@mmnto/totem 1.103.0 → 1.104.0

package/dist/parity-detect.js

@@ -2027,4 +2027,599 @@ function isDirectory(p) {
         return false;
     }
 }
+/**
+ * The pinned squash-merge body/title posture (row-1). GitHub encodes these as
+ * enums; the ruled values are a BLANK squash body + a PR_TITLE squash title.
+ */
+const EXPECTED_SQUASH_MESSAGE = 'BLANK';
+const EXPECTED_SQUASH_TITLE = 'PR_TITLE';
+/** The symbolic ref-name includes that mark a ruleset as targeting the default branch. */
+const DEFAULT_BRANCH_INCLUDES = new Set(['~DEFAULT_BRANCH', '~ALL']);
+/**
+ * The ruleset rule types that gate writes to a branch (the "push/PR-class" set,
+ * row-3). Any active ruleset carrying one of these for the default branch must
+ * itself be un-bypassable — a permissive/bypassable ruleset must not undercut
+ * classic branch protection.
+ */
+const PUSH_PR_RULE_TYPES = new Set([
+    'pull_request',
+    'non_fast_forward',
+    'deletion',
+    'creation',
+    'update',
+    'required_linear_history',
+    'required_signatures',
+    'required_status_checks',
+    'required_deployments',
+    'merge_queue',
+]);
+// ── Boundary Zod schemas (untrusted fetched JSON; max-tolerance) ──
+/** Row-1 repo-settings posture fields. A 200 missing any of these is auth-class (`unknown`). */
+const RepoMergeSettingsSchema = z.object({
+    allow_squash_merge: z.boolean(),
+    allow_merge_commit: z.boolean(),
+    allow_rebase_merge: z.boolean(),
+    squash_merge_commit_message: z.string(),
+    squash_merge_commit_title: z.string(),
+});
+/** One ruleset rule (`{ type, parameters }`) — parameters stay `unknown` until a per-type narrow. */
+const RulesetRuleSchema = z.object({
+    type: z.string(),
+    parameters: z.unknown().optional(),
+});
+/** One ruleset detail object (max-tolerance — every field optional so a slim payload still narrows). */
+const RulesetSchema = z.object({
+    id: z.union([z.number(), z.string()]).optional(),
+    name: z.string().optional(),
+    enforcement: z.string().optional(),
+    target: z.string().optional(),
+    conditions: z
+        .object({
+        ref_name: z
+            .object({
+            include: z.array(z.string()).optional(),
+            exclude: z.array(z.string()).optional(),
+        })
+            .optional(),
+    })
+        .optional(),
+    bypass_actors: z.array(z.unknown()).optional(),
+    rules: z.array(RulesetRuleSchema).optional(),
+});
+/** The rulesets surface payload is an array of ruleset details. */
+const RulesetsArraySchema = z.array(RulesetSchema);
+/** Parameters of a `required_status_checks` rule (row-2 union + strict-policy read). */
+const StatusCheckParamsSchema = z.object({
+    required_status_checks: z.array(z.object({ context: z.string() })).optional(),
+    strict_required_status_checks_policy: z.boolean().optional(),
+});
+/** A classic branch-protection `{ enabled }` toggle. */
+const ProtectionToggleSchema = z.object({ enabled: z.boolean() });
+/**
+ * Row-3 classic branch-protection posture. The three toggles are ALWAYS present
+ * in a full admin read, so their absence marks an under-privileged 200
+ * (auth-class `unknown`). `required_pull_request_reviews` is legitimately absent
+ * when PR review is not required — that absence is real drift, not auth-class.
