@orion-agents/orion-code 0.1.8 → 0.2.0

package/dist/runtime/harness-confluence.js

@@ -0,0 +1,807 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ArchitectureConfluenceError = exports.DEFAULT_ARCHITECTURE_CONFLUENCE_RULES_V1 = exports.DEFAULT_RESOURCE_SCOPE_CHURN_CYCLES = exports.ARCHITECTURE_CONFLUENCE_RECEIPT_VERSION = void 0;
+exports.runArchitectureConfluenceAuditV1 = runArchitectureConfluenceAuditV1;
+exports.verifyArchitectureConfluenceReceiptV1 = verifyArchitectureConfluenceReceiptV1;
+exports.runResourceScopeChurnV1 = runResourceScopeChurnV1;
+const fs_1 = require("fs");
+const path_1 = require("path");
+const canonical_1 = require("./protocol/canonical");
+const resource_scope_1 = require("./resource-scope");
+exports.ARCHITECTURE_CONFLUENCE_RECEIPT_VERSION = 1;
+exports.DEFAULT_RESOURCE_SCOPE_CHURN_CYCLES = 1000;
+const DEFAULT_RULES = {
+    forbiddenImports: [
+        {
+            id: 'legacy-import',
+            description: 'Production code must not import a legacy runtime, agent, loop, or mock SDK.',
+            targetPatterns: [
+                'src/init.ts',
+                'src/agents/**',
+                'src/core/agent.ts',
+                'src/core/brain.ts',
+                'src/harness/harness.ts',
+                'src/harness/safety.ts',
+                'src/services/agent-runner.ts',
+                'src/sdk/**',
+                'src/runtime/chat-controller.ts',
+                'src/framework/tool-scheduler.ts',
+                'src/tools/index.ts',
+                'src/tools/mcp.ts',
+                'src/skills/index.ts',
+                'src/skills/loader.ts',
+                'src/skills/registry.ts',
+                'src/skills/runtime.ts',
+                'src/runtime/goals/accounting.ts',
+                'src/runtime/goals/coordinator.ts',
+                'src/runtime/goals/lifecycle.ts',
+                'src/runtime/goals/prompt.ts',
+                'src/runtime/goals/stop-policy.ts',
+                'src/runtime/goals/tools.ts',
+            ],
+        },
+        {
+            id: 'direct-query-import',
+            description: 'Only AgentLoopV1 may bind the internal model-to-tool recursion function.',
+            targetPatterns: ['src/framework/query.ts'],
+            allowedFiles: ['src/runtime/agent-loop.ts'],
+        },
+        {
+            id: 'global-tools-import',
+            description: 'Production code must receive a tool catalog instead of importing global TOOLS.',
+            targetPatterns: ['src/tools.ts', 'src/tools/index.ts'],
+        },
+        {
+            id: 'direct-tool-scheduler-import',
+            description: 'Production effects must converge through ToolGateway instead of tool-scheduler.',
+            targetPatterns: ['src/framework/tool-scheduler.ts'],
+        },
+    ],
+    forbiddenExportSymbols: [
+        'Brain',
+        'BaseAgent',
+        'LeaderAgent',
+        'CoderAgent',
+        'init',
+        'Harness',
+        'MemorySystem',
+        'SafetyChecker',
+        'AgentRunner',
+        'HarnessEngine',
+        'query',
+        'simpleQuery',
+        'ContextHarness',
+        'HarnessKernel',
+        'createContextHarness',
+        'createHarnessKernel',
+    ],
+    forbiddenSingletons: [
+        {
+            id: 'global-tool-catalog',
+            description: 'The tool catalog must be injected by the composition root.',
+            pattern: '\\bexport\\s+const\\s+TOOLS\\b|\\bexport\\s+function\\s+getRuntimeTools\\b',
+        },
+        {
+            id: 'global-mcp-manager',
+            description: 'MCP lifecycle must be owned by the runtime resource scope.',
+            pattern: '\\bexport\\s+const\\s+mcpManager\\s*=\\s*new\\s+',
+        },
+        {
+            id: 'global-agent-pool',
+            description: 'Agent coordinators and worker pools must not be process singletons.',
+            pattern: '\\blet\\s+default(?:Coordinator|Pool)\\b|\\bexport\\s+function\\s+get(?:Coordinator|WorkerPool)\\b',
+        },
+        {
+            id: 'global-tool-state',
+            description: 'Mutable tool lifecycle state must be task/runtime scoped.',
+            pattern: '\\blet\\s+state\\s*:\\s*ToolState\\b|\\blet\\s+listeners\\s*:\\s*Array<\\(s:\\s*ToolState',
