@jeger-ai/opengantry 3.2.6 → 3.4.0

package/dist/cli/lib/ledger/ledger-chain.d.ts

@@ -0,0 +1,24 @@
+import { type LedgerEntry } from "./ledger-entry.js";
+export declare const LEDGER_CAS_MAX_ATTEMPTS = 8;
+export declare function readLedgerTip(root: string, ref?: string): string | null;
+export declare function readLedgerEntryAt(root: string, commit: string): LedgerEntry;
+export declare function commitLedgerEntry(root: string, entry: LedgerEntry, parent: string | null, sign: boolean): string;
+export declare function casUpdateLedgerRef(root: string, newCommit: string, expectedOld: string | null): boolean;
+/** Sync CAS backoff (Atomics.wait parks the thread; not a busy-spin). */
+export declare function sleepJitter(attempt: number): void;
+export interface LedgerChainReport {
+    ok: boolean;
+    ref: string;
+    tip: string | null;
+    count: number;
+    errors: string[];
+    entries: LedgerEntry[];
+}
+export declare function verifyLedgerChain(root: string, ref?: string, opts?: {
+    requireSignatures?: boolean;
+}): LedgerChainReport;
+export declare function runLedgerDoctorChecks(root: string): {
+    level: "ok" | "warn" | "fail";
+    message: string;
+}[];
+//# sourceMappingURL=ledger-chain.d.ts.map

package/dist/cli/lib/ledger/ledger-chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger-chain.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/ledger/ledger-chain.ts"],"names":[],"mappings":"AAKA,OAAO,EAA8B,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEjF,eAAO,MAAM,uBAAuB,IAAI,CAAC;AA2BzC,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,MAAmB,GAAG,MAAM,GAAG,IAAI,CAEnF;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,WAAW,CAoB3E;AAED,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,IAAI,EAAE,OAAO,GACZ,MAAM,CAoBR;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAKvG;AAED,yEAAyE;AACzE,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAGjD;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,WAAW,EAAE,CAAC;CACxB;AAED,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,GAAG,GAAE,MAAmB,EACxB,IAAI,CAAC,EAAE;IAAE,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAAE,GACrC,iBAAiB,CA6BnB;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAAE,CASxG"}