+ */
+const BranchProtectionSchema = z.object({
+    required_pull_request_reviews: z
+        .object({ required_approving_review_count: z.number().optional() })
+        .optional(),
+    enforce_admins: ProtectionToggleSchema,
+    allow_force_pushes: ProtectionToggleSchema,
+    allow_deletions: ProtectionToggleSchema,
+});
+/**
+ * The totem-side canonical ruleset declaration (`.totem/rulesets/main.json`,
+ * schema-version 1). The canonical required-checks list + pinned strict policy
+ * come from `required_status_checks`; the surface is compared against THIS, never
+ * against itself (Tenet 20).
+ */
+const RulesetDeclarationSchema = z.object({
+    'schema-version': z.number(),
+    'ruleset-name': z.string().optional(),
+    enforcement: z.string().optional(),
+    bypass_actors: z.array(z.unknown()).optional(),
+    required_status_checks: z
+        .object({
+        strict_required_status_checks_policy: z.boolean().optional(),
+        contexts: z.array(z.string()).optional(),
+    })
+        .optional(),
+});
+/**
+ * Sense the three Prop 296 §14 network-read-only posture rows against pre-fetched
+ * snapshots. Returns an ARRAY of per-repo verdict lines (the {@link LockContentLine}
+ * pattern — the CLI's flatMap render + R2 contract-counting already support
+ * multi-line rows). NEVER networks (the fetches ran at the CLI edge), NEVER
+ * throws (every read/parse failure degrades to a verdict), NEVER emits `fail`
+ * (the CLI edge owns `--strict` promotion) and NEVER a drift verdict on an
+ * auth/transport failure (§14 clause 2).
+ *
+ * Applicability: the row's `consumers` scope is applied PER-REPO against each
+ * snapshot's `repoId` (verbatim with {@link detectLockContentContract}). A row
+ * scoped `consumers: [totem]` senses only the roster repos whose id is `totem`;
+ * an empty in-scope set yields one honest-absent `skip`.
+ */
+export function detectNetworkPostureContract(contract, ctx) {
+    const inScope = ctx.repos.filter((r) => repoInConsumerScope(contract, r.repoId));
+    if (inScope.length === 0) {
+        return [
+            {
+                lineName: `Parity: ${contract.id}`,
+                verdict: {
+                    status: 'skip',
+                    message: contract.consumers !== undefined
+                        ? `cohort permits absence here (no roster repo in consumers [${contract.consumers.join(', ')}])`
+                        : 'no roster repo resolved to probe (current-repo slug unresolvable)',
+                },
+            },
+        ];
+    }
+    switch (ctx.row) {
+        case 'repo-merge-posture':
+            return inScope.map((repo) => mergePostureLine(contract, repo));
+        case 'repo-required-checks-posture':
+            return requiredChecksLines(contract, ctx, inScope);
+        case 'repo-branch-protection-posture':
+            return inScope.flatMap((repo) => branchProtectionLines(contract, repo));
+        default:
+            // Defensive: an unrecognized row degrades to a single honest-absent skip
+            // rather than darking the sensor (mirrors the manifestation fail-loud).
+            return [
+                {
+                    lineName: `Parity: ${contract.id}`,
+                    verdict: { status: 'skip', message: `network-posture row unrecognized by this doctor` },
+                },
+            ];
+    }
+}
+/** True when `repoId` is inside the contract's `consumers` scope (undefined = applies to all). */
+function repoInConsumerScope(contract, repoId) {
+    return contract.consumers === undefined || contract.consumers.includes(repoId);
+}
+/** Append ` (detail)` to a message when the snapshot carries render detail. */
+function detailSuffix(surface) {
+    return surface.detail !== undefined && surface.detail.length > 0 ? ` (${surface.detail})` : '';
+}
+/**
+ * Map a non-`ok` (or absent) surface to its cannot-verify verdict, or `undefined`
+ * when the surface is `ok` and the caller should inspect the payload. §14 clause
+ * 2/4: `no-transport` → `skip` (honest-absent), every other failure → `unknown`
+ * (never a drift verdict).
