@opensip-cli/core 0.1.0

package/dist/lib/ui-context.d.ts

@@ -0,0 +1,34 @@
+/**
+ * @fileoverview UiContext — per-invocation presentation settings.
+ *
+ * A small kernel-level bag for values the render paths need but that aren't
+ * owned by any single tool: the selected banner size and the CLI version.
+ * Populated once by the CLI bootstrap (pre-action hook) and read by every
+ * render seam — the static `App`, fit's live view, and graph's live view —
+ * via `currentScope()?.ui`.
+ *
+ * `bannerSize` is a plain `string` here, NOT the `BannerSize` union: that
+ * union lives in `@opensip-cli/cli-ui` (a higher layer the kernel must not
+ * import). The render sites narrow it with `normalizeBannerSize` at the
+ * point of use, so an unknown / stale config value degrades to `lg`.
+ */
+/** Per-invocation presentation settings, read by the render paths. */
+export interface UiContext {
+    /**
+     * Selected banner art: `lg` | `md` | `sm` | `mini` (product default
+     * `mini`, applied by the CLI bootstrap when no `cli.ui.banner` is set).
+     * Stored untyped; narrowed via cli-ui's `normalizeBannerSize` at render.
+     */
+    readonly bannerSize: string;
+    /** CLI version (e.g. `1.0.0`), shown by the `mini` banner. */
+    readonly version: string;
+    /**
+     * Newer published version available on npm (e.g. `1.0.1`), or `undefined`
+     * when up-to-date / the check is skipped or hasn't completed. Resolved by
+     * the CLI bootstrap from the cached `update-notifier` result. The `mini`
+     * banner surfaces it inline as `(<new-version> available)`; other sizes rely on
+     * the separate stderr nag.
+     */
+    readonly update?: string;
+}
+//# sourceMappingURL=ui-context.d.ts.map

package/dist/lib/ui-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ui-context.d.ts","sourceRoot":"","sources":["../../src/lib/ui-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,sEAAsE;AACtE,MAAM,WAAW,SAAS;IACxB;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B"}

package/dist/lib/ui-context.js

@@ -0,0 +1,16 @@
+/**
+ * @fileoverview UiContext — per-invocation presentation settings.
+ *
+ * A small kernel-level bag for values the render paths need but that aren't
+ * owned by any single tool: the selected banner size and the CLI version.
+ * Populated once by the CLI bootstrap (pre-action hook) and read by every
+ * render seam — the static `App`, fit's live view, and graph's live view —
+ * via `currentScope()?.ui`.
+ *
+ * `bannerSize` is a plain `string` here, NOT the `BannerSize` union: that
+ * union lives in `@opensip-cli/cli-ui` (a higher layer the kernel must not
+ * import). The render sites narrow it with `normalizeBannerSize` at the
+ * point of use, so an unknown / stale config value degrades to `lg`.
+ */
+export {};
+//# sourceMappingURL=ui-context.js.map

package/dist/lib/ui-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ui-context.js","sourceRoot":"","sources":["../../src/lib/ui-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG"}

