@levr-one/cli 0.12.8 → 0.12.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (35) hide show
  1. package/dist/{addHandler-ybX54_3f.js → addHandler-CD1pda0z.js} +7 -7
  2. package/dist/{appendHandler-CKkl9ymw.js → appendHandler-BYOoCNXJ.js} +9 -9
  3. package/dist/{artifact-upload-Ba801tb6.js → artifact-upload-t6kL20b5.js} +2 -2
  4. package/dist/{attachHandler-CfNvVAV2.js → attachHandler-Ojk7mc2E.js} +9 -9
  5. package/dist/bindingsHandler-Dxx2LIci.js +2781 -0
  6. package/dist/change-scope-DBmyRWZV.js +379 -0
  7. package/dist/changedCoverageHandler-B8Zh5WIK.js +200 -0
  8. package/dist/cli.js +300 -15
  9. package/dist/{connect-yq3fGXkW.js → connect-A5VSJUv5.js} +3 -3
  10. package/dist/coverage-defaults-Ct3KNnGl.js +24 -0
  11. package/dist/{currentHandler-PaLZKLGF.js → currentHandler-DmffKHyZ.js} +1 -1
  12. package/dist/dependencyAuditHandler-CdpW-IvY.js +291 -0
  13. package/dist/dist-DU3htaZ_.js +325 -0
  14. package/dist/{find-workspace-4Us2vEb7.js → find-workspace-IWolSyrf.js} +1 -1
  15. package/dist/gate-op-BINrIT2l.js +278 -0
  16. package/dist/{importHandler-bYBWYC_0.js → importHandler-86cjc2Zs.js} +6 -6
  17. package/dist/inspect-CAxNgTwj.js +4 -0
  18. package/dist/{inspect-BbL7kDe-.js → inspect-CinRBSv6.js} +2 -277
  19. package/dist/{listHandler-Du_YGzre.js → listHandler-BoCzGUDK.js} +5 -5
  20. package/dist/{loginHandler-PbKmDAGo.js → loginHandler-CXmNViCo.js} +6 -6
  21. package/dist/{logoutHandler-DxnzGPYx.js → logoutHandler-DwTURB_A.js} +2 -2
  22. package/dist/{pushHandler-BulraEwP.js → pushHandler-BkCmzQz7.js} +9 -330
  23. package/dist/{resolve-token-DKEXT7SA.js → resolve-token-D1zteEfm.js} +2 -2
  24. package/dist/{resolve-workspace-D8y7twod.js → resolve-workspace-CJN1plpd.js} +2 -2
  25. package/dist/{runHandler-B-u-0eRk.js → runHandler-BLkPzImG.js} +8 -7
  26. package/dist/{sdk-client-BgzKzVIR.js → sdk-client-CSy2LOEh.js} +1 -1
  27. package/dist/{selectHandler-C0gs-Q70.js → selectHandler-Dp74pefc.js} +5 -5
  28. package/dist/{statusHandler-Dnnh80ZN.js → statusHandler-ByTUMdKK.js} +3 -3
  29. package/dist/{token-refresh-BpFuU4Ij.js → token-refresh-DEmYbJ8V.js} +1 -1
  30. package/package.json +1 -1
  31. package/dist/inspect-EGW-cgVD.js +0 -3
  32. /package/dist/{env-DjeRwmZ7.js → env-Cv-anxJA.js} +0 -0
  33. /package/dist/{refsHandler--ySvLjmX.js → refsHandler-BPlcdJvR.js} +0 -0
  34. /package/dist/{sleep-CGBHjsj5.js → sleep-DNLj0FMk.js} +0 -0
  35. /package/dist/{workspace-store-Bmw104Qa.js → workspace-store-BJyB_WEG.js} +0 -0
@@ -0,0 +1,278 @@
1
+ import { z } from "zod";
2
+
3
+ //#region ../shared/dist/runs/gate-pattern.js
4
+ /**
5
+ * POSIX ERE → JS `RegExp` translation for gate patterns (ENG-7246).
6
+ *
7
+ * Moved from the CLI's `gates inspect` builtins so the server and the seed
8
+ * specs read a pattern with the same parser the CLI runs: a pattern the CLI
9
+ * refuses is caught before it ships, not when a gate is verified.
