@jeger-ai/opengantry 3.2.6 → 3.4.0

package/dist/cli/lib/contract/propose-imports.js

@@ -0,0 +1,128 @@
+import fs from "node:fs";
+import path from "node:path";
+import { importMatchesBan } from "../ast-discovery.js";
+import { layerForFile, loadTargetArchitecture } from "../arch/cage/target-architecture.js";
+import { extractImportSites } from "../import-scanner.js";
+import { isBuiltinSpecifier } from "./resolve-specifier.js";
+import { listSourcesUnderRoots } from "./contract-scan.js";
+import { normalizeRepoRelativePath } from "../tmvc-path.js";
+function tryLoadArch(root) {
+    try {
+        return loadTargetArchitecture(root);
+    }
+    catch {
+        return null;
+    }
+}
+function expandWorkspaceGlob(root, glob) {
+    const trimmed = glob.replace(/\/\*$/, "").replace(/\/\*\*$/, "");
+    const abs = path.join(root, trimmed);
+    if (!fs.existsSync(abs) || !fs.statSync(abs).isDirectory())
+        return [];
+    const out = [];
+    for (const ent of fs.readdirSync(abs, { withFileTypes: true })) {
+        if (!ent.isDirectory())
+            continue;
+        const pkgJson = path.join(abs, ent.name, "package.json");
+        if (fs.existsSync(pkgJson))
+            out.push(path.posix.join(normalizeRepoRelativePath(trimmed), ent.name));
+    }
+    return out;
+}
+/** Workspace packages from root `package.json` `workspaces` (no npm expand). */
+export function listWorkspacePackages(root) {
+    const abs = path.join(root, "package.json");
+    if (!fs.existsSync(abs))
+        return [];
+    let parsed;
+    try {
+        parsed = JSON.parse(fs.readFileSync(abs, "utf8"));
+    }
+    catch {
+        return [];
+    }
+    const globs = Array.isArray(parsed.workspaces) ? parsed.workspaces : (parsed.workspaces?.packages ?? []);
+    const out = [];
+    for (const glob of globs) {
+        for (const dir of expandWorkspaceGlob(root, glob)) {
+            try {
+                const name = JSON.parse(fs.readFileSync(path.join(root, dir, "package.json"), "utf8")).name;
+                if (name)
+                    out.push({ name, dir: `${dir.replace(/\/$/, "")}/` });
+            }
+            catch {
+                /* skip malformed workspace package */
+            }
+        }
+    }
+    return out.sort((a, b) => a.name.localeCompare(b.name));
+}
+function collectBareSpecs(root, files) {
+    const specs = new Set();
+    for (const file of files) {
+        const abs = path.join(root, file);
+        if (!fs.existsSync(abs))
+            continue;
+        for (const site of extractImportSites(fs.readFileSync(abs, "utf8"))) {
+            if (!site.spec || site.spec.startsWith(".") || site.spec.startsWith("/") || isBuiltinSpecifier(site.spec))
+                continue;
+            specs.add(site.spec);
+        }
+    }
+    return [...specs].sort();
+}
+function bareSpecifiersUnder(root, roots) {
+    return collectBareSpecs(root, listSourcesUnderRoots(root, roots));
+}
+function specifiersInForbidden(root, forbidden) {
+    return collectBareSpecs(root, listSourcesUnderRoots(root, forbidden));
+}
+function archBannedForRoots(root, proposedRoots) {
+    const spec = tryLoadArch(root);
+    if (!spec)
+        return [];
+    const layers = new Set();
+    for (const r of proposedRoots)
+        layers.add(layerForFile(spec, r.endsWith("/") ? `${r}index.ts` : `${r}/index.ts`));
+    const out = new Set();
+    for (const rule of spec.rules) {
+        if (!rule.forbid_specifier_substring)
+            continue;
+        if (layers.has(rule.from_layer) || rule.from_layer === "*")
+            out.add(rule.forbid_specifier_substring);
+    }
+    return [...out].sort();
+}
+/**
+ * Allowed = bare specifiers already imported under proposed roots. Banned = policy ∪ arch
+ * substring rules ∪ specifiers seen only in forbidden zones. Workspace packages named by a
+ * banned specifier have their directory appended so relative traversal cannot substitute.
+ */
+export function proposeImports(input) {
+    const rationale = [];
+    const allowed = bareSpecifiersUnder(input.root, input.proposedRoots);
+    if (allowed.length > 0)
+        rationale.push(`allowed_imports from imports under ${input.proposedRoots.join(", ")}`);
+    const policyBanned = (input.policy?.banned_imports ?? []).map((b) => b.specifier.trim()).filter(Boolean);
+    const archBanned = archBannedForRoots(input.root, input.proposedRoots);
+    const forbiddenOnly = specifiersInForbidden(input.root, input.forbiddenZones).filter((s) => !allowed.some((a) => importMatchesBan(s, a) || importMatchesBan(a, s)));
+    const banned = [...new Set([...policyBanned, ...archBanned, ...forbiddenOnly])].sort();
+    if (policyBanned.length > 0)
+        rationale.push(`banned_imports from org policy: ${policyBanned.join(", ")}`);
+    if (archBanned.length > 0)
+        rationale.push(`banned_imports from TARGET_ARCHITECTURE: ${archBanned.join(", ")}`);
+    if (forbiddenOnly.length > 0)
+        rationale.push(`banned_imports observed only in forbidden zones: ${forbiddenOnly.join(", ")}`);
+    const extraForbidden = [];
+    for (const pkg of listWorkspacePackages(input.root)) {
+        if (!banned.some((b) => importMatchesBan(pkg.name, b) || importMatchesBan(b, pkg.name)))
+            continue;
+        extraForbidden.push(pkg.dir);
+    }
+    extraForbidden.sort();
+    if (extraForbidden.length > 0) {
+        rationale.push(`forbidden_zones += workspace packages of banned specifiers: ${extraForbidden.join(", ")}`);
+    }
+    return { allowed_imports: allowed, banned_imports: banned, extraForbidden, rationale };
+}
+//# sourceMappingURL=propose-imports.js.map

