@lannguyensi/harness 0.64.0 → 1.0.0

package/dist/runtime/git-context.js

@@ -1,422 +0,0 @@
-// Resolves the `REPO` and `BRANCH` policy builtins from a working
-// directory.
-//
-// The intercept engine exposes `${REPO}` / `${BRANCH}` as `ledger_tag`
-// template builtins, but they were only ever populated from the
-// `HARNESS_REPO` / `HARNESS_BRANCH` env vars — which nothing sets — so
-// every `preflight:${REPO}` tag collapsed to the literal `preflight:`.
-// That silently degraded the founding-incident policies to one global
-// tag: a preflight done in repo A satisfied the gate in repo B.
-//
-// This module derives both values from the filesystem, not a `git`
-// subprocess: the intercept hook runs on every Bash / Edit / Write
-// tool call, so the resolution must stay cheap. A bounded walk up the
-// directory tree to find `.git`, plus one small `HEAD` read, is
-// microseconds and spawns no process.
-//
-// It is a deliberate approximation of `git rev-parse`: it reads the
-// work tree's basename and `.git/HEAD` directly and does NOT consult
-// `GIT_DIR` / `GIT_WORK_TREE` / `core.worktree`. For namespacing a
-// ledger tag, the on-disk layout is the right (and more stable)
-// signal; those exotic overrides are out of scope.
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { isValidProjectName } from "../io/project-name.js";
-const EMPTY = { repo: "", branch: "", sha: "" };
-// A `.git` *file* (linked worktree / submodule) points at the real git
-// dir: `gitdir: <path>`.
-const GITDIR_RE = /^gitdir:\s*(.+)$/;
-// `.git/HEAD` on a branch: `ref: refs/heads/<branch>`. A detached HEAD
-// holds a raw SHA instead and matches nothing here.
-const HEAD_REF_RE = /^ref:\s*refs\/heads\/(.+)$/;
-// A loose ref or detached-HEAD sha is exactly 40 lowercase hex chars.
-const SHA_RE = /^[0-9a-f]{40}$/;
-/**
- * Walk up from `startDir` looking for a `.git` entry. Handles both the
- * common `.git` directory and the `.git` *file* form used by linked
- * worktrees and submodules. The walk is bounded so a pathologically
- * deep cwd cannot spin.
- *
- * Exported (task T-001, record-verbs) so `cli/record/index.ts` can
- * locate the same `.git` directory this module resolves `repo`/
- * `branch`/`sha` from, without re-walking the tree with duplicate
- * logic — its base-branch resolution needs the raw git directory (to
- * read `refs/remotes/origin/HEAD` / `packed-refs`), which
- * `resolveGitContext`'s return shape does not expose. Behavior is
- * unchanged; this is a visibility-only change.
- */
-export function findGitEntry(startDir) {
-    let dir = path.resolve(startDir);
-    for (let depth = 0; depth < 128; depth++) {
-        const dotGit = path.join(dir, ".git");
-        let stat;
-        try {
-            stat = fs.statSync(dotGit);
-        }
-        catch {
-            stat = undefined;
-        }
-        if (stat?.isDirectory()) {
-            try {
-                if (!fs.statSync(path.join(dotGit, "HEAD")).isFile())
-                    return null;
-            }
-            catch {
-                return null;
-            }
-            return { worktreeRoot: dir, gitDir: dotGit };
-        }
-        if (stat?.isFile()) {
-            let gitDir = "";
-            try {
-                const match = GITDIR_RE.exec(fs.readFileSync(dotGit, "utf8").trim());
-                if (match)
-                    gitDir = path.resolve(dir, match[1].trim());
-            }
-            catch {
-                /* unreadable `.git` file — leave gitDir empty, repo still resolves */
-            }
-            return { worktreeRoot: dir, gitDir };
-        }
-        const parent = path.dirname(dir);
-        if (parent === dir)
-            return null; // hit the filesystem root
-        dir = parent;
-    }
-    return null;
-}
-/**
- * Look up a branch's sha by reading the loose ref file first, then
- * falling back to `packed-refs`. Both sources are plain text; the
- * lookup stays cheap (no `git` subprocess).