package/dist/cli/lib/ledger/ledger-chain.js

@@ -0,0 +1,101 @@
+import path from "node:path";
+import { LEDGER_REF } from "../constants.js";
+import { gitRevParse, gitRun } from "../git.js";
+import { GantryUserError } from "../errors.js";
+import { GXT_ERROR } from "../gxt-error-codes.js";
+import { entryHash, genesisPrevHash } from "./ledger-entry.js";
+export const LEDGER_CAS_MAX_ATTEMPTS = 8;
+function requireRoot(root) {
+    if (!root || !path.isAbsolute(root)) {
+        throw new GantryUserError(GXT_ERROR.INVALID_ARGUMENT, "ledger helpers require an absolute repo root (never implicit cwd)", undefined, 2);
+    }
+    return root;
+}
+function requireGitOk(result, verb, hint) {
+    const out = result.stdout.trim();
+    if (!result.ok || !out) {
+        throw new GantryUserError(GXT_ERROR.LEDGER_CHAIN_BROKEN, `git ${verb} failed: ${result.stderr.trim() || "no output"}`, hint, 1);
+    }
+    return out;
+}
+export function readLedgerTip(root, ref = LEDGER_REF) {
+    return gitRevParse(requireRoot(root), ref);
+}
+export function readLedgerEntryAt(root, commit) {
+    const show = gitRun(requireRoot(root), ["show", `${commit}:entry.json`]);
+    if (!show.ok) {
+        throw new GantryUserError(GXT_ERROR.LEDGER_CHAIN_BROKEN, `ledger commit ${commit} has no entry.json`, undefined, 1);
+    }
+    try {
+        return JSON.parse(show.stdout);
+    }
+    catch {
+        throw new GantryUserError(GXT_ERROR.LEDGER_CHAIN_BROKEN, `ledger commit ${commit} has invalid entry.json`, undefined, 1);
+    }
+}
+export function commitLedgerEntry(root, entry, parent, sign) {
+    const absRoot = requireRoot(root);
+    const body = `${JSON.stringify(entry, null, 2)}\n`;
+    const blob = requireGitOk(gitRun(absRoot, ["hash-object", "-w", "--stdin"], { input: body }), "hash-object");
+    const tree = requireGitOk(gitRun(absRoot, ["mktree"], { input: `100644 blob ${blob}\tentry.json\n` }), "mktree");
+    const subject = `[GXT-LEDGER] ${entry.entry_kind} ${entry.msn_id}`;
+    const commitArgs = ["commit-tree", tree, "-m", subject];
+    if (parent)
+        commitArgs.push("-p", parent);
+    if (sign)
+        commitArgs.splice(1, 0, "-S");
+    return requireGitOk(gitRun(absRoot, commitArgs), "commit-tree", sign ? "configure user.signingkey or set ledger.signature off" : undefined);
+}
+export function casUpdateLedgerRef(root, newCommit, expectedOld) {
+    const absRoot = requireRoot(root);
+    const old = expectedOld ?? "0000000000000000000000000000000000000000";
+    const r = gitRun(absRoot, ["update-ref", LEDGER_REF, newCommit, old]);
+    return r.ok;
+}
+/** Sync CAS backoff (Atomics.wait parks the thread; not a busy-spin). */
+export function sleepJitter(attempt) {
+    const ms = Math.min(50 * 2 ** attempt, 400) + Math.floor(Math.random() * 25);
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+export function verifyLedgerChain(root, ref = LEDGER_REF, opts) {
+    const tip = readLedgerTip(root, ref);
+    if (!tip) {
+        return { ok: true, ref, tip: null, count: 0, errors: [], entries: [] };
+    }
+    const log = gitRun(root, ["rev-list", "--reverse", tip]);
+    const commits = log.ok ? log.stdout.split("\n").map((s) => s.trim()).filter(Boolean) : [];
+    const errors = [];
+    const entries = [];
+    let expectedPrev = genesisPrevHash();
+    for (const commit of commits) {
+        try {
+            const entry = readLedgerEntryAt(root, commit);
+            entries.push(entry);
+            if (entry.prev_entry_hash !== expectedPrev) {
+                errors.push(`${GXT_ERROR.LEDGER_CHAIN_BROKEN}: ${commit} prev_entry_hash mismatch`);
+            }
+            if (opts?.requireSignatures === true) {
+                const verified = gitRun(root, ["verify-commit", commit]);
+                if (!verified.ok) {
+                    errors.push(`${GXT_ERROR.LEDGER_UNSIGNED}: ${commit} failed git verify-commit`);
+                }
+            }
+            expectedPrev = entryHash(entry);
+        }
+        catch (e) {
+            errors.push(e instanceof Error ? e.message : String(e));
+        }
+    }
+    return { ok: errors.length === 0, ref, tip, count: entries.length, errors, entries };
+}
+export function runLedgerDoctorChecks(root) {
+    const report = verifyLedgerChain(root);
+    if (!report.tip) {
+        return [{ level: "ok", message: `${LEDGER_REF}: absent` }];
+    }
+    if (!report.ok) {
+        return report.errors.map((message) => ({ level: "fail", message }));
+    }
+    return [{ level: "ok", message: `${LEDGER_REF}: ${report.count} entries, chain consistent` }];
+}
+//# sourceMappingURL=ledger-chain.js.map

