@jeger-ai/opengantry 3.2.6 → 3.4.0

package/dist/cli/lib/contract/contract-scan.js

@@ -0,0 +1,167 @@
+import fs from "node:fs";
+import path from "node:path";
+import { importMatchesBan } from "../ast-discovery.js";
+import { toPosixRel } from "../cli-io.js";
+import { gitRunOk } from "../git.js";
+import { GXT_ERROR } from "../gxt-error-codes.js";
+import { extractImportSites } from "../import-scanner.js";
+import { isPathUnderRoot, normalizeRepoRelativePath } from "../tmvc-path.js";
+import { classifySpecifier, loadTsconfigPaths } from "./resolve-specifier.js";
+const SOURCE_EXT = new Set([".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"]);
+const SKIP_DIRS = new Set(["node_modules", "dist", "build", "coverage"]);
+export function isScannableSource(fileRel) {
+    const ext = path.extname(fileRel).toLowerCase();
+    return SOURCE_EXT.has(ext) && !fileRel.endsWith(".d.ts");
+}
+function walkSources(repoRoot, absRoot, out) {
+    if (!fs.existsSync(absRoot))
+        return;
+    const stat = fs.statSync(absRoot);
+    if (stat.isFile()) {
+        if (isScannableSource(absRoot))
+            out.push(toPosixRel(repoRoot, absRoot));
+        return;
+    }
+    if (!stat.isDirectory())
+        return;
+    for (const ent of fs.readdirSync(absRoot, { withFileTypes: true })) {
+        const child = path.join(absRoot, ent.name);
+        if (ent.isDirectory()) {
+            if (SKIP_DIRS.has(ent.name) || ent.name.startsWith("."))
+                continue;
+            walkSources(repoRoot, child, out);
+        }
+        else if (ent.isFile() && isScannableSource(ent.name)) {
+            out.push(toPosixRel(repoRoot, child));
+        }
+    }
+}
+/** Repo-relative source files under the effective TMVC roots (sorted, deduped). */
+export function listSourcesUnderRoots(repoRoot, roots) {
+    const out = [];
+    for (const root of roots)
+        walkSources(repoRoot, path.join(repoRoot, root), out);
+    return [...new Set(out)].sort();
+}
+function addGitNames(repoRoot, args, out) {
+    const r = gitRunOk(repoRoot, [...args, "--"]);
+    if (!r.ok)
+        return false;
+    for (const line of r.stdout.split(/\r?\n/))
+        if (line.trim())
+            out.add(line.trim());
+    return true;
+}
+/**
+ * Dirty sources: `git diff --name-only HEAD` ∪ untracked. On an unborn branch (no HEAD) the
+ * index (`ls-files --cached`) stands in for the diff. Every argv ends with `--` so a path that
+ * looks like a flag is never parsed as one. Missing/deleted paths are dropped.
+ */
+export function listChangedSourceFiles(repoRoot) {
+    const out = new Set();
+    if (!addGitNames(repoRoot, ["diff", "--name-only", "HEAD"], out)) {
+        addGitNames(repoRoot, ["ls-files", "--cached"], out);
+    }
+    addGitNames(repoRoot, ["ls-files", "--others", "--exclude-standard"], out);
+    return [...out]
+        .filter((rel) => isScannableSource(rel) && fs.existsSync(path.join(repoRoot, rel)))
+        .sort();
+}
+export function contractViolationCode(kind) {
+    switch (kind) {
+        case "banned":
+            return GXT_ERROR.CONTRACT_IMPORT_BANNED;
+        case "unlisted":
+            return GXT_ERROR.CONTRACT_IMPORT_UNLISTED;
+        case "dynamic":
+            return GXT_ERROR.CONTRACT_IMPORT_DYNAMIC;
+        case "scope_escape":
+            return GXT_ERROR.CONTRACT_SCOPE_ESCAPE;
+        default: {
+            const _exhaustive = kind;
+            return _exhaustive;
+        }
+    }
+}
+function violation(kind, file, site, specifier, detail) {
+    return { kind, file, line: site.line, column: site.column, specifier, detail };
+}
+function checkBareSpecifier(scope, file, site, spec) {
+    const banned = scope.bannedImports.find((b) => importMatchesBan(spec, b));
+    if (banned) {
+        return violation("banned", file, site, spec, `import of banned specifier "${spec}" (banned: ${banned})`);
+    }
+    if (scope.allowedImports.length > 0 && !scope.allowedImports.some((a) => importMatchesBan(spec, a))) {
+        return violation("unlisted", file, site, spec, `import "${spec}" is not in contract.allowed_imports`);
+    }
+    return null;
+}
+function checkResolvedPath(scope, file, site, spec, resolvedRepoRel) {
+    const forbidden = scope.forbiddenZones.find((fz) => isPathUnderRoot(resolvedRepoRel, fz));
+    if (forbidden) {
+        return violation("scope_escape", file, site, spec, `import resolves into forbidden zone ${forbidden} (${resolvedRepoRel})`);
+    }
+    if (scope.strictRelativeImports && scope.tmvcRoots.length > 0) {
+        const inside = scope.tmvcRoots.some((r) => isPathUnderRoot(resolvedRepoRel, r));
+        if (!inside) {
+            return violation("scope_escape", file, site, spec, `import resolves outside effective TMVC roots (${resolvedRepoRel})`);
+        }
+    }
+    return null;
+}
+function checkSite(scope, file, site, ts) {
+    if (site.spec === null) {
+        if (scope.allowDynamicSpecifiers)
+            return null;
+        return violation("dynamic", file, site, site.expression ?? "", `non-literal ${site.kind === "require_expr" ? "require" : "import"}(${site.expression ?? ""}) is not allowed (contract.allow_dynamic_specifiers=false)`);
+    }
+    const cls = classifySpecifier(site.spec, file, ts);
+    switch (cls.kind) {
+        case "builtin":
+            return null;
+        case "bare":
+            return checkBareSpecifier(scope, file, site, cls.specifier);
+        case "relative":
+        case "alias":
+            return checkResolvedPath(scope, file, site, cls.specifier, cls.resolvedRepoRel);
+        default: {
+            const _exhaustive = cls;
+            return _exhaustive;
+        }
+    }
+}
+/** Scan a single source file's import sites against the effective scope. */
+export function scanFileImports(repoRoot, fileRel, scope, ts = loadTsconfigPaths(repoRoot)) {
+    const abs = path.join(repoRoot, fileRel);
+    if (!fs.existsSync(abs) || !fs.statSync(abs).isFile())
+        return [];
+    const norm = normalizeRepoRelativePath(fileRel);
+    const out = [];
+    for (const site of extractImportSites(fs.readFileSync(abs, "utf8"))) {
+        const v = checkSite(scope, norm, site, ts);
+        if (v)
+            out.push(v);
+    }
+    return out;
+}
+/**
+ * Import-site scan for the effective cage: banned / unlisted bare specifiers, non-literal dynamic
+ * specifiers, and relative or alias imports resolving into forbidden zones (or outside TMVC when
+ * `strict_relative_imports`). Deterministic ordering by file, line, column.
+ */
+export function scanContractImports(repoRoot, scope, options = {}) {
+    const files = options.files
+        ? [...new Set(options.files.map(normalizeRepoRelativePath))].filter(isScannableSource).sort()
+        : scope.tmvcRoots.length > 0
+            ? listSourcesUnderRoots(repoRoot, scope.tmvcRoots)
+            : listChangedSourceFiles(repoRoot);
+    const ts = loadTsconfigPaths(repoRoot);
+    const out = [];
+    for (const file of files)
+        out.push(...scanFileImports(repoRoot, file, scope, ts));
+    return out.sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line || a.column - b.column);
+}
+export function formatContractViolation(v) {
+    return `[${contractViolationCode(v.kind)}] ${v.file}:${v.line}:${v.column} ${v.detail}`;
+}
+//# sourceMappingURL=contract-scan.js.map