- */
-function resolveBranchSha(gitDir, branch) {
-    try {
-        const loose = fs
-            .readFileSync(path.join(gitDir, "refs", "heads", branch), "utf8")
-            .trim();
-        if (SHA_RE.test(loose))
-            return loose;
-    }
-    catch {
-        /* loose ref missing, try packed-refs */
-    }
-    try {
-        const packed = fs.readFileSync(path.join(gitDir, "packed-refs"), "utf8");
-        const target = `refs/heads/${branch}`;
-        for (const raw of packed.split("\n")) {
-            const line = raw.trim();
-            if (line === "" || line.startsWith("#") || line.startsWith("^"))
-                continue;
-            const [sha, ref] = line.split(/\s+/, 2);
-            if (ref === target && sha && SHA_RE.test(sha))
-                return sha;
-        }
-    }
-    catch {
-        /* packed-refs missing too — caller treats "" as "unknown" */
-    }
-    return "";
-}
-/**
- * Resolve `{ repo, branch, sha }` for a working directory. Returns empty
- * strings (never throws) when `cwd` is not inside a git work tree, or
- * when any individual lookup fails: callers treat "" as "unknown" and
- * fall through to their own behaviour.
- */
-export function resolveGitContext(cwd) {
-    if (typeof cwd !== "string" || cwd.length === 0)
-        return EMPTY;
-    const entry = findGitEntry(cwd);
-    if (!entry)
-        return EMPTY;
-    const repo = path.basename(entry.worktreeRoot);
-    let branch = "";
-    let sha = "";
-    if (entry.gitDir) {
-        try {
-            const head = fs.readFileSync(path.join(entry.gitDir, "HEAD"), "utf8").trim();
-            const match = HEAD_REF_RE.exec(head);
-            if (match) {
-                branch = match[1].trim();
-                // `refs/heads/<branch>` and `packed-refs` are not duplicated in
-                // a linked worktree's private gitdir; they live in the shared
-                // common dir (see `resolveCommonDir`'s doc comment). Routing
-                // through it here is a no-op for the main checkout (no
-                // `commondir` file, `resolveCommonDir` returns `gitDir`
-                // unchanged).
-                sha = resolveBranchSha(resolveCommonDir(entry.gitDir), branch);
-            }
-            else if (SHA_RE.test(head)) {
-                // Detached HEAD: the file contains the raw sha directly.
-                sha = head;
-            }
-        }
-        catch {
-            /* unreadable HEAD — branch + sha stay "" */
-        }
-    }
-    return { repo, branch, sha };
-}
-// ---------------------------------------------------------------------------
-// Default-branch resolution (offline, no `gh`/`git` subprocess).
-//
-// Originally written for `harness record review`'s `--base` fallback
-// (task T-001, record-verbs) and lived only in `cli/record/index.ts`.
-// Exported here (task post-merge-gate, T-001) so
-// `policy-packs/builtin/post-merge-gate-runtime.ts` can resolve the same
-// "what's the default branch to switch back to" answer for its deny
-// message without a policy-pack module reaching into `cli/`. Behavior is
-// unchanged; this is a visibility/location move, not a rewrite — see
-// `findGitEntry`'s doc comment above for the identical precedent
-// (record/index.ts reusing this module's git-dir walk instead of
-// duplicating it).
-// ---------------------------------------------------------------------------
-// `.git/refs/remotes/origin/HEAD` on a normal clone: a symbolic ref
-// pointing at the remote's default branch.
-const ORIGIN_HEAD_REF_RE = /^ref:\s*refs\/remotes\/origin\/(.+)$/;
-const ORIGIN_HEAD_REF_PATH = "refs/remotes/origin/HEAD";
-const ORIGIN_REMOTE_PREFIX = "refs/remotes/origin/";
-/**
- * Resolve the remote's default branch name from `<gitDir>/refs/remotes/
- * origin/HEAD`. Loose symbolic ref first (the normal shape: `ref: refs/
- * remotes/origin/<name>`, written by `git clone` / `git remote set-head
- * origin -a`). When that loose file is absent, falls back to
- * `packed-refs`: some git versions / tooling pack `refs/remotes/origin/
- * HEAD` as a plain `<sha> <ref>` entry instead of a symref, which loses
- * the branch NAME directly — recovered here by matching that sha
- * against another packed `refs/remotes/origin/<name>` entry that shares
- * it (mirrors the loose-then-packed shape `resolveBranchSha` uses
- * above, adapted since packed-refs has no symref concept). Returns null
- * when neither source resolves a name.