10
+ */
11
+ const POSIX_CLASSES = {
12
+ alpha: "A-Za-z",
13
+ digit: "0-9",
14
+ alnum: "A-Za-z0-9",
15
+ upper: "A-Z",
16
+ lower: "a-z",
17
+ space: " \\t\\n\\r\\f\\v",
18
+ blank: " \\t",
19
+ punct: "!-\\/:-@\\[-`{-~",
20
+ xdigit: "0-9A-Fa-f",
21
+ cntrl: "\\x00-\\x1f\\x7f",
22
+ print: "\\x20-\\x7e",
23
+ graph: "\\x21-\\x7e",
24
+ word: "A-Za-z0-9_"
25
+ };
26
+ /**
27
+ * Translate a POSIX ERE (what `grep -E` read) into a JS `RegExp` source.
28
+ *
29
+ * Bracket classes become their JS ranges. Syntax that `grep` and JS read
30
+ * differently, and that has no faithful translation, is refused with a
31
+ * reason: GNU word anchors `\<` `\>`, buffer anchors, collating and
32
+ * equivalence classes, a backslash inside a bracket expression (literal to
33
+ * grep, an escape to JS), and a back-reference to a group that does not
34
+ * exist (an octal escape to JS). Refusing is the point: a `not_contains`
35
+ * whose pattern silently stopped matching is a false pass.
36
+ */
37
+ function translatePosixEre(pattern) {
38
+ let out = "";
39
+ let groups = 0;
40
+ for (let i = 0; i < pattern.length; i++) if (pattern[i] === "\\") i += 1;
41
+ else if (pattern[i] === "(" && pattern[i + 1] !== "?") groups += 1;
42
+ for (let i = 0; i < pattern.length; i++) {
43
+ const ch = pattern[i] ?? "";
44
+ if (ch === "\\") {
45
+ const next = pattern[i + 1];
46
+ if (next === void 0) return { error: "pattern ends with a backslash" };
47
+ if (next === "<" || next === ">") return { error: `\\${next} is a GNU word anchor with no JS equivalent; use \\b` };
48
+ if (next === "`" || next === "'") return { error: `\\${next} is a GNU buffer anchor; use ^ or $` };
49
+ if (/[1-9]/.test(next) && Number(next) > groups) return { error: `back-reference \\${next} names a group the pattern does not have` };
50
+ out += ch + next;
51
+ i += 1;
52
+ continue;
53
+ }
54
+ if (ch !== "[") {
55
+ out += ch;
56
+ continue;
57
+ }
58
+ let j = i + 1;
59
+ let body = "";
60
+ if (pattern[j] === "^") {
61
+ body += "^";
62
+ j += 1;
63
+ }
64
+ if (pattern[j] === "]") {
65
+ body += "\\]";
66
+ j += 1;
67
+ }
68
+ let closed = false;
69
+ while (j < pattern.length) {
70
+ const c = pattern[j] ?? "";
71
+ if (c === "]") {
72
+ closed = true;
73
+ break;
74
+ }
75
+ if (c === "[" && (pattern[j + 1] === ":" || pattern[j + 1] === "=" || pattern[j + 1] === ".")) {
76
+ const kind = pattern[j + 1];
77
+ const end = pattern.indexOf(`${kind}]`, j + 2);
78
+ if (end === -1) return { error: `unterminated [${kind} in a bracket expression` };
79
+ const name = pattern.slice(j + 2, end);
80
+ if (kind !== ":") return { error: `[${kind}${name}${kind}] has no JS equivalent` };
81
+ const range = POSIX_CLASSES[name];
82
+ if (range === void 0) return { error: `unknown class [:${name}:]` };
83
+ body += range;
84
+ j = end + 2;
85
+ continue;
86
+ }
87
+ if (c === "\\") return { error: "a backslash inside [...] is literal to grep and an escape to JS; use a POSIX class or move it outside the brackets" };
88
+ if (c === "[") body += "\\[";
89
