@lumenflow/core 3.1.2 → 3.1.3

package/dist/risk-detector.js

@@ -1,253 +0,0 @@
-#!/usr/bin/env node
-/**
- * Risk Detector
- *
- * WU-2062: Implement tiered test execution for faster wu:done
- *
- * Detects risk tier based on changed files to enable tiered test execution:
- * - docs-only: Skip tests, run lint/typecheck only
- * - standard: Run changed tests
- * - high-risk: Run integration tests in addition to unit tests
- *
- * Safety-critical tests (red-flag, PHI, escalation) always run regardless of tier.
- *
- * Note: This is project-specific risk detection logic for ExampleApp's
- * healthcare domain (PHI, RLS, auth). No standard library exists for this
- * domain-specific classification.
- *
- * @see {@link packages/@lumenflow/cli/src/gates.ts} - Consumer of risk detection
- * @see {@link packages/@lumenflow/cli/src/lib/file-classifiers.ts} - File classification utilities
- */
-import path from 'node:path';
-import { isDocumentationPath } from './file-classifiers.js';
-/**
- * Risk tier constants
- * @readonly
- * @enum {string}
- */
-export const RISK_TIERS = Object.freeze({
-    /** Documentation-only changes - skip tests, run lint/typecheck only */
-    DOCS_ONLY: 'docs-only',
-    /** Standard code changes - run incremental tests */
-    STANDARD: 'standard',
-    /** Safety-critical tests need to run - always include safety test patterns */
-    SAFETY_CRITICAL: 'safety-critical',
-    /** High-risk changes (auth, PHI, RLS, migrations) - run integration tests */
-    HIGH_RISK: 'high-risk',
-});
-/**
- * Test patterns that should ALWAYS run regardless of which files changed.
- * These are safety-critical tests that verify red-flag detection, PHI protection,
- * escalation triggers, and constitutional enforcement.
- *
- * @type {string[]}
- */
-export const SAFETY_CRITICAL_TEST_PATTERNS = Object.freeze([
-    // Red-flag detection tests
-    'red-flag',
-    'redflag',
-    'RedFlag',
-    // PHI protection tests
-    'phi',
-    'PHI',
-    'PHIGuard',
-    // Escalation trigger tests
-    'escalation',
-    'Escalation',
-    // Privacy detection tests
-    'privacy',
-    'Privacy',
-    'privacyDetector',
-    // Constitutional enforcement tests
-    'constitutional',
-    'Constitutional',
-    // Safe prompt wrapper tests
-    'safePrompt',
-    'SafePrompt',
-    // Crisis/emergency handling tests
-    'crisis',
-    'Crisis',
-    // Policy enforcement tests
-    'policyReferee',
-    'PolicyReferee',
-]);
-/**
- * Path patterns that indicate high-risk code changes.
- * Changes to these paths should trigger integration tests.
- *
- * WU-2242: Added authentication/ pattern
- *
- * @type {string[]}
- */
-// constants: HIGH_RISK_PATH_PATTERNS (skip hardcoded string detection)
-export const HIGH_RISK_PATH_PATTERNS = Object.freeze([
-    // Authentication (WU-2242: include both auth/ and authentication/)
-    '/auth/', // constants
-    '/auth.', // constants
-    '/authentication/', // constants
-    '/authentication.', // constants
-    // PHI (Protected Health Information)
-    '/phi/',
-    '/phi.',
-    // Row Level Security
-    '/rls/',
-    '/rls.',
-    'rls.sql',
-    // Security policies
-    '/policy/',
-    '/policy.',
-    // Supabase configuration
-    'supabase/config',
-    // API routes (potential attack surface)
-    '/api/',
-]);
-/**
- * Supabase migrations directory (relative to repo root).
- * @type {string}
- */
-const SUPABASE_MIGRATIONS_DIR = 'supabase/supabase/migrations/';
-/**
- * Filename patterns that indicate RLS or policy changes in migrations.
- * @type {RegExp[]}
- */
-const RLS_MIGRATION_PATTERNS = Object.freeze([
-    /policy/i,
-    /rls/i,
-    /row[_-]?level[_-]?security/i,
-    /enable[_-]?rls/i,
-]);
-/**
- * Check if a test file path matches safety-critical patterns.