package/dist/cli/lib/ledger/ledger-chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger-chain.js","sourceRoot":"","sources":["../../../../src/cli/lib/ledger/ledger-chain.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,EAAqB,MAAM,WAAW,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,eAAe,EAAoB,MAAM,mBAAmB,CAAC;AAEjF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAEzC,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,eAAe,CACvB,SAAS,CAAC,gBAAgB,EAC1B,mEAAmE,EACnE,SAAS,EACT,CAAC,CACF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,MAAoB,EAAE,IAAY,EAAE,IAAa;IACrE,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,eAAe,CACvB,SAAS,CAAC,mBAAmB,EAC7B,OAAO,IAAI,YAAY,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,WAAW,EAAE,EAC5D,IAAI,EACJ,CAAC,CACF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,MAAc,UAAU;IAClE,OAAO,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,MAAc;IAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,CAAC,CAAC;IACzE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,eAAe,CACvB,SAAS,CAAC,mBAAmB,EAC7B,iBAAiB,MAAM,oBAAoB,EAC3C,SAAS,EACT,CAAC,CACF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAgB,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CACvB,SAAS,CAAC,mBAAmB,EAC7B,iBAAiB,MAAM,yBAAyB,EAChD,SAAS,EACT,CAAC,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,KAAkB,EAClB,MAAqB,EACrB,IAAa;IAEb,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IACnD,MAAM,IAAI,GAAG,YAAY,CACvB,MAAM,CAAC,OAAO,EAAE,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAClE,aAAa,CACd,CAAC;IACF,MAAM,IAAI,GAAG,YAAY,CACvB,MAAM,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,eAAe,IAAI,gBAAgB,EAAE,CAAC,EAC3E,QAAQ,CACT,CAAC;IACF,MAAM,OAAO,GAAG,gBAAgB,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;IACnE,MAAM,UAAU,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACxD,IAAI,MAAM;QAAE,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1C,IAAI,IAAI;QAAE,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IACxC,OAAO,YAAY,CACjB,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,EAC3B,aAAa,EACb,IAAI,CAAC,CAAC,CAAC,uDAAuD,CAAC,CAAC,CAAC,SAAS,CAC3E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,SAAiB,EAAE,WAA0B;IAC5F,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,WAAW,IAAI,0CAA0C,CAAC;IACtE,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;IACtE,OAAO,CAAC,CAAC,EAAE,CAAC;AACd,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,OAAO,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7E,OAAO,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AACnE,CAAC;AAWD,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,MAAc,UAAU,EACxB,IAAsC;IAEtC,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACzE,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1F,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,IAAI,YAAY,GAAG,eAAe,EAAE,CAAC;IACrC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC9C,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,KAAK,CAAC,eAAe,KAAK,YAAY,EAAE,CAAC;gBAC3C,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,mBAAmB,KAAK,MAAM,2BAA2B,CAAC,CAAC;YACtF,CAAC;YACD,IAAI,IAAI,EAAE,iBAAiB,KAAK,IAAI,EAAE,CAAC;gBACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;gBACzD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,eAAe,KAAK,MAAM,2BAA2B,CAAC,CAAC;gBAClF,CAAC;YACH,CAAC;YACD,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QAChB,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,UAAU,UAAU,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,MAAe,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,UAAU,KAAK,MAAM,CAAC,KAAK,4BAA4B,EAAE,CAAC,CAAC;AAChG,CAAC"}

package/dist/cli/lib/ledger/ledger-entry.d.ts

@@ -0,0 +1,79 @@
+import type { MissionDependencySpec } from "../types.js";
+export declare const LEDGER_ENTRY_SCHEMA_VERSION: "1.0.0";
+export declare const LEDGER_ENTRY_KINDS: readonly ["receipt", "verify_findings", "break_glass", "policy_pin", "dependency_check"];
+export type LedgerEntryKind = (typeof LEDGER_ENTRY_KINDS)[number];
+/** Digest-only receipt fields already allowed on the export path (ADR-0043). */
+export interface ReceiptLedgerPayload {
+    verify_status?: string;
+    signed?: boolean;
+    receipt_sha256?: string;
+    source?: string;
+    envelope_sha?: string;
+    has_payload?: boolean;
+}
+export interface VerifyFindingsLedgerPayload {
+    failed_gate: string;
+    findings_digest?: string;
+    fingerprints?: string[];
+    message?: string;
+}
+export interface BreakGlassLedgerPayload {
+    reason_sha256: string;
+    error_code: string;
+}
+export interface PolicyPinLedgerPayload {
+    policy_id: string;
+    bundle_sha256: string;
+    pinned_commit: string;
+}
+export interface DependencyCheckLedgerPayload {
+    repo: string;
+    msn_id: string;
+    require?: MissionDependencySpec["require"];
+    result: string;
+}
+export type LedgerPayload = ReceiptLedgerPayload | VerifyFindingsLedgerPayload | BreakGlassLedgerPayload | PolicyPinLedgerPayload | DependencyCheckLedgerPayload;
+export type LedgerPayloadFor<K extends LedgerEntryKind> = K extends "receipt" ? ReceiptLedgerPayload : K extends "verify_findings" ? VerifyFindingsLedgerPayload : K extends "break_glass" ? BreakGlassLedgerPayload : K extends "policy_pin" ? PolicyPinLedgerPayload : K extends "dependency_check" ? DependencyCheckLedgerPayload : never;
+interface LedgerEntryBase {
+    schema_version: typeof LEDGER_ENTRY_SCHEMA_VERSION;
+    org_id: string;
+    repository_hash: string;
+    msn_id: string;
+    git_head: string;
+    payload_sha256: string;
+    prev_entry_hash: string;
+    issued_at: string;
+}
+export type LedgerEntry = (LedgerEntryBase & {
+    entry_kind: "receipt";
+    payload: ReceiptLedgerPayload;
+}) | (LedgerEntryBase & {
+    entry_kind: "verify_findings";
+    payload: VerifyFindingsLedgerPayload;
+}) | (LedgerEntryBase & {
+    entry_kind: "break_glass";
+    payload: BreakGlassLedgerPayload;
+}) | (LedgerEntryBase & {
+    entry_kind: "policy_pin";
+    payload: PolicyPinLedgerPayload;
+}) | (LedgerEntryBase & {
+    entry_kind: "dependency_check";
+    payload: DependencyCheckLedgerPayload;
+});
+export declare function sha256Utf8(text: string): string;
+export declare function entryHash(entry: LedgerEntry): string;
+export declare function genesisPrevHash(): string;
+export declare function buildLedgerEntry<K extends LedgerEntryKind>(input: {
+    kind: K;
+    org_id: string;
+    repository_hash: string;
+    msn_id: string;
+    git_head: string;
+    payload: LedgerPayloadFor<K>;
+    prev_entry_hash: string;
+    issued_at?: string;
+}): Extract<LedgerEntry, {
+    entry_kind: K;
+}>;
+export {};
+//# sourceMappingURL=ledger-entry.d.ts.map