+ else body += c;
90
+ j += 1;
91
+ }
92
+ if (!closed) return { error: "unterminated bracket expression" };
93
+ out += `[${body}]`;
94
+ i = j;
95
+ }
96
+ return out;
97
+ }
98
+
99
+ //#endregion
100
+ //#region ../shared/dist/runs/gate-op.js
101
+ const GATE_OP_CONTRACT_VERSION = 1;
102
+ const REPO_RELATIVE = "path must be repo-relative and must not contain ..";
103
+ /** Repo-relative, no `..` segment, not absolute, not home-relative. */
104
+ function isRepoRelative(value) {
105
+ if (value.length === 0 || value.includes("\0")) return false;
106
+ if (value.startsWith("/") || value.startsWith("~") || /^[A-Za-z]:[\\/]/.test(value)) return false;
107
+ return !value.split(/[\\/]/).includes("..");
108
+ }
109
+ const RepoRelativeCwd = z.string().refine(isRepoRelative, REPO_RELATIVE);
110
+ const RepoRelativePath = z.string().refine(isRepoRelative, REPO_RELATIVE);
111
+ const SandboxProfileSchema = z.object({
112
+ network_hosts: z.array(z.string()),
113
+ ports: z.array(z.number().int().nonnegative()),
114
+ read_paths: z.array(z.string()),
115
+ write_paths: z.array(z.string()),
116
+ env_allow: z.array(z.string()),
117
+ loopback: z.boolean(),
118
+ unsandboxed_on: z.array(z.enum(["linux", "wsl2"])).optional(),
119
+ unsandboxed_reason: z.string().optional()
120
+ });
121
+ const InspectPathParams = z.object({
122
+ path: RepoRelativePath,
123
+ glob: z.boolean().optional()
124
+ }).strict();
125
+ const ContainsParams = z.object({
126
+ path: RepoRelativePath,
127
+ glob: z.boolean().optional(),
128
+ pattern: z.string().optional(),
129
+ keywords: z.array(z.string()).optional(),
130
+ literal: z.boolean().optional()
131
+ }).strict().superRefine((params, ctx) => {
132
+ const hasPattern = params.pattern != null && params.pattern.length > 0;
133
+ const hasKeywords = (params.keywords?.length ?? 0) > 0;
134
+ if (!hasPattern && !hasKeywords) ctx.addIssue({
135
+ code: z.ZodIssueCode.custom,
136
+ message: "contains needs a pattern or keywords"
137
+ });
138
+ });
139
+ const DoneCriteriaParams = z.object({
140
+ path: RepoRelativePath,
141
+ glob: z.boolean().optional(),
142
+ requirements: z.array(z.union([z.string(), z.object({
143
+ pattern: z.string(),
144
+ label: z.string().optional()
145
+ }).strict()])).nonempty()
146
+ }).strict();
147
+ const JsonHasKeyParams = z.object({
148
+ path: RepoRelativePath,
149
+ glob: z.boolean().optional(),
150
+ key: z.string().min(1),
151
+ object: z.string().min(1).optional()
152
+ }).strict();
153
+ const SpecColumnsParams = z.object({
154
+ path: RepoRelativePath,
155
+ glob: z.boolean().optional(),
156
+ required_columns: z.union([z.string().min(1), z.array(z.string()).nonempty()])
157
+ }).strict();
158
+ const ArgvOpSchema = z.object({
159
+ op: z.literal("argv"),
160
+ cwd: RepoRelativeCwd,
161
+ argv: z.array(z.string()).nonempty()
162
+ }).strict();
163
+ const InspectOpSchema = z.discriminatedUnion("check", [
164
+ z.object({
165
+ op: z.literal("inspect"),
166
+ check: z.literal("exists"),
167
+ params: InspectPathParams
168
+ }).strict(),
