@jeger-ai/opengantry 1.1.2 → 2.1.0

package/dist/cli/lib/surgeon.d.ts

@@ -0,0 +1,23 @@
+/** Append immutable surgeon mutation line to WORKER_LOG (fail-closed if missing). */
+export declare function appendSurgeonMutationLog(workerLogPath: string, summary: string): void;
+export declare function ensureWorkerLogExists(workerLogPath: string): void;
+/** Structured import-layer gate report (check-import-layers.mjs --json). */
+export interface ImportLayerViolation {
+    file: string;
+    rule_id: string;
+    module_specifier: string;
+    bindings: string[];
+    line: number;
+    column: number;
+}
+export interface ImportLayerGateReport {
+    schema_version: number;
+    ok: boolean;
+    violations: ImportLayerViolation[];
+}
+/** Parse versioned JSON gate output; null when not a valid import-layer report. */
+export declare function parseImportLayerGateJson(text: string): ImportLayerGateReport | null;
+export declare function gateOutputIndicatesImportLayer(text: string): boolean;
+/** Extract import-layer report from gate stdout/stderr (prefer stdout). */
+export declare function extractImportLayerGateReport(gateStdout: string, gateStderr: string): ImportLayerGateReport | null;
+//# sourceMappingURL=surgeon.d.ts.map

package/dist/cli/lib/surgeon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"surgeon.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/surgeon.ts"],"names":[],"mappings":"AAIA,qFAAqF;AACrF,wBAAgB,wBAAwB,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAKrF;AAED,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAIjE;AAED,4EAA4E;AAC5E,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,qBAAqB;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,EAAE,EAAE,OAAO,CAAC;IACZ,UAAU,EAAE,oBAAoB,EAAE,CAAC;CACpC;AAeD,mFAAmF;AACnF,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,qBAAqB,GAAG,IAAI,CAoBnF;AAED,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGpE;AAED,2EAA2E;AAC3E,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,qBAAqB,GAAG,IAAI,CAEjH"}

package/dist/cli/lib/surgeon.js

@@ -0,0 +1,63 @@
+import fs from "node:fs";
+const MUTATION_PREFIX = "[SURGEON-MUTATION]";
+/** Append immutable surgeon mutation line to WORKER_LOG (fail-closed if missing). */
+export function appendSurgeonMutationLog(workerLogPath, summary) {
+    ensureWorkerLogExists(workerLogPath);
+    const line = summary.startsWith(MUTATION_PREFIX) ? summary : `${MUTATION_PREFIX} ${summary}`;
+    const suffix = line.endsWith("\n") ? line : `${line}\n`;
+    fs.appendFileSync(workerLogPath, suffix, { encoding: "utf8" });
+}
+export function ensureWorkerLogExists(workerLogPath) {
+    if (!fs.existsSync(workerLogPath)) {
+        fs.writeFileSync(workerLogPath, "", "utf8");
+    }
+}
+function isViolationRecord(v) {
+    if (typeof v !== "object" || v === null)
+        return false;
+    const o = v;
+    return (typeof o.file === "string" &&
+        typeof o.rule_id === "string" &&
+        typeof o.module_specifier === "string" &&
+        Array.isArray(o.bindings) &&
+        typeof o.line === "number" &&
+        typeof o.column === "number");
+}
+/** Parse versioned JSON gate output; null when not a valid import-layer report. */
+export function parseImportLayerGateJson(text) {
+    const trimmed = text.trim();
+    if (!trimmed.startsWith("{"))
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(trimmed);
+    }
+    catch {
+        return null;
+    }
+    if (typeof parsed !== "object" || parsed === null)
+        return null;
+    const o = parsed;
+    if (o.schema_version !== 1)
+        return null;
+    if (typeof o.ok !== "boolean")
+        return null;
+    if (!Array.isArray(o.violations))
+        return null;
+    if (!o.violations.every(isViolationRecord))
+        return null;
+    return {
+        schema_version: 1,
+        ok: o.ok,
+        violations: o.violations,
+    };
+}
+export function gateOutputIndicatesImportLayer(text) {
+    const report = parseImportLayerGateJson(text);
+    return report !== null && report.ok === false && report.violations.length > 0;
+}
+/** Extract import-layer report from gate stdout/stderr (prefer stdout). */
+export function extractImportLayerGateReport(gateStdout, gateStderr) {
+    return parseImportLayerGateJson(gateStdout) ?? parseImportLayerGateJson(gateStderr);
+}
+//# sourceMappingURL=surgeon.js.map

package/dist/cli/lib/surgeon.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"surgeon.js","sourceRoot":"","sources":["../../../src/cli/lib/surgeon.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAE7C,qFAAqF;AACrF,MAAM,UAAU,wBAAwB,CAAC,aAAqB,EAAE,OAAe;IAC7E,qBAAqB,CAAC,aAAa,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,eAAe,IAAI,OAAO,EAAE,CAAC;IAC7F,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC;IACxD,EAAE,CAAC,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,aAAqB;IACzD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAClC,EAAE,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAkBD,SAAS,iBAAiB,CAAC,CAAU;IACnC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,OAAO,CACL,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAC1B,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAC7B,OAAO,CAAC,CAAC,gBAAgB,KAAK,QAAQ;QACtC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;QACzB,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAC1B,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAC7B,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAY,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,CAAC,GAAG,MAAiC,CAAC;IAC5C,IAAI,CAAC,CAAC,cAAc,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,OAAO;QACL,cAAc,EAAE,CAAC;QACjB,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,UAAU,EAAE,CAAC,CAAC,UAAU;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,IAAY;IACzD,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAC9C,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;AAChF,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,4BAA4B,CAAC,UAAkB,EAAE,UAAkB;IACjF,OAAO,wBAAwB,CAAC,UAAU,CAAC,IAAI,wBAAwB,CAAC,UAAU,CAAC,CAAC;AACtF,CAAC"}

