@neurcode-ai/cli 0.10.1 → 0.12.0

package/dist/utils/import-edge-extractor.js

@@ -0,0 +1,223 @@
+"use strict";
+/**
+ * Deterministic import-edge extractor.
+ *
+ * Pure regex over source lines — no AST, no inference, no probability.
+ * Same input always produces the same output, in the same canonical order.
+ *
+ * Supported languages:
+ *   - Python: `import x.y.z`, `from x.y import z`, relative `from .foo import bar`
+ *   - TypeScript / JavaScript:
+ *       `import ... from "..."`
+ *       `import "..."` (side-effect)
+ *       `import("...")` (dynamic)
+ *       `require("...")` (CommonJS)
+ *
+ * The extractor is diff-aware: it consumes already-added source lines so we
+ * only flag imports introduced by the current diff. Pre-existing imports
+ * stay outside the governance frame.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractImportEdgesFromDiff = extractImportEdgesFromDiff;
+exports.canonicalizeEdges = canonicalizeEdges;
+const PY_EXTENSIONS = new Set(['py', 'pyi']);
+const TS_EXTENSIONS = new Set(['ts', 'tsx', 'mts', 'cts']);
+const JS_EXTENSIONS = new Set(['js', 'jsx', 'mjs', 'cjs']);
+function languageFor(path) {
+    const ext = (path.split('.').pop() ?? '').toLowerCase();
+    if (PY_EXTENSIONS.has(ext))
+        return 'python';
+    if (TS_EXTENSIONS.has(ext))
+        return 'typescript';
+    if (JS_EXTENSIONS.has(ext))
+        return 'javascript';
+    return null;
+}
+// ────────────────────────────────────────────────────────────────────────────
+// Python regex set
+// ────────────────────────────────────────────────────────────────────────────
+//   `import x.y.z` / `import x.y.z as foo`
+//   `from x.y import z` / `from .foo import bar` / `from ..baz.q import r`
+//   Multi-import on one line: `import a, b, c` (we capture each comma-separated entry)
+const PY_IMPORT = /^\s*import\s+([\w\.,\s]+?)(?:\s+as\s+\w+)?\s*(?:#.*)?$/;
+const PY_FROM = /^\s*from\s+(\.+)?([\w\.]*)\s+import\s+/;
+// ────────────────────────────────────────────────────────────────────────────
+// TS/JS regex set
+// ────────────────────────────────────────────────────────────────────────────
+const TS_STATIC = /\bimport\s+(?:[^'"\n;]+?\s+from\s+)?['"]([^'"]+)['"]/g;
+const TS_SIDE_EFFECT = /\bimport\s+['"]([^'"]+)['"]/g;
+const TS_DYNAMIC = /\bimport\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
+const TS_REQUIRE = /\brequire\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
+function collectAddedLines(file) {
+    const out = [];
+    for (const hunk of file.hunks ?? []) {
+        let cursor = hunk.newStart ?? 0;
+        for (const line of (hunk.lines ?? [])) {
+            if (line.type === 'added') {
+                out.push({ text: line.content ?? '', lineNumber: line.lineNumber ?? cursor });
+                cursor += 1;
+            }
+            else if (line.type === 'context') {
+                cursor += 1;
+            }
+            // 'removed' lines do not advance the new-file cursor
+        }
+    }
+    return out;
+}
+// ────────────────────────────────────────────────────────────────────────────
+// Python extraction
+// ────────────────────────────────────────────────────────────────────────────
+function extractPython(file) {
+    const edges = [];
+    for (const { text, lineNumber } of collectAddedLines(file)) {
+        if (!text.trim())
+            continue;
+        // `from x import y`
+        const fromMatch = PY_FROM.exec(text);
+        if (fromMatch) {
+            const dots = fromMatch[1] ?? '';
+            const dotted = fromMatch[2] ?? '';
+            const importTarget = dots ? `${dots}${dotted}` : dotted;
+            if (importTarget) {
+                edges.push({
+                    sourceFile: file.path,
+                    sourceLine: lineNumber,
+                    importStatement: text.trim(),
+                    importTarget,
+                    importKind: dots ? 'relative' : 'static',
+                    language: 'python',
+                    relativeLevel: dots.length,
+                });
+            }
+            continue;
+        }
+        // `import x.y[, z[, w as foo]]`
+        const importMatch = PY_IMPORT.exec(text);
+        if (importMatch) {
+            const body = importMatch[1] ?? '';
+            // Split on commas, strip `as <alias>` per entry, ignore inline whitespace.
+            const targets = body
+                .split(',')
+                .map((t) => t.trim())
+                .filter(Boolean)
+                .map((t) => t.replace(/\s+as\s+\w+$/, '').trim())
+                .filter(Boolean);
+            for (const importTarget of targets) {
+                // `import .relative` is a SyntaxError in Python; only top-level dotted
+                // names appear here. Still guard against leading dots defensively.
+                if (importTarget.startsWith('.'))