package/dist/cli/lib/contract/propose-imports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"propose-imports.js","sourceRoot":"","sources":["../../../../src/cli/lib/contract/propose-imports.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAA+B,MAAM,qCAAqC,CAAC;AACxH,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAQ5D,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,CAAC;QACH,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAE,IAAY;IACrD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;QAAE,OAAO,EAAE,CAAC;IACtE,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE;YAAE,SAAS;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QACzD,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC5C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,MAA2D,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAkB,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;IACzG,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,GAAG,IAAI,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC;gBACH,MAAM,IAAI,GAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAuB,CAAC,IAAI,CAAC;gBACnH,IAAI,IAAI;oBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;YAClE,CAAC;YAAC,MAAM,CAAC;gBACP,sCAAsC;YACxC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,KAAwB;IAC9D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClC,KAAK,MAAM,IAAI,IAAI,kBAAkB,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YACpE,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAS;YACpH,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAE,KAAwB;IACjE,OAAO,gBAAgB,CAAC,IAAI,EAAE,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY,EAAE,SAA4B;IACvE,OAAO,gBAAgB,CAAC,IAAI,EAAE,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,aAAgC;IACxE,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,aAAa;QAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IAClH,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,0BAA0B;YAAE,SAAS;QAC/C,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,KAAK,GAAG;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAgBD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAA0B;IACvD,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,SAAS,CAAC,IAAI,CAAC,sCAAsC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAE/G,MAAM,YAAY,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzG,MAAM,UAAU,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IACvE,MAAM,aAAa,GAAG,qBAAqB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC,MAAM,CAClF,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAC9E,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,YAAY,EAAE,GAAG,UAAU,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACvF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;QAAE,SAAS,CAAC,IAAI,CAAC,mCAAmC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1G,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,SAAS,CAAC,IAAI,CAAC,4CAA4C,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/G,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC;QAAE,SAAS,CAAC,IAAI,CAAC,oDAAoD,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAE7H,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,KAAK,MAAM,GAAG,IAAI,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,gBAAgB,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAAE,SAAS;QAClG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IACD,cAAc,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,SAAS,CAAC,IAAI,CAAC,+DAA+D,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7G,CAAC;IAED,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;AACzF,CAAC"}

package/dist/cli/lib/contract/propose.d.ts

@@ -0,0 +1,25 @@
+import type { MissionContract } from "./contract-types.js";
+import { type ProposedGate } from "./propose-gate.js";
+import type { Manifest } from "../types.js";
+import type { OrgPolicyBundle as PolicyBundle } from "../policy/policy-types.js";
+export interface ProposeContractInput {
+    root: string;
+    manifest: Manifest;
+    intent: string;
+    skillKey: string;
+    paths?: string[];
+    policy?: PolicyBundle | null;
+    gateCommand?: string;
+    gateSuccessSubstring?: string;
+}
+export interface ProposeContractResult {
+    contract: MissionContract;
+    gate: ProposedGate;
+    rationale: string[];
+}
+/**
+ * Deterministic contract proposal (ADR-0030: no LLM). Same inputs always yield the same
+ * normalized contract, gate, and sorted rationale.
+ */
+export declare function proposeContract(input: ProposeContractInput): ProposeContractResult;
+//# sourceMappingURL=propose.d.ts.map

package/dist/cli/lib/contract/propose.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"propose.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/contract/propose.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAe,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,eAAe,IAAI,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAGjF,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,eAAe,CAAC;IAC1B,IAAI,EAAE,YAAY,CAAC;IACnB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AA4DD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,qBAAqB,CAmClF"}

