@isaacriehm/cairn-core 0.1.0

package/dist/ground/scope-index.js

@@ -0,0 +1,120 @@
+/**
+ * Scope index — forward map from every file path in the repo to the decisions
+ * and invariants that apply to that file.
+ *
+ * Built at init by the Tier-2 mapper LLM, maintained by the daemon. Read by
+ * the read-enricher / write-guardian hooks (via cached accessor in
+ * `hooks/post-tool-use/ledger-cache.ts`) and by the GC scope-coverage pass.
+ *
+ * Spec: docs/DOCS_SPEC.md §3.8.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
+import { detectAll } from "../init/detect.js";
+import { buildMapperUserPrompt, MAPPER_OUTPUT_SCHEMA, MAPPER_SYSTEM_PROMPT, validateMapperOutput, } from "../init/mapper.js";
+import { buildRepoSummary } from "../init/walker.js";
+import { logger } from "../logger.js";
+import { runClaude } from "../claude/index.js";
+export function scopeIndexPath(repoRoot) {
+    return join(repoRoot, ".cairn", "ground", "scope-index.yaml");
+}
+export function readScopeIndex(repoRoot) {
+    const path = scopeIndexPath(repoRoot);
+    if (!existsSync(path))
+        return null;
+    let parsed;
+    try {
+        parsed = parseYaml(readFileSync(path, "utf8"));
+    }
+    catch {
+        return null;
+    }
+    if (typeof parsed !== "object" || parsed === null)
+        return null;
+    const generated = typeof parsed["generated"] === "string"
+        ? parsed["generated"]
+        : new Date().toISOString();
+    const filesRaw = parsed["files"];
+    const files = {};
+    if (typeof filesRaw === "object" && filesRaw !== null) {
+        for (const [k, v] of Object.entries(filesRaw)) {
+            if (typeof v !== "object" || v === null)
+                continue;
+            const e = v;
+            const decisions = Array.isArray(e["decisions"])
+                ? e["decisions"].filter((x) => typeof x === "string")
+                : [];
+            const invariants = Array.isArray(e["invariants"])
+                ? e["invariants"].filter((x) => typeof x === "string")
+                : [];
+            const entry = { decisions, invariants };
+            if (e["unscoped"] === true)
+                entry.unscoped = true;
+            files[k] = entry;
+        }
+    }
+    return { generated, files };
+}
+export function lookupScope(index, repoRelativePath) {
+    const entry = index.files[repoRelativePath];
+    if (entry === undefined)
+        return null;
+    return entry;
+}
+export function writeScopeIndex(repoRoot, index) {
+    const path = scopeIndexPath(repoRoot);
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, stringifyYaml(index), "utf8");
+}
+const log = logger("ground.scope-index");
+/**
+ * Re-run the init mapper LLM scoped to the scope-index field of its output and
+ * write the result to `.cairn/ground/scope-index.yaml`. Used by the
+ * `cairn scope rebuild` CLI subcommand to populate scope coverage after
+ * decisions/invariants land — the init-time skeleton ships empty.
+ *
+ * Throws if the LLM call fails. Caller (CLI) catches and prints a user-facing
+ * error.
+ */
+export async function rebuildScopeIndex(opts) {
+    const detection = await detectAll(opts.repoRoot);
+    const summary = buildRepoSummary({ repoRoot: opts.repoRoot });
+    const userPrompt = buildMapperUserPrompt({ detection, summary });
+    log.info({
+        slug: detection.project_slug,
+        total_files: summary.total_files,
+    }, "scope rebuild — mapper dispatch");
+    const result = await runClaude({
+        tier: "sonnet",
+        prompt: userPrompt,
+        system: MAPPER_SYSTEM_PROMPT,
+        jsonSchema: MAPPER_OUTPUT_SCHEMA,
+        timeoutMs: opts.timeoutMs ?? 300_000,
+    });
+    const mapperOutput = validateMapperOutput(result.parsed);
+    const scopeIndex = mapperOutput.scope_index;
+    // Coerce mapper-shape `unscoped: boolean` → ground-shape `unscoped: true`.
+    const files = {};
+    for (const [path, e] of Object.entries(scopeIndex.files)) {
+        const entry = {
+            decisions: e.decisions,
+            invariants: e.invariants,
+        };
+        if (e.unscoped === true)
+            entry.unscoped = true;
+        files[path] = entry;
+    }
+    const next = {
+        generated: new Date().toISOString(),
+        files,
+    };
+    writeScopeIndex(opts.repoRoot, next);
+    return {
+        path: scopeIndexPath(opts.repoRoot),
+        filesClassified: Object.keys(files).length,
+        mapperDurationMs: result.durationMs,
+        model: result.model,
+    };
+}
+//# sourceMappingURL=scope-index.js.map

