@multileaf/ai-workflow 0.1.0

package/dist/package-updates.js

@@ -0,0 +1,32 @@
+export function compareVersions(left, right) {
+    const a = left.split(".").map(Number);
+    const b = right.split(".").map(Number);
+    for (let index = 0; index < 3; index++) {
+        const difference = (a[index] ?? 0) - (b[index] ?? 0);
+        if (difference)
+            return difference;
+    }
+    return 0;
+}
+export function planPackageUpdate(current, candidate, target, lockedVersions = new Map()) {
+    const supportedTargets = candidate.targets;
+    if (supportedTargets &&
+        !supportedTargets.includes(target) &&
+        !supportedTargets.includes("universal"))
+        return {
+            status: "incompatible",
+            reason: `${candidate.id} does not support target '${target}'.`,
+        };
+    const dependencyConflict = candidate.dependencies.find((dependency) => {
+        const locked = lockedVersions.get(dependency);
+        return locked !== undefined && compareVersions(locked, candidate.version) !== 0;
+    });
+    if (dependencyConflict)
+        return {
+            status: "conflict",
+            reason: `Dependency '${dependencyConflict}' is locked at an incompatible version.`,
+        };
+    if (current && compareVersions(candidate.version, current.version) <= 0)
+        return { status: "current", reason: `${candidate.id} is already at ${current.version}.` };
+    return { status: "update" };
+}

package/dist/plugin-sdk.d.ts

@@ -0,0 +1,20 @@
+import type { FileSystem } from "./types.js";
+import { type PackageContract } from "./package-contract.js";
+export type PluginDefinition = {
+    id: string;
+    version: string;
+    description: string;
+};
+export type PluginScaffold = {
+    projectRoot: string;
+    root: string;
+    files: Readonly<Record<string, string>>;
+};
+export type DeepReadonly<T> = T extends (...args: never[]) => unknown ? T : T extends object ? {
+    readonly [Key in keyof T]: DeepReadonly<T[Key]>;
+} : T;
+export declare function definePlugin(contract: PackageContract): DeepReadonly<PackageContract>;
+export declare function createPluginScaffold(projectRoot: string, directory: string, definition: PluginDefinition): PluginScaffold;
+export declare function writePluginScaffold(fs: FileSystem, scaffold: PluginScaffold): void;
+export declare function validatePluginDirectory(fs: FileSystem, projectRoot: string, directory: string): PackageContract;
+export declare function resolvePluginDirectory(projectRoot: string, directory: string): string;