package/dist/cli/lib/surgeons/banned-import.d.ts

@@ -0,0 +1,4 @@
+import type { CodeSurgeon } from "./registry.js";
+export { quarantineBannedImportInFile } from "./quarantine-import.js";
+export declare const bannedImportSurgeon: CodeSurgeon;
+//# sourceMappingURL=banned-import.d.ts.map

package/dist/cli/lib/surgeons/banned-import.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"banned-import.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/surgeons/banned-import.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAyC,MAAM,eAAe,CAAC;AAIxF,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AAEtE,eAAO,MAAM,mBAAmB,EAAE,WAmCjC,CAAC"}

package/dist/cli/lib/surgeons/banned-import.js

@@ -0,0 +1,37 @@
+import path from "node:path";
+import { GXT_ERROR } from "../gxt-error-codes.js";
+import { parseBannedImportGateOutput } from "../banned-import-violation.js";
+import { quarantineImportDeclaration } from "./quarantine-import.js";
+const QUARANTINE_RULE = "RULE-BANNED-IMPORT";
+export { quarantineBannedImportInFile } from "./quarantine-import.js";
+export const bannedImportSurgeon = {
+    errorCode: GXT_ERROR.BANNED_IMPORT_DETECTED,
+    async applyMutation(context) {
+        const combined = `${context.failure.gateStderr ?? ""}\n${context.failure.gateStdout ?? ""}`;
+        const violations = parseBannedImportGateOutput(combined);
+        if (violations.length === 0) {
+            return { mutated: false, summary: "no banned-import violations parsed from gate output" };
+        }
+        const summaries = [];
+        let anyMutated = false;
+        for (const v of violations) {
+            const absPath = path.isAbsolute(v.file) ? v.file : path.join(context.root, v.file);
+            const result = quarantineImportDeclaration({
+                absPath,
+                moduleSpecifier: v.specifier,
+                ruleId: QUARANTINE_RULE,
+                reason: "removed banned specifier",
+                root: context.root,
+            });
+            if (result.mutated) {
+                anyMutated = true;
+                summaries.push(`banned-import quarantined: ${v.file}:${String(result.line ?? "?")} -> ${QUARANTINE_RULE}`);
+            }
+        }
+        return {
+            mutated: anyMutated,
+            summary: summaries.join("; "),
+        };
+    },
+};
+//# sourceMappingURL=banned-import.js.map

package/dist/cli/lib/surgeons/banned-import.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"banned-import.js","sourceRoot":"","sources":["../../../../src/cli/lib/surgeons/banned-import.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AAGrE,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAE7C,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AAEtE,MAAM,CAAC,MAAM,mBAAmB,GAAgB;IAC9C,SAAS,EAAE,SAAS,CAAC,sBAAsB;IAE3C,KAAK,CAAC,aAAa,CAAC,OAAuB;QACzC,MAAM,QAAQ,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;QAC5F,MAAM,UAAU,GAAG,2BAA2B,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC;QAC5F,CAAC;QAED,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,IAAI,UAAU,GAAG,KAAK,CAAC;QAEvB,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YACnF,MAAM,MAAM,GAAG,2BAA2B,CAAC;gBACzC,OAAO;gBACP,eAAe,EAAE,CAAC,CAAC,SAAS;gBAC5B,MAAM,EAAE,eAAe;gBACvB,MAAM,EAAE,0BAA0B;gBAClC,IAAI,EAAE,OAAO,CAAC,IAAI;aACnB,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,UAAU,GAAG,IAAI,CAAC;gBAClB,SAAS,CAAC,IAAI,CACZ,8BAA8B,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,eAAe,EAAE,CAC3F,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO;YACL,OAAO,EAAE,UAAU;YACnB,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;SAC9B,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/cli/lib/surgeons/import-layer.d.ts

@@ -0,0 +1,3 @@
+import type { CodeSurgeon } from "./registry.js";
+export declare const importLayerSurgeon: CodeSurgeon;
+//# sourceMappingURL=import-layer.d.ts.map

package/dist/cli/lib/surgeons/import-layer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-layer.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/surgeons/import-layer.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAyC,MAAM,eAAe,CAAC;AAgDxF,eAAO,MAAM,kBAAkB,EAAE,WAwChC,CAAC"}

