@ornexus/neocortex 4.60.62 → 4.60.64

package/packages/client/dist/private-execution/ux-source-validation.js

@@ -1 +1 @@
-import{parse as H}from"@babel/parser";import{lstatSync as q,readFileSync as G}from"node:fs";import{join as K,posix as V}from"node:path";const Q=1024*1024,ee=1e5,z=/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;function p(){throw new Error("private-execution-ux-source-unverified")}function o(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}function j(e,t){const r=q(K(e,t));(!r.isFile()||r.isSymbolicLink()||r.size<1||r.size>Q)&&p();const s=new TextDecoder("utf-8",{fatal:!0}).decode(G(K(e,t)));return(!s.trim()||s.includes("\0"))&&p(),s}function I(e,t){const r=H(j(e,t),{sourceType:"module",plugins:["typescript","jsx"],errorRecovery:!1});let s=0;const i=[r];for(;i.length>0;){const l=i.pop();if(o(l)){++s>ee&&p();for(const[n,f]of Object.entries(l))n==="loc"||n==="tokens"||n==="comments"||n==="errors"||(Array.isArray(f)?i.push(...f):o(f)&&i.push(f))}}return r}function E(e){const t=e.program;return(!o(t)||!Array.isArray(t.body))&&p(),t.body.filter(o)}function m(e,t){if(!o(e)||e.type!=="ObjectExpression"||!Array.isArray(e.properties))return;const r=e.properties.filter(s=>o(s)&&s.type==="ObjectProperty"&&s.computed!==!0&&o(s.key)&&(s.key.name===t||s.key.value===t));return r.length===1&&o(r[0])?r[0].value:void 0}function g(e){return o(e)&&e.type==="StringLiteral"&&typeof e.value=="string"?e.value:void 0}function y(e){return o(e)&&e.type==="Identifier"&&typeof e.name=="string"?e.name:void 0}function x(e){return e.type==="VariableDeclaration"&&Array.isArray(e.declarations)?e.declarations.filter(o):[]}function D(e){let t=e;for(let r=0;r<4&&o(t)&&["TSAsExpression","TSSatisfiesExpression","TSTypeAssertion","ParenthesizedExpression"].includes(String(t.type));r++)t=t.expression;return t}function te(e,t){const r=e.flatMap(x).filter(s=>y(s.id)===t);return r.length===1?D(r[0].init):void 0}function R(e,t){for(const r of e){if(r.type!=="ExportNamedDeclaration"||!o(r.declaration))continue;const s=r.declaration;if(s.type==="FunctionDeclaration"&&o(s.id)&&s.id.name===t)return s;const i=x(s).find(l=>o(l.id)&&l.id.name===t);if(i)return D(i.init)}}function A(e,t){const r=[],s=[e];for(;s.length>0;){const i=s.pop();if(o(i)){i.type===t&&r.push(i);for(const[l,n]of Object.entries(i))l==="loc"||l==="comments"||(Array.isArray(n)?s.push(...n):o(n)&&s.push(n))}}return r}function P(e){return e.screenId.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"").slice(0,64)}function U(e){return e.split(/[^A-Za-z0-9]+/).filter(Boolean).map(t=>`${t.charAt(0).toUpperCase()}${t.slice(1).toLowerCase()}`).join("")}function Z(e,t,r){const s=[];for(const i of e){if(i.type!=="ImportDeclaration"||i.importKind==="type"||!o(i.source)||typeof i.source.value!="string"||!i.source.value.startsWith("./")&&!i.source.value.startsWith("../"))continue;const l=V.normalize(V.join(V.dirname(t),i.source.value));if(!(l!==r.screenViewPath&&l!==r.screenViewPath.replace(/\.tsx$/,"")))for(const n of Array.isArray(i.specifiers)?i.specifiers:[])o(n)&&n.type==="ImportSpecifier"&&o(n.imported)&&n.imported.name===r.screenViewExport&&n.importKind!=="type"&&o(n.local)&&typeof n.local.name=="string"&&s.push(n.local.name)}return s.length!==1&&p(),s[0]}function re(e,t){return A(e,"JSXOpeningElement").some(r=>o(r.name)&&r.name.name===t)}function w(e,t,r){const s=e.filter(i=>i.type==="ImportDeclaration"&&o(i.source)&&i.source.value===t).flatMap(i=>Array.isArray(i.specifiers)?i.specifiers:[]).filter(i=>o(i)&&i.type==="ImportSpecifier"&&o(i.imported)&&i.imported.name===r&&o(i.local)&&typeof i.local.name=="string").map(i=>i.local);return s.length===1?s[0].name:void 0}function Y(e,t,r){return o(e)&&e.type==="CallExpression"&&o(e.callee)&&e.callee.type==="MemberExpression"&&e.callee.computed!