package/dist/plugin-sdk.js

@@ -0,0 +1,243 @@
+import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
+import { validatePackageContract } from "./package-contract.js";
+export function definePlugin(contract) {
+    return deepFreeze(contract);
+}
+export function createPluginScaffold(projectRoot, directory, definition) {
+    assertPluginDefinition(definition);
+    const root = resolvePluginDirectory(projectRoot, directory);
+    const skillId = definition.id.split("/").at(-1) ?? definition.id;
+    const skillPath = `skills/${skillId}/SKILL.md`;
+    return {
+        projectRoot: resolve(projectRoot),
+        root,
+        files: {
+            "package.yaml": pluginManifest(definition, skillId, skillPath),
+            [skillPath]: `---\nname: ${skillId}\ndescription: ${JSON.stringify(definition.description)}\n---\n\n# ${title(skillId)}\n\nDescribe the focused workflow this skill provides.\n`,
+            "README.md": `# ${definition.id}\n\n${definition.description}\n\nValidate this plugin from the project root with \`aiw plugin validate --directory=${shellQuote(directory)}\`.\n`,
+        },
+    };
+}
+export function writePluginScaffold(fs, scaffold) {
+    const entries = Object.entries(scaffold.files).map(([path, content]) => {
+        if (!path || path === "." || hasUnsafePathSegment(path) || isAbsolute(path))
+            throw new Error(`Plugin scaffold path must be a safe relative file path: ${path}`);
+        if (typeof content !== "string")
+            throw new Error(`Plugin scaffold content must be text: ${path}`);
+        const destination = resolve(scaffold.root, path);
+        if (!isInside(scaffold.root, destination))
+            throw new Error(`Plugin scaffold path must stay inside its root: ${path}`);
+        return { content, destination, path };
+    });
+    const destinations = entries.map(({ destination }) => destination);
+    if (new Set(destinations).size !== destinations.length)
+        throw new Error("Plugin scaffold paths must resolve to unique destinations.");
+    const destinationSet = new Set(destinations);
+    if (destinations.some((destination) => ancestorsUntil(destination, scaffold.root).some((ancestor) => ancestor !== scaffold.root && destinationSet.has(ancestor))))
+        throw new Error("Plugin scaffold cannot use a planned file as a directory.");
+    assertNoSymlinkTraversal(fs, scaffold.projectRoot, scaffold.root);
+    const ancestors = new Set(destinations.flatMap((path) => ancestorsUntil(path, scaffold.root)));
+    const obstructed = [...ancestors].find((path) => {
+        const type = pathType(fs, path);
+        return type !== "missing" && type !== "directory";
+    });
+    if (obstructed)
+        throw new Error(`Plugin scaffold has an unsafe or obstructed ancestor: ${obstructed}`);
+    const conflict = destinations.find((path) => pathType(fs, path) !== "missing");
+    if (conflict)
+        throw new Error(`Plugin scaffold would overwrite an existing file: ${conflict}`);
+    fs.mkdir(scaffold.root);
+    entries.forEach(({ destination, content }) => fs.write(destination, content));
+}
+export function validatePluginDirectory(fs, projectRoot, directory) {
+    const pluginRoot = resolvePluginDirectory(projectRoot, directory);
+    assertNoSymlinkTraversal(fs, resolve(projectRoot), pluginRoot);
+    if (pathType(fs, pluginRoot) !== "directory")
+        throw new Error(`Plugin directory does not exist or is not a directory: ${pluginRoot}`);
+    const realProjectRoot = fs.realpath?.(resolve(projectRoot)) ?? resolve(projectRoot);
+    const realPluginRoot = fs.realpath?.(pluginRoot) ?? pluginRoot;
+    if (!isInside(realProjectRoot, realPluginRoot))
+        throw new Error("Plugin directory resolves outside the project.");
+    const manifestPath = resolve(pluginRoot, "package.yaml");
+    if (pathType(fs, manifestPath) !== "file")
+        throw new Error(`Plugin manifest does not exist: ${manifestPath}`);
+    const content = fs.read(manifestPath);
+    assertPluginManifestSyntax(content);
+    return validatePackageContract(content, (path) => {
+        if (isAbsolute(path))
+            return false;