package/dist/ground/scope-index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-index.js","sourceRoot":"","sources":["../../src/ground/scope-index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,GAGrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAa/C,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,OAAO,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,SAAS,GACb,OAAQ,MAAkC,CAAC,WAAW,CAAC,KAAK,QAAQ;QAClE,CAAC,CAAG,MAAkC,CAAC,WAAW,CAAY;QAC9D,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAI,MAAkC,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAoC,EAAE,CAAC;IAClD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;gBAAE,SAAS;YAClD,MAAM,CAAC,GAAG,CAA4B,CAAC;YACvC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;gBAC7C,CAAC,CAAE,CAAC,CAAC,WAAW,CAAe,CAAC,MAAM,CAClC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAC1C;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;gBAC/C,CAAC,CAAE,CAAC,CAAC,YAAY,CAAe,CAAC,MAAM,CACnC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAC1C;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,KAAK,GAAoB,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;YACzD,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,IAAI;gBAAE,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;YAClD,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,KAAiB,EACjB,gBAAwB;IAExB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC5C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,KAAiB;IACjE,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACtC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,GAAG,GAAG,MAAM,CAAC,oBAAoB,CAAC,CAAC;AAmBzC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAA8B;IAE9B,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,qBAAqB,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;IAEjE,GAAG,CAAC,IAAI,CACN;QACE,IAAI,EAAE,SAAS,CAAC,YAAY;QAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,EACD,iCAAiC,CAClC,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC;QAC7B,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,UAAU;QAClB,MAAM,EAAE,oBAAoB;QAC5B,UAAU,EAAE,oBAA8B;QAC1C,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,OAAO;KACrC,CAAC,CAAC;IACH,MAAM,YAAY,GAAiB,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvE,MAAM,UAAU,GAAqB,YAAY,CAAC,WAAW,CAAC;IAE9D,2EAA2E;IAC3E,MAAM,KAAK,GAAoC,EAAE,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,KAAK,GAAoB;YAC7B,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,UAAU,EAAE,CAAC,CAAC,UAAU;SACzB,CAAC;QACF,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI;YAAE,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,MAAM,IAAI,GAAe;QACvB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,KAAK;KACN,CAAC;IACF,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAErC,OAAO;QACL,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC;QACnC,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM;QAC1C,gBAAgB,EAAE,MAAM,CAAC,UAAU;QACnC,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;AACJ,CAAC"}

package/dist/ground/walk.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Walks the repo from root and returns every file (relative to root) that
+ * matches CANONICAL_GLOBS and is not excluded by CANONICAL_EXCLUDES.
+ *
+ * Skips heavyweight noise dirs (.git, node_modules, dist, etc.) eagerly.
+ */
+export declare function walkCanonical(repoRoot: string): string[];