package/dist/cli/lib/surgeons/import-layer.js

@@ -0,0 +1,74 @@
+import path from "node:path";
+import { GXT_ERROR } from "../gxt-error-codes.js";
+import { extractImportLayerGateReport } from "../surgeon.js";
+import { quarantineImportDeclaration, resolveImportDeclarationOffset, } from "./quarantine-import.js";
+const QUARANTINE_RULE = "RULE-IMPORT-LAYER";
+function reasonForRule(ruleId) {
+    switch (ruleId) {
+        case "RULE-LIB-TO-COMMAND":
+            return "removed lib-to-command import";
+        case "RULE-LIB-COMMANDER":
+            return "removed commander import from lib layer";
+        case "RULE-COMMAND-RUNTIME-EXEC-PROCESS":
+            return "removed direct runtime-exec-process import";
+        default:
+            return "removed import layer violation";
+    }
+}
+function resolveTargets(root, violations) {
+    const targets = [];
+    for (const v of violations) {
+        const absPath = path.isAbsolute(v.file) ? v.file : path.join(root, v.file);
+        const offset = resolveImportDeclarationOffset(root, absPath, v.module_specifier);
+        if (offset === null)
+            continue;
+        targets.push({ violation: v, absPath, offset });
+    }
+    return targets;
+}
+function groupAndSortBottomToTop(targets) {
+    const byFile = new Map();
+    for (const t of targets) {
+        const list = byFile.get(t.absPath) ?? [];
+        list.push(t);
+        byFile.set(t.absPath, list);
+    }
+    for (const [file, list] of byFile) {
+        list.sort((a, b) => b.offset - a.offset);
+        byFile.set(file, list);
+    }
+    return byFile;
+}
+export const importLayerSurgeon = {
+    errorCode: GXT_ERROR.IMPORT_LAYER_VIOLATION,
+    async applyMutation(context) {
+        const report = extractImportLayerGateReport(context.failure.gateStdout ?? "", context.failure.gateStderr ?? "");
+        if (!report || report.violations.length === 0) {
+            return { mutated: false, summary: "no import-layer violations parsed from gate JSON" };
+        }
+        const grouped = groupAndSortBottomToTop(resolveTargets(context.root, report.violations));
+        const summaries = [];
+        let anyMutated = false;
+        for (const [, fileTargets] of grouped) {
+            for (const target of fileTargets) {
+                const v = target.violation;
+                const result = quarantineImportDeclaration({
+                    absPath: target.absPath,
+                    moduleSpecifier: v.module_specifier,
+                    ruleId: QUARANTINE_RULE,
+                    reason: reasonForRule(v.rule_id),
+                    root: context.root,
+                });
+                if (result.mutated) {
+                    anyMutated = true;
+                    summaries.push(`import-layer quarantined: ${v.file}:${String(result.line ?? v.line)} -> ${QUARANTINE_RULE}`);
+                }
+            }
+        }
+        return {
+            mutated: anyMutated,
+            summary: summaries.join("; "),
+        };
+    },
+};
+//# sourceMappingURL=import-layer.js.map

package/dist/cli/lib/surgeons/import-layer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-layer.js","sourceRoot":"","sources":["../../../../src/cli/lib/surgeons/import-layer.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,4BAA4B,EAA6B,MAAM,eAAe,CAAC;AACxF,OAAO,EACL,2BAA2B,EAC3B,8BAA8B,GAC/B,MAAM,wBAAwB,CAAC;AAGhC,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAQ5C,SAAS,aAAa,CAAC,MAAc;IACnC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,qBAAqB;YACxB,OAAO,+BAA+B,CAAC;QACzC,KAAK,oBAAoB;YACvB,OAAO,yCAAyC,CAAC;QACnD,KAAK,mCAAmC;YACtC,OAAO,4CAA4C,CAAC;QACtD;YACE,OAAO,gCAAgC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,UAAkC;IACtE,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,8BAA8B,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,gBAAgB,CAAC,CAAC;QACjF,IAAI,MAAM,KAAK,IAAI;YAAE,SAAS;QAC9B,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAyB;IACxD,MAAM,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACb,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAgB;IAC7C,SAAS,EAAE,SAAS,CAAC,sBAAsB;IAE3C,KAAK,CAAC,aAAa,CAAC,OAAuB;QACzC,MAAM,MAAM,GAAG,4BAA4B,CACzC,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,EAChC,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CACjC,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC;QACzF,CAAC;QAED,MAAM,OAAO,GAAG,uBAAuB,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QACzF,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,IAAI,UAAU,GAAG,KAAK,CAAC;QAEvB,KAAK,MAAM,CAAC,EAAE,WAAW,CAAC,IAAI,OAAO,EAAE,CAAC;YACtC,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;gBACjC,MAAM,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC;gBAC3B,MAAM,MAAM,GAAG,2BAA2B,CAAC;oBACzC,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,eAAe,EAAE,CAAC,CAAC,gBAAgB;oBACnC,MAAM,EAAE,eAAe;oBACvB,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC;oBAChC,IAAI,EAAE,OAAO,CAAC,IAAI;iBACnB,CAAC,CAAC;gBACH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACnB,UAAU,GAAG,IAAI,CAAC;oBAClB,SAAS,CAAC,IAAI,CACZ,6BAA6B,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,eAAe,EAAE,CAC7F,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO;YACL,OAAO,EAAE,UAAU;YACnB,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;SAC9B,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/cli/lib/surgeons/quarantine-import.d.ts