package/dist/cli/lib/contract/contract-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract-scan.js","sourceRoot":"","sources":["../../../../src/cli/lib/contract/contract-scan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,SAAS,EAAqB,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAmB,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAE7E,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAsB,MAAM,wBAAwB,CAAC;AAElG,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAC3F,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;AAEzE,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;IAChD,OAAO,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,OAAe,EAAE,GAAa;IACnE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO;IACpC,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAClB,IAAI,iBAAiB,CAAC,OAAO,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QACxE,OAAO;IACT,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;QAAE,OAAO;IAChC,KAAK,MAAM,GAAG,IAAI,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACnE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;YACtB,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YAClE,WAAW,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QACpC,CAAC;aAAM,IAAI,GAAG,CAAC,MAAM,EAAE,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,qBAAqB,CAAC,QAAgB,EAAE,KAAwB;IAC9E,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,IAAc,EAAE,GAAgB;IACrE,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9C,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IACxB,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,IAAI,IAAI,CAAC,IAAI,EAAE;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAClF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QACjE,WAAW,CAAC,QAAQ,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC;IACvD,CAAC;IACD,WAAW,CAAC,QAAQ,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,oBAAoB,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3E,OAAO,CAAC,GAAG,GAAG,CAAC;SACZ,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;SAClF,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAA2B;IAC/D,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,SAAS,CAAC,sBAAsB,CAAC;QAC1C,KAAK,UAAU;YACb,OAAO,SAAS,CAAC,wBAAwB,CAAC;QAC5C,KAAK,SAAS;YACZ,OAAO,SAAS,CAAC,uBAAuB,CAAC;QAC3C,KAAK,cAAc;YACjB,OAAO,SAAS,CAAC,qBAAqB,CAAC;QACzC,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,WAAW,GAAU,IAAI,CAAC;YAChC,OAAO,WAAW,CAAC;QACrB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAChB,IAA2B,EAC3B,IAAY,EACZ,IAAgB,EAChB,SAAiB,EACjB,MAAc;IAEd,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AACjF,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAqB,EAAE,IAAY,EAAE,IAAgB,EAAE,IAAY;IAC7F,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1E,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,+BAA+B,IAAI,cAAc,MAAM,GAAG,CAAC,CAAC;IAC3G,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpG,OAAO,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,IAAI,sCAAsC,CAAC,CAAC;IACxG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAqB,EACrB,IAAY,EACZ,IAAgB,EAChB,IAAY,EACZ,eAAuB;IAEvB,MAAM,SAAS,GAAG,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,eAAe,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1F,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,SAAS,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,uCAAuC,SAAS,KAAK,eAAe,GAAG,CAAC,CAAC;IAC9H,CAAC;IACD,IAAI,KAAK,CAAC,qBAAqB,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,CAAC;QAChF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,iDAAiD,eAAe,GAAG,CAAC,CAAC;QAC1H,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,KAAqB,EAAE,IAAY,EAAE,IAAgB,EAAE,EAAwB;IAChG,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACvB,IAAI,KAAK,CAAC,sBAAsB;YAAE,OAAO,IAAI,CAAC;QAC9C,OAAO,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,eAAe,IAAI,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,IAAI,EAAE,4DAA4D,CAAC,CAAC;IAC1N,CAAC;IACD,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACnD,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,SAAS;YACZ,OAAO,IAAI,CAAC;QACd,KAAK,MAAM;YACT,OAAO,kBAAkB,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9D,KAAK,UAAU,CAAC;QAChB,KAAK,OAAO;YACV,OAAO,iBAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC;QAClF,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,WAAW,GAAU,GAAG,CAAC;YAC/B,OAAO,WAAW,CAAC;QACrB,CAAC;IACH,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAC7B,QAAgB,EAChB,OAAe,EACf,KAAqB,EACrB,KAA2B,iBAAiB,CAAC,QAAQ,CAAC;IAEtD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,CAAC;IACjE,MAAM,IAAI,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,GAAG,GAA8B,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,kBAAkB,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QACpE,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAgB,EAChB,KAAqB,EACrB,UAAsC,EAAE;IAExC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK;QACzB,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,IAAI,EAAE;QAC7F,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;YAC1B,CAAC,CAAC,qBAAqB,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;YAClD,CAAC,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,EAAE,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,GAAG,GAA8B,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;IAClF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;AACpG,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,CAA0B;IAChE,OAAO,IAAI,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;AAC1F,CAAC"}

