@mmnto/totem 1.40.2 → 1.42.0

package/dist/badge-verifier.d.ts

@@ -0,0 +1,60 @@
+import { z } from 'zod';
+export declare const ToolIntegrationConfigSchema: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString, "atleastone">>;
+export declare const BadgeVerificationResultSchema: z.ZodObject<{
+    valid: z.ZodBoolean;
+    errors: z.ZodArray<z.ZodString, "many">;
+    warnings: z.ZodArray<z.ZodString, "many">;
+}, "strip", z.ZodTypeAny, {
+    valid: boolean;
+    warnings: string[];
+    errors: string[];
+}, {
+    valid: boolean;
+    warnings: string[];
+    errors: string[];
+}>;
+export type ToolIntegrationConfig = z.infer<typeof ToolIntegrationConfigSchema>;
+export type BadgeVerificationResult = z.infer<typeof BadgeVerificationResultSchema>;
+export declare const DEFAULT_TOOL_INTEGRATIONS: ToolIntegrationConfig;
+export interface ExtractedBadge {
+    rawUrl: string;
+    altText: string;
+    label: string;
+    message: string;
+    linkTarget?: string;
+    file: string;
+    lineNumber: number;
+}
+/**
+ * Extract shields.io badges from added (`+`) lines of a unified diff,
+ * filtered to `README.md` only. Stateless — recomputes from diff each
+ * invocation (ADR-083: no SHA-stamped flag files).
+ */
+export declare function extractBadgesFromDiff(diff: string): ExtractedBadge[];
+/**
+ * Predicate used by `verifyToolClaims` to determine whether a tool-integration
+ * file/directory exists at the given absolute path. Injectable for tests;
+ * production callers pass `fs.existsSync` (the default).
+ */
+export type PathExistsPredicate = (absolutePath: string) => boolean;
+/**
+ * For each badge, check whether any tool name from `config` appears in the
+ * decoded label or message (case-insensitive, word-boundary match). For every
+ * matched tool, require that at least one of its configured paths exists in
+ * `repoRoot`. Missing tools become errors.
+ *
+ * Falsifying metric: existence of at least one config-listed path satisfies
+ * the badge's tool-integration claim.
+ */
+export declare function verifyToolClaims(badges: ExtractedBadge[], config: ToolIntegrationConfig, repoRoot: string, exists?: PathExistsPredicate): string[];
+/**
+ * Flag standard-claim badges (AGENTS.md, MIT, Apache 2.0, etc.) whose link
+ * target points at internal repo paths instead of the canonical upstream
+ * standard. This is the failure class from mmnto-ai/totem#1925 R2.
+ *
+ * Standard claims are recognized in EITHER the label or the message position
+ * to catch both `[![AGENTS.md](.../AGENTS.md-compliant-...)](./AGENTS.md)` and
+ * `[![Tool-agnostic](.../Tool--agnostic-AGENTS.md-...)](./AGENTS.md)`.
+ */
+export declare function verifySelfReferenceLinks(badges: ExtractedBadge[]): string[];
+//# sourceMappingURL=badge-verifier.d.ts.map

package/dist/badge-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"badge-verifier.d.ts","sourceRoot":"","sources":["../src/badge-verifier.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,2BAA2B,iEAAuD,CAAC;AAEhG,eAAO,MAAM,6BAA6B;;;;;;;;;;;;EAIxC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAIpF,eAAO,MAAM,yBAAyB,EAAE,qBAMvC,CAAC;AAIF,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB;AAKD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,EAAE,CAsCpE;AAID;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC;AAEpE;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,cAAc,EAAE,EACxB,MAAM,EAAE,qBAAqB,EAC7B,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,mBAAmC,GAC1C,MAAM,EAAE,CAuCV;AA+CD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,EAAE,CAY3E"}

package/dist/badge-verifier.js

@@ -0,0 +1,228 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { z } from 'zod';
+import { extractAddedLines } from './diff-parser.js';
+// ─── Schemas ────────────────────────────────────────
+export const ToolIntegrationConfigSchema = z.record(z.string(), z.array(z.string()).nonempty());
+export const BadgeVerificationResultSchema = z.object({
+    valid: z.boolean(),
+    errors: z.array(z.string()),
+    warnings: z.array(z.string()),
+});
+// ─── Default integration matrix (mmnto-ai/totem#1924) ───
+export const DEFAULT_TOOL_INTEGRATIONS = {
+    claude: ['.claude/', 'CLAUDE.md'],
+    gemini: ['.gemini/', 'GEMINI.md'],
+    cursor: ['.cursor/', '.cursorrules'],
+    windsurf: ['.windsurfrules', '.windsurf/'],
+    copilot: ['.github/copilot-instructions.md'],
+};
+const BADGE_IMAGE_RE = /!\[([^\]]*)\]\((https:\/\/img\.shields\.io\/badge\/[^)\s"]+)\)/g;
+const WRAP_TAIL_RE = /^\]\(([^)\s"]+)\)/;
+/**
+ * Extract shields.io badges from added (`+`) lines of a unified diff,
+ * filtered to `README.md` only. Stateless — recomputes from diff each
+ * invocation (ADR-083: no SHA-stamped flag files).
