@iowarp/clio-coder 0.4.9 → 0.5.0

package/dist/chunk-IALZJE37.js

@@ -1,1710 +0,0 @@
-import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
-import {
-  ROUTE_POLICY_VERSION,
-  isRouteDecisionAgentSelection,
-  isRoutingIntent,
-  parseWorkerContextProvenance
-} from "./chunk-MO65K5CH.js";
-import {
-  isExecutionRole
-} from "./chunk-H6IUCY6Q.js";
-import {
-  readSettings
-} from "./chunk-FPS4R2RN.js";
-import {
-  require_dist
-} from "./chunk-B5GGDIHT.js";
-import {
-  readClioVersion,
-  resolvePackageRoot
-} from "./chunk-E3LEPLQ2.js";
-import {
-  __toESM,
-  init_esm_shims
-} from "./chunk-ECBHH7LU.js";
-
-// src/domains/context/codewiki/digest.ts
-init_esm_shims();
-function compareStrings(a, b) {
-  return a.localeCompare(b);
-}
-function topTwoSegments(path2) {
-  const parts = path2.split("/").slice(0, -1);
-  if (parts.length === 0) return ".";
-  return parts.slice(0, 2).join("/");
-}
-function sourceFiles(codewiki) {
-  return codewiki.files.filter((file) => file.lang !== "config").sort((a, b) => a.path.localeCompare(b.path));
-}
-function countBy(items) {
-  const counts = /* @__PURE__ */ new Map();
-  for (const item of items) counts.set(item, (counts.get(item) ?? 0) + 1);
-  return [...counts.entries()].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]));
-}
-function entryPoints(codewiki, limit) {
-  const files = sourceFiles(codewiki);
-  const tagged = files.filter((file) => file.role === "entry");
-  if (tagged.length >= limit) return tagged.slice(0, limit);
-  const fileById = new Map(files.map((file) => [file.id, file]));
-  const inDegree = /* @__PURE__ */ new Map();
-  for (const edge of codewiki.edges) {
-    if ("toFileId" in edge) inDegree.set(edge.toFileId, (inDegree.get(edge.toFileId) ?? 0) + 1);
-  }
-  const taggedIds = new Set(tagged.map((file) => file.id));
-  const ranked = [...inDegree.entries()].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0])).map(([id]) => fileById.get(id)).filter((file) => file !== void 0 && !taggedIds.has(file.id));
-  return [...tagged, ...ranked].slice(0, limit);
-}
-function keySymbols(codewiki, limit) {
-  const rank = /* @__PURE__ */ new Map([
-    ["class", 0],
-    ["trait", 1],
-    ["iface", 2],
-    ["type", 3],
-    ["func", 4],
-    ["method", 5],
-    ["const", 6],
-    ["var", 7]
-  ]);
-  return [...codewiki.symbols].sort((a, b) => {
-    const rankCmp = (rank.get(a.kind) ?? 99) - (rank.get(b.kind) ?? 99);
-    return rankCmp || a.name.localeCompare(b.name) || a.fileId.localeCompare(b.fileId) || a.line - b.line;
-  }).slice(0, limit);
-}
-function dependencyLines(codewiki, limit) {
-  const fileById = new Map(codewiki.files.map((file) => [file.id, file]));
-  const byFile = /* @__PURE__ */ new Map();
-  for (const edge of codewiki.edges) {
-    const deps = byFile.get(edge.fileId) ?? { internal: [], external: [] };
-    if ("toFileId" in edge) {
-      const target = fileById.get(edge.toFileId);
-      if (target) deps.internal.push(target.path);
-    } else {
-      deps.external.push(edge.externalModule);
-    }
-    byFile.set(edge.fileId, deps);
-  }
-  return [...byFile.entries()].map(([fileId, deps]) => {
-    const file = fileById.get(fileId);
-    if (!file) return "";
-    const internal = [...new Set(deps.internal)].sort(compareStrings).slice(0, 4);
-    const external = [...new Set(deps.external)].sort(compareStrings).slice(0, 4);
-    return `- ${file.path}: internal=[${internal.join(", ")}] external=[${external.join(", ")}]`;
-  }).filter((line) => line.length > 0).sort(compareStrings).slice(0, limit);
-}
-function fitLines(lines, tokenBudget) {
-  const maxChars = Math.max(256, Math.floor(tokenBudget * 4));
-  const out = [];
-  let used = 0;
-  for (const line of lines) {
-    const next = used + line.length + 1;
-    if (next > maxChars) {
-      out.push("[digest truncated]");
-      break;
-    }
-    out.push(line);
-    used = next;
-  }
-  return out.join("\n");
-}
-function entryPointLine(file) {
-  const base = `- ${file.path} (${file.lang}, ${file.loc} loc)`;
-  return file.summary ? `${base}: ${file.summary.slice(0, 160)}` : base;
-}
-function renderCodewikiDigest(codewiki, tokenBudget = 1200) {
-  const files = sourceFiles(codewiki);
-  const areaCounts = countBy(files.map((file) => topTwoSegments(file.path))).slice(0, 10).map(([area, count]) => `${area}=${count}`);
-  const languageCounts = countBy(files.map((file) => file.lang)).map(([language, count]) => `${language}=${count}`).join(", ");
-  const roleCounts = countBy(files.map((file) => file.role)).map(([role, count]) => `${role}=${count}`).join(", ");
-  const fileById = new Map(codewiki.files.map((file) => [file.id, file]));
-  const lines = [
-    `codewiki v${codewiki.version} language=${codewiki.language} files=${files.length} configs=${codewiki.files.length - files.length} symbols=${codewiki.symbols.length} edges=${codewiki.edges.length}`,
-    `languages: ${languageCounts || "none"}`,
-    `roles: ${roleCounts || "none"}`,
-    `areas: ${areaCounts.join(", ") || "none"}`,
-    "entry points:",
-    ...entryPoints(codewiki, 12).map(entryPointLine),
-    "key symbols:",
-    ...keySymbols(codewiki, 40).map((symbol) => {
-      const file = fileById.get(symbol.fileId);
-      const location = file ? `${file.path}:${symbol.line}` : `${symbol.fileId}:${symbol.line}`;
-      return `- ${symbol.name} ${symbol.kind} ${location}`;
-    }),
-    "dependencies:",
-    ...dependencyLines(codewiki, 24)
-  ];
-  return fitLines(lines, tokenBudget);
-}
-
-// src/domains/prompts/hash.ts
-init_esm_shims();
-import { createHash } from "node:crypto";
-function sha256(input) {
-  return createHash("sha256").update(input, "utf8").digest("hex");
-}
-function canonicalJson(value) {
-  return serialize(value);
-}
-function serialize(value) {
-  if (value === null) return "null";
-  if (typeof value === "number") {
-    if (!Number.isFinite(value)) {
-      throw new Error(`canonicalJson: non-finite number ${String(value)} is not representable`);
-    }
-    return JSON.stringify(value);
-  }
-  if (typeof value === "string" || typeof value === "boolean") {
-    return JSON.stringify(value);
-  }
-  if (typeof value === "bigint") {
-    throw new Error("canonicalJson: bigint is not representable");
-  }
-  if (typeof value === "symbol" || typeof value === "function") {
-    throw new Error(`canonicalJson: ${typeof value} is not representable`);
-  }
-  if (value === void 0) {
-    throw new Error("canonicalJson: undefined is not representable at root");
-  }
-  if (Array.isArray(value)) {
-    const parts = [];
-    for (let i = 0; i < value.length; i++) {
-      if (!(i in value) || value[i] === void 0) {
-        parts.push("null");
-        continue;
-      }
-      parts.push(serialize(value[i]));
-    }
-    return `[${parts.join(",")}]`;
-  }
-  if (typeof value === "object") {
-    const obj = value;
-    const keys = Object.keys(obj).sort();
-    const parts = [];
-    for (const key of keys) {
-      const child = obj[key];
-      if (child === void 0) continue;
-      parts.push(`${JSON.stringify(key)}:${serialize(child)}`);
-    }
-    return `{${parts.join(",")}}`;
-  }
-  throw new Error(`canonicalJson: unsupported value of type ${typeof value}`);
-}
-
-// src/domains/dispatch/receipt-integrity.ts
-init_esm_shims();
-import { createHash as createHash2 } from "node:crypto";
-var RUN_RECEIPT_INTEGRITY_VERSION = 20;
-var RUN_RECEIPT_INTEGRITY_ALGORITHM = "sha256";
-function sha2562(input) {
-  return createHash2("sha256").update(input, "utf8").digest("hex");
-}
-function canonicalJson2(value) {
-  return serializeCanonical(value);
-}
-function serializeCanonical(value) {
-  if (value === null) return "null";
-  if (typeof value === "number") {
-    if (!Number.isFinite(value)) {
-      throw new Error(`receipt integrity: non-finite number ${String(value)} is not representable`);
-    }
-    return JSON.stringify(value);
-  }
-  if (typeof value === "string" || typeof value === "boolean") return JSON.stringify(value);
-  if (typeof value === "bigint") throw new Error("receipt integrity: bigint is not representable");
-  if (typeof value === "symbol" || typeof value === "function") {
-    throw new Error(`receipt integrity: ${typeof value} is not representable`);
-  }
-  if (value === void 0) throw new Error("receipt integrity: undefined is not representable at root");
-  if (Array.isArray(value)) {
-    const parts = [];
-    for (let i = 0; i < value.length; i++) {
-      if (!(i in value) || value[i] === void 0) {
-        parts.push("null");
-        continue;
-      }
-      parts.push(serializeCanonical(value[i]));
-    }
-    return `[${parts.join(",")}]`;
-  }
-  if (typeof value === "object") {
-    const obj = value;
-    const keys = Object.keys(obj).sort();
-    const parts = [];
-    for (const key of keys) {
-      const child = obj[key];
-      if (child === void 0) continue;
-      parts.push(`${JSON.stringify(key)}:${serializeCanonical(child)}`);
-    }
-    return `{${parts.join(",")}}`;
-  }
-  throw new Error(`receipt integrity: unsupported value of type ${typeof value}`);
-}
-var RECEIPT_INTEGRITY_FIELD_COVERAGE = {
-  runId: true,
-  agentId: true,
-  executionRole: true,
-  agentAudience: true,
-  requestOrigin: true,
-  task: true,
-  intent: true,
-  pathScope: true,
-  // Historical receipts omit this field, so their receipt and ledger payloads remain unchanged.