package/dist/cli/lib/contract/contract-types.d.ts

@@ -0,0 +1,38 @@
+/** Planner-sealed mission cage (ADR-0045). All fields optional; absent = inherit skill/policy. */
+export interface MissionContract {
+    tmvc_roots?: string[];
+    forbidden_zones?: string[];
+    allowed_imports?: string[];
+    banned_imports?: string[];
+    allow_dynamic_specifiers?: boolean;
+    strict_relative_imports?: boolean;
+}
+/** Effective cage after merging skill roots, mission contract, and org policy (tighten-only). */
+export interface EffectiveScope {
+    /** Repo-relative TMVC roots (contract narrowing when present, else skill roots). */
+    tmvcRoots: string[];
+    /** Union of skill, contract, and policy forbidden zones. */
+    forbiddenZones: string[];
+    /** Bare-specifier allowlist; empty = no allowlist enforced. */
+    allowedImports: string[];
+    /** Union of contract and policy banned bare specifiers (exact or prefix match). */
+    bannedImports: string[];
+    allowDynamicSpecifiers: boolean;
+    strictRelativeImports: boolean;
+    /** True when the mission declared a contract block. */
+    hasContract: boolean;
+}
+export type ContractViolationKind = "banned" | "unlisted" | "dynamic" | "scope_escape";
+export interface ContractImportViolation {
+    kind: ContractViolationKind;
+    /** Repo-relative importing file. */
+    file: string;
+    line: number;
+    column: number;
+    /** Specifier text, or the raw expression for dynamic sites. */
+    specifier: string;
+    detail: string;
+}
+export declare const CONTRACT_ARRAY_KEYS: readonly ["tmvc_roots", "forbidden_zones", "allowed_imports", "banned_imports"];
+export declare const CONTRACT_BOOLEAN_KEYS: readonly ["allow_dynamic_specifiers", "strict_relative_imports"];
+//# sourceMappingURL=contract-types.d.ts.map