+ */
+export function extractBadgesFromDiff(diff) {
+    if (!diff)
+        return [];
+    const additions = extractAddedLines(diff);
+    const badges = [];
+    for (const addition of additions) {
+        if (addition.file !== 'README.md')
+            continue;
+        const line = addition.line;
+        for (const match of line.matchAll(BADGE_IMAGE_RE)) {
+            const altText = match[1] ?? '';
+            const url = match[2] ?? '';
+            const start = match.index ?? 0;
+            const end = start + match[0].length;
+            let linkTarget;
+            // Wrapped form `[![alt](url)](target)`: precede by `[`, follow with `](target)`
+            if (line[start - 1] === '[') {
+                const after = line.slice(end);
+                const wrap = WRAP_TAIL_RE.exec(after);
+                if (wrap) {
+                    linkTarget = wrap[1];
+                }
+            }
+            const { label, message } = decodeBadgeUrl(url);
+            badges.push({
+                rawUrl: url,
+                altText,
+                label,
+                message,
+                linkTarget,
+                file: addition.file,
+                lineNumber: addition.lineNumber,
+            });
+        }
+    }
+    return badges;
+}
+/**
+ * For each badge, check whether any tool name from `config` appears in the
+ * decoded label or message (case-insensitive, word-boundary match). For every
+ * matched tool, require that at least one of its configured paths exists in
+ * `repoRoot`. Missing tools become errors.
+ *
+ * Falsifying metric: existence of at least one config-listed path satisfies
+ * the badge's tool-integration claim.
+ */
+export function verifyToolClaims(badges, config, repoRoot, exists = fs.existsSync) {
+    const errors = [];
+    const reported = new Set();
+    const toolKeys = Object.keys(config);
+    for (const badge of badges) {
+        const haystack = `${badge.label} ${badge.message}`.toLowerCase();
+        for (const tool of toolKeys) {
+            const key = tool.toLowerCase();
+            const wordBoundary = new RegExp(`\\b${escapeRegExp(key)}\\b`);
+            if (!wordBoundary.test(haystack))
+                continue;
+            const candidatePaths = config[tool] ?? [];
+            // Resolve and constrain to repoRoot — a path like '../CLAUDE.md' would
+            // satisfy the claim with a file OUTSIDE the repo, defeating the falsifying
+            // metric. Drop paths that escape the repo before existence-checking.
+            const anyExists = candidatePaths.some((rel) => {
+                const resolved = path.resolve(repoRoot, rel);
+                const repoRootResolved = path.resolve(repoRoot);
+                const sep = path.sep;
+                if (resolved !== repoRootResolved && !resolved.startsWith(repoRootResolved + sep)) {
+                    return false;
+                }
+                return exists(resolved);
+            });
+            if (anyExists)
+                continue;
+            const dedupKey = `${badge.rawUrl}|${key}`;
+            if (reported.has(dedupKey))
+                continue;
+            reported.add(dedupKey);
+            const expected = candidatePaths.join(', ');
+            errors.push(`Badge at README.md:${badge.lineNumber} claims integration with "${tool}" but none of the expected paths exist in the repo: ${expected}`);
+        }
+    }
+    return errors;
+}
+function escapeRegExp(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+// ─── Self-reference link verification ───────────────
+/**
+ * Standard-claim labels — badges that assert compliance with an external
+ * spec/license. When these claims appear, the badge's link target must point
+ * at the canonical upstream, not at internal repo paths (the "circular claim"
+ * trap from mmnto-ai/totem#1925 R2).
+ */
+const STANDARD_CLAIM_LABELS = new Set([
+    'agents.md',
+    'mit',
+    'apache 2.0',
+    'apache-2.0',
+    'apache2.0',
+    'bsd',
+    'bsd-2-clause',
+    'bsd-3-clause',
+    'gpl',
+    'gpl-3.0',
+    'mpl',
+    'mpl-2.0',
+]);
+/**
+ * A link target is "internal" if either:
+ *   - it has no HTTP(S) scheme (bare/relative path: `AGENTS.md`, `./AGENTS.md`,
+ *     `../docs/foo.md`, `LICENSE`, `docs/ADR-038.md`), OR
+ *   - it's a fully-qualified URL into a `mmnto-ai/...` GitHub path (self-reference
+ *     for this org — the catalyst class from mmnto-ai/totem#1925 R2).
+ *
+ * The `mmnto-ai/` pattern is intentionally hardcoded for this PR's scope and
+ * tracked as a follow-up: GCA's review on #1934 flagged this as core-pack coupling
+ * to a single user. Resolution path is configuration via `totem.config.ts`
+ * (e.g., a `selfLinkOrgs: string[]` field) — see the PR description.