- */
-export function resolveOriginHeadBase(gitDir) {
-    try {
-        const raw = fs
-            .readFileSync(path.join(gitDir, "refs", "remotes", "origin", "HEAD"), "utf8")
-            .trim();
-        const match = ORIGIN_HEAD_REF_RE.exec(raw);
-        if (match)
-            return match[1].trim();
-    }
-    catch {
-        /* loose symref missing — try packed-refs */
-    }
-    try {
-        const packed = fs.readFileSync(path.join(gitDir, "packed-refs"), "utf8");
-        let headSha = null;
-        const entries = [];
-        for (const rawLine of packed.split("\n")) {
-            const line = rawLine.trim();
-            if (line === "" || line.startsWith("#") || line.startsWith("^"))
-                continue;
-            const parts = line.split(/\s+/);
-            const sha = parts[0];
-            const ref = parts[1];
-            if (!sha || !ref || !SHA_RE.test(sha))
-                continue;
-            if (ref === ORIGIN_HEAD_REF_PATH)
-                headSha = sha;
-            else
-                entries.push({ sha, ref });
-        }
-        if (headSha) {
-            const match = entries.find((e) => e.sha === headSha && e.ref.startsWith(ORIGIN_REMOTE_PREFIX));
-            if (match)
-                return match.ref.slice(ORIGIN_REMOTE_PREFIX.length);
-        }
-    }
-    catch {
-        /* packed-refs missing too — caller treats null as "unresolvable" */
-    }
-    return null;
-}
-/**
- * Resolve the actual shared git directory for `gitDir`, following the
- * `commondir` file linked worktrees write. `git worktree add` gives each
- * worktree its own private `.git` FILE pointing at `<main>/.git/
- * worktrees/<name>/` (what `findGitEntry` returns as `gitDir`), but
- * `refs/remotes/origin/HEAD` and `packed-refs` are NOT duplicated there
- * — they live only in the shared common dir, reachable via that
- * per-worktree directory's own `commondir` file (a path, normally
- * `../..`, relative to the per-worktree directory itself; see
- * `git-worktree(1)`). Without this indirection, `resolveOriginHeadBase`
- * would look for those refs in the empty per-worktree directory and
- * always miss. Returns `gitDir` unchanged when no `commondir` file
- * exists (the normal, non-worktree case).
- */
-export function resolveCommonDir(gitDir) {
-    try {
-        const raw = fs.readFileSync(path.join(gitDir, "commondir"), "utf8").trim();
-        if (raw.length > 0) {
-            // `path.normalize` on the absolute branch (review round 3,
-            // decision D-028's security finding): the relative branch already
-            // normalizes via `path.resolve`, but an absolute `commondir`
-            // value was returned verbatim, `..` segments and all. A crafted
-            // `.git` FILE pointing at a private gitdir whose `commondir` file
-            // holds an absolute path ending in unresolved `..` segments (e.g.
-            // `<gitDir>/../..`) then reached `deriveProjectName` below with
-            // those segments still literally present, `path.basename` textually
-            // returning `..` instead of the intended ancestor directory's real
-            // name. Normalizing here closes that off at the source, before
-            // either caller (`resolveOriginHeadBase`, `deriveProjectName`)
-            // ever sees the raw value.
-            return path.isAbsolute(raw) ? path.normalize(raw) : path.resolve(gitDir, raw);
-        }
-    }
-    catch {
-        /* no commondir file — gitDir already IS the common dir */
-    }
-    return gitDir;
-}
-// ---------------------------------------------------------------------------
-// Repository-identity derivation for per-repo config scoping (task
-// c88461c1, review round 2, decision D-021a).