package/dist/cli/lib/contract/contract-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract-types.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/contract/contract-types.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AAED,iGAAiG;AACjG,MAAM,WAAW,cAAc;IAC7B,oFAAoF;IACpF,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,4DAA4D;IAC5D,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,+DAA+D;IAC/D,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,mFAAmF;IACnF,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,sBAAsB,EAAE,OAAO,CAAC;IAChC,qBAAqB,EAAE,OAAO,CAAC;IAC/B,uDAAuD;IACvD,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,GAAG,cAAc,CAAC;AAEvF,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,mBAAmB,iFAKuB,CAAC;AAExD,eAAO,MAAM,qBAAqB,kEAGqB,CAAC"}

package/dist/cli/lib/contract/contract-types.js

@@ -0,0 +1,11 @@
+export const CONTRACT_ARRAY_KEYS = [
+    "tmvc_roots",
+    "forbidden_zones",
+    "allowed_imports",
+    "banned_imports",
+];
+export const CONTRACT_BOOLEAN_KEYS = [
+    "allow_dynamic_specifiers",
+    "strict_relative_imports",
+];
+//# sourceMappingURL=contract-types.js.map

package/dist/cli/lib/contract/contract-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract-types.js","sourceRoot":"","sources":["../../../../src/cli/lib/contract/contract-types.ts"],"names":[],"mappings":"AAuCA,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,YAAY;IACZ,iBAAiB;IACjB,iBAAiB;IACjB,gBAAgB;CACqC,CAAC;AAExD,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,0BAA0B;IAC1B,yBAAyB;CAC4B,CAAC"}

package/dist/cli/lib/contract/effective-scope.d.ts

@@ -0,0 +1,21 @@
+import type { OrgPolicyBundle } from "../policy/policy-types.js";
+import type { Manifest, ParsedMission } from "../types.js";
+import type { EffectiveScope, MissionContract } from "./contract-types.js";
+export interface ResolveEffectiveScopeInput {
+    manifest: Manifest;
+    skillKey: string;
+    contract: MissionContract | null;
+    /** Cached org policy bundle (ADR-0042); null when absent or unreadable. */
+    policy?: OrgPolicyBundle | null;
+}
+/** Best-effort offline policy bundle; verify's policy phase owns failure reporting. */
+export declare function loadPolicyBundleQuiet(root: string): OrgPolicyBundle | null;
+/**
+ * Tighten-only merge (RULES §4, §8): TMVC = contract narrowing or skill roots; forbidden zones and
+ * banned imports are unions of skill, contract, and policy. Throws GXT_CONTRACT_SCOPE_ESCAPE when the
+ * contract tries to widen scope.
+ */
+export declare function resolveEffectiveScope(input: ResolveEffectiveScopeInput): EffectiveScope;
+/** Convenience for callers holding a parsed mission and repo root (loads policy quietly). */
+export declare function resolveEffectiveScopeForMission(root: string, manifest: Manifest, mission: ParsedMission): EffectiveScope;
+//# sourceMappingURL=effective-scope.d.ts.map

package/dist/cli/lib/contract/effective-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"effective-scope.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/contract/effective-scope.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAIjE,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE3D,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3E,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAC;IACjC,2EAA2E;IAC3E,MAAM,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;CACjC;AAED,uFAAuF;AACvF,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAI1E;AA+BD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,0BAA0B,GAAG,cAAc,CAyBvF;AAED,6FAA6F;AAC7F,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,GAAG,cAAc,CAWxH"}