+                    continue;
+                edges.push({
+                    sourceFile: file.path,
+                    sourceLine: lineNumber,
+                    importStatement: text.trim(),
+                    importTarget,
+                    importKind: 'static',
+                    language: 'python',
+                    relativeLevel: 0,
+                });
+            }
+        }
+    }
+    return edges;
+}
+// ────────────────────────────────────────────────────────────────────────────
+// TS/JS extraction
+// ────────────────────────────────────────────────────────────────────────────
+function extractTypeScript(file, language) {
+    const edges = [];
+    for (const { text, lineNumber } of collectAddedLines(file)) {
+        if (!text.trim())
+            continue;
+        const consumed = new Set();
+        const push = (target, kind) => {
+            const key = `${target}::${kind}`;
+            if (consumed.has(key))
+                return;
+            consumed.add(key);
+            edges.push({
+                sourceFile: file.path,
+                sourceLine: lineNumber,
+                importStatement: text.trim(),
+                importTarget: target,
+                importKind: kind,
+                language,
+                relativeLevel: 0,
+            });
+        };
+        // Static / side-effect imports
+        TS_STATIC.lastIndex = 0;
+        for (let m; (m = TS_STATIC.exec(text));) {
+            push(m[1], 'static');
+        }
+        TS_SIDE_EFFECT.lastIndex = 0;
+        for (let m; (m = TS_SIDE_EFFECT.exec(text));) {
+            push(m[1], 'side-effect');
+        }
+        // Dynamic / require
+        TS_DYNAMIC.lastIndex = 0;
+        for (let m; (m = TS_DYNAMIC.exec(text));) {
+            push(m[1], 'dynamic');
+        }
+        TS_REQUIRE.lastIndex = 0;
+        for (let m; (m = TS_REQUIRE.exec(text));) {
+            push(m[1], 'require');
+        }
+    }
+    return edges;
+}
+// ────────────────────────────────────────────────────────────────────────────
+// Public entry point
+// ────────────────────────────────────────────────────────────────────────────
+/**
+ * Extract import edges from the added lines of a diff. Deterministic and
+ * order-stable: identical diffs yield identical edge arrays.
+ */
+function extractImportEdgesFromDiff(diffFiles) {
+    const edges = [];
+    for (const file of diffFiles) {
+        if (file.changeType === 'delete')
+            continue;
+        const language = languageFor(file.path);
+        if (!language)
+            continue;
+        if (language === 'python') {
+            edges.push(...extractPython(file));
+        }
+        else {
+            edges.push(...extractTypeScript(file, language));
+        }
+    }
+    return canonicalizeEdges(edges);
+}
+/**
+ * Sort edges into a canonical, replay-stable order.
+ *
+ * Order: sourceFile → importTarget → sourceLine → importKind. Identical
+ * tuples are deduplicated.
+ */
+function canonicalizeEdges(edges) {
+    const seen = new Set();
+    const out = [];
+    for (const e of edges) {
+        const key = `${e.sourceFile}|${e.importTarget}|${e.sourceLine}|${e.importKind}|${e.language}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        out.push(e);
+    }
+    out.sort((a, b) => {
+        if (a.sourceFile !== b.sourceFile)
+            return a.sourceFile < b.sourceFile ? -1 : 1;
+        if (a.importTarget !== b.importTarget)
+            return a.importTarget < b.importTarget ? -1 : 1;
+        if (a.sourceLine !== b.sourceLine)
+            return a.sourceLine - b.sourceLine;
+        if (a.importKind !== b.importKind)
+            return a.importKind < b.importKind ? -1 : 1;
+        return 0;
+    });
+    return out;
+}
+//# sourceMappingURL=import-edge-extractor.js.map

package/dist/utils/import-edge-extractor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-edge-extractor.js","sourceRoot":"","sources":["../../src/utils/import-edge-extractor.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;AAmMH,gEAaC;AAQD,8CAiBC;AA/MD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AAC7C,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAC3D,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAE3D,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACxD,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC5C,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC;IAChD,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC;IAChD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAC/E,2CAA2C;AAC3C,2EAA2E;AAC3E,uFAAuF;AACvF,MAAM,SAAS,GAAG,wDAAwD,CAAC;AAC3E,MAAM,OAAO,GAAG,wCAAwC,CAAC;AAEzD,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAC/E,MAAM,SAAS,GAAG,uDAAuD,CAAC;AAC1E,MAAM,cAAc,GAAG,8BAA8B,CAAC;AACtD,MAAM,UAAU,GAAG,wCAAwC,CAAC;AAC5D,MAAM,UAAU,GAAG,yCAAyC,CAAC;AAW7D,SAAS,iBAAiB,CAAC,IAAc;IACvC,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QACpC,IAAI,MAAM,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAe,EAAE,CAAC;YACpD,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC1B,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,MAAM,EAAE,CAAC,CAAC;gBAC9E,MAAM,IAAI,CAAC,CAAC;YACd,CAAC;iBAAM,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBACnC,MAAM,IAAI,CAAC,CAAC;YACd,CAAC;YACD,qDAAqD;QACvD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E,SAAS,aAAa,CAAC,IAAc;IACnC,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,KAAK,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAS;QAE3B,oBAAoB;QACpB,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;YACxD,IAAI,YAAY,EAAE,CAAC;gBACjB,KAAK,CAAC,IAAI,CAAC;oBACT,UAAU,EAAE,IAAI,CAAC,IAAI;oBACrB,UAAU,EAAE,UAAU;oBACtB,eAAe,EAAE,IAAI,CAAC,IAAI,EAAE;oBAC5B,YAAY;oBACZ,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;oBACxC,QAAQ,EAAE,QAAQ;oBAClB,aAAa,EAAE,IAAI,CAAC,MAAM;iBAC3B,CAAC,CAAC;YACL,CAAC;YACD,SAAS;QACX,CAAC;QAED,gCAAgC;QAChC,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAClC,2EAA2E;YAC3E,MAAM,OAAO,GAAG,IAAI;iBACjB,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBACpB,MAAM,CAAC,OAAO,CAAC;iBACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;iBAChD,MAAM,CAAC,OAAO,CAAC,CAAC;YACnB,KAAK,MAAM,YAAY,IAAI,OAAO,EAAE,CAAC;gBACnC,uEAAuE;gBACvE,mEAAmE;gBACnE,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAC3C,KAAK,CAAC,IAAI,CAAC;oBACT,UAAU,EAAE,IAAI,CAAC,IAAI;oBACrB,UAAU,EAAE,UAAU;oBACtB,eAAe,EAAE,IAAI,CAAC,IAAI,EAAE;oBAC5B,YAAY;oBACZ,UAAU,EAAE,QAAQ;oBACpB,QAAQ,EAAE,QAAQ;oBAClB,aAAa,EAAE,CAAC;iBACjB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E,SAAS,iBAAiB,CAAC,IAAc,EAAE,QAAwB;IACjE,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,KAAK,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAS;QAE3B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,IAAoB,EAAE,EAAE;YACpD,MAAM,GAAG,GAAG,GAAG,MAAM,KAAK,IAAI,EAAE,CAAC;YACjC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO;YAC9B,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC;gBACT,UAAU,EAAE,IAAI,CAAC,IAAI;gBACrB,UAAU,EAAE,UAAU;gBACtB,eAAe,EAAE,IAAI,CAAC,IAAI,EAAE;gBAC5B,YAAY,EAAE,MAAM;gBACpB,UAAU,EAAE,IAAI;gBAChB,QAAQ;gBACR,aAAa,EAAE,CAAC;aACjB,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,+BAA+B;QAC/B,SAAS,CAAC,SAAS,GAAG,CAAC,CAAC;QACxB,KAAK,IAAI,CAAyB,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAI,CAAC;YACjE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACvB,CAAC;QACD,cAAc,CAAC,SAAS,GAAG,CAAC,CAAC;QAC7B,KAAK,IAAI,CAAyB,EAAE,CAAC,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAI,CAAC;YACtE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;QAC5B,CAAC;QACD,oBAAoB;QACpB,UAAU,CAAC,SAAS,GAAG,CAAC,CAAC;QACzB,KAAK,IAAI,CAAyB,EAAE,CAAC,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAI,CAAC;YAClE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACxB,CAAC;QACD,UAAU,CAAC,SAAS,GAAG,CAAC,CAAC;QACzB,KAAK,IAAI,CAAyB,EAAE,CAAC,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAI,CAAC;YAClE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E;;;GAGG;AACH,SAAgB,0BAA0B,CAAC,SAA8B;IACvE,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ;YAAE,SAAS;QAC3C,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IACD,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC;AAClC,CAAC;AAED;;;;;GAKG;AACH,SAAgB,iBAAiB,CAAC,KAA4B;IAC5D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9F,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAChB,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;YAAE,OAAO,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/E,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,YAAY;YAAE,OAAO,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;YAAE,OAAO,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;QACtE,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;YAAE,OAAO,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/E,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/utils/import-edge-governance.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Deterministic import-edge governance orchestrator.
+ *
+ * Glues the extractor + classifier into a single replay-stable surface that
+ * verify.ts can consume. Every output array is sorted canonically and
+ * deduplicated; identical inputs always produce identical output bytes.
+ */
+import type { DiffFile } from '@neurcode-ai/diff-parser';
+import { type ImportEdge } from './import-edge-extractor';
+import { type ImportEdgeFinding, type IntentContextSnapshot } from './import-edge-classifier';
+export type { ImportEdge } from './import-edge-extractor';
+export type { ImportEdgeFinding, IntentContextSnapshot, IntentApprovedScope, IntentForbiddenBoundary, ImportEdgePolicy, ImportEdgeBoundaryType, ImportEdgeSeverity, } from './import-edge-classifier';
+export interface ImportEdgeGovernanceInput {
+    diffFiles: readonly DiffFile[];
+    projectRoot: string;
+    intent: IntentContextSnapshot;
+}
+export interface ImportEdgeGovernanceResult {
+    /** All import edges extracted from the added diff lines (canonical order). */
+    edges: ImportEdge[];
+    /** Edges that resolved into a flagged boundary, canonicalised + deduped. */
+    findings: ImportEdgeFinding[];
+    /** Convenience counts so callers do not have to recompute. */
+    edgeCount: number;
+    blockingFindingCount: number;
+    advisoryFindingCount: number;
+    /** A sorted, unique list of observed boundary types — useful for capability envelopes. */
+    observedBoundaryTypes: string[];
+    /** A sorted, unique list of observed policies — useful for capability envelopes. */
+    observedPolicies: string[];
+}
+/**
+ * Evaluate import-edge governance for the given diff against the given
+ * intent context. Pure, deterministic, replay-stable.
+ */
+export declare function evaluateImportEdgeGovernance(input: ImportEdgeGovernanceInput): ImportEdgeGovernanceResult;
+//# sourceMappingURL=import-edge-governance.d.ts.map

package/dist/utils/import-edge-governance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-edge-governance.d.ts","sourceRoot":"","sources":["../../src/utils/import-edge-governance.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAEzD,OAAO,EAAiD,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACzG,OAAO,EAEL,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC3B,MAAM,0BAA0B,CAAC;AAElC,YAAY,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,YAAY,EACV,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,uBAAuB,EACvB,gBAAgB,EAChB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAElC,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,SAAS,QAAQ,EAAE,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,qBAAqB,CAAC;CAC/B;AAED,MAAM,WAAW,0BAA0B;IACzC,8EAA8E;IAC9E,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,4EAA4E;IAC5E,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAC;IAClB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,0FAA0F;IAC1F,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,oFAAoF;IACpF,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,yBAAyB,GAC/B,0BAA0B,CAqC5B"}

package/dist/utils/import-edge-governance.js

@@ -0,0 +1,56 @@
+"use strict";
+/**
+ * Deterministic import-edge governance orchestrator.