package/dist/cli/lib/ledger/ledger-entry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger-entry.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/ledger/ledger-entry.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEzD,eAAO,MAAM,2BAA2B,EAAG,OAAgB,CAAC;AAE5D,eAAO,MAAM,kBAAkB,0FAMrB,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAElE,gFAAgF;AAChF,MAAM,WAAW,oBAAoB;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,aAAa,GACrB,oBAAoB,GACpB,2BAA2B,GAC3B,uBAAuB,GACvB,sBAAsB,GACtB,4BAA4B,CAAC;AAEjC,MAAM,MAAM,gBAAgB,CAAC,CAAC,SAAS,eAAe,IAAI,CAAC,SAAS,SAAS,GACzE,oBAAoB,GACpB,CAAC,SAAS,iBAAiB,GACzB,2BAA2B,GAC3B,CAAC,SAAS,aAAa,GACrB,uBAAuB,GACvB,CAAC,SAAS,YAAY,GACpB,sBAAsB,GACtB,CAAC,SAAS,kBAAkB,GAC1B,4BAA4B,GAC5B,KAAK,CAAC;AAElB,UAAU,eAAe;IACvB,cAAc,EAAE,OAAO,2BAA2B,CAAC;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,WAAW,GACnB,CAAC,eAAe,GAAG;IAAE,UAAU,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,CAAC,GAC5E,CAAC,eAAe,GAAG;IAAE,UAAU,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,2BAA2B,CAAA;CAAE,CAAC,GAC3F,CAAC,eAAe,GAAG;IAAE,UAAU,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,uBAAuB,CAAA;CAAE,CAAC,GACnF,CAAC,eAAe,GAAG;IAAE,UAAU,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,sBAAsB,CAAA;CAAE,CAAC,GACjF,CAAC,eAAe,GAAG;IAAE,UAAU,EAAE,kBAAkB,CAAC;IAAC,OAAO,EAAE,4BAA4B,CAAA;CAAE,CAAC,CAAC;AAElG,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAEpD;AAED,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,eAAe,EAAE,KAAK,EAAE;IACjE,IAAI,EAAE,CAAC,CAAC;IACR,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAC7B,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,WAAW,EAAE;IAAE,UAAU,EAAE,CAAC,CAAA;CAAE,CAAC,CAc1C"}

package/dist/cli/lib/ledger/ledger-entry.js

@@ -0,0 +1,36 @@
+import crypto from "node:crypto";
+import { canonicalJson } from "../canonical-json.js";
+import { LEDGER_GENESIS_HASH } from "../constants.js";
+export const LEDGER_ENTRY_SCHEMA_VERSION = "1.0.0";
+export const LEDGER_ENTRY_KINDS = [
+    "receipt",
+    "verify_findings",
+    "break_glass",
+    "policy_pin",
+    "dependency_check",
+];
+export function sha256Utf8(text) {
+    return crypto.createHash("sha256").update(text, "utf8").digest("hex");
+}
+export function entryHash(entry) {
+    return sha256Utf8(canonicalJson(entry));
+}
+export function genesisPrevHash() {
+    return LEDGER_GENESIS_HASH;
+}
+export function buildLedgerEntry(input) {
+    const payload_sha256 = sha256Utf8(canonicalJson(input.payload));
+    return {
+        schema_version: LEDGER_ENTRY_SCHEMA_VERSION,
+        entry_kind: input.kind,
+        org_id: input.org_id,
+        repository_hash: input.repository_hash,
+        msn_id: input.msn_id,
+        git_head: input.git_head,
+        payload_sha256,
+        payload: input.payload,
+        prev_entry_hash: input.prev_entry_hash,
+        issued_at: input.issued_at ?? new Date().toISOString(),
+    };
+}
+//# sourceMappingURL=ledger-entry.js.map