package/dist/ground/walk.js

@@ -0,0 +1,53 @@
+import { readdirSync } from "node:fs";
+import { relative, resolve } from "node:path";
+import { CANONICAL_EXCLUDES, CANONICAL_GLOBS } from "./paths.js";
+import { matchAnyGlob } from "./glob.js";
+const SKIP_DIRS = new Set([
+    ".git",
+    "node_modules",
+    ".pnpm-store",
+    "dist",
+    ".next",
+    ".turbo",
+    ".cache",
+    ".archive",
+]);
+/**
+ * Walks the repo from root and returns every file (relative to root) that
+ * matches CANONICAL_GLOBS and is not excluded by CANONICAL_EXCLUDES.
+ *
+ * Skips heavyweight noise dirs (.git, node_modules, dist, etc.) eagerly.
+ */
+export function walkCanonical(repoRoot) {
+    const out = [];
+    const stack = [repoRoot];
+    while (stack.length > 0) {
+        const dir = stack.pop();
+        if (dir === undefined)
+            break;
+        let entries;
+        try {
+            entries = readdirSync(dir, { withFileTypes: true, encoding: "utf8" });
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            const abs = resolve(dir, entry.name);
+            if (entry.isDirectory()) {
+                if (SKIP_DIRS.has(entry.name))
+                    continue;
+                stack.push(abs);
+            }
+            else if (entry.isFile()) {
+                const rel = relative(repoRoot, abs).replace(/\\/g, "/");
+                if (matchAnyGlob(rel, CANONICAL_GLOBS) && !matchAnyGlob(rel, CANONICAL_EXCLUDES)) {
+                    out.push(rel);
+                }
+            }
+        }
+    }
+    out.sort();
+    return out;
+}
+//# sourceMappingURL=walk.js.map

package/dist/ground/walk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"walk.js","sourceRoot":"","sources":["../../src/ground/walk.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,WAAW,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,MAAM;IACN,cAAc;IACd,aAAa;IACb,MAAM;IACN,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,UAAU;CACX,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,KAAK,GAAa,CAAC,QAAQ,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;QACxB,IAAI,GAAG,KAAK,SAAS;YAAE,MAAM;QAC7B,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAE,SAAS;gBACxC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClB,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBACxD,IAAI,YAAY,CAAC,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,kBAAkB,CAAC,EAAE,CAAC;oBACjF,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAChB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,GAAG,CAAC,IAAI,EAAE,CAAC;IACX,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/hooks/bypass-detection.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Bypass detection — Stop hook layer that catches `git commit --no-verify`.
+ *
+ * Spec: PLUGIN_ARCHITECTURE §17 Layer 1 (bypass tracking).
+ *
+ * The post-commit hook appends every successfully-attested SHA to
+ * `.cairn/.attested-commits` (gitignored, per-clone). On every Stop hook
+ * we read that file + the last 5 SHAs from `git log` and surface any HEAD
+ * commit that isn't in the attested set.
+ *
+ * Pure functions on top of git + filesystem reads. No mutation. The Stop
+ * hook calls `scanBypassedCommits(repoRoot)` and renders the inline A/B/C
+ * via `renderBypassHint`.
+ */
+export interface BypassedCommit {
+    sha: string;
+    shortSha: string;
+    subject: string;
+}
+export interface ScanBypassResult {
+    bypassed: BypassedCommit[];
+    /** Total HEAD commits inspected (≤ 5). */
+    inspected: number;
+    /** True when `.cairn/.attested-commits` exists (even if empty). */
+    attestedFileExists: boolean;
+}
+export declare function scanBypassedCommits(repoRoot: string): ScanBypassResult;
+export declare function renderBypassHint(bypassed: BypassedCommit[]): string;