package/dist/lib/verdict-policy.d.ts

@@ -0,0 +1,71 @@
+/**
+ * @fileoverview Verdict policy — the host-owned findings gate (ADR-0035).
+ *
+ * A run's pass/fail is one value, `envelope.verdict.passed`, computed from the
+ * run's error/warning counts against a tool-declared findings policy. The policy
+ * is two reserved config keys — `failOnErrors` / `failOnWarnings` — recognized in
+ * EVERY tool's config namespace, with a host fallback of `{1, 0}` (fail on any
+ * error, warnings informational) when a tool declares neither.
+ *
+ * Lives in `lib/` next to {@link ./severity-policy} (the error/warning split it
+ * pairs with), NOT under `tools/`: `resolveVerdictPolicy` reads
+ * `currentScope().toolConfig`, and `run-scope.ts` imports `tools/registry.js`, so
+ * a `tools/ → run-scope` edge would reintroduce a cycle (see `tools/types.ts`).
+ * `contracts` imports {@link VerdictPolicy} / {@link policyPasses} from here the
+ * same way it imports `SeverityPolicy`.
+ */
+/** The findings gate for a run: fail when counts cross either threshold. */
+export interface VerdictPolicy {
+    /** Fail when `errors >= failOnErrors`; `0` disables the error gate. */
+    readonly failOnErrors: number;
+    /** Fail when `warnings >= failOnWarnings`; `0` disables the warning gate. */
+    readonly failOnWarnings: number;
+}
+/**
+ * Host fallback applied when a tool declares neither reserved key: fail on any
+ * error, warnings informational. This is fit's historical default generalized to
+ * every tool (graph/sim inherit it, reproducing their `errors > 0 ⇒ fail`).
+ */
+export declare const HOST_VERDICT_POLICY_FALLBACK: VerdictPolicy;
+/**
+ * The findings predicate: `true` ⇔ the run passes its policy. Pure. Mirrors
+ * fit's pre-ADR-0035 threshold (`result-builders.ts`) exactly — a `> 0` threshold
+ * is active, `0` disables that rung. Execution faults are handled by the caller
+ * (the envelope's `runFaulted` / unit `error`), not here.
+ */
+export declare function policyPasses(counts: {
+    readonly errors: number;
+    readonly warnings: number;
+}, policy: VerdictPolicy): boolean;
+/**
+ * Resolve a tool's findings policy from its config namespace. Reads the already-
+ * resolved `currentScope().toolConfig?.[toolNamespace]` (ADR-0023 applied the
+ * flag>env>file>defaults precedence upstream); this only extracts the two
+ * reserved keys and applies {@link HOST_VERDICT_POLICY_FALLBACK} per-key, so a
+ * tool may declare one key and inherit the other.
+ */
+export declare function resolveVerdictPolicy(toolNamespace: string): VerdictPolicy;
+/**
+ * Host default for the third reserved gate key, `failOnDegraded` (ADR-0036): a
+ * `--gate-compare` that finds net-new findings (the diff is `degraded`) fails the
+ * run. `true` by default.
+ */
+export declare const DEFAULT_FAIL_ON_DEGRADED = true;
+/**
+ * Resolve the net-new ratchet's hard-fail switch, `failOnDegraded` (ADR-0036) —
+ * the THIRD reserved gate key beside `failOnErrors`/`failOnWarnings`, read off the
+ * same already-resolved `currentScope().toolConfig?.[toolNamespace]` (ADR-0023
+ * flag>env>file precedence). Boolean, default {@link DEFAULT_FAIL_ON_DEGRADED}.
+ *
+ * Deliberately NOT part of {@link VerdictPolicy} or {@link policyPasses}: the
+ * findings verdict stays a pure function of findings, while the gate-compare
+ * ratchet is the documented ADR-0035 Phase-5 RETAIN carve-out — an orthogonal,
+ * gate-dispatch-only mechanism. `false` ⇒ ratchet-as-report (compare runs, prints
+ * the diff, exits 0), mirroring ADR-0020's `failOnErrors:0 = ratchet-only`.
+ *
+ * The HOST derives the exit: dispatch passes `degraded && failOnDegraded` as the
+ * `deliverSignals` runFailed override (→ RUNTIME_ERROR). No tool calls
+ * `setExitCode` for the gate path (ADR-0035 invariant).
+ */
+export declare function resolveFailOnDegraded(toolNamespace: string): boolean;
+//# sourceMappingURL=verdict-policy.d.ts.map

package/dist/lib/verdict-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verdict-policy.d.ts","sourceRoot":"","sources":["../../src/lib/verdict-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,4EAA4E;AAC5E,MAAM,WAAW,aAAa;IAC5B,uEAAuE;IACvE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,6EAA6E;IAC7E,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,EAAE,aAG1C,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EAC9D,MAAM,EAAE,aAAa,GACpB,OAAO,CAIT;AAOD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,aAAa,EAAE,MAAM,GAAG,aAAa,CAMzE;AAED;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAE7C;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAGpE"}