@@ -0,0 +1,24 @@
+export interface QuarantineImportTarget {
+    absPath: string;
+    moduleSpecifier: string;
+    ruleId: string;
+    reason: string;
+    /** Repo root for workspace TypeScript resolution. */
+    root: string;
+}
+export interface QuarantineImportResult {
+    mutated: boolean;
+    line?: number;
+    bindings: string[];
+    startOffset?: number;
+}
+/** Resolve import declaration start offset for bottom-to-top sorting. */
+export declare function resolveImportDeclarationOffset(root: string, absPath: string, moduleSpecifier: string): number | null;
+/** Quarantine a matching import via TypeScript AST offsets (lazy Proxy roadblock). */
+export declare function quarantineImportDeclaration(target: QuarantineImportTarget): QuarantineImportResult;
+/** Back-compat alias used by banned-import surgeon tests. */
+export declare function quarantineBannedImportInFile(absPath: string, specifier: string, ruleId?: string, root?: string): {
+    mutated: boolean;
+    lineNumber?: number;
+};
+//# sourceMappingURL=quarantine-import.d.ts.map

package/dist/cli/lib/surgeons/quarantine-import.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quarantine-import.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/surgeons/quarantine-import.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAyFD,yEAAyE;AACzE,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,eAAe,EAAE,MAAM,GACtB,MAAM,GAAG,IAAI,CAOf;AAED,sFAAsF;AACtF,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,sBAAsB,GAC7B,sBAAsB,CAuCxB;AAED,6DAA6D;AAC7D,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,MAAM,GAAE,MAA6B,EACrC,IAAI,GAAE,MAAsB,GAC3B;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAS3C"}

package/dist/cli/lib/surgeons/quarantine-import.js

@@ -0,0 +1,128 @@
+import fs from "node:fs";
+import { getWorkspaceTypeScript } from "./typescript-workspace.js";
+function specifierMatches(found, expected) {
+    if (found === expected)
+        return true;
+    const norm = (s) => s.replace(/\.js$/i, ".ts");
+    return norm(found) === norm(expected);
+}
+function extractBindingsFromClause(ts, clause) {
+    if (!clause) {
+        return { namedBindings: ["__gxtQuarantineImport"] };
+    }
+    const groups = { namedBindings: [] };
+    if (clause.name) {
+        groups.defaultBinding = clause.name.text;
+    }
+    const named = clause.namedBindings;
+    if (named) {
+        if (ts.isNamespaceImport(named)) {
+            groups.namespaceBinding = named.name.text;
+        }
+        else if (ts.isNamedImports(named)) {
+            for (const el of named.elements) {
+                if (el.isTypeOnly)
+                    continue;
+                groups.namedBindings.push(el.name.text);
+            }
+        }
+    }
+    if (!groups.defaultBinding && !groups.namespaceBinding && groups.namedBindings.length === 0) {
+        groups.namedBindings.push("__gxtQuarantineImport");
+    }
+    return groups;
+}
+function flattenBindingGroups(groups) {
+    const out = [];
+    if (groups.defaultBinding)
+        out.push(groups.defaultBinding);
+    out.push(...groups.namedBindings);
+    if (groups.namespaceBinding)
+        out.push(groups.namespaceBinding);
+    return out;
+}
+function proxyConstLine(binding, specifier, ruleId, reason) {
+    return [
+        `const ${binding} = new Proxy(Object.create(null), {`,
+        `  get() { throw new Error("GXT Security Violation: Execution blocked. ${reason} Import '${specifier}' quarantined by Code Surgeon [${ruleId}]."); }`,
+        `});`,
+    ].join("\n");
+}
+function buildProxyBlock(groups, specifier, ruleId, reason) {
+    return flattenBindingGroups(groups)
+        .map((binding) => proxyConstLine(binding, specifier, ruleId, reason))
+        .join("\n");
+}
+function findImportDeclaration(ts, sourceFile, moduleSpecifier) {
+    let found = null;
+    const visit = (node) => {
+        if (found)
+            return;
+        if (ts.isImportDeclaration(node) && node.moduleSpecifier && ts.isStringLiteral(node.moduleSpecifier)) {
+            if (specifierMatches(node.moduleSpecifier.text, moduleSpecifier)) {
+                found = node;
+                return;
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(sourceFile);
+    return found;
+}
+/** Resolve import declaration start offset for bottom-to-top sorting. */
+export function resolveImportDeclarationOffset(root, absPath, moduleSpecifier) {
+    const ts = getWorkspaceTypeScript(root);
+    if (!ts || !fs.existsSync(absPath))
+        return null;
+    const source = fs.readFileSync(absPath, "utf8");
+    const sourceFile = ts.createSourceFile(absPath, source, ts.ScriptTarget.Latest, true);
+    const decl = findImportDeclaration(ts, sourceFile, moduleSpecifier);
+    return decl ? decl.getStart(sourceFile) : null;
+}
+/** Quarantine a matching import via TypeScript AST offsets (lazy Proxy roadblock). */
+export function quarantineImportDeclaration(target) {
+    const ts = getWorkspaceTypeScript(target.root);
+    if (!ts) {
+        return { mutated: false, bindings: [] };
+    }
+    if (!fs.existsSync(target.absPath)) {
+        return { mutated: false, bindings: [] };
+    }
+    const source = fs.readFileSync(target.absPath, "utf8");
+    const sourceFile = ts.createSourceFile(target.absPath, source, ts.ScriptTarget.Latest, true);
+    const decl = findImportDeclaration(ts, sourceFile, target.moduleSpecifier);
+    if (!decl || !decl.moduleSpecifier || !ts.isStringLiteral(decl.moduleSpecifier)) {
+        return { mutated: false, bindings: [] };
+    }
+    const isTypeOnly = decl.importClause?.isTypeOnly === true;
+    if (isTypeOnly) {
+        return { mutated: false, bindings: [] };
+    }
+    const bindingGroups = extractBindingsFromClause(ts, decl.importClause);
+    const bindings = flattenBindingGroups(bindingGroups);
+    const specifier = decl.moduleSpecifier.text;
+    const start = decl.getFullStart();
+    const end = decl.getEnd();
+    const line = sourceFile.getLineAndCharacterOfPosition(decl.getStart(sourceFile)).line + 1;
+    const quarantine = [
+        `// GXT-SURGEON-QUARANTINE-START [${target.ruleId}]`,
+        `// GXT-SURGEON-QUARANTINE: ${target.reason} ${specifier} (formerly line ${String(line)})`,
+        buildProxyBlock(bindingGroups, specifier, target.ruleId, target.reason),
+        "// GXT-SURGEON-QUARANTINE-END",
+    ].join("\n");
+    const updated = `${source.slice(0, start)}${quarantine}${source.slice(end)}`;
+    fs.writeFileSync(target.absPath, updated.endsWith("\n") ? updated : `${updated}\n`, "utf8");
+    return { mutated: true, line, bindings, startOffset: start };
+}
+/** Back-compat alias used by banned-import surgeon tests. */
+export function quarantineBannedImportInFile(absPath, specifier, ruleId = "RULE-BANNED-IMPORT", root = process.cwd()) {
+    const result = quarantineImportDeclaration({
+        absPath,
+        moduleSpecifier: specifier,
+        ruleId,
+        reason: "removed banned specifier",
+        root,
+    });
+    return { mutated: result.mutated, lineNumber: result.line };
+}
+//# sourceMappingURL=quarantine-import.js.map