==!0&&y(e.callee.object)===t&&y(e.callee.property)===r}function ne(e,t){const r=w(t,"storybook/test","within"),s=w(t,"storybook/test","userEvent"),i=w(t,"storybook/test","expect");if(!r||!s||!i||!Array.isArray(e.params)||!o(e.params[0])||e.params[0].type!=="ObjectPattern"||!Array.isArray(e.params[0].properties)||!e.params[0].properties.some(a=>o(a)&&o(a.key)&&a.key.name==="canvasElement"&&o(a.value)&&a.value.name==="canvasElement"))return!1;const l=A(e.body,"VariableDeclarator"),n=l.filter(a=>o(a.init)&&a.init.type==="CallExpression"&&y(a.init.callee)===r&&Array.isArray(a.init.arguments)&&a.init.arguments.length===1&&y(a.init.arguments[0])==="canvasElement").map(a=>y(a.id)).filter(a=>!!a),f=l.filter(a=>n.some(k=>Y(a.init,k,"getByRole")&&Array.isArray(a.init.arguments)&&g(a.init.arguments[0])==="button"&&typeof g(m(a.init.arguments[1],"name"))=="string"&&!!g(m(a.init.arguments[1],"name"))?.trim())).map(a=>y(a.id)).filter(a=>!!a);if(f.length===0)return!1;const u=A(e.body,"AwaitExpression").map(a=>a.argument),$=u.some(a=>Y(a,s,"tab")&&Array.isArray(a.arguments)&&a.arguments.length===0),h=u.some(a=>o(a)&&a.type==="CallExpression"&&o(a.callee)&&a.callee.type==="MemberExpression"&&y(a.callee.property)==="toHaveFocus"&&o(a.callee.object)&&a.callee.object.type==="CallExpression"&&y(a.callee.object.callee)===i&&Array.isArray(a.callee.object.arguments)&&f.includes(y(a.callee.object.arguments[0])??""));return $&&h}function se(e,t,r){const s=`src/screens/${P(t)}/${P(t)}`,i=I(e,t.screenViewPath),l=R(E(i),t.screenViewExport);(!l||A(l,"JSXElement").length+A(l,"JSXFragment").length===0)&&p();const n=I(e,t.appRoutePath),f=Z(E(n),t.appRoutePath,t);re(n,f)||p();const u=`${s}.stories.tsx`,$=I(e,u),h=E($),a=r==="storybook-react-vite"?"@storybook/react-vite":"@storybook/nextjs-vite";(!w(h,a,"Meta")||!w(h,a,"StoryObj"))&&p();const k=Z(h,u,t),C=h.filter(c=>c.type==="ExportDefaultDeclaration");C.length!==1&&p();const O=D(C[0].declaration),T=y(O)?te(h,y(O)):O;(y(m(T,"component"))!==k||g(m(T,"title"))!==`Screens/${t.screenId}`)&&p();const v=new Set;for(const c of t.states)for(const d of t.viewports){const L=`${U(c)}${U(d)}`;v.add(L);const b=R(h,L);if((!o(b)||b.type!=="ObjectExpression"||g(m(m(b,"args"),"state"))!==c||g(m(m(m(b,"parameters"),"viewport"),"defaultViewport"))!==d)&&p(),t.critical&&(c==="success"||c==="recovery")){const N=m(b,"play");(!o(N)||!["ArrowFunctionExpression","FunctionExpression"].includes(String(N.type))||!ne(N,h))&&p()}}const F=h.filter(c=>c.type==="ExportNamedDeclaration");F.some(c=>!o(c.declaration)||x(c.declaration).length!==1||Array.isArray(c.specifiers)&&c.specifiers.length>0)&&p();const X=F.flatMap(c=>x(c.declaration)).map(c=>y(c.id)).filter(c=>!!c);(X.length!==v.size||X.some(c=>!v.has(c)))&&p();const W=I(e,`${s}.fixtures.ts`);E(W).filter(c=>c.type==="ExportNamedDeclaration").flatMap(c=>o(c.declaration)?x(c.declaration):[]).some(c=>{const d=m(c.init,"synthetic");return o(d)&&d.type==="BooleanLiteral"&&d.value===!0&&m(c.init,"data")!==void 0})||p();const _=I(e,`${s}.handlers.ts`),B=E(_);(!B.some(c=>c.type==="ImportDeclaration"&&o(c.source)&&c.source.value==="msw"&&Array.isArray(c.specifiers)&&c.specifiers.some(d=>o(d)&&o(d.imported)&&d.imported.name==="http"))||!B.some(c=>c.type==="ExportNamedDeclaration"&&o(c.declaration)&&x(c.declaration).some(d=>o(d.init)&&d.init.type==="ArrayExpression"&&Array.isArray(d.init.elements)&&d.init.elements.length>0))||!A(_,"CallExpression").some(c=>o(c.callee)&&c.callee.type==="MemberExpression"&&o(c.callee.object)&&c.callee.object.name==="http"))&&p();const M=j(e,`${s}.mdx`),J=new RegExp(`import\\s+\\*\\s+as\\s+([A-Za-z_$][\\w$]*)\\s+from\\s+['"]\\./${P(t)}\\.stories(?:\\.tsx)?