@iowarp/clio-coder 0.4.9 → 0.5.0

package/dist/chunk-6RJMYYIE.js

@@ -0,0 +1,1023 @@
+import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
+import {
+  verifyTool
+} from "./chunk-4SYHGVDE.js";
+import {
+  parseTomlDocument,
+  tomlTableAt
+} from "./chunk-LQTKDAUO.js";
+import {
+  VALIDATION_CONTRACT_MARKDOWN_PATH,
+  loadValidationContract
+} from "./chunk-ZU4JPCPR.js";
+import {
+  discoverDeclaredChecksAtRoot,
+  discoverDeclaredProjectEntriesAtRoot
+} from "./chunk-7RET77VB.js";
+import {
+  PROJECT_VERIFIER_CATALOG_CAPS,
+  PROJECT_VERIFIER_CATALOG_RELATIVE_PATH,
+  PROJECT_VERIFIER_CATALOG_VERSION,
+  parseProjectVerifierCatalogText
+} from "./chunk-6CTHLZFB.js";
+import {
+  compareCodepoints,
+  normalizeNumericTolerance
+} from "./chunk-2KUBKL63.js";
+import {
+  isVerificationScriptName
+} from "./chunk-M4KFUXS7.js";
+import {
+  require_dist
+} from "./chunk-B5GGDIHT.js";
+import {
+  SAFE_EXEC_DEFAULT_TIMEOUT_MS,
+  resolveSafeCwd
+} from "./chunk-M2IPMWCN.js";
+import {
+  __toESM,
+  init_esm_shims
+} from "./chunk-ECBHH7LU.js";
+
+// src/tools/verify/authoring.ts
+init_esm_shims();
+var import_yaml = __toESM(require_dist(), 1);
+import { randomUUID } from "node:crypto";
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  renameSync,
+  rmSync,
+  statSync,
+  writeFileSync
+} from "node:fs";
+import path from "node:path";
+var DECLARED_FILE_CAP_BYTES = 1024 * 1024;
+function manualEntryInstruction() {
+  return 'No unambiguous declared command was found. Add one explicitly with `clio-coder verifiers add --id <id> --description <text> --command \'["executable","arg"]\'`; `--command` is an exact JSON argv array. Review the preview, then rerun with `--yes`.';
+}
+function cloneCheck(check) {
+  return {
+    ...check,
+    command: [...check.command],
+    tags: [...check.tags],
+    ...check.numeric !== void 0 ? { numeric: structuredClone(check.numeric) } : {},
+    ...check.perf !== void 0 ? { perf: structuredClone(check.perf) } : {},
+    provenance: { ...check.provenance }
+  };
+}
+function kindFields(check) {
+  const kind = check.kind ?? "command";
+  if (kind === "command") return {};
+  return {
+    kind,
+    ...check.numeric !== void 0 ? { numeric: structuredClone(check.numeric) } : {},
+    ...check.perf !== void 0 ? { perf: structuredClone(check.perf) } : {}
+  };
+}
+function relativePath(workspaceRoot, filePath) {
+  const relative = path.relative(workspaceRoot, filePath);
+  return relative.length === 0 ? "." : relative.split(path.sep).join("/");
+}
+function regularFileText(filePath, workspaceRoot) {
+  if (!existsSync(filePath)) return null;
+  try {
+    const realRoot = realpathSync(workspaceRoot);
+    const realFilePath = realpathSync(filePath);
+    resolveSafeCwd(realFilePath, realRoot);
+    const stats = statSync(realFilePath);
+    if (!stats.isFile()) return new Error("path is not a regular file");
+    if (stats.size > DECLARED_FILE_CAP_BYTES) {
+      return new Error(`file exceeds the ${DECLARED_FILE_CAP_BYTES}-byte discovery cap`);
+    }
+    return readFileSync(realFilePath, "utf8");
+  } catch (error) {
+    return error instanceof Error ? error : new Error(String(error));
+  }
+}
+function slug(value, fallback) {
+  const normalized = value.toLowerCase().replace(/[^a-z0-9._:-]+/gu, "-").replace(/^[^a-z0-9]+/u, "").replace(/[-.:]+$/u, "");
+  return normalized.length > 0 ? normalized : fallback;
+}
+function boundedId(base, suffix = "") {
+  const cap = PROJECT_VERIFIER_CATALOG_CAPS.idBytes - Buffer.byteLength(suffix, "utf8");
+  let result = "";
+  for (const character of base) {
+    if (Buffer.byteLength(result + character, "utf8") > cap) break;
+    result += character;
+  }
+  result = result.replace(/[-.:]+$/u, "");
+  return `${result.length > 0 ? result : "check"}${suffix}`;
+}
+function deterministicVerifierId(preferredId, occupied) {
+  const base = boundedId(slug(preferredId, "check"));
+  if (!occupied.has(base) && base !== "frontend") return base;
+  for (let index = 2; index <= PROJECT_VERIFIER_CATALOG_CAPS.checks + 2; index += 1) {
+    const suffix = `-${index}`;
+    const candidate = boundedId(base, suffix);
+    if (!occupied.has(candidate) && candidate !== "frontend") return candidate;
+  }
+  throw new Error(`cannot allocate a deterministic ID for '${preferredId}' within the catalog cap`);
+}
+function rawProposalSort(left, right) {
+  return compareCodepoints(left.provenance.path, right.provenance.path) || compareCodepoints(left.provenance.detail, right.provenance.detail) || compareCodepoints(left.preferredId, right.preferredId) || compareCodepoints(JSON.stringify(left.command), JSON.stringify(right.command));
+}
+function checkIdentity(check) {
+  return JSON.stringify([check.cwd, check.command]);
+}
+function sourceProvenance(workspaceRoot, check) {
+  if (check.source.kind === "package.json") {
+    return {
+      kind: "package-script",