package/dist/cli/lib/surgeons/quarantine-import.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quarantine-import.js","sourceRoot":"","sources":["../../../../src/cli/lib/surgeons/quarantine-import.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAwBnE,SAAS,gBAAgB,CAAC,KAAa,EAAE,QAAgB;IACvD,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,yBAAyB,CAChC,EAA+B,EAC/B,MAAqD;IAErD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,aAAa,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC;IACtD,CAAC;IACD,MAAM,MAAM,GAAwB,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;IAC1D,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;IAC3C,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC;IACnC,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,CAAC,gBAAgB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;QAC5C,CAAC;aAAM,IAAI,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YACpC,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAChC,IAAI,EAAE,CAAC,UAAU;oBAAE,SAAS;gBAC5B,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5F,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,oBAAoB,CAAC,MAA2B;IACvD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,MAAM,CAAC,cAAc;QAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC3D,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;IAClC,IAAI,MAAM,CAAC,gBAAgB;QAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC/D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,OAAe,EAAE,SAAiB,EAAE,MAAc,EAAE,MAAc;IACxF,OAAO;QACL,SAAS,OAAO,qCAAqC;QACrD,yEAAyE,MAAM,YAAY,SAAS,kCAAkC,MAAM,SAAS;QACrJ,KAAK;KACN,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CACtB,MAA2B,EAC3B,SAAiB,EACjB,MAAc,EACd,MAAc;IAEd,OAAO,oBAAoB,CAAC,MAAM,CAAC;SAChC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;SACpE,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,qBAAqB,CAC5B,EAA+B,EAC/B,UAA2C,EAC3C,eAAuB;IAEvB,IAAI,KAAK,GAAkD,IAAI,CAAC;IAChE,MAAM,KAAK,GAAG,CAAC,IAA+B,EAAQ,EAAE;QACtD,IAAI,KAAK;YAAE,OAAO;QAClB,IAAI,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACrG,IAAI,gBAAgB,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC;gBACjE,KAAK,GAAG,IAAI,CAAC;gBACb,OAAO;YACT,CAAC;QACH,CAAC;QACD,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC,CAAC;IACF,KAAK,CAAC,UAAU,CAAC,CAAC;IAClB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,8BAA8B,CAC5C,IAAY,EACZ,OAAe,EACf,eAAuB;IAEvB,MAAM,EAAE,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACtF,MAAM,IAAI,GAAG,qBAAqB,CAAC,EAAE,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;IACpE,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,2BAA2B,CACzC,MAA8B;IAE9B,MAAM,EAAE,GAAG,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC1C,CAAC;IAED,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC7F,MAAM,IAAI,GAAG,qBAAqB,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IAC3E,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;QAChF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC1C,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,UAAU,KAAK,IAAI,CAAC;IAC1D,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC1C,CAAC;IAED,MAAM,aAAa,GAAG,yBAAyB,CAAC,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,UAAU,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;IAE1F,MAAM,UAAU,GAAG;QACjB,oCAAoC,MAAM,CAAC,MAAM,GAAG;QACpD,8BAA8B,MAAM,CAAC,MAAM,IAAI,SAAS,mBAAmB,MAAM,CAAC,IAAI,CAAC,GAAG;QAC1F,eAAe,CAAC,aAAa,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;QACvE,+BAA+B;KAChC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;IAC7E,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,EAAE,MAAM,CAAC,CAAC;IAE5F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAC/D,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,4BAA4B,CAC1C,OAAe,EACf,SAAiB,EACjB,SAAiB,oBAAoB,EACrC,OAAe,OAAO,CAAC,GAAG,EAAE;IAE5B,MAAM,MAAM,GAAG,2BAA2B,CAAC;QACzC,OAAO;QACP,eAAe,EAAE,SAAS;QAC1B,MAAM;QACN,MAAM,EAAE,0BAA0B;QAClC,IAAI;KACL,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC9D,CAAC"}