+        const resource = resolve(pluginRoot, path);
+        if (!isInside(pluginRoot, resource) || pathType(fs, resource) !== "file")
+            return false;
+        const realResource = fs.realpath?.(resource) ?? resource;
+        return isInside(realPluginRoot, realResource);
+    });
+}
+export function resolvePluginDirectory(projectRoot, directory) {
+    if (!directory ||
+        isAbsolute(directory) ||
+        hasUnsafePathSegment(directory) ||
+        resolve(projectRoot, directory) === resolve(projectRoot))
+        throw new Error("Plugin directory must be a non-empty project-relative path.");
+    const root = resolve(projectRoot);
+    const destination = resolve(root, directory);
+    if (!isInside(root, destination))
+        throw new Error("Plugin directory must stay inside the project.");
+    return destination;
+}
+function assertPluginDefinition(definition) {
+    if (!/^[a-z0-9][a-z0-9-]*\/[a-z0-9][a-z0-9-]*$/.test(definition.id))
+        throw new Error("Plugin id must use the owner/name format with lowercase letters and hyphens.");
+    if (!/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/.test(definition.version))
+        throw new Error("Plugin version must be an exact semantic version.");
+    if (!definition.description.trim() || /[\r\n\u0085\u2028\u2029]/.test(definition.description))
+        throw new Error("Plugin description must be a non-empty single line.");
+}
+function assertPluginManifestSyntax(content) {
+    if ([...content].some((character) => character !== "\n" && isUnsafeCharacter(character)))
+        throw new Error("Plugin manifest contains unsupported control characters.");
+    const lines = content.split("\n");
+    if (lines.at(-1) === "")
+        lines.pop();
+    if (!lines.length || lines.some((line) => !isValidManifestLine(line)))
+        throw new Error("Plugin manifest syntax is invalid.");
+    const topLevel = [...content.matchAll(/^([a-z_]+):/gm)].map((match) => match[1]);
+    const allowed = new Set([
+        "schema",
+        "id",
+        "version",
+        "provider",
+        "source",
+        "dependencies",
+        "permissions",
+        "provenance",
+        "resources",
+        "policies",
+        "engines",
+        "provides",
+        "targets",
+    ]);
+    if (topLevel.some((key) => !allowed.has(key)) || new Set(topLevel).size !== topLevel.length)
+        throw new Error("Plugin manifest has unknown or duplicate top-level fields.");
+    const id = content.match(/^id:\s*(.*)$/m)?.[1]?.trim() ?? "";
+    if (!/^[a-z0-9][a-z0-9-]*\/[a-z0-9][a-z0-9-]*$/.test(id))
+        throw new Error("Plugin manifest id must use the lowercase owner/name format.");
+    const version = content.match(/^version:\s*(.*)$/m)?.[1]?.trim() ?? "";
+    if (!/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/.test(version))
+        throw new Error("Plugin manifest version must be an exact semantic version.");
+    for (const key of ["dependencies", "permissions", "targets"]) {
+        const line = content.match(new RegExp(`^${key}:\\s*(.*)$`, "m"))?.[1];
+        if (line !== undefined) {
+            const list = line.trim();
+            const body = list.slice(1, -1);
+            if (!list.startsWith("[") ||
+                !list.endsWith("]") ||
+                body.includes("[") ||
+                body.includes("]") ||
+                (body && body.split(",").some((entry) => !isPlainManifestValue(entry.trim()))))
+                throw new Error(`Plugin manifest field '${key}' must be an inline list.`);
+        }
+    }
+    for (const type of ["skills", "rules", "agents", "hooks", "templates"]) {
+        if ((content.match(new RegExp(`^  ${type}:`, "gm")) ?? []).length !== 1)
+            throw new Error(`Plugin manifest resource section '${type}' must occur exactly once.`);
+    }
+    const resourceEntries = [
+        ...content.matchAll(/^\s{4}- \{ id: ([^,]+), version: ([^,]+), path: ([^ }]+) \}$/gm),
+    ];
+    const identities = new Set();
+    for (const entry of resourceEntries) {
+        const [, resourceId, resourceVersion, resourcePath] = entry;