- *
- * @param {string} testPath - Path to test file
- * @returns {boolean} True if test is safety-critical
- */
-export function isSafetyCriticalTest(testPath) {
-    if (!testPath || typeof testPath !== 'string') {
-        return false;
-    }
-    // Normalise Windows paths
-    const normalized = testPath.replace(/\\/g, '/');
-    // Check if any safety-critical pattern matches
-    for (const pattern of SAFETY_CRITICAL_TEST_PATTERNS) {
-        if (normalized.includes(pattern)) {
-            return true;
-        }
-    }
-    return false;
-}
-/**
- * Check whether a path refers to a Supabase migration file.
- *
- * @param {string} filePath - Path to check
- * @returns {boolean} True if file is a migration SQL
- */
-function isMigrationPath(filePath) {
-    if (!filePath || typeof filePath !== 'string') {
-        return false;
-    }
-    const normalized = filePath.replace(/\\/g, '/');
-    return normalized.includes(SUPABASE_MIGRATIONS_DIR) && normalized.endsWith('.sql');
-}
-/**
- * Check if a migration file contains RLS or policy changes.
- *
- * @param {string} filePath - Migration file path
- * @returns {boolean} True if migration is high-risk
- */
-export function isHighRiskMigration(filePath) {
-    if (!isMigrationPath(filePath)) {
-        return false;
-    }
-    const normalized = filePath.replace(/\\/g, '/');
-    const filename = path.basename(normalized);
-    return RLS_MIGRATION_PATTERNS.some((pattern) => pattern.test(filename));
-}
-/**
- * Check if a file path represents a high-risk code change.
- *
- * @param {string} filePath - Path to check
- * @returns {boolean} True if path is high-risk
- */
-export function isHighRiskPath(filePath) {
-    if (!filePath || typeof filePath !== 'string') {
-        return false;
-    }
-    if (isMigrationPath(filePath)) {
-        return false;
-    }
-    // Normalise Windows paths
-    const normalized = filePath.replace(/\\/g, '/');
-    // Check if any high-risk pattern matches
-    for (const pattern of HIGH_RISK_PATH_PATTERNS) {
-        if (normalized.includes(pattern)) {
-            return true;
-        }
-    }
-    return false;
-}
-/**
- * Check if all changed files are documentation-only.
- *
- * @param {string[]} changedFiles - List of changed file paths
- * @returns {boolean} True if all files are documentation
- */
-function areAllDocsOnly(changedFiles) {
-    if (!changedFiles || changedFiles.length === 0) {
-        return true;
-    }
-    return changedFiles.every((file) => {
-        // Normalise Windows paths
-        const normalized = file.replace(/\\/g, '/');
-        return isDocumentationPath(normalized);
-    });
-}
-/**
- * Find high-risk paths in changed files.
- *
- * @param {string[]} changedFiles - List of changed file paths
- * @returns {string[]} List of high-risk paths found
- */
-function findHighRiskPaths(changedFiles) {
-    if (!changedFiles || changedFiles.length === 0) {
-        return [];
-    }
-    return changedFiles.filter((file) => {
-        // Normalise Windows paths
-        const normalized = file.replace(/\\/g, '/');
-        if (isMigrationPath(normalized)) {
-            return isHighRiskMigration(normalized);
-        }
-        return isHighRiskPath(normalized);
-    });
-}
-export function detectRiskTier(options = {}) {
-    const { changedFiles = [] } = options;
-    // Normalise all paths
-    const normalizedFiles = changedFiles.map((f) => (f ? f.replace(/\\/g, '/') : ''));
-    // Check if all files are documentation-only
-    const isDocsOnly = areAllDocsOnly(normalizedFiles);
-    // Find any high-risk paths
-    const highRiskPaths = findHighRiskPaths(normalizedFiles);
-    // Determine tier
-    let tier;
-    if (isDocsOnly) {
-        tier = RISK_TIERS.DOCS_ONLY;
-    }
-    else if (highRiskPaths.length > 0) {
-        tier = RISK_TIERS.HIGH_RISK;
-    }
-    else {
-        tier = RISK_TIERS.STANDARD;
-    }
-    // Safety-critical patterns always apply (for test filtering)