+ */
+function isInternalLinkTarget(target) {
+    if (!/^https?:\/\//i.test(target))
+        return true;
+    if (/\bmmnto-ai\//i.test(target))
+        return true;
+    return false;
+}
+/**
+ * Flag standard-claim badges (AGENTS.md, MIT, Apache 2.0, etc.) whose link
+ * target points at internal repo paths instead of the canonical upstream
+ * standard. This is the failure class from mmnto-ai/totem#1925 R2.
+ *
+ * Standard claims are recognized in EITHER the label or the message position
+ * to catch both `[![AGENTS.md](.../AGENTS.md-compliant-...)](./AGENTS.md)` and
+ * `[![Tool-agnostic](.../Tool--agnostic-AGENTS.md-...)](./AGENTS.md)`.
+ */
+export function verifySelfReferenceLinks(badges) {
+    const errors = [];
+    for (const badge of badges) {
+        if (!badge.linkTarget)
+            continue;
+        const claim = findStandardClaim(badge);
+        if (!claim)
+            continue;
+        if (!isInternalLinkTarget(badge.linkTarget))
+            continue;
+        errors.push(`Badge at README.md:${badge.lineNumber} claims "${claim}" but links to internal path "${badge.linkTarget}". Standard-claim badges must link to the canonical upstream (e.g., https://agents.md/, https://opensource.org/licenses/MIT).`);
+    }
+    return errors;
+}
+function findStandardClaim(badge) {
+    for (const field of [badge.label, badge.message]) {
+        const key = field.toLowerCase().trim();
+        if (STANDARD_CLAIM_LABELS.has(key))
+            return field;
+    }
+    return null;
+}
+// ─── shields.io URL decoding ────────────────────────
+function decodeBadgeUrl(url) {
+    const m = url.match(/\/badge\/(.+)$/);
+    if (!m)
+        return { label: '', message: '' };
+    let path = m[1] ?? '';
+    const queryIdx = path.indexOf('?');
+    if (queryIdx >= 0)
+        path = path.slice(0, queryIdx);
+    path = path.replace(/\.svg$/, '');
+    // Split on unescaped single dashes; `--` is the shields.io escape for literal `-`.
+    const parts = path.split(/(?<!-)-(?!-)/);
+    // shields.io treats /badge/<LABEL>-<MESSAGE>-<COLOR> as 3-part and /badge/<MESSAGE>-<COLOR>
+    // as 2-part (empty label). Without this branch, a badge like `/badge/Claude-blue` would
+    // misassign `Claude` to label and never get checked for tool-claim membership.
+    const hasLabel = parts.length >= 3;
+    return {
+        label: decodeShieldsText(hasLabel ? (parts[0] ?? '') : ''),
+        message: decodeShieldsText(hasLabel ? (parts[1] ?? '') : (parts[0] ?? '')),
+    };
+}
+/**
+ * Decode shields.io path-segment encoding per the static-badge spec:
+ *   `--` → `-`, `__` → `_`, `_` → ` `, plus standard percent-encoding.
+ *
+ * Single-pass replace with alternation order (`--` and `__` listed before `_`)
+ * matches longer sequences first at each position, so `key__value` decodes to
+ * `key_value` rather than `key  value`.
+ */
+function decodeShieldsText(s) {
+    let out;
+    try {
+        out = decodeURIComponent(s); // totem-context: intentional cleanup — next-line catch swallows malformed % escapes (e.g., a stray `%` in a badge URL) so verifyToolClaims can still match the raw segment instead of crashing the whole hook.
+    }
+    catch {
+        out = s;
+    }
+    return out.replace(/--|__|_/g, (m) => {
+        if (m === '--')
+            return '-';
+        if (m === '__')
+            return '_';
+        return ' ';
+    });
+}
+//# sourceMappingURL=badge-verifier.js.map

package/dist/badge-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"badge-verifier.js","sourceRoot":"","sources":["../src/badge-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD,uDAAuD;AAEvD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;AAEhG,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC9B,CAAC,CAAC;AAKH,2DAA2D;AAE3D,MAAM,CAAC,MAAM,yBAAyB,GAA0B;IAC9D,MAAM,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC;IACjC,MAAM,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC;IACjC,MAAM,EAAE,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,QAAQ,EAAE,CAAC,gBAAgB,EAAE,YAAY,CAAC;IAC1C,OAAO,EAAE,CAAC,iCAAiC,CAAC;CAC7C,CAAC;AAcF,MAAM,cAAc,GAAG,iEAAiE,CAAC;AACzF,MAAM,YAAY,GAAG,mBAAmB,CAAC;AAEzC;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAqB,EAAE,CAAC;IAEpC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW;YAAE,SAAS;QAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;QAC3B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAClD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;YAC/B,MAAM,GAAG,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAEpC,IAAI,UAA8B,CAAC;YACnC,gFAAgF;YAChF,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC9B,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACtC,IAAI,IAAI,EAAE,CAAC;oBACT,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACvB,CAAC;YACH,CAAC;YAED,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC;gBACV,MAAM,EAAE,GAAG;gBACX,OAAO;gBACP,KAAK;gBACL,OAAO;gBACP,UAAU;gBACV,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,UAAU,EAAE,QAAQ,CAAC,UAAU;aAChC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAWD;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAwB,EACxB,MAA6B,EAC7B,QAAgB,EAChB,SAA8B,EAAE,CAAC,UAAU;IAE3C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAErC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC;QACjE,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAC/B,