package/dist/hooks/bypass-detection.js

@@ -0,0 +1,106 @@
+/**
+ * Bypass detection — Stop hook layer that catches `git commit --no-verify`.
+ *
+ * Spec: PLUGIN_ARCHITECTURE §17 Layer 1 (bypass tracking).
+ *
+ * The post-commit hook appends every successfully-attested SHA to
+ * `.cairn/.attested-commits` (gitignored, per-clone). On every Stop hook
+ * we read that file + the last 5 SHAs from `git log` and surface any HEAD
+ * commit that isn't in the attested set.
+ *
+ * Pure functions on top of git + filesystem reads. No mutation. The Stop
+ * hook calls `scanBypassedCommits(repoRoot)` and renders the inline A/B/C
+ * via `renderBypassHint`.
+ */
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+const HEAD_LOOKBACK = 5;
+export function scanBypassedCommits(repoRoot) {
+    if (!existsSync(join(repoRoot, ".git"))) {
+        return { bypassed: [], inspected: 0, attestedFileExists: false };
+    }
+    const recent = readRecentHead(repoRoot);
+    if (recent.length === 0) {
+        return { bypassed: [], inspected: 0, attestedFileExists: false };
+    }
+    const attested = readAttestedCommits(repoRoot);
+    const bypassed = [];
+    for (const c of recent) {
+        if (attested.has(c.sha))
+            continue;
+        bypassed.push(c);
+    }
+    return {
+        bypassed,
+        inspected: recent.length,
+        attestedFileExists: existsSync(join(repoRoot, ".cairn", ".attested-commits")),
+    };
+}
+export function renderBypassHint(bypassed) {
+    const lines = [];
+    lines.push(`## Bypass detection — ${bypassed.length} commit${bypassed.length === 1 ? "" : "s"} not attested`);
+    lines.push("");
+    lines.push("The following HEAD commit" +
+        (bypassed.length === 1 ? " was" : "s were") +
+        " not recorded by cairn's post-commit hook. Likely cause: " +
+        "`git commit --no-verify` (or the hook ran before `cairn join` " +
+        "set `core.hooksPath`).");
+    lines.push("");
+    for (const c of bypassed) {
+        lines.push(`- \`${c.shortSha}\` — ${c.subject}`);
+    }
+    lines.push("");
+    lines.push("Surface inline to the operator now:");
+    lines.push("");
+    lines.push("> Some recent commits weren't attested by cairn. Pick one:");
+    lines.push("> `[a]` backfill — run `cairn sweep` to attest sensors retroactively");
+    lines.push("> `[b]` accept — record a DEC noting the bypass + reason");
+    lines.push("> `[c]` defer — keep the warning, address later");
+    return lines.join("\n");
+}
+/* -------------------------------------------------------------------------- */
+/* Internals                                                                  */
+/* -------------------------------------------------------------------------- */
+function readRecentHead(repoRoot) {
+    try {
+        const out = execFileSync("git", ["log", `-n${HEAD_LOOKBACK}`, "--format=%H%x09%s"], { cwd: repoRoot, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+        const result = [];
+        for (const line of out.split("\n")) {
+            if (line.length === 0)
+                continue;
+            const tabIdx = line.indexOf("\t");
+            if (tabIdx === -1)
+                continue;
+            const sha = line.slice(0, tabIdx);
+            const subject = line.slice(tabIdx + 1);
+            if (sha.length < 7)
+                continue;
+            result.push({ sha, shortSha: sha.slice(0, 7), subject });
+        }
+        return result;
+    }
+    catch {
+        return [];
+    }
+}
+function readAttestedCommits(repoRoot) {
+    const path = join(repoRoot, ".cairn", ".attested-commits");
+    if (!existsSync(path))
+        return new Set();
+    try {
+        const body = readFileSync(path, "utf8");
+        const set = new Set();
+        for (const raw of body.split("\n")) {
+            const line = raw.trim();
+            if (line.length === 0)
+                continue;
+            set.add(line);
+        }
+        return set;
+    }
+    catch {
+        return new Set();
+    }
+}
+//# sourceMappingURL=bypass-detection.js.map

package/dist/hooks/bypass-detection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bypass-detection.js","sourceRoot":"","sources":["../../src/hooks/bypass-detection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAgBjC,MAAM,aAAa,GAAG,CAAC,CAAC;AAExB,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC;IACnE,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC;IACnE,CAAC;IACD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAAE,SAAS;QAClC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,OAAO;QACL,QAAQ;QACR,SAAS,EAAE,MAAM,CAAC,MAAM;QACxB,kBAAkB,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAC;KAC9E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAA0B;IACzD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CACR,yBAAyB,QAAQ,CAAC,MAAM,UAAU,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,eAAe,CAClG,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CACR,2BAA2B;QACzB,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC3C,2DAA2D;QAC3D,gEAAgE;QAChE,wBAAwB,CAC3B,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IAClD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;IACzE,KAAK,CAAC,IAAI,CAAC,sEAAsE,CAAC,CAAC;IACnF,KAAK,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;IACvE,KAAK,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;IAC9D,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,SAAS,cAAc,CAAC,QAAgB;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CACtB,KAAK,EACL,CAAC,KAAK,EAAE,KAAK,aAAa,EAAE,EAAE,mBAAmB,CAAC,EAClD,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CACzE,CAAC;QACF,MAAM,MAAM,GAAqB,EAAE,CAAC;QACpC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAChC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,MAAM,KAAK,CAAC,CAAC;gBAAE,SAAS;YAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YAClC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACvC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;gBAAE,SAAS;YAC7B,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;QAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAChC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/hooks/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Claude Code hooks — runner functions + bin entrypoints.
+ *
+ * Bin entrypoints live at `dist/hooks/<event>.js` (one per event) so
+ * the plugin manifest can invoke them via
+ * `node ${CLAUDE_PLUGIN_ROOT}/../cairn-core/dist/hooks/<event>.js`
+ * without depending on the `cairn` umbrella CLI being on PATH.
+ *
+ * The umbrella CLI's `cairn hook <event>` calls the same runners.
+ */
+export * from "./runners/index.js";
+export * from "./post-tool-use/index.js";