-//
-// Round 1 fed `resolveGitContext(cwd).repo` (the WORK-TREE basename)
-// into the `session_start_preflight.setup` project-layer lookup. That
-// is wrong for a linked worktree: `git worktree add ../foo` gives the
-// linked checkout its OWN directory name, so two worktrees of the SAME
-// repository resolved two DIFFERENT project layers, and neither one
-// matched the name an operator would naturally pick for the shared
-// project override file. `repo` stays exactly as-is for its existing
-// consumer (the `preflight:${REPO}` ledger tag, `src/cli/session-start/
-// index.ts`), a ledger tag namespaced per CHECKOUT is a defensible,
-// unrelated design choice, and changing it is out of this task's scope.
-// This is a SEPARATE derivation for a SEPARATE purpose: naming the
-// `<home>/projects/<name>/harness.overrides.yaml` layer that should
-// apply to every linked worktree of one repository alike.
-// ---------------------------------------------------------------------------
-/**
- * Derive the project-layer name for `cwd`: the basename of the
- * directory that CONTAINS the repository's shared git common dir (the
- * main checkout), so every linked worktree of one repository resolves
- * the same name, unlike `resolveGitContext(cwd).repo`, which names the
- * checkout directory itself and therefore differs per worktree. Feeds
- * `LoaderOptions.project` (the same seam every command's own
- * `--project <name>` flag already uses) for `harness session-start
- * preflight`, `harness explain-policy`, and `harness doctor` alike (one
- * helper, three consumers, so the three cannot silently disagree on
- * what "this repository's project name" means).
- *
- * Resolution:
- *  - `findGitEntry(cwd)` walks up to the `.git` entry, exactly like
- *    `resolveGitContext`.
- *  - `resolveCommonDir(entry.gitDir)` follows a linked worktree's
- *    `commondir` file to the shared common dir (a no-op for the main
- *    checkout, which has none).
- *  - The COMMON DIR's basename is normally literally `.git` (a
- *    directory or, in a linked worktree's private gitdir, the resolved
- *    target of a `.git` FILE): in that shape the project name is one
- *    level further up, the basename of the directory THAT CONTAINS the
- *    common dir, i.e. the main checkout's own directory name.
- *  - For a BARE repository (`git init --bare`, or a linked worktree
- *    created FROM one), there is no `.git` wrapper at all, the common
- *    dir IS the bare directory itself (its basename is not `.git`), so
- *    that basename is the project name directly, with no extra `..`
- *    step. This is the one shape where going up an extra level would
- *    be wrong (it would name the bare directory's PARENT instead), and
- *    the `.git` SUFFIX in a conventionally-named bare directory (e.g.
- *    `myrepo.git`) is kept, not stripped.
- *  - A SUBMODULE checkout (`git submodule add`) derives the submodule's
- *    OWN name, not its superproject's: a submodule's `.git` FILE points
- *    at a private gitdir under the superproject's `.git/modules/<name>/`
- *    tree, which has no `commondir` file of its own (that mechanism is
- *    for linked worktrees, not submodules), so `resolveCommonDir` is a
- *    no-op and the submodule's own checkout directory basename applies
- *    directly, same as a normal (non-worktree) repo.
- *  - A `git init --separate-git-dir=<dir>` checkout derives the GIT
- *    DIR's own basename, NOT the work tree's: the `.git` file at the
- *    work tree root points at `<dir>` with no `commondir` file either
- *    (again a linked-worktree-only mechanism), so `resolveCommonDir` is
- *    a no-op and `<dir>`'s own basename (e.g. `sepgit.git`) is the
- *    derived name, exactly like the bare-repository shape above; the
- *    work tree's own directory name never enters into it.
- *
- * Returns `null` when `cwd` is not inside a git work tree (mirrors
- * `resolveGitContext`'s "" for the same case), when `entry.gitDir`
- * could not be resolved at all (an unreadable `.git` FILE, see
- * `findGitEntry`'s doc comment; in that case this falls back to the
- * checkout directory's own basename, the same value `repo` would
- * carry, rather than guessing at a common dir it has no path to), or
- * when the resolved name fails {@link isValidProjectName} (review
- * round 3, decision D-028's security finding: an untrusted on-disk
- * `commondir`/`.git` FILE value must never hand a caller a name like
- * `""`, `"."`, `".."`, or one containing a path separator, since every
- * consumer joins it straight into a filesystem path,
- * `resolvePaths`/`src/cli/loader.ts`; task `e904f25a` extended the same
- * exit to a name containing a control character, which no consumer could
- * render safely). A rejection here is silent by design: no project
- * override layer resolves for that repository and the base/machine value
- * applies, exactly as for a repository that simply has no layer on disk.