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC9D,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAE3C,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAC1C,uEAAuE;YACvE,2EAA2E;YAC3E,qEAAqE;YACrE,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;gBAC7C,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAChD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;gBACrB,IAAI,QAAQ,KAAK,gBAAgB,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,gBAAgB,GAAG,GAAG,CAAC,EAAE,CAAC;oBAClF,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1B,CAAC,CAAC,CAAC;YACH,IAAI,SAAS;gBAAE,SAAS;YAExB,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAC1C,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACrC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAEvB,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3C,MAAM,CAAC,IAAI,CACT,sBAAsB,KAAK,CAAC,UAAU,6BAA6B,IAAI,uDAAuD,QAAQ,EAAE,CACzI,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED,uDAAuD;AAEvD;;;;;GAKG;AACH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,WAAW;IACX,KAAK;IACL,YAAY;IACZ,YAAY;IACZ,WAAW;IACX,KAAK;IACL,cAAc;IACd,cAAc;IACd,KAAK;IACL,SAAS;IACT,KAAK;IACL,SAAS;CACV,CAAC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,SAAS,oBAAoB,CAAC,MAAc;IAC1C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAwB;IAC/D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,UAAU;YAAE,SAAS;QAChC,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,UAAU,CAAC;YAAE,SAAS;QACtD,MAAM,CAAC,IAAI,CACT,sBAAsB,KAAK,CAAC,UAAU,YAAY,KAAK,iCAAiC,KAAK,CAAC,UAAU,+HAA+H,CACxO,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAqB;IAC9C,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uDAAuD;AAEvD,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC1C,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,QAAQ,IAAI,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAClD,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAElC,mFAAmF;IACnF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACzC,4FAA4F;IAC5F,wFAAwF;IACxF,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;IACnC,OAAO;QACL,KAAK,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;KAC3E,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,CAAS;IAClC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,+MAA+M;IAC9O,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,CAAC,CAAC;IACV,CAAC;IACD,OAAO,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE;QACnC,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC;QAC3B,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC;QAC3B,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/badge-verifier.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=badge-verifier.test.d.ts.map

package/dist/badge-verifier.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"badge-verifier.test.d.ts","sourceRoot":"","sources":["../src/badge-verifier.test.ts"],"names":[],"mappings":""}

package/dist/badge-verifier.test.js

@@ -0,0 +1,264 @@
+import { describe, expect, it } from 'vitest';
+import { BadgeVerificationResultSchema, DEFAULT_TOOL_INTEGRATIONS, extractBadgesFromDiff, ToolIntegrationConfigSchema, verifySelfReferenceLinks, verifyToolClaims, } from './badge-verifier.js';
+function makeBadge(overrides = {}) {
+    return {
+        rawUrl: 'https://img.shields.io/badge/x-y-blue',
+        altText: '',
+        label: 'x',
+        message: 'y',
+        file: 'README.md',
+        lineNumber: 1,
+        ...overrides,
+    };
+}
+const README_DIFF_HEADER = `diff --git a/README.md b/README.md
+index aaaaaa..bbbbbb 100644
+--- a/README.md
++++ b/README.md
+@@ -1,5 +1,5 @@\n`;
+const DIFF_NOT_README_HEADER = `diff --git a/docs/other.md b/docs/other.md
+index aaaaaa..bbbbbb 100644
+--- a/docs/other.md
++++ b/docs/other.md
+@@ -1,5 +1,5 @@\n`;
+describe('badge-verifier — schemas', () => {
+    it('ToolIntegrationConfigSchema accepts a mapping of tool name to path list', () => {
+        const parsed = ToolIntegrationConfigSchema.parse({
+            claude: ['.claude/', 'CLAUDE.md'],
+            gemini: ['.gemini/'],
+        });
+        expect(parsed.claude).toEqual(['.claude/', 'CLAUDE.md']);
+    });
+    it('ToolIntegrationConfigSchema rejects empty path arrays', () => {
+        expect(() => ToolIntegrationConfigSchema.parse({ claude: [] })).toThrow();
+    });
+    it('BadgeVerificationResultSchema valid===true iff errors empty', () => {
+        const ok = BadgeVerificationResultSchema.parse({
+            valid: true,
+            errors: [],
+            warnings: ['something'],
+        });
+        expect(ok.valid).toBe(true);
+        expect(ok.warnings).toHaveLength(1);
+    });
+    it('DEFAULT_TOOL_INTEGRATIONS includes the 5 tools named in mmnto-ai/totem#1924', () => {
+        expect(Object.keys(DEFAULT_TOOL_INTEGRATIONS).sort()).toEqual([
+            'claude',
+            'copilot',
+            'cursor',
+            'gemini',
+            'windsurf',
+        ]);
+        // Every tool has at least one falsifying path
+        for (const [, paths] of Object.entries(DEFAULT_TOOL_INTEGRATIONS)) {
+            expect(paths.length).toBeGreaterThan(0);
+        }
+    });
+});
+describe('badge-verifier — extractBadgesFromDiff', () => {
+    it('extracts url, decoded text, and link target from complex multiline diffs', () => {
+        // The TEST DIRECTIVE from spec — proves shields.io URL encoding (_, --) decodes correctly.
