
-                        uncovered: ['hosted-production-inbound-pull-operations'],
-                    },
-                ],
-                surfaces: [],
-                uncovered: ['hosted-production-operational-surfaces'],
-            },
-            selector_surface_census: {
-                status: 'partial',
-                evidence_ids: input.repositoryTopology.evidenceIds,
-                discovery_roots: [],
-                surfaces: [],
-                uncovered: ['hosted-production-selector-surfaces'],
-            },
-        },
-        evidence: input.evidence.map((record) => ({
-            id: record.id,
-            subject_ids: record.subjectIds,
-            assertion: record.assertion,
-            ...(record.claimKind === undefined
-                ? {}
-                : { claim_kind: record.claimKind }),
-            environment_scope: record.environmentScope,
-            authority: record.authority,
-            sources: record.sources.map((source) => ({
-                path: source.path,
-                ...(source.lines === undefined ? {} : { lines: source.lines }),
-                anchor: source.anchor,
-                kind: source.kind,
-                locator_kind: source.locatorKind,
-            })),
-            confidence: record.confidence,
-        })),
-    };
-    const review = {
-        version: 1,
-        inventory_closure_audit: {
-            status: 'deferred',
-            reason: 'inventory-closure-partial',
-        },
-        reviewer: {
-            status: 'deferred',
-            reason: 'production-authority-required',
-        },
-        budget: {
-            primary_discovery: {
-                call_limit: PRIMARY_CALL_LIMIT,
-                elapsed_limit_seconds: PRIMARY_ELAPSED_LIMIT_SECONDS,
-                repository_inspection_calls_used: input.budget.primaryDiscovery.repositoryInspectionCallsUsed,
-                elapsed_seconds: input.budget.primaryDiscovery.elapsedSeconds,
-                authority_gate: {
-                    call_limit: AUTHORITY_CALL_LIMIT,
-                    elapsed_limit_seconds: AUTHORITY_ELAPSED_LIMIT_SECONDS,
-                    repository_inspection_calls_used: input.budget.authorityGate.repositoryInspectionCallsUsed,
-                    elapsed_seconds: input.budget.authorityGate.elapsedSeconds,
-                },
-            },
-        },
-        termination: {
-            reason: 'missing-production-authority',
-            phase: 'authority-gate',
-        },
-        validation: {
-            command: 'haystack skills validate-universe --json',
-            validator_contract_revision: VALIDATOR_CONTRACT_REVISION,
-            status: 'passed',
-        },
-        status: 'blocked',
-        blocking_items: [
-            {
-                id: input.authorityBlocker.id,
-                kind: input.authorityBlocker.kind,
-                evidence_ids: input.authorityBlocker.evidenceIds,
-            },
-            ...budgetBlockers,
-        ],
-    };
-    return {
-        'universe.yml': yamlText(universe),
-        'evidence.yml': yamlText(evidence),
-        'review.yml': yamlText(review),
-    };
-}
-function assertSafeOutputDirectory(outputDirectory) {
-    if (!isAbsolute(outputDirectory) || normalize(outputDirectory) !== outputDirectory) {
-        throw new Error('output directory must be an absolute normalized path');
-    }
-    const resolved = resolve(outputDirectory);
-    const parent = dirname(resolved);
-    const repositoryRoot = dirname(parent);
-    if (basename(resolved) !== 'cloud-verifier' ||
-        basename(parent) !== '.haystack' ||
-        repositoryRoot === parsePath(resolved).root) {
-        throw new Error('output directory must be an absolute <repository>/.haystack/cloud-verifier path');
-    }
-    const root = parsePath(resolved).root;
-    let current = root;
-    for (const component of relative(root, resolved).split(sep)) {
-        current = join(current, component);
-        const metadata = lstatSync(current, { throwIfNoEntry: false });
-        if (metadata === undefined)
-            continue;
-        if (metadata.isSymbolicLink()) {
-            throw new Error(`output directory must not traverse symlink "${current}"`);
-        }
-        if (!metadata.isDirectory()) {
-            throw new Error(`output directory ancestor is not a directory: "${current}"`);
-        }
-    }
-    if (lstatSync(resolved, { throwIfNoEntry: false }) !== undefined) {
-        throw new Error('output directory already exists; refusing to overwrite an artifact set');
-    }
-    return resolved;
-}
-function digest(text) {
-    return `sha256:${createHash('sha256').update(text, 'utf8').digest('hex')}`;
-}
-/**
- * Validates a pure, data-only provisional receipt input, validates the rendered
- * artifacts against the universe contract, then publishes the three-file set by
- * one directory rename. Cooperative scaffold calls serialize through a lock,
- * and every destination observed before publication fails closed.