169
+ z.object({
170
+ op: z.literal("inspect"),
171
+ check: z.literal("not_exists"),
172
+ params: InspectPathParams
173
+ }).strict(),
174
+ z.object({
175
+ op: z.literal("inspect"),
176
+ check: z.literal("contains"),
177
+ params: ContainsParams
178
+ }).strict(),
179
+ z.object({
180
+ op: z.literal("inspect"),
181
+ check: z.literal("not_contains"),
182
+ params: ContainsParams
183
+ }).strict(),
184
+ z.object({
185
+ op: z.literal("inspect"),
186
+ check: z.literal("done_criteria"),
187
+ params: DoneCriteriaParams
188
+ }).strict(),
189
+ z.object({
190
+ op: z.literal("inspect"),
191
+ check: z.literal("json_has_key"),
192
+ params: JsonHasKeyParams
193
+ }).strict(),
194
+ z.object({
195
+ op: z.literal("inspect"),
196
+ check: z.literal("spec_columns"),
197
+ params: SpecColumnsParams
198
+ }).strict(),
199
+ z.object({
200
+ op: z.literal("inspect"),
201
+ check: z.literal("migration_down_scope"),
202
+ params: InspectPathParams
203
+ }).strict()
204
+ ]);
205
+ const JudgeOpSchema = z.object({
206
+ op: z.literal("judge"),
207
+ path: RepoRelativePath,
208
+ rubric: z.string(),
209
+ output_schema: z.string(),
210
+ judge_prompt: z.string(),
211
+ model: z.string().min(1),
212
+ runner: z.literal("agy"),
213
+ max_input_bytes: z.number().int().positive()
214
+ }).strict();
215
+ const GateOpSchema = z.union([
216
+ ArgvOpSchema,
217
+ InspectOpSchema,
218
+ JudgeOpSchema
219
+ ]);
220
+ const AuthoringSourceSchema = z.object({
221
+ kind: z.enum(["binding", "definition"]),
222
+ id: z.string().uuid(),
223
+ workspace_id: z.string().uuid()
224
+ }).strict();
225
+ /**
226
+ * fail_closed: both `op` and `legacy_command`, or neither, is refused.
227
+ * A legacy carrier also keeps its authored `legacy_template` when the
228
+ * converter could not turn the template into argv.
229
+ */
230
+ const GateOpEnvelopeSchema = z.object({
231
+ contract_version: z.literal(GATE_OP_CONTRACT_VERSION),
232
+ op: GateOpSchema.optional(),
233
+ legacy_command: z.string().min(1).optional(),
234
+ legacy_template: z.string().optional(),
235
+ link_id: z.string().uuid(),
236
+ step_id: z.string().optional(),
237
+ rule_hash: z.string().optional(),
238
+ expected: z.string(),
239
+ provenance: z.enum([
240
+ "seeded",
241
+ "binding",
242
+ "workspace_template",
243
+ "legacy",
244
+ "replicated"
245
+ ]),
246
+ authored_digest: z.string().min(1),
247
+ content_digest: z.string().min(1),
248
+ authoring_source: AuthoringSourceSchema.optional(),
249
+ approval: z.enum([
250
+ "server_approved",
251
+ "confirm",
252
+ "denied"
253
+ ]),
254
+ approval_basis: z.enum([
255
+ "kind",
256
+ "default_list",
257
+ "workspace_list"
258
+ ]).optional(),
259
+ matched_pattern: z.string().optional(),
260
+ suggested_pattern: z.string().optional(),
261
+ sandbox: z.object({
262
+ mode: z.enum(["on", "off-by-gate"]),
263
+ profile: SandboxProfileSchema
264
+ }).strict(),
265
+ untested: z.boolean().optional(),
266
+ display: z.object({
267
+ posix: z.string(),
268
+ powershell: z.string()
269
+ }).strict()
270