+ */
+function surfaceCannotVerify(surface, surfaceLabel) {
+    if (surface === undefined) {
+        return { status: 'unknown', message: `${surfaceLabel}: not probed — cannot verify` };
+    }
+    switch (surface.outcome) {
+        case 'ok':
+            return undefined;
+        case 'no-transport':
+            return {
+                status: 'skip',
+                message: `${surfaceLabel}: no transport (gh unavailable / offline) — honest-absent per §14 clause 4${detailSuffix(surface)}`,
+            };
+        case 'auth':
+            return {
+                status: 'unknown',
+                message: `${surfaceLabel}: auth-class — cannot verify (missing / under-privileged token; never posture-false per §14 clause 2)${detailSuffix(surface)}`,
+            };
+        case 'not-found':
+            return {
+                status: 'unknown',
+                message: `${surfaceLabel}: 404 on a governed surface — indistinguishable from under-privilege; cannot verify per §14 clause 2${detailSuffix(surface)}`,
+            };
+        case 'error':
+            return {
+                status: 'unknown',
+                message: `${surfaceLabel}: transient / unreachable — cannot verify${detailSuffix(surface)}`,
+            };
+        default:
+            return {
+                status: 'unknown',
+                message: `${surfaceLabel}: unrecognized outcome — cannot verify`,
+            };
+    }
+}
+// ── Row 1: repo-merge-posture ──
+/**
+ * One repo's merge-posture line: `GET /repos/{owner}/{repo}` must report
+ * squash-only merges + a BLANK squash body + a PR_TITLE squash title. A 200
+ * missing those fields is auth-class (`unknown`); a read mismatch is drift
+ * (`warn`). Silent by choice on `delete_branch_on_merge`.
+ */
+function mergePostureLine(contract, repo) {
+    const lineName = `Parity: ${contract.id} [${repo.repoSlug}]`;
+    const surface = repo.surfaces.repoSettings;
+    const cannot = surfaceCannotVerify(surface, 'repo settings');
+    if (cannot !== undefined)
+        return { lineName, verdict: cannot };
+    const parsed = RepoMergeSettingsSchema.safeParse(surface?.data);
+    if (!parsed.success) {
+        return {
+            lineName,
+            verdict: {
+                status: 'unknown',
+                message: 'repo settings: 200 without the merge-posture fields — auth-class (under-privileged token), never posture-false (§14 clause 2)',
+            },
+        };
+    }
+    const s = parsed.data;
+    const drift = [];
+    if (s.allow_squash_merge !== true)
+        drift.push('allow_squash_merge≠true');
+    if (s.allow_merge_commit !== false)
+        drift.push('allow_merge_commit≠false');
+    if (s.allow_rebase_merge !== false)
+        drift.push('allow_rebase_merge≠false');
+    if (s.squash_merge_commit_message !== EXPECTED_SQUASH_MESSAGE)
+        drift.push(`squash_merge_commit_message=${s.squash_merge_commit_message}≠${EXPECTED_SQUASH_MESSAGE}`);
+    if (s.squash_merge_commit_title !== EXPECTED_SQUASH_TITLE)
+        drift.push(`squash_merge_commit_title=${s.squash_merge_commit_title}≠${EXPECTED_SQUASH_TITLE}`);
+    if (drift.length > 0) {
+        return {
+            lineName,
+            verdict: {
+                status: 'warn',
+                message: `merge posture drifted: ${drift.join(', ')}`,
+                remediation: 'Restore squash-only merges with a BLANK squash body + PR_TITLE title in the repo Settings → General → Pull Requests.',
+            },
+        };
+    }
+    return {
+        lineName,
+        verdict: { status: 'pass', message: 'squash-only + BLANK squash body + PR_TITLE title' },
+    };
+}
+// ── Row 2: repo-required-checks-posture ──
+/**
+ * The required-checks lines: the active-ruleset UNION of `required_status_checks`
+ * must set-equal the canonical list (BOTH directions), AND every ruleset
+ * contributing a canonical check must itself hold enforcement=active,
+ * target ~DEFAULT_BRANCH, `bypass_actors=[]`, and the pinned
+ * `strict_required_status_checks_policy` — the union must not hide a bypassable
+ * contributing ruleset. Canonical + pin come from `.totem/rulesets/main.json`;
+ * an absent declaration is honest-absent `skip`.