+ *
+ * Glues the extractor + classifier into a single replay-stable surface that
+ * verify.ts can consume. Every output array is sorted canonically and
+ * deduplicated; identical inputs always produce identical output bytes.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.evaluateImportEdgeGovernance = evaluateImportEdgeGovernance;
+const import_edge_extractor_1 = require("./import-edge-extractor");
+const import_edge_classifier_1 = require("./import-edge-classifier");
+/**
+ * Evaluate import-edge governance for the given diff against the given
+ * intent context. Pure, deterministic, replay-stable.
+ */
+function evaluateImportEdgeGovernance(input) {
+    const edges = (0, import_edge_extractor_1.canonicalizeEdges)((0, import_edge_extractor_1.extractImportEdgesFromDiff)(input.diffFiles));
+    const findings = [];
+    const dedupe = new Set();
+    for (const edge of edges) {
+        const finding = (0, import_edge_classifier_1.classifyImportEdge)(edge, input.projectRoot, input.intent);
+        if (!finding)
+            continue;
+        const key = `${finding.sourceFile}|${finding.importTarget}|${finding.resolvedBoundary}|${finding.policy}`;
+        if (dedupe.has(key))
+            continue;
+        dedupe.add(key);
+        findings.push(finding);
+    }
+    findings.sort((a, b) => {
+        if (a.sourceFile !== b.sourceFile)
+            return a.sourceFile < b.sourceFile ? -1 : 1;
+        if (a.resolvedBoundary !== b.resolvedBoundary)
+            return a.resolvedBoundary < b.resolvedBoundary ? -1 : 1;
+        if (a.importTarget !== b.importTarget)
+            return a.importTarget < b.importTarget ? -1 : 1;
+        if (a.sourceLine !== b.sourceLine)
+            return a.sourceLine - b.sourceLine;
+        return 0;
+    });
+    const blockingFindingCount = findings.filter((f) => f.governanceSeverity === 'blocking').length;
+    const advisoryFindingCount = findings.filter((f) => f.governanceSeverity === 'advisory').length;
+    const observedBoundaryTypes = Array.from(new Set(findings.map((f) => f.boundaryType))).sort();
+    const observedPolicies = Array.from(new Set(findings.map((f) => f.policy))).sort();
+    return {
+        edges,
+        findings,
+        edgeCount: edges.length,
+        blockingFindingCount,
+        advisoryFindingCount,
+        observedBoundaryTypes,
+        observedPolicies,
+    };
+}
+//# sourceMappingURL=import-edge-governance.js.map

package/dist/utils/import-edge-governance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-edge-governance.js","sourceRoot":"","sources":["../../src/utils/import-edge-governance.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AA+CH,oEAuCC;AAlFD,mEAAyG;AACzG,qEAIkC;AAkClC;;;GAGG;AACH,SAAgB,4BAA4B,CAC1C,KAAgC;IAEhC,MAAM,KAAK,GAAG,IAAA,yCAAiB,EAAC,IAAA,kDAA0B,EAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IAEjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAA,2CAAkB,EAAC,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC1E,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QAC1G,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChB,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACrB,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;YAAE,OAAO,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/E,IAAI,CAAC,CAAC,gBAAgB,KAAK,CAAC,CAAC,gBAAgB;YAAE,OAAO,CAAC,CAAC,gBAAgB,GAAG,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvG,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,YAAY;YAAE,OAAO,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;YAAE,OAAO,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;QACtE,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;IAEH,MAAM,oBAAoB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,kBAAkB,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;IAChG,MAAM,oBAAoB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,kBAAkB,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;IAEhG,MAAM,qBAAqB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9F,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAEnF,OAAO;QACL,KAAK;QACL,QAAQ;QACR,SAAS,EAAE,KAAK,CAAC,MAAM;QACvB,oBAAoB;QACpB,oBAAoB;QACpB,qBAAqB;QACrB,gBAAgB;KACjB,CAAC;AACJ,CAAC"}

package/dist/utils/path-boundary-classifier.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Deterministic, replay-safe path-boundary classification.
+ *
+ * Maps a repo-relative file path to one of a small, well-defined set of
+ * governance boundary categories (generated-code, infra, ci,
+ * dependency-manifest, sensitive). Uses ONLY pattern matching — no file I/O,
+ * no AI inference, no probabilistic scoring. Same path string → same
+ * classification across machines, runs, and CLI versions. Boundary patterns
+ * are intentionally conservative: when in doubt the classifier returns
+ * `null`, leaving the path uncategorised rather than asserting an incorrect
+ * boundary.
+ */
+export type PathBoundaryCategory = 'generated-code' | 'infra' | 'ci' | 'dependency-manifest' | 'sensitive';
+export interface PathBoundaryClassification {
+    category: PathBoundaryCategory;
+    /**
+     * Stable rationale ID. Used so dashboard/replay surfaces can group + render
+     * classifications without reading the human message.
+     */
+    reasonId: string;
+    /**
+     * Short human-readable description of why this path was classified this
+     * way. Stable: not parameterised by repo state.
+     */
+    reason: string;
+}
+/**
+ * Classify a single repo-relative path. Returns the FIRST matching boundary
+ * (rules are ordered by specificity / severity), or `null` when the path
+ * does not match any well-known boundary pattern.
+ *
+ * The classifier is intentionally first-match-wins so the ordering above
+ * encodes the priority: generated-code > CI > infra > sensitive > dep-manifest.
+ */
+export declare function classifyPathBoundary(path: string): PathBoundaryClassification | null;
+/**
+ * Bulk classify and bucket. Returns a deterministic { category → paths } map.
+ * Empty buckets are omitted from the result for compactness; consumers should
+ * defensively check `result.<category]?.length`.