+        const diff = README_DIFF_HEADER +
+            ` # Totem\n` +
+            `+[![Tool-agnostic](https://img.shields.io/badge/Tool--agnostic-AGENTS.md-blue)](./AGENTS.md)\n` +
+            `+[![Build Status](https://img.shields.io/badge/build-passing-green)](https://example.com/ci)\n` +
+            `+Some text with [![Hello World](https://img.shields.io/badge/Hello_World-yes-blue)](https://example.com)\n` +
+            ` ## Other\n`;
+        const badges = extractBadgesFromDiff(diff);
+        expect(badges).toHaveLength(3);
+        expect(badges[0]).toMatchObject({
+            rawUrl: 'https://img.shields.io/badge/Tool--agnostic-AGENTS.md-blue',
+            label: 'Tool-agnostic',
+            message: 'AGENTS.md',
+            linkTarget: './AGENTS.md',
+            file: 'README.md',
+        });
+        expect(badges[1]).toMatchObject({
+            rawUrl: 'https://img.shields.io/badge/build-passing-green',
+            label: 'build',
+            message: 'passing',
+            linkTarget: 'https://example.com/ci',
+        });
+        expect(badges[2]).toMatchObject({
+            label: 'Hello World',
+            message: 'yes',
+        });
+    });
+    it('ignores - (removed) lines', () => {
+        const diff = README_DIFF_HEADER +
+            ` # Totem\n` +
+            `-[![Old](https://img.shields.io/badge/Old-badge-red)](./old.md)\n` +
+            `+[![New](https://img.shields.io/badge/New-badge-green)](./new.md)\n`;
+        const badges = extractBadgesFromDiff(diff);
+        expect(badges).toHaveLength(1);
+        expect(badges[0]?.label).toBe('New');
+    });
+    it('ignores badges in files other than README.md', () => {
+        const diff = DIFF_NOT_README_HEADER +
+            ` text\n` +
+            `+[![Tool](https://img.shields.io/badge/Tool-agnostic-blue)](./foo.md)\n`;
+        expect(extractBadgesFromDiff(diff)).toHaveLength(0);
+    });
+    it('handles badge without surrounding markdown link', () => {
+        const diff = README_DIFF_HEADER + `+![alt](https://img.shields.io/badge/MIT-License-green)\n`;
+        const badges = extractBadgesFromDiff(diff);
+        expect(badges).toHaveLength(1);
+        expect(badges[0]?.linkTarget).toBeUndefined();
+        expect(badges[0]?.label).toBe('MIT');
+        expect(badges[0]?.message).toBe('License');
+    });
+    it('decodes percent-encoded characters in label/message', () => {
+        const diff = README_DIFF_HEADER +
+            `+[![X](https://img.shields.io/badge/Apache%202.0-license-blue)](./LICENSE)\n`;
+        const badges = extractBadgesFromDiff(diff);
+        expect(badges[0]?.label).toBe('Apache 2.0');
+    });
+    it('treats 2-part shields URLs (/<MESSAGE>-<COLOR>) as empty-label per shields.io spec', () => {
+        // GCA review on mmnto-ai/totem#1934: `/badge/Claude-blue` means MESSAGE=Claude,
+        // COLOR=blue, LABEL=''. Without the 2-part branch, "Claude" lands in label,
+        // and downstream consumers that key on label vs message misidentify.
+        const diff = README_DIFF_HEADER + `+[![X](https://img.shields.io/badge/Claude-blue)](https://claude.ai)\n`;
+        const badges = extractBadgesFromDiff(diff);
+        expect(badges[0]?.label).toBe('');
+        expect(badges[0]?.message).toBe('Claude');
+    });
+    it('returns empty array when diff has no README.md changes', () => {
+        expect(extractBadgesFromDiff('')).toEqual([]);
+        expect(extractBadgesFromDiff(DIFF_NOT_README_HEADER + ` text\n+more text\n`)).toEqual([]);
+    });
+});
+describe('badge-verifier — verifyToolClaims', () => {
+    const config = DEFAULT_TOOL_INTEGRATIONS;
+    const noPathsExist = (_p) => false;
+    const allPathsExist = (_p) => true;
+    it('returns 2 errors when badge claims Claude and Cursor but neither integration file exists', () => {
+        const badge = makeBadge({ label: 'Tool', message: 'Claude · Cursor' });
+        const errors = verifyToolClaims([badge], config, '/repo', noPathsExist);
+        expect(errors).toHaveLength(2);
+        expect(errors.some((e) => e.toLowerCase().includes('claude'))).toBe(true);
+        expect(errors.some((e) => e.toLowerCase().includes('cursor'))).toBe(true);
+    });
+    it('returns 0 errors when at least one config path exists for the claimed tool', () => {
+        const badge = makeBadge({ label: 'Integration', message: 'Claude' });
+        const errors = verifyToolClaims([badge], config, '/repo', (p) => p.endsWith('CLAUDE.md'));
+        expect(errors).toHaveLength(0);
+    });
+    it('returns 0 errors when no tool name appears in badge text', () => {
+        const badge = makeBadge({ label: 'build', message: 'passing' });
+        const errors = verifyToolClaims([badge], config, '/repo', noPathsExist);
+        expect(errors).toHaveLength(0);
+    });
+    it('matches tool names case-insensitively with word boundaries', () => {
+        // "claudette" should NOT match "claude" — word-boundary required.