+ */
+function requiredChecksLines(contract, ctx, inScope) {
+    // ── Canonical declaration (read ONCE; absent → honest-absent skip) ──
+    const readFile = ctx.readFile ?? readFileText;
+    const declPath = ctx.declarationPath;
+    const declRaw = declPath !== undefined ? safeReadFile(readFile, declPath) : undefined;
+    if (declRaw === undefined) {
+        return inScope.map((repo) => ({
+            lineName: `Parity: ${contract.id} [${repo.repoSlug}]`,
+            verdict: {
+                status: 'skip',
+                message: 'canonical ruleset declaration (.totem/rulesets/main.json) not yet committed — honest-absent (interim canonical is prose, never parser input)',
+            },
+        }));
+    }
+    const canonical = parseRulesetDeclaration(declRaw);
+    if (canonical === undefined) {
+        // Malformed / unsupported canonical: cannot prove drift NOR currency (the
+        // Stale-Doctor-Paradox) → unknown, never a fabricated pass/warn.
+        return inScope.map((repo) => ({
+            lineName: `Parity: ${contract.id} [${repo.repoSlug}]`,
+            verdict: {
+                status: 'unknown',
+                message: '.totem/rulesets/main.json is unparseable / missing required_status_checks.contexts — canonical list underivable, cannot verify',
+            },
+        }));
+    }
+    return inScope.map((repo) => requiredChecksLine(contract, repo, canonical));
+}
+/** Parse + narrow the declaration; undefined when unparseable / unsupported / context-less. */
+function parseRulesetDeclaration(raw) {
+    let doc;
+    try {
+        doc = JSON.parse(raw);
+        // totem-context: a malformed canonical declaration is a first-class "canonical underivable" signal (→ unknown), not a throw — the sensor must never crash on a mis-authored totem-side file.
+    }
+    catch {
+        return undefined;
+    }
+    const parsed = RulesetDeclarationSchema.safeParse(doc);
+    if (!parsed.success)
+        return undefined;
+    if (parsed.data['schema-version'] !== 1)
+        return undefined;
+    const contexts = parsed.data.required_status_checks?.contexts;
+    if (contexts === undefined || contexts.length === 0)
+        return undefined;
+    return {
+        contexts: new Set(contexts),
+        // Pinned posture; the row's expected value is `false`, but the PIN is whatever
+        // the canonical declares (derive-not-hardcode, Tenet 20).
+        strictPolicy: parsed.data.required_status_checks?.strict_required_status_checks_policy ?? false,
+    };
+}
+/** One repo's required-checks line (union set-compare + per-contributing-ruleset enforcement). */
+function requiredChecksLine(contract, repo, canonical) {
+    const lineName = `Parity: ${contract.id} [${repo.repoSlug}]`;
+    const surface = repo.surfaces.rulesets;
+    const cannot = surfaceCannotVerify(surface, 'rulesets');
+    if (cannot !== undefined)
+        return { lineName, verdict: cannot };
+    const parsed = RulesetsArraySchema.safeParse(surface?.data);
+    if (!parsed.success) {
+        return {
+            lineName,
+            verdict: {
+                status: 'unknown',
+                message: 'rulesets: 200 with an unparseable body — cannot verify (§14 clause 2)',
+            },
+        };
+    }
+    // Every ruleset targeting the default branch (any enforcement mode) is
+    // considered for the union so a check supplied ONLY by an evaluate-mode ruleset
+    // still appears in the set-compare — the per-contributing-ruleset gate below is
+    // what catches the bypassable/evaluate case with a precise reason, rather than a
+    // blunt "missing" (round finding + greptile P1 on strategy#962).