package/dist/cli/lib/ledger/ledger-entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger-entry.js","sourceRoot":"","sources":["../../../../src/cli/lib/ledger/ledger-entry.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAGtD,MAAM,CAAC,MAAM,2BAA2B,GAAG,OAAgB,CAAC;AAE5D,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,SAAS;IACT,iBAAiB;IACjB,aAAa;IACb,YAAY;IACZ,kBAAkB;CACV,CAAC;AA4EX,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAkB;IAC1C,OAAO,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,gBAAgB,CAA4B,KAS3D;IACC,MAAM,cAAc,GAAG,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,OAAO;QACL,cAAc,EAAE,2BAA2B;QAC3C,UAAU,EAAE,KAAK,CAAC,IAAI;QACtB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc;QACd,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACZ,CAAC;AAC/C,CAAC"}

package/dist/cli/lib/ledger/ledger-export.d.ts

@@ -0,0 +1,28 @@
+export declare const SOC2_CONTROL_MAP: readonly [{
+    readonly framework: "ISO 27001";
+    readonly control: "A.5.3";
+    readonly mapping: "Planner stamp + mission YAML + verify ledger entry";
+}, {
+    readonly framework: "ISO 27001";
+    readonly control: "A.8.15";
+    readonly mapping: "refs/gxt/ledger + EXECUTOR_LOG.md quotes";
+}, {
+    readonly framework: "ISO 27001";
+    readonly control: "A.8.28";
+    readonly mapping: "TMVC + policy floor (mandatory_gates, banned_imports)";
+}, {
+    readonly framework: "ISO 42001";
+    readonly control: "AI boundaries";
+    readonly mapping: "Mission depends_on + interrogation record";
+}, {
+    readonly framework: "SOC 2";
+    readonly control: "CC7";
+    readonly mapping: "Ledger chain verify + doctor ledger health";
+}, {
+    readonly framework: "SOC 2";
+    readonly control: "CC8";
+    readonly mapping: "Planner git-proof + receipt / verify_findings entries";
+}];
+export declare function exportLedgerJson(root: string, outDir: string): string;
+export declare function exportSoc2Pack(root: string, outDir: string): string;
+//# sourceMappingURL=ledger-export.d.ts.map

package/dist/cli/lib/ledger/ledger-export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger-export.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/ledger/ledger-export.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;EAOnB,CAAC;AAEX,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAMrE;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAmBnE"}

package/dist/cli/lib/ledger/ledger-export.js

@@ -0,0 +1,36 @@
+import fs from "node:fs";
+import path from "node:path";
+import { REL_RECEIPTS_DIR } from "../constants.js";
+import { verifyLedgerChain } from "./ledger-chain.js";
+export const SOC2_CONTROL_MAP = [
+    { framework: "ISO 27001", control: "A.5.3", mapping: "Planner stamp + mission YAML + verify ledger entry" },
+    { framework: "ISO 27001", control: "A.8.15", mapping: "refs/gxt/ledger + EXECUTOR_LOG.md quotes" },
+    { framework: "ISO 27001", control: "A.8.28", mapping: "TMVC + policy floor (mandatory_gates, banned_imports)" },
+    { framework: "ISO 42001", control: "AI boundaries", mapping: "Mission depends_on + interrogation record" },
+    { framework: "SOC 2", control: "CC7", mapping: "Ledger chain verify + doctor ledger health" },
+    { framework: "SOC 2", control: "CC8", mapping: "Planner git-proof + receipt / verify_findings entries" },
+];
+export function exportLedgerJson(root, outDir) {
+    const report = verifyLedgerChain(root);
+    fs.mkdirSync(outDir, { recursive: true });
+    const dest = path.join(outDir, "ledger.json");
+    fs.writeFileSync(dest, `${JSON.stringify(report, null, 2)}\n`, "utf8");
+    return dest;
+}
+export function exportSoc2Pack(root, outDir) {
+    fs.mkdirSync(outDir, { recursive: true });
+    exportLedgerJson(root, outDir);
+    fs.writeFileSync(path.join(outDir, "control-map.json"), `${JSON.stringify({ schema_version: "1.0.0", controls: SOC2_CONTROL_MAP }, null, 2)}\n`, "utf8");
+    const receiptsDir = path.join(root, REL_RECEIPTS_DIR);
+    const destReceipts = path.join(outDir, "receipts");
+    if (fs.existsSync(receiptsDir)) {
+        fs.mkdirSync(destReceipts, { recursive: true });
+        for (const name of fs.readdirSync(receiptsDir)) {
+            if (name.endsWith(".json")) {
+                fs.copyFileSync(path.join(receiptsDir, name), path.join(destReceipts, name));
+            }
+        }
+    }
+    return outDir;
+}
+//# sourceMappingURL=ledger-export.js.map