package/dist/cli/lib/surgeons/registry.d.ts

@@ -0,0 +1,22 @@
+import type { GxtErrorCode } from "../gxt-error-codes.js";
+import type { VerifyPhaseFailure } from "../verify-engine.js";
+import type { Manifest } from "../types.js";
+export interface SurgeonMutationResult {
+    mutated: boolean;
+    summary: string;
+}
+export interface SurgeonContext {
+    root: string;
+    failure: VerifyPhaseFailure;
+    manifest: Manifest;
+    workerLogPath: string;
+    errorCode: GxtErrorCode;
+}
+export interface CodeSurgeon {
+    errorCode: GxtErrorCode;
+    applyMutation(context: SurgeonContext): Promise<SurgeonMutationResult>;
+}
+export declare function getSurgeonForErrorCode(code: GxtErrorCode): CodeSurgeon | undefined;
+export declare function hasRegisteredSurgeon(code: GxtErrorCode): boolean;
+export declare function resolveSurgeonErrorCode(failure: VerifyPhaseFailure): GxtErrorCode | null;
+//# sourceMappingURL=registry.d.ts.map

package/dist/cli/lib/surgeons/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/surgeons/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAI1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAI5C,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,kBAAkB,CAAC;IAC5B,QAAQ,EAAE,QAAQ,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,YAAY,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,YAAY,CAAC;IACxB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACxE;AAID,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,YAAY,GAAG,WAAW,GAAG,SAAS,CAElF;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAEhE;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,kBAAkB,GAAG,YAAY,GAAG,IAAI,CAaxF"}

package/dist/cli/lib/surgeons/registry.js

@@ -0,0 +1,27 @@
+import { GXT_ERROR } from "../gxt-error-codes.js";
+import { gateOutputIndicatesBannedImport } from "../banned-import-violation.js";
+import { gateOutputIndicatesImportLayer } from "../surgeon.js";
+import { bannedImportSurgeon } from "./banned-import.js";
+import { importLayerSurgeon } from "./import-layer.js";
+const SURGEONS = [importLayerSurgeon, bannedImportSurgeon];
+export function getSurgeonForErrorCode(code) {
+    return SURGEONS.find((s) => s.errorCode === code);
+}
+export function hasRegisteredSurgeon(code) {
+    return getSurgeonForErrorCode(code) !== undefined;
+}
+export function resolveSurgeonErrorCode(failure) {
+    if (failure.phase !== "gate")
+        return null;
+    const stdout = failure.gateStdout ?? "";
+    const stderr = failure.gateStderr ?? "";
+    const combined = `${stderr}\n${stdout}`;
+    if (gateOutputIndicatesImportLayer(stdout) || gateOutputIndicatesImportLayer(stderr)) {
+        return GXT_ERROR.IMPORT_LAYER_VIOLATION;
+    }
+    if (gateOutputIndicatesBannedImport(combined) || /: banned import "/.test(combined)) {
+        return GXT_ERROR.BANNED_IMPORT_DETECTED;
+    }
+    return null;
+}
+//# sourceMappingURL=registry.js.map

package/dist/cli/lib/surgeons/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../../src/cli/lib/surgeons/registry.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,EAAE,8BAA8B,EAAE,MAAM,eAAe,CAAC;AAG/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAoBvD,MAAM,QAAQ,GAAkB,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAAC;AAE1E,MAAM,UAAU,sBAAsB,CAAC,IAAkB;IACvD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAkB;IACrD,OAAO,sBAAsB,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAA2B;IACjE,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;IACxC,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,GAAG,MAAM,KAAK,MAAM,EAAE,CAAC;IAExC,IAAI,8BAA8B,CAAC,MAAM,CAAC,IAAI,8BAA8B,CAAC,MAAM,CAAC,EAAE,CAAC;QACrF,OAAO,SAAS,CAAC,sBAAsB,CAAC;IAC1C,CAAC;IACD,IAAI,+BAA+B,CAAC,QAAQ,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpF,OAAO,SAAS,CAAC,sBAAsB,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/cli/lib/surgeons/typescript-workspace.d.ts

@@ -0,0 +1,7 @@
+type TsModule = typeof import("typescript");
+/** Resolve TypeScript compiler API from adopter workspace or gapman package (lazy, fail-soft). */
+export declare function getWorkspaceTypeScript(root: string): TsModule | null;
+/** @internal Reset cache between tests. */
+export declare function clearTypeScriptWorkspaceCache(): void;
+export {};
+//# sourceMappingURL=typescript-workspace.d.ts.map

package/dist/cli/lib/surgeons/typescript-workspace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"typescript-workspace.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/surgeons/typescript-workspace.ts"],"names":[],"mappings":"AAIA,KAAK,QAAQ,GAAG,cAAc,YAAY,CAAC,CAAC;AAS5C,kGAAkG;AAClG,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAuBpE;AAED,2CAA2C;AAC3C,wBAAgB,6BAA6B,IAAI,IAAI,CAEpD"}