+      path: relativePath(workspaceRoot, check.source.path),
+      detail: `package.json script '${check.id}'`,
+      authority: "project-declared"
+    };
+  }
+  return {
+    kind: "project-catalog",
+    path: PROJECT_VERIFIER_CATALOG_RELATIVE_PATH,
+    detail: `existing catalog check '${check.id}'`,
+    authority: "project-declared"
+  };
+}
+function projectedCheck(workspaceRoot, check) {
+  return {
+    id: check.id,
+    description: check.description,
+    command: [...check.command],
+    cwd: check.cwd,
+    timeoutMs: check.timeoutMs,
+    tags: [...check.tags],
+    ...kindFields(check),
+    provenance: sourceProvenance(workspaceRoot, check),
+    state: check.source.kind === "package.json" ? "active" : "existing",
+    ...check.source.kind === "package.json" ? {} : { catalogId: check.id }
+  };
+}
+function cargoProposals(workspaceRoot, diagnostics) {
+  const relative = "Cargo.toml";
+  const text = regularFileText(path.join(workspaceRoot, relative), workspaceRoot);
+  if (text === null) return [];
+  if (text instanceof Error) {
+    diagnostics.push(`${relative}: ${text.message}; Cargo discovery skipped.`);
+    return [];
+  }
+  const document = parseTomlDocument(text);
+  if (document === null) {
+    diagnostics.push(`${relative}: invalid TOML; Cargo discovery skipped.`);
+    return [];
+  }
+  const workspace = tomlTableAt(document, ["workspace"]) !== null;
+  const packageManifest = tomlTableAt(document, ["package"]) !== null;
+  if (!workspace && !packageManifest) {
+    diagnostics.push(`${relative}: no [package] or [workspace] declaration was found; Cargo discovery skipped.`);
+    return [];
+  }
+  return [
+    {
+      preferredId: "cargo-test",
+      description: workspace ? "Run the Cargo workspace tests" : "Run the Cargo package tests",
+      command: workspace ? ["cargo", "test", "--workspace"] : ["cargo", "test"],
+      cwd: ".",
+      timeoutMs: SAFE_EXEC_DEFAULT_TIMEOUT_MS,
+      tags: ["rust", "test"],
+      provenance: {
+        kind: "cargo",
+        path: relative,
+        detail: workspace ? "Cargo [workspace] manifest" : "Cargo package manifest",
+        authority: "toolchain-defined"
+      }
+    }
+  ];
+}
+function cmakeProposals(workspaceRoot, diagnostics) {
+  const relative = "CMakePresets.json";
+  const text = regularFileText(path.join(workspaceRoot, relative), workspaceRoot);
+  if (text === null) return [];
+  if (text instanceof Error) {
+    diagnostics.push(`${relative}: ${text.message}; CMake preset discovery skipped.`);
+    return [];
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (error) {
+    diagnostics.push(`${relative}: invalid JSON (${error instanceof Error ? error.message : String(error)}).`);
+    return [];
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    diagnostics.push(`${relative}: root is not an object; CMake preset discovery skipped.`);
+    return [];
+  }
+  const record = parsed;
+  const proposals = [];
+  for (const [field, executable, args, label, tag] of [
+    ["testPresets", "ctest", ["--preset"], "test", "test"],
+    ["buildPresets", "cmake", ["--build", "--preset"], "build", "build"]
+  ]) {
+    const presets = record[field];
+    if (!Array.isArray(presets)) continue;
+    for (const preset of presets) {
+      if (preset === null || typeof preset !== "object" || Array.isArray(preset)) continue;
+      const value = preset;
+      if (value.hidden === true || typeof value.name !== "string" || value.name.length === 0) continue;
+      const name = value.name;
+      proposals.push({
+        preferredId: `cmake-${label}-${slug(name, "preset")}`,
+        description: `Run CMake ${label} preset '${name}'`,
+        command: [executable, ...args, name],
+        cwd: ".",
+        timeoutMs: SAFE_EXEC_DEFAULT_TIMEOUT_MS,
+        tags: ["cmake", tag],
+        provenance: {
+          kind: "cmake-preset",
+          path: relative,
+          detail: `${field} entry '${name}'`,
+          authority: "toolchain-defined"
+        }
+      });
+    }
+  }
+  if (proposals.length === 0) diagnostics.push(`${relative}: no visible buildPresets or testPresets were declared.`);
+  return proposals;
+}
+function pythonProposals(workspaceRoot, diagnostics) {
+  const proposals = [];
+  const pyprojectPath = "pyproject.toml";
+  const pyproject = regularFileText(path.join(workspaceRoot, pyprojectPath), workspaceRoot);
+  if (pyproject instanceof Error) diagnostics.push(`${pyprojectPath}: ${pyproject.message}; Python discovery skipped.`);
+  if (typeof pyproject === "string") {
+    const document = parseTomlDocument(pyproject);
+    if (document === null) {
+      diagnostics.push(`${pyprojectPath}: invalid TOML; Python discovery skipped.`);
+    } else {
+      for (const [path2, section, module, id, description, tags] of [
+        [
+          ["tool", "pytest", "ini_options"],
+          "tool.pytest.ini_options",