package/dist/cli/lib/ledger/ledger-export.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger-export.js","sourceRoot":"","sources":["../../../../src/cli/lib/ledger/ledger-export.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,oDAAoD,EAAE;IAC3G,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,0CAA0C,EAAE;IAClG,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,uDAAuD,EAAE;IAC/G,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,2CAA2C,EAAE;IAC1G,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,4CAA4C,EAAE;IAC7F,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,uDAAuD,EAAE;CAChG,CAAC;AAEX,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,MAAc;IAC3D,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACvC,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC9C,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,MAAc;IACzD,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC/B,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,kBAAkB,CAAC,EACrC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EACvF,MAAM,CACP,CAAC;IACF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACnD,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/C,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3B,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/cli/lib/legislate-from-intent.d.ts

@@ -0,0 +1,9 @@
+import { type LegislateOptions, type LegislateResult } from "./legislate.js";
+export interface FromIntentOptions extends LegislateOptions {
+    fromIntent?: boolean;
+    yes?: boolean;
+    contractFile?: string;
+}
+/** Propose (or load) a contract, optionally prompt, then legislate. */
+export declare function runLegislateFromIntent(options: FromIntentOptions): Promise<LegislateResult>;
+//# sourceMappingURL=legislate-from-intent.d.ts.map

package/dist/cli/lib/legislate-from-intent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"legislate-from-intent.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/legislate-from-intent.ts"],"names":[],"mappings":"AAMA,OAAO,EAA+C,KAAK,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAI1H,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IACzD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAMD,uEAAuE;AACvE,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,eAAe,CAAC,CAiDjG"}

package/dist/cli/lib/legislate-from-intent.js

@@ -0,0 +1,59 @@
+import fs from "node:fs";
+import { approveContractPrompt } from "./contract/approve-prompt.js";
+import { normalizeContract, parseContractYaml } from "./contract/contract-hash.js";
+import { proposeContract } from "./contract/propose.js";
+import { GantryUserError } from "./errors.js";
+import { logInfo } from "./cli-io.js";
+import { resolveSkillKeyForLegislation, runLegislate } from "./legislate.js";
+import { loadWorkspace } from "./workspace.js";
+function loadContractFile(file) {
+    return parseContractYaml(fs.readFileSync(file, "utf8"));
+}
+/** Propose (or load) a contract, optionally prompt, then legislate. */
+export async function runLegislateFromIntent(options) {
+    const { root, manifest } = loadWorkspace();
+    const resolved = resolveSkillKeyForLegislation({
+        root,
+        manifest,
+        intent: options.intent,
+        skillKey: options.skillKey,
+    });
+    if (!resolved.ok) {
+        throw new GantryUserError("INVALID_ARGUMENT", `legislate: ${resolved.reason}`, undefined, 2);
+    }
+    const proposed = proposeContract({
+        root,
+        manifest,
+        intent: options.intent,
+        skillKey: resolved.skillKey,
+        paths: options.paths,
+        gateCommand: options.gateCommand,
+        gateSuccessSubstring: options.gateSuccessSubstring,
+    });
+    let contract = options.contractFile?.trim()
+        ? loadContractFile(options.contractFile.trim())
+        : options.contract
+            ? normalizeContract(options.contract)
+            : proposed.contract;
+    if (options.fromIntent === true && !options.contractFile?.trim()) {
+        const decision = await approveContractPrompt({
+            contract,
+            gate: proposed.gate,
+            rationale: proposed.rationale,
+            yes: options.yes,
+        });
+        if (decision.action === "quit") {
+            logInfo("legislate: contract rejected — no mission written");
+            return { ok: false, exitCode: 2 };
+        }
+        contract = decision.contract;
+    }
+    return runLegislate({
+        ...options,
+        skillKey: resolved.skillKey,
+        contract,
+        gateCommand: options.gateCommand ?? proposed.gate.command,
+        gateSuccessSubstring: options.gateSuccessSubstring ?? proposed.gate.successSubstring ?? undefined,
+    });
+}
+//# sourceMappingURL=legislate-from-intent.js.map