package/dist/cli/lib/contract/propose.js

@@ -0,0 +1,100 @@
+import fs from "node:fs";
+import path from "node:path";
+import { loadPolicyBundleQuiet } from "./effective-scope.js";
+import { normalizeContract, normalizeContractPath } from "./contract-hash.js";
+import { proposeGate } from "./propose-gate.js";
+import { proposeImports } from "./propose-imports.js";
+import { isPathUnderRoot } from "../tmvc-path.js";
+import { resolveManifestSkillKey } from "../skill-key.js";
+const PATH_TOKEN_RE = /(?:\.{0,2}\/)?[A-Za-z0-9_.@-]+(?:\/[A-Za-z0-9_.@-]+)+\/?/g;
+function existsRepoPath(root, rel) {
+    return fs.existsSync(path.join(root, rel));
+}
+function intentPathTokens(intent) {
+    const out = [];
+    for (const m of intent.matchAll(PATH_TOKEN_RE)) {
+        const norm = normalizeContractPath(m[0]);
+        if (norm && !norm.includes("://"))
+            out.push(norm);
+    }
+    return out;
+}
+function intersectWithSkillRoots(candidates, skillRoots) {
+    if (skillRoots.length === 0)
+        return [...candidates];
+    return candidates.filter((c) => skillRoots.some((s) => isPathUnderRoot(c, s)));
+}
+function proposeTmvcRoots(input, skillRoots) {
+    const hinted = [...intentPathTokens(input.intent), ...(input.paths ?? []).map(normalizeContractPath)];
+    const existing = [...new Set(hinted)].filter((p) => existsRepoPath(input.root, p.replace(/\/$/, ""))).sort();
+    const narrowed = intersectWithSkillRoots(existing, skillRoots);
+    if (narrowed.length > 0) {
+        return {
+            roots: narrowed,
+            rationale: `tmvc_roots from intent/--path that exist on disk (intersect skill roots): ${narrowed.join(", ")}`,
+        };
+    }
+    if (skillRoots.length > 0) {
+        return { roots: [...skillRoots].sort(), rationale: `tmvc_roots fallback to skill roots: ${skillRoots.join(", ")}` };
+    }
+    return { roots: [], rationale: "tmvc_roots empty (substrate skill; Planner must declare roots)" };
+}
+function proposeForbidden(skillForbidden, policy, manifest, proposedRoots) {
+    const rationale = [];
+    const policyAdd = (policy?.manifest_constraints?.forbidden_zones_add ?? []).map(normalizeContractPath);
+    const tier3 = [];
+    for (const [prefix, tier] of Object.entries(manifest.path_risks)) {
+        if (tier !== "Tier-3")
+            continue;
+        const norm = normalizeContractPath(prefix);
+        const covered = proposedRoots.some((r) => isPathUnderRoot(norm, r) || isPathUnderRoot(r, norm));
+        if (!covered)
+            tier3.push(norm);
+    }
+    const zones = [...new Set([...skillForbidden, ...policyAdd, ...tier3])].sort();
+    if (skillForbidden.length > 0)
+        rationale.push(`forbidden_zones from skill: ${skillForbidden.join(", ")}`);
+    if (policyAdd.length > 0)
+        rationale.push(`forbidden_zones from policy: ${policyAdd.join(", ")}`);
+    if (tier3.length > 0)
+        rationale.push(`forbidden_zones from Tier-3 path_risks outside proposed roots: ${tier3.join(", ")}`);
+    return { zones, rationale };
+}
+/**
+ * Deterministic contract proposal (ADR-0030: no LLM). Same inputs always yield the same
+ * normalized contract, gate, and sorted rationale.
+ */
+export function proposeContract(input) {
+    const skillKey = resolveManifestSkillKey(input.manifest, input.skillKey);
+    const skill = input.manifest.skills[skillKey];
+    const skillRoots = (skill?.tmvc_roots ?? []).map(normalizeContractPath);
+    const skillForbidden = (skill?.forbidden_zones ?? []).map(normalizeContractPath);
+    const policy = input.policy !== undefined ? input.policy : loadPolicyBundleQuiet(input.root);
+    const tmvc = proposeTmvcRoots(input, skillRoots);
+    const forbidden = proposeForbidden(skillForbidden, policy, input.manifest, tmvc.roots);
+    const imports = proposeImports({
+        root: input.root,
+        proposedRoots: tmvc.roots,
+        forbiddenZones: forbidden.zones,
+        policy,
+    });
+    const gate = proposeGate({
+        root: input.root,
+        skill,
+        proposedRoots: tmvc.roots,
+        explicitCommand: input.gateCommand,
+        explicitSuccess: input.gateSuccessSubstring,
+    });
+    const contract = normalizeContract({
+        ...(tmvc.roots.length > 0 ? { tmvc_roots: tmvc.roots } : {}),
+        forbidden_zones: [...forbidden.zones, ...imports.extraForbidden],
+        allowed_imports: imports.allowed_imports,
+        banned_imports: imports.banned_imports,
+    });
+    return {
+        contract,
+        gate: gate.gate,
+        rationale: [tmvc.rationale, ...forbidden.rationale, ...imports.rationale, gate.rationale],
+    };
+}
+//# sourceMappingURL=propose.js.map

package/dist/cli/lib/contract/propose.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"propose.js","sourceRoot":"","sources":["../../../../src/cli/lib/contract/propose.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE9E,OAAO,EAAE,WAAW,EAAqB,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAGlD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAmB1D,MAAM,aAAa,GAAG,2DAA2D,CAAC;AAElF,SAAS,cAAc,CAAC,IAAY,EAAE,GAAW;IAC/C,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc;IACtC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;QAC1C,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,uBAAuB,CAAC,UAA6B,EAAE,UAA6B;IAC3F,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC;IACpD,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,gBAAgB,CAAC,KAA2B,EAAE,UAA6B;IAClF,MAAM,MAAM,GAAG,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACtG,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7G,MAAM,QAAQ,GAAG,uBAAuB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC/D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,KAAK,EAAE,QAAQ;YACf,SAAS,EAAE,6EAA6E,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC9G,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,uCAAuC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IACtH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,gEAAgE,EAAE,CAAC;AACpG,CAAC;AAED,SAAS,gBAAgB,CACvB,cAAiC,EACjC,MAA2B,EAC3B,QAAkB,EAClB,aAAgC;IAEhC,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,CAAC,MAAM,EAAE,oBAAoB,EAAE,mBAAmB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACvG,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACjE,IAAI,IAAI,KAAK,QAAQ;YAAE,SAAS;QAChC,MAAM,IAAI,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAChG,IAAI,CAAC,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,cAAc,EAAE,GAAG,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/E,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC;QAAE,SAAS,CAAC,IAAI,CAAC,+BAA+B,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1G,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,SAAS,CAAC,IAAI,CAAC,gCAAgC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjG,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,SAAS,CAAC,IAAI,CAAC,kEAAkE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3H,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAA2B;IACzD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACxE,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACjF,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAE7F,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,gBAAgB,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACvF,MAAM,OAAO,GAAG,cAAc,CAAC;QAC7B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,aAAa,EAAE,IAAI,CAAC,KAAK;QACzB,cAAc,EAAE,SAAS,CAAC,KAAK;QAC/B,MAAM;KACP,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,WAAW,CAAC;QACvB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,KAAK;QACL,aAAa,EAAE,IAAI,CAAC,KAAK;QACzB,eAAe,EAAE,KAAK,CAAC,WAAW;QAClC,eAAe,EAAE,KAAK,CAAC,oBAAoB;KAC5C,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,iBAAiB,CAAC;QACjC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,eAAe,EAAE,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC;QAChE,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,cAAc,EAAE,OAAO,CAAC,cAAc;KACvC,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ;QACR,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,SAAS,CAAC,SAAS,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC;KAC1F,CAAC;AACJ,CAAC"}