package/dist/hooks/index.js

@@ -0,0 +1,13 @@
+/**
+ * Claude Code hooks — runner functions + bin entrypoints.
+ *
+ * Bin entrypoints live at `dist/hooks/<event>.js` (one per event) so
+ * the plugin manifest can invoke them via
+ * `node ${CLAUDE_PLUGIN_ROOT}/../cairn-core/dist/hooks/<event>.js`
+ * without depending on the `cairn` umbrella CLI being on PATH.
+ *
+ * The umbrella CLI's `cairn hook <event>` calls the same runners.
+ */
+export * from "./runners/index.js";
+export * from "./post-tool-use/index.js";
+//# sourceMappingURL=index.js.map

package/dist/hooks/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/hooks/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC"}

package/dist/hooks/post-tool-use/allowlist-reader.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Reads `copy_safety` configuration from
+ * `.cairn/config/sensors.yaml`. Consumed by the PostToolUse Write
+ * guardian and (later) by the Layer D copy-safety sensor.
+ *
+ * Falls back to hardcoded defaults if the file is missing or
+ * unparseable — the guardian must never block on configuration.
+ */
+export interface CopySafetyConfig {
+    enabled: boolean;
+    globs: string[];
+    allowlist: string[];
+}
+export declare function readCopySafetyConfig(repoRoot: string): CopySafetyConfig;

package/dist/hooks/post-tool-use/allowlist-reader.js

@@ -0,0 +1,69 @@
+/**
+ * Reads `copy_safety` configuration from
+ * `.cairn/config/sensors.yaml`. Consumed by the PostToolUse Write
+ * guardian and (later) by the Layer D copy-safety sensor.
+ *
+ * Falls back to hardcoded defaults if the file is missing or
+ * unparseable — the guardian must never block on configuration.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { parse as parseYaml } from "yaml";
+const DEFAULT = {
+    enabled: true,
+    globs: [
+        "src/**/*.tsx",
+        "src/**/*.jsx",
+        "src/**/*.vue",
+        "src/**/*.svelte",
+        "**/*.html",
+        "src/**/i18n/**/*.json",
+        "src/**/locales/**/*.json",
+    ],
+    allowlist: [],
+};
+function defaultsCopy() {
+    return {
+        enabled: DEFAULT.enabled,
+        globs: [...DEFAULT.globs],
+        allowlist: [...DEFAULT.allowlist],
+    };
+}
+function asStringArray(value) {
+    if (!Array.isArray(value))
+        return null;
+    const out = [];
+    for (const v of value) {
+        if (typeof v === "string")
+            out.push(v);
+    }
+    return out;
+}
+export function readCopySafetyConfig(repoRoot) {
+    const path = join(repoRoot, ".cairn", "config", "sensors.yaml");
+    if (!existsSync(path))
+        return defaultsCopy();
+    let parsed;
+    try {
+        parsed = parseYaml(readFileSync(path, "utf8"));
+    }
+    catch {
+        return defaultsCopy();
+    }
+    if (typeof parsed !== "object" || parsed === null)
+        return defaultsCopy();
+    const raw = parsed.copy_safety;
+    if (typeof raw !== "object" || raw === null)
+        return defaultsCopy();
+    const block = raw;
+    const enabledRaw = block["enabled"];
+    const enabled = typeof enabledRaw === "boolean" ? enabledRaw : DEFAULT.enabled;
+    const globsParsed = asStringArray(block["globs"]);
+    const globs = globsParsed !== null && globsParsed.length > 0
+        ? globsParsed
+        : [...DEFAULT.globs];
+    const allowlistParsed = asStringArray(block["allowlist"]);
+    const allowlist = allowlistParsed !== null ? allowlistParsed : [];
+    return { enabled, globs, allowlist };
+}
+//# sourceMappingURL=allowlist-reader.js.map