+ */
+export declare function classifyAndBucket(paths: readonly string[]): Partial<Record<PathBoundaryCategory, string[]>>;
+//# sourceMappingURL=path-boundary-classifier.d.ts.map

package/dist/utils/path-boundary-classifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-boundary-classifier.d.ts","sourceRoot":"","sources":["../../src/utils/path-boundary-classifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,MAAM,oBAAoB,GAC5B,gBAAgB,GAChB,OAAO,GACP,IAAI,GACJ,qBAAqB,GACrB,WAAW,CAAC;AAEhB,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,oBAAoB,CAAC;IAC/B;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AA0GD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,0BAA0B,GAAG,IAAI,CASpF;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,MAAM,EAAE,CAAC,CAAC,CAe3G"}

package/dist/utils/path-boundary-classifier.js

@@ -0,0 +1,143 @@
+"use strict";
+/**
+ * Deterministic, replay-safe path-boundary classification.
+ *
+ * Maps a repo-relative file path to one of a small, well-defined set of
+ * governance boundary categories (generated-code, infra, ci,
+ * dependency-manifest, sensitive). Uses ONLY pattern matching — no file I/O,
+ * no AI inference, no probabilistic scoring. Same path string → same
+ * classification across machines, runs, and CLI versions. Boundary patterns
+ * are intentionally conservative: when in doubt the classifier returns
+ * `null`, leaving the path uncategorised rather than asserting an incorrect
+ * boundary.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.classifyPathBoundary = classifyPathBoundary;
+exports.classifyAndBucket = classifyAndBucket;
+function exact(needle) {
+    return (path) => path === needle;
+}
+function basename(needle) {
+    return (path) => path === needle || path.endsWith(`/${needle}`);
+}
+function basenameAny(needles) {
+    const set = new Set(needles);
+    return (path) => {
+        const slash = path.lastIndexOf('/');
+        const name = slash === -1 ? path : path.slice(slash + 1);
+        return set.has(name);
+    };
+}
+function suffix(needle) {
+    return (path) => path.endsWith(needle);
+}
+function suffixAny(needles) {
+    return (path) => needles.some((n) => path.endsWith(n));
+}
+function segment(needle) {
+    const fragment = `/${needle}/`;
+    return (path) => path === needle || path.startsWith(`${needle}/`) || path.includes(fragment);
+}
+function regex(pattern) {
+    return (path) => pattern.test(path);
+}
+const RULES = Object.freeze([
+    // ── Generated code ────────────────────────────────────────────────────────
+    // Detection prioritised over infra because many generated artefacts live
+    // inside infra-adjacent paths (e.g. helm template output), and the
+    // "this is generated, do not hand-edit" semantic is the stronger signal.
+    { category: 'generated-code', reasonId: 'gen.protobuf-py', reason: 'Generated protobuf (Python).', test: suffixAny(['_pb2.py', '_pb2_grpc.py']) },
+    { category: 'generated-code', reasonId: 'gen.protobuf-go', reason: 'Generated protobuf (Go).', test: suffixAny(['.pb.go', '_pb.go']) },
+    { category: 'generated-code', reasonId: 'gen.protobuf-ts', reason: 'Generated protobuf (TS/JS).', test: suffixAny(['.pb.ts', '.pb.js']) },
+    { category: 'generated-code', reasonId: 'gen.dts', reason: 'TypeScript declaration file (typically generated).', test: suffix('.d.ts') },
+    { category: 'generated-code', reasonId: 'gen.openapi-segment', reason: 'OpenAPI / Swagger generated client surface.', test: regex(/(^|\/)(openapi-generated|swagger-generated|generated-clients?)\//) },
+    { category: 'generated-code', reasonId: 'gen.generated-segment', reason: 'Conventional generated-code directory.', test: regex(/(^|\/)(__generated__|generated|gen)\//) },
+    { category: 'generated-code', reasonId: 'gen.suffix-generated', reason: 'File explicitly suffixed `.generated.*`.', test: regex(/\.generated\.[A-Za-z0-9]+$/) },
+    { category: 'generated-code', reasonId: 'gen.dist-build', reason: 'Build output directory; never hand-edit.', test: regex(/(^|\/)(dist|build|out|\.next|\.nuxt|\.svelte-kit|\.turbo|target)\//) },
+    { category: 'generated-code', reasonId: 'gen.vendor', reason: 'Vendored / installed dependency tree.', test: regex(/(^|\/)(vendor|node_modules|Pods)\//) },
+    { category: 'generated-code', reasonId: 'gen.snapshots', reason: 'Generated test snapshot.', test: regex(/(^|\/)__snapshots__\//) },
+    { category: 'generated-code', reasonId: 'gen.lockfile', reason: 'Lock file — regenerated by tooling, not hand-authored.', test: basenameAny(['package-lock.json', 'pnpm-lock.yaml', 'yarn.lock', 'Cargo.lock', 'Pipfile.lock', 'poetry.lock', 'composer.lock', 'go.sum']) },
+    // ── CI ────────────────────────────────────────────────────────────────────
+    { category: 'ci', reasonId: 'ci.github-workflows', reason: 'GitHub Actions workflow.', test: regex(/^\.github\/workflows\//) },
+    { category: 'ci', reasonId: 'ci.github-action-config', reason: 'GitHub action / repo automation config.', test: regex(/^\.github\/(actions|dependabot\.yml|CODEOWNERS)/) },
+    { category: 'ci', reasonId: 'ci.gitlab', reason: 'GitLab CI config.', test: exact('.gitlab-ci.yml') },