+        },
+        {
+            id: 'global-sdk-config',
+            description: 'SDK configuration must not live in a process-global mutable slot.',
+            pattern: '\\blet\\s+globalConfig\\s*:\\s*SDKConfig',
+        },
+    ],
+    forbiddenTarballSourcePatterns: [
+        'src/init.ts',
+        'src/agents/**',
+        'src/core/agent.ts',
+        'src/core/brain.ts',
+        'src/harness/harness.ts',
+        'src/harness/safety.ts',
+        'src/services/agent-runner.ts',
+        'src/sdk/**',
+        'src/runtime/chat-controller.ts',
+        'src/framework/tool-scheduler.ts',
+        'src/tools/index.ts',
+        'src/tools/mcp.ts',
+        'src/skills/index.ts',
+        'src/skills/loader.ts',
+        'src/skills/registry.ts',
+        'src/skills/runtime.ts',
+        'src/runtime/goals/accounting.ts',
+        'src/runtime/goals/coordinator.ts',
+        'src/runtime/goals/lifecycle.ts',
+        'src/runtime/goals/prompt.ts',
+        'src/runtime/goals/stop-policy.ts',
+        'src/runtime/goals/tools.ts',
+    ],
+    requiredOwners: [
+        {
+            kind: 'runtime',
+            symbol: 'OrionRuntimeV1',
+            file: 'src/runtime/orion-runtime-v1.ts',
+            competingFindingRuleIds: [
+                'legacy-import',
+                'forbidden-export:Brain',
+                'forbidden-export:Harness',
+                'forbidden-export:HarnessEngine',
+            ],
+        },
+        {
+            kind: 'loop',
+            symbol: 'AgentLoopV1',
+            file: 'src/runtime/agent-loop.ts',
+            competingFindingRuleIds: [
+                'direct-query-import',
+                'forbidden-export:AgentRunner',
+                'forbidden-export:query',
+                'forbidden-export:simpleQuery',
+            ],
+        },
+        {
+            kind: 'task_context',
+            symbol: 'TaskContextService',
+            file: 'src/runtime/task-context-service.ts',
+            competingFindingRuleIds: [
+                'forbidden-export:ContextHarness',
+                'forbidden-export:HarnessKernel',
+                'forbidden-export:createContextHarness',
+                'forbidden-export:createHarnessKernel',
+            ],
+        },
+    ],
+};
+exports.DEFAULT_ARCHITECTURE_CONFLUENCE_RULES_V1 = deepFreeze(cloneRules(DEFAULT_RULES));
+/** Configuration or receipt corruption is an architecture gate error, never an implicit pass. */
+class ArchitectureConfluenceError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ArchitectureConfluenceError';
+    }
+}
+exports.ArchitectureConfluenceError = ArchitectureConfluenceError;
+/**
+ * Run the strict architecture audit and produce a digest-bound, machine-readable receipt.
+ * Architecture violations are represented as a NO_GO receipt; invalid input throws fail closed.
+ */
+async function runArchitectureConfluenceAuditV1(options) {
+    const repositoryRoot = (0, path_1.resolve)(options.repositoryRoot);
+    if (!(0, fs_1.existsSync)(repositoryRoot) || !(0, fs_1.statSync)(repositoryRoot).isDirectory()) {
+        throw new ArchitectureConfluenceError(`Repository root does not exist: ${repositoryRoot}`);
+    }
+    const config = resolveConfig(options.config);
+    const sourceFiles = readSourceFiles(repositoryRoot, config.sourceRoot);
+    const sourceByPath = new Map(sourceFiles.map(file => [file.path, file]));
+    const findings = [];
+    const missingEntrypoints = [];
+    for (const entrypoint of uniqueSorted([
+        ...config.productionEntrypoints,
+        ...config.publicExportEntrypoints,
+    ])) {
+        if (sourceByPath.has(entrypoint))
+            continue;
+        missingEntrypoints.push(entrypoint);
+        findings.push(finding('missing-entrypoint', 'scan', entrypoint, 1, entrypoint, `Configured architecture entrypoint does not exist: ${entrypoint}`));
+    }
+    const reachableFiles = collectReachableFiles(repositoryRoot, config.productionEntrypoints, sourceByPath);
+    const importRecords = collectImportRecords(repositoryRoot, reachableFiles, sourceByPath);
+    findings.push(...findForbiddenImports(importRecords, config));
+    findings.push(...findForbiddenExports(sourceByPath, config));
+    findings.push(...findForbiddenSingletons(sourceFiles, config));