+        const badge1 = makeBadge({ message: 'claudette' });
+        expect(verifyToolClaims([badge1], config, '/repo', noPathsExist)).toHaveLength(0);
+        // "CLAUDE" uppercase should match.
+        const badge2 = makeBadge({ message: 'CLAUDE' });
+        expect(verifyToolClaims([badge2], config, '/repo', noPathsExist)).toHaveLength(1);
+    });
+    it('does not double-count tools that appear in both label and message', () => {
+        const badge = makeBadge({ label: 'Claude', message: 'Claude integration' });
+        const errors = verifyToolClaims([badge], config, '/repo', noPathsExist);
+        expect(errors).toHaveLength(1);
+    });
+    it('error message names the tool and at least one expected path', () => {
+        const badge = makeBadge({ message: 'gemini' });
+        const errors = verifyToolClaims([badge], config, '/repo', noPathsExist);
+        expect(errors[0]).toContain('gemini');
+        expect(errors[0]).toMatch(/\.gemini\/|GEMINI\.md/);
+    });
+    it('passes through cleanly when all paths exist', () => {
+        const badge = makeBadge({ message: 'Claude Gemini Cursor' });
+        expect(verifyToolClaims([badge], config, '/repo', allPathsExist)).toHaveLength(0);
+    });
+    it('rejects configured paths that escape repoRoot via .. traversal', () => {
+        // CR review on mmnto-ai/totem#1934: a configured path like '../CLAUDE.md' would
+        // satisfy the claim with a file outside the repo, defeating the falsifying metric.
+        const escapeConfig = {
+            claude: ['../CLAUDE.md', '../../CLAUDE.md'],
+        };
+        const badge = makeBadge({ message: 'Claude' });
+        // Predicate returns true for everything — but the path-escape guard must filter
+        // before existence-checking, so we still get an error.
+        const errors = verifyToolClaims([badge], escapeConfig, '/repo/root', () => true);
+        expect(errors).toHaveLength(1);
+        expect(errors[0]).toMatch(/claude/i);
+    });
+});
+describe('badge-verifier — verifySelfReferenceLinks', () => {
+    it('rejects AGENTS.md badge pointing to internal ADR instead of canonical standard', () => {
+        // The TEST DIRECTIVE from spec — circular claim: badge claims AGENTS.md compliance
+        // but links to an internal ADR (not the upstream standard).
+        const badge = makeBadge({
+            label: 'AGENTS.md',
+            message: 'compliant',
+            linkTarget: 'https://github.com/mmnto-ai/totem/blob/main/docs/ADR-038.md',
+        });
+        const errors = verifySelfReferenceLinks([badge]);
+        expect(errors).toHaveLength(1);
+        expect(errors[0]).toMatch(/AGENTS\.md|self-reference|internal/i);
+    });
+    it('rejects standard-claim badge linked to a relative internal path', () => {
+        const badge = makeBadge({
+            label: 'MIT',
+            message: 'license',
+            linkTarget: './docs/licensing.md',
+        });
+        expect(verifySelfReferenceLinks([badge])).toHaveLength(1);
+    });
+    it('rejects standard-claim badge linked to mmnto-ai/<anything>', () => {
+        const badge = makeBadge({
+            label: 'Apache 2.0',
+            message: 'license',
+            linkTarget: 'https://github.com/mmnto-ai/totem-strategy',
+        });
+        expect(verifySelfReferenceLinks([badge])).toHaveLength(1);
+    });
+    it('accepts AGENTS.md badge linked to canonical upstream', () => {
+        const badge = makeBadge({
+            label: 'AGENTS.md',
+            message: 'compliant',
+            linkTarget: 'https://agents.md/',
+        });
+        expect(verifySelfReferenceLinks([badge])).toHaveLength(0);
+    });
+    it('accepts MIT badge linked to opensource.org', () => {
+        const badge = makeBadge({
+            label: 'MIT',
+            message: 'license',
+            linkTarget: 'https://opensource.org/licenses/MIT',
+        });
+        expect(verifySelfReferenceLinks([badge])).toHaveLength(0);
+    });
+    it('ignores non-standard-claim badges entirely (no self-reference check)', () => {
+        const badge = makeBadge({
+            label: 'build',
+            message: 'passing',
+            linkTarget: './docs/ci.md',
+        });
+        expect(verifySelfReferenceLinks([badge])).toHaveLength(0);
+    });
+    it('ignores standard-claim badges with no link target', () => {
+        const badge = makeBadge({ label: 'AGENTS.md', message: 'compliant' });
+        expect(verifySelfReferenceLinks([badge])).toHaveLength(0);
+    });
+    it('flags bare relative paths like LICENSE or docs/ADR-038.md as internal', () => {
+        // CR review on mmnto-ai/totem#1934: hardcoded `./` / `../` regex missed bare
+        // README-relative targets. Inversion: anything without http(s):// is internal.