package/dist/lib/verdict-policy.js

@@ -0,0 +1,82 @@
+/**
+ * @fileoverview Verdict policy — the host-owned findings gate (ADR-0035).
+ *
+ * A run's pass/fail is one value, `envelope.verdict.passed`, computed from the
+ * run's error/warning counts against a tool-declared findings policy. The policy
+ * is two reserved config keys — `failOnErrors` / `failOnWarnings` — recognized in
+ * EVERY tool's config namespace, with a host fallback of `{1, 0}` (fail on any
+ * error, warnings informational) when a tool declares neither.
+ *
+ * Lives in `lib/` next to {@link ./severity-policy} (the error/warning split it
+ * pairs with), NOT under `tools/`: `resolveVerdictPolicy` reads
+ * `currentScope().toolConfig`, and `run-scope.ts` imports `tools/registry.js`, so
+ * a `tools/ → run-scope` edge would reintroduce a cycle (see `tools/types.ts`).
+ * `contracts` imports {@link VerdictPolicy} / {@link policyPasses} from here the
+ * same way it imports `SeverityPolicy`.
+ */
+import { currentScope } from './run-scope.js';
+/**
+ * Host fallback applied when a tool declares neither reserved key: fail on any
+ * error, warnings informational. This is fit's historical default generalized to
+ * every tool (graph/sim inherit it, reproducing their `errors > 0 ⇒ fail`).
+ */
+export const HOST_VERDICT_POLICY_FALLBACK = {
+    failOnErrors: 1,
+    failOnWarnings: 0,
+};
+/**
+ * The findings predicate: `true` ⇔ the run passes its policy. Pure. Mirrors
+ * fit's pre-ADR-0035 threshold (`result-builders.ts`) exactly — a `> 0` threshold
+ * is active, `0` disables that rung. Execution faults are handled by the caller
+ * (the envelope's `runFaulted` / unit `error`), not here.
+ */
+export function policyPasses(counts, policy) {
+    const failsOnErrors = policy.failOnErrors > 0 && counts.errors >= policy.failOnErrors;
+    const failsOnWarnings = policy.failOnWarnings > 0 && counts.warnings >= policy.failOnWarnings;
+    return !failsOnErrors && !failsOnWarnings;
+}
+/** A resolved config value is a usable threshold only if it is a non-negative int. */
+function asThreshold(value) {
+    return typeof value === 'number' && Number.isInteger(value) && value >= 0 ? value : undefined;
+}
+/**
+ * Resolve a tool's findings policy from its config namespace. Reads the already-
+ * resolved `currentScope().toolConfig?.[toolNamespace]` (ADR-0023 applied the
+ * flag>env>file>defaults precedence upstream); this only extracts the two
+ * reserved keys and applies {@link HOST_VERDICT_POLICY_FALLBACK} per-key, so a
+ * tool may declare one key and inherit the other.
+ */
+export function resolveVerdictPolicy(toolNamespace) {
+    const ns = currentScope()?.toolConfig?.[toolNamespace];
+    return {
+        failOnErrors: asThreshold(ns?.failOnErrors) ?? HOST_VERDICT_POLICY_FALLBACK.failOnErrors,
+        failOnWarnings: asThreshold(ns?.failOnWarnings) ?? HOST_VERDICT_POLICY_FALLBACK.failOnWarnings,
+    };
+}
+/**
+ * Host default for the third reserved gate key, `failOnDegraded` (ADR-0036): a
+ * `--gate-compare` that finds net-new findings (the diff is `degraded`) fails the
+ * run. `true` by default.
+ */
+export const DEFAULT_FAIL_ON_DEGRADED = true;
+/**
+ * Resolve the net-new ratchet's hard-fail switch, `failOnDegraded` (ADR-0036) —
+ * the THIRD reserved gate key beside `failOnErrors`/`failOnWarnings`, read off the
+ * same already-resolved `currentScope().toolConfig?.[toolNamespace]` (ADR-0023
+ * flag>env>file precedence). Boolean, default {@link DEFAULT_FAIL_ON_DEGRADED}.
+ *
+ * Deliberately NOT part of {@link VerdictPolicy} or {@link policyPasses}: the
+ * findings verdict stays a pure function of findings, while the gate-compare
+ * ratchet is the documented ADR-0035 Phase-5 RETAIN carve-out — an orthogonal,
+ * gate-dispatch-only mechanism. `false` ⇒ ratchet-as-report (compare runs, prints
+ * the diff, exits 0), mirroring ADR-0020's `failOnErrors:0 = ratchet-only`.
+ *
+ * The HOST derives the exit: dispatch passes `degraded && failOnDegraded` as the
+ * `deliverSignals` runFailed override (→ RUNTIME_ERROR). No tool calls
+ * `setExitCode` for the gate path (ADR-0035 invariant).
+ */
+export function resolveFailOnDegraded(toolNamespace) {
+    const value = currentScope()?.toolConfig?.[toolNamespace]?.failOnDegraded;
+    return typeof value === 'boolean' ? value : DEFAULT_FAIL_ON_DEGRADED;
+}
+//# sourceMappingURL=verdict-policy.js.map

package/dist/lib/verdict-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verdict-policy.js","sourceRoot":"","sources":["../../src/lib/verdict-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAU9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAkB;IACzD,YAAY,EAAE,CAAC;IACf,cAAc,EAAE,CAAC;CAClB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,MAA8D,EAC9D,MAAqB;IAErB,MAAM,aAAa,GAAG,MAAM,CAAC,YAAY,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC;IACtF,MAAM,eAAe,GAAG,MAAM,CAAC,cAAc,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,cAAc,CAAC;IAC9F,OAAO,CAAC,aAAa,IAAI,CAAC,eAAe,CAAC;AAC5C,CAAC;AAED,sFAAsF;AACtF,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAChG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,aAAqB;IACxD,MAAM,EAAE,GAAG,YAAY,EAAE,EAAE,UAAU,EAAE,CAAC,aAAa,CAAC,CAAC;IACvD,OAAO;QACL,YAAY,EAAE,WAAW,CAAC,EAAE,EAAE,YAAY,CAAC,IAAI,4BAA4B,CAAC,YAAY;QACxF,cAAc,EAAE,WAAW,CAAC,EAAE,EAAE,cAAc,CAAC,IAAI,4BAA4B,CAAC,cAAc;KAC/F,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAE7C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,qBAAqB,CAAC,aAAqB;IACzD,MAAM,KAAK,GAAG,YAAY,EAAE,EAAE,UAAU,EAAE,CAAC,aAAa,CAAC,EAAE,cAAc,CAAC;IAC1E,OAAO,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,wBAAwB,CAAC;AACvE,CAAC"}