+          "pytest",
+          "python-pytest",
+          "Run the declared pytest suite",
+          ["python", "test"]
+        ],
+        [["tool", "tox"], "tool.tox", "tox", "python-tox", "Run the declared tox environments", ["python", "test"]],
+        [["tool", "nox"], "tool.nox", "nox", "python-nox", "Run the declared nox sessions", ["python", "test"]]
+      ]) {
+        if (tomlTableAt(document, path2) === null) continue;
+        proposals.push({
+          preferredId: id,
+          description,
+          command: ["python", "-m", module],
+          cwd: ".",
+          timeoutMs: SAFE_EXEC_DEFAULT_TIMEOUT_MS,
+          tags: [...tags],
+          provenance: {
+            kind: "python-runner",
+            path: pyprojectPath,
+            detail: `[${section}]`,
+            authority: "toolchain-defined"
+          }
+        });
+      }
+      for (const [path2, section] of [
+        [["project", "scripts"], "project.scripts"],
+        [["tool", "poetry", "scripts"], "tool.poetry.scripts"]
+      ]) {
+        const scripts = tomlTableAt(document, path2);
+        if (scripts === null) continue;
+        for (const [name, target] of Object.entries(scripts)) {
+          if (typeof target !== "string" || !isVerificationScriptName(name)) continue;
+          proposals.push({
+            preferredId: `python-${slug(name, "check")}`,
+            description: `Run declared Python entry point '${name}'`,
+            command: [name],
+            cwd: ".",
+            timeoutMs: SAFE_EXEC_DEFAULT_TIMEOUT_MS,
+            tags: [slug(name.split(/[:.-]/u)[0] ?? "python", "python"), "python"],
+            provenance: {
+              kind: "python-runner",
+              path: pyprojectPath,
+              detail: `[${section}] entry '${name}'`,
+              authority: "project-declared"
+            }
+          });
+        }
+      }
+    }
+  }
+  for (const [relative, marker, module, id, description] of [
+    ["pytest.ini", null, "pytest", "python-pytest", "Run the declared pytest suite"],
+    ["tox.ini", null, "tox", "python-tox", "Run the declared tox environments"],
+    ["noxfile.py", null, "nox", "python-nox", "Run the declared nox sessions"],
+    ["setup.cfg", /^\s*\[tool:pytest\]/mu, "pytest", "python-pytest", "Run the declared pytest suite"]
+  ]) {
+    const text = regularFileText(path.join(workspaceRoot, relative), workspaceRoot);
+    if (text === null) continue;
+    if (text instanceof Error) {
+      diagnostics.push(`${relative}: ${text.message}; Python discovery skipped.`);
+      continue;
+    }
+    if (marker !== null && !marker.test(text)) continue;
+    proposals.push({
+      preferredId: id,
+      description,
+      command: ["python", "-m", module],
+      cwd: ".",
+      timeoutMs: SAFE_EXEC_DEFAULT_TIMEOUT_MS,
+      tags: ["python", "test"],
+      provenance: {
+        kind: "python-runner",
+        path: relative,
+        detail: `${module} configuration file`,
+        authority: "toolchain-defined"
+      }
+    });
+  }
+  return proposals;
+}
+function discoverDeclaredProjectCommands(workspaceRoot = process.cwd()) {
+  const commands = [];
+  const add = (id, command, pathValue, detail, kind) => {
+    commands.push({
+      id,
+      command,
+      provenance: { kind, path: pathValue, detail, authority: "project-declared" }
+    });
+  };
+  for (const entry of discoverDeclaredProjectEntriesAtRoot(workspaceRoot)) {
+    add(entry.id, entry.command, entry.path, entry.detail, entry.kind);
+  }
+  const pyprojectText = regularFileText(path.join(workspaceRoot, "pyproject.toml"), workspaceRoot);
+  if (typeof pyprojectText === "string") {
+    const document = parseTomlDocument(pyprojectText);
+    if (document !== null) {
+      for (const [tablePath, label] of [
+        [["project", "scripts"], "project.scripts"],
+        [["tool", "poetry", "scripts"], "tool.poetry.scripts"]
+      ]) {
+        const scripts = tomlTableAt(document, tablePath);
+        if (scripts === null) continue;
+        for (const [name, target] of Object.entries(scripts).sort(([left], [right]) => compareCodepoints(left, right))) {
+          if (typeof target === "string") add(name, [name], "pyproject.toml", `[${label}] entry '${name}'`, "python-runner");
+        }
+      }
+      for (const [tablePath, module, id, label] of [
+        [["tool", "pytest", "ini_options"], "pytest", "pytest", "tool.pytest.ini_options"],
+        [["tool", "tox"], "tox", "tox", "tool.tox"],
+        [["tool", "nox"], "nox", "nox", "tool.nox"]
+      ]) {
+        if (tomlTableAt(document, tablePath) !== null)
+          add(id, ["python", "-m", module], "pyproject.toml", `[${label}]`, "python-runner");
+      }
+    }
+  }
+  const seen = /* @__PURE__ */ new Set();
+  return commands.filter((entry) => {
+    let id = slug(entry.id, "command");
+    let suffix = 2;