-    const safetyCriticalPatterns = [...SAFETY_CRITICAL_TEST_PATTERNS];
-    return {
-        tier,
-        safetyCriticalPatterns,
-        highRiskPaths,
-        isDocsOnly,
-        shouldRunIntegration: tier === RISK_TIERS.HIGH_RISK,
-    };
-}
-//# sourceMappingURL=risk-detector.js.map

package/dist/risk-detector.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"risk-detector.js","sourceRoot":"","sources":["../src/risk-detector.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;IACtC,uEAAuE;IACvE,SAAS,EAAE,WAAW;IAEtB,oDAAoD;IACpD,QAAQ,EAAE,UAAU;IAEpB,8EAA8E;IAC9E,eAAe,EAAE,iBAAiB;IAElC,6EAA6E;IAC7E,SAAS,EAAE,WAAW;CACvB,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC,MAAM,CAAC;IACzD,2BAA2B;IAC3B,UAAU;IACV,SAAS;IACT,SAAS;IAET,uBAAuB;IACvB,KAAK;IACL,KAAK;IACL,UAAU;IAEV,2BAA2B;IAC3B,YAAY;IACZ,YAAY;IAEZ,0BAA0B;IAC1B,SAAS;IACT,SAAS;IACT,iBAAiB;IAEjB,mCAAmC;IACnC,gBAAgB;IAChB,gBAAgB;IAEhB,4BAA4B;IAC5B,YAAY;IACZ,YAAY;IAEZ,kCAAkC;IAClC,QAAQ;IACR,QAAQ;IAER,2BAA2B;IAC3B,eAAe;IACf,eAAe;CAChB,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,uEAAuE;AACvE,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,MAAM,CAAC;IACnD,mEAAmE;IACnE,QAAQ,EAAE,YAAY;IACtB,QAAQ,EAAE,YAAY;IACtB,kBAAkB,EAAE,YAAY;IAChC,kBAAkB,EAAE,YAAY;IAEhC,qCAAqC;IACrC,OAAO;IACP,OAAO;IAEP,qBAAqB;IACrB,OAAO;IACP,OAAO;IACP,SAAS;IAET,oBAAoB;IACpB,UAAU;IACV,UAAU;IAEV,yBAAyB;IACzB,iBAAiB;IAEjB,wCAAwC;IACxC,OAAO;CACR,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,uBAAuB,GAAG,+BAA+B,CAAC;AAEhE;;;GAGG;AACH,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3C,SAAS;IACT,MAAM;IACN,6BAA6B;IAC7B,iBAAiB;CAClB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAQ;IAC3C,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,0BAA0B;IAC1B,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAEhD,+CAA+C;IAC/C,KAAK,MAAM,OAAO,IAAI,6BAA6B,EAAE,CAAC;QACpD,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,QAAQ;IAC/B,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAChD,OAAO,UAAU,CAAC,QAAQ,CAAC,uBAAuB,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACrF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAQ;IAC1C,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC3C,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,QAAQ;IACrC,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,0BAA0B;IAC1B,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAEhD,yCAAyC;IACzC,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;QAC9C,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,YAAY;IAClC,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE;QACjC,0BAA0B;QAC1B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC5C,OAAO,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,YAAY;IACrC,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QAClC,0BAA0B;QAC1B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAE5C,IAAI,eAAe,CAAC,UAAU,CAAC,EAAE,CAAC;YAChC,OAAO,mBAAmB,CAAC,UAAU,CAAC,CAAC;QACzC,CAAC;QAED,OAAO,cAAc,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC;AA+BD,MAAM,UAAU,cAAc,CAAC,UAAiC,EAAE;IAChE,MAAM,EAAE,YAAY,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC;IAEtC,sBAAsB;IACtB,MAAM,eAAe,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAElF,4CAA4C;IAC5C,MAAM,UAAU,GAAG,cAAc,CAAC,eAAe,CAAC,CAAC;IAEnD,2BAA2B;IAC3B,MAAM,aAAa,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;IAEzD,iBAAiB;IACjB,IAAI,IAAI,CAAC;IACT,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC;IAC9B,CAAC;SAAM,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC;IAC9B,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC;IAC7B,CAAC;IAED,6DAA6D;IAC7D,MAAM,sBAAsB,GAAG,CAAC,GAAG,6BAA6B,CAAC,CAAC;IAElE,OAAO;QACL,IAAI;QACJ,sBAAsB;QACtB,aAAa;QACb,UAAU;QACV,oBAAoB,EAAE,IAAI,KAAK,UAAU,CAAC,SAAS;KACpD,CAAC;AACJ,CAAC"}

package/dist/rollback-utils.d.ts

@@ -1,129 +0,0 @@
-#!/usr/bin/env node
-/**
- * Rollback Utilities for WU Tooling
- *
- * WU-1255: Per-file error tracking for robust rollback operations.