+    const tarball = scanTarballIntent(repositoryRoot, sourceFiles, config, findings);
+    const sortedPreOwnershipFindings = sortFindings(findings);
+    const owners = scanOwners(sourceFiles, reachableFiles, config, sortedPreOwnershipFindings);
+    for (const owner of owners.filter(candidate => candidate.status === 'fail')) {
+        findings.push(finding(`ownership:${owner.kind}`, 'ownership', owner.expectedFile, owner.declarations[0]?.line ?? 1, owner.expectedSymbol, owner.reason));
+    }
+    const resourceScope = await runResourceScopeChurnV1(config.scopeCycles);
+    if (resourceScope.status === 'fail') {
+        findings.push(finding('resource-scope-churn', 'resource_scope', 'src/runtime/resource-scope.ts', 1, `${resourceScope.cycles} cycles`, 'ResourceScope churn left a leak, teardown error, timeout, or LIFO violation.'));
+    }
+    const sortedFindings = deepFreeze(sortFindings(findings));
+    const counts = countFindings(sortedFindings);
+    const checks = buildChecks(owners, counts, resourceScope);
+    const decision = checks.every(check => check.status === 'pass')
+        ? 'GO'
+        : 'NO_GO';
+    const scan = buildSourceScan(config, sourceFiles, reachableFiles, uniqueSorted(missingEntrypoints));
+    const generatedAt = options.clock?.() ?? Date.now();
+    if (!Number.isFinite(generatedAt) || generatedAt < 0) {
+        throw new ArchitectureConfluenceError('Receipt clock must return a finite non-negative number.');
+    }
+    const unsigned = {
+        version: exports.ARCHITECTURE_CONFLUENCE_RECEIPT_VERSION,
+        generatedAt,
+        repositoryRoot,
+        strict: config.strict,
+        configurationDigest: (0, canonical_1.digestRuntimeValue)(config),
+        scan,
+        owners,
+        tarball,
+        resourceScope,
+        counts,
+        findings: sortedFindings,
+        checks,
+        decision,
+    };
+    return deepFreeze({ ...unsigned, digest: (0, canonical_1.digestRuntimeValue)(unsigned) });
+}
+/** Verify the receipt digest and every derived decision/count field. */
+function verifyArchitectureConfluenceReceiptV1(receipt) {
+    if (receipt.version !== exports.ARCHITECTURE_CONFLUENCE_RECEIPT_VERSION) {
+        throw new ArchitectureConfluenceError(`Unsupported receipt version: ${receipt.version}`);
+    }
+    const { digest, ...unsigned } = receipt;
+    if ((0, canonical_1.digestRuntimeValue)(unsigned) !== digest) {
+        throw new ArchitectureConfluenceError('Architecture confluence receipt digest mismatch.');
+    }
+    const expectedCounts = countFindings(receipt.findings);
+    if ((0, canonical_1.canonicalRuntimeJson)(expectedCounts) !== (0, canonical_1.canonicalRuntimeJson)(receipt.counts)) {
+        throw new ArchitectureConfluenceError('Architecture confluence receipt counts mismatch.');
+    }
+    const expectedDecision = receipt.checks.every(check => check.status === 'pass') ? 'GO' : 'NO_GO';
+    if (expectedDecision !== receipt.decision) {
+        throw new ArchitectureConfluenceError('Architecture confluence receipt decision mismatch.');
+    }
+    return receipt;
+}
+/**
+ * Prove bounded teardown under two different activation histories. Each cycle owns a fresh scope,
+ * two fake resources and one lease; closing must converge to the same empty state in LIFO order.
+ */
+async function runResourceScopeChurnV1(cycles = exports.DEFAULT_RESOURCE_SCOPE_CHURN_CYCLES) {
+    if (!Number.isSafeInteger(cycles) || cycles <= 0) {
+        throw new ArchitectureConfluenceError('ResourceScope churn cycles must be a positive integer.');
+    }
+    let resourcesActivated = 0;
+    let resourcesDisposed = 0;
+    let leasesAcquired = 0;
+    let leasesReleased = 0;
+    let leakedResources = 0;
+    let leakedLeases = 0;
+    let lifoViolations = 0;
+    let closeErrors = 0;
+    let timedOutCloses = 0;
+    const finalStateDigests = new Set();
+    for (let cycle = 0; cycle < cycles; cycle++) {
+        const scope = new resource_scope_1.ResourceScope({ id: `harness-confluence-${cycle}`, deadlineMs: 250 });
+        const activationOrder = cycle % 2 === 0 ? ['catalog', 'transport'] : ['transport', 'catalog'];
+        const disposalOrder = [];
+        for (const resourceId of activationOrder) {