package/dist/cli/lib/contract/effective-scope.js

@@ -0,0 +1,77 @@
+import { GantryUserError } from "../errors.js";
+import { GXT_ERROR } from "../gxt-error-codes.js";
+import { resolveOrgPolicy } from "../policy/policy-resolve.js";
+import { resolveManifestSkillKey } from "../skill-key.js";
+import { isPathUnderRoot } from "../tmvc-path.js";
+import { normalizeContract, normalizeContractPath } from "./contract-hash.js";
+/** Best-effort offline policy bundle; verify's policy phase owns failure reporting. */
+export function loadPolicyBundleQuiet(root) {
+    const resolved = resolveOrgPolicy(root);
+    if (!resolved.ok || !resolved.present)
+        return null;
+    return resolved.bundle;
+}
+function unionSorted(...lists) {
+    const out = new Set();
+    for (const list of lists)
+        for (const v of list)
+            if (v.trim())
+                out.add(v);
+    return [...out].sort();
+}
+function assertSubsetOfSkillRoots(contractRoots, skillRoots, skillKey) {
+    if (skillRoots.length === 0)
+        return;
+    const escaped = contractRoots.filter((r) => !skillRoots.some((s) => isPathUnderRoot(r, s)));
+    if (escaped.length === 0)
+        return;
+    throw new GantryUserError(GXT_ERROR.CONTRACT_SCOPE_ESCAPE, `${GXT_ERROR.CONTRACT_SCOPE_ESCAPE}: contract.tmvc_roots must stay inside skill ${skillKey} roots (${skillRoots.join(", ")}); escaped: ${escaped.join(", ")}`, "Narrow contract.tmvc_roots to a subset of the manifest skill tmvc_roots, or legislate under a skill that owns those roots.", 2);
+}
+function assertRootsOutsideForbidden(contractRoots, forbidden) {
+    const hits = contractRoots.filter((r) => forbidden.some((fz) => isPathUnderRoot(r, fz)));
+    if (hits.length === 0)
+        return;
+    throw new GantryUserError(GXT_ERROR.CONTRACT_SCOPE_ESCAPE, `${GXT_ERROR.CONTRACT_SCOPE_ESCAPE}: contract.tmvc_roots overlap forbidden zones: ${hits.join(", ")}`, "Remove the forbidden path from contract.tmvc_roots; forbidden zones are tighten-only and cannot be re-opened by a mission.", 2);
+}
+/**
+ * Tighten-only merge (RULES §4, §8): TMVC = contract narrowing or skill roots; forbidden zones and
+ * banned imports are unions of skill, contract, and policy. Throws GXT_CONTRACT_SCOPE_ESCAPE when the
+ * contract tries to widen scope.
+ */
+export function resolveEffectiveScope(input) {
+    const skillKey = resolveManifestSkillKey(input.manifest, input.skillKey);
+    const skill = input.manifest.skills[skillKey];
+    const skillRoots = (skill?.tmvc_roots ?? []).map(normalizeContractPath);
+    const skillForbidden = (skill?.forbidden_zones ?? []).map(normalizeContractPath);
+    const contract = input.contract ? normalizeContract(input.contract) : {};
+    const policy = input.policy ?? null;
+    const policyForbidden = (policy?.manifest_constraints?.forbidden_zones_add ?? []).map(normalizeContractPath);
+    const policyBanned = (policy?.banned_imports ?? []).map((b) => b.specifier.trim());
+    const forbiddenZones = unionSorted(skillForbidden, contract.forbidden_zones ?? [], policyForbidden);
+    const contractRoots = contract.tmvc_roots ?? [];
+    assertSubsetOfSkillRoots(contractRoots, skillRoots, skillKey);
+    assertRootsOutsideForbidden(contractRoots, forbiddenZones);
+    return {
+        tmvcRoots: contractRoots.length > 0 ? contractRoots : skillRoots,
+        forbiddenZones,
+        allowedImports: [...(contract.allowed_imports ?? [])],
+        bannedImports: unionSorted(contract.banned_imports ?? [], policyBanned),
+        allowDynamicSpecifiers: contract.allow_dynamic_specifiers === true,
+        strictRelativeImports: contract.strict_relative_imports === true,
+        hasContract: input.contract !== null,
+    };
+}
+/** Convenience for callers holding a parsed mission and repo root (loads policy quietly). */
+export function resolveEffectiveScopeForMission(root, manifest, mission) {
+    const skillKey = mission.skillKey?.trim();
+    if (!skillKey) {
+        throw new GantryUserError("MISSION_SCHEMA_INVALID", `mission missing skill_key (${mission.rawPath})`, undefined, 2);
+    }
+    return resolveEffectiveScope({
+        manifest,
+        skillKey,
+        contract: mission.contract,
+        policy: loadPolicyBundleQuiet(root),
+    });
+}
+//# sourceMappingURL=effective-scope.js.map