- * Ensures all files are attempted even if some fail, with clear error reporting.
- *
- * WU-1665: Adds rollbackFromPipelineState for state-machine-driven recovery.
- * Centralized entry point that determines rollback actions from pipeline state.
- *
- * @see {@link packages/@lumenflow/cli/src/wu-done.ts} - Consumer (rollbackTransaction function)
- */
-import type { RollbackScope } from './wu-recovery.js';
-/**
- * Error entry for failed file restoration
- */
-interface RollbackError {
-    name: string;
-    path: string;
-    error: string;
-}
-/**
- * Result of a rollback operation.
- * Tracks which files were restored and which failed.
- *
- * WU-1665: Extended with optional scope metadata for state-machine-driven recovery.
- *
- * @class
- */
-export declare class RollbackResult {
-    /** Names of successfully restored files */
-    restored: string[];
-    /** Failed file restorations */
-    errors: RollbackError[];
-    /** WU-1665: Rollback scope from pipeline state (set by rollbackFromPipelineState) */
-    scope: RollbackScope | null;
-    constructor();
-    /**
-     * Record a successful file restoration.
-     * @param {string} name - File identifier (e.g., 'backlog.md')
-     */
-    addSuccess(name: UnsafeAny): void;
-    /**
-     * Record a failed file restoration.
-     * @param {string} name - File identifier
-     * @param {string} path - Full file path
-     * @param {string} error - Error message
-     */
-    addError(name: UnsafeAny, path: UnsafeAny, error: UnsafeAny): void;
-    /**
-     * Check if all files were restored successfully.
-     * @returns {boolean} True if no errors occurred
-     */
-    get success(): boolean;
-}
-/**
- * Restore multiple files with per-file error tracking.
- *
- * Each file is restored independently - if one fails, subsequent files
- * are still attempted. This ensures maximum recovery even in partial
- * failure scenarios.
- *
- * @param {Array<{name: string, path: string, content: string}>} filesToRestore - Files to restore
- * @returns {RollbackResult} Result with restored files and UnsafeAny errors
- *
- * @example
- * const result = rollbackFiles([
- *   { name: 'backlog.md', path: '/path/to/backlog.md', content: 'original content' },
- *   { name: 'status.md', path: '/path/to/status.md', content: 'original content' },
- * ]);
- *
- * if (!result.success) {
- *   console.error('Rollback had errors:', result.errors);
- * }
- */
-export declare function rollbackFiles(filesToRestore: UnsafeAny): RollbackResult;
-/**
- * Delete multiple files with per-file error tracking.
- *
- * @param {Array<{name: string, path: string}>} filesToDelete - Files to delete
- * @returns {RollbackResult} Result with deleted files and UnsafeAny errors
- */
-export declare function deleteFiles(filesToDelete: UnsafeAny): RollbackResult;
-/**
- * Input for the centralized pipeline-state-aware rollback.
- */
-export interface PipelineRollbackInput {
-    /** The pipeline state where failure occurred (from machine context.failedAt) */
-    failedAt: string | null;
-    /** Snapshot map of file paths to original content (from createTransactionSnapshot) */
-    snapshot: Map<string, string | null> | null;
-    /** Files to restore via the legacy per-file rollback path */
-    filesToRestore: Array<{
-        name: string;
-        path: string;
-        content: string;
-    }>;
-}
-/**
- * WU-1665: Centralized rollback entry point driven by pipeline state.
- *
- * Determines the rollback scope from the failedAt state, then executes
- * the appropriate rollback actions. This replaces the scattered rollback
- * logic that was previously duplicated across wu-recovery.ts, wu-transaction.ts,
- * and the CLI orchestrator.