+            scope.register(resourceId, () => {
+                resourcesDisposed++;
+                disposalOrder.push(resourceId);
+            });
+            resourcesActivated++;
+        }
+        const lease = scope.acquireLease(`cycle-${cycle}`);
+        leasesAcquired++;
+        lease.release();
+        leasesReleased++;
+        const report = await scope.close({ reason: 'confluence_churn', deadlineMs: 250 });
+        const expectedDisposalOrder = [...activationOrder].reverse();
+        if ((0, canonical_1.canonicalRuntimeJson)(disposalOrder) !== (0, canonical_1.canonicalRuntimeJson)(expectedDisposalOrder)) {
+            lifoViolations++;
+        }
+        if (report.errors.length > 0)
+            closeErrors += report.errors.length;
+        if (report.timedOut || report.leaseTimedOut)
+            timedOutCloses++;
+        leakedResources += scope.activeResourceCount;
+        leakedLeases += scope.activeLeaseCount;
+        finalStateDigests.add((0, canonical_1.digestRuntimeValue)({
+            state: scope.state,
+            activeResourceCount: scope.activeResourceCount,
+            activeLeaseCount: scope.activeLeaseCount,
+            signalAborted: scope.signal.aborted,
+        }));
+    }
+    const historyIndependent = finalStateDigests.size === 1;
+    const status = resourcesActivated === resourcesDisposed &&
+        leasesAcquired === leasesReleased &&
+        leakedResources === 0 &&
+        leakedLeases === 0 &&
+        lifoViolations === 0 &&
+        closeErrors === 0 &&
+        timedOutCloses === 0 &&
+        historyIndependent
+        ? 'pass'
+        : 'fail';
+    const unsigned = {
+        cycles,
+        resourcesActivated,
+        resourcesDisposed,
+        leasesAcquired,
+        leasesReleased,
+        leakedResources,
+        leakedLeases,
+        lifoViolations,
+        closeErrors,
+        timedOutCloses,
+        historyIndependent,
+        status,
+    };
+    return deepFreeze({ ...unsigned, digest: (0, canonical_1.digestRuntimeValue)(unsigned) });
+}
+function resolveConfig(input = {}) {
+    const strict = input.strict ?? true;
+    const scopeCycles = input.scopeCycles ?? exports.DEFAULT_RESOURCE_SCOPE_CHURN_CYCLES;
+    if (!Number.isSafeInteger(scopeCycles) || scopeCycles <= 0) {
+        throw new ArchitectureConfluenceError('scopeCycles must be a positive integer.');
+    }
+    if (strict && scopeCycles < exports.DEFAULT_RESOURCE_SCOPE_CHURN_CYCLES) {
+        throw new ArchitectureConfluenceError(`Strict mode requires at least ${exports.DEFAULT_RESOURCE_SCOPE_CHURN_CYCLES} ResourceScope cycles.`);
+    }
+    const rules = input.rules ?? {};
+    const resolved = {
+        strict,
+        sourceRoot: normalizeRepositoryPath(input.sourceRoot ?? 'src'),
+        productionEntrypoints: normalizePathList(input.productionEntrypoints ?? ['src/cli.ts', 'src/index.ts']),
+        publicExportEntrypoints: normalizePathList(input.publicExportEntrypoints ?? ['src/index.ts']),
+        scopeCycles,
+        rules: {
+            forbiddenImports: cloneArray(rules.forbiddenImports ?? DEFAULT_RULES.forbiddenImports),
+            forbiddenExportSymbols: uniqueSorted(rules.forbiddenExportSymbols ?? DEFAULT_RULES.forbiddenExportSymbols),
+            forbiddenSingletons: cloneArray(rules.forbiddenSingletons ?? DEFAULT_RULES.forbiddenSingletons),
+            forbiddenTarballSourcePatterns: uniqueSorted(rules.forbiddenTarballSourcePatterns ?? DEFAULT_RULES.forbiddenTarballSourcePatterns),
+            requiredOwners: cloneArray(rules.requiredOwners ?? DEFAULT_RULES.requiredOwners),
+        },
+        allow: {
+            imports: uniqueSorted(input.allow?.imports ?? []),
+            exports: uniqueSorted(input.allow?.exports ?? []),
+            singletons: uniqueSorted(input.allow?.singletons ?? []),
+            tarballEntries: uniqueSorted(input.allow?.tarballEntries ?? []),
+        },
+    };
+    validateResolvedConfig(resolved);
+    return deepFreeze(resolved);
+}
+function validateResolvedConfig(config) {
+    const ruleIds = [
+        ...config.rules.forbiddenImports.map(rule => rule.id),
+        ...config.rules.forbiddenSingletons.map(rule => rule.id),
+    ];
+    if (new Set(ruleIds).size !== ruleIds.length) {