package/dist/cli/lib/contract/effective-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"effective-scope.js","sourceRoot":"","sources":["../../../../src/cli/lib/contract/effective-scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAW9E,uFAAuF;AACvF,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,QAAQ,CAAC,MAAM,CAAC;AACzB,CAAC;AAED,SAAS,WAAW,CAAC,GAAG,KAAqC;IAC3D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,IAAI,CAAC,CAAC,IAAI,EAAE;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,SAAS,wBAAwB,CAAC,aAAgC,EAAE,UAA6B,EAAE,QAAgB;IACjH,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACpC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5F,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACjC,MAAM,IAAI,eAAe,CACvB,SAAS,CAAC,qBAAqB,EAC/B,GAAG,SAAS,CAAC,qBAAqB,gDAAgD,QAAQ,WAAW,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC7J,4HAA4H,EAC5H,CAAC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAAC,aAAgC,EAAE,SAA4B;IACjG,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACzF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC9B,MAAM,IAAI,eAAe,CACvB,SAAS,CAAC,qBAAqB,EAC/B,GAAG,SAAS,CAAC,qBAAqB,kDAAkD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACrG,4HAA4H,EAC5H,CAAC,CACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAiC;IACrE,MAAM,QAAQ,GAAG,uBAAuB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACxE,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACjF,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC;IAEpC,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,oBAAoB,EAAE,mBAAmB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAC7G,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IAEnF,MAAM,cAAc,GAAG,WAAW,CAAC,cAAc,EAAE,QAAQ,CAAC,eAAe,IAAI,EAAE,EAAE,eAAe,CAAC,CAAC;IACpG,MAAM,aAAa,GAAG,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC;IAChD,wBAAwB,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC9D,2BAA2B,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;IAE3D,OAAO;QACL,SAAS,EAAE,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU;QAChE,cAAc;QACd,cAAc,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;QACrD,aAAa,EAAE,WAAW,CAAC,QAAQ,CAAC,cAAc,IAAI,EAAE,EAAE,YAAY,CAAC;QACvE,sBAAsB,EAAE,QAAQ,CAAC,wBAAwB,KAAK,IAAI;QAClE,qBAAqB,EAAE,QAAQ,CAAC,uBAAuB,KAAK,IAAI;QAChE,WAAW,EAAE,KAAK,CAAC,QAAQ,KAAK,IAAI;KACrC,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,+BAA+B,CAAC,IAAY,EAAE,QAAkB,EAAE,OAAsB;IACtG,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,eAAe,CAAC,wBAAwB,EAAE,8BAA8B,OAAO,CAAC,OAAO,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACtH,CAAC;IACD,OAAO,qBAAqB,CAAC;QAC3B,QAAQ;QACR,QAAQ;QACR,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,MAAM,EAAE,qBAAqB,CAAC,IAAI,CAAC;KACpC,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/lib/contract/format.d.ts

@@ -0,0 +1,20 @@
+import type { EffectiveScope, MissionContract } from "./contract-types.js";
+import type { ProposedGate } from "./propose-gate.js";
+export interface CageFormatInput {
+    tmvcRoots?: readonly string[];
+    forbiddenZones?: readonly string[];
+    allowedImports?: readonly string[];
+    bannedImports?: readonly string[];
+    allowDynamicSpecifiers?: boolean;
+    strictRelativeImports?: boolean;
+    emptyRoots?: string;
+    emptyForbidden?: string;
+    emptyAllowed?: string;
+    emptyBanned?: string;
+    gate?: ProposedGate | null;
+}
+/** Four cage lists + flags. Check, show, and propose share this. */
+export declare function formatCage(input: CageFormatInput): string;
+export declare function formatContractBlock(contract: MissionContract, gate?: ProposedGate | null): string;
+export declare function formatEffectiveScope(scope: EffectiveScope, gate?: ProposedGate | null): string;
+//# sourceMappingURL=format.d.ts.map

package/dist/cli/lib/contract/format.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"format.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/contract/format.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAMtD,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;CAC5B;AAED,oEAAoE;AACpE,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CAmBzD;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,CAAC,EAAE,YAAY,GAAG,IAAI,GAAG,MAAM,CAUjG;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,YAAY,GAAG,IAAI,GAAG,MAAM,CAc9F"}

package/dist/cli/lib/contract/format.js

@@ -0,0 +1,48 @@
+function csv(values, empty) {
+    return values && values.length > 0 ? values.join(", ") : empty;
+}
+/** Four cage lists + flags. Check, show, and propose share this. */
+export function formatCage(input) {
+    const lines = [
+        "Scope:",
+        `  ${csv(input.tmvcRoots, input.emptyRoots ?? "(inherit skill roots)")}`,
+        "Forbidden:",
+        `  ${csv(input.forbiddenZones, input.emptyForbidden ?? "(none beyond skill/policy)")}`,
+    ];
+    if (input.gate !== undefined) {
+        lines.push("Gate:", `  ${input.gate?.command ?? "(unchanged)"}`);
+    }
+    lines.push("Allowed Imports:", `  ${csv(input.allowedImports, input.emptyAllowed ?? "(any bare specifier)")}`, "Banned Imports:", `  ${csv(input.bannedImports, input.emptyBanned ?? "(none)")}`);
+    if (input.allowDynamicSpecifiers === true)
+        lines.push("Dynamic specifiers: allowed");
+    if (input.strictRelativeImports === true)
+        lines.push("Strict relative imports: on");
+    return lines.join("\n");
+}
+export function formatContractBlock(contract, gate) {
+    return formatCage({
+        tmvcRoots: contract.tmvc_roots,
+        forbiddenZones: contract.forbidden_zones,
+        allowedImports: contract.allowed_imports,
+        bannedImports: contract.banned_imports,
+        allowDynamicSpecifiers: contract.allow_dynamic_specifiers,
+        strictRelativeImports: contract.strict_relative_imports,
+        gate: gate ?? null,
+    });
+}
+export function formatEffectiveScope(scope, gate) {
+    return formatCage({
+        tmvcRoots: scope.tmvcRoots,
+        forbiddenZones: scope.forbiddenZones,
+        allowedImports: scope.allowedImports,
+        bannedImports: scope.bannedImports,
+        allowDynamicSpecifiers: scope.allowDynamicSpecifiers,
+        strictRelativeImports: scope.strictRelativeImports,
+        emptyRoots: "(none)",
+        emptyForbidden: "(none)",
+        emptyAllowed: "(any)",
+        emptyBanned: "(none)",
+        gate,
+    });
+}
+//# sourceMappingURL=format.js.map