-  budget: true,
-  targetId: true,
-  wireModelId: true,
-  runtimeId: true,
-  runtimeKind: true,
-  startedAt: true,
-  endedAt: true,
-  outcome: true,
-  outcomeDetail: true,
-  lineage: true,
-  identity: true,
-  node: true,
-  attestation: true,
-  reroutes: true,
-  pipeline: true,
-  gate: true,
-  council: true,
-  plan: true,
-  fleetGate: true,
-  personaOverride: true,
-  // Absent unless the parent board held decisions, so older receipts and
-  // decision-free runs digest exactly as before.
-  decisionRefs: true,
-  projectContext: true,
-  // Always set on receipts written after #104 landed; absent only on older
-  // receipts, which omit these fields from canonical serialization.
-  rulesApplied: true,
-  operatorProfileApplied: true,
-  exitCode: true,
-  failureMessage: true,
-  tokenCount: true,
-  inputTokenCount: true,
-  outputTokenCount: true,
-  cacheReadTokenCount: true,
-  cacheWriteTokenCount: true,
-  cacheWrite1hTokenCount: true,
-  reasoningTokenCount: true,
-  upstreamResponses: true,
-  output: true,
-  costUsd: true,
-  costProvenance: true,
-  compiledPromptHash: true,
-  staticCompositionHash: true,
-  staticShellHash: true,
-  sessionShellHash: true,
-  dynamicHash: true,
-  promptSignature: true,
-  toolSignature: true,
-  clioCoderVersion: true,
-  piMonoVersion: true,
-  platform: true,
-  nodeVersion: true,
-  toolCalls: true,
-  toolStats: true,
-  toolActivity: true,
-  verification: true,
-  hostVerification: true,
-  worktree: true,
-  routingIntent: true,
-  quality: true,
-  skillActivations: true,
-  autonomyEnforcement: true,
-  safety: true,
-  reproducibility: true,
-  runtimeResolution: true,
-  delegation: true,
-  findingsSummary: true,
-  // Both are optional and absent unless the run produced the condition they
-  // name, so a receipt that carries neither digests exactly as it did before
-  // they existed and the integrity version stays where it is.
-  validationGrounding: true,
-  capabilityMismatch: true,
-  // Same reasoning: absent unless the run had an agent ledger, so a receipt
-  // without one omits the field from canonical serialization.
-  ledgerContribution: true,
-  sessionId: true,
-  briefing: true,
-  workerContext: true,
-  outcomeCode: true,
-  steering: true,
-  routeDecision: true
-};
-var RECEIPT_FIELDS = Object.keys(RECEIPT_INTEGRITY_FIELD_COVERAGE);
-function selectedReceiptFields(receipt, fields) {
-  const source = receipt;
-  const result = {};
-  for (const field of fields) {
-    const value = source[field];
-    if (value !== void 0) result[field] = value;
-  }
-  return result;
-}
-function receiptDigestFields(receipt, legacyNaming = false) {
-  const result = selectedReceiptFields(receipt, RECEIPT_FIELDS);
-  if (legacyNaming) {
-    const source = receipt;
-    const version = source.clioVersion ?? source.clioCoderVersion;
-    delete result.clioCoderVersion;
-    if (version !== void 0) result.clioVersion = version;
-  }
-  result.briefing = receipt.briefing ?? null;
-  result.outcomeCode = receipt.outcomeCode ?? null;
-  result.steering = receipt.steering ?? null;
-  return result;
-}
-function ledgerDigestFields(envelope) {
-  return {
-    id: envelope.id,
-    agentId: envelope.agentId,
-    executionRole: envelope.executionRole,
-    task: envelope.task,
-    ...envelope.budget !== void 0 ? { budget: envelope.budget } : {},
-    ...envelope.decisionRefs !== void 0 ? { decisionRefs: envelope.decisionRefs } : {},
-    targetId: envelope.targetId,
-    wireModelId: envelope.wireModelId,
-    runtimeId: envelope.runtimeId,
-    runtimeKind: envelope.runtimeKind,
-    startedAt: envelope.startedAt,
-    endedAt: envelope.endedAt,
-    status: envelope.status,
-    exitCode: envelope.exitCode,
-    sessionId: envelope.sessionId,
-    cwd: envelope.cwd,
-    tokenCount: envelope.tokenCount,
-    cacheReadTokenCount: envelope.cacheReadTokenCount,
-    cacheWriteTokenCount: envelope.cacheWriteTokenCount,
-    cacheWrite1hTokenCount: envelope.cacheWrite1hTokenCount,
-    reasoningTokenCount: envelope.reasoningTokenCount,
-    staticShellHash: envelope.staticShellHash,
-    sessionShellHash: envelope.sessionShellHash,
-    dynamicHash: envelope.dynamicHash,
-    costUsd: envelope.costUsd,
-    agentAudience: envelope.agentAudience ?? null,
-    requestOrigin: envelope.requestOrigin ?? null,
-    outcome: envelope.outcome ?? null,
-    outcomeDetail: envelope.outcomeDetail ?? null,
-    lineage: envelope.lineage ?? null,
-    identity: envelope.identity ?? null,
-    node: envelope.node ?? null,
-    reroutes: envelope.reroutes ?? null,
-    pipeline: envelope.pipeline ?? null,
-    gate: envelope.gate ?? null,
-    plan: envelope.plan ?? null,
-    personaOverride: envelope.personaOverride ?? null,
-    inputTokenCount: envelope.inputTokenCount ?? 0,
-    outputTokenCount: envelope.outputTokenCount ?? 0,
-    promptSignature: envelope.promptSignature ?? null,
-    toolSignature: envelope.toolSignature ?? null,
-    briefing: envelope.briefing ?? null,
-    ...envelope.workerContext !== void 0 ? { workerContext: envelope.workerContext } : {},
-    outcomeCode: envelope.outcomeCode ?? null,
-    steering: envelope.steering ?? null
-  };
-}
-function integrityPayload(receipt, envelope, legacyNaming = false) {
-  return {
-    contract: legacyNaming ? "clio.runReceipt.integrity" : "clio-coder.runReceipt.integrity",
-    version: RUN_RECEIPT_INTEGRITY_VERSION,
-    sources: ["receipt", "run-ledger"],
-    receipt: receiptDigestFields(receipt, legacyNaming),
-    ledger: ledgerDigestFields(envelope)
-  };
-}
-function computeReceiptIntegrity(receipt, envelope, legacyNaming = false) {
-  return {
-    version: RUN_RECEIPT_INTEGRITY_VERSION,
-    algorithm: RUN_RECEIPT_INTEGRITY_ALGORITHM,
-    digest: sha2562(canonicalJson2(integrityPayload(receipt, envelope, legacyNaming)))
-  };
-}
-function isReceiptQuality(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
-  const quality = value;
-  if (quality.version !== 1 || !Array.isArray(quality.typedValidations)) return false;
-  if (!quality.typedValidations.every(
-    (fact) => fact !== null && typeof fact === "object" && typeof fact.sourceId === "string" && typeof fact.validatorDigest === "string" && /^[0-9a-f]{64}$/.test(String(fact.validatorDigest)) && typeof fact.passed === "boolean"
-  ))
-    return false;
-  const schema = quality.responseSchema;
-  if (!schema || typeof schema !== "object" || Array.isArray(schema)) return false;
-  const responseSchema = schema;
-  const resultContract = quality.resultContract;
-  const validResultContract = resultContract === null || resultContract !== void 0 && typeof resultContract === "object" && !Array.isArray(resultContract) && typeof resultContract.sourceId === "string" && typeof resultContract.validatorDigest === "string" && /^[0-9a-f]{64}$/.test(String(resultContract.validatorDigest)) && (resultContract.conformance === "pass" || resultContract.conformance === "fail" || resultContract.conformance === "not-reached") && (resultContract.quality === "pass" || resultContract.quality === "fail" || resultContract.quality === "unmeasured");
-  return (responseSchema.sourceId === null || typeof responseSchema.sourceId === "string") && (responseSchema.schemaDigest === null || typeof responseSchema.schemaDigest === "string" && /^[0-9a-f]{64}$/.test(responseSchema.schemaDigest)) && typeof responseSchema.runtimeEnforceable === "boolean" && (responseSchema.enforcementPassed === null || typeof responseSchema.enforcementPassed === "boolean") && validResultContract;
-}
-function isCurrentRouteDecision(value) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
-  const decision = value;
-  return decision.policyVersion === ROUTE_POLICY_VERSION && (decision.mode === "fixed" || decision.mode === "shadow" || decision.mode === "active") && isRouteDecisionAgentSelection(decision.agentSelection) && typeof decision.decisionHash === "string" && /^[0-9a-f]{64}$/u.test(decision.decisionHash);
-}
-function withReceiptIntegrity(receipt, envelope) {
-  if (!isReceiptQuality(receipt.quality)) throw new Error("receipt integrity: required quality block invalid");
-  if (!isExecutionRole(receipt.executionRole)) throw new Error("receipt integrity: required execution role invalid");
-  if (!isRoutingIntent(receipt.routingIntent)) {
-    throw new Error("receipt integrity: required routing intent invalid");
-  }
-  if (receipt.routeDecision !== void 0 && !isCurrentRouteDecision(receipt.routeDecision)) {
-    throw new Error("receipt integrity: route decision is invalid or retired");
-  }
-  return {
-    ...receipt,
-    routingIntent: receipt.routingIntent,
-    integrity: computeReceiptIntegrity(receipt, envelope)
-  };
-}
-function isReceiptIntegrity(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
-  const candidate = value;
-  return candidate.version === RUN_RECEIPT_INTEGRITY_VERSION && candidate.algorithm === RUN_RECEIPT_INTEGRITY_ALGORITHM && typeof candidate.digest === "string" && /^[0-9a-f]{64}$/.test(candidate.digest);
-}
-function firstLedgerMismatch(receipt, envelope) {