- *
- * Scope determination:
- * - validating/preparing/gating: no-op (nothing was written)
- * - committing: restore files from snapshot or filesToRestore
- * - merging/pushing: restore files + flag branch rollback needed
- * - cleaningUp: flag worktree cleanup only (push already succeeded)
- *
- * @param {PipelineRollbackInput} input - Rollback inputs
- * @returns {RollbackResult} Result with scope metadata and file restoration details
- */
-export declare function rollbackFromPipelineState(input: PipelineRollbackInput): RollbackResult;
-/**
- * WU-1665: Compute rollback scope from pipeline failedAt state.
- *
- * Pure function: given the same failedAt, always returns the same scope.
- * This is the canonical scope determination used by both
- * StateMachineRecoveryManager.getRollbackScope() and rollbackFromPipelineState().
- *
- * @param {string|null} failedAt - Pipeline state where failure occurred
- * @returns {RollbackScope} Rollback scope
- */
-export declare function computeRollbackScope(failedAt: string | null): RollbackScope;
-export {};
-//# sourceMappingURL=rollback-utils.d.ts.map

package/dist/rollback-utils.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"rollback-utils.d.ts","sourceRoot":"","sources":["../src/rollback-utils.ts"],"names":[],"mappings":";AAGA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD;;GAEG;AACH,UAAU,aAAa;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;GAOG;AACH,qBAAa,cAAc;IACzB,2CAA2C;IAC3C,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,+BAA+B;IAC/B,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,qFAAqF;IACrF,KAAK,EAAE,aAAa,GAAG,IAAI,CAAC;;IAQ5B;;;OAGG;IACH,UAAU,CAAC,IAAI,EAAE,SAAS;IAI1B;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS;IAI3D;;;OAGG;IACH,IAAI,OAAO,YAEV;CACF;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,aAAa,CAAC,cAAc,EAAE,SAAS,kBActD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,aAAa,EAAE,SAAS,kBAcnD;AAMD;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,gFAAgF;IAChF,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,sFAAsF;IACtF,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC5C,6DAA6D;IAC7D,cAAc,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACxE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,qBAAqB,GAAG,cAAc,CA2CtF;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,aAAa,CAkC3E"}

package/dist/rollback-utils.js

@@ -1,217 +0,0 @@
-#!/usr/bin/env node
-// Copyright (c) 2026 Hellmai Ltd
-// SPDX-License-Identifier: AGPL-3.0-only
-/**
- * Rollback Utilities for WU Tooling
- *
- * WU-1255: Per-file error tracking for robust rollback operations.
- * Ensures all files are attempted even if some fail, with clear error reporting.
- *
- * WU-1665: Adds rollbackFromPipelineState for state-machine-driven recovery.
- * Centralized entry point that determines rollback actions from pipeline state.
- *
- * @see {@link packages/@lumenflow/cli/src/wu-done.ts} - Consumer (rollbackTransaction function)
- */
-import { writeFileSync, unlinkSync } from 'node:fs';
-/**
- * Result of a rollback operation.
- * Tracks which files were restored and which failed.
- *
- * WU-1665: Extended with optional scope metadata for state-machine-driven recovery.
- *
- * @class
- */
-export class RollbackResult {
-    /** Names of successfully restored files */
-    restored;
-    /** Failed file restorations */
-    errors;
-    /** WU-1665: Rollback scope from pipeline state (set by rollbackFromPipelineState) */
-    scope;
-    constructor() {
-        this.restored = [];
-        this.errors = [];
-        this.scope = null;
-    }
-    /**
-     * Record a successful file restoration.
-     * @param {string} name - File identifier (e.g., 'backlog.md')
-     */
-    addSuccess(name) {
-        this.restored.push(name);
-    }
-    /**
-     * Record a failed file restoration.
-     * @param {string} name - File identifier
-     * @param {string} path - Full file path
-     * @param {string} error - Error message
-     */
-    addError(name, path, error) {
-        this.errors.push({ name, path, error });
-    }
-    /**
-     * Check if all files were restored successfully.
-     * @returns {boolean} True if no errors occurred
-     */
-    get success() {
-        return this.errors.length === 0;
-    }
-}
-/**
- * Restore multiple files with per-file error tracking.
- *
- * Each file is restored independently - if one fails, subsequent files
- * are still attempted. This ensures maximum recovery even in partial
- * failure scenarios.