package/dist/lib/yaml.d.ts

@@ -0,0 +1,74 @@
+/**
+ * @fileoverview Permissive YAML reader used by plugin-discovery sites
+ * that need to extract a single field from `opensip-cli.config.yml`
+ * without dragging in a Zod schema or surfacing structured errors.
+ *
+ * The kernel's plugin discovery (and fitness's check-package discovery)
+ * only need to read `plugins.<domain>` / `plugins.checkPackages`
+ * out of the project config. They previously reached for js-yaml via a
+ * `createRequire(import.meta.url)` shim — duplicated, and unnecessary
+ * now that `js-yaml` is a direct dep of every package that calls this.
+ *
+ * Behavior:
+ *   - Missing file → `undefined`
+ *   - I/O error → `undefined`
+ *   - Malformed YAML → `undefined`
+ *   - Valid YAML → parsed value (typed `unknown`; callers narrow)
+ *
+ * Strict YAML loading (with structured errors and size caps) is the
+ * targets loader's job — it lives in fitness because the schema lives
+ * there. Don't add error-throwing modes here; that's a different tool's
+ * surface.
+ */
+/**
+ * Read a YAML file and return the parsed document. Returns `undefined`
+ * on any failure (missing, unreadable, or malformed). Callers that
+ * need structured error reporting should use a dedicated loader
+ * instead — this helper exists for the discovery seam where "no
+ * config" and "bad config" are both treated the same: don't load
+ * plugins.
+ *
+ * @remarks Advanced / discouraged for general use. This is the
+ * "permissive" reader for plugin discovery; tools that read their
+ * own config should keep a dedicated loader (see fitness's
+ * targets/loader.ts) so malformed YAML surfaces a structured error
+ * instead of silently no-op'ing.
+ *
+ * On parse failure we still emit a `core.yaml.parse_failed` debug
+ * log so a `--debug` run reveals the cause — "permissive" should
+ * not mean "silent" at the kernel layer.
+ */
+export declare function readYamlFile(filePath: string): unknown;
+/** Knobs for {@link readYamlFileOrThrow}: size guard and loader attribution. */
+export interface ReadYamlFileOrThrowOptions {
+    /**
+     * Maximum file size in bytes before this loader refuses to read.
+     * Defaults to 10 MB — a project config file that grows past this is
+     * almost certainly checked-in test data or a bug.
+     */
+    readonly maxBytes?: number;
+    /**
+     * Loader name surfaced in `ValidationError.options.loader` so
+     * downstream error rendering can attribute failures to the right
+     * subsystem (e.g. `'signalers'`, `'cli-defaults'`).
+     */
+    readonly loader?: string;
+}
+/**
+ * Strict counterpart to `readYamlFile`. Throws structured errors on
+ * any failure mode instead of returning `undefined`:
+ *
+ *   - `ValidationError` — missing file, unreadable file, malformed YAML.
+ *     The `loader` and `operation` fields are populated for downstream
+ *     attribution.
+ *   - `SystemError` — file exceeds `maxBytes` (default 10 MB).
+ *
+ * Consumers that want hand-rolled stat/read/parse with the same
+ * structured errors should call this instead — it consolidates a
+ * pattern previously duplicated across loaders (audit-round-2 Finding F).
+ *
+ * @throws {ValidationError} When the file is missing, unreadable, or contains malformed YAML.
+ * @throws {SystemError} When the file exceeds `maxBytes`.
+ */
+export declare function readYamlFileOrThrow(filePath: string, options?: ReadYamlFileOrThrowOptions): unknown;
+//# sourceMappingURL=yaml.d.ts.map

package/dist/lib/yaml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"yaml.d.ts","sourceRoot":"","sources":["../../src/lib/yaml.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AASH;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CActD;AAED,gFAAgF;AAChF,MAAM,WAAW,0BAA0B;IACzC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAsCT"}