+        throw new ArchitectureConfluenceError('Architecture rule ids must be unique.');
+    }
+    for (const rule of config.rules.forbiddenSingletons) {
+        try {
+            new RegExp(rule.pattern, 'm');
+        }
+        catch (error) {
+            throw new ArchitectureConfluenceError(`Invalid singleton rule ${rule.id}: ${errorMessage(error)}`);
+        }
+    }
+    const ownerKinds = config.rules.requiredOwners.map(owner => owner.kind);
+    if (new Set(ownerKinds).size !== ownerKinds.length) {
+        throw new ArchitectureConfluenceError('Each architecture owner kind must be declared once.');
+    }
+}
+function readSourceFiles(repositoryRoot, sourceRoot) {
+    const absoluteSourceRoot = (0, path_1.resolve)(repositoryRoot, sourceRoot);
+    if (!(0, fs_1.existsSync)(absoluteSourceRoot) || !(0, fs_1.statSync)(absoluteSourceRoot).isDirectory()) {
+        throw new ArchitectureConfluenceError(`Source root does not exist: ${sourceRoot}`);
+    }
+    const files = [];
+    const visit = (directory) => {
+        for (const entry of (0, fs_1.readdirSync)(directory, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name))) {
+            const absolute = (0, path_1.resolve)(directory, entry.name);
+            if (entry.isDirectory()) {
+                visit(absolute);
+            }
+            else if (entry.isFile() && /\.(?:ts|tsx)$/.test(entry.name)) {
+                files.push({
+                    path: toRepositoryPath(repositoryRoot, absolute),
+                    content: (0, fs_1.readFileSync)(absolute, 'utf8'),
+                });
+            }
+        }
+    };
+    visit(absoluteSourceRoot);
+    return files.sort((left, right) => left.path.localeCompare(right.path));
+}
+function collectReachableFiles(repositoryRoot, entrypoints, sourceByPath) {
+    const reachable = new Set();
+    const queue = [...entrypoints.filter(entrypoint => sourceByPath.has(entrypoint))];
+    while (queue.length > 0) {
+        const current = queue.shift();
+        if (!current || reachable.has(current))
+            continue;
+        reachable.add(current);
+        const source = sourceByPath.get(current);
+        if (!source)
+            continue;
+        for (const record of extractImportRecords(repositoryRoot, source)) {
+            if (record.target && sourceByPath.has(record.target) && !reachable.has(record.target)) {
+                queue.push(record.target);
+            }
+        }
+    }
+    return uniqueSorted(reachable);
+}
+function collectImportRecords(repositoryRoot, reachableFiles, sourceByPath) {
+    return reachableFiles.flatMap(file => {
+        const source = sourceByPath.get(file);
+        return source ? extractImportRecords(repositoryRoot, source) : [];
+    });
+}
+function extractImportRecords(repositoryRoot, source) {
+    const records = [];
+    const expressions = [
+        {
+            expression: /\b(?:import|export)\s+(type\s+)?[^;'"`]*?\s+from\s*['"]([^'"]+)['"]/g,
+            specifierGroup: 2,
+            typeOnlyGroup: 1,
+        },
+        { expression: /\bimport\s*['"]([^'"]+)['"]/g, specifierGroup: 1 },
+        { expression: /\brequire\(\s*['"]([^'"]+)['"]\s*\)/g, specifierGroup: 1 },
+        { expression: /\bimport\(\s*['"]([^'"]+)['"]\s*\)/g, specifierGroup: 1 },
+    ];
+    const seen = new Set();
+    for (const parser of expressions) {
+        for (const match of source.content.matchAll(parser.expression)) {
+            const specifier = match[parser.specifierGroup];
+            const index = (match.index ?? 0) + match[0].lastIndexOf(specifier);
+            const key = `${index}:${specifier}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            records.push({
+                file: source.path,
+                line: lineNumberAt(source.content, index),
+                specifier,
+                typeOnly: parser.typeOnlyGroup !== undefined && match[parser.typeOnlyGroup] !== undefined,
+                target: resolveTypeScriptImport(repositoryRoot, source.path, specifier),
+            });
+        }
+    }
+    return records.sort((left, right) => left.file.localeCompare(right.file) || left.line - right.line);
+}
+function resolveTypeScriptImport(repositoryRoot, importer, specifier) {
+    if (!specifier.startsWith('.'))