- *
- * @param {Array<{name: string, path: string, content: string}>} filesToRestore - Files to restore
- * @returns {RollbackResult} Result with restored files and UnsafeAny errors
- *
- * @example
- * const result = rollbackFiles([
- *   { name: 'backlog.md', path: '/path/to/backlog.md', content: 'original content' },
- *   { name: 'status.md', path: '/path/to/status.md', content: 'original content' },
- * ]);
- *
- * if (!result.success) {
- *   console.error('Rollback had errors:', result.errors);
- * }
- */
-export function rollbackFiles(filesToRestore) {
-    const result = new RollbackResult();
-    for (const file of filesToRestore) {
-        try {
-            writeFileSync(file.path, file.content, { encoding: 'utf-8' });
-            result.addSuccess(file.name);
-        }
-        catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
-            result.addError(file.name, file.path, message);
-        }
-    }
-    return result;
-}
-/**
- * Delete multiple files with per-file error tracking.
- *
- * @param {Array<{name: string, path: string}>} filesToDelete - Files to delete
- * @returns {RollbackResult} Result with deleted files and UnsafeAny errors
- */
-export function deleteFiles(filesToDelete) {
-    const result = new RollbackResult();
-    for (const file of filesToDelete) {
-        try {
-            unlinkSync(file.path);
-            result.addSuccess(file.name);
-        }
-        catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
-            result.addError(file.name, file.path, message);
-        }
-    }
-    return result;
-}
-/**
- * WU-1665: Centralized rollback entry point driven by pipeline state.
- *
- * Determines the rollback scope from the failedAt state, then executes
- * the appropriate rollback actions. This replaces the scattered rollback
- * logic that was previously duplicated across wu-recovery.ts, wu-transaction.ts,
- * and the CLI orchestrator.
- *
- * Scope determination:
- * - validating/preparing/gating: no-op (nothing was written)
- * - committing: restore files from snapshot or filesToRestore
- * - merging/pushing: restore files + flag branch rollback needed
- * - cleaningUp: flag worktree cleanup only (push already succeeded)
- *
- * @param {PipelineRollbackInput} input - Rollback inputs
- * @returns {RollbackResult} Result with scope metadata and file restoration details
- */
-export function rollbackFromPipelineState(input) {
-    const { failedAt, snapshot, filesToRestore } = input;
-    const result = new RollbackResult();
-    // Determine scope from failedAt state (same logic as StateMachineRecoveryManager)
-    const scope = computeRollbackScope(failedAt);
-    result.scope = scope;
-    // If no file restoration needed, return early with scope metadata
-    if (!scope.snapshotRestore) {
-        return result;
-    }
-    // Restore files using snapshot if available, otherwise fall back to filesToRestore
-    if (snapshot && snapshot.size > 0) {
-        for (const [filePath, content] of snapshot) {
-            try {
-                if (content === null) {
-                    // File didn't exist before - delete if created
-                    try {
-                        unlinkSync(filePath);
-                        result.addSuccess(filePath);
-                    }
-                    catch {
-                        // File might not exist, which is fine
-                        result.addSuccess(filePath);
-                    }
-                }
-                else {
-                    writeFileSync(filePath, content, { encoding: 'utf-8' });
-                    result.addSuccess(filePath);
-                }
-            }
-            catch (err) {
-                const message = err instanceof Error ? err.message : String(err);
-                result.addError(filePath, filePath, message);
-            }
-        }
-    }
-    else if (filesToRestore.length > 0) {
-        // Legacy-compatible file restoration
-        const legacyResult = rollbackFiles(filesToRestore);
-        result.restored.push(...legacyResult.restored);
-        result.errors.push(...legacyResult.errors);
-    }
-    return result;
-}
-/**
- * WU-1665: Compute rollback scope from pipeline failedAt state.
- *
- * Pure function: given the same failedAt, always returns the same scope.
- * This is the canonical scope determination used by both
- * StateMachineRecoveryManager.getRollbackScope() and rollbackFromPipelineState().