package/dist/lib/yaml.js

@@ -0,0 +1,118 @@
+/**
+ * @fileoverview Permissive YAML reader used by plugin-discovery sites
+ * that need to extract a single field from `opensip-cli.config.yml`
+ * without dragging in a Zod schema or surfacing structured errors.
+ *
+ * The kernel's plugin discovery (and fitness's check-package discovery)
+ * only need to read `plugins.<domain>` / `plugins.checkPackages`
+ * out of the project config. They previously reached for js-yaml via a
+ * `createRequire(import.meta.url)` shim — duplicated, and unnecessary
+ * now that `js-yaml` is a direct dep of every package that calls this.
+ *
+ * Behavior:
+ *   - Missing file → `undefined`
+ *   - I/O error → `undefined`
+ *   - Malformed YAML → `undefined`
+ *   - Valid YAML → parsed value (typed `unknown`; callers narrow)
+ *
+ * Strict YAML loading (with structured errors and size caps) is the
+ * targets loader's job — it lives in fitness because the schema lives
+ * there. Don't add error-throwing modes here; that's a different tool's
+ * surface.
+ */
+import { existsSync, readFileSync, statSync } from 'node:fs';
+import yaml from 'js-yaml';
+import { SystemError, ValidationError } from './errors.js';
+import { logger } from './logger.js';
+/**
+ * Read a YAML file and return the parsed document. Returns `undefined`
+ * on any failure (missing, unreadable, or malformed). Callers that
+ * need structured error reporting should use a dedicated loader
+ * instead — this helper exists for the discovery seam where "no
+ * config" and "bad config" are both treated the same: don't load
+ * plugins.
+ *
+ * @remarks Advanced / discouraged for general use. This is the
+ * "permissive" reader for plugin discovery; tools that read their
+ * own config should keep a dedicated loader (see fitness's
+ * targets/loader.ts) so malformed YAML surfaces a structured error
+ * instead of silently no-op'ing.
+ *
+ * On parse failure we still emit a `core.yaml.parse_failed` debug
+ * log so a `--debug` run reveals the cause — "permissive" should
+ * not mean "silent" at the kernel layer.
+ */
+export function readYamlFile(filePath) {
+    if (!existsSync(filePath))
+        return undefined;
+    try {
+        const raw = readFileSync(filePath, 'utf8');
+        return yaml.load(raw);
+    }
+    catch (error) {
+        logger.debug({
+            evt: 'core.yaml.parse_failed',
+            module: 'core:lib',
+            filePath,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return undefined;
+    }
+}
+/**
+ * Strict counterpart to `readYamlFile`. Throws structured errors on
+ * any failure mode instead of returning `undefined`:
+ *
+ *   - `ValidationError` — missing file, unreadable file, malformed YAML.
+ *     The `loader` and `operation` fields are populated for downstream
+ *     attribution.
+ *   - `SystemError` — file exceeds `maxBytes` (default 10 MB).
+ *
+ * Consumers that want hand-rolled stat/read/parse with the same
+ * structured errors should call this instead — it consolidates a
+ * pattern previously duplicated across loaders (audit-round-2 Finding F).
+ *
+ * @throws {ValidationError} When the file is missing, unreadable, or contains malformed YAML.
+ * @throws {SystemError} When the file exceeds `maxBytes`.
+ */
+export function readYamlFileOrThrow(filePath, options = {}) {
+    const loader = options.loader ?? 'yaml';
+    const maxBytes = options.maxBytes ?? 10 * 1024 * 1024;
+    let raw;
+    try {
+        const stats = statSync(filePath);
+        if (stats.size > maxBytes) {
+            throw new SystemError(`File too large (${stats.size} bytes, max ${maxBytes}): ${filePath}`, {
+                code: 'SYSTEM.FILE.TOO_LARGE',
+                operation: 'read',
+                loader,
+                filePath,
+            });
+        }
+        raw = readFileSync(filePath, 'utf8');
+    }
+    catch (error) {
+        if (error instanceof SystemError || error instanceof ValidationError)
+            throw error;
+        const message = error instanceof Error ? error.message : String(error);
+        throw new ValidationError(`Failed to read ${filePath}: ${message}`, {
+            operation: 'read',
+            loader,
+            filePath,
+            cause: error instanceof Error ? error : undefined,
+        });
+    }
+    try {
+        return yaml.load(raw) ?? {};
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new ValidationError(`${filePath} contains invalid YAML: ${message}`, {
+            operation: 'parse',
+            loader,
+            filePath,
+            cause: error instanceof Error ? error : undefined,
+        });
+    }
+}
+//# sourceMappingURL=yaml.js.map