['"];?\\r?\\n(?:[ \\t]*\\r?\\n)+`).exec(M);(!/import\s+\{\s*Meta\s*\}\s+from\s+['"]@storybook\/addon-docs\/blocks['"]/.test(M)||!J||!M.includes(`<Meta of={${J[1]}} />`))&&p()}function S(e){return Array.isArray(e)?`[${e.map(S).join(",")}]`:e&&typeof e=="object"?`{${Object.entries(e).sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>`${JSON.stringify(t)}:${S(r)}`).join(",")}}`:JSON.stringify(e)??"null"}function oe(e){const t=S(e);let r=2166136261;for(let s=0;s<t.length;s++)r^=t.charCodeAt(s),r=Math.imul(r,16777619);return`uxm-${(r>>>0).toString(16).padStart(8,"0")}`}function ie(e,t){let r;try{r=JSON.parse(j(e,"docs/architecture/ux-coverage-manifest.json"))}catch{p()}(!o(r)||r.schemaVersion!==1||r.manifestId!=="P201-UX-MANIFEST-01"||!Array.isArray(r.entries)||typeof r.fingerprint!="string"||Object.keys(r).sort().join(",")!=="entries,fingerprint,manifestId,schemaVersion"||r.fingerprint!==oe(r.entries))&&p();const s=new Map;for(const n of t.screens)for(const f of n.states)for(const u of n.viewports)s.set(`Screens/${n.screenId}/${f}/${u}`,{screen:n,state:f,viewport:u});r.entries.length!==s.size&&p();const i=new Set;let l="";for(const n of r.entries){(!o(n)||typeof n.storyId!="string"||i.has(n.storyId))&&p(),l&&l.localeCompare(n.storyId)>=0&&p(),l=n.storyId,Object.keys(n).sort().join(",")!=="approvalEvidenceIds,fixtureId,handlerIds,journeyIds,screenId,screenViewPath,state,storyId,viewport"&&p(),i.add(n.storyId);const f=s.get(n.storyId);(!f||n.screenId!==f.screen.screenId||n.state!==f.state||n.viewport!==f.viewport||n.screenViewPath!==f.screen.screenViewPath||!Array.isArray(n.approvalEvidenceIds)||S([...n.approvalEvidenceIds].sort())!==S([...f.screen.approvalEvidenceIds].sort())||!Array.isArray(n.journeyIds)||n.journeyIds.length<1||n.journeyIds.some(u=>typeof u!="string"||!z.test(u))||new Set(n.journeyIds).size!==n.journeyIds.length||typeof n.fixtureId!="string"||!z.test(n.fixtureId)||!Array.isArray(n.handlerIds)||n.handlerIds.length<1||n.handlerIds.some(u=>typeof u!="string"||!z.test(u))||new Set(n.handlerIds).size!==n.handlerIds.length)&&p()}}function fe(e,t){try{for(const[r,s]of[["docs/architecture/ux-design.md","P201-UX-STORYBOOK-01"],["docs/architecture/storybook-ux-contract.md","P201-UX-STORYBOOK-01"]])j(e,r).includes(s)||p();for(const r of t.screens)se(e,r,t.adapterId);ie(e,t)}catch{p()}}export{fe as validateUxCandidateSource};
+import{parse as H}from"@babel/parser";import{lstatSync as q,readFileSync as G}from"node:fs";import{join as U,posix as V}from"node:path";const Q=1024*1024,ee=1e5,P=/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;function p(){throw new Error("private-execution-ux-source-unverified")}function o(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}function k(e,r){const t=q(U(e,r));(!t.isFile()||t.isSymbolicLink()||t.size<1||t.size>Q)&&p();const s=new TextDecoder("utf-8",{fatal:!0}).decode(G(U(e,r)));return(!s.trim()||s.includes("\0"))&&p(),s}function w(e,r){const t=H(k(e,r),{sourceType:"module",plugins:["typescript","jsx"],errorRecovery:!1});let s=0;const i=[t];for(;i.length>0;){const f=i.pop();if(o(f)){++s>ee&&p();for(const[n,l]of Object.entries(f))n==="loc"||n==="tokens"||n==="comments"||n==="errors"||(Array.isArray(l)?i.push(...l):o(l)&&i.push(l))}}return t}function S(e){const r=e.program;return(!o(r)||!Array.isArray(r.body))&&p(),r.body.filter(o)}function m(e,r){if(!o(e)||e.type!=="ObjectExpression"||!Array.isArray(e.properties))return;const t=e.properties.filter(s=>o(s)&&s.type==="ObjectProperty"&&s.computed!