package/dist/cli/lib/contract/format.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"format.js","sourceRoot":"","sources":["../../../../src/cli/lib/contract/format.ts"],"names":[],"mappings":"AAGA,SAAS,GAAG,CAAC,MAAqC,EAAE,KAAa;IAC/D,OAAO,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjE,CAAC;AAgBD,oEAAoE;AACpE,MAAM,UAAU,UAAU,CAAC,KAAsB;IAC/C,MAAM,KAAK,GAAG;QACZ,QAAQ;QACR,KAAK,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,IAAI,uBAAuB,CAAC,EAAE;QACxE,YAAY;QACZ,KAAK,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,4BAA4B,CAAC,EAAE;KACvF,CAAC;IACF,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,KAAK,CAAC,IAAI,EAAE,OAAO,IAAI,aAAa,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,CAAC,IAAI,CACR,kBAAkB,EAClB,KAAK,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,YAAY,IAAI,sBAAsB,CAAC,EAAE,EAC9E,iBAAiB,EACjB,KAAK,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,IAAI,QAAQ,CAAC,EAAE,CAC/D,CAAC;IACF,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IACrF,IAAI,KAAK,CAAC,qBAAqB,KAAK,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IACpF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAyB,EAAE,IAA0B;IACvF,OAAO,UAAU,CAAC;QAChB,SAAS,EAAE,QAAQ,CAAC,UAAU;QAC9B,cAAc,EAAE,QAAQ,CAAC,eAAe;QACxC,cAAc,EAAE,QAAQ,CAAC,eAAe;QACxC,aAAa,EAAE,QAAQ,CAAC,cAAc;QACtC,sBAAsB,EAAE,QAAQ,CAAC,wBAAwB;QACzD,qBAAqB,EAAE,QAAQ,CAAC,uBAAuB;QACvD,IAAI,EAAE,IAAI,IAAI,IAAI;KACnB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAqB,EAAE,IAA0B;IACpF,OAAO,UAAU,CAAC;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,UAAU,EAAE,QAAQ;QACpB,cAAc,EAAE,QAAQ;QACxB,YAAY,EAAE,OAAO;QACrB,WAAW,EAAE,QAAQ;QACrB,IAAI;KACL,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/lib/contract/propose-gate.d.ts

@@ -0,0 +1,21 @@
+import type { SkillEntry } from "../types.js";
+export interface ProposedGate {
+    command: string;
+    successSubstring: string | null;
+}
+/**
+ * Prefer a skill allowlist entry whose text names a proposed TMVC root segment (e.g. `test:billing`),
+ * else the first allowlisted command. `package.json` script names are a secondary signal when no
+ * allowlist exists. Falls back to `echo OK` so interrogation can raise `missing_test_criteria`.
+ */
+export declare function proposeGate(input: {
+    root: string;
+    skill: SkillEntry | undefined;
+    proposedRoots: readonly string[];
+    explicitCommand?: string;
+    explicitSuccess?: string;
+}): {
+    gate: ProposedGate;
+    rationale: string;
+};
+//# sourceMappingURL=propose-gate.d.ts.map

package/dist/cli/lib/contract/propose-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"propose-gate.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/contract/propose-gate.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAsBD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,UAAU,GAAG,SAAS,CAAC;IAC9B,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,GAAG;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CA8B5C"}