package/dist/cli/lib/contract/resolve-specifier.d.ts

@@ -0,0 +1,34 @@
+export type SpecifierClass = {
+    kind: "builtin";
+    specifier: string;
+} | {
+    kind: "bare";
+    specifier: string;
+    packageName: string;
+} | {
+    kind: "relative";
+    specifier: string;
+    resolvedRepoRel: string;
+} | {
+    kind: "alias";
+    specifier: string;
+    resolvedRepoRel: string;
+};
+export interface TsconfigPaths {
+    /** Repo-relative directory that `paths` targets resolve against. */
+    baseDirRel: string;
+    /** Alias pattern → target patterns (tsconfig `compilerOptions.paths`). */
+    paths: Record<string, string[]>;
+}
+export declare function isBuiltinSpecifier(spec: string): boolean;
+/** `@scope/name/sub` → `@scope/name`; `name/sub` → `name`. */
+export declare function bareSpecifierPackage(spec: string): string;
+/** Read `compilerOptions.paths` from `<repo>/tsconfig.json` (no `extends` chasing). Null when absent. */
+export declare function loadTsconfigPaths(repoRoot: string, tsconfigRel?: string): TsconfigPaths | null;
+/**
+ * Classify a module specifier for contract checks. Relative and alias specifiers resolve to a
+ * repo-relative path (extension left as written; directory prefix checks do not need it). Alias
+ * specifiers that match no tsconfig path are treated as bare packages.
+ */
+export declare function classifySpecifier(spec: string, importerRepoRel: string, tsconfigPaths: TsconfigPaths | null): SpecifierClass;
+//# sourceMappingURL=resolve-specifier.d.ts.map

package/dist/cli/lib/contract/resolve-specifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-specifier.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/contract/resolve-specifier.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,GAChE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CAAC;AAElE,MAAM,WAAW,aAAa;IAC5B,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACjC;AAID,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIxD;AAED,8DAA8D;AAC9D,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIzD;AAQD,yGAAyG;AACzG,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,SAAkB,GAAG,aAAa,GAAG,IAAI,CAevG;AA6BD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,eAAe,EAAE,MAAM,EACvB,aAAa,EAAE,aAAa,GAAG,IAAI,GAClC,cAAc,CAahB"}

package/dist/cli/lib/contract/resolve-specifier.js

@@ -0,0 +1,93 @@
+import fs from "node:fs";
+import { builtinModules } from "node:module";
+import path from "node:path";
+import { normalizeRepoRelativePath } from "../tmvc-path.js";
+const BUILTINS = new Set(builtinModules);
+export function isBuiltinSpecifier(spec) {
+    if (spec.startsWith("node:"))
+        return true;
+    const base = spec.split("/")[0] ?? spec;
+    return BUILTINS.has(base);
+}
+/** `@scope/name/sub` → `@scope/name`; `name/sub` → `name`. */
+export function bareSpecifierPackage(spec) {
+    const parts = spec.split("/");
+    if (spec.startsWith("@") && parts.length >= 2)
+        return `${parts[0]}/${parts[1]}`;
+    return parts[0] ?? spec;
+}
+function stripJsonComments(raw) {
+    const noBlock = raw.replace(/\/\*[\s\S]*?\*\//g, "");
+    const noLine = noBlock.replace(/(^|[^:"'\\])\/\/[^\n]*/g, "$1");
+    return noLine.replace(/,(\s*[}\]])/g, "$1");
+}
+/** Read `compilerOptions.paths` from `<repo>/tsconfig.json` (no `extends` chasing). Null when absent. */
+export function loadTsconfigPaths(repoRoot, tsconfigRel = "tsconfig.json") {
+    const abs = path.join(repoRoot, tsconfigRel);
+    if (!fs.existsSync(abs))
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(stripJsonComments(fs.readFileSync(abs, "utf8")));
+    }
+    catch {
+        return null;
+    }
+    const paths = parsed.compilerOptions?.paths;
+    if (!paths || Object.keys(paths).length === 0)
+        return null;
+    const tsconfigDir = path.posix.dirname(normalizeRepoRelativePath(tsconfigRel));
+    const baseUrl = parsed.compilerOptions?.baseUrl ?? ".";
+    const baseDirRel = normalizeRepoRelativePath(path.posix.normalize(path.posix.join(tsconfigDir === "." ? "" : tsconfigDir, baseUrl)));
+    return { baseDirRel: baseDirRel === "." ? "" : baseDirRel, paths };
+}
+function matchAliasPattern(spec, pattern) {
+    const star = pattern.indexOf("*");
+    if (star === -1)
+        return spec === pattern ? "" : null;
+    const prefix = pattern.slice(0, star);
+    const suffix = pattern.slice(star + 1);
+    if (!spec.startsWith(prefix) || !spec.endsWith(suffix) || spec.length < prefix.length + suffix.length)
+        return null;
+    return spec.slice(prefix.length, spec.length - suffix.length);
+}
+function resolveAlias(spec, ts) {
+    for (const [pattern, targets] of Object.entries(ts.paths)) {
+        const wildcard = matchAliasPattern(spec, pattern);
+        if (wildcard === null)
+            continue;
+        const target = targets[0];
+        if (!target)
+            continue;
+        const substituted = target.replace("*", wildcard);
+        const joined = path.posix.join(ts.baseDirRel, substituted);
+        return normalizeRepoRelativePath(path.posix.normalize(joined));
+    }
+    return null;
+}
+function resolveRelative(importerRepoRel, spec) {
+    const dir = path.posix.dirname(normalizeRepoRelativePath(importerRepoRel));
+    return normalizeRepoRelativePath(path.posix.normalize(path.posix.join(dir, spec)));
+}
+/**
+ * Classify a module specifier for contract checks. Relative and alias specifiers resolve to a
+ * repo-relative path (extension left as written; directory prefix checks do not need it). Alias
+ * specifiers that match no tsconfig path are treated as bare packages.
+ */
+export function classifySpecifier(spec, importerRepoRel, tsconfigPaths) {
+    if (spec.startsWith(".")) {
+        return { kind: "relative", specifier: spec, resolvedRepoRel: resolveRelative(importerRepoRel, spec) };
+    }
+    if (spec.startsWith("/")) {
+        return { kind: "relative", specifier: spec, resolvedRepoRel: normalizeRepoRelativePath(spec.slice(1)) };
+    }
+    if (isBuiltinSpecifier(spec))
+        return { kind: "builtin", specifier: spec };
+    if (tsconfigPaths) {
+        const resolved = resolveAlias(spec, tsconfigPaths);
+        if (resolved !== null)
+            return { kind: "alias", specifier: spec, resolvedRepoRel: resolved };
+    }
+    return { kind: "bare", specifier: spec, packageName: bareSpecifierPackage(spec) };
+}
+//# sourceMappingURL=resolve-specifier.js.map