- */
-export function scaffoldProvisionalUniverse(outputDirectory, rawInput) {
-    const input = provisionalUniverseScaffoldInputSchema.parse(rawInput);
-    validateLinkedInput(input);
-    const texts = renderArtifacts(input);
-    const validation = validateUniverseArtifactTexts(texts);
-    if (validation.status !== 'valid') {
-        throw new Error(`generated provisional artifacts failed validation: ${validation.issues
-            .map((issue) => `${issue.file}:${issue.path}: ${issue.message}`)
-            .join('; ')}`);
-    }
-    const safeOutputDirectory = assertSafeOutputDirectory(outputDirectory);
-    const parent = dirname(safeOutputDirectory);
-    mkdirSync(parent, { recursive: true, mode: 0o700 });
-    assertSafeOutputDirectory(safeOutputDirectory);
-    const lockDirectory = join(parent, '.cloud-verifier-scaffold-lock');
-    mkdirSync(lockDirectory, { mode: 0o700 });
-    let stagingDirectory = null;
-    try {
-        if (lstatSync(safeOutputDirectory, { throwIfNoEntry: false }) !== undefined) {
-            throw new Error('output directory appeared during scaffold; refusing to overwrite it');
-        }
-        stagingDirectory = mkdtempSync(join(parent, '.cloud-verifier-staging-'));
-        for (const name of ARTIFACT_NAMES) {
-            writeFileSync(join(stagingDirectory, name), texts[name], {
-                encoding: 'utf8',
-                flag: 'wx',
-                mode: 0o600,
-            });
-        }
-        if (lstatSync(safeOutputDirectory, { throwIfNoEntry: false }) !== undefined) {
-            throw new Error('output directory appeared during scaffold; refusing to overwrite it');
-        }
-        renameSync(stagingDirectory, safeOutputDirectory);
-        stagingDirectory = null;
-    }
-    finally {
-        if (stagingDirectory !== null) {
-            rmSync(stagingDirectory, { recursive: true, force: true });
-        }
-        rmSync(lockDirectory, { recursive: true, force: true });
-    }
-    return {
-        outputDirectory: safeOutputDirectory,
-        texts,
-        artifacts: {
-            'universe.yml': {
-                bytes: Buffer.byteLength(texts['universe.yml'], 'utf8'),
-                digest: digest(texts['universe.yml']),
-            },
-            'evidence.yml': {
-                bytes: Buffer.byteLength(texts['evidence.yml'], 'utf8'),
-                digest: digest(texts['evidence.yml']),
-            },
-            'review.yml': {
-                bytes: Buffer.byteLength(texts['review.yml'], 'utf8'),
-                digest: digest(texts['review.yml']),
-            },
-        },
-        validationSummary: {
-            universeIds: validation.summary.universe_ids,
-            evidenceIds: validation.summary.evidence_ids,
-            reviewIds: validation.summary.review_ids,
-        },
-    };
-}
-function readStrictJsonInput(inputPath) {
-    const metadata = lstatSync(inputPath, { throwIfNoEntry: false });
-    if (metadata === undefined) {
-        throw new Error(`provisional universe input file does not exist: "${inputPath}"`);
-    }
-    if (metadata.isSymbolicLink() || !metadata.isFile()) {
-        throw new Error('provisional universe input must be a non-symlink regular file');
-    }
-    if (metadata.size > PROVISIONAL_UNIVERSE_INPUT_MAX_BYTES) {
-        throw new Error(`provisional universe input exceeds ${PROVISIONAL_UNIVERSE_INPUT_MAX_BYTES} bytes`);
-    }
-    let descriptor = null;
-    let bytes;
-    try {
-        descriptor = openSync(inputPath, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW);