- * Never throws.
- *
- * REALPATH (task c88461c1, review round 3 residual; task `1c4eb3ea`
- * of the batch-44 follow-up run): the common dir is resolved through
- * `fs.realpathSync` BEFORE taking its basename, so a checkout reached
- * through a symlink (an operator's own convenience symlink, or a
- * second clone path) derives the SAME project name as the real
- * directory it points at, matching D-021a's "repository identity is
- * the common dir" rule: two paths to one repository must resolve one
- * project layer, not two. Best-effort: `realpathSync` failing (a
- * dangling symlink, a permissions error) falls back to the
- * un-resolved common dir rather than throwing, so a repository that
- * was reachable before this change stays reachable.
- */
-export function deriveProjectName(cwd) {
-    if (typeof cwd !== "string" || cwd.length === 0)
-        return null;
-    const entry = findGitEntry(cwd);
-    if (!entry)
-        return null;
-    if (!entry.gitDir) {
-        const fallback = path.basename(entry.worktreeRoot);
-        return isValidProjectName(fallback) ? fallback : null;
-    }
-    let commonDir = resolveCommonDir(entry.gitDir);
-    try {
-        commonDir = fs.realpathSync(commonDir);
-    }
-    catch {
-        /* dangling symlink or unreadable target, keep the un-resolved commonDir */
-    }
-    const commonDirBase = path.basename(commonDir);
-    const projectDir = commonDirBase === ".git" ? path.dirname(commonDir) : commonDir;
-    const name = path.basename(projectDir);
-    return isValidProjectName(name) ? name : null;
-}
-/**
- * Shared `opts.project ?? deriveProjectName(cwd) ?? fallback` resolution,
- * used by two of the three producers of a per-repo-scoped
- * `session_start_preflight` project name: `harness doctor`'s second,
- * project-scoped load and the `session_start_preflight` producer. Both
- * surfaces agree on the first two terms (an explicit `--project`, then
- * the cwd-derived name); only the fallback differs by call site, and
- * this helper takes it as an explicit argument so that difference is
- * named rather than duplicated inline. The third producer,
- * `harness explain-policy` (`src/cli/explain-policy.ts`), keeps its own
- * copy of the same expression with a third fallback (`undefined`);
- * folding it into this helper is deliberately out of scope of task
- * `f1eb1c5c`. No observable behaviour change versus either surface's
- * own prior inline expression, other than doctor's `cwd` expression
- * now being evaluated eagerly (see the call site): this only extracts
- * the shared shape.
- */
-export function resolveScopedProjectName(opts) {
-    return opts.project ?? deriveProjectName(opts.cwd) ?? opts.fallback;
-}
-/**
- * `{project}` value validation and safe display now live in
- * `src/io/project-name.ts` (task `b5e6ccb0`): `buildLockEntries`
- * (`src/io/harness-lock.ts`) is itself a `{project}` sink, and `io/` may
- * not import from `runtime/` (`io-no-upward-imports`,
- * `.dependency-cruiser.cjs`), so the shared logic moved down rather than
- * `harness-lock.ts` re-implementing it. Re-exported here so every
- * existing consumer that imports `isValidProjectName` /
- * `sanitizeProjectForDisplay` from `../runtime/git-context.js` keeps
- * working unchanged; see `src/io/project-name.ts` for the doc comments
- * (the sink inventory, the two-screen rationale, the display-stripping
- * invariant).