+        if (!/^[a-z0-9][a-z0-9-]*$/.test(resourceId))
+            throw new Error("Plugin resource id must use lowercase letters and hyphens.");
+        if (!/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/.test(resourceVersion))
+            throw new Error("Plugin resource version must be an exact semantic version.");
+        if (!isPlainManifestValue(resourcePath))
+            throw new Error("Plugin resource path is invalid.");
+        const identity = `${resourceId}@${resourceVersion}`;
+        if (identities.has(identity))
+            throw new Error(`Duplicate plugin resource: ${identity}`);
+        identities.add(identity);
+    }
+}
+function isValidManifestLine(line) {
+    if (!line.trim() || /^#[^\r\n]*$/.test(line))
+        return true;
+    if (/^[a-z_]+:$/.test(line))
+        return true;
+    if (/^(schema|id|version|provider|source): [^\s].*$/.test(line))
+        return isPlainManifestValue(line.slice(line.indexOf(":") + 1).trim());
+    if (/^(dependencies|permissions|targets): \[.*\]$/.test(line))
+        return true;
+    if (/^\s{2}(source|checksum|ai_workflow): [^\s].*$/.test(line))
+        return isPlainManifestValue(line.slice(line.indexOf(":") + 1).trim());
+    if (/^\s{2}(skills|rules|agents|hooks|templates):(?: \[\])?$/.test(line))
+        return true;
+    if (/^\s{4}- \{ id: [^,]+, version: [^,]+, path: [^ }]+ \}$/.test(line))
+        return true;
+    if (/^\s{2}- \{ id: [^,]+, value: [^ }]+ \}$/.test(line))
+        return true;
+    return /^\s{4}(skills|rules|agents|hooks|templates): \[.*\]$/.test(line);
+}
+function isPlainManifestValue(value) {
+    if (!value || value.includes("[") || value.includes("]") || /[{}#,]/.test(value))
+        return false;
+    if (value.startsWith('"') || value.endsWith('"') || value.startsWith("'") || value.endsWith("'"))
+        return false;
+    return true;
+}
+function pluginManifest(definition, skillId, skillPath) {
+    return `schema: 1\nid: ${definition.id}\nversion: ${definition.version}\nprovider: local\nsource: .\ndependencies: []\npermissions: []\nprovenance:\n  source: .\nresources:\n  skills:\n    - { id: ${skillId}, version: ${definition.version}, path: ${skillPath} }\n  rules: []\n  agents: []\n  hooks: []\n  templates: []\n`;
+}
+function assertNoSymlinkTraversal(fs, projectRoot, destination) {
+    let current = destination;
+    while (isInside(projectRoot, current)) {
+        if (pathType(fs, current) === "symlink")
+            throw new Error(`Plugin path cannot traverse a symbolic link: ${current}`);
+        if (current === projectRoot)
+            return;
+        current = dirname(current);
+    }
+    throw new Error("Plugin path must stay inside the project.");
+}
+function ancestorsUntil(path, root) {
+    const ancestors = [];
+    let current = dirname(path);
+    while (isInside(root, current)) {
+        ancestors.push(current);
+        if (current === root)
+            break;
+        current = dirname(current);
+    }
+    return ancestors;
+}
+function pathType(fs, path) {
+    return fs.pathType ? fs.pathType(path) : fs.exists(path) ? "file" : "missing";
+}
+function isInside(root, destination) {
+    const path = relative(root, destination);
+    return path === "" || (path !== ".." && !path.startsWith(`..${sep}`) && !isAbsolute(path));
+}
+function deepFreeze(value, visited = new WeakSet()) {
+    if (!value || typeof value !== "object" || visited.has(value))
+        return value;
+    visited.add(value);
+    Object.values(value).forEach((entry) => deepFreeze(entry, visited));
+    return Object.freeze(value);
+}
+function title(value) {
+    return value
+        .split("-")
+        .map((part) => `${part.charAt(0).toUpperCase()}${part.slice(1)}`)
+        .join(" ");
+}
+function hasUnsafePathSegment(value) {
+    return [...value].some(isUnsafeCharacter) || value.split(/[\\/]/).includes("..");
+}
+function isUnsafeCharacter(value) {
+    const code = value.codePointAt(0) ?? 0;
+    return code <= 31 || code === 127 || code === 133 || code === 8232 || code === 8233;
+}
+function shellQuote(value) {
+    return `'${value.replaceAll("'", `'"'"'`)}'`;
+}