package/dist/lib/yaml.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"yaml.js","sourceRoot":"","sources":["../../src/lib/yaml.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAE7D,OAAO,IAAI,MAAM,SAAS,CAAC;AAE3B,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC;YACX,GAAG,EAAE,wBAAwB;YAC7B,MAAM,EAAE,UAAU;YAClB,QAAQ;YACR,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAkBD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAgB,EAChB,UAAsC,EAAE;IAExC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;IACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;IAEtD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,KAAK,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;YAC1B,MAAM,IAAI,WAAW,CAAC,mBAAmB,KAAK,CAAC,IAAI,eAAe,QAAQ,MAAM,QAAQ,EAAE,EAAE;gBAC1F,IAAI,EAAE,uBAAuB;gBAC7B,SAAS,EAAE,MAAM;gBACjB,MAAM;gBACN,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;QACD,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,WAAW,IAAI,KAAK,YAAY,eAAe;YAAE,MAAM,KAAK,CAAC;QAClF,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,eAAe,CAAC,kBAAkB,QAAQ,KAAK,OAAO,EAAE,EAAE;YAClE,SAAS,EAAE,MAAM;YACjB,MAAM;YACN,QAAQ;YACR,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SAClD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,eAAe,CAAC,GAAG,QAAQ,2BAA2B,OAAO,EAAE,EAAE;YACzE,SAAS,EAAE,OAAO;YAClB,MAAM;YACN,QAAQ;YACR,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SAClD,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/plugins/__tests__/as-if-external.test.d.ts

@@ -0,0 +1,18 @@
+/**
+ * @fileoverview As-if-external acceptance test (release 2.8.0, identity &
+ * compatibility — Phase 5, task 5.2).
+ *
+ * The miniature of the north-star §8 minimum proof slice: a **bundled** tool's
+ * static manifest, loaded + admitted through the **exact same** gate path an
+ * external tool would take (`loadToolManifest` → `admitTool`), is admitted
+ * identically — and the gate actually fires on incompatibility.
+ *
+ * Why the equality is asserted against a KNOWN command list rather than by
+ * importing the tool's runtime `Tool.commands`: core is the kernel and MUST
+ * NOT import `@opensip-cli/fitness` / `graph` / `simulation` (the layering
+ * rule dependency-cruiser enforces). The manifest⇔tool equality was already
+ * asserted from the tool side in Phase 1; here we assert the manifest the
+ * host reads matches the contract-frozen command set the tools register.
+ */
+export {};
+//# sourceMappingURL=as-if-external.test.d.ts.map

package/dist/plugins/__tests__/as-if-external.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"as-if-external.test.d.ts","sourceRoot":"","sources":["../../../src/plugins/__tests__/as-if-external.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG"}