- */
-export { isValidProjectName, sanitizeProjectForDisplay } from "../io/project-name.js";
-//# sourceMappingURL=git-context.js.map

package/dist/runtime/git-context.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"git-context.js","sourceRoot":"","sources":["../../src/runtime/git-context.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,aAAa;AACb,EAAE;AACF,uEAAuE;AACvE,gEAAgE;AAChE,uEAAuE;AACvE,uEAAuE;AACvE,sEAAsE;AACtE,gEAAgE;AAChE,EAAE;AACF,mEAAmE;AACnE,mEAAmE;AACnE,sEAAsE;AACtE,gEAAgE;AAChE,sCAAsC;AACtC,EAAE;AACF,oEAAoE;AACpE,qEAAqE;AACrE,mEAAmE;AACnE,gEAAgE;AAChE,mDAAmD;AAEnD,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAsB3D,MAAM,KAAK,GAAmB,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;AAEhE,uEAAuE;AACvE,yBAAyB;AACzB,MAAM,SAAS,GAAG,kBAAkB,CAAC;AACrC,uEAAuE;AACvE,oDAAoD;AACpD,MAAM,WAAW,GAAG,4BAA4B,CAAC;AACjD,sEAAsE;AACtE,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAShC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACtC,IAAI,IAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE;oBAAE,OAAO,IAAI,CAAC;YACpE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC/C,CAAC;QACD,IAAI,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;YACnB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBACrE,IAAI,KAAK;oBAAE,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1D,CAAC;YAAC,MAAM,CAAC;gBACP,sEAAsE;YACxE,CAAC;YACD,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QACvC,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,0BAA0B;QAC3D,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,MAAc,EAAE,MAAc;IACtD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,EAAE;aACb,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC;aAChE,IAAI,EAAE,CAAC;QACV,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,wCAAwC;IAC1C,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,cAAc,MAAM,EAAE,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC1E,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACxC,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,GAAG,CAAC;QAC5D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;IAC/D,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC/C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7E,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;gBAC1B,gEAAgE;gBAChE,8DAA8D;gBAC9D,6DAA6D;gBAC7D,uDAAuD;gBACvD,wDAAwD;gBACxD,cAAc;gBACd,GAAG,GAAG,gBAAgB,CAAC,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;YACjE,CAAC;iBAAM,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,yDAAyD;gBACzD,GAAG,GAAG,IAAI,CAAC;YACb,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,4CAA4C;QAC9C,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC/B,CAAC;AAED,8EAA8E;AAC9E,iEAAiE;AACjE,EAAE;AACF,qEAAqE;AACrE,sEAAsE;AACtE,iDAAiD;AACjD,yEAAyE;AACzE,oEAAoE;AACpE,yEAAyE;AACzE,qEAAqE;AACrE,iEAAiE;AACjE,iEAAiE;AACjE,mBAAmB;AACnB,8EAA8E;AAE9E,oEAAoE;AACpE,2CAA2C;AAC3C,MAAM,kBAAkB,GAAG,sCAAsC,CAAC;AAClE,MAAM,oBAAoB,GAAG,0BAA0B,CAAC;AACxD,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAEpD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE;aACX,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC;aAC5E,IAAI,EAAE,CAAC;QACV,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC;QACzE,IAAI,OAAO,GAAkB,IAAI,CAAC;QAClC,MAAM,OAAO,GAAwC,EAAE,CAAC;QACxD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACrB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACrB,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,SAAS;YAChD,IAAI,GAAG,KAAK,oBAAoB;gBAAE,OAAO,GAAG,GAAG,CAAC;;gBAC3C,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CACxB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,oBAAoB,CAAC,CACnE,CAAC;YACF,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;IACtE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3E,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnB,2DAA2D;YAC3D,kEAAkE;YAClE,6DAA6D;YAC7D,gEAAgE;YAChE,kEAAkE;YAClE,kEAAkE;YAClE,gEAAgE;YAChE,oEAAoE;YACpE,mEAAmE;YACnE,+DAA+D;YAC/D,+DAA+D;YAC/D,2BAA2B;YAC3B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,mEAAmE;AACnE,8CAA8C;AAC9C,EAAE;AACF,qEAAqE;AACrE,sEAAsE;AACtE,sEAAsE;AACtE,uEAAuE;AACvE,oEAAoE;AACpE,mEAAmE;AACnE,qEAAqE;AACrE,wEAAwE;AACxE,oEAAoE;AACpE,wEAAwE;AACxE,mEAAmE;AACnE,oEAAoE;AACpE,0DAA0D;AAC1D,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2EG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACnD,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACxD,CAAC;IACD,IAAI,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,SAAS,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;IAC7E,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,aAAa,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClF,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACvC,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAmBD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,wBAAwB,CAAI,IAAwC;IAClF,OAAO,IAAI,CAAC,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/runtime/index.d.ts