+    { category: 'ci', reasonId: 'ci.circleci', reason: 'CircleCI config.', test: regex(/^\.circleci\//) },
+    { category: 'ci', reasonId: 'ci.jenkins', reason: 'Jenkins pipeline.', test: basenameAny(['Jenkinsfile']) },
+    { category: 'ci', reasonId: 'ci.travis', reason: 'Travis CI config.', test: exact('.travis.yml') },
+    { category: 'ci', reasonId: 'ci.azure-pipelines', reason: 'Azure Pipelines config.', test: basenameAny(['azure-pipelines.yml']) },
+    { category: 'ci', reasonId: 'ci.drone', reason: 'Drone CI config.', test: exact('.drone.yml') },
+    { category: 'ci', reasonId: 'ci.buildkite', reason: 'Buildkite pipeline.', test: regex(/^\.buildkite\//) },
+    // ── Infra / deployment ────────────────────────────────────────────────────
+    { category: 'infra', reasonId: 'infra.dockerfile', reason: 'Docker build artefact.', test: basenameAny(['Dockerfile']) },
+    { category: 'infra', reasonId: 'infra.dockerfile-variant', reason: 'Docker build artefact (variant).', test: regex(/(^|\/)Dockerfile(\.[A-Za-z0-9._-]+)?$/) },
+    { category: 'infra', reasonId: 'infra.docker-compose', reason: 'docker-compose deployment file.', test: regex(/(^|\/)docker-compose(\.[A-Za-z0-9._-]+)?\.ya?ml$/) },
+    { category: 'infra', reasonId: 'infra.terraform', reason: 'Terraform infrastructure source.', test: regex(/(^|\/)(terraform|infra\/terraform)\//) },
+    { category: 'infra', reasonId: 'infra.terraform-suffix', reason: 'Terraform source (suffix).', test: suffix('.tf') },
+    { category: 'infra', reasonId: 'infra.helm', reason: 'Helm chart source.', test: regex(/(^|\/)(helm|helm-chart|charts)\//) },
+    { category: 'infra', reasonId: 'infra.kubernetes', reason: 'Kubernetes manifest directory.', test: regex(/(^|\/)(k8s|kubernetes|manifests)\//) },
+    { category: 'infra', reasonId: 'infra.ansible', reason: 'Ansible playbook directory.', test: regex(/(^|\/)(ansible|playbooks)\//) },
+    { category: 'infra', reasonId: 'infra.cloudformation', reason: 'CloudFormation template directory.', test: regex(/(^|\/)cloudformation\//) },
+    { category: 'infra', reasonId: 'infra.serverless', reason: 'Serverless framework config.', test: basenameAny(['serverless.yml', 'serverless.yaml', 'serverless.ts']) },
+    { category: 'infra', reasonId: 'infra.nginx', reason: 'Nginx / reverse-proxy config.', test: regex(/(^|\/)nginx(.*)?\.conf$/) },
+    { category: 'infra', reasonId: 'infra.migration', reason: 'Database migration file.', test: regex(/(^|\/)(migrations|db\/migrations|services\/.+\/migrations)\//) },
+    // ── Sensitive ─────────────────────────────────────────────────────────────
+    { category: 'sensitive', reasonId: 'sensitive.env', reason: 'Environment variable file.', test: regex(/(^|\/)\.env(\.[A-Za-z0-9._-]+)?$/) },
+    { category: 'sensitive', reasonId: 'sensitive.keys', reason: 'Key/credential material.', test: regex(/\.(pem|key|crt|p12|pfx|jks|keystore)$/) },
+    { category: 'sensitive', reasonId: 'sensitive.auth-path', reason: 'Auth / IAM / permissions surface.', test: regex(/(^|\/)(auth|iam|permissions|secrets?)\//) },
+    // ── Dependency manifest ───────────────────────────────────────────────────
+    { category: 'dependency-manifest', reasonId: 'dep.npm', reason: 'Node package manifest.', test: basename('package.json') },
+    { category: 'dependency-manifest', reasonId: 'dep.python-requirements', reason: 'Python requirements file.', test: regex(/(^|\/)requirements(\/[^/]+)?\.(txt|in)$|^requirements(\/[^/]+)?\.(txt|in)$/) },
+    { category: 'dependency-manifest', reasonId: 'dep.python-requirements-dir', reason: 'Python requirements directory.', test: regex(/(^|\/)requirements\//) },
+    { category: 'dependency-manifest', reasonId: 'dep.pyproject', reason: 'Python project / build manifest.', test: basename('pyproject.toml') },
+    { category: 'dependency-manifest', reasonId: 'dep.pipfile', reason: 'Pipenv manifest.', test: basename('Pipfile') },
+    { category: 'dependency-manifest', reasonId: 'dep.setup-py', reason: 'Legacy setuptools manifest.', test: basename('setup.py') },
+    { category: 'dependency-manifest', reasonId: 'dep.setup-cfg', reason: 'Legacy setuptools config.', test: basename('setup.cfg') },
+    { category: 'dependency-manifest', reasonId: 'dep.cargo', reason: 'Rust crate manifest.', test: basename('Cargo.toml') },
+    { category: 'dependency-manifest', reasonId: 'dep.go-mod', reason: 'Go module manifest.', test: basename('go.mod') },
+    { category: 'dependency-manifest', reasonId: 'dep.maven', reason: 'Maven project manifest.', test: basename('pom.xml') },
+    { category: 'dependency-manifest', reasonId: 'dep.gradle', reason: 'Gradle build script.', test: suffixAny(['/build.gradle', '/build.gradle.kts', '/settings.gradle', '/settings.gradle.kts']) },
+    { category: 'dependency-manifest', reasonId: 'dep.composer', reason: 'PHP composer manifest.', test: basename('composer.json') },
+    { category: 'dependency-manifest', reasonId: 'dep.gemfile', reason: 'Ruby Gemfile.', test: basename('Gemfile') },
+]);
+/**
+ * Classify a single repo-relative path. Returns the FIRST matching boundary
+ * (rules are ordered by specificity / severity), or `null` when the path
+ * does not match any well-known boundary pattern.