package/dist/plugins/__tests__/as-if-external.test.js

@@ -0,0 +1,159 @@
+/**
+ * @fileoverview As-if-external acceptance test (release 2.8.0, identity &
+ * compatibility — Phase 5, task 5.2).
+ *
+ * The miniature of the north-star §8 minimum proof slice: a **bundled** tool's
+ * static manifest, loaded + admitted through the **exact same** gate path an
+ * external tool would take (`loadToolManifest` → `admitTool`), is admitted
+ * identically — and the gate actually fires on incompatibility.
+ *
+ * Why the equality is asserted against a KNOWN command list rather than by
+ * importing the tool's runtime `Tool.commands`: core is the kernel and MUST
+ * NOT import `@opensip-cli/fitness` / `graph` / `simulation` (the layering
+ * rule dependency-cruiser enforces). The manifest⇔tool equality was already
+ * asserted from the tool side in Phase 1; here we assert the manifest the
+ * host reads matches the contract-frozen command set the tools register.
+ */
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { describe, expect, it } from 'vitest';
+import { PLUGIN_API_VERSION } from '../../tools/manifest.js';
+import { admitTool, loadToolManifest } from '../manifest-loader.js';
+const HERE = dirname(fileURLToPath(import.meta.url));
+/** Repo root, five levels up from this test's directory. */
+const REPO_ROOT = join(HERE, '..', '..', '..', '..', '..');
+/**
+ * The three bundled tools' engine package dirs + their CONTRACT-FROZEN command
+ * name sets. These are the exact lists the runtime `Tool.commands` arrays
+ * register (Phase 1 asserts manifest⇔Tool from the tool side); core asserts
+ * the host-read manifest matches them without importing the tool runtime.
+ */
+const BUNDLED_TOOLS = [
+    {
+        id: 'fitness',
+        dir: join(REPO_ROOT, 'packages', 'fitness', 'engine'),
+        commands: ['fit', 'fit-list', 'fit-recipes', 'fit-baseline-export', 'fit-run-worker'],
+    },
+    {
+        id: 'simulation',
+        dir: join(REPO_ROOT, 'packages', 'simulation', 'engine'),
+        commands: ['sim', 'sim-run-worker'],
+    },
+    {
+        id: 'graph',
+        dir: join(REPO_ROOT, 'packages', 'graph', 'engine'),
+        commands: [
+            'graph',
+            'graph-lookup',
+            'graph-symbol-index',
+            'graph-baseline-export',
+            'graph-shard-worker',
+            'graph-equivalence-check',
+            'graph-run-worker',
+            'catalog-export',
+            'sarif-export',
+            'graph-recipes',
+        ],
+    },
+];
+const FIXTURES = join(HERE, '__fixtures__');
+const FUTURE_EPOCH_DIR = join(FIXTURES, 'future-epoch-tool');
+const NO_APIVERSION_DIR = join(FIXTURES, 'no-apiversion-tool');
+describe('as-if-external gate — bundled tools admitted through the external path', () => {
+    for (const tool of BUNDLED_TOOLS) {
+        describe(`${tool.id} (bundled)`, () => {
+            it('(a) loads its static manifest from package.json and admits it', () => {
+                const manifest = loadToolManifest('bundled', tool.dir);
+                expect(manifest, `expected a readable manifest for ${tool.id}`).toBeDefined();
+                if (manifest === undefined)
+                    return;
+                expect(manifest.kind).toBe('tool');
+                expect(manifest.id).toBe(tool.id);
+                // Bundled tools declare the current epoch.
+                expect(manifest.apiVersion).toBe(PLUGIN_API_VERSION);
+                const result = admitTool({
+                    manifest,
+                    source: 'bundled',
+                    dir: tool.dir,
+                    packageName: manifest.name,
+                    explicitlyRequested: false,
+                });
+                expect(result.decision).toBe('admit');
+                expect(result.verdict.kind).toBe('compatible');
+                expect(result.diagnostic).toBeUndefined();
+                // Provenance identity matches the tool the host read.
+                expect(result.provenance.source).toBe('bundled');
+                expect(result.provenance.id).toBe(tool.id);
+                expect(result.provenance.resolvedPath).toBe(tool.dir);
+                expect(result.provenance.manifestHash).toMatch(/^[0-9a-f]{64}$/);
+            });
+            it('(b) manifest command-name SET equals the contract-frozen Tool.commands set', () => {
+                const manifest = loadToolManifest('bundled', tool.dir);
+                expect(manifest).toBeDefined();
+                if (manifest === undefined)
+                    return;
+                const manifestNames = new Set(manifest.commands.map((c) => c.name));
+                expect(manifestNames).toEqual(new Set(tool.commands));
+                // Every command entry carries a non-empty description (the manifest
+                // contract the guardrail enforces).
+                for (const cmd of manifest.commands) {
+                    expect(typeof cmd.description).toBe('string');
+                    expect(cmd.name.length).toBeGreaterThan(0);
+                }
+            });
+        });
+    }
+});
+describe('as-if-external gate — the gate fires on incompatibility', () => {
+    it('(c) skips an out-of-range tool that was NOT explicitly requested', () => {
+        const manifest = loadToolManifest('installed', FUTURE_EPOCH_DIR);
+        expect(manifest?.apiVersion).toBe(999);
+        if (manifest === undefined)
+            return;
+        const result = admitTool({
+            manifest,
+            source: 'installed',
+            dir: FUTURE_EPOCH_DIR,
+            explicitlyRequested: false,
+        });
+        expect(result.decision).toBe('skip');
+        expect(result.verdict.kind).toBe('incompatible');
+        expect(result.diagnostic).toBeTruthy();
+        expect(result.diagnostic).toContain('999');
+        // Provenance is still recorded for a skipped tool.
+        expect(result.provenance.id).toBe('future');
+    });
+    it('(c) fails closed for an out-of-range tool that WAS explicitly requested', () => {
+        const manifest = loadToolManifest('installed', FUTURE_EPOCH_DIR);
+        expect(manifest).toBeDefined();
+        if (manifest === undefined)
+            return;
+        const result = admitTool({
+            manifest,
+            source: 'installed',
+            dir: FUTURE_EPOCH_DIR,
+            explicitlyRequested: true,
+        });
+        expect(result.decision).toBe('fail-closed');
+        expect(result.verdict.kind).toBe('incompatible');
+        expect(result.diagnostic).toBeTruthy();
+    });
+    it('(d) fail-closes an explicitly-requested tool with NO apiVersion (3.0.0 — grace window ended)', () => {
+        const manifest = loadToolManifest('installed', NO_APIVERSION_DIR);
+        expect(manifest).toBeDefined();
+        if (manifest === undefined)
+            return;
+        // The manifest omits apiVersion entirely.
+        expect(manifest.apiVersion).toBeUndefined();
+        const result = admitTool({
+            manifest,
+            source: 'installed',
+            dir: NO_APIVERSION_DIR,
+            explicitlyRequested: true, // 3.0.0: a missing apiVersion + explicit request → fail-closed.
+        });
+        expect(result.decision).toBe('fail-closed');
+        expect(result.verdict.kind).toBe('incompatible');
+        expect(result.diagnostic).toBeDefined();
+    });
+});
+//# sourceMappingURL=as-if-external.test.js.map