+    const defaultRulesets = parsed.data.filter(rulesetTargetsDefault);
+    const union = new Set();
+    const contributing = [];
+    for (const ruleset of defaultRulesets) {
+        const contexts = statusCheckContexts(ruleset);
+        if (contexts.length === 0)
+            continue; // a zero-rule / copilot-class ruleset never satisfies presence
+        for (const c of contexts)
+            union.add(c);
+        contributing.push({ ruleset, contexts });
+    }
+    const drift = [];
+    // ── Set-compare BOTH directions ──
+    const missing = [...canonical.contexts].filter((c) => !union.has(c));
+    const extra = [...union].filter((c) => !canonical.contexts.has(c));
+    if (missing.length > 0)
+        drift.push(`missing required check(s): ${missing.join(', ')} (re-opens the gated vector)`);
+    if (extra.length > 0)
+        drift.push(`stale extra required check(s): ${extra.join(', ')} (silent merge-block)`);
+    // ── Per-contributing-ruleset enforcement posture ──
+    const unobserved = [];
+    for (const { ruleset, contexts } of contributing) {
+        const read = enforcementProblems(ruleset, canonical.strictPolicy);
+        const name = ruleset.name ?? String(ruleset.id ?? '(unnamed)');
+        if (read.problems.length > 0) {
+            drift.push(`contributing ruleset '${name}' (supplies ${contexts.join(', ')}) is ${read.problems.join(' / ')}`);
+        }
+        if (read.unobserved.length > 0) {
+            unobserved.push(`contributing ruleset '${name}' omitted ${read.unobserved.join(', ')}`);
+        }
+    }
+    if (drift.length > 0) {
+        return {
+            lineName,
+            verdict: {
+                status: 'warn',
+                message: `required-checks posture drifted: ${drift.join('; ')}`,
+                remediation: 'Align the default-branch ruleset union to the canonical required-checks list and make every contributing ruleset enforcement=active with no bypass actors.',
+            },
+        };
+    }
+    // Observed drift outranks an observability gap (a definite finding is never
+    // hidden behind unknown); with no drift, a field-shy contributing ruleset is
+    // auth-class — never a silent pass (§14 clause 2).
+    if (unobserved.length > 0) {
+        return {
+            lineName,
+            verdict: {
+                status: 'unknown',
+                message: `rulesets detail field-shy — cannot certify enforcement posture: ${unobserved.join('; ')} (auth-class, §14 clause 2)`,
+            },
+        };
+    }
+    return {
+        lineName,
+        verdict: {
+            status: 'pass',
+            message: `active-ruleset union == canonical required checks (${canonical.contexts.size}); every contributing ruleset un-bypassable`,
+        },
+    };
+}
+function enforcementProblems(ruleset, pinnedStrict) {
+    const problems = [];
+    const unobserved = [];
+    if (ruleset.enforcement === undefined)
+        unobserved.push('enforcement');
+    else if (ruleset.enforcement !== 'active')
+        problems.push(`enforcement=${ruleset.enforcement}`);
+    if (ruleset.bypass_actors === undefined)
+        unobserved.push('bypass_actors');
+    else if (ruleset.bypass_actors.length > 0)
+        problems.push('bypassable (bypass_actors non-empty)');
+    // Row-3 callers omit the pin: protection rulesets are judged on enforcement +
+    // bypass only — the strict policy is a required-checks (row-2) concern.