package/dist/cli/lib/contract/propose-gate.js

@@ -0,0 +1,57 @@
+import fs from "node:fs";
+import path from "node:path";
+function packageScripts(root) {
+    const abs = path.join(root, "package.json");
+    if (!fs.existsSync(abs))
+        return [];
+    try {
+        const scripts = JSON.parse(fs.readFileSync(abs, "utf8")).scripts;
+        return scripts ? Object.keys(scripts).sort() : [];
+    }
+    catch {
+        return [];
+    }
+}
+function rootSegmentHits(command, roots) {
+    let hits = 0;
+    for (const root of roots) {
+        const seg = root.replace(/\/$/, "").split("/").filter(Boolean).pop();
+        if (seg && command.includes(seg))
+            hits += 1;
+    }
+    return hits;
+}
+/**
+ * Prefer a skill allowlist entry whose text names a proposed TMVC root segment (e.g. `test:billing`),
+ * else the first allowlisted command. `package.json` script names are a secondary signal when no
+ * allowlist exists. Falls back to `echo OK` so interrogation can raise `missing_test_criteria`.
+ */
+export function proposeGate(input) {
+    if (input.explicitCommand?.trim()) {
+        const command = input.explicitCommand.trim();
+        return {
+            gate: {
+                command,
+                successSubstring: input.explicitSuccess !== undefined ? input.explicitSuccess.trim() || null : null,
+            },
+            rationale: `gate_command from --gate-command: ${command}`,
+        };
+    }
+    const allow = input.skill?.gate_commands ?? [];
+    if (allow.length > 0) {
+        const ranked = [...allow].sort((a, b) => rootSegmentHits(b, input.proposedRoots) - rootSegmentHits(a, input.proposedRoots) || a.localeCompare(b));
+        const command = ranked[0];
+        return { gate: { command, successSubstring: null }, rationale: `gate_command from skill allowlist: ${command}` };
+    }
+    const scripts = packageScripts(input.root);
+    const scriptHit = scripts.find((s) => rootSegmentHits(`npm run ${s}`, input.proposedRoots) > 0);
+    if (scriptHit) {
+        const command = `npm run ${scriptHit}`;
+        return { gate: { command, successSubstring: null }, rationale: `gate_command from package.json script matching a TMVC segment: ${command}` };
+    }
+    return {
+        gate: { command: "echo OK", successSubstring: "OK" },
+        rationale: "gate_command fallback echo OK (no skill allowlist; interrogation may raise missing_test_criteria)",
+    };
+}
+//# sourceMappingURL=propose-gate.js.map

package/dist/cli/lib/contract/propose-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"propose-gate.js","sourceRoot":"","sources":["../../../../src/cli/lib/contract/propose-gate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAQ7B,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC5C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,OAAO,GAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAA0C,CAAC,OAAO,CAAC;QAC3G,OAAO,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,OAAe,EAAE,KAAwB;IAChE,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC;QACrE,IAAI,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,IAAI,IAAI,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,KAM3B;IACC,IAAI,KAAK,CAAC,eAAe,EAAE,IAAI,EAAE,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QAC7C,OAAO;YACL,IAAI,EAAE;gBACJ,OAAO;gBACP,gBAAgB,EAAE,KAAK,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI;aACpG;YACD,SAAS,EAAE,qCAAqC,OAAO,EAAE;SAC1D,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,aAAa,IAAI,EAAE,CAAC;IAC/C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC,GAAG,eAAe,CAAC,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QAClJ,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,sCAAsC,OAAO,EAAE,EAAE,CAAC;IACnH,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IAChG,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,WAAW,SAAS,EAAE,CAAC;QACvC,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,kEAAkE,OAAO,EAAE,EAAE,CAAC;IAC/I,CAAC;IAED,OAAO;QACL,IAAI,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,IAAI,EAAE;QACpD,SAAS,EAAE,mGAAmG;KAC/G,CAAC;AACJ,CAAC"}

package/dist/cli/lib/contract/propose-imports.d.ts

@@ -0,0 +1,26 @@
+import type { OrgPolicyBundle } from "../policy/policy-types.js";
+export interface WorkspacePackage {
+    name: string;
+    dir: string;
+}
+/** Workspace packages from root `package.json` `workspaces` (no npm expand). */
+export declare function listWorkspacePackages(root: string): WorkspacePackage[];
+export interface ProposeImportsInput {
+    root: string;
+    proposedRoots: readonly string[];
+    forbiddenZones: readonly string[];
+    policy: OrgPolicyBundle | null;
+}
+export interface ProposeImportsResult {
+    allowed_imports: string[];
+    banned_imports: string[];
+    extraForbidden: string[];
+    rationale: string[];
+}
+/**
+ * Allowed = bare specifiers already imported under proposed roots. Banned = policy ∪ arch
+ * substring rules ∪ specifiers seen only in forbidden zones. Workspace packages named by a
+ * banned specifier have their directory appended so relative traversal cannot substitute.
+ */
+export declare function proposeImports(input: ProposeImportsInput): ProposeImportsResult;
+//# sourceMappingURL=propose-imports.d.ts.map

package/dist/cli/lib/contract/propose-imports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"propose-imports.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/contract/propose-imports.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAEjE,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb;AAuBD,gFAAgF;AAChF,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAsBtE;AAoCD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,MAAM,EAAE,eAAe,GAAG,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,oBAAoB;IACnC,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,oBAAoB,CA0B/E"}