-  const sharedFields = [
-    ["runId", receipt.runId, envelope.id],
-    ["agentId", receipt.agentId, envelope.agentId],
-    ["executionRole", receipt.executionRole, envelope.executionRole],
-    ["agentAudience", receipt.agentAudience, envelope.agentAudience],
-    ["requestOrigin", receipt.requestOrigin, envelope.requestOrigin],
-    ["task", receipt.task, envelope.task],
-    ["targetId", receipt.targetId, envelope.targetId],
-    ["wireModelId", receipt.wireModelId, envelope.wireModelId],
-    ["runtimeId", receipt.runtimeId, envelope.runtimeId],
-    ["runtimeKind", receipt.runtimeKind, envelope.runtimeKind],
-    ["startedAt", receipt.startedAt, envelope.startedAt],
-    ["endedAt", receipt.endedAt, envelope.endedAt],
-    ["exitCode", receipt.exitCode, envelope.exitCode],
-    ["tokenCount", receipt.tokenCount, envelope.tokenCount],
-    ["cacheReadTokenCount", receipt.cacheReadTokenCount ?? 0, envelope.cacheReadTokenCount ?? 0],
-    ["cacheWriteTokenCount", receipt.cacheWriteTokenCount ?? 0, envelope.cacheWriteTokenCount ?? 0],
-    ["cacheWrite1hTokenCount", receipt.cacheWrite1hTokenCount ?? 0, envelope.cacheWrite1hTokenCount ?? 0],
-    ["reasoningTokenCount", receipt.reasoningTokenCount ?? 0, envelope.reasoningTokenCount ?? 0],
-    ["staticShellHash", receipt.staticShellHash ?? null, envelope.staticShellHash ?? null],
-    ["sessionShellHash", receipt.sessionShellHash ?? null, envelope.sessionShellHash ?? null],
-    ["dynamicHash", receipt.dynamicHash ?? null, envelope.dynamicHash ?? null],
-    ["costUsd", receipt.costUsd, envelope.costUsd],
-    ["sessionId", receipt.sessionId, envelope.sessionId],
-    ["outcome", receipt.outcome ?? null, envelope.outcome ?? null],
-    ["outcomeDetail", receipt.outcomeDetail ?? null, envelope.outcomeDetail ?? null],
-    ["nodeId", receipt.node?.id ?? null, envelope.node?.id ?? null],
-    ["outcomeCode", receipt.outcomeCode ?? null, envelope.outcomeCode ?? null]
-  ];
-  for (const [field, receiptValue, ledgerValue] of sharedFields) {
-    if (!Object.is(receiptValue, ledgerValue)) return field;
-  }
-  if (canonicalJson2(receipt.briefing ?? null) !== canonicalJson2(envelope.briefing ?? null)) return "briefing";
-  if (canonicalJson2(receipt.workerContext ?? null) !== canonicalJson2(envelope.workerContext ?? null))
-    return "workerContext";
-  if (canonicalJson2(receipt.budget ?? null) !== canonicalJson2(envelope.budget ?? null)) return "budget";
-  if (canonicalJson2(receipt.steering ?? null) !== canonicalJson2(envelope.steering ?? null)) return "steering";
-  return null;
-}
-function verifyReceiptIntegrity(receipt, envelope) {
-  if (!isReceiptQuality(receipt.quality) || !isReceiptIntegrity(receipt.integrity)) {
-    return { ok: false, reason: "integrity invalid" };
-  }
-  if (!isExecutionRole(receipt.executionRole)) return { ok: false, reason: "execution role invalid" };
-  if (!isRoutingIntent(receipt.routingIntent)) {
-    return { ok: false, reason: "routing intent invalid" };
-  }
-  if (receipt.routeDecision !== void 0 && !isCurrentRouteDecision(receipt.routeDecision)) {
-    return { ok: false, reason: "route decision invalid" };
-  }
-  const mismatch = firstLedgerMismatch(receipt, envelope);
-  if (mismatch) {
-    return { ok: false, reason: `ledger mismatch: ${mismatch}` };
-  }
-  const expected = computeReceiptIntegrity(receipt, envelope);
-  const legacyExpected = computeReceiptIntegrity(receipt, envelope, true);
-  if (expected.digest !== receipt.integrity.digest && legacyExpected.digest !== receipt.integrity.digest) {
-    return { ok: false, reason: "integrity mismatch" };
-  }
-  return { ok: true };
-}
-
-// src/domains/evidence/trust-status.ts
-init_esm_shims();
-var TRUST_STATUS_VERSION = 1;
-var TRUST_STATUS_MAX_ARTIFACT_REFERENCES = 16;
-var TRUST_STATUS_MAX_IDENTIFIER_LENGTH = 512;
-var TRUST_STATUS_AXES = [
-  "artifactIntegrity",
-  "validationGrounding",
-  "independentReview",
-  "contextProvenance",
-  "autonomyEnforcement",
-  "completionEvidence"
-];
-var TRUST_STATUS_STATES = {
-  artifactIntegrity: ["verified", "failed", "absent", "unknown", "not_applicable"],
-  validationGrounding: ["validated", "failed", "ungrounded", "absent", "unknown", "not_applicable"],
-  independentReview: ["passed", "failed", "inconclusive", "not_independent", "absent", "unknown", "not_applicable"],
-  contextProvenance: ["recorded", "invalid", "absent", "unknown", "not_applicable"],
-  autonomyEnforcement: ["enforced", "approximated", "bypassed", "absent", "unknown", "not_applicable"],
-  completionEvidence: ["evidenced", "incomplete", "limited", "absent", "unknown", "not_applicable"]
-};
-var SELF_REPORTED_ARTIFACT_KINDS = /* @__PURE__ */ new Set([
-  "finish_contract_evidence",
-  "run_receipt"
-]);
-var AXIS_STATES = {
-  artifactIntegrity: new Set(TRUST_STATUS_STATES.artifactIntegrity),
-  validationGrounding: new Set(TRUST_STATUS_STATES.validationGrounding),
-  independentReview: new Set(TRUST_STATUS_STATES.independentReview),
-  contextProvenance: new Set(TRUST_STATUS_STATES.contextProvenance),
-  autonomyEnforcement: new Set(TRUST_STATUS_STATES.autonomyEnforcement),
-  completionEvidence: new Set(TRUST_STATUS_STATES.completionEvidence)
-};
-var AXIS_SOURCES = {
-  artifactIntegrity: /* @__PURE__ */ new Set(["receipt_integrity_verification", "compatibility"]),
-  validationGrounding: /* @__PURE__ */ new Set(["run_receipt", "evidence_bundle", "compatibility"]),
-  independentReview: /* @__PURE__ */ new Set(["gate_decision", "compatibility"]),
-  contextProvenance: /* @__PURE__ */ new Set(["run_receipt", "evidence_bundle", "compatibility"]),
-  autonomyEnforcement: /* @__PURE__ */ new Set(["run_receipt", "compatibility"]),
-  completionEvidence: /* @__PURE__ */ new Set(["finish_contract", "compatibility"])
-};
-var SOURCE_AUTHORITIES = {
-  receipt_integrity_verification: /* @__PURE__ */ new Set(["clio"]),
-  run_receipt: /* @__PURE__ */ new Set(["clio", "validator", "runtime", "external_system", "unknown"]),
-  gate_decision: /* @__PURE__ */ new Set(["clio", "reviewer", "operator", "unknown"]),
-  evidence_bundle: /* @__PURE__ */ new Set(["clio"]),
-  finish_contract: /* @__PURE__ */ new Set(["clio"]),
-  compatibility: /* @__PURE__ */ new Set(["clio", "unknown"])
-};
-var ABSENCE_REASONS = /* @__PURE__ */ new Set([
-  "not_recorded",
-  "not_observed",
-  "artifact_missing",
-  "historical_format"
-]);
-var SOURCE_KINDS = /* @__PURE__ */ new Set([
-  "receipt_integrity_verification",
-  "run_receipt",
-  "gate_decision",
-  "evidence_bundle",
-  "finish_contract",
-  "compatibility"
-]);
-var AUTHORITY_KINDS = /* @__PURE__ */ new Set([
-  "clio",
-  "validator",
-  "reviewer",
-  "operator",
-  "runtime",
-  "external_system",
-  "unknown"
-]);
-var ARTIFACT_KINDS = /* @__PURE__ */ new Set([
-  "run_receipt",
-  "validation_result",
-  "gate_decision",
-  "briefing",
-  "project_context",
-  "worker_context",
-  "autonomy_policy",
-  "finish_contract_evidence",
-  "evidence_bundle",
-  "session_entry"
-]);
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function hasExactKeys(value, keys) {
-  const expected = new Set(keys);
-  return Object.keys(value).length === expected.size && Object.keys(value).every((key) => expected.has(key));
-}
-function isTrustStatusIdentifier(value) {
-  if (typeof value !== "string" || value.trim().length === 0 || value.length > TRUST_STATUS_MAX_IDENTIFIER_LENGTH) {
-    return false;
-  }
-  for (const character of value) {
-    const codePoint = character.codePointAt(0);
-    if (codePoint !== void 0 && (codePoint < 32 || codePoint === 127)) return false;
-  }
-  return true;
-}
-function compareArtifactReferences(left, right) {
-  const leftKey = `${left.kind}\0${left.id}\0${left.digest?.value ?? ""}`;
-  const rightKey = `${right.kind}\0${right.id}\0${right.digest?.value ?? ""}`;
-  return leftKey < rightKey ? -1 : leftKey > rightKey ? 1 : 0;
-}
-function normalizeArtifactReference(value, path2) {
-  if (!isRecord(value)) throw new Error(`${path2} must be an object`);
-  if (!hasExactKeys(value, value.digest === void 0 ? ["kind", "id"] : ["kind", "id", "digest"])) {
-    throw new Error(`${path2} has unknown or missing fields`);
-  }
-  if (typeof value.kind !== "string" || !ARTIFACT_KINDS.has(value.kind)) {
-    throw new Error(`${path2}.kind is invalid`);
-  }
-  if (!isTrustStatusIdentifier(value.id)) throw new Error(`${path2}.id is invalid`);
-  const reference = { kind: value.kind, id: value.id };
-  if (value.digest !== void 0) {
-    if (!isRecord(value.digest) || !hasExactKeys(value.digest, ["algorithm", "value"]) || value.digest.algorithm !== "sha256" || typeof value.digest.value !== "string" || !/^[a-f0-9]{64}$/u.test(value.digest.value)) {
-      throw new Error(`${path2}.digest is invalid`);
-    }
-    reference.digest = { algorithm: "sha256", value: value.digest.value };
-  }
-  return reference;
-}
-function normalizeAttributedStatus(axis, value) {
-  if (!hasExactKeys(value, ["state", "source", "authority", "artifacts"])) {
-    throw new Error(`${axis} has unknown or missing fields`);
-  }
-  if (!isRecord(value.source) || !hasExactKeys(value.source, ["kind", "id"])) {
-    throw new Error(`${axis}.source is invalid`);
-  }
-  if (typeof value.source.kind !== "string" || !SOURCE_KINDS.has(value.source.kind) || !AXIS_SOURCES[axis].has(value.source.kind) || !isTrustStatusIdentifier(value.source.id)) {
-    throw new Error(`${axis}.source is invalid`);
-  }
-  if (!isRecord(value.authority) || !hasExactKeys(value.authority, ["kind", "id"])) {
-    throw new Error(`${axis}.authority is invalid`);
-  }
-  if (typeof value.authority.kind !== "string" || !AUTHORITY_KINDS.has(value.authority.kind) || !SOURCE_AUTHORITIES[value.source.kind].has(
-    value.authority.kind
-  ) || !isTrustStatusIdentifier(value.authority.id)) {
-    throw new Error(`${axis}.authority is invalid`);
-  }
-  if (value.source.kind === "compatibility" && value.state !== "unknown" && value.state !== "not_applicable") {
-    throw new Error(`${axis} compatibility source cannot establish ${value.state}`);
-  }
-  if (!Array.isArray(value.artifacts) || value.artifacts.length > TRUST_STATUS_MAX_ARTIFACT_REFERENCES) {
-    throw new Error(`${axis}.artifacts exceeds the bounded reference list`);
-  }
-  const artifacts = value.artifacts.map(
-    (entry, index) => normalizeArtifactReference(entry, `${axis}.artifacts[${index}]`)
-  );
-  artifacts.sort(compareArtifactReferences);
-  for (let index = 1; index < artifacts.length; index += 1) {
-    if (compareArtifactReferences(
-      artifacts[index - 1],
-      artifacts[index]
-    ) === 0) {
-      throw new Error(`${axis}.artifacts contains a duplicate reference`);
-    }
-  }
-  return {
-    state: value.state,
-    source: { kind: value.source.kind, id: value.source.id },
-    authority: { kind: value.authority.kind, id: value.authority.id },
-    artifacts
-  };
-}
-function normalizeAxis(axis, value) {
-  if (!isRecord(value) || typeof value.state !== "string" || !AXIS_STATES[axis].has(value.state)) {
-    throw new Error(`${axis}.state is invalid`);
-  }
-  if (value.state === "absent") {
-    if (!hasExactKeys(value, ["state", "reason"]) || typeof value.reason !== "string" || !ABSENCE_REASONS.has(value.reason)) {
-      throw new Error(`${axis} absent state is invalid`);
-    }
-    return { state: "absent", reason: value.reason };
-  }
-  return normalizeAttributedStatus(axis, value);
-}
-function normalizeTrustStatus(value) {
-  if (!isRecord(value) || !hasExactKeys(value, ["version", ...TRUST_STATUS_AXES])) {
-    throw new Error("trust status has unknown or missing fields");
-  }
-  if (value.version !== TRUST_STATUS_VERSION) throw new Error("trust status version is invalid");
-  return {
-    version: TRUST_STATUS_VERSION,
-    artifactIntegrity: normalizeAxis("artifactIntegrity", value.artifactIntegrity),
-    validationGrounding: normalizeAxis("validationGrounding", value.validationGrounding),
-    independentReview: normalizeAxis("independentReview", value.independentReview),
-    contextProvenance: normalizeAxis("contextProvenance", value.contextProvenance),
-    autonomyEnforcement: normalizeAxis("autonomyEnforcement", value.autonomyEnforcement),
-    completionEvidence: normalizeAxis("completionEvidence", value.completionEvidence)
-  };
-}
-function validateTrustStatus(value) {
-  try {
-    return { ok: true, status: normalizeTrustStatus(value) };
-  } catch (error) {
-    return { ok: false, reason: error instanceof Error ? error.message : String(error) };
-  }
-}
-function absentTrustStatus(reason) {
-  return { state: "absent", reason };
-}
-function composeTrustStatus(...projections) {
-  const axes = {
-    artifactIntegrity: absentTrustStatus("not_recorded"),
-    validationGrounding: absentTrustStatus("not_recorded"),
-    independentReview: absentTrustStatus("not_recorded"),
-    contextProvenance: absentTrustStatus("not_recorded"),
-    autonomyEnforcement: absentTrustStatus("not_recorded"),
-    completionEvidence: absentTrustStatus("not_recorded")
-  };
-  for (const projection of projections) {
-    if (projection.artifactIntegrity !== void 0) axes.artifactIntegrity = projection.artifactIntegrity;
-    if (projection.validationGrounding !== void 0) axes.validationGrounding = projection.validationGrounding;
-    if (projection.independentReview !== void 0) axes.independentReview = projection.independentReview;
-    if (projection.contextProvenance !== void 0) axes.contextProvenance = projection.contextProvenance;
-    if (projection.autonomyEnforcement !== void 0) axes.autonomyEnforcement = projection.autonomyEnforcement;
-    if (projection.completionEvidence !== void 0) axes.completionEvidence = projection.completionEvidence;
-  }
-  return normalizeTrustStatus({ version: TRUST_STATUS_VERSION, ...axes });
-}
-function projectTrustStatus(status, axes) {
-  const normalized = normalizeTrustStatus(status);
-  const projection = {};
-  const requested = new Set(axes);
-  if (requested.has("artifactIntegrity")) projection.artifactIntegrity = normalized.artifactIntegrity;
-  if (requested.has("validationGrounding")) projection.validationGrounding = normalized.validationGrounding;
-  if (requested.has("independentReview")) projection.independentReview = normalized.independentReview;
-  if (requested.has("contextProvenance")) projection.contextProvenance = normalized.contextProvenance;
-  if (requested.has("autonomyEnforcement")) projection.autonomyEnforcement = normalized.autonomyEnforcement;
-  if (requested.has("completionEvidence")) projection.completionEvidence = normalized.completionEvidence;
-  return projection;
-}
-function sha256Reference(kind, id, digest) {
-  const reference = { kind, id };
-  if (digest !== void 0 && /^[a-f0-9]{64}$/u.test(digest)) {
-    reference.digest = { algorithm: "sha256", value: digest };
-  }
-  return reference;
-}
-function receiptReference(receipt) {
-  return sha256Reference("run_receipt", receipt.runId, receipt.integrity?.digest);
-}
-function attributed(state, source, authority, artifacts) {
-  return { state, source, authority, artifacts: [...artifacts].sort(compareArtifactReferences) };
-}
-function receiptSource(receipt) {
-  return { kind: "run_receipt", id: receipt.runId };
-}
-function compatibilitySource(receipt, field) {
-  return { kind: "compatibility", id: `run_receipt:${receipt.runId}:${field}` };
-}
-var DISPATCH_AUTHORITY = { kind: "clio", id: "dispatch" };
-var COMPATIBILITY_AUTHORITY = { kind: "unknown", id: "historical-persisted-format" };
-function retiredReceiptIntegrity(integrity) {
-  if (!isRecord(integrity)) return null;
-  const version = integrity.version;
-  if (typeof version !== "number" || !Number.isInteger(version) || version < 1) return null;
-  if (version >= RUN_RECEIPT_INTEGRITY_VERSION) return null;
-  return { receiptVersion: version, supportedVersion: RUN_RECEIPT_INTEGRITY_VERSION };
-}
-function retiredReceiptIntegrityReason(retired) {
-  return `receipt integrity v${retired.receiptVersion} is retired; this build verifies v${retired.supportedVersion}; the receipt is not read as evidence`;
-}
-function verifyReceiptIntegrityOutcome(receipt, envelope) {
-  const retired = retiredReceiptIntegrity(receipt.integrity);
-  if (retired !== null) return { ok: false, reason: retiredReceiptIntegrityReason(retired), retired };
-  return verifyReceiptIntegrity(receipt, envelope);
-}
-var RETIRED_INTEGRITY_SOURCE = /:integrity-v(\d+)-retired$/u;
-function retiredIntegritySourceId(runId, receiptVersion) {
-  return `run_receipt:${runId}:integrity-v${receiptVersion}-retired`;
-}
-function retiredIntegrityVersionOf(status) {
-  if (status.state !== "unknown" || status.source.kind !== "compatibility") return null;
-  const match = RETIRED_INTEGRITY_SOURCE.exec(status.source.id);
-  return match === null ? null : Number(match[1]);
-}
-function adaptReceiptIntegrityStatus(receipt, verification) {
-  if (receipt === null || receipt === void 0) return absentTrustStatus("artifact_missing");
-  const artifacts = [receiptReference(receipt)];
-  if (verification !== void 0 && !verification.ok && verification.retired !== void 0) {
-    return attributed(
-      "unknown",
-      { kind: "compatibility", id: retiredIntegritySourceId(receipt.runId, verification.retired.receiptVersion) },
-      COMPATIBILITY_AUTHORITY,
-      artifacts
-    );
-  }
-  if (verification === void 0 || verification.ok && receipt.integrity === void 0) {
-    return attributed(
-      "unknown",
-      {
-        kind: "compatibility",
-        id: `run_receipt:${receipt.runId}:${receipt.integrity === void 0 ? "integrity-missing" : "integrity-unchecked"}`
-      },
-      COMPATIBILITY_AUTHORITY,
-      artifacts
-    );
-  }
-  return attributed(
-    verification.ok ? "verified" : "failed",
-    { kind: "receipt_integrity_verification", id: receipt.runId },
-    { kind: "clio", id: "receipt-integrity" },
-    artifacts
-  );
-}
-function validationArtifacts(receipt) {
-  const artifacts = [receiptReference(receipt)];
-  for (const fact of receipt.quality?.typedValidations ?? []) {
-    artifacts.push(sha256Reference("validation_result", fact.sourceId, fact.validatorDigest));