+        const cases = [
+            { linkTarget: 'LICENSE', expectFlag: true },
+            { linkTarget: 'docs/ADR-038.md', expectFlag: true },
+            { linkTarget: 'AGENTS.md', expectFlag: true },
+            { linkTarget: './AGENTS.md', expectFlag: true },
+            { linkTarget: '../AGENTS.md', expectFlag: true },
+            { linkTarget: 'https://agents.md/', expectFlag: false },
+            { linkTarget: 'http://opensource.org/licenses/MIT', expectFlag: false },
+        ];
+        for (const { linkTarget, expectFlag } of cases) {
+            const badge = makeBadge({ label: 'AGENTS.md', message: 'compliant', linkTarget });
+            const errors = verifySelfReferenceLinks([badge]);
+            expect(errors).toHaveLength(expectFlag ? 1 : 0);
+        }
+    });
+});
+//# sourceMappingURL=badge-verifier.test.js.map

package/dist/badge-verifier.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"badge-verifier.test.js","sourceRoot":"","sources":["../src/badge-verifier.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,EACzB,qBAAqB,EAGrB,2BAA2B,EAC3B,wBAAwB,EACxB,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAE7B,SAAS,SAAS,CAAC,YAAqC,EAAE;IACxD,OAAO;QACL,MAAM,EAAE,uCAAuC;QAC/C,OAAO,EAAE,EAAE;QACX,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,WAAW;QACjB,UAAU,EAAE,CAAC;QACb,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,MAAM,kBAAkB,GAAG;;;;kBAIT,CAAC;AAEnB,MAAM,sBAAsB,GAAG;;;;kBAIb,CAAC;AAEnB,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC;YAC/C,MAAM,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC;YACjC,MAAM,EAAE,CAAC,UAAU,CAAC;SACrB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,GAAG,EAAE,CAAC,2BAA2B,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,EAAE,GAAG,6BAA6B,CAAC,KAAK,CAAC;YAC7C,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,CAAC,WAAW,CAAC;SACxB,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACrF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC;YAC5D,QAAQ;YACR,SAAS;YACT,QAAQ;YACR,QAAQ;YACR,UAAU;SACX,CAAC,CAAC;QACH,8CAA8C;QAC9C,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,EAAE,CAAC;YAClE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wCAAwC,EAAE,GAAG,EAAE;IACtD,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,2FAA2F;QAC3F,MAAM,IAAI,GACR,kBAAkB;YAClB,YAAY;YACZ,gGAAgG;YAChG,gGAAgG;YAChG,4GAA4G;YAC5G,aAAa,CAAC;QAEhB,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAE3C,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YAC9B,MAAM,EAAE,4DAA4D;YACpE,KAAK,EAAE,eAAe;YACtB,OAAO,EAAE,WAAW;YACpB,UAAU,EAAE,aAAa;YACzB,IAAI,EAAE,WAAW;SAClB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YAC9B,MAAM,EAAE,kDAAkD;YAC1D,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,SAAS;YAClB,UAAU,EAAE,wBAAwB;SACrC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YAC9B,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,IAAI,GACR,kBAAkB;YAClB,YAAY;YACZ,mEAAmE;YACnE,qEAAqE,CAAC;QAExE,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,IAAI,GACR,sBAAsB;YACtB,SAAS;YACT,yEAAyE,CAAC;QAE5E,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,IAAI,GAAG,kBAAkB,GAAG,2DAA2D,CAAC;QAE9F,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;QAC9C,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,IAAI,GACR,kBAAkB;YAClB,8EAA8E,CAAC;QAEjF,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oFAAoF,EAAE,GAAG,EAAE;QAC5F,gFAAgF;QAChF,4EAA4E;QAC5E,qEAAqE;QACrE,MAAM,IAAI,GACR,kBAAkB,GAAG,wEAAwE,CAAC;QAChG,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC9C,MAAM,CAAC,qBAAqB,CAAC,sBAAsB,GAAG,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;IACjD,MAAM,MAAM,GAAG,yBAAyB,CAAC;IACzC,MAAM,YAAY,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,KAAK,CAAC;IAC3C,MAAM,aAAa,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,CAAC;IAE3C,EAAE,CAAC,0FAA0F,EAAE,GAAG,EAAE;QAClG,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;QACxE,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1E,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;QAC1F,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;QACxE,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,kEAAkE;QAClE,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;QACnD,MAAM,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAClF,mCAAmC;QACnC,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QAChD,MAAM,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;QACxE,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;QACxE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAC7D,MAAM,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,gFAAgF;QAChF,mFAAmF;QACnF,MAAM,YAAY,GAA0B;YAC1C,MAAM,EAAE,CAAC,cAAc,EAAE,iBAAiB,CAAC;SAC5C,CAAC;QACF,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC/C,gFAAgF;QAChF