package/dist/policy-gate.d.ts

@@ -0,0 +1,6 @@
+import { type OrganizationPolicy, type PackagePolicySubject } from "./organization-policy.js";
+export interface PolicyTracking {
+    isTracked(root: string, path: string): boolean;
+}
+export declare const gitPolicyTracking: PolicyTracking;
+export declare function enforcePolicyGate(policy: OrganizationPolicy, subjects: readonly PackagePolicySubject[]): void;

package/dist/policy-gate.js

@@ -0,0 +1,20 @@
+import { enforceOrganizationPolicy, } from "./organization-policy.js";
+import { execFileSync } from "node:child_process";
+import { relative } from "node:path";
+export const gitPolicyTracking = {
+    isTracked(root, path) {
+        try {
+            execFileSync("git", ["ls-files", "--error-unmatch", "--", relative(root, path)], {
+                cwd: root,
+                stdio: "ignore",
+            });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    },
+};
+export function enforcePolicyGate(policy, subjects) {
+    subjects.forEach((subject) => enforceOrganizationPolicy(policy, subject));
+}

package/dist/profile.d.ts

@@ -0,0 +1,23 @@
+import { type EvidenceFact } from "./evidence.js";
+export type Tool = {
+    name: string;
+    command?: string;
+};
+export type ProjectProfile = {
+    runtime: {
+        languages: string[];
+    };
+    frameworks: string[];
+    packageManager: string;
+    quality: {
+        linter?: Tool;
+        formatter?: Tool;
+        typecheck?: Tool;
+    };
+    testing?: Tool;
+    ci: string[];
+    workspaces: string[];
+    facts: EvidenceFact[];
+};
+export declare function parseProjectProfile(content: string): ProjectProfile;
+export declare function profileProject(root: string): Promise<ProjectProfile>;

package/dist/profile.js

@@ -0,0 +1,123 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { scanProject } from "./scanner.js";
+import { buildFacts } from "./evidence.js";
+function scalar(content, key) {
+    const value = content.match(new RegExp(`^\\s*${key}:\\s*(.+)$`, "m"))?.[1]?.trim();
+    return value && value !== "unknown" ? value : undefined;
+}
+function list(content, key) {
+    const value = content.match(new RegExp(`^${key}:\\s*\\[([^\\]]*)\\]$`, "m"))?.[1] ?? "";
+    return value
+        .split(",")
+        .map((item) => item.trim())
+        .filter(Boolean);
+}
+export function parseProjectProfile(content) {
+    if (!/^status:\s*scanned$/m.test(content))
+        throw new Error("Project profile has not been scanned.");
+    const languages = list(content, "  languages");
+    const frameworks = list(content, "frameworks");
+    let packageManager = scalar(content, "package_manager") ?? "unknown";
+    const confirmed = [
+        ...content.matchAll(/\s{2}- key: ([^\n]+)\n\s{4}value: ([^\n]+)\n\s{4}state: confirmed/g),
+    ];
+    for (const match of confirmed) {
+        const key = match[1].trim();
+        const value = match[2].trim();
+        if (key === "package-manager")
+            packageManager = value;
+        if (key === "runtime.language" && !languages.includes(value))
+            languages.push(value);
+        if (key === "framework" && !frameworks.includes(value))
+            frameworks.push(value);
+    }
+    const tool = (name, command) => {
+        const toolName = scalar(content, name);
+        return toolName ? { name: toolName, command: scalar(content, command) } : undefined;
+    };
+    return {
+        runtime: { languages },
+        frameworks,
+        packageManager,
+        quality: {
+            linter: tool("linter", "linter_command"),
+            formatter: tool("formatter", "formatter_command"),
+            typecheck: tool("typecheck", "typecheck_command"),
+        },
+        testing: tool("testing", "testing_command"),
+        ci: list(content, "ci"),
+        workspaces: list(content, "workspaces"),
+        facts: [],
+    };
+}
+async function packageManifest(root) {
+    try {
+        return JSON.parse(await readFile(join(root, "package.json"), "utf8"));
+    }
+    catch {
+        return {};
+    }
+}
+function hasDependency(manifest, name) {
+    return Boolean(manifest.dependencies?.[name] || manifest.devDependencies?.[name]);
+}
+function commandFor(manifest, key) {
+    return manifest.scripts?.[key];
+}
+export async function profileProject(root) {
+    const scan = await scanProject(root);
+    const manifest = await packageManifest(root);
+    const files = scan.files;
+    const languages = [
+        ...new Set(scan.evidence
+            .filter((item) => item.fact.startsWith("language."))
+            .map((item) => item.fact.replace("language.", ""))),
+    ];
+    const frameworks = [
+        hasDependency(manifest, "next") ? "nextjs" : "",
+        hasDependency(manifest, "react") ? "react" : "",
+        hasDependency(manifest, "vue") ? "vue" : "",
+        hasDependency(manifest, "express") ? "express" : "",
+    ].filter(Boolean);
+    const packageManager = files.includes("pnpm-lock.yaml")
+        ? "pnpm"
+        : files.includes("yarn.lock")
+            ? "yarn"
+            : files.includes("package.json")
+                ? "npm"
+                : "unknown";
+    const linter = hasDependency(manifest, "eslint") ||
+        files.some((file) => file.startsWith("eslint.config") || file === ".eslintrc.json")
+        ? { name: "eslint", command: commandFor(manifest, "lint") }
+        : undefined;
+    const formatter = hasDependency(manifest, "prettier") || files.some((file) => file.startsWith("prettier"))
+        ? { name: "prettier", command: commandFor(manifest, "format") }
+        : undefined;
+    const testingName = hasDependency(manifest, "vitest")
+        ? "vitest"
+        : hasDependency(manifest, "jest")
+            ? "jest"
+            : undefined;
+    const workspaces = Array.isArray(manifest.workspaces)
+        ? manifest.workspaces
+        : (manifest.workspaces?.packages ?? []);
+    const profile = {
+        runtime: { languages },
+        frameworks,
+        packageManager,
+        quality: {
+            linter,
+            formatter,
+            typecheck: commandFor(manifest, "typecheck")
+                ? { name: "typescript", command: commandFor(manifest, "typecheck") }
+                : undefined,
+        },
+        testing: testingName ? { name: testingName, command: commandFor(manifest, "test") } : undefined,
+        ci: files.some((file) => file.startsWith(".github/workflows/")) ? ["github-actions"] : [],
+        workspaces,
+        facts: [],
+    };
+    profile.facts = buildFacts(profile, scan.evidence);
+    return profile;
+}