-  }
-  const resultContract = receipt.quality?.resultContract;
-  if (resultContract !== null && resultContract !== void 0) {
-    artifacts.push(sha256Reference("validation_result", resultContract.sourceId, resultContract.validatorDigest));
-  }
-  return uniqueBoundedReferences(artifacts);
-}
-function qualityHasFailure(quality) {
-  if (quality === void 0) return false;
-  if (quality.typedValidations.some((fact) => !fact.passed)) return true;
-  return quality.resultContract?.conformance === "fail" || quality.resultContract?.quality === "fail";
-}
-function qualityHasValidation(quality) {
-  if (quality === void 0) return false;
-  if (quality.typedValidations.some((fact) => fact.passed)) return true;
-  return quality.resultContract?.quality === "pass";
-}
-function verificationStatus(verification, receipt, artifacts) {
-  if (verification.state === "verified") {
-    return attributed("validated", receiptSource(receipt), { kind: "validator", id: verification.basis }, artifacts);
-  }
-  if (verification.state === "unverified") return absentTrustStatus("not_observed");
-  if (verification.state === "not_applicable") {
-    return attributed("not_applicable", receiptSource(receipt), DISPATCH_AUTHORITY, artifacts);
-  }
-  return attributed(
-    "unknown",
-    receiptSource(receipt),
-    verification.basis === "acp-external-unobserved" ? { kind: "external_system", id: "acp-delegation" } : COMPATIBILITY_AUTHORITY,
-    artifacts
-  );
-}
-function adaptRunReceiptValidationStatus(receipt) {
-  if (receipt === null || receipt === void 0) return absentTrustStatus("artifact_missing");
-  const artifacts = validationArtifacts(receipt);
-  if (receipt.hostVerification?.status === "rejected") {
-    return attributed("failed", receiptSource(receipt), { kind: "validator", id: "host-verification" }, artifacts);
-  }
-  if (receipt.hostVerification?.status === "verified") {
-    return attributed("validated", receiptSource(receipt), { kind: "validator", id: "host-verification" }, artifacts);
-  }
-  if (receipt.hostVerification?.status === "not_implicated") {
-    return attributed("unknown", receiptSource(receipt), { kind: "validator", id: "host-verification" }, artifacts);
-  }
-  if (qualityHasFailure(receipt.quality)) {
-    return attributed("failed", receiptSource(receipt), { kind: "validator", id: "receipt-quality" }, artifacts);
-  }
-  if ((receipt.validationGrounding?.ungrounded.length ?? 0) > 0 || receipt.validationGrounding !== void 0 && receipt.validationGrounding.claimed > receipt.validationGrounding.grounded) {
-    return attributed("ungrounded", receiptSource(receipt), { kind: "validator", id: "command-grounding" }, artifacts);
-  }
-  if (qualityHasValidation(receipt.quality)) {
-    return attributed("validated", receiptSource(receipt), { kind: "validator", id: "receipt-quality" }, artifacts);
-  }
-  if (receipt.verification !== void 0) {
-    return verificationStatus(receipt.verification, receipt, artifacts);
-  }
-  return attributed("unknown", compatibilitySource(receipt, "verification"), COMPATIBILITY_AUTHORITY, artifacts);
-}
-function validBriefing(briefing) {
-  return Number.isSafeInteger(briefing.bytes) && briefing.bytes >= 0 && /^[a-f0-9]{64}$/u.test(briefing.contentHash);
-}
-function validBoundedProjectContext(context) {
-  return context.tier === "bounded" && Number.isSafeInteger(context.chars) && (context.chars ?? -1) >= 0 && typeof context.contentHash === "string" && /^[a-f0-9]{64}$/u.test(context.contentHash);
-}
-var NONE_TIER_SECTIONS = ["workspace-root"];
-function validNoneTierProjectContext(context) {
-  return context.tier === "none" && context.sections !== void 0 && context.sections.length === NONE_TIER_SECTIONS.length && context.sections.every((section) => NONE_TIER_SECTIONS.includes(section)) && Number.isSafeInteger(context.chars) && (context.chars ?? -1) >= 0 && typeof context.contentHash === "string" && /^[a-f0-9]{64}$/u.test(context.contentHash);
-}
-function recordedProjectContextHash(context) {
-  if (context === void 0) return void 0;
-  if (context.tier === "bounded") return validBoundedProjectContext(context) ? context.contentHash : void 0;
-  return validNoneTierProjectContext(context) ? context.contentHash : void 0;
-}
-function validWorkerContext(value) {
-  try {
-    parseWorkerContextProvenance(value);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function contextArtifacts(receipt) {
-  const artifacts = [receiptReference(receipt)];
-  if (receipt.workerContext !== void 0 && validWorkerContext(receipt.workerContext))
-    artifacts.push(
-      sha256Reference("worker_context", `${receipt.runId}:worker-context`, receipt.workerContext.contentHash)
-    );
-  if (receipt.briefing !== void 0 && validBriefing(receipt.briefing)) {
-    artifacts.push(sha256Reference("briefing", `${receipt.runId}:briefing`, receipt.briefing.contentHash));
-  }
-  const recordedHash = recordedProjectContextHash(receipt.projectContext);
-  if (recordedHash !== void 0) {
-    artifacts.push(sha256Reference("project_context", `${receipt.runId}:project-context`, recordedHash));
-  }
-  return uniqueBoundedReferences(artifacts);
-}
-function adaptRunReceiptContextStatus(receipt) {
-  if (receipt === null || receipt === void 0) return absentTrustStatus("artifact_missing");
-  const artifacts = contextArtifacts(receipt);
-  const source = receiptSource(receipt);
-  const briefingInvalid = receipt.briefing !== void 0 && !validBriefing(receipt.briefing);
-  if (briefingInvalid || receipt.workerContext !== void 0 && !validWorkerContext(receipt.workerContext))
-    return attributed("invalid", source, DISPATCH_AUTHORITY, artifacts);
-  const context = receipt.projectContext;
-  if (context === void 0) {
-    if (receipt.briefing !== void 0 || receipt.workerContext !== void 0)
-      return attributed("recorded", source, DISPATCH_AUTHORITY, artifacts);
-    return attributed("unknown", compatibilitySource(receipt, "projectContext"), COMPATIBILITY_AUTHORITY, artifacts);
-  }
-  if (context.tier === "none") {
-    const bare = context.chars === void 0 && context.contentHash === void 0 && context.sections === void 0;
-    if (bare) {
-      return receipt.briefing === void 0 && receipt.workerContext === void 0 ? attributed("not_applicable", source, DISPATCH_AUTHORITY, artifacts) : attributed("recorded", source, DISPATCH_AUTHORITY, artifacts);
-    }
-    return attributed(
-      validNoneTierProjectContext(context) ? "recorded" : "invalid",
-      source,
-      DISPATCH_AUTHORITY,
-      artifacts
-    );
-  }
-  return attributed(validBoundedProjectContext(context) ? "recorded" : "invalid", source, DISPATCH_AUTHORITY, artifacts);
-}
-function adaptRunReceiptAutonomyStatus(receipt) {
-  if (receipt === null || receipt === void 0) return absentTrustStatus("artifact_missing");
-  const enforcement = receipt.autonomyEnforcement;
-  const artifacts = [receiptReference(receipt)];
-  if (enforcement === void 0) {
-    return attributed("unknown", compatibilitySource(receipt, "autonomyEnforcement"), COMPATIBILITY_AUTHORITY, artifacts);
-  }
-  artifacts.push({ kind: "autonomy_policy", id: `${receipt.runId}:${enforcement.autonomy}` });
-  const authority = enforcement.grade === "mediated" ? { kind: "clio", id: "safety-autonomy" } : { kind: "runtime", id: enforcement.externalMode ?? "external-runtime" };
-  const state = enforcement.dangerousBypass === true || enforcement.grade === "bypassed" ? "bypassed" : enforcement.grade === "approximated" ? "approximated" : "enforced";
-  return attributed(state, receiptSource(receipt), authority, artifacts);
-}
-function receiptClaimsAreAuthenticated(receipt, integrity) {
-  return receipt?.integrity !== void 0 && integrity?.ok === true;
-}
-function unauthenticatedReceiptProjection(receipt, integrity) {
-  if (receipt === null || receipt === void 0) {
-    return {
-      validationGrounding: absentTrustStatus("artifact_missing"),
-      contextProvenance: absentTrustStatus("artifact_missing"),
-      autonomyEnforcement: absentTrustStatus("artifact_missing")
-    };
-  }
-  if (receipt.integrity === void 0) {
-    const artifacts = [receiptReference(receipt)];
-    return {
-      validationGrounding: attributed(
-        "unknown",
-        compatibilitySource(receipt, "canonical-projection"),
-        COMPATIBILITY_AUTHORITY,
-        artifacts
-      ),
-      contextProvenance: attributed(
-        "unknown",
-        compatibilitySource(receipt, "canonical-projection"),
-        COMPATIBILITY_AUTHORITY,
-        artifacts
-      ),
-      autonomyEnforcement: attributed(
-        "unknown",
-        compatibilitySource(receipt, "canonical-projection"),
-        COMPATIBILITY_AUTHORITY,
-        artifacts
-      )
-    };
-  }
-  if (integrity !== void 0 && !integrity.ok && integrity.retired !== void 0) {
-    return {
-      validationGrounding: absentTrustStatus("historical_format"),
-      contextProvenance: absentTrustStatus("historical_format"),
-      autonomyEnforcement: absentTrustStatus("historical_format")