+ *
+ * The classifier is intentionally first-match-wins so the ordering above
+ * encodes the priority: generated-code > CI > infra > sensitive > dep-manifest.
+ */
+function classifyPathBoundary(path) {
+    if (!path)
+        return null;
+    const normalised = path.replace(/\\/g, '/').replace(/^\.\//, '');
+    for (const rule of RULES) {
+        if (rule.test(normalised)) {
+            return { category: rule.category, reasonId: rule.reasonId, reason: rule.reason };
+        }
+    }
+    return null;
+}
+/**
+ * Bulk classify and bucket. Returns a deterministic { category → paths } map.
+ * Empty buckets are omitted from the result for compactness; consumers should
+ * defensively check `result.<category]?.length`.
+ */
+function classifyAndBucket(paths) {
+    const buckets = {};
+    // Sort + dedupe inputs so the output is replay-stable regardless of caller
+    // ordering. This is load-bearing for the canonical replay checksum.
+    const seen = new Set();
+    const inputs = [...paths]
+        .filter((p) => typeof p === 'string' && p.length > 0)
+        .filter((p) => (seen.has(p) ? false : (seen.add(p), true)))
+        .sort();
+    for (const path of inputs) {
+        const classification = classifyPathBoundary(path);
+        if (!classification)
+            continue;
+        (buckets[classification.category] ??= []).push(path);
+    }
+    return buckets;
+}
+//# sourceMappingURL=path-boundary-classifier.js.map

package/dist/utils/path-boundary-classifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-boundary-classifier.js","sourceRoot":"","sources":["../../src/utils/path-boundary-classifier.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;AAuIH,oDASC;AAOD,8CAeC;AAxID,SAAS,KAAK,CAAC,MAAc;IAC3B,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC;AACnC,CAAC;AAED,SAAS,QAAQ,CAAC,MAAc;IAC9B,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,WAAW,CAAC,OAA0B;IAC7C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,CAAC,IAAI,EAAE,EAAE;QACd,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACzD,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,MAAc;IAC5B,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,SAAS,CAAC,OAA0B;IAC3C,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,OAAO,CAAC,MAAc;IAC7B,MAAM,QAAQ,GAAG,IAAI,MAAM,GAAG,CAAC;IAC/B,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC/F,CAAC;AAED,SAAS,KAAK,CAAC,OAAe;IAC5B,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,KAAK,GAAoC,MAAM,CAAC,MAAM,CAAC;IAC3D,6EAA6E;IAC7E,yEAAyE;IACzE,mEAAmE;IACnE,yEAAyE;IACzE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,8BAA8B,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,EAAE;IACjJ,EAAE,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,0BAA0B,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,EAAE;IACtI,EAAE,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,6BAA6B,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,EAAE;IACzI,EAAE,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,oDAAoD,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE;IACxI,EAAE,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,qBAAqB,EAAE,MAAM,EAAE,6CAA6C,EAAE,IAAI,EAAE,KAAK,CAAC,kEAAkE,CAAC,EAAE;IACvM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,uBAAuB,EAAE,MAAM,EAAE,wCAAwC,EAAE,IAAI,EAAE,KAAK,CAAC,uCAAuC,CAAC,EAAE;IACzK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,sBAAsB,EAAE,MAAM,EAAE,0CAA0C,EAAE,IAAI,EAAE,KAAK,CAAC,4BAA4B,CAAC,EAAE;IAC/J,EAAE,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,0CAA0C,EAAE,IAAI,EAAE,KAAK,CAAC,oEAAoE,CAAC,EAAE;IACjM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,uCAAuC,EAAE,IAAI,EAAE,KAAK,CAAC,oCAAoC,CAAC,EAAE;IAC1J,EAAE,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,0BAA0B,EAAE,IAAI,EAAE,KAAK,CAAC,uBAAuB,CAAC,EAAE;IACnI,EAAE,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,wDAAwD,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,mBAAmB,EAAE,gBAAgB,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC,EAAE;IAE3Q,6EAA6E;IAC7E,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,qBAAqB,EAAE,MAAM,EAAE,0BAA0B,EAAE,IAAI,EAAE,KAAK,CAAC,wBAAwB,CAAC,EAAE;IAC9H,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,yBAAyB,EAAE,MAAM,EAAE,yCAAyC,EAAE,IAAI,EAAE,KAAK,CAAC,iDAAiD,CAAC,EAAE;IAC1K,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,KAAK,CAAC,gBAAgB,CAAC,EAAE;IACrG,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,KAAK,CAAC,eAAe,CAAC,EAAE;IACrG,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE;IAC3G,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,KAAK,CAAC,aAAa,CAAC,EAAE;IAClG,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,EAAE,yBAAyB,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,qBAAqB,CAAC,CAAC,EAAE;IACjI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE;IAC/F,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,KAAK,CAAC,gBAAgB,CAAC,EAAE;IAE1G,6EAA6E;IAC7E,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,EAAE,wBAAwB,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE;IACxH,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,0BAA0B,EAAE,MAAM,EAAE,kCAAkC,EAAE,IAAI,EAAE,KAAK,CAAC,uCAAuC,CAAC,EAAE;IAC7J,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,sBAAsB,EAAE,MAAM,EAAE,iCAAiC,EAAE,IAAI,EAAE,KAAK,CAAC,kDAAkD,CAAC,EAAE;IACnK,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,kCAAkC,EAAE,IAAI,EAAE,KAAK,CAAC,sCAAsC,CAAC,EAAE;IACnJ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,wBAAwB,EAAE,MAAM,EAAE,4BAA4B,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE;IACpH,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE,KAAK,CAAC,kCAAkC,CAAC,EAAE;IAC5H,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,EAAE,gCAAgC,EAAE,IAAI,EAAE,KAAK,CAAC,oCAAoC,CAAC,EAAE;IAChJ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,6BAA6B,EAAE,IAAI,EAAE,KAAK,CAAC,6BAA6B,CAAC,EAAE;IACnI,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,sBAAsB,EAAE,MAAM,EAAE,oCAAoC,EAAE,IAAI,EAAE,KAAK,CAAC,wBAAwB,CAAC,EAAE;IAC5I,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,EAAE,8BAA8B,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,eAAe,CAAC,CAAC,EAAE;IACtK,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,+BAA+B,EAAE,IAAI,EAAE,KAAK,CAAC,yBAAyB,CAAC,EAAE;IAC/H,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,0BAA0B,EAAE,IAAI,EAAE,KAAK,CAAC,8DAA8D,CAAC,EAAE;IAEnK,6EAA6E;IAC7E,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,4BAA4B,EAAE,IAAI,EAAE,KAAK,CAAC,kCAAkC,CAAC,EAAE;IAC3I,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,0BAA0B,EAAE,IAAI,EAAE,KAAK,CAAC,uCAAuC,CAAC,EAAE;IAC/I,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,qBAAqB,EAAE,MAAM,EAAE,mCAAmC,EAAE,IAAI,EAAE,KAAK,CAAC,yCAAyC,CAAC,EAAE;IAE/J,6EAA6E;IAC7E,EAAE,QAAQ,EAAE,qBAAqB,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,wBAAwB,EAAE,IAAI,EAAE,QAAQ,CAAC,cAAc,CAAC,EAAE;IAC1H,EAAE,QAAQ,EAAE,qBAAqB,EAAE,QAAQ,EAAE,yBAAyB,EAAE,MAAM,EAAE,2BAA2B,EAAE,IAAI,EAAE,KAAK,CAAC,4EAA4E,CAAC,EAAE;IACxM,EAAE,QAAQ,EAAE,qBAAqB,EAAE,QAAQ,EAAE,6BAA6B,EAAE,MAAM,EAAE,gCAAgC,EAAE,IAAI,EAAE,KAAK,CAAC,sBAAsB,CAAC,EAAE;IAC3J,EAAE,QAAQ,EAAE,qBAAqB,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,kCAAkC,EAAE,IAAI,EAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE;IAC5I,EAAE,QAAQ,EAAE,qBAAqB,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE;IACnH,EAAE,QAAQ,EAAE,qBAAqB,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,6BAA6B,EAAE,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE;IAChI,EAAE,QAAQ,EAAE,qBAAqB,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,2BAA2B,EAAE,IAAI,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE;IAChI,EAAE,QAAQ,EAAE,qBAAqB,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE;IACxH,EAAE,QAAQ,EAAE,qBAAqB,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE;IACpH,EAAE,QAAQ,EAAE,qBAAqB,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,yBAAyB,EAAE,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE;IACxH,EAAE,QAAQ,EAAE,qBAAqB,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,eAAe,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,sBAAsB,CAAC,CAAC,EAAE;IAChM,EAAE,QAAQ,EAAE,qBAAqB,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,wBAAwB,EAAE,IAAI,EAAE,QAAQ,CAAC,eAAe,CAAC,EAAE;IAChI,EAAE,QAAQ,EAAE,qBAAqB,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE;CACjH,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,SAAgB,oBAAoB,CAAC,IAAY;IAC/C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACjE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QACnF,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAgB,iBAAiB,CAAC,KAAwB;IACxD,MAAM,OAAO,GAAoD,EAAE,CAAC;IACpE,2EAA2E;IAC3E,oEAAoE;IACpE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;SACjE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;SAC1D,IAAI,EAAE,CAAC;IACV,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,MAAM,cAAc,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,cAAc;YAAE,SAAS;QAC9B,CAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/utils/replay-html-report.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Self-contained HTML replay report generator.
+ *
+ * Renders deterministic replay state into a single audit-grade HTML file.
+ * No JavaScript, no external assets, no remote requests — every byte of the
+ * output is derived from canonical replay artifacts.
+ *
+ * The output is intended to be opened directly in a browser, attached to
+ * audit reports, or stored alongside `.neurcode/evidence/` artifacts.
+ */
+import type { replayGovernanceState } from './replay-runtime';
+type ReplayState = ReturnType<typeof replayGovernanceState>;
+export interface HtmlReportInput {
+    state: ReplayState;
+    /**
+     * Optional latest verify payload (the structural+governance envelope
+     * emitted by `verify --json`). When provided, scope issues, runtime
+     * capabilities, and the canonical replay checksum are surfaced.
+     */
+    verify?: Record<string, unknown> | null;
+    generatedAt?: string;
+}
+/**
+ * Render a self-contained HTML report. The returned string is ready to be
+ * written to disk and opened in any browser. No external assets fetched.
+ */
+export declare function renderReplayHtmlReport(input: HtmlReportInput): string;
+export {};
+//# sourceMappingURL=replay-html-report.d.ts.map

package/dist/utils/replay-html-report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay-html-report.d.ts","sourceRoot":"","sources":["../../src/utils/replay-html-report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAE9D,KAAK,WAAW,GAAG,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE5D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,WAAW,CAAC;IACnB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACxC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAoQD;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CAsCrE"}