+ }).strict().superRefine((value, ctx) => {
271
+ if (value.op !== void 0 === (value.legacy_command !== void 0)) ctx.addIssue({
272
+ code: z.ZodIssueCode.custom,
273
+ message: "fail_closed: envelope must carry exactly one of op and legacy_command"
274
+ });
275
+ });
276
+
277
+ //#endregion
278
+ export { GateOpSchema, translatePosixEre };
@@ -1,9 +1,9 @@
1
- import { authGetProfileV1, client, configureClient } from "./sdk-client-BgzKzVIR.js";
2
- import "./token-refresh-BpFuU4Ij.js";
3
- import { getApiUrl, getTeamId } from "./env-DjeRwmZ7.js";
4
- import { resolveToken } from "./resolve-token-DKEXT7SA.js";
5
- import "./workspace-store-Bmw104Qa.js";
6
- import { resolveWorkspaceFor } from "./resolve-workspace-D8y7twod.js";
1
+ import { authGetProfileV1, client, configureClient } from "./sdk-client-CSy2LOEh.js";
2
+ import "./token-refresh-DEmYbJ8V.js";
3
+ import { getApiUrl, getTeamId } from "./env-Cv-anxJA.js";
4
+ import { resolveToken } from "./resolve-token-D1zteEfm.js";
5
+ import "./workspace-store-BJyB_WEG.js";
6
+ import { resolveWorkspaceFor } from "./resolve-workspace-CJN1plpd.js";
7
7
  import chalk from "chalk";
8
8
  import { createReadStream } from "node:fs";
9
9
  import { basename } from "node:path";
@@ -0,0 +1,4 @@
1
+ import "./gate-op-BINrIT2l.js";
2
+ import { executeInspect, gatesInspectCommand, gatesInspectHandler } from "./inspect-CinRBSv6.js";
3
+
4
+ export { gatesInspectHandler };
@@ -1,283 +1,8 @@
1
+ import { GateOpSchema, translatePosixEre } from "./gate-op-BINrIT2l.js";
1
2
  import { buildCommand } from "@stricli/core";
2
- import { z } from "zod";
3
3
  import * as fs from "node:fs";
4
4
  import path from "node:path";
5
5
 
6
- //#region ../shared/dist/runs/gate-pattern.js
7
- /**
8
- * POSIX ERE → JS `RegExp` translation for gate patterns (ENG-7246).
9
- *
10
- * Moved from the CLI's `gates inspect` builtins so the server and the seed
11
- * specs read a pattern with the same parser the CLI runs: a pattern the CLI
12
- * refuses is caught before it ships, not when a gate is verified.
13
- */
14
- const POSIX_CLASSES = {
15
- alpha: "A-Za-z",
16
- digit: "0-9",
17
- alnum: "A-Za-z0-9",
18
- upper: "A-Z",
19
- lower: "a-z",
20
- space: " \\t\\n\\r\\f\\v",
21
- blank: " \\t",
22
- punct: "!-\\/:-@\\[-`{-~",
23
- xdigit: "0-9A-Fa-f",
24
- cntrl: "\\x00-\\x1f\\x7f",
25
- print: "\\x20-\\x7e",
26
- graph: "\\x21-\\x7e",
27
- word: "A-Za-z0-9_"
28
- };
29
- /**
30
- * Translate a POSIX ERE (what `grep -E` read) into a JS `RegExp` source.
31
- *
32
- * Bracket classes become their JS ranges. Syntax that `grep` and JS read
33
- * differently, and that has no faithful translation, is refused with a
34
- * reason: GNU word anchors `\<` `\>`, buffer anchors, collating and
35
- * equivalence classes, a backslash inside a bracket expression (literal to
36
- * grep, an escape to JS), and a back-reference to a group that does not
37
- * exist (an octal escape to JS). Refusing is the point: a `not_contains`
38
- * whose pattern silently stopped matching is a false pass.