+        return undefined;
+    const base = (0, path_1.resolve)(repositoryRoot, (0, path_1.dirname)(importer), specifier);
+    const candidates = /\.(?:ts|tsx|js)$/.test(base)
+        ? [base.replace(/\.js$/, '.ts'), base.replace(/\.js$/, '.tsx')]
+        : [base, `${base}.ts`, `${base}.tsx`, (0, path_1.resolve)(base, 'index.ts'), (0, path_1.resolve)(base, 'index.tsx')];
+    const target = candidates.find(candidate => (0, fs_1.existsSync)(candidate) && (0, fs_1.statSync)(candidate).isFile());
+    return target ? toRepositoryPath(repositoryRoot, target) : undefined;
+}
+function findForbiddenImports(records, config) {
+    const findings = [];
+    for (const record of records) {
+        if (!record.target || record.typeOnly)
+            continue;
+        for (const rule of config.rules.forbiddenImports) {
+            if (!rule.targetPatterns.some(pattern => matchesPathPattern(record.target, pattern)))
+                continue;
+            if (rule.allowedFiles?.some(pattern => matchesPathPattern(record.file, pattern)))
+                continue;
+            const keys = [
+                record.file,
+                `${rule.id}:${record.file}`,
+                `${rule.id}:${record.file}:${record.target}`,
+            ];
+            if (keys.some(key => config.allow.imports.includes(key)))
+                continue;
+            findings.push(finding(rule.id, 'import', record.file, record.line, record.specifier, `${rule.description} Resolved target: ${record.target}.`));
+        }
+    }
+    return findings;
+}
+function findForbiddenExports(sourceByPath, config) {
+    const findings = [];
+    for (const path of config.publicExportEntrypoints) {
+        const source = sourceByPath.get(path);
+        if (!source)
+            continue;
+        const exported = extractExports(source.content);
+        for (const symbol of config.rules.forbiddenExportSymbols) {
+            const match = exported.find(candidate => candidate.symbol === symbol);
+            if (!match)
+                continue;
+            if (config.allow.exports.includes(symbol) ||
+                config.allow.exports.includes(`${path}:${symbol}`)) {
+                continue;
+            }
+            findings.push(finding(`forbidden-export:${symbol}`, 'export', path, match.line, symbol, `Legacy symbol ${symbol} remains reachable from a public export entrypoint.`));
+        }
+    }
+    return findings;
+}
+function extractExports(content) {
+    const exports = [];
+    const blocks = /\bexport\s+(?:type\s+)?\{([\s\S]*?)\}(?:\s+from\s*['"][^'"]+['"])?/g;
+    for (const block of content.matchAll(blocks)) {
+        const body = block[1];
+        const bodyOffset = (block.index ?? 0) + block[0].indexOf(body);
+        for (const rawPart of body.split(',')) {
+            const part = rawPart.trim();
+            if (!part)
+                continue;
+            const names = part.split(/\s+as\s+/).map(name => name.trim());
+            const symbol = names[names.length - 1];
+            const localOffset = body.indexOf(rawPart) + rawPart.indexOf(symbol);
+            exports.push({ symbol, line: lineNumberAt(content, bodyOffset + localOffset) });
+        }
+    }
+    const declarations = /\bexport\s+(?:default\s+)?(?:abstract\s+)?(?:class|function|const|let|var|interface|type|enum)\s+([A-Za-z_$][\w$]*)/g;
+    for (const declaration of content.matchAll(declarations)) {
+        exports.push({
+            symbol: declaration[1],
+            line: lineNumberAt(content, (declaration.index ?? 0) + declaration[0].lastIndexOf(declaration[1])),
+        });
+    }
+    return exports;
+}
+function findForbiddenSingletons(sourceFiles, config) {
+    const findings = [];
+    for (const source of sourceFiles) {
+        for (const rule of config.rules.forbiddenSingletons) {
+            if (rule.allowedFiles?.some(pattern => matchesPathPattern(source.path, pattern)))
+                continue;
+            const match = new RegExp(rule.pattern, 'm').exec(source.content);
+            if (!match)
+                continue;
+            const keys = [source.path, `${rule.id}:${source.path}`];
+            if (keys.some(key => config.allow.singletons.includes(key)))
+                continue;
+            findings.push(finding(rule.id, 'singleton', source.path, lineNumberAt(source.content, match.index), match[0], rule.description));
+        }
+    }
+    return findings;
+}
+function scanTarballIntent(repositoryRoot, sourceFiles, config, findings) {
+    const packageJson = readJsonObject(repositoryRoot, 'package.json', findings);
+    const tsconfig = readJsonObject(repositoryRoot, 'tsconfig.json', findings);
+    const packageFiles = toStringArray(packageJson?.files);
+    const compilerIncludes = toStringArray(tsconfig?.include);
+    const compilerExcludes = toStringArray(tsconfig?.exclude);
+    const main = typeof packageJson?.main === 'string' ? packageJson.main : '';
+    const distIncluded = packageFiles.length === 0
+        ? main.startsWith('dist/')
+        : packageFiles.some(pattern => /^(?:\.\/)?dist(?:\/|\/\*\*?|$)/.test(pattern));
+    const isCompiledSource = (source) => compilerIncludes.some(pattern => matchesPathPattern(source.path, normalizeRepositoryPath(pattern))) &&