,uDAAuD;QACvD,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACjF,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2CAA2C,EAAE,GAAG,EAAE;IACzD,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;QACxF,mFAAmF;QACnF,4DAA4D;QAC5D,MAAM,KAAK,GAAG,SAAS,CAAC;YACtB,KAAK,EAAE,WAAW;YAClB,OAAO,EAAE,WAAW;YACpB,UAAU,EAAE,6DAA6D;SAC1E,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,wBAAwB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,KAAK,GAAG,SAAS,CAAC;YACtB,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,SAAS;YAClB,UAAU,EAAE,qBAAqB;SAClC,CAAC,CAAC;QACH,MAAM,CAAC,wBAAwB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,KAAK,GAAG,SAAS,CAAC;YACtB,KAAK,EAAE,YAAY;YACnB,OAAO,EAAE,SAAS;YAClB,UAAU,EAAE,4CAA4C;SACzD,CAAC,CAAC;QACH,MAAM,CAAC,wBAAwB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,KAAK,GAAG,SAAS,CAAC;YACtB,KAAK,EAAE,WAAW;YAClB,OAAO,EAAE,WAAW;YACpB,UAAU,EAAE,oBAAoB;SACjC,CAAC,CAAC;QACH,MAAM,CAAC,wBAAwB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,KAAK,GAAG,SAAS,CAAC;YACtB,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,SAAS;YAClB,UAAU,EAAE,qCAAqC;SAClD,CAAC,CAAC;QACH,MAAM,CAAC,wBAAwB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,KAAK,GAAG,SAAS,CAAC;YACtB,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,SAAS;YAClB,UAAU,EAAE,cAAc;SAC3B,CAAC,CAAC;QACH,MAAM,CAAC,wBAAwB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;QACtE,MAAM,CAAC,wBAAwB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,6EAA6E;QAC7E,+EAA+E;QAC/E,MAAM,KAAK,GAAuD;YAChE,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE;YAC3C,EAAE,UAAU,EAAE,iBAAiB,EAAE,UAAU,EAAE,IAAI,EAAE;YACnD,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE;YAC7C,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,IAAI,EAAE;YAC/C,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,IAAI,EAAE;YAChD,EAAE,UAAU,EAAE,oBAAoB,EAAE,UAAU,EAAE,KAAK,EAAE;YACvD,EAAE,UAAU,EAAE,oCAAoC,EAAE,UAAU,EAAE,KAAK,EAAE;SACxE,CAAC;QACF,KAAK,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,KAAK,EAAE,CAAC;YAC/C,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;YAClF,MAAM,MAAM,GAAG,wBAAwB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YACjD,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/compile-manifest.d.ts

@@ -5,18 +5,21 @@ export declare const CompileManifestSchema: z.ZodObject<{
     input_hash: z.ZodString;
     output_hash: z.ZodString;
     rule_count: z.ZodNumber;
+    compile_worker_fingerprint: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     model: string;
     compiled_at: string;
     input_hash: string;
     output_hash: string;
     rule_count: number;
+    compile_worker_fingerprint?: string | undefined;
 }, {
     model: string;
     compiled_at: string;
     input_hash: string;
     output_hash: string;
     rule_count: number;
+    compile_worker_fingerprint?: string | undefined;
 }>;
 export type CompileManifest = z.infer<typeof CompileManifestSchema>;
 /**

package/dist/compile-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compile-manifest.d.ts","sourceRoot":"","sources":["../src/compile-manifest.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;EAMhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AA8BpE;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAoB5D;AAmDD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAUxD;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAyB1E;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAuC5D;AAMD;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,GAAG,IAAI,CAW1F;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,eAAe,CA6BzE"}
+{"version":3,"file":"compile-manifest.d.ts","sourceRoot":"","sources":["../src/compile-manifest.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;EAUhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AA8BpE;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAoB5D;AAmDD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAUxD;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAyB1E;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAuC5D;AAMD;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,GAAG,IAAI,CAW1F;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,eAAe,CA6BzE"}

package/dist/compile-manifest.js

@@ -11,6 +11,10 @@ export const CompileManifestSchema = z.object({
     input_hash: z.string(),
     output_hash: z.string(),
     rule_count: z.number().int().nonnegative(),
+    // Producer attestation orthogonal to output_hash (recompute trigger).
+    // Optional for backward-compat with pre-#1937 manifests; only the anthropic
+    // provider populates it in Phase 1. Per Proposal 278 § Action 3.
+    compile_worker_fingerprint: z.string().optional(),
 });
 // ─── Hashing ─────────────────────────────────────────
 /**