-        const openedMetadata = fstatSync(descriptor);
-        if (!openedMetadata.isFile()) {
-            throw new Error('provisional universe input must be a non-symlink regular file');
-        }
-        if (openedMetadata.size > PROVISIONAL_UNIVERSE_INPUT_MAX_BYTES) {
-            throw new Error(`provisional universe input exceeds ${PROVISIONAL_UNIVERSE_INPUT_MAX_BYTES} bytes`);
-        }
-        bytes = readFileSync(descriptor);
-    }
-    finally {
-        if (descriptor !== null)
-            closeSync(descriptor);
-    }
-    if (bytes.byteLength > PROVISIONAL_UNIVERSE_INPUT_MAX_BYTES) {
-        throw new Error(`provisional universe input exceeds ${PROVISIONAL_UNIVERSE_INPUT_MAX_BYTES} bytes`);
-    }
-    let text;
-    try {
-        text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
-    }
-    catch {
-        throw new Error('provisional universe input must be valid UTF-8 JSON');
-    }
-    try {
-        return JSON.parse(text);
-    }
-    catch (error) {
-        throw new Error(`provisional universe input is malformed JSON: ${error.message}`);
-    }
-}
-function currentCleanRepositoryCommit(root) {
-    let head;
-    try {
-        head = execFileSync('git', ['rev-parse', '--verify', 'HEAD^{commit}'], {
-            cwd: root,
-            encoding: 'utf8',
-            stdio: ['ignore', 'pipe', 'pipe'],
-        }).trim();
-    }
-    catch {
-        throw new Error('scaffold-provisional-universe requires a Git repository with a current commit');
-    }
-    const changes = execFileSync('git', [
-        'status',
-        '--porcelain=v1',
-        '--untracked-files=all',
-        '--',
-        '.',
-        ':(exclude).haystack',
-        ':(exclude).haystack/**',
-    ], {
-        cwd: root,
-        encoding: 'utf8',
-        stdio: ['ignore', 'pipe', 'pipe'],
-        maxBuffer: 4 * 1024 * 1024,
-    });
-    if (changes.length > 0) {
-        throw new Error('scaffold-provisional-universe requires a clean Git worktree outside .haystack');
-    }
-    return head;
-}
-/** CLI adapter for later command registration. Always emits one compact JSON line. */
-export function scaffoldProvisionalUniverseCommand(options) {
-    if (typeof options.input !== 'string' || options.input.length === 0) {
-        throw new Error('--input must name an absolute or current-directory-relative JSON file');
-    }
-    const root = findGitRoot();
-    if (!root) {
-        throw new Error('scaffold-provisional-universe must be run inside a Git repository');
-    }
-    const inputPath = isAbsolute(options.input)
-        ? normalize(options.input)
-        : resolve(process.cwd(), options.input);
-    const rawInput = readStrictJsonInput(inputPath);
-    const input = provisionalUniverseScaffoldInputSchema.parse(rawInput);
-    const head = currentCleanRepositoryCommit(root);
-    if (input.sourceCommit !== head) {
-        throw new Error(`sourceCommit must equal the current Git HEAD "${head}"`);
-    }
-    const result = scaffoldProvisionalUniverse(join(root, '.haystack', 'cloud-verifier'), input);
-    const metadata = {
-        status: 'created',
-        output_directory: result.outputDirectory,
-        artifacts: result.artifacts,
-        validation: {
-            validator_contract_revision: VALIDATOR_CONTRACT_REVISION,
-            universe_ids: result.validationSummary.universeIds,
-            evidence_ids: result.validationSummary.evidenceIds,
-            review_ids: result.validationSummary.reviewIds,
-        },
-    };
-    console.log(JSON.stringify(metadata));
-}