39
- */
40
- function translatePosixEre(pattern) {
41
- let out = "";
42
- let groups = 0;
43
- for (let i = 0; i < pattern.length; i++) if (pattern[i] === "\\") i += 1;
44
- else if (pattern[i] === "(" && pattern[i + 1] !== "?") groups += 1;
45
- for (let i = 0; i < pattern.length; i++) {
46
- const ch = pattern[i] ?? "";
47
- if (ch === "\\") {
48
- const next = pattern[i + 1];
49
- if (next === void 0) return { error: "pattern ends with a backslash" };
50
- if (next === "<" || next === ">") return { error: `\\${next} is a GNU word anchor with no JS equivalent; use \\b` };
51
- if (next === "`" || next === "'") return { error: `\\${next} is a GNU buffer anchor; use ^ or $` };
52
- if (/[1-9]/.test(next) && Number(next) > groups) return { error: `back-reference \\${next} names a group the pattern does not have` };
53
- out += ch + next;
54
- i += 1;
55
- continue;
56
- }
57
- if (ch !== "[") {
58
- out += ch;
59
- continue;
60
- }
61
- let j = i + 1;
62
- let body = "";
63
- if (pattern[j] === "^") {
64
- body += "^";
65
- j += 1;
66
- }
67
- if (pattern[j] === "]") {
68
- body += "\\]";
69
- j += 1;
70
- }
71
- let closed = false;
72
- while (j < pattern.length) {
73
- const c = pattern[j] ?? "";
74
- if (c === "]") {
75
- closed = true;
76
- break;
77
- }
78
- if (c === "[" && (pattern[j + 1] === ":" || pattern[j + 1] === "=" || pattern[j + 1] === ".")) {
79
- const kind = pattern[j + 1];
80
- const end = pattern.indexOf(`${kind}]`, j + 2);
81
- if (end === -1) return { error: `unterminated [${kind} in a bracket expression` };
82
- const name = pattern.slice(j + 2, end);
83
- if (kind !== ":") return { error: `[${kind}${name}${kind}] has no JS equivalent` };
84
- const range = POSIX_CLASSES[name];
85
- if (range === void 0) return { error: `unknown class [:${name}:]` };
86
- body += range;
87
- j = end + 2;
88
- continue;
89
- }
90
- if (c === "\\") return { error: "a backslash inside [...] is literal to grep and an escape to JS; use a POSIX class or move it outside the brackets" };
91
- if (c === "[") body += "\\[";
92
- else body += c;
93
- j += 1;
94
- }
95
- if (!closed) return { error: "unterminated bracket expression" };
96
- out += `[${body}]`;
97
- i = j;
98
- }
99
- return out;
100
- }
101
-
102
- //#endregion
103
- //#region ../shared/dist/runs/gate-op.js
104
- const GATE_OP_CONTRACT_VERSION = 1;
105
- const REPO_RELATIVE = "path must be repo-relative and must not contain ..";
106
- /** Repo-relative, no `..` segment, not absolute, not home-relative. */
107
- function isRepoRelative(value) {
108
- if (value.length === 0 || value.includes("\0")) return false;
109
- if (value.startsWith("/") || value.startsWith("~") || /^[A-Za-z]:[\\/]/.test(value)) return false;
110
- return !value.split(/[\\/]/).includes("..");
111
- }
112
- const RepoRelativeCwd = z.string().refine(isRepoRelative, REPO_RELATIVE);
113
- const RepoRelativePath = z.string().refine(isRepoRelative, REPO_RELATIVE);
114
- const SandboxProfileSchema = z.object({
115
- network_hosts: z.array(z.string()),
116
- ports: z.array(z.number().int().nonnegative()),
117
- read_paths: z.array(z.string()),
118
- write_paths: z.array(z.string()),
119
- env_allow: z.array(z.string()),
120
- loopback: z.boolean(),
121
- unsandboxed_on: z.array(z.enum(["linux", "wsl2"])).optional(),
122
- unsandboxed_reason: z.string().optional()
123
- });
124
- const InspectPathParams = z.object({
125
- path: RepoRelativePath,
126
- glob: z.boolean().optional()
127
- }).strict();
128
- const ContainsParams = z.object({
129
- path: RepoRelativePath,
130
- glob: z.boolean().optional(),
131
- pattern: z.string().optional(),
132
- keywords: z.array(z.string()).optional(),
133
- literal: z.boolean().optional()
134
- }).strict().superRefine((params, ctx) => {
135
- const hasPattern = params.pattern != null && params.pattern.length > 0;
136
- const hasKeywords = (params.keywords?.length ?? 0) > 0;
137
- if (!hasPattern && !hasKeywords) ctx.addIssue({
138
- code: z.ZodIssueCode.custom,
139
- message: "contains needs a pattern or keywords"
140
- });
141
- });
142
- const DoneCriteriaParams = z.object({
143
- path: RepoRelativePath,
144
- glob: z.boolean().optional(),
145
- requirements: z.array(z.union([z.string(), z.object({
146
- pattern: z.string(),
147
- label: z.string().optional()