+        !compilerExcludes.some(pattern => matchesPathPattern(source.path, normalizeRepositoryPath(pattern)));
+    const sourceCompilationEnabled = sourceFiles.some(isCompiledSource);
+    const forbiddenEntries = distIncluded && sourceCompilationEnabled
+        ? uniqueSorted(sourceFiles
+            .filter(isCompiledSource)
+            .filter(source => config.rules.forbiddenTarballSourcePatterns.some(pattern => matchesPathPattern(source.path, pattern)))
+            .map(source => source.path.replace(/^src\//, 'dist/').replace(/\.tsx?$/, '.js'))
+            .filter(entry => !config.allow.tarballEntries.includes(entry)))
+        : [];
+    for (const entry of forbiddenEntries) {
+        findings.push(finding('legacy-tarball-entry', 'tarball', 'package.json', 1, entry, `Build/package intent includes forbidden legacy entry ${entry}.`));
+    }
+    const unsigned = {
+        packageFiles: uniqueSorted(packageFiles),
+        compilerIncludes: uniqueSorted(compilerIncludes),
+        compilerExcludes: uniqueSorted(compilerExcludes),
+        distIncluded,
+        sourceCompilationEnabled,
+        forbiddenEntries,
+    };
+    return deepFreeze({ ...unsigned, digest: (0, canonical_1.digestRuntimeValue)(unsigned) });
+}
+function readJsonObject(repositoryRoot, path, findings) {
+    const absolute = (0, path_1.resolve)(repositoryRoot, path);
+    try {
+        const value = JSON.parse((0, fs_1.readFileSync)(absolute, 'utf8'));
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            throw new Error('not an object');
+        return value;
+    }
+    catch (error) {
+        findings.push(finding('invalid-package-intent', 'scan', path, 1, path, `Unable to read architecture package intent: ${errorMessage(error)}`));
+        return undefined;
+    }
+}
+function scanOwners(sourceFiles, reachableFiles, config, findings) {
+    const reachable = new Set(reachableFiles);
+    return deepFreeze(config.rules.requiredOwners.map(owner => {
+        const expression = new RegExp(`^\\s*export\\s+(?:abstract\\s+)?(?:class|interface|function|const|type)\\s+${escapeRegExp(owner.symbol)}\\b`, 'gm');
+        const declarations = sourceFiles.flatMap(source => [...source.content.matchAll(expression)].map(match => ({
+            file: source.path,
+            line: lineNumberAt(source.content, match.index ?? 0),
+        })));
+        const referenceExpression = new RegExp(`\\b${escapeRegExp(owner.symbol)}\\b`, 'g');
+        const productionReferences = sourceFiles
+            .filter(source => reachable.has(source.path) && source.path !== owner.file)
+            .flatMap(source => {
+            const match = referenceExpression.exec(source.content);
+            referenceExpression.lastIndex = 0;
+            return match
+                ? [{ file: source.path, line: lineNumberAt(source.content, match.index) }]
+                : [];
+        });
+        const competingFindingRuleIds = uniqueSorted(findings
+            .filter(candidate => owner.competingFindingRuleIds.includes(candidate.ruleId))
+            .map(candidate => candidate.ruleId));
+        const declarationIsUnique = declarations.length === 1 && declarations[0].file === owner.file;
+        const isProductionOwned = productionReferences.length > 0;
+        const status = declarationIsUnique && isProductionOwned && competingFindingRuleIds.length === 0
+            ? 'pass'
+            : 'fail';
+        const reasons = [];
+        if (!declarationIsUnique) {
+            reasons.push(`expected exactly one ${owner.symbol} declaration at ${owner.file}, observed ${declarations.length}`);
+        }
+        if (!isProductionOwned)
+            reasons.push('owner is not referenced by the production entrypoint graph');
+        if (competingFindingRuleIds.length > 0) {
+            reasons.push(`competing paths remain: ${competingFindingRuleIds.join(', ')}`);
+        }
+        return deepFreeze({
+            kind: owner.kind,
+            expectedSymbol: owner.symbol,
+            expectedFile: owner.file,
+            declarations,
+            productionReferences,
+            competingFindingRuleIds,
+            status,
+            reason: reasons.length > 0 ? reasons.join('; ') : 'single production owner confirmed',
+        });
+    }));
+}
+function buildSourceScan(config, sourceFiles, reachableFiles, missingEntrypoints) {
+    const fileDigests = sourceFiles.map(source => ({
+        file: source.path,
+        digest: (0, canonical_1.digestRuntimeValue)(source.content),
+    }));
+    return deepFreeze({
+        sourceRoot: config.sourceRoot,
+        productionEntrypoints: config.productionEntrypoints,
+        publicExportEntrypoints: config.publicExportEntrypoints,
+        allSourceFiles: sourceFiles.map(source => source.path),
+        reachableProductionFiles: reachableFiles,
+        missingEntrypoints,
+        sourceDigest: (0, canonical_1.digestRuntimeValue)(fileDigests),
+    });
+}
+function buildChecks(owners, counts, resourceScope) {
+    const checks = owners.map(owner => ({
+        id: `ownership.${owner.kind}`,
+        category: 'ownership',
+        status: owner.status,