-    };
-  }
-  return {
-    validationGrounding: absentTrustStatus("not_observed"),
-    contextProvenance: absentTrustStatus("not_observed"),
-    autonomyEnforcement: absentTrustStatus("not_observed")
-  };
-}
-function adaptRunReceiptTrustStatus(receipt, options = {}) {
-  const authenticated = receiptClaimsAreAuthenticated(receipt, options.integrity);
-  const receiptProjection = authenticated ? {
-    validationGrounding: adaptRunReceiptValidationStatus(receipt),
-    contextProvenance: adaptRunReceiptContextStatus(receipt),
-    autonomyEnforcement: adaptRunReceiptAutonomyStatus(receipt)
-  } : unauthenticatedReceiptProjection(receipt, options.integrity);
-  return composeTrustStatus({
-    artifactIntegrity: adaptReceiptIntegrityStatus(receipt, options.integrity),
-    ...receiptProjection,
-    independentReview: absentTrustStatus(receipt === null || receipt === void 0 ? "artifact_missing" : "not_recorded"),
-    completionEvidence: absentTrustStatus(
-      receipt === null || receipt === void 0 ? "artifact_missing" : "not_recorded"
-    )
-  });
-}
-function inspectRunReceiptTrustStatus(receipt, envelope) {
-  let integrity;
-  if (receipt === null || receipt === void 0) {
-    integrity = { ok: false, reason: "receipt unavailable" };
-  } else if (envelope === null || envelope === void 0) {
-    integrity = { ok: false, reason: "run ledger envelope unavailable" };
-  } else {
-    try {
-      integrity = verifyReceiptIntegrityOutcome(receipt, envelope);
-    } catch (error) {
-      integrity = {
-        ok: false,
-        reason: `receipt invalid: ${error instanceof Error ? error.message : String(error)}`
-      };
-    }
-  }
-  return {
-    integrity,
-    status: adaptRunReceiptTrustStatus(receipt, { integrity })
-  };
-}
-function gateReference(artifact) {
-  return sha256Reference("gate_decision", artifact.id, artifact.integrity.digest);
-}
-function gateAuthority(artifact) {
-  if (artifact.outcome === "operator-confirmed") return { kind: "operator", id: "gate-confirmation" };
-  if (artifact.outcome === "full-auto-applied") return { kind: "clio", id: "full-auto-gate-policy" };
-  return { kind: "reviewer", id: artifact.decider?.runId ?? "unavailable-decider" };
-}
-function adaptGateDecisionReviewStatus(artifact, subjectRunId, verification) {
-  if (artifact === null || artifact === void 0) return absentTrustStatus("artifact_missing");
-  const source = { kind: "gate_decision", id: artifact.id };
-  const artifacts = [gateReference(artifact)];
-  const authority = gateAuthority(artifact);
-  if (!artifact.subjects.some((subject) => subject.runId === subjectRunId)) return absentTrustStatus("not_recorded");
-  if (verification === void 0 || !verification.ok) {
-    return attributed(
-      "unknown",
-      source,
-      verification === void 0 ? COMPATIBILITY_AUTHORITY : { kind: "unknown", id: "unauthenticated-gate-artifact" },
-      artifacts
-    );
-  }
-  if (artifact.decider === void 0 || artifact.correlation === void 0) {
-    if (artifact.outcome === "operator-confirmed" || artifact.outcome === "full-auto-applied") {
-      return attributed("not_applicable", source, authority, artifacts);
-    }
-    return attributed("inconclusive", source, authority, artifacts);
-  }
-  if (!artifact.correlation.independent) return attributed("not_independent", source, authority, artifacts);
-  if (artifact.outcome === "pass") return attributed("passed", source, authority, artifacts);
-  if (artifact.outcome === "fail") return attributed("failed", source, authority, artifacts);
-  if (artifact.outcome === "winner") {
-    return attributed(
-      artifact.winner?.subject.runId === subjectRunId ? "passed" : "failed",
-      source,
-      authority,
-      artifacts
-    );
-  }
-  return attributed("inconclusive", source, authority, artifacts);
-}
-function adaptGroundedEvidenceValidationStatus(input) {
-  const observed = (input.artifacts ?? []).filter((artifact) => !SELF_REPORTED_ARTIFACT_KINDS.has(artifact.kind));
-  if (observed.length === 0) return absentTrustStatus("not_observed");
-  return attributed(
-    "validated",
-    { kind: "evidence_bundle", id: `${input.evidenceId}:${input.runId}` },
-    { kind: "clio", id: "evidence-grounding" },
-    uniqueBoundedReferences([{ kind: "evidence_bundle", id: input.evidenceId }, ...observed])
-  );
-}
-function adaptFinishContractCompletionStatus(assessment, options = {}) {
-  const artifacts = uniqueBoundedReferences(
-    options.artifacts ?? assessment.evidence.map((evidence, index) => ({
-      kind: evidence.turnId === void 0 ? "finish_contract_evidence" : "session_entry",
-      id: evidence.turnId ?? `${evidence.kind}:${index + 1}`
-    }))
-  );
-  const source = { kind: "finish_contract", id: options.sourceId ?? assessment.reason };
-  const authority = { kind: "clio", id: "finish-contract" };
-  if (assessment.reason === "no_mutation") return attributed("not_applicable", source, authority, artifacts);
-  if (assessment.reason === "validation_evidence") return attributed("evidenced", source, authority, artifacts);
-  if (assessment.reason === "explicit_limitation") return attributed("limited", source, authority, artifacts);
-  return attributed("incomplete", source, authority, artifacts);
-}
-function uniqueBoundedReferences(references) {
-  const sorted = [...references].sort(compareArtifactReferences);
-  const unique = sorted.filter(
-    (reference, index) => index === 0 || compareArtifactReferences(sorted[index - 1], reference) !== 0
-  );
-  return unique.slice(0, TRUST_STATUS_MAX_ARTIFACT_REFERENCES);
-}
-
-// src/domains/evidence/trust-projection.ts
-init_esm_shims();
-var TRUST_SUMMARY_VERSION = 1;
-var TRUST_SUMMARY_MAX_REFS = 8;
-var TRUST_VERDICTS = [
-  "reviewed",
-  "grounded",
-  "unverified",
-  "compromised",
-  "unknown"
-];
-var TRUST_STATE_WORDS = {
-  artifactIntegrity: {
-    verified: "sealed",
-    failed: "seal broken",
-    absent: "no receipt",
-    unknown: "seal unchecked",
-    not_applicable: "seal not applicable"
-  },
-  validationGrounding: {
-    validated: "grounded",
-    failed: "validation failed",
-    ungrounded: "inferred: validation claimed, none observed",
-    absent: "no validation observed",
-    unknown: "validation unknown",
-    not_applicable: "validation not applicable"
-  },
-  independentReview: {
-    passed: "independently reviewed: pass",
-    failed: "independently reviewed: fail",
-    inconclusive: "independent review inconclusive",
-    not_independent: "review not independent",
-    absent: "not independently reviewed",
-    unknown: "independent review unknown",
-    not_applicable: "independent review not applicable"
-  },
-  contextProvenance: {
-    recorded: "context recorded",
-    invalid: "context record invalid",
-    absent: "context not recorded",
-    unknown: "context unknown",
-    not_applicable: "context not applicable"
-  },
-  autonomyEnforcement: {
-    enforced: "mediated",
-    approximated: "approximated",
-    bypassed: "bypassed",
-    absent: "autonomy not recorded",
-    unknown: "autonomy unknown",
-    not_applicable: "autonomy not applicable"
-  },
-  completionEvidence: {
-    evidenced: "completion evidenced",
-    incomplete: "completion unevidenced",
-    limited: "completion limited",
-    absent: "completion not recorded",
-    unknown: "completion unknown",
-    not_applicable: "completion not applicable"
-  }
-};
-function trustStateWord(axis, state) {
-  const words = TRUST_STATE_WORDS[axis];
-  return words[state] ?? words.unknown ?? "unknown";
-}
-function authorityOf(status, axis) {
-  const entry = status[axis];
-  return entry.state === "absent" ? null : `${entry.authority.kind}:${entry.authority.id}`;
-}
-function integrityClause(status) {
-  const retired = retiredIntegrityVersionOf(status.artifactIntegrity);
-  if (retired !== null) return `seal v${retired} retired (this build verifies v${RUN_RECEIPT_INTEGRITY_VERSION})`;
-  return trustStateWord("artifactIntegrity", status.artifactIntegrity.state);
-}
-function validationClause(status) {
-  const entry = status.validationGrounding;
-  const word = trustStateWord("validationGrounding", entry.state);
-  if (entry.state === "absent") return word;
-  if (entry.state === "validated" || entry.state === "failed") return `${word} by ${entry.authority.id}`;
-  if (entry.state === "unknown" && entry.authority.kind !== "unknown") return `${word} (${entry.authority.id})`;
-  return word;
-}
-function autonomyClause(status) {
-  const entry = status.autonomyEnforcement;
-  const word = trustStateWord("autonomyEnforcement", entry.state);
-  if (entry.state !== "approximated" && entry.state !== "bypassed") return word;
-  return `${word} (${entry.authority.id})`;
-}
-function formatTrustSummary(status) {
-  return [
-    integrityClause(status),
-    validationClause(status),
-    trustStateWord("independentReview", status.independentReview.state),
-    autonomyClause(status),
-    trustStateWord("contextProvenance", status.contextProvenance.state),
-    trustStateWord("completionEvidence", status.completionEvidence.state)