package/dist/cli/lib/surgeons/typescript-workspace.js

@@ -0,0 +1,41 @@
+import { createRequire } from "node:module";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+let cachedTs;
+function gapmanPackageRoot() {
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    return path.resolve(here, "..", "..", "..", "..");
+}
+/** Resolve TypeScript compiler API from adopter workspace or gapman package (lazy, fail-soft). */
+export function getWorkspaceTypeScript(root) {
+    if (cachedTs !== undefined)
+        return cachedTs;
+    try {
+        const require = createRequire(import.meta.url);
+        const searchPaths = [root, gapmanPackageRoot()];
+        let tsPath;
+        for (const base of searchPaths) {
+            try {
+                tsPath = require.resolve("typescript", { paths: [base] });
+                break;
+            }
+            catch {
+                // try next base
+            }
+        }
+        if (!tsPath) {
+            cachedTs = null;
+            return null;
+        }
+        cachedTs = require(tsPath);
+    }
+    catch {
+        cachedTs = null;
+    }
+    return cachedTs;
+}
+/** @internal Reset cache between tests. */
+export function clearTypeScriptWorkspaceCache() {
+    cachedTs = undefined;
+}
+//# sourceMappingURL=typescript-workspace.js.map

package/dist/cli/lib/surgeons/typescript-workspace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"typescript-workspace.js","sourceRoot":"","sources":["../../../../src/cli/lib/surgeons/typescript-workspace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAIzC,IAAI,QAAqC,CAAC;AAE1C,SAAS,iBAAiB;IACxB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACpD,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAChD,IAAI,MAA0B,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC1D,MAAM;YACR,CAAC;YAAC,MAAM,CAAC;gBACP,gBAAgB;YAClB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,QAAQ,GAAG,IAAI,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAa,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,6BAA6B;IAC3C,QAAQ,GAAG,SAAS,CAAC;AACvB,CAAC"}

package/dist/cli/lib/teacher-identity.js

@@ -1,7 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { fromPosix } from "./cli-io.js";
-import { gitRunOk } from "./git-repo.js";
+import { gitRunOk } from "./git.js";
 export const ENV_TEACHER_EMAILS = "GAPMAN_TEACHER_EMAILS";
 export const GIT_CONFIG_TEACHER_EMAILS = "gapman.teacherEmails";
 export const REL_TEACHER_ALLOWLIST = ".gitagent/foreman/TEACHER.allowlist";

package/dist/cli/lib/teacher-identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"teacher-identity.js","sourceRoot":"","sources":["../../../src/cli/lib/teacher-identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,MAAM,CAAC,MAAM,kBAAkB,GAAG,uBAAgC,CAAC;AACnE,MAAM,CAAC,MAAM,yBAAyB,GAAG,sBAA+B,CAAC;AAEzE,MAAM,CAAC,MAAM,qBAAqB,GAAG,qCAA8C,CAAC;AACpF,MAAM,CAAC,MAAM,2BAA2B,GAAG,2CAAoD,CAAC;AAiBhG,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,KAAK,GAAG,GAAG;SACd,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SACtD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB,EAAE,OAAe;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IACpD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,kBAAkB,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,0BAA0B,CAAC,QAAgB;IAClD,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAC5F,IAAI,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACpC,OAAO,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAC9F,IAAI,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACtC,OAAO,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;IAC/E,IAAI,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACpC,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,yBAAyB;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IAC5B,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,2BAA2B,CAAC,CAAC;IACvE,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACzD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAChE,OAAO;YACL,MAAM,EAAE,UAAU;YAClB,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,gBAAgB;YACpF,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;SAC5B,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,0BAA0B,CAAC,QAAQ,CAAC,CAAC;IAC3D,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,cAAc,yBAAyB,EAAE;SAClD,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,yBAAyB,EAAE,CAAC;IAC5C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,kBAAkB;SAC3B,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO;YACL,MAAM,EAAE,CAAC,QAAQ,CAAC;YAClB,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,iDAAiD;SAC1D,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,MAAgB;IACxD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtG,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,QAAgB,EAAE,MAAgB;IAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,2BAA2B,CAAC,CAAC,CAAC;IACxE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,yBAAyB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;AACnE,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,4BAA4B,CAAC,QAAgB;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,2BAA2B,CAAC,CAAC,CAAC;IACxE,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;IAChE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAClC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,0BAA0B,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,SAAiB;IACxD,OAAO;QACL,sCAAsC,2BAA2B,EAAE;QACnE,gEAAgE;QAChE,mDAAmD;QACnD,SAAS,kBAAkB,gDAAgD;KAC5E,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AACtB,CAAC"}
+{"version":3,"file":"teacher-identity.js","sourceRoot":"","sources":["../../../src/cli/lib/teacher-identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEpC,MAAM,CAAC,MAAM,kBAAkB,GAAG,uBAAgC,CAAC;AACnE,MAAM,CAAC,MAAM,yBAAyB,GAAG,sBAA+B,CAAC;AAEzE,MAAM,CAAC,MAAM,qBAAqB,GAAG,qCAA8C,CAAC;AACpF,MAAM,CAAC,MAAM,2BAA2B,GAAG,2CAAoD,CAAC;AAiBhG,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,KAAK,GAAG,GAAG;SACd,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SACtD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB,EAAE,OAAe;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IACpD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,kBAAkB,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,0BAA0B,CAAC,QAAgB;IAClD,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAC5F,IAAI,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACpC,OAAO,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAC9F,IAAI,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACtC,OAAO,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;IAC/E,IAAI,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACpC,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,yBAAyB;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IAC5B,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,2BAA2B,CAAC,CAAC;IACvE,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACzD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAChE,OAAO;YACL,MAAM,EAAE,UAAU;YAClB,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,gBAAgB;YACpF,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;SAC5B,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,0BAA0B,CAAC,QAAQ,CAAC,CAAC;IAC3D,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,cAAc,yBAAyB,EAAE;SAClD,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,yBAAyB,EAAE,CAAC;IAC5C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,kBAAkB;SAC3B,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO;YACL,MAAM,EAAE,CAAC,QAAQ,CAAC;YAClB,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,iDAAiD;SAC1D,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,MAAgB;IACxD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtG,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,QAAgB,EAAE,MAAgB;IAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,2BAA2B,CAAC,CAAC,CAAC;IACxE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,yBAAyB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;AACnE,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,4BAA4B,CAAC,QAAgB;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,2BAA2B,CAAC,CAAC,CAAC;IACxE,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;IAChE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAClC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,0BAA0B,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,SAAiB;IACxD,OAAO;QACL,sCAAsC,2BAA2B,EAAE;QACnE,gEAAgE;QAChE,mDAAmD;QACnD,SAAS,kBAAkB,gDAAgD;KAC5E,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AACtB,CAAC"}