package/dist/providers.d.ts

@@ -0,0 +1,20 @@
+export type PackageSource = {
+    provider: "local" | "git";
+    source: string;
+};
+export type LoadedPackageSource = PackageSource & {
+    root: string;
+    manifest: string;
+    release(): void;
+};
+export interface PackageProvider {
+    canResolve(source: string): boolean;
+    normalize(source: string, root: string): PackageSource;
+}
+export interface PackageSourceLoader {
+    load(source: string, root: string): LoadedPackageSource;
+}
+export declare const localProvider: PackageProvider;
+export declare const gitProvider: PackageProvider;
+export declare function resolveProvider(source: string, root: string): PackageSource;
+export declare const nodePackageSourceLoader: PackageSourceLoader;

package/dist/providers.js

@@ -0,0 +1,67 @@
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdtempSync, readFileSync, rmSync, statSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { isAbsolute, join, resolve } from "node:path";
+export const localProvider = {
+    canResolve: (source) => !source.includes(":") && !source.startsWith("git+") && !/^https?:\/\//.test(source),
+    normalize: (source, root) => ({
+        provider: "local",
+        source: isAbsolute(source) ? source : resolve(root, source),
+    }),
+};
+export const gitProvider = {
+    canResolve: (source) => source.startsWith("git+") ||
+        source.startsWith("git@") ||
+        source.startsWith("file://") ||
+        /^https?:\/\//.test(source) ||
+        source.endsWith(".git"),
+    normalize: (source) => ({ provider: "git", source }),
+};
+export function resolveProvider(source, root) {
+    const provider = [gitProvider, localProvider].find((candidate) => candidate.canResolve(source));
+    if (!provider)
+        throw new Error(`Unsupported package source: ${source}`);
+    return provider.normalize(source, root);
+}
+export const nodePackageSourceLoader = {
+    load(source, projectRoot) {
+        const normalized = resolveProvider(source, projectRoot);
+        if (normalized.provider === "local") {
+            if (!existsSync(normalized.source))
+                throw new Error(`Local package source does not exist: ${normalized.source}`);
+            const isDirectory = statSync(normalized.source).isDirectory();
+            const packageRoot = isDirectory ? normalized.source : resolve(normalized.source, "..");
+            const manifestPath = isDirectory ? join(packageRoot, "package.yaml") : normalized.source;
+            if (!existsSync(manifestPath))
+                throw new Error(`Package manifest does not exist: ${manifestPath}`);
+            return {
+                ...normalized,
+                root: packageRoot,
+                manifest: readFileSync(manifestPath, "utf8"),
+                release() { },
+            };
+        }
+        const checkout = mkdtempSync(join(tmpdir(), "aiw-package-"));
+        try {
+            const cloneSource = normalized.source.startsWith("git+")
+                ? normalized.source.slice(4)
+                : normalized.source;
+            execFileSync("git", ["clone", "--depth", "1", "--", cloneSource, checkout], {
+                stdio: "ignore",
+            });
+            const manifestPath = join(checkout, "package.yaml");
+            if (!existsSync(manifestPath))
+                throw new Error("Git package does not contain package.yaml.");
+            return {
+                ...normalized,
+                root: checkout,
+                manifest: readFileSync(manifestPath, "utf8"),
+                release: () => rmSync(checkout, { recursive: true, force: true }),
+            };
+        }
+        catch (error) {
+            rmSync(checkout, { recursive: true, force: true });
+            throw new Error(`Unable to load Git package source: ${normalized.source}`, { cause: error });
+        }
+    },
+};