package/dist/cli/lib/contract/resolve-specifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-specifier.js","sourceRoot":"","sources":["../../../../src/cli/lib/contract/resolve-specifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAe5D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;AAEzC,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACxC,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC1B,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACpC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,yBAAyB,EAAE,IAAI,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,WAAW,GAAG,eAAe;IAC/E,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC7C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,MAAoF,CAAC;IACzF,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAkB,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,EAAE,KAAK,CAAC;IAC5C,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe,EAAE,OAAO,IAAI,GAAG,CAAC;IACvD,MAAM,UAAU,GAAG,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACrI,OAAO,EAAE,UAAU,EAAE,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC;AACrE,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,OAAe;IACtD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,IAAI,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACrD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IACvC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACnH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,EAAiB;IACnD,KAAK,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,QAAQ,KAAK,IAAI;YAAE,SAAS;QAChC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAC3D,OAAO,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,eAAuB,EAAE,IAAY;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAC,eAAe,CAAC,CAAC,CAAC;IAC3E,OAAO,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AACrF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,eAAuB,EACvB,aAAmC;IAEnC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,eAAe,CAAC,eAAe,EAAE,IAAI,CAAC,EAAE,CAAC;IACxG,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1G,CAAC;IACD,IAAI,kBAAkB,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC1E,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACnD,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;IAC9F,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;AACpF,CAAC"}

package/dist/cli/lib/defensive-profile-presets.d.ts

@@ -7,4 +7,10 @@ export declare function parseDefensiveProfilePreset(raw: string): DefensiveProfi
 /** Build a full defensive_profile config for init scaffolding from a named preset. */
 export declare function buildDefensiveProfileFromPreset(preset: DefensiveProfilePresetName): DefensiveProfileConfig;
 export declare function presetDefaultSeverity(preset: DefensiveProfilePresetName): GuardSeverity;
+/** Config keys a named defensive preset implies when the operator has not set them. */
+export declare function presetConfigDefaults(preset: DefensiveProfilePresetName): {
+    ledger?: {
+        mode: "local";
+    };
+};
 //# sourceMappingURL=defensive-profile-presets.d.ts.map

package/dist/cli/lib/defensive-profile-presets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"defensive-profile-presets.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/defensive-profile-presets.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEpF,eAAO,MAAM,8BAA8B,uEAIjC,CAAC;AAEX,MAAM,MAAM,0BAA0B,GAAG,CAAC,OAAO,8BAA8B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzF,eAAO,MAAM,+BAA+B,EAAE,MAAM,CAAC,0BAA0B,EAAE,MAAM,CAItF,CAAC;AAEF,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,0BAA0B,CAE/F;AAED,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,GAAG,0BAA0B,CAOnF;AAkCD,sFAAsF;AACtF,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,0BAA0B,GACjC,sBAAsB,CA4BxB;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,0BAA0B,GAAG,aAAa,CAEvF"}
+{"version":3,"file":"defensive-profile-presets.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/defensive-profile-presets.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEpF,eAAO,MAAM,8BAA8B,uEAIjC,CAAC;AAEX,MAAM,MAAM,0BAA0B,GAAG,CAAC,OAAO,8BAA8B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzF,eAAO,MAAM,+BAA+B,EAAE,MAAM,CAAC,0BAA0B,EAAE,MAAM,CAItF,CAAC;AAEF,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,0BAA0B,CAE/F;AAED,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,GAAG,0BAA0B,CAOnF;AAkCD,sFAAsF;AACtF,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,0BAA0B,GACjC,sBAAsB,CA4BxB;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,0BAA0B,GAAG,aAAa,CAEvF;AAED,uFAAuF;AACvF,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,0BAA0B,GAAG;IACxE,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;CAC5B,CAYA"}