148
- }).strict()])).nonempty()
149
- }).strict();
150
- const JsonHasKeyParams = z.object({
151
- path: RepoRelativePath,
152
- glob: z.boolean().optional(),
153
- key: z.string().min(1),
154
- object: z.string().min(1).optional()
155
- }).strict();
156
- const SpecColumnsParams = z.object({
157
- path: RepoRelativePath,
158
- glob: z.boolean().optional(),
159
- required_columns: z.union([z.string().min(1), z.array(z.string()).nonempty()])
160
- }).strict();
161
- const ArgvOpSchema = z.object({
162
- op: z.literal("argv"),
163
- cwd: RepoRelativeCwd,
164
- argv: z.array(z.string()).nonempty()
165
- }).strict();
166
- const InspectOpSchema = z.discriminatedUnion("check", [
167
- z.object({
168
- op: z.literal("inspect"),
169
- check: z.literal("exists"),
170
- params: InspectPathParams
171
- }).strict(),
172
- z.object({
173
- op: z.literal("inspect"),
174
- check: z.literal("not_exists"),
175
- params: InspectPathParams
176
- }).strict(),
177
- z.object({
178
- op: z.literal("inspect"),
179
- check: z.literal("contains"),
180
- params: ContainsParams
181
- }).strict(),
182
- z.object({
183
- op: z.literal("inspect"),
184
- check: z.literal("not_contains"),
185
- params: ContainsParams
186
- }).strict(),
187
- z.object({
188
- op: z.literal("inspect"),
189
- check: z.literal("done_criteria"),
190
- params: DoneCriteriaParams
191
- }).strict(),
192
- z.object({
193
- op: z.literal("inspect"),
194
- check: z.literal("json_has_key"),
195
- params: JsonHasKeyParams
196
- }).strict(),
197
- z.object({
198
- op: z.literal("inspect"),
199
- check: z.literal("spec_columns"),
200
- params: SpecColumnsParams
201
- }).strict(),
202
- z.object({
203
- op: z.literal("inspect"),
204
- check: z.literal("migration_down_scope"),
205
- params: InspectPathParams
206
- }).strict()
207
- ]);
208
- const JudgeOpSchema = z.object({
209
- op: z.literal("judge"),
210
- path: RepoRelativePath,
211
- rubric: z.string(),
212
- output_schema: z.string(),
213
- judge_prompt: z.string(),
214
- model: z.string().min(1),
215
- runner: z.literal("agy"),
216
- max_input_bytes: z.number().int().positive()
217
- }).strict();
218
- const GateOpSchema = z.union([
219
- ArgvOpSchema,
220
- InspectOpSchema,
221
- JudgeOpSchema
222
- ]);
223
- const AuthoringSourceSchema = z.object({
224
- kind: z.enum(["binding", "definition"]),
225
- id: z.string().uuid(),
226
- workspace_id: z.string().uuid()
227
- }).strict();
228
- /**
229
- * fail_closed: both `op` and `legacy_command`, or neither, is refused.
230
- * A legacy carrier also keeps its authored `legacy_template` when the
231
- * converter could not turn the template into argv.
232
- */
233
- const GateOpEnvelopeSchema = z.object({
234
- contract_version: z.literal(GATE_OP_CONTRACT_VERSION),
235
- op: GateOpSchema.optional(),
236
- legacy_command: z.string().min(1).optional(),
237
- legacy_template: z.string().optional(),
238
- link_id: z.string().uuid(),
239
- step_id: z.string().optional(),
240
- rule_hash: z.string().optional(),
241
- expected: z.string(),
242
- provenance: z.enum([
243
- "seeded",
244
- "binding",
245
- "workspace_template",
246
- "legacy",
247
- "replicated"
248
- ]),
249
- authored_digest: z.string().min(1),
250
- content_digest: z.string().min(1),
251
- authoring_source: AuthoringSourceSchema.optional(),
252
- approval: z.enum([
253
- "server_approved",
254
- "confirm",
255
- "denied"
256
- ]),
257
- approval_basis: z.enum([
258
- "kind",
259
- "default_list",
260
- "workspace_list"
261
- ]).optional(),
262
- matched_pattern: z.string().optional(),
263
- suggested_pattern: z.string().optional(),
264
- sandbox: z.object({
265
- mode: z.enum(["on", "off-by-gate"]),
266
- profile: SandboxProfileSchema
267
- }).strict(),
268
- untested: z.boolean().optional(),
269
- display: z.object({
270
- posix: z.string(),
271
- powershell: z.string()
272
- }).strict()
273
- }).strict().superRefine((value, ctx) => {
274
- if (value.op !== void 0 === (value.legacy_command !== void 0)) ctx.addIssue({
275
- code: z.ZodIssueCode.custom,
276
- message: "fail_closed: envelope must carry exactly one of op and legacy_command"
277
- });
278
- });
279
-
280
- //#endregion
281
6
  //#region src/commands/gates/migration-down-scope.ts
282
7
  /**
283
8
  * The `migration_revert_scope` check — ENG-5106 L3a.