+    while (seen.has(id)) id = `${slug(entry.id, "command")}-${suffix++}`;
+    seen.add(id);
+    entry.id = id;
+    return true;
+  });
+}
+function goProposals(workspaceRoot, diagnostics) {
+  const relative = "go.mod";
+  const text = regularFileText(path.join(workspaceRoot, relative), workspaceRoot);
+  if (text === null) return [];
+  if (text instanceof Error) {
+    diagnostics.push(`${relative}: ${text.message}; Go discovery skipped.`);
+    return [];
+  }
+  if (!/^\s*module\s+\S+/mu.test(text)) {
+    diagnostics.push(`${relative}: no module directive was found; Go discovery skipped.`);
+    return [];
+  }
+  return [
+    {
+      preferredId: "go-test",
+      description: "Run all Go module tests",
+      command: ["go", "test", "./..."],
+      cwd: ".",
+      timeoutMs: SAFE_EXEC_DEFAULT_TIMEOUT_MS,
+      tags: ["go", "test"],
+      provenance: {
+        kind: "go-module",
+        path: relative,
+        detail: "Go module directive",
+        authority: "toolchain-defined"
+      }
+    }
+  ];
+}
+function shellLikeArgv(command) {
+  const argv = [];
+  let token = "";
+  let quote = null;
+  let tokenStarted = false;
+  for (let index = 0; index < command.length; index += 1) {
+    const character = command[index] ?? "";
+    if (quote === "single") {
+      if (character === "'") quote = null;
+      else token += character;
+      tokenStarted = true;
+      continue;
+    }
+    if (quote === "double") {
+      if (character === '"') {
+        quote = null;
+        continue;
+      }
+      if (character === "\\") {
+        const next = command[index + 1];
+        if (next === void 0) return new Error("trailing escape");
+        token += next;
+        index += 1;
+      } else if (character === "$" || character === "`") {
+        return new Error(`shell expansion '${character}' is ambiguous`);
+      } else {
+        token += character;
+      }
+      tokenStarted = true;
+      continue;
+    }
+    if (/\s/u.test(character)) {
+      if (tokenStarted) {
+        argv.push(token);
+        token = "";
+        tokenStarted = false;
+      }
+      continue;
+    }
+    if (character === "'") {
+      quote = "single";
+      tokenStarted = true;
+      continue;
+    }
+    if (character === '"') {
+      quote = "double";
+      tokenStarted = true;
+      continue;
+    }
+    if (character === "\\") {
+      const next = command[index + 1];
+      if (next === void 0) return new Error("trailing escape");
+      token += next;
+      tokenStarted = true;
+      index += 1;
+      continue;
+    }
+    if ("|&;<>()`$\n\r".includes(character)) {
+      return new Error(`shell operator or expansion '${character}' is ambiguous`);
+    }
+    token += character;
+    tokenStarted = true;
+  }
+  if (quote !== null) return new Error(`unterminated ${quote}-quoted argument`);
+  if (tokenStarted) argv.push(token);
+  if (argv.length === 0) return new Error("empty command");
+  if ((argv[0] ?? "").includes("=")) return new Error("environment assignments are not argv executables");
+  return argv;
+}
+function validationPreferredId(argv) {
+  const executable = path.basename(argv[0] ?? "check").replace(/\.[^.]+$/u, "");
+  const script = argv.find((entry, index) => index > 0 && /\.(?:py|js|mjs|sh)$/u.test(entry));
+  const subject = script === void 0 ? executable : path.basename(script).replace(/\.[^.]+$/u, "");
+  return `validation-${slug(subject, "check")}`;
+}
+function validationContractProposals(workspaceRoot, diagnostics) {
+  const proposals = [];
+  const loaded = loadValidationContract(workspaceRoot);
+  if (!loaded.ok) {
+    diagnostics.push(`${loaded.path}: ${loaded.reason}; validation command discovery skipped.`);
+  } else if (loaded.contract !== null) {
+    for (const [index, validator] of (loaded.contract.validators ?? []).entries()) {
+      const argv = shellLikeArgv(validator);
+      if (argv instanceof Error) {
+        diagnostics.push(`${loaded.path}: validators[${index}] is ambiguous (${argv.message}); use manual argv entry.`);
+        continue;
+      }
+      proposals.push({
+        preferredId: validationPreferredId(argv),
+        description: `Run validation contract command ${JSON.stringify(argv)}`,
+        command: argv,
+        cwd: ".",
+        timeoutMs: SAFE_EXEC_DEFAULT_TIMEOUT_MS,
+        tags: ["scientific", "validation"],
+        provenance: {
+          kind: "validation-contract",
+          path: loaded.path,
+          detail: `validators[${index}]`,
+          authority: "project-declared"
+        }
+      });
+    }
+  }
+  if (existsSync(path.join(workspaceRoot, VALIDATION_CONTRACT_MARKDOWN_PATH))) {
+    diagnostics.push(
+      `${VALIDATION_CONTRACT_MARKDOWN_PATH} is advisory prose; enter an exact argv vector manually instead of inferring a command.`
+    );
+  }
+  return proposals;
+}
+function numericContractProposals(workspaceRoot, diagnostics) {