-  ].join("; ");
-}
-function formatTrustSummaryLine(status) {
-  return `trust v${TRUST_SUMMARY_VERSION}: ${trustVerdict(status)}; ${formatTrustSummary(status)}`;
-}
-function formatTrustAxes(status) {
-  return [`trust_status=v${status.version}`, ...TRUST_STATUS_AXES.map((axis) => `${axis}:${status[axis].state}`)].join(
-    " "
-  );
-}
-function isUnanswered(status, axis) {
-  const state = status[axis].state;
-  return state === "absent" || state === "unknown";
-}
-function trustVerdict(status) {
-  const integrity = status.artifactIntegrity.state;
-  const validation = status.validationGrounding.state;
-  const review = status.independentReview.state;
-  const autonomy = status.autonomyEnforcement.state;
-  if (integrity === "failed" || autonomy === "bypassed" || validation === "failed" || validation === "ungrounded" || review === "failed" || review === "not_independent" || status.contextProvenance.state === "invalid") {
-    return "compromised";
-  }
-  if (integrity !== "verified") return "unknown";
-  if (review === "passed") return "reviewed";
-  if (validation === "validated") return "grounded";
-  return "unverified";
-}
-function claimantOf(status) {
-  const state = status.validationGrounding.state;
-  if (state === "absent" || state === "ungrounded") return "worker";
-  return authorityOf(status, "validationGrounding") ?? "worker";
-}
-function referenceKey(reference) {
-  return `${reference.kind}:${reference.id}`;
-}
-function trustSummaryReferences(status) {
-  const keys = /* @__PURE__ */ new Set();
-  for (const axis of TRUST_STATUS_AXES) {
-    const entry = status[axis];
-    if (entry.state === "absent") continue;
-    for (const reference of entry.artifacts) keys.add(referenceKey(reference));
-  }
-  return [...keys].sort().slice(0, TRUST_SUMMARY_MAX_REFS);
-}
-function summarizeTrustStatus(status) {
-  const axes = Object.fromEntries(TRUST_STATUS_AXES.map((axis) => [axis, status[axis].state]));
-  return {
-    version: TRUST_SUMMARY_VERSION,
-    verdict: trustVerdict(status),
-    text: formatTrustSummary(status),
-    axes,
-    claimant: claimantOf(status),
-    unknown: TRUST_STATUS_AXES.filter((axis) => isUnanswered(status, axis)),
-    refs: trustSummaryReferences(status)
-  };
-}
-
-// src/domains/eval/provenance.ts
-init_esm_shims();
-import { spawnSync } from "node:child_process";
-function evalClioProvenance(options = {}) {
-  return {
-    version: readClioVersion(),
-    commit: options.commit === void 0 ? currentClioCommit() : options.commit,
-    entry: options.entry ?? process.argv[1] ?? "unknown"
-  };
-}
-function evalEnvironmentProvenance() {
-  return {
-    platform: `${process.platform}-${process.arch}`,
-    node: process.version
-  };
-}
-async function evalServingConfiguration(targets, observations) {
-  const targetId = targets.length === 1 ? targets[0]?.id ?? "unknown" : "multiple";
-  const configured = configuredTarget(targetId);
-  const target = targets.length === 1 ? targets[0] : void 0;
-  const runtimeId = consensus(observations.map((entry) => entry.runtimeId)) ?? configured?.runtime ?? null;
-  const modelId = consensus(observations.map((entry) => entry.modelId)) ?? target?.model ?? configured?.defaultModel ?? null;
-  const props = configured?.url === void 0 ? null : await readServingProps(configured.url, modelId);
-  return {
-    targetId,
-    runtimeId,
-    modelId,
-    serverBuild: props?.serverBuild ?? null,
-    total_slots: props?.totalSlots ?? null,
-    thinkingLevel: consensus(observations.map((entry) => entry.thinkingLevel)) ?? target?.thinking ?? null,
-    compiledPromptHash: consensus(observations.map((entry) => entry.compiledPromptHash))
-  };
-}
-function evalServingObservationFrom(target, receipt, compiledPromptHashes) {
-  const compiledPromptHash = receipt?.staticCompositionHash ?? receipt?.compiledPromptHash ?? consensus(compiledPromptHashes);
-  return {
-    targetId: receipt?.targetId ?? target.id,
-    runtimeId: receipt?.runtimeId ?? null,
-    modelId: receipt?.wireModelId ?? target.model ?? null,
-    thinkingLevel: receipt?.runtimeResolution?.effectiveThinkingLevel ?? target.thinking ?? null,
-    compiledPromptHash
-  };
-}
-function currentClioCommit() {
-  const result = spawnSync("git", ["rev-parse", "HEAD"], {
-    cwd: resolvePackageRoot(),
-    encoding: "utf8",
-    stdio: ["ignore", "pipe", "ignore"],
-    timeout: 1e3
-  });
-  if (result.status !== 0 || typeof result.stdout !== "string") return null;
-  const value = result.stdout.trim();
-  return value.length > 0 ? value : null;
-}
-function configuredTarget(targetId) {
-  try {
-    const target = readSettings().targets.find((entry) => entry.id === targetId);
-    if (target === void 0) return null;
-    return {
-      runtime: target.runtime,
-      ...target.url === void 0 ? {} : { url: target.url },
-      ...target.defaultModel === void 0 ? {} : { defaultModel: target.defaultModel }
-    };
-  } catch {
-    return null;
-  }
-}
-async function readServingProps(targetUrl, modelId) {
-  const root = targetUrl.replace(/\/+$/u, "").replace(/\/v1$/u, "");
-  try {
-    const response = await fetch(`${root}/props`, { signal: AbortSignal.timeout(5e3) });
-    if (!response.ok) return null;
-    const value = await response.json();
-    if (!isRecord2(value)) return null;
-    const totalSlots = positiveInteger(value.total_slots) ?? await readServingSlots(root, modelId);
-    return {
-      serverBuild: typeof value.build_info === "string" && value.build_info.length > 0 ? value.build_info : null,
-      totalSlots
-    };
-  } catch {
-    return null;
-  }
-}
-async function readServingSlots(root, modelId) {
-  if (modelId === null) return null;
-  try {
-    const query = new URLSearchParams({ model: modelId });
-    const response = await fetch(`${root}/slots?${query}`, { signal: AbortSignal.timeout(5e3) });
-    if (!response.ok) return null;
-    const value = await response.json();
-    return Array.isArray(value) && value.length > 0 ? value.length : null;
-  } catch {
-    return null;
-  }
-}
-function consensus(values) {
-  const known = [...new Set(values.filter((value) => typeof value === "string" && value.length > 0))];
-  return known.length === 1 ? known[0] ?? null : null;
-}
-function positiveInteger(value) {
-  return typeof value === "number" && Number.isInteger(value) && value > 0 ? value : null;
-}
-function isRecord2(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
-// src/domains/eval/task-file.ts
-init_esm_shims();
-var import_yaml = __toESM(require_dist(), 1);
-import { createHash as createHash3 } from "node:crypto";
-import { readFile } from "node:fs/promises";
-import { dirname, isAbsolute, relative, resolve } from "node:path";
-
-// src/domains/eval/types.ts
-init_esm_shims();
-var EVAL_TASK_FILE_VERSION = 1;
-
-// src/domains/eval/task-file.ts
-var TASK_KEYS = /* @__PURE__ */ new Set(["id", "prompt", "cwd", "setup", "verifier", "timeoutMs", "tags"]);
-async function loadEvalTaskFile(path2) {
-  const resolved = resolve(path2);
-  const raw = await readFile(resolved, "utf8");
-  const result = parseEvalTaskFileYaml(raw);
-  if (!result.valid) {
-    throw new EvalTaskFileError(result.issues);
-  }
-  const baseDir = dirname(resolved);
-  const cwdIssues = validateTaskCwds(result.taskFile.tasks, baseDir);
-  if (cwdIssues.length > 0) throw new EvalTaskFileError(cwdIssues);
-  return {
-    path: resolved,
-    baseDir,
-    contentHash: sha256Hex(raw),
-    taskFile: result.taskFile
-  };
-}
-function parseEvalTaskFileYaml(raw) {
-  let parsed;
-  try {
-    parsed = (0, import_yaml.parse)(raw);
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return { valid: false, issues: [{ path: "$", message: `invalid YAML: ${message}` }] };
-  }
-  return validateEvalTaskFile(parsed);
-}
-function validateEvalTaskFile(value) {
-  const issues = [];
-  if (!isRecord3(value)) {
-    return { valid: false, issues: [{ path: "$", message: "expected object" }] };
-  }
-  if (value.version !== EVAL_TASK_FILE_VERSION) {
-    issues.push({ path: "$.version", message: "expected version 1" });
-  }
-  if (!Array.isArray(value.tasks)) {
-    issues.push({ path: "$.tasks", message: "expected non-empty array" });
-    return { valid: false, issues };
-  }
-  if (value.tasks.length === 0) {
-    issues.push({ path: "$.tasks", message: "expected non-empty array" });
-  }
-  const tasks = [];
-  const seenIds = /* @__PURE__ */ new Set();
-  for (let index = 0; index < value.tasks.length; index += 1) {
-    const task = parseTask(value.tasks[index], `$.tasks[${index}]`, issues);
-    if (task === null) continue;
-    if (seenIds.has(task.id)) {
-      issues.push({ path: `$.tasks[${index}].id`, message: `duplicate task id: ${task.id}` });
-    }
-    seenIds.add(task.id);
-    tasks.push(task);
-  }
-  if (issues.length > 0) return { valid: false, issues };
-  return { valid: true, taskFile: { version: 1, tasks } };
-}
-var EvalTaskFileError = class extends Error {
-  issues;
-  constructor(issues) {