package/dist/cli/lib/defensive-profile-presets.js

@@ -4,7 +4,7 @@ export const DEFENSIVE_PROFILE_PRESET_NAMES = [
     "lean_scratchpad",
 ];
 export const DEFENSIVE_PROFILE_PRESET_LABELS = {
-    strict_enterprise: "Strict Enterprise — block risky diffs",
+    strict_enterprise: "Strict Enterprise — block risky diffs (also defaults ledger.mode to local)",
     balanced_partner: "Balanced Partner — warn on risky diffs",
     lean_scratchpad: "Lean Scratchpad — audit telemetry only",
 };
@@ -73,4 +73,18 @@ export function buildDefensiveProfileFromPreset(preset) {
 export function presetDefaultSeverity(preset) {
     return PRESET_DEFAULTS[preset].severity;
 }
+/** Config keys a named defensive preset implies when the operator has not set them. */
+export function presetConfigDefaults(preset) {
+    switch (preset) {
+        case "strict_enterprise":
+            return { ledger: { mode: "local" } };
+        case "balanced_partner":
+        case "lean_scratchpad":
+            return {};
+        default: {
+            const _never = preset;
+            return _never;
+        }
+    }
+}
 //# sourceMappingURL=defensive-profile-presets.js.map

package/dist/cli/lib/defensive-profile-presets.js.map

@@ -1 +1 @@
-{"version":3,"file":"defensive-profile-presets.js","sourceRoot":"","sources":["../../../src/cli/lib/defensive-profile-presets.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,mBAAmB;IACnB,kBAAkB;IAClB,iBAAiB;CACT,CAAC;AAIX,MAAM,CAAC,MAAM,+BAA+B,GAA+C;IACzF,iBAAiB,EAAE,uCAAuC;IAC1D,gBAAgB,EAAE,wCAAwC;IAC1D,eAAe,EAAE,wCAAwC;CAC1D,CAAC;AAEF,MAAM,UAAU,4BAA4B,CAAC,KAAa;IACxD,OAAQ,8BAAoD,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,GAAW;IACrD,IAAI,CAAC,4BAA4B,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,4CAA4C,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAUD,MAAM,eAAe,GAA4D;IAC/E,iBAAiB,EAAE;QACjB,QAAQ,EAAE,OAAO;QACjB,WAAW,EAAE,GAAG;QAChB,SAAS,EAAE,EAAE;QACb,eAAe,EAAE,IAAI;QACrB,mBAAmB,EAAE,CAAC;KACvB;IACD,gBAAgB,EAAE;QAChB,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,GAAG;QAChB,SAAS,EAAE,EAAE;QACb,eAAe,EAAE,IAAI;QACrB,mBAAmB,EAAE,CAAC;KACvB;IACD,eAAe,EAAE;QACf,QAAQ,EAAE,OAAO;QACjB,WAAW,EAAE,GAAG;QAChB,SAAS,EAAE,EAAE;QACb,eAAe,EAAE,IAAI;QACrB,mBAAmB,EAAE,CAAC;KACvB;CACF,CAAC;AAEF,sFAAsF;AACtF,MAAM,UAAU,+BAA+B,CAC7C,MAAkC;IAElC,MAAM,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO;QACL,OAAO,EAAE,IAAI;QACb,MAAM;QACN,MAAM,EAAE;YACN,cAAc,EAAE;gBACd,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,WAAW,EAAE,CAAC,CAAC,WAAW;aAC3B;YACD,UAAU,EAAE;gBACV,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,SAAS,EAAE,CAAC,CAAC,SAAS;aACvB;YACD,WAAW,EAAE;gBACX,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,SAAS,EAAE,CAAC,CAAC,eAAe;aAC7B;YACD,YAAY,EAAE;gBACZ,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;aAC3C;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAkC;IACtE,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"defensive-profile-presets.js","sourceRoot":"","sources":["../../../src/cli/lib/defensive-profile-presets.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,mBAAmB;IACnB,kBAAkB;IAClB,iBAAiB;CACT,CAAC;AAIX,MAAM,CAAC,MAAM,+BAA+B,GAA+C;IACzF,iBAAiB,EAAE,4EAA4E;IAC/F,gBAAgB,EAAE,wCAAwC;IAC1D,eAAe,EAAE,wCAAwC;CAC1D,CAAC;AAEF,MAAM,UAAU,4BAA4B,CAAC,KAAa;IACxD,OAAQ,8BAAoD,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,GAAW;IACrD,IAAI,CAAC,4BAA4B,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,4CAA4C,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAUD,MAAM,eAAe,GAA4D;IAC/E,iBAAiB,EAAE;QACjB,QAAQ,EAAE,OAAO;QACjB,WAAW,EAAE,GAAG;QAChB,SAAS,EAAE,EAAE;QACb,eAAe,EAAE,IAAI;QACrB,mBAAmB,EAAE,CAAC;KACvB;IACD,gBAAgB,EAAE;QAChB,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,GAAG;QAChB,SAAS,EAAE,EAAE;QACb,eAAe,EAAE,IAAI;QACrB,mBAAmB,EAAE,CAAC;KACvB;IACD,eAAe,EAAE;QACf,QAAQ,EAAE,OAAO;QACjB,WAAW,EAAE,GAAG;QAChB,SAAS,EAAE,EAAE;QACb,eAAe,EAAE,IAAI;QACrB,mBAAmB,EAAE,CAAC;KACvB;CACF,CAAC;AAEF,sFAAsF;AACtF,MAAM,UAAU,+BAA+B,CAC7C,MAAkC;IAElC,MAAM,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO;QACL,OAAO,EAAE,IAAI;QACb,MAAM;QACN,MAAM,EAAE;YACN,cAAc,EAAE;gBACd,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,WAAW,EAAE,CAAC,CAAC,WAAW;aAC3B;YACD,UAAU,EAAE;gBACV,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,SAAS,EAAE,CAAC,CAAC,SAAS;aACvB;YACD,WAAW,EAAE;gBACX,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,SAAS,EAAE,CAAC,CAAC,eAAe;aAC7B;YACD,YAAY,EAAE;gBACZ,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;aAC3C;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAkC;IACtE,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;AAC1C,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,oBAAoB,CAAC,MAAkC;IAGrE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,mBAAmB;YACtB,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;QACvC,KAAK,kBAAkB,CAAC;QACxB,KAAK,iBAAiB;YACpB,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,MAAM,GAAU,MAAM,CAAC;YAC7B,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/cli/lib/deps/deps-fetch.d.ts