package/dist/hooks/post-tool-use/allowlist-reader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowlist-reader.js","sourceRoot":"","sources":["../../../src/hooks/post-tool-use/allowlist-reader.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAQ1C,MAAM,OAAO,GAAqB;IAChC,OAAO,EAAE,IAAI;IACb,KAAK,EAAE;QACL,cAAc;QACd,cAAc;QACd,cAAc;QACd,iBAAiB;QACjB,WAAW;QACX,uBAAuB;QACvB,0BAA0B;KAC3B;IACD,SAAS,EAAE,EAAE;CACd,CAAC;AAEF,SAAS,YAAY;IACnB,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC;QACzB,SAAS,EAAE,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;IAChE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,YAAY,EAAE,CAAC;IAE7C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,YAAY,EAAE,CAAC;IACxB,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,YAAY,EAAE,CAAC;IAEzE,MAAM,GAAG,GAAI,MAAoC,CAAC,WAAW,CAAC;IAC9D,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,YAAY,EAAE,CAAC;IAEnE,MAAM,KAAK,GAAG,GAA8B,CAAC;IAE7C,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;IACpC,MAAM,OAAO,GACX,OAAO,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAEjE,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,MAAM,KAAK,GACT,WAAW,KAAK,IAAI,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QAC5C,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAEzB,MAAM,eAAe,GAAG,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;IAElE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AACvC,CAAC"}

package/dist/hooks/post-tool-use/citation-scanner.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Scans the visible body of a Read tool's content for cairn citation
+ * patterns: §V invariants, TODO(TSK-...) linked todos, and (banned)
+ * DEC-id references.
+ *
+ * Per READ_ENRICHER_SPEC §3 — line numbers in the legend should reflect
+ * the original source line, so when content is `cat -n`-prefixed
+ * (`<num>\t<line>`), strip the prefix for matching but use the prefix
+ * number as the reported line. The body text itself is NEVER mutated.
+ */
+export interface CitationMatch {
+    /** Citation id, e.g. "V0023" or "TSK-auth-refactor" or "DEC-0042". */
+    id: string;
+    /** 1-indexed line number from cat -n prefix, or iteration index. */
+    line: number;
+}
+export interface ScannedCitations {
+    invariants: CitationMatch[];
+    todos: CitationMatch[];
+    /** Banned DEC-N citations — for the policy-violation legend. */
+    decIds: CitationMatch[];
+}
+export declare function scanCitations(content: string): ScannedCitations;