+  const loaded = loadValidationContract(workspaceRoot);
+  if (!loaded.ok || loaded.contract === null) return [];
+  const proposals = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const artifact of loaded.contract.artifacts ?? []) {
+    if (artifact.numerical_tolerances === void 0) continue;
+    const tolerance = normalizeNumericTolerance(artifact.numerical_tolerances);
+    if (tolerance instanceof Error) {
+      diagnostics.push(
+        `${loaded.path}: artifact ${JSON.stringify(artifact.path)} numeric proposal skipped: ${tolerance.message}`
+      );
+      continue;
+    }
+    const base = slug(path.basename(artifact.path).replace(/\.[^.]+$/u, ""), "artifact");
+    const preferred = boundedId(`numeric-${base}`);
+    let id = preferred;
+    for (let suffix = 2; seen.has(id); suffix += 1) id = `${boundedId(preferred, `-${suffix}`)}-${suffix}`;
+    seen.add(id);
+    const reference = `${artifact.path}.reference.json`;
+    proposals.push({
+      id,
+      artifactPath: artifact.path,
+      reference,
+      tolerance,
+      addCommand: `clio-coder verifiers add --id ${id} --kind numeric-compare --reference ${JSON.stringify(reference)} --tolerance '${JSON.stringify(tolerance)}' --description ${JSON.stringify(`Compare ${artifact.path} against its reference within tolerance`)} --command '["<executable>","<arg>"]'`
+    });
+  }
+  return proposals;
+}
+function deduplicatedRawProposals(proposals, diagnostics) {
+  const seen = /* @__PURE__ */ new Map();
+  for (const proposal of proposals.sort(rawProposalSort)) {
+    const identity = checkIdentity(proposal);
+    const prior = seen.get(identity);
+    if (prior !== void 0) {
+      diagnostics.push(
+        `${proposal.provenance.path} (${proposal.provenance.detail}) repeats ${prior.provenance.path} (${prior.provenance.detail}); one proposal was kept.`
+      );
+      continue;
+    }
+    seen.set(identity, proposal);
+  }
+  return [...seen.values()];
+}
+function discoverVerifierAuthoring(workspaceRoot = process.cwd()) {
+  const manualEntry = manualEntryInstruction();
+  const productionDiscovery = discoverDeclaredChecksAtRoot(workspaceRoot, void 0);
+  if (!productionDiscovery.ok) {
+    return {
+      ok: false,
+      reason: `Cannot author over the existing verifier authority: ${productionDiscovery.reason}`,
+      manualEntry
+    };
+  }
+  const activeChecks = [];
+  const existingChecks = [];
+  for (const source of productionDiscovery.sources) {
+    for (const check of source.checks) {
+      const projected = projectedCheck(workspaceRoot, check);
+      if (projected.state === "active") activeChecks.push(projected);
+      else existingChecks.push(projected);
+    }
+  }
+  activeChecks.sort((left, right) => compareCodepoints(left.id, right.id));
+  existingChecks.sort((left, right) => compareCodepoints(left.id, right.id));
+  const diagnostics = [];
+  const raw = deduplicatedRawProposals(
+    [
+      ...cargoProposals(workspaceRoot, diagnostics),
+      ...cmakeProposals(workspaceRoot, diagnostics),
+      ...pythonProposals(workspaceRoot, diagnostics),
+      ...goProposals(workspaceRoot, diagnostics),
+      ...validationContractProposals(workspaceRoot, diagnostics)
+    ],
+    diagnostics
+  );
+  const occupied = new Set([...activeChecks, ...existingChecks].map((check) => check.id));
+  const represented = new Map(existingChecks.map((check) => [checkIdentity(check), check.id]));
+  const proposals = [];
+  for (const proposal of raw) {
+    const priorId = represented.get(checkIdentity(proposal));
+    if (priorId !== void 0) {
+      diagnostics.push(
+        `${proposal.provenance.path} (${proposal.provenance.detail}) is already represented by catalog check '${priorId}'.`
+      );
+      continue;
+    }
+    const normalizedId = boundedId(slug(proposal.preferredId, "check"));
+    const id = deterministicVerifierId(proposal.preferredId, occupied);
+    if (normalizedId !== proposal.preferredId) {
+      diagnostics.push(`Proposed ID '${proposal.preferredId}' was normalized to '${normalizedId}'.`);
+    }
+    if (id !== normalizedId) {
+      diagnostics.push(`Proposed ID '${normalizedId}' collides with declared authority; using '${id}'.`);
+    }
+    occupied.add(id);
+    represented.set(checkIdentity(proposal), id);
+    proposals.push({
+      id,
+      description: proposal.description,
+      command: [...proposal.command],
+      cwd: proposal.cwd,
+      timeoutMs: proposal.timeoutMs,
+      tags: [...proposal.tags],
+      provenance: { ...proposal.provenance },
+      state: "proposed"
+    });
+  }
+  proposals.sort((left, right) => compareCodepoints(left.id, right.id));
+  if (activeChecks.length === 0 && existingChecks.length === 0 && proposals.length === 0) {
+    diagnostics.push(
+      "No package verification script, supported toolchain declaration, or exact validation command was found."