package/dist/cli/lib/legislate-from-intent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legislate-from-intent.js","sourceRoot":"","sources":["../../../src/cli/lib/legislate-from-intent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,6BAA6B,EAAE,YAAY,EAA+C,MAAM,gBAAgB,CAAC;AAC1H,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAS/C,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,iBAAiB,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAA0B;IACrE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,aAAa,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAG,6BAA6B,CAAC;QAC7C,IAAI;QACJ,QAAQ;QACR,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,cAAc,QAAQ,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAC/F,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC;QAC/B,IAAI;QACJ,QAAQ;QACR,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;KACnD,CAAC,CAAC;IAEH,IAAI,QAAQ,GAAG,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE;QACzC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAC/C,CAAC,CAAC,OAAO,CAAC,QAAQ;YAChB,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC;YACrC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAExB,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC;YAC3C,QAAQ;YACR,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC/B,OAAO,CAAC,mDAAmD,CAAC,CAAC;YAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACpC,CAAC;QACD,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;IAC/B,CAAC;IAED,OAAO,YAAY,CAAC;QAClB,GAAG,OAAO;QACV,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,QAAQ;QACR,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO;QACzD,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,IAAI,QAAQ,CAAC,IAAI,CAAC,gBAAgB,IAAI,SAAS;KAClG,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/lib/legislate-gate-options.d.ts

@@ -1,9 +1,8 @@
+import { type GateAdapterId, type GateSpec } from "./types.js";
 /** Shared gate-command defaults for legislate, interrogate, and MCP draft flows. */
 export declare function resolveLegislateGateOptions(options: {
     gateCommand?: string;
     gateSuccessSubstring?: string;
-}): {
-    gateCommand: string;
-    gateSuccessSubstring: string | null;
-};
+    adapter?: GateAdapterId;
+}): GateSpec;
 //# sourceMappingURL=legislate-gate-options.d.ts.map

package/dist/cli/lib/legislate-gate-options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"legislate-gate-options.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/legislate-gate-options.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,wBAAgB,2BAA2B,CAAC,OAAO,EAAE;IACnD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAS/D"}
+{"version":3,"file":"legislate-gate-options.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/legislate-gate-options.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,QAAQ,EACd,MAAM,YAAY,CAAC;AAEpB,oFAAoF;AACpF,wBAAgB,2BAA2B,CAAC,OAAO,EAAE;IACnD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB,GAAG,QAAQ,CAaX"}

package/dist/cli/lib/legislate-gate-options.js

@@ -1,11 +1,16 @@
+import { DEFAULT_GATE_ADAPTER, } from "./types.js";
 /** Shared gate-command defaults for legislate, interrogate, and MCP draft flows. */
 export function resolveLegislateGateOptions(options) {
-    const gateCommand = options.gateCommand?.trim() || "echo OK";
-    const gateSuccessSubstring = options.gateSuccessSubstring !== undefined
+    const command = options.gateCommand?.trim() || "echo OK";
+    const successSubstring = options.gateSuccessSubstring !== undefined
         ? options.gateSuccessSubstring.trim() || null
-        : gateCommand === "echo OK"
+        : command === "echo OK"
             ? "OK"
             : null;
-    return { gateCommand, gateSuccessSubstring };
+    return {
+        command,
+        successSubstring,
+        adapter: options.adapter ?? DEFAULT_GATE_ADAPTER,
+    };
 }
 //# sourceMappingURL=legislate-gate-options.js.map

package/dist/cli/lib/legislate-gate-options.js.map

@@ -1 +1 @@
-{"version":3,"file":"legislate-gate-options.js","sourceRoot":"","sources":["../../../src/cli/lib/legislate-gate-options.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,MAAM,UAAU,2BAA2B,CAAC,OAG3C;IACC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAC7D,MAAM,oBAAoB,GACxB,OAAO,CAAC,oBAAoB,KAAK,SAAS;QACxC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,IAAI,EAAE,IAAI,IAAI;QAC7C,CAAC,CAAC,WAAW,KAAK,SAAS;YACzB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,IAAI,CAAC;IACb,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"legislate-gate-options.js","sourceRoot":"","sources":["../../../src/cli/lib/legislate-gate-options.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,GAGrB,MAAM,YAAY,CAAC;AAEpB,oFAAoF;AACpF,MAAM,UAAU,2BAA2B,CAAC,OAI3C;IACC,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACzD,MAAM,gBAAgB,GACpB,OAAO,CAAC,oBAAoB,KAAK,SAAS;QACxC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,IAAI,EAAE,IAAI,IAAI;QAC7C,CAAC,CAAC,OAAO,KAAK,SAAS;YACrB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,IAAI,CAAC;IACb,OAAO;QACL,OAAO;QACP,gBAAgB;QAChB,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,oBAAoB;KACjD,CAAC;AACJ,CAAC"}