@@ -1,12 +0,0 @@
-export { attributeTriggerSegments, intercept, isBlockingDecision, policyMatchesEvent, sanitizeEnvelopeReason, type ClaudeDenyJson, type InterceptOptions, type InterceptResult, type LedgerClient, type ForeignTarget, type PolicyDecision, type PolicyOutcome, type RiskGateContext, type ToolEvent, } from "./intercept.js";
-export { evaluateWhen, type WhenClauseKey, type WhenClauseResult, type WhenContext, type WhenEvaluation, } from "./when-eval.js";
-export { recordPolicyDecision, recordPolicyDecisionOnSession, payloadFromDecision, encodeLedgerContent, decodeLedgerContent, decisionSortKey, type LedgerRecordOptions, type PolicyDecisionPayload, } from "../io/ledger-record.js";
-export { resolveSessionId } from "./session-id.js";
-export { buildAgentFacingBlock, formatAgentFacingMessage, renderAgentFacing, type AgentFacingBlock, } from "./agent-facing.js";
-export { resolveGitContext, deriveProjectName, isValidProjectName, resolveScopedProjectName, type GitRepoContext, type ResolveScopedProjectNameOptions, } from "./git-context.js";
-export { buildActionEnvelope, type ActionEnvelope, type ActionEnvelopeRuntime, type ActionEnvelopeSession, type EnvelopeContext, } from "./action-envelope.js";
-export { classifyRisk, type RiskConfidence, type RiskProfile, } from "./risk-classifier.js";
-export { resolveDeletionTarget, type DeletionTargetVerdict, } from "./deletion-target-resolve.js";
-export { resolveKubeContext, type KubeContext, type ResolveKubeContextOptions, } from "./kube-context.js";
-export { resolveEnvironment, type EnvironmentConfidence, type EnvironmentResolution, type SignalInputs, } from "./environment-resolver.js";
-export { addLedgerFact, type AddLedgerFactOptions, type AddLedgerFactResult, } from "./ledger-add.js";

package/dist/runtime/index.js

@@ -1,13 +0,0 @@
-export { attributeTriggerSegments, intercept, isBlockingDecision, policyMatchesEvent, sanitizeEnvelopeReason, } from "./intercept.js";
-export { evaluateWhen, } from "./when-eval.js";
-export { recordPolicyDecision, recordPolicyDecisionOnSession, payloadFromDecision, encodeLedgerContent, decodeLedgerContent, decisionSortKey, } from "../io/ledger-record.js";
-export { resolveSessionId } from "./session-id.js";
-export { buildAgentFacingBlock, formatAgentFacingMessage, renderAgentFacing, } from "./agent-facing.js";
-export { resolveGitContext, deriveProjectName, isValidProjectName, resolveScopedProjectName, } from "./git-context.js";
-export { buildActionEnvelope, } from "./action-envelope.js";
-export { classifyRisk, } from "./risk-classifier.js";
-export { resolveDeletionTarget, } from "./deletion-target-resolve.js";
-export { resolveKubeContext, } from "./kube-context.js";
-export { resolveEnvironment, } from "./environment-resolver.js";
-export { addLedgerFact, } from "./ledger-add.js";
-//# sourceMappingURL=index.js.map

package/dist/runtime/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,SAAS,EACT,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,GAUvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,YAAY,GAKb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,GAGhB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,iBAAiB,GAElB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,wBAAwB,GAGzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,mBAAmB,GAKpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,YAAY,GAGb,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,qBAAqB,GAEtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,kBAAkB,GAGnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,kBAAkB,GAInB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,aAAa,GAGd,MAAM,iBAAiB,CAAC"}