@@ -0,0 +1,4 @@
+import type { MissionDependencySpec } from "../types.js";
+/** Explicit network path (ADR-0026 / ADR-0044). Doctor and verify MUST NOT call this. */
+export declare function fetchMissionDependency(root: string, dep: MissionDependencySpec): string;
+//# sourceMappingURL=deps-fetch.d.ts.map

package/dist/cli/lib/deps/deps-fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deps-fetch.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/deps/deps-fetch.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGzD,yFAAyF;AACzF,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,qBAAqB,GAAG,MAAM,CAcvF"}

package/dist/cli/lib/deps/deps-fetch.js

@@ -0,0 +1,16 @@
+import { gitRun } from "../git.js";
+import { GantryUserError } from "../errors.js";
+import { GXT_ERROR } from "../gxt-error-codes.js";
+import { assertSafeFetchRef, depsRefForRepo, gitUrlForRepo } from "./deps-slug.js";
+/** Explicit network path (ADR-0026 / ADR-0044). Doctor and verify MUST NOT call this. */
+export function fetchMissionDependency(root, dep) {
+    const destRef = depsRefForRepo(dep.repo);
+    const srcRef = assertSafeFetchRef(dep.ref ?? "refs/gxt/ledger");
+    const url = gitUrlForRepo(dep.repo);
+    const r = gitRun(root, ["fetch", "--", url, `${srcRef}:${destRef}`]);
+    if (!r.ok) {
+        throw new GantryUserError(GXT_ERROR.DEPENDENCY_UNFETCHED, `gantry deps fetch failed for ${dep.repo}: ${r.stderr.trim()}`, "grant read access to refs/gxt/ledger or check the URL", 1);
+    }
+    return destRef;
+}
+//# sourceMappingURL=deps-fetch.js.map

package/dist/cli/lib/deps/deps-fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deps-fetch.js","sourceRoot":"","sources":["../../../../src/cli/lib/deps/deps-fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEnF,yFAAyF;AACzF,MAAM,UAAU,sBAAsB,CAAC,IAAY,EAAE,GAA0B;IAC7E,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,GAAG,IAAI,iBAAiB,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,MAAM,IAAI,eAAe,CACvB,SAAS,CAAC,oBAAoB,EAC9B,gCAAgC,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAC9D,uDAAuD,EACvD,CAAC,CACF,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/cli/lib/deps/deps-resolve.d.ts

@@ -0,0 +1,18 @@
+import { GXT_ERROR } from "../gxt-error-codes.js";
+import { type MissionDependencySpec, type ParsedMission } from "../types.js";
+export type DependencyFailureCode = typeof GXT_ERROR.DEPENDENCY_UNFETCHED | typeof GXT_ERROR.DEPENDENCY_UNSATISFIED | typeof GXT_ERROR.DEPENDENCY_UNSIGNED | typeof GXT_ERROR.DEPENDENCY_STALE | typeof GXT_ERROR.DEPENDENCY_ORG_MISMATCH;
+export type DependencyCheckResult = {
+    code: "ok";
+    repo: string;
+    msn_id: string;
+} | {
+    code: DependencyFailureCode;
+    repo: string;
+    msn_id: string;
+    message: string;
+};
+/** Offline: walk fetched refs/gxt/deps/<slug> only. */
+export declare function checkMissionDependency(root: string, dep: MissionDependencySpec): DependencyCheckResult;
+/** Check every depends_on row and append one aggregated ok ledger entry. */
+export declare function checkMissionDependencies(root: string, mission: ParsedMission): DependencyCheckResult[];
+//# sourceMappingURL=deps-resolve.d.ts.map

package/dist/cli/lib/deps/deps-resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deps-resolve.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/deps/deps-resolve.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAIlD,OAAO,EAAkB,KAAK,qBAAqB,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAG7F,MAAM,MAAM,qBAAqB,GAC7B,OAAO,SAAS,CAAC,oBAAoB,GACrC,OAAO,SAAS,CAAC,sBAAsB,GACvC,OAAO,SAAS,CAAC,mBAAmB,GACpC,OAAO,SAAS,CAAC,gBAAgB,GACjC,OAAO,SAAS,CAAC,uBAAuB,CAAC;AAE7C,MAAM,MAAM,qBAAqB,GAC7B;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAenF,uDAAuD;AACvD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,qBAAqB,GAAG,qBAAqB,CAuCtG;AAED,4EAA4E;AAC5E,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,qBAAqB,EAAE,CAWtG"}