package/dist/cli/lib/legislate-policy-warn.d.ts

@@ -0,0 +1,3 @@
+/** Warn-only: a draft that would violate the org floor is still written (ADR-0042). */
+export declare function warnLegislatePolicyFloor(root: string): void;
+//# sourceMappingURL=legislate-policy-warn.d.ts.map

package/dist/cli/lib/legislate-policy-warn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"legislate-policy-warn.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/legislate-policy-warn.ts"],"names":[],"mappings":"AAGA,uFAAuF;AACvF,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAW3D"}

package/dist/cli/lib/legislate-policy-warn.js

@@ -0,0 +1,17 @@
+import { logWarn } from "./cli-io.js";
+import { configFloorViolations, localConfigFloor, resolveOrgPolicy } from "./policy/policy-resolve.js";
+/** Warn-only: a draft that would violate the org floor is still written (ADR-0042). */
+export function warnLegislatePolicyFloor(root) {
+    const resolved = resolveOrgPolicy(root);
+    if (!resolved.ok) {
+        logWarn(`legislate: org policy preflight warning — ${resolved.message}`);
+        return;
+    }
+    if (!resolved.present)
+        return;
+    const violations = configFloorViolations(resolved.bundle?.config_floor ?? {}, localConfigFloor(root));
+    for (const v of violations) {
+        logWarn(`legislate: org policy floor warning — ${v}`);
+    }
+}
+//# sourceMappingURL=legislate-policy-warn.js.map

package/dist/cli/lib/legislate-policy-warn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legislate-policy-warn.js","sourceRoot":"","sources":["../../../src/cli/lib/legislate-policy-warn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAEvG,uFAAuF;AACvF,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,CAAC,6CAA6C,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QACzE,OAAO;IACT,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO;QAAE,OAAO;IAC9B,MAAM,UAAU,GAAG,qBAAqB,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,IAAI,EAAE,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;IACtG,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,OAAO,CAAC,yCAAyC,CAAC,EAAE,CAAC,CAAC;IACxD,CAAC;AACH,CAAC"}

package/dist/cli/lib/legislate.d.ts

@@ -1,4 +1,4 @@
-import type { Manifest, TriageResult } from "./types.js";
+import { type GateAdapterId, type Manifest, type MissionContract, type TriageResult } from "./types.js";
 import type { InterrogationRow } from "./interrogate/findings.js";
 export type LegislateInterrogation = {
     source: "draft_token";
@@ -16,10 +16,14 @@ export interface LegislateOptions {
     allowDuplicate?: boolean;
     gateCommand?: string;
     gateSuccessSubstring?: string;
+    /** Explicit gate output parser (ADR-0041); omitted/generic is not written. */
+    gateAdapter?: GateAdapterId;
     paths?: string[];
     interrogation?: LegislateInterrogation;
     /** When true, skip stdout info messages (MCP / structured JSON callers). */
     silent?: boolean;
+    /** Planner-sealed cage; written as `contract` + `contract_sha256`. */
+    contract?: MissionContract | null;
 }
 export type ResolveSkillKeyResult = {
     ok: true;

package/dist/cli/lib/legislate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"legislate.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/legislate.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAGzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAIlE,MAAM,MAAM,sBAAsB,GAC9B;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,gBAAgB,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnE;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,gBAAgB,EAAE,CAAA;CAAE,CAAC;AAE1D,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC,4EAA4E;IAC5E,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,GACpD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,eAAe,GAAG,WAAW,CAAA;CAAE,CAAC;AAE7F,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,qBAAqB,CA8BxB;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,CAAC,CAAA;CAAE,CAAC;AA4L/B,OAAO,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAE1E,wBAAgB,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,eAAe,CAgEvE"}
+{"version":3,"file":"legislate.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/legislate.ts"],"names":[],"mappings":"AAmBA,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,KAAK,YAAY,EAClB,MAAM,YAAY,CAAC;AAQpB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAIlE,MAAM,MAAM,sBAAsB,GAC9B;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,gBAAgB,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnE;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,gBAAgB,EAAE,CAAA;CAAE,CAAC;AAE1D,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,8EAA8E;IAC9E,WAAW,CAAC,EAAE,aAAa,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC,4EAA4E;IAC5E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;CACnC;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,GACpD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,eAAe,GAAG,WAAW,CAAA;CAAE,CAAC;AAE7F,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,qBAAqB,CA8BxB;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,CAAC,CAAA;CAAE,CAAC;AA4M/B,OAAO,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAE1E,wBAAgB,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,eAAe,CAmEvE"}