package/dist/plugins/__tests__/as-if-external.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"as-if-external.test.js","sourceRoot":"","sources":["../../../src/plugins/__tests__/as-if-external.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEpE,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAErD,4DAA4D;AAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAS3D;;;;;GAKG;AACH,MAAM,aAAa,GAA2B;IAC5C;QACE,EAAE,EAAE,SAAS;QACb,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;QACrD,QAAQ,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,qBAAqB,EAAE,gBAAgB,CAAC;KACtF;IACD;QACE,EAAE,EAAE,YAAY;QAChB,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,CAAC;QACxD,QAAQ,EAAE,CAAC,KAAK,EAAE,gBAAgB,CAAC;KACpC;IACD;QACE,EAAE,EAAE,OAAO;QACX,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC;QACnD,QAAQ,EAAE;YACR,OAAO;YACP,cAAc;YACd,oBAAoB;YACpB,uBAAuB;YACvB,oBAAoB;YACpB,yBAAyB;YACzB,kBAAkB;YAClB,gBAAgB;YAChB,cAAc;YACd,eAAe;SAChB;KACF;CACF,CAAC;AAEF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;AAC5C,MAAM,gBAAgB,GAAG,IAAI,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;AAC7D,MAAM,iBAAiB,GAAG,IAAI,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;AAE/D,QAAQ,CAAC,wEAAwE,EAAE,GAAG,EAAE;IACtF,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,QAAQ,CAAC,GAAG,IAAI,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE;YACpC,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;gBACvE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;gBACvD,MAAM,CAAC,QAAQ,EAAE,oCAAoC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC9E,IAAI,QAAQ,KAAK,SAAS;oBAAE,OAAO;gBAEnC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACnC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAClC,2CAA2C;gBAC3C,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;gBAErD,MAAM,MAAM,GAAG,SAAS,CAAC;oBACvB,QAAQ;oBACR,MAAM,EAAE,SAAS;oBACjB,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,WAAW,EAAE,QAAQ,CAAC,IAAI;oBAC1B,mBAAmB,EAAE,KAAK;iBAC3B,CAAC,CAAC;gBAEH,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACtC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAC/C,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;gBAC1C,sDAAsD;gBACtD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACjD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC3C,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACtD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;YACnE,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;gBACpF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;gBACvD,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC/B,IAAI,QAAQ,KAAK,SAAS;oBAAE,OAAO;gBAEnC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;gBACpE,MAAM,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACtD,oEAAoE;gBACpE,oCAAoC;gBACpC,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;oBACpC,MAAM,CAAC,OAAO,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBAC9C,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;gBAC7C,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yDAAyD,EAAE,GAAG,EAAE;IACvE,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,QAAQ,GAAG,gBAAgB,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QACjE,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO;QAEnC,MAAM,MAAM,GAAG,SAAS,CAAC;YACvB,QAAQ;YACR,MAAM,EAAE,WAAW;YACnB,GAAG,EAAE,gBAAgB;YACrB,mBAAmB,EAAE,KAAK;SAC3B,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,UAAU,EAAE,CAAC;QACvC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC3C,mDAAmD;QACnD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QACjE,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/B,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO;QAEnC,MAAM,MAAM,GAAG,SAAS,CAAC;YACvB,QAAQ;YACR,MAAM,EAAE,WAAW;YACnB,GAAG,EAAE,gBAAgB;YACrB,mBAAmB,EAAE,IAAI;SAC1B,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,UAAU,EAAE,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8FAA8F,EAAE,GAAG,EAAE;QACtG,MAAM,QAAQ,GAAG,gBAAgB,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;QAClE,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/B,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO;QACnC,0CAA0C;QAC1C,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;QAE5C,MAAM,MAAM,GAAG,SAAS,CAAC;YACvB,QAAQ;YACR,MAAM,EAAE,WAAW;YACnB,GAAG,EAAE,iBAAiB;YACtB,mBAAmB,EAAE,IAAI,EAAE,gEAAgE;SAC5F,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/plugins/__tests__/authored-tool-discovery.test.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Authored-Tool sidecar discovery (Phase 1): a source-agnostic walk over a
+ * single authored `tools/` root that returns each `<root>/<name>/` dir carrying
+ * an `opensip-tool.manifest.json` sidecar. Pure filesystem reads — no module
+ * code is imported (the walk keys on the sidecar FILE's presence).
+ */
+export {};
+//# sourceMappingURL=authored-tool-discovery.test.d.ts.map

package/dist/plugins/__tests__/authored-tool-discovery.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authored-tool-discovery.test.d.ts","sourceRoot":"","sources":["../../../src/plugins/__tests__/authored-tool-discovery.test.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}