package/dist/cli/lib/tmvc-path.d.ts

@@ -0,0 +1,12 @@
+import type { Manifest } from "./types.js";
+/** Governance transport files — never TMVC drift violations during pre-commit scans. */
+export declare const GOVERNANCE_TRANSPORT_PATHS: readonly ["WORKER_LOG.md", ".gitagent/missions/.active-mission"];
+export type TmvcPathClassification = "governance_transport" | "inside_tmvc" | "outside_tmvc" | "forbidden_zone";
+export declare function normalizeRepoRelativePath(repoRel: string): string;
+export declare function isGovernanceTransportPath(repoRel: string): boolean;
+export declare function tmvcRootsForSkill(manifest: Manifest, skillKey: string | null): string[];
+export declare function forbiddenZonesForSkill(manifest: Manifest, skillKey: string | null): string[];
+/** True when `repoRel` is exactly `root` or nested under `root/` (POSIX semantics). */
+export declare function isPathUnderRoot(repoRel: string, root: string): boolean;
+export declare function classifyRepoRelativePath(repoRel: string, tmvcRoots: readonly string[], forbiddenZones: readonly string[]): TmvcPathClassification;
+//# sourceMappingURL=tmvc-path.d.ts.map

package/dist/cli/lib/tmvc-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tmvc-path.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/tmvc-path.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,wFAAwF;AACxF,eAAO,MAAM,0BAA0B,kEAG7B,CAAC;AAEX,MAAM,MAAM,sBAAsB,GAC9B,sBAAsB,GACtB,aAAa,GACb,cAAc,GACd,gBAAgB,CAAC;AAErB,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAGlE;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,EAAE,CAIvF;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,EAAE,CAI5F;AAED,uFAAuF;AACvF,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAKtE;AAED,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,cAAc,EAAE,SAAS,MAAM,EAAE,GAChC,sBAAsB,CAWxB"}

package/dist/cli/lib/tmvc-path.js

@@ -0,0 +1,47 @@
+/** Governance transport files — never TMVC drift violations during pre-commit scans. */
+export const GOVERNANCE_TRANSPORT_PATHS = [
+    "WORKER_LOG.md",
+    ".gitagent/missions/.active-mission",
+];
+export function normalizeRepoRelativePath(repoRel) {
+    return repoRel.replace(/\\/g, "/").replace(/^\.\//, "");
+}
+export function isGovernanceTransportPath(repoRel) {
+    const norm = normalizeRepoRelativePath(repoRel);
+    return GOVERNANCE_TRANSPORT_PATHS.includes(norm);
+}
+export function tmvcRootsForSkill(manifest, skillKey) {
+    if (!skillKey?.trim())
+        return [];
+    const skill = manifest.skills[skillKey];
+    return skill ? [...skill.tmvc_roots] : [];
+}
+export function forbiddenZonesForSkill(manifest, skillKey) {
+    if (!skillKey?.trim())
+        return [];
+    const skill = manifest.skills[skillKey];
+    return skill ? [...skill.forbidden_zones] : [];
+}
+/** True when `repoRel` is exactly `root` or nested under `root/` (POSIX semantics). */
+export function isPathUnderRoot(repoRel, root) {
+    const normPath = normalizeRepoRelativePath(repoRel);
+    const normRoot = normalizeRepoRelativePath(root).replace(/\/$/, "");
+    if (normPath === normRoot)
+        return true;
+    return normPath.startsWith(`${normRoot}/`);
+}
+export function classifyRepoRelativePath(repoRel, tmvcRoots, forbiddenZones) {
+    const norm = normalizeRepoRelativePath(repoRel);
+    if (isGovernanceTransportPath(norm))
+        return "governance_transport";
+    for (const fz of forbiddenZones) {
+        if (isPathUnderRoot(norm, fz))
+            return "forbidden_zone";
+    }
+    for (const root of tmvcRoots) {
+        if (isPathUnderRoot(norm, root))
+            return "inside_tmvc";
+    }
+    return "outside_tmvc";
+}
+//# sourceMappingURL=tmvc-path.js.map