+    );
+  }
+  const catalogPath = path.join(workspaceRoot, PROJECT_VERIFIER_CATALOG_RELATIVE_PATH);
+  const catalogText = regularFileText(catalogPath, workspaceRoot);
+  return {
+    ok: true,
+    workspaceRoot,
+    catalogPath,
+    activeChecks,
+    existingChecks,
+    proposals,
+    numericProposals: numericContractProposals(workspaceRoot, diagnostics),
+    diagnostics,
+    manualEntry,
+    ...typeof catalogText === "string" ? { catalogText } : {}
+  };
+}
+function createVerifierDraft(discovery, options = {}) {
+  return {
+    workspaceRoot: discovery.workspaceRoot,
+    catalogPath: discovery.catalogPath,
+    activeChecks: discovery.activeChecks.map(cloneCheck),
+    checks: [...discovery.existingChecks, ...options.includeProposals === false ? [] : discovery.proposals].map(cloneCheck).sort((left, right) => compareCodepoints(left.id, right.id)),
+    numericProposals: options.includeProposals === false ? [] : discovery.numericProposals.map((proposal) => ({ ...proposal })),
+    diagnostics: [...discovery.diagnostics],
+    manualEntry: discovery.manualEntry,
+    ...discovery.catalogText === void 0 ? {} : { catalogText: discovery.catalogText }
+  };
+}
+function catalogEntry(check) {
+  const { id, description, command, cwd, timeoutMs, tags } = check;
+  const entry = { id, description, command: [...command], cwd, timeoutMs, tags: [...tags] };
+  const kind = check.kind ?? "command";
+  if (kind === "command") return entry;
+  entry.kind = kind;
+  if (check.numeric !== void 0) {
+    entry.reference = check.numeric.reference;
+    entry.tolerance = { ...check.numeric.tolerance };
+  }
+  if (check.perf !== void 0) {
+    if (check.perf.budget !== void 0) entry.budget = structuredClone(check.perf.budget);
+    if (check.perf.baseline !== void 0) entry.baseline = check.perf.baseline;
+    if (check.perf.tolerance !== void 0) entry.tolerance = { ...check.perf.tolerance };
+  }
+  return entry;
+}
+function serializeVerifierDraft(draft) {
+  const checks = [...draft.checks].sort((left, right) => compareCodepoints(left.id, right.id));
+  const document = draft.catalogText === void 0 ? null : (0, import_yaml.parseDocument)(draft.catalogText);
+  const sequence = document?.get("checks");
+  if (document === null || !(0, import_yaml.isSeq)(sequence)) {
+    return (0, import_yaml.stringify)({ version: PROJECT_VERIFIER_CATALOG_VERSION, checks: checks.map(catalogEntry) }, { lineWidth: 0 });
+  }
+  const nodes = /* @__PURE__ */ new Map();
+  for (const node of sequence.items) if ((0, import_yaml.isMap)(node)) nodes.set(node.get("id"), node);
+  const kept = /* @__PURE__ */ new Set();
+  const appended = [];
+  let changed = false;
+  for (const check of checks) {
+    const entry = catalogEntry(check);
+    const node = nodes.get(check.catalogId ?? check.id);
+    if (node === void 0) {
+      appended.push(document.createNode(entry));
+      continue;
+    }
+    kept.add(node);
+    const current = node.toJSON();
+    for (const [field, value] of Object.entries(entry)) {
+      if (JSON.stringify(current[field]) === JSON.stringify(value)) continue;
+      node.set(field, value);
+      changed = true;
+    }
+    for (const field of ["kind", "reference", "tolerance", "budget", "baseline"]) {
+      if (Object.hasOwn(current, field) && !Object.hasOwn(entry, field)) {
+        node.delete(field);
+        changed = true;
+      }
+    }
+  }
+  if (!changed && appended.length === 0 && kept.size === sequence.items.length) return draft.catalogText;
+  if (document.get("version") !== PROJECT_VERIFIER_CATALOG_VERSION) {
+    document.set("version", PROJECT_VERIFIER_CATALOG_VERSION);
+  }
+  sequence.items = [...sequence.items.filter((node) => (0, import_yaml.isMap)(node) && kept.has(node)), ...appended];
+  return document.toString({ lineWidth: 0 });
+}
+function validateVerifierDraft(draft) {
+  const text = serializeVerifierDraft(draft);
+  const parsed = parseProjectVerifierCatalogText(text, draft.workspaceRoot, draft.catalogPath);
+  if (!parsed.ok) return { ok: false, reason: parsed.reason, text };
+  const activeId = new Map(draft.activeChecks.map((check) => [check.id, check]));
+  for (const check of parsed.source?.checks ?? []) {
+    const collision = activeId.get(check.id);
+    if (collision !== void 0) {
+      return {
+        ok: false,
+        reason: `duplicate declared check id '${check.id}' from ${collision.provenance.kind} (${collision.provenance.path}) and project-catalog (${PROJECT_VERIFIER_CATALOG_RELATIVE_PATH})`,
+        text
+      };
+    }
+  }
+  const byId = new Map(draft.checks.map((check) => [check.id, check]));
+  const checks = (parsed.source?.checks ?? []).map((check) => {
+    const original = byId.get(check.id);
+    return {
+      id: check.id,
+      description: check.description,
+      command: [...check.command],
+      cwd: check.cwd,
+      timeoutMs: check.timeoutMs,
+      tags: [...check.tags],
+      ...kindFields(check),
+      provenance: original?.provenance ?? {
+        kind: "manual-entry",
+        path: PROJECT_VERIFIER_CATALOG_RELATIVE_PATH,
+        detail: `manual check '${check.id}'`,
+        authority: "project-declared"
+      },
+      state: original?.state ?? "manual",
+      ...original?.catalogId === void 0 ? {} : { catalogId: original.catalogId }
+    };
+  });
+  return { ok: true, text, checks };
+}
+function cloneDraft(draft) {
+  return {
+    ...draft,
+    activeChecks: draft.activeChecks.map(cloneCheck),
+    checks: draft.checks.map(cloneCheck),
+    numericProposals: draft.numericProposals.map((proposal) => ({ ...proposal })),
+    diagnostics: [...draft.diagnostics]
+  };
+}
+function reviseVerifierDraft(draft, revisions) {
+  const next = cloneDraft(draft);
+  const diagnostics = [];
+  for (const revision of revisions) {
+    if (revision.kind === "add") {
+      if (next.checks.some((check2) => check2.id === revision.check.id)) {
+        return { ok: false, draft, reason: `Cannot add '${revision.check.id}': that ID already exists.` };
+      }
+      if (next.activeChecks.some((check2) => check2.id === revision.check.id)) {
+        return { ok: false, draft, reason: `Cannot add '${revision.check.id}': it collides with an active package check.` };
+      }
+      next.checks.push({
+        ...revision.check,