-    super(`eval task file invalid (${issues.length} ${issues.length === 1 ? "issue" : "issues"})`);
-    this.name = "EvalTaskFileError";
-    this.issues = [...issues];
-  }
-};
-function parseTask(value, path2, issues) {
-  if (!isRecord3(value)) {
-    issues.push({ path: path2, message: "expected object" });
-    return null;
-  }
-  for (const key of Object.keys(value).sort((a, b) => a.localeCompare(b))) {
-    if (!TASK_KEYS.has(key)) issues.push({ path: `${path2}.${key}`, message: "unknown field" });
-  }
-  const id = readNonEmptyString(value, path2, "id", issues);
-  if (id !== null && !/^[A-Za-z0-9._-]+$/.test(id)) {
-    issues.push({ path: `${path2}.id`, message: "expected id with letters, numbers, dots, underscores, or hyphens" });
-  }
-  const prompt = readNonEmptyString(value, path2, "prompt", issues);
-  const cwd = readNonEmptyString(value, path2, "cwd", issues);
-  if (cwd !== null && isAbsolute(cwd)) {
-    issues.push({ path: `${path2}.cwd`, message: "expected repo-local relative path" });
-  }
-  const setup = readStringArray(value, path2, "setup", issues, true);
-  const verifier = readStringArray(value, path2, "verifier", issues, false);
-  if (verifier !== null && verifier.length === 0) {
-    issues.push({ path: `${path2}.verifier`, message: "expected at least one command" });
-  }
-  const timeoutMs = readPositiveInteger(value, path2, "timeoutMs", issues);
-  const tags = readStringArray(value, path2, "tags", issues, true);
-  if (id === null || prompt === null || cwd === null || setup === null || verifier === null || timeoutMs === null) {
-    return null;
-  }
-  return { id, prompt, cwd, setup, verifier, timeoutMs, tags: tags ?? [] };
-}
-function validateTaskCwds(tasks, baseDir) {
-  const issues = [];
-  for (let index = 0; index < tasks.length; index += 1) {
-    const task = tasks[index];
-    if (task === void 0) continue;
-    const resolved = resolve(baseDir, task.cwd);
-    const rel = relative(baseDir, resolved);
-    if (rel === "" || !rel.startsWith("..") && !isAbsolute(rel)) continue;
-    issues.push({ path: `$.tasks[${index}].cwd`, message: "cwd must stay within the task file directory" });
-  }
-  return issues;
-}
-function readNonEmptyString(record, path2, field, issues) {
-  const value = record[field];
-  if (typeof value !== "string" || value.trim().length === 0) {
-    issues.push({ path: `${path2}.${field}`, message: "expected non-empty string" });
-    return null;
-  }
-  return value;
-}
-function readStringArray(record, path2, field, issues, allowMissing) {
-  const value = record[field];
-  if (value === void 0 && allowMissing) return [];
-  if (!Array.isArray(value)) {
-    issues.push({ path: `${path2}.${field}`, message: "expected string array" });
-    return null;
-  }
-  const out = [];
-  for (let index = 0; index < value.length; index += 1) {
-    const entry = value[index];
-    if (typeof entry !== "string" || entry.trim().length === 0) {
-      issues.push({ path: `${path2}.${field}[${index}]`, message: "expected non-empty string" });
-      continue;
-    }
-    out.push(entry);
-  }
-  return out;
-}
-function readPositiveInteger(record, path2, field, issues) {
-  const value = record[field];
-  if (typeof value !== "number" || !Number.isInteger(value) || value <= 0) {
-    issues.push({ path: `${path2}.${field}`, message: "expected positive integer" });
-    return null;
-  }
-  return value;
-}
-function isRecord3(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function sha256Hex(content) {
-  return createHash3("sha256").update(content, "utf8").digest("hex");
-}
-
-// src/domains/eval/run-compare.ts
-init_esm_shims();
-var EvalTrackedMetricSourceMismatchError = class extends Error {
-  constructor(metric, baseline, candidate) {
-    super(
-      `tracked metric ${metric} cannot compare estimated and measured values (baseline=${baseline.join(",") || "none"}, candidate=${candidate.join(",") || "none"})`
-    );
-    this.name = "EvalTrackedMetricSourceMismatchError";
-  }
-};
-function assertComparableTrackedMetricSources(metric, baseline, candidate) {
-  if (baseline.includes("estimated") === candidate.includes("estimated")) return;
-  throw new EvalTrackedMetricSourceMismatchError(metric, baseline, candidate);
-}
-
-// src/domains/prompts/fragment-loader.ts
-init_esm_shims();
-var import_yaml2 = __toESM(require_dist(), 1);
-import { readdirSync, readFileSync } from "node:fs";
-import path from "node:path";
-var frontmatterRegex = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/;
-var fragmentIdRegex = /^[a-z0-9-]+(?:\.[a-z0-9-]+)+$/;
-function defaultRootDir() {
-  return path.join(resolvePackageRoot(), "src", "domains", "prompts", "fragments");
-}
-function walk(root) {
-  const out = [];
-  let entries;
-  try {
-    entries = readdirSync(root, { withFileTypes: true });
-  } catch {
-    return out;
-  }
-  for (const entry of entries) {
-    const full = path.join(root, entry.name);
-    if (entry.isDirectory()) {
-      out.push(...walk(full));
-      continue;
-    }
-    if (entry.isFile() && entry.name.endsWith(".md")) {
-      out.push(full);
-    }
-  }
-  return out.sort((left, right) => left.localeCompare(right));
-}
-function parseFragment(filePath, rootDir) {
-  const raw = readFileSync(filePath, "utf8");
-  const rawRel = path.relative(rootDir, filePath);
-  const relPath = rawRel.split(path.sep).join("/");
-  const match = raw.match(frontmatterRegex);
-  if (!match) {
-    throw new Error(`fragment-loader: ${relPath}: missing or malformed YAML frontmatter`);
-  }
-  const frontmatterText = match[1] ?? "";
-  const body = match[2] ?? "";
-  let parsed;
-  try {
-    parsed = import_yaml2.default.parse(frontmatterText);
-  } catch (err) {
-    const reason = err instanceof Error ? err.message : String(err);
-    throw new Error(`fragment-loader: ${relPath}: invalid YAML frontmatter (${reason})`);
-  }
-  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error(`fragment-loader: ${relPath}: frontmatter must be a YAML object`);
-  }
-  const fm = parsed;
-  const id = fm.id;
-  if (typeof id !== "string" || !fragmentIdRegex.test(id)) {
-    throw new Error(`fragment-loader: ${relPath}: frontmatter.id must be a dot-separated namespace`);
-  }
-  const version = fm.version;
-  if (version !== 1) {
-    throw new Error(`fragment-loader: ${relPath}: frontmatter.version must be 1`);
-  }
-  const description = fm.description;
-  if (typeof description !== "string" || description.trim() === "") {
-    throw new Error(`fragment-loader: ${relPath}: frontmatter.description must be a non-empty string`);
-  }
-  const dynamicRaw = fm.dynamic;
-  if (dynamicRaw !== void 0 && typeof dynamicRaw !== "boolean") {
-    throw new Error(`fragment-loader: ${relPath}: frontmatter.dynamic must be a boolean when present`);
-  }
-  return {
-    path: filePath,
-    relPath,
-    id,
-    version,
-    description,
-    dynamic: dynamicRaw === true,
-    body,
-    contentHash: sha256(raw)
-  };
-}
-function loadFragments(options) {
-  const rootDir = typeof options === "string" ? options : options?.rootDir;
-  const resolvedRoot = rootDir ? path.resolve(rootDir) : defaultRootDir();
-  const files = walk(resolvedRoot);
-  const byId = /* @__PURE__ */ new Map();
-  for (const file of files) {
-    const fragment = parseFragment(file, resolvedRoot);
-    const existing = byId.get(fragment.id);
-    if (existing) {
-      throw new Error(
-        `fragment-loader: duplicate fragment id "${fragment.id}" in ${existing.relPath} and ${fragment.relPath}`
-      );
-    }
-    byId.set(fragment.id, fragment);
-  }
-  return { byId, rootDir: resolvedRoot };
-}
-
-export {
-  renderCodewikiDigest,
-  sha256,
-  canonicalJson,
-  RUN_RECEIPT_INTEGRITY_VERSION,
-  RUN_RECEIPT_INTEGRITY_ALGORITHM,
-  withReceiptIntegrity,
-  isReceiptIntegrity,
-  verifyReceiptIntegrity,
-  TRUST_STATUS_VERSION,
-  TRUST_STATUS_MAX_ARTIFACT_REFERENCES,
-  TRUST_STATUS_MAX_IDENTIFIER_LENGTH,
-  TRUST_STATUS_AXES,
-  TRUST_STATUS_STATES,
-  isTrustStatusIdentifier,
-  normalizeTrustStatus,
-  validateTrustStatus,
-  absentTrustStatus,
-  composeTrustStatus,
-  projectTrustStatus,
-  retiredReceiptIntegrity,
-  retiredReceiptIntegrityReason,
-  verifyReceiptIntegrityOutcome,
-  retiredIntegrityVersionOf,
-  adaptReceiptIntegrityStatus,
-  adaptRunReceiptValidationStatus,
-  adaptRunReceiptContextStatus,
-  adaptRunReceiptAutonomyStatus,
-  adaptRunReceiptTrustStatus,
-  inspectRunReceiptTrustStatus,
-  adaptGateDecisionReviewStatus,
-  adaptGroundedEvidenceValidationStatus,
-  adaptFinishContractCompletionStatus,
-  TRUST_SUMMARY_VERSION,
-  TRUST_SUMMARY_MAX_REFS,
-  TRUST_VERDICTS,
-  TRUST_STATE_WORDS,
-  trustStateWord,
-  formatTrustSummary,
-  formatTrustSummaryLine,
-  formatTrustAxes,
-  trustVerdict,
-  trustSummaryReferences,
-  summarizeTrustStatus,
-  evalClioProvenance,
-  evalEnvironmentProvenance,
-  evalServingConfiguration,
-  evalServingObservationFrom,
-  assertComparableTrackedMetricSources,
-  loadEvalTaskFile,
-  EvalTaskFileError,
-  loadFragments
-};
-//# sourceMappingURL=chunk-IALZJE37.js.map