package/dist/quality-gates.d.ts

@@ -0,0 +1,2 @@
+export type QualityGateStage = "specification" | "plan" | "verification";
+export declare function evaluateQualityGate(stage: QualityGateStage, content: string): string[];

package/dist/quality-gates.js

@@ -0,0 +1,40 @@
+function section(content, heading) {
+    const match = content.match(new RegExp(`^## ${heading}\\s*$([\\s\\S]*?)(?=^## |(?![\\s\\S]))`, "im"));
+    return match?.[1].trim();
+}
+function requireSections(content, artifact, headings) {
+    return headings.flatMap((heading) => {
+        const value = section(content, heading);
+        if (value === undefined)
+            return [`${artifact} section ${heading} is missing.`];
+        return value ? [] : [`${artifact} section ${heading} must contain content.`];
+    });
+}
+export function evaluateQualityGate(stage, content) {
+    if (stage === "specification")
+        return requireSections(content, "Brainstorm", [
+            "Goal",
+            "Users",
+            "Constraints",
+            "Risks",
+            "Non-goals",
+        ]);
+    if (stage === "plan") {
+        const issues = [];
+        if (!/REQ-\d+/.test(content))
+            issues.push("Specification must define a stable REQ-### ID.");
+        if (!/Acceptance criteria/i.test(content))
+            issues.push("Specification requirements must define acceptance criteria.");
+        if (!["Given", "When", "Then"].every((word) => new RegExp(`\\b${word}[ \\t]+\\S+`, "i").test(content)))
+            issues.push("Requirement acceptance criteria must use Given, When, and Then.");
+        return issues;
+    }
+    const fields = ["Requirement", "Code", "Tests", "Validation", "Evidence"];
+    const issues = !/TASK-\d+/.test(content)
+        ? ["Implementation plan must define a TASK-### ID."]
+        : [];
+    for (const field of fields)
+        if (!new RegExp(`^[ \\t]*-?[ \\t]*${field}:[ \\t]*\\S+`, "im").test(content))
+            issues.push(`Implementation plan task must define ${field}.`);
+    return issues;
+}

package/dist/recommendations.d.ts

@@ -0,0 +1,12 @@
+import type { ProjectProfile } from "./profile.js";
+export type CapabilityRecommendation = {
+    id: string;
+    provider: string;
+    confidence: number;
+    rationale: string;
+    evidence: string[];
+    permissions: string[];
+    conflicts: string[];
+};
+export declare function recommendCapabilities(profile: ProjectProfile): CapabilityRecommendation[];
+export declare function serializeRecommendations(items: CapabilityRecommendation[], selected?: string[]): string;