+        command: [...revision.check.command],
+        tags: [...revision.check.tags],
+        provenance: revision.provenance ?? {
+          kind: "manual-entry",
+          path: PROJECT_VERIFIER_CATALOG_RELATIVE_PATH,
+          detail: `manual check '${revision.check.id}'`,
+          authority: "project-declared"
+        },
+        state: "manual"
+      });
+      diagnostics.push(`Added check '${revision.check.id}'.`);
+      continue;
+    }
+    const index = next.checks.findIndex((check2) => check2.id === revision.id);
+    if (index === -1) return { ok: false, draft, reason: `Check '${revision.id}' does not exist.` };
+    const check = next.checks[index];
+    if (check === void 0) return { ok: false, draft, reason: `Check '${revision.id}' does not exist.` };
+    if (revision.kind === "remove") {
+      next.checks.splice(index, 1);
+      diagnostics.push(`Removed check '${revision.id}'; its command is no longer executable through the catalog.`);
+      continue;
+    }
+    if (revision.kind === "rename") {
+      if (next.checks.some((candidate, candidateIndex) => candidateIndex !== index && candidate.id === revision.newId)) {
+        return {
+          ok: false,
+          draft,
+          reason: `Cannot rename '${revision.id}' to '${revision.newId}': that ID already exists.`
+        };
+      }
+      if (next.activeChecks.some((candidate) => candidate.id === revision.newId)) {
+        return {
+          ok: false,
+          draft,
+          reason: `Cannot rename '${revision.id}' to '${revision.newId}': it collides with an active package check.`
+        };
+      }
+      check.id = revision.newId;
+      diagnostics.push(`Renamed check '${revision.id}' to '${revision.newId}'.`);
+      continue;
+    }
+    if (revision.changes.description !== void 0) check.description = revision.changes.description;
+    if (revision.changes.command !== void 0) check.command = [...revision.changes.command];
+    if (revision.changes.cwd !== void 0) check.cwd = revision.changes.cwd;
+    if (revision.changes.timeoutMs !== void 0) check.timeoutMs = revision.changes.timeoutMs;
+    if (revision.changes.tags !== void 0) check.tags = [...revision.changes.tags];
+    if (revision.changes.kind !== void 0) {
+      const next2 = kindFields({
+        kind: revision.changes.kind,
+        ...revision.changes.numeric !== void 0 ? { numeric: revision.changes.numeric } : {},
+        ...revision.changes.perf !== void 0 ? { perf: revision.changes.perf } : {}
+      });
+      delete check.kind;
+      delete check.numeric;
+      delete check.perf;
+      Object.assign(check, next2);
+    }
+    diagnostics.push(`Edited check '${revision.id}' without changing its deterministic ID.`);
+  }
+  next.checks.sort((left, right) => compareCodepoints(left.id, right.id));
+  const validation = validateVerifierDraft(next);
+  if (!validation.ok) return { ok: false, draft, reason: validation.reason };
+  next.checks = validation.checks;
+  next.diagnostics.push(...diagnostics);
+  return { ok: true, draft: next, diagnostics };
+}
+function authorityDescription(check) {
+  if (check.state === "active") {
+    return "active package-script authority; verify runs npm with the declared script name and may accept explicit extra argv";
+  }
+  return `exact catalog authority after confirmation; verify fixes argv, cwd, and timeout through safe-exec (proposal origin: ${check.provenance.authority})`;
+}
+function renderCheck(check, destinationPath) {
+  return [
+    `- ${check.id}`,
+    `  path: ${check.state === "active" ? check.provenance.path : destinationPath}`,
+    `  source: ${check.provenance.path} (${check.provenance.detail}; ${check.provenance.authority})`,
+    `  argv: ${JSON.stringify(check.command)}`,
+    `  cwd: ${check.cwd}`,
+    `  timeoutMs: ${check.timeoutMs}`,
+    `  tags: ${JSON.stringify(check.tags)}`,
+    ...renderKind(check),
+    `  effective execution authority: ${authorityDescription(check)}`
+  ];
+}
+function renderKind(check) {
+  const kind = check.kind ?? "command";
+  if (kind === "command") return [];
+  const lines = [`  kind: ${kind}`];
+  if (check.numeric !== void 0) {
+    lines.push(`  reference: ${check.numeric.reference}`, `  tolerance: ${JSON.stringify(check.numeric.tolerance)}`);
+  }
+  if (check.perf !== void 0) {
+    if (check.perf.budget !== void 0) lines.push(`  budget: ${JSON.stringify(check.perf.budget)}`);
+    if (check.perf.baseline !== void 0) lines.push(`  baseline: ${check.perf.baseline}`);
+    if (check.perf.tolerance !== void 0) lines.push(`  tolerance: ${JSON.stringify(check.perf.tolerance)}`);
+  }
+  return lines;
+}
+function previewVerifierDraft(draft, options = {}) {
+  const validation = validateVerifierDraft(draft);
+  const lines = [
+    "Project verifier authority preview",
+    `Catalog path: ${draft.catalogPath}`,
+    `Schema validation: ${validation.ok ? "accepted by the production catalog parser" : `rejected (${validation.reason})`}`
+  ];
+  if (draft.activeChecks.length > 0) {
+    lines.push("", "Already executable package checks (not duplicated into the catalog):");
+    for (const check of draft.activeChecks) lines.push(...renderCheck(check, draft.catalogPath));
+  }
+  lines.push("", "Catalog checks after confirmation:");
+  if (draft.checks.length === 0) lines.push("(none)");
+  else for (const check of draft.checks) lines.push(...renderCheck(check, draft.catalogPath));
+  if (draft.numericProposals.length > 0) {
+    lines.push("", "Numeric-compare checks the validation contract implies (command required before they can be added):");
+    for (const proposal of draft.numericProposals) {
+      lines.push(
+        `- ${proposal.id}`,
+        `  artifact: ${proposal.artifactPath}`,
+        `  reference: ${proposal.reference}`,
+        `  tolerance: ${JSON.stringify(proposal.tolerance)}`,
+        `  add with: ${proposal.addCommand}`
+      );
+    }
+  }
+  if (draft.diagnostics.length > 0) {
+    lines.push("", "Diagnostics:");
+    for (const diagnostic of draft.diagnostics) lines.push(`- ${diagnostic}`);
+  }
+  if (draft.checks.length === 0) {
+    lines.push(
+      "",
+      draft.activeChecks.length === 0 ? draft.manualEntry : "No catalog checks are proposed; the package checks above are already executable without a catalog entry."