package/dist/cli/lib/deps/deps-resolve.js

@@ -0,0 +1,66 @@
+import { hmacSha256Hex, canonicalizeRepositoryIdentifier } from "../receipt-attribution.js";
+import { resolveOrgExportConfig } from "../org-export-config.js";
+import { GXT_ERROR } from "../gxt-error-codes.js";
+import { appendLedgerIfEnabled } from "../ledger/ledger-append.js";
+import { readLedgerTip, verifyLedgerChain } from "../ledger/ledger-chain.js";
+import { msnIdOrDefault } from "../types.js";
+import { depsRefForRepo } from "./deps-slug.js";
+function expectedRepoHash(root, repo) {
+    const org = resolveOrgExportConfig(root);
+    return hmacSha256Hex(org.pepper, canonicalizeRepositoryIdentifier(repo));
+}
+function fail(dep, code, message) {
+    return { repo: dep.repo, msn_id: dep.msn_id, code, message };
+}
+/** Offline: walk fetched refs/gxt/deps/<slug> only. */
+export function checkMissionDependency(root, dep) {
+    const ref = depsRefForRepo(dep.repo);
+    const tip = readLedgerTip(root, ref);
+    if (!tip) {
+        return fail(dep, GXT_ERROR.DEPENDENCY_UNFETCHED, `${ref} is not fetched`);
+    }
+    const chain = verifyLedgerChain(root, ref);
+    if (!chain.ok) {
+        return fail(dep, GXT_ERROR.DEPENDENCY_UNSATISFIED, chain.errors[0] ?? "dependency ledger chain broken");
+    }
+    const matches = [...chain.entries]
+        .reverse()
+        .filter((e) => e.msn_id === dep.msn_id && e.entry_kind === "receipt");
+    const newest = matches[0];
+    if (!newest) {
+        return fail(dep, GXT_ERROR.DEPENDENCY_UNSATISFIED, `no receipt entry for ${dep.msn_id}`);
+    }
+    const wantHash = dep.expected_repository_hash ?? expectedRepoHash(root, dep.repo);
+    if (newest.repository_hash !== wantHash) {
+        return fail(dep, GXT_ERROR.DEPENDENCY_ORG_MISMATCH, "repository_hash does not match consumer GANTRY_ORG_PEPPER");
+    }
+    const status = newest.payload.verify_status;
+    if ((dep.require?.verify_status ?? "passed") === "passed" && status !== "passed") {
+        return fail(dep, GXT_ERROR.DEPENDENCY_UNSATISFIED, `verify_status is ${String(status)}`);
+    }
+    if (dep.require?.signed === true && newest.payload.signed !== true) {
+        return fail(dep, GXT_ERROR.DEPENDENCY_UNSIGNED, "require.signed but newest receipt entry is unsigned");
+    }
+    if (dep.require?.max_age_days !== undefined) {
+        const issued = Date.parse(newest.issued_at);
+        const maxMs = dep.require.max_age_days * 86_400_000;
+        if (!Number.isFinite(issued) || Date.now() - issued > maxMs) {
+            return fail(dep, GXT_ERROR.DEPENDENCY_STALE, `entry older than ${dep.require.max_age_days} days`);
+        }
+    }
+    return { repo: dep.repo, msn_id: dep.msn_id, code: "ok" };
+}
+/** Check every depends_on row and append one aggregated ok ledger entry. */
+export function checkMissionDependencies(root, mission) {
+    const results = mission.dependsOn.map((d) => checkMissionDependency(root, d));
+    const okResults = results.filter((r) => r.code === "ok");
+    if (okResults.length > 0) {
+        appendLedgerIfEnabled(root, "dependency_check", msnIdOrDefault(mission), {
+            repo: okResults.map((r) => r.repo).join(","),
+            msn_id: msnIdOrDefault(mission),
+            result: "ok",
+        });
+    }
+    return results;
+}
+//# sourceMappingURL=deps-resolve.js.map

package/dist/cli/lib/deps/deps-resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deps-resolve.js","sourceRoot":"","sources":["../../../../src/cli/lib/deps/deps-resolve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,gCAAgC,EAAE,MAAM,2BAA2B,CAAC;AAC5F,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE7E,OAAO,EAAE,cAAc,EAAkD,MAAM,aAAa,CAAC;AAC7F,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAahD,SAAS,gBAAgB,CAAC,IAAY,EAAE,IAAY;IAClD,MAAM,GAAG,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACzC,OAAO,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,IAAI,CACX,GAA0B,EAC1B,IAA2B,EAC3B,OAAe;IAEf,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC/D,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,sBAAsB,CAAC,IAAY,EAAE,GAA0B;IAC7E,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,oBAAoB,EAAE,GAAG,GAAG,iBAAiB,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,sBAAsB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,gCAAgC,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;SAC/B,OAAO,EAAE;SACT,MAAM,CACL,CAAC,CAAC,EAAwD,EAAE,CAC1D,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,CACxD,CAAC;IACJ,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,sBAAsB,EAAE,wBAAwB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,wBAAwB,IAAI,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAClF,IAAI,MAAM,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,uBAAuB,EAAE,2DAA2D,CAAC,CAAC;IACnH,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC;IAC5C,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,IAAI,QAAQ,CAAC,KAAK,QAAQ,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACjF,OAAO,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,sBAAsB,EAAE,oBAAoB,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACnE,OAAO,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,mBAAmB,EAAE,qDAAqD,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,EAAE,YAAY,KAAK,SAAS,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,GAAG,UAAU,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,GAAG,KAAK,EAAE,CAAC;YAC5D,OAAO,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,gBAAgB,EAAE,oBAAoB,GAAG,CAAC,OAAO,CAAC,YAAY,OAAO,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5D,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,wBAAwB,CAAC,IAAY,EAAE,OAAsB;IAC3E,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9E,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAuD,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC9G,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,qBAAqB,CAAC,IAAI,EAAE,kBAAkB,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE;YACvE,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAC5C,MAAM,EAAE,cAAc,CAAC,OAAO,CAAC;YAC/B,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/cli/lib/deps/deps-slug.d.ts

@@ -0,0 +1,5 @@
+export declare function depsSlug(repo: string): string;
+export declare function depsRefForRepo(repo: string): string;
+export declare function gitUrlForRepo(repo: string): string;
+export declare function assertSafeFetchRef(ref: string): string;
+//# sourceMappingURL=deps-slug.d.ts.map

package/dist/cli/lib/deps/deps-slug.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deps-slug.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/deps/deps-slug.ts"],"names":[],"mappings":"AAyBA,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAK7C;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGnD;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAUlD;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAUtD"}