+    if (pinnedStrict === undefined)
+        return { problems, unobserved };
+    const strict = strictPolicy(ruleset);
+    if (strict === undefined)
+        unobserved.push('strict_required_status_checks_policy');
+    else if (strict !== pinnedStrict)
+        problems.push(`strict_required_status_checks_policy=${strict}≠${pinnedStrict}`);
+    return { problems, unobserved };
+}
+// ── Row 3: repo-branch-protection-posture ──
+/**
+ * One repo's TWO branch-protection lines — classic branch protection AND the
+ * rulesets surface (reading one senses a subset). Classic: PR-required with a
+ * ruled `required_approving_review_count=0`, `enforce_admins=true`, force pushes
+ * + deletions disallowed. Rulesets: any active ruleset carrying push/PR-class
+ * rules for the default branch must be enforcement=active with `bypass_actors=[]`.
+ */
+function branchProtectionLines(contract, repo) {
+    return [classicProtectionLine(contract, repo), rulesetProtectionLine(contract, repo)];
+}
+/** The classic-branch-protection line (row-3 surface 1). */
+function classicProtectionLine(contract, repo) {
+    const lineName = `Parity: ${contract.id} [${repo.repoSlug} · classic]`;
+    const surface = repo.surfaces.branchProtection;
+    const cannot = surfaceCannotVerify(surface, 'classic branch protection');
+    if (cannot !== undefined)
+        return { lineName, verdict: cannot };
+    const parsed = BranchProtectionSchema.safeParse(surface?.data);
+    if (!parsed.success) {
+        // The three toggles are always present in a full admin read; their absence
+        // marks an under-privileged 200 → auth-class, never posture-false.
+        return {
+            lineName,
+            verdict: {
+                status: 'unknown',
+                message: 'classic branch protection: 200 without the enforce_admins/force-push/deletion toggles — auth-class (§14 clause 2)',
+            },
+        };
+    }
+    const p = parsed.data;
+    const drift = [];
+    if (p.required_pull_request_reviews === undefined) {
+        drift.push('required_pull_request_reviews absent (PR not required — direct-push vector open)');
+    }
+    else {
+        const count = p.required_pull_request_reviews.required_approving_review_count;
+        if (count === undefined) {
+            // reviews object present but count field shy → auth-class read.
+            return {
+                lineName,
+                verdict: {
+                    status: 'unknown',
+                    message: 'classic branch protection: reviews object present without required_approving_review_count — auth-class (§14 clause 2)',
+                },
+            };
+        }
+        if (count !== 0)
+            drift.push(`required_approving_review_count=${count}≠0 (ruled posture — nonzero deadlocks the solo-operator merge)`);
+    }
+    if (p.enforce_admins.enabled !== true)
+        drift.push('enforce_admins≠true');
+    if (p.allow_force_pushes.enabled !== false)
+        drift.push('allow_force_pushes≠false');
+    if (p.allow_deletions.enabled !== false)
+        drift.push('allow_deletions≠false');
+    if (drift.length > 0) {
+        return {
+            lineName,
+            verdict: {
+                status: 'warn',
+                message: `classic branch protection drifted: ${drift.join(', ')}`,
+                remediation: 'Restore the default-branch protection: PR required with required_approving_review_count=0, enforce_admins on, force pushes + deletions off.',
+            },
+        };
+    }
+    return {
+        lineName,
+        verdict: {
+            status: 'pass',
+            message: 'PR required (approving-count 0), enforce_admins on, force pushes + deletions off',
+        },
+    };
+}
+/** The rulesets-surface line for row-3 (surface 2 — a bypassable protection ruleset must not undercut classic). */
+function rulesetProtectionLine(contract, repo) {
+    const lineName = `Parity: ${contract.id} [${repo.repoSlug} · rulesets]`;
+    const surface = repo.surfaces.rulesets;
+    const cannot = surfaceCannotVerify(surface, 'rulesets');
+    if (cannot !== undefined)
+        return { lineName, verdict: cannot };
+    const parsed = RulesetsArraySchema.safeParse(surface?.data);