package/dist/hooks/post-tool-use/citation-scanner.js

@@ -0,0 +1,59 @@
+/**
+ * Scans the visible body of a Read tool's content for cairn citation
+ * patterns: §V invariants, TODO(TSK-...) linked todos, and (banned)
+ * DEC-id references.
+ *
+ * Per READ_ENRICHER_SPEC §3 — line numbers in the legend should reflect
+ * the original source line, so when content is `cat -n`-prefixed
+ * (`<num>\t<line>`), strip the prefix for matching but use the prefix
+ * number as the reported line. The body text itself is NEVER mutated.
+ */
+const INVARIANT_RE = /§V(\d+)/g;
+const TODO_RE = /TODO\(TSK-([^)]+)\)/g;
+const DEC_RE = /DEC-(\d+)/g;
+const CAT_N_PREFIX_RE = /^(\d+)\t/;
+export function scanCitations(content) {
+    const invariants = [];
+    const todos = [];
+    const decIds = [];
+    if (content.length === 0) {
+        return { invariants, todos, decIds };
+    }
+    const lines = content.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i] ?? "";
+        const prefixMatch = raw.match(CAT_N_PREFIX_RE);
+        let lineText;
+        let lineNumber;
+        if (prefixMatch) {
+            const num = Number.parseInt(prefixMatch[1] ?? "", 10);
+            lineNumber = Number.isFinite(num) && num > 0 ? num : i + 1;
+            lineText = raw.slice(prefixMatch[0].length);
+        }
+        else {
+            lineNumber = i + 1;
+            lineText = raw;
+        }
+        // Reset lastIndex implicitly via fresh matchAll calls.
+        for (const m of lineText.matchAll(INVARIANT_RE)) {
+            const digits = m[1];
+            if (digits === undefined)
+                continue;
+            invariants.push({ id: `V${digits}`, line: lineNumber });
+        }
+        for (const m of lineText.matchAll(TODO_RE)) {
+            const tail = m[1];
+            if (tail === undefined)
+                continue;
+            todos.push({ id: `TSK-${tail}`, line: lineNumber });
+        }
+        for (const m of lineText.matchAll(DEC_RE)) {
+            const digits = m[1];
+            if (digits === undefined)
+                continue;
+            decIds.push({ id: `DEC-${digits}`, line: lineNumber });
+        }
+    }
+    return { invariants, todos, decIds };
+}
+//# sourceMappingURL=citation-scanner.js.map

package/dist/hooks/post-tool-use/citation-scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"citation-scanner.js","sourceRoot":"","sources":["../../../src/hooks/post-tool-use/citation-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAgBH,MAAM,YAAY,GAAG,UAAU,CAAC;AAChC,MAAM,OAAO,GAAG,sBAAsB,CAAC;AACvC,MAAM,MAAM,GAAG,YAAY,CAAC;AAC5B,MAAM,eAAe,GAAG,UAAU,CAAC;AAEnC,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,UAAU,GAAoB,EAAE,CAAC;IACvC,MAAM,KAAK,GAAoB,EAAE,CAAC;IAClC,MAAM,MAAM,GAAoB,EAAE,CAAC;IAEnC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAC/C,IAAI,QAAgB,CAAC;QACrB,IAAI,UAAkB,CAAC;QACvB,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YACtD,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC3D,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,CAAC,GAAG,CAAC,CAAC;YACnB,QAAQ,GAAG,GAAG,CAAC;QACjB,CAAC;QAED,uDAAuD;QACvD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,MAAM,KAAK,SAAS;gBAAE,SAAS;YACnC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAClB,IAAI,IAAI,KAAK,SAAS;gBAAE,SAAS;YACjC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,MAAM,KAAK,SAAS;gBAAE,SAAS;YACnC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACvC,CAAC"}

package/dist/hooks/post-tool-use/copy-scanner.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Copy-safety scanner for the PostToolUse Write/Edit guardian.
+ *
+ * Given a file path and its (post-Write/Edit) content, locate strings
+ * that look like internal-only copy leaking into a user-facing surface
+ * (TODO/FIXME comments inside JSX text, cairn citations, snake_case
+ * identifiers in display strings, internal repo paths, etc.).
+ *
+ * Implementation is intentionally regex-only — NOT a full AST. For
+ * `.tsx`/`.jsx` we extract the contents of string/template literals and
+ * the text between `>` and `<`/`{` in JSX. For `.json` we walk values
+ * (skipping keys). For `.html`/`.vue`/`.svelte` and any other extension
+ * we scan the entire content.
+ *
+ * Spec: docs/READ_ENRICHER_SPEC.md "Write Guardian" section.
+ */
+export interface CopyIssue {
+    /** 1-indexed line where match occurred. */
+    line: number;
+    /** Verbatim matched text — used for allowlist comparison. */
+    match: string;
+    /** Human-readable pattern label, e.g. "comment-marker". */
+    pattern: string;
+}
+export declare function scanForCopyLeakage(content: string, filePath: string): CopyIssue[];