+        expected: `one production ${owner.expectedSymbol} owner and no competitor`,
+        observed: owner.reason,
+    }));
+    checks.push(countCheck('legacy.imports', 'import', counts.forbiddenImports), countCheck('legacy.exports', 'export', counts.forbiddenExports), countCheck('global.singletons', 'singleton', counts.forbiddenSingletons), countCheck('legacy.tarball_entries', 'tarball', counts.forbiddenTarballEntries), countCheck('scan.integrity', 'scan', counts.scanErrors), {
+        id: 'resource_scope.churn',
+        category: 'resource_scope',
+        status: resourceScope.status,
+        expected: `${resourceScope.cycles} cycles, zero leaks/errors/timeouts/LIFO violations`,
+        observed: `${resourceScope.leakedResources} resource leaks, ${resourceScope.leakedLeases} lease leaks, ${resourceScope.closeErrors} close errors, ${resourceScope.lifoViolations} LIFO violations`,
+    });
+    return deepFreeze(checks);
+}
+function countCheck(id, category, count) {
+    return {
+        id,
+        category,
+        status: count === 0 ? 'pass' : 'fail',
+        expected: '0 violations',
+        observed: `${count} violations`,
+    };
+}
+function countFindings(findings) {
+    return deepFreeze({
+        findings: findings.length,
+        forbiddenImports: findings.filter(candidate => candidate.category === 'import').length,
+        forbiddenExports: findings.filter(candidate => candidate.category === 'export').length,
+        forbiddenSingletons: findings.filter(candidate => candidate.category === 'singleton').length,
+        forbiddenTarballEntries: findings.filter(candidate => candidate.category === 'tarball').length,
+        scanErrors: findings.filter(candidate => candidate.category === 'scan').length,
+    });
+}
+function finding(ruleId, category, file, line, match, message) {
+    return deepFreeze({
+        ruleId,
+        category,
+        severity: 'error',
+        file: normalizeRepositoryPath(file),
+        line: Math.max(1, line),
+        match: compactMatch(match),
+        message,
+    });
+}
+function sortFindings(findings) {
+    const unique = new Map();
+    for (const candidate of findings) {
+        const key = `${candidate.ruleId}:${candidate.file}:${candidate.line}:${candidate.match}`;
+        unique.set(key, candidate);
+    }
+    return [...unique.values()].sort((left, right) => left.category.localeCompare(right.category) ||
+        left.ruleId.localeCompare(right.ruleId) ||
+        left.file.localeCompare(right.file) ||
+        left.line - right.line ||
+        left.match.localeCompare(right.match));
+}
+function cloneRules(rules) {
+    return {
+        forbiddenImports: cloneArray(rules.forbiddenImports),
+        forbiddenExportSymbols: [...rules.forbiddenExportSymbols],
+        forbiddenSingletons: cloneArray(rules.forbiddenSingletons),
+        forbiddenTarballSourcePatterns: [...rules.forbiddenTarballSourcePatterns],
+        requiredOwners: cloneArray(rules.requiredOwners),
+    };
+}
+function cloneArray(values) {
+    return values.map(value => (value && typeof value === 'object' ? { ...value } : value));
+}
+function normalizePathList(paths) {
+    return uniqueSorted(paths.map(normalizeRepositoryPath));
+}
+function uniqueSorted(values) {
+    return [...new Set(values)].sort((left, right) => left.localeCompare(right));
+}
+function toStringArray(value) {
+    return Array.isArray(value)
+        ? value.filter((entry) => typeof entry === 'string')
+        : [];
+}
+function toRepositoryPath(repositoryRoot, absolutePath) {
+    return normalizeRepositoryPath((0, path_1.relative)(repositoryRoot, absolutePath));
+}
+function normalizeRepositoryPath(path) {
+    return path.split(path_1.sep).join('/').replace(/^\.\//, '').replace(/\/$/, '');
+}
+function matchesPathPattern(path, pattern) {
+    return globToRegExp(normalizeRepositoryPath(pattern)).test(normalizeRepositoryPath(path));
+}
+function globToRegExp(pattern) {
+    let source = '^';
+    for (let index = 0; index < pattern.length; index++) {
+        const character = pattern[index];
+        if (character === '*' && pattern[index + 1] === '*') {
+            if (pattern[index + 2] === '/') {
+                source += '(?:.*/)?';
+                index += 2;
+            }
+            else {
+                source += '.*';
+                index++;
+            }
+        }
+        else if (character === '*') {
+            source += '[^/]*';
+        }
+        else {
+            source += escapeRegExp(character);
+        }
+    }
+    return new RegExp(`${source}$`);
+}
+function lineNumberAt(content, index) {
+    return content.slice(0, Math.max(0, index)).split('\n').length;
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+function compactMatch(value) {
+    const normalized = value.replace(/\s+/g, ' ').trim();
+    return normalized.length <= 160 ? normalized : `${normalized.slice(0, 157)}...`;
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function deepFreeze(value) {
+    if (value === null || typeof value !== 'object' || Object.isFrozen(value))
+        return value;
+    for (const nested of Object.values(value))
+        deepFreeze(nested);
+    return Object.freeze(value);
+}
+//# sourceMappingURL=harness-confluence.js.map