+    if (!parsed.success) {
+        return {
+            lineName,
+            verdict: {
+                status: 'unknown',
+                message: 'rulesets: 200 with an unparseable body — cannot verify (§14 clause 2)',
+            },
+        };
+    }
+    const protectionRulesets = parsed.data
+        .filter(rulesetTargetsDefault)
+        .filter((r) => (r.rules ?? []).some((rule) => PUSH_PR_RULE_TYPES.has(rule.type)));
+    const drift = [];
+    const unobserved = [];
+    for (const ruleset of protectionRulesets) {
+        const name = ruleset.name ?? String(ruleset.id ?? '(unnamed)');
+        const read = enforcementProblems(ruleset);
+        if (read.problems.length > 0)
+            drift.push(`protection ruleset '${name}' is ${read.problems.join(' / ')}`);
+        if (read.unobserved.length > 0)
+            unobserved.push(`protection ruleset '${name}' omitted ${read.unobserved.join(', ')}`);
+    }
+    if (drift.length > 0) {
+        return {
+            lineName,
+            verdict: {
+                status: 'warn',
+                message: `ruleset protection drifted: ${drift.join('; ')}`,
+                remediation: 'Make every default-branch push/PR ruleset enforcement=active with no bypass actors so it cannot undercut classic protection.',
+            },
+        };
+    }
+    // Same precedence as row 2: a field-shy protection ruleset is auth-class —
+    // never certified un-bypassable without observing the field (§14 clause 2).
+    if (unobserved.length > 0) {
+        return {
+            lineName,
+            verdict: {
+                status: 'unknown',
+                message: `rulesets detail field-shy — cannot certify protection posture: ${unobserved.join('; ')} (auth-class, §14 clause 2)`,
+            },
+        };
+    }
+    return {
+        lineName,
+        verdict: {
+            status: 'pass',
+            message: protectionRulesets.length === 0
+                ? 'no default-branch push/PR ruleset present to undercut classic protection'
+                : `${protectionRulesets.length} default-branch push/PR ruleset(s) active + un-bypassable`,
+        },
+    };
+}
+// ── Shared ruleset helpers ──
+/** True when a ruleset's ref-name conditions target the default branch (and don't exclude it). */
+function rulesetTargetsDefault(ruleset) {
+    const refName = ruleset.conditions?.ref_name;
+    if (refName === undefined)
+        return false;
+    const include = refName.include ?? [];
+    const exclude = refName.exclude ?? [];
+    const included = include.some((r) => DEFAULT_BRANCH_INCLUDES.has(r));
+    const excluded = exclude.some((r) => DEFAULT_BRANCH_INCLUDES.has(r));
+    return included && !excluded;
+}
+/** The `required_status_checks` contexts a ruleset supplies (empty when it carries no such rule). */
+function statusCheckContexts(ruleset) {
+    const contexts = [];
+    for (const rule of ruleset.rules ?? []) {
+        if (rule.type !== 'required_status_checks')
+            continue;
+        const params = StatusCheckParamsSchema.safeParse(rule.parameters);
+        if (!params.success)
+            continue;
+        for (const check of params.data.required_status_checks ?? [])
+            contexts.push(check.context);
+    }
+    return contexts;
+}
+/** The `strict_required_status_checks_policy` a ruleset pins, or undefined when it carries no such rule. */
+function strictPolicy(ruleset) {
+    for (const rule of ruleset.rules ?? []) {
+        if (rule.type !== 'required_status_checks')
+            continue;
+        const params = StatusCheckParamsSchema.safeParse(rule.parameters);
+        if (params.success)
+            return params.data.strict_required_status_checks_policy;
+    }
+    return undefined;
+}
+/** Read a file through the injected seam, swallowing a throwing reader to undefined (honest-absent). */
+function safeReadFile(readFile, absPath) {
+    try {
+        return readFile(absPath);
+        // totem-context: a throwing injected reader is the honest-absent signal (declaration file unreadable → skip); rethrowing would break the never-throws contract for a routine absence.
+    }
+    catch {
+        return undefined;
+    }
+}
 //# sourceMappingURL=parity-detect.js.map