@@ -1131,7 +856,7 @@ Examples:
1131
856
  flags: {}
1132
857
  },
1133
858
  loader: async () => {
1134
- const { gatesInspectHandler: handler } = await import("./inspect-EGW-cgVD.js");
859
+ const { gatesInspectHandler: handler } = await import("./inspect-CAxNgTwj.js");
1135
860
  return handler;
1136
861
  }
1137
862
  });
@@ -1,8 +1,8 @@
1
- import { authGetSitesV1, configureClient } from "./sdk-client-BgzKzVIR.js";
2
- import "./token-refresh-BpFuU4Ij.js";
3
- import "./env-DjeRwmZ7.js";
4
- import { resolveToken } from "./resolve-token-DKEXT7SA.js";
5
- import { loadWorkspace } from "./workspace-store-Bmw104Qa.js";
1
+ import { authGetSitesV1, configureClient } from "./sdk-client-CSy2LOEh.js";
2
+ import "./token-refresh-DEmYbJ8V.js";
3
+ import "./env-Cv-anxJA.js";
4
+ import { resolveToken } from "./resolve-token-D1zteEfm.js";
5
+ import { loadWorkspace } from "./workspace-store-BJyB_WEG.js";
6
6
 
7
7
  //#region src/commands/workspace/listHandler.ts
8
8
  async function listHandler() {
@@ -1,9 +1,9 @@
1
- import { configureClient } from "./sdk-client-BgzKzVIR.js";
2
- import { CLI_CLIENT_ID, getApiUrl, getAuthUrl, setSessionApiUrl, writeCredentials } from "./env-DjeRwmZ7.js";
3
- import { saveWorkspace } from "./workspace-store-Bmw104Qa.js";
4
- import { autoSelectWorkspace, fetchSites } from "./resolve-workspace-D8y7twod.js";
5
- import { sleep } from "./sleep-CGBHjsj5.js";
6
- import { findWorkspaceByKeyOrName, looksLikeUrlKey, resolveMcpUrl, scopedMcpUrl } from "./find-workspace-4Us2vEb7.js";
1
+ import { configureClient } from "./sdk-client-CSy2LOEh.js";
2
+ import { CLI_CLIENT_ID, getApiUrl, getAuthUrl, setSessionApiUrl, writeCredentials } from "./env-Cv-anxJA.js";
3
+ import { saveWorkspace } from "./workspace-store-BJyB_WEG.js";
4
+ import { autoSelectWorkspace, fetchSites } from "./resolve-workspace-CJN1plpd.js";
5
+ import { sleep } from "./sleep-DNLj0FMk.js";
6
+ import { findWorkspaceByKeyOrName, looksLikeUrlKey, resolveMcpUrl, scopedMcpUrl } from "./find-workspace-IWolSyrf.js";
7
7
  import chalk from "chalk";
8
8
  import { createHash, randomBytes } from "node:crypto";
9
9
  import { createServer } from "node:http";
@@ -1,5 +1,5 @@
1
- import { deleteCredentials, getPatToken } from "./env-DjeRwmZ7.js";
2
- import { clearWorkspace } from "./workspace-store-Bmw104Qa.js";
1
+ import { deleteCredentials, getPatToken } from "./env-Cv-anxJA.js";
2
+ import { clearWorkspace } from "./workspace-store-BJyB_WEG.js";
3
3
 
4
4
  //#region src/commands/auth/logoutHandler.ts
5
5
  function logoutHandler() {