+    );
+  }
+  if (options.confirmed !== true) {
+    lines.push("", "Preview only: no file has been written and no check has been executed.");
+  }
+  return lines.join("\n");
+}
+function writeValidatedDraft(draft, validation) {
+  const directory = path.dirname(draft.catalogPath);
+  mkdirSync(directory, { recursive: true });
+  const realRoot = realpathSync(draft.workspaceRoot);
+  const realDirectory = realpathSync(directory);
+  resolveSafeCwd(realDirectory, realRoot);
+  const realCatalogPath = path.join(realDirectory, path.basename(draft.catalogPath));
+  const temporaryPath = path.join(
+    realDirectory,
+    `.${path.basename(draft.catalogPath)}.${process.pid}.${randomUUID()}.tmp`
+  );
+  try {
+    writeFileSync(temporaryPath, validation.text, { encoding: "utf8", flag: "wx", mode: 420 });
+    renameSync(temporaryPath, realCatalogPath);
+  } catch (error) {
+    rmSync(temporaryPath, { force: true });
+    throw error;
+  }
+}
+async function runVerifierAuthoringWorkflow(options) {
+  const workspaceRoot = options.workspaceRoot ?? process.cwd();
+  const discovery = discoverVerifierAuthoring(workspaceRoot);
+  if (!discovery.ok) return { status: "invalid", reason: discovery.reason, wrote: false };
+  let draft = createVerifierDraft(
+    discovery,
+    options.includeProposals === void 0 ? {} : { includeProposals: options.includeProposals }
+  );
+  if (options.initialRevisions !== void 0 && options.initialRevisions.length > 0) {
+    const revised = reviseVerifierDraft(draft, options.initialRevisions);
+    if (!revised.ok) return { status: "invalid", reason: revised.reason, wrote: false };
+    draft = revised.draft;
+  }
+  for (let revision = 0; revision <= PROJECT_VERIFIER_CATALOG_CAPS.checks; revision += 1) {
+    const validation = validateVerifierDraft(draft);
+    const preview = previewVerifierDraft(draft, { confirmed: options.confirmed === true });
+    const decision = await options.decide({ draft: cloneDraft(draft), preview, validation, revision });
+    if (decision.kind === "reject") {
+      return { status: "rejected", wrote: false, preview, diagnostics: [...draft.diagnostics] };
+    }
+    if (decision.kind === "revise") {
+      const revised = reviseVerifierDraft(draft, decision.revisions);
+      if (!revised.ok) {
+        draft.diagnostics.push(`Revision rejected: ${revised.reason}`);
+        continue;
+      }
+      draft = revised.draft;
+      continue;
+    }
+    if (!validation.ok) return { status: "invalid", reason: validation.reason, wrote: false, preview };
+    const authorizedPreview = previewVerifierDraft(draft, { confirmed: true });
+    try {
+      writeValidatedDraft(draft, validation);
+    } catch (error) {
+      return {
+        status: "invalid",
+        reason: `Could not write ${draft.catalogPath}: ${error instanceof Error ? error.message : String(error)}`,
+        wrote: false,
+        preview: authorizedPreview
+      };
+    }
+    const loaded = discoverDeclaredChecksAtRoot(workspaceRoot, void 0);
+    if (!loaded.ok) {
+      return {
+        status: "invalid",
+        reason: `Catalog was written but production discovery rejected it: ${loaded.reason}`,
+        wrote: true,
+        path: draft.catalogPath,
+        preview: authorizedPreview
+      };
+    }
+    const dryRuns = [];
+    const runCheck = options.runCheck ?? ((id) => verifyTool.run({ check: id }));
+    for (const id of decision.dryRunCheckIds ?? []) {
+      dryRuns.push({ id, result: await runCheck(id) });
+    }
+    return {
+      status: "written",
+      wrote: true,
+      path: draft.catalogPath,
+      preview: authorizedPreview,
+      diagnostics: [...draft.diagnostics],
+      dryRuns
+    };
+  }
+  return {
+    status: "invalid",
+    reason: `Revision limit of ${PROJECT_VERIFIER_CATALOG_CAPS.checks} exceeded without an operator decision.`,
+    wrote: false
+  };
+}
+
+export {
+  discoverDeclaredProjectCommands,
+  discoverVerifierAuthoring,
+  createVerifierDraft,
+  previewVerifierDraft,
+  runVerifierAuthoringWorkflow
+};
+//# sourceMappingURL=chunk-6RJMYYIE.js.map