- *
- * @param {string|null} failedAt - Pipeline state where failure occurred
- * @returns {RollbackScope} Rollback scope
- */
-export function computeRollbackScope(failedAt) {
-    // Pre-write states: nothing to roll back
-    if (!failedAt || failedAt === 'validating' || failedAt === 'preparing' || failedAt === 'gating') {
-        return {
-            snapshotRestore: false,
-            branchRollback: false,
-            worktreeCleanup: false,
-        };
-    }
-    // Post-push state: push already succeeded, only cleanup remains
-    if (failedAt === 'cleaningUp') {
-        return {
-            snapshotRestore: false,
-            branchRollback: false,
-            worktreeCleanup: true,
-        };
-    }
-    // Commit-phase failures: files written, need snapshot restore
-    if (failedAt === 'committing') {
-        return {
-            snapshotRestore: true,
-            branchRollback: false,
-            worktreeCleanup: false,
-        };
-    }
-    // Merge/push phase failures: committed + potentially merged, need full rollback
-    return {
-        snapshotRestore: true,
-        branchRollback: true,
-        worktreeCleanup: false,
-    };
-}
-//# sourceMappingURL=rollback-utils.js.map

package/dist/rollback-utils.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"rollback-utils.js","sourceRoot":"","sources":["../src/rollback-utils.ts"],"names":[],"mappings":";AACA,iCAAiC;AACjC,yCAAyC;AACzC;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAYpD;;;;;;;GAOG;AACH,MAAM,OAAO,cAAc;IACzB,2CAA2C;IAC3C,QAAQ,CAAW;IACnB,+BAA+B;IAC/B,MAAM,CAAkB;IACxB,qFAAqF;IACrF,KAAK,CAAuB;IAE5B;QACE,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;QACnB,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACjB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED;;;OAGG;IACH,UAAU,CAAC,IAAe;QACxB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,IAAe,EAAE,IAAe,EAAE,KAAgB;QACzD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACH,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;IAClC,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,aAAa,CAAC,cAAyB;IACrD,MAAM,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;IAEpC,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YAC9D,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,aAAwB;IAClD,MAAM,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;IAEpC,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAkBD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAA4B;IACpE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;IAEpC,kFAAkF;IAClF,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IAErB,kEAAkE;IAClE,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,mFAAmF;IACnF,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAClC,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,QAAQ,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACH,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;oBACrB,+CAA+C;oBAC/C,IAAI,CAAC;wBACH,UAAU,CAAC,QAAQ,CAAC,CAAC;wBACrB,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;oBAC9B,CAAC;oBAAC,MAAM,CAAC;wBACP,sCAAsC;wBACtC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;oBAC9B,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;oBACxD,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAC9B,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACjE,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,qCAAqC;QACrC,MAAM,YAAY,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC;QACnD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAuB;IAC1D,yCAAyC;IACzC,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChG,OAAO;YACL,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,KAAK;YACrB,eAAe,EAAE,KAAK;SACvB,CAAC;IACJ,CAAC;IAED,gEAAgE;IAChE,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC9B,OAAO;YACL,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,KAAK;YACrB,eAAe,EAAE,IAAI;SACtB,CAAC;IACJ,CAAC;IAED,8DAA8D;IAC9D,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC9B,OAAO;YACL,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,KAAK;YACrB,eAAe,EAAE,KAAK;SACvB,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,OAAO;QACL,eAAe,EAAE,IAAI;QACrB,cAAc,EAAE,IAAI;QACpB,eAAe,EAAE,KAAK;KACvB,CAAC;AACJ,CAAC"}

package/dist/sandbox-allowlist.d.ts

@@ -1,16 +0,0 @@
-export interface SandboxAllowlistEntry {
-    originalPath: string;
-    normalizedPath: string;
-    canonicalPath: string;
-}
-export interface SandboxAllowlist {
-    projectRoot: string;
-    writableRoots: SandboxAllowlistEntry[];
-}
-export interface BuildSandboxAllowlistInput {
-    projectRoot: string;
-    writableRoots: string[];
-}
-export declare function buildSandboxAllowlist(input: BuildSandboxAllowlistInput): SandboxAllowlist;
-export declare function isWritePathAllowed(allowlist: SandboxAllowlist, targetPath: string): boolean;
-//# sourceMappingURL=sandbox-allowlist.d.ts.map

package/dist/sandbox-allowlist.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sandbox-allowlist.d.ts","sourceRoot":"","sources":["../src/sandbox-allowlist.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,qBAAqB,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAkED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,0BAA0B,GAAG,gBAAgB,CAgBzF;AAED,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAa3F"}