==!0&&o(s.key)&&(s.key.name===r||s.key.value===r));return t.length===1&&o(t[0])?t[0].value:void 0}function E(e){return o(e)&&e.type==="StringLiteral"&&typeof e.value=="string"?e.value:void 0}function u(e){return o(e)&&e.type==="Identifier"&&typeof e.name=="string"?e.name:void 0}function A(e){return e.type==="VariableDeclaration"&&Array.isArray(e.declarations)?e.declarations.filter(o):[]}function b(e){let r=e;for(let t=0;t<4&&o(r)&&["TSAsExpression","TSSatisfiesExpression","TSTypeAssertion","ParenthesizedExpression"].includes(String(r.type));t++)r=r.expression;return r}function te(e,r){const t=e.flatMap(A).filter(s=>u(s.id)===r);return t.length===1?b(t[0].init):void 0}function K(e,r){for(const t of e){if(t.type!=="ExportNamedDeclaration"||!o(t.declaration))continue;const s=t.declaration;if(s.type==="FunctionDeclaration"&&o(s.id)&&s.id.name===r)return s;const i=A(s).find(f=>o(f.id)&&f.id.name===r);if(i)return b(i.init)}}function g(e,r){const t=[],s=[e];for(;s.length>0;){const i=s.pop();if(o(i)){i.type===r&&t.push(i);for(const[f,n]of Object.entries(i))f==="loc"||f==="comments"||(Array.isArray(n)?s.push(...n):o(n)&&s.push(n))}}return t}function z(e){return e.screenId.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"").slice(0,64)}function R(e){return e.split(/[^A-Za-z0-9]+/).filter(Boolean).map(r=>`${r.charAt(0).toUpperCase()}${r.slice(1).toLowerCase()}`).join("")}function Z(e,r,t){const s=[];for(const i of e){if(i.type!=="ImportDeclaration"||i.importKind==="type"||!o(i.source)||typeof i.source.value!="string"||!i.source.value.startsWith("./")&&!i.source.value.startsWith("../"))continue;const f=V.normalize(V.join(V.dirname(r),i.source.value));if(!(f!==t.screenViewPath&&f!==t.screenViewPath.replace(/\.tsx$/,"")))for(const n of Array.isArray(i.specifiers)?i.specifiers:[])o(n)&&n.type==="ImportSpecifier"&&o(n.imported)&&n.imported.name===t.screenViewExport&&n.importKind!=="type"&&o(n.local)&&typeof n.local.name=="string"&&s.push(n.local.name)}return s.length!==1&&p(),s[0]}function re(e,r){return g(e,"JSXOpeningElement").some(t=>o(t.name)&&t.name.name===r)}function j(e,r,t){const s=e.filter(i=>i.type==="ImportDeclaration"&&o(i.source)&&i.source.value===r).flatMap(i=>Array.isArray(i.specifiers)?i.specifiers:[]).filter(i=>o(i)&&i.type==="ImportSpecifier"&&o(i.imported)&&i.imported.name===t&&o(i.local)&&typeof i.local.name=="string").map(i=>i.local);return s.length===1?s[0].name:void 0}function Y(e,r,t){return o(e)&&e.type==="CallExpression"&&o(e.callee)&&e.callee.type==="MemberExpression"&&e.callee.computed!==!0&&u(e.callee.object)===r&&u(e.callee.property)===t}function ne(e,r){const t=j(r,"storybook/test","within"),s=j(r,"storybook/test","userEvent"),i=j(r,"storybook/test","expect");if(!t||!s||!i||!Array.isArray(e.params)||!o(e.params[0])||e.params[0].type!=="ObjectPattern"||!Array.isArray(e.params[0].properties)||!e.params[0].properties.some(a=>o(a)&&o(a.key)&&a.key.name==="canvasElement"&&o(a.value)&&a.value.name==="canvasElement"))return!1;const f=g(e.body,"VariableDeclarator"),n=f.filter(a=>o(a.init)&&a.init.type==="CallExpression"&&u(a.init.callee)===t&&Array.isArray(a.init.arguments)&&a.init.arguments.length===1&&u(a.init.arguments[0])==="canvasElement").map(a=>u(a.id)).filter(a=>!!a),l=f.filter(a=>n.some(O=>Y(a.init,O,"getByRole")&&Array.isArray(a.init.arguments)&&E(a.init.arguments[0])==="button"&&typeof E(m(a.init.arguments[1],"name"))=="string"&&!!E(m(a.init.arguments[1],"name"))?.trim())).map(a=>u(a.id)).filter(a=>!!a);if(l.length===0)return!1;const d=g(e.body,"AwaitExpression").map(a=>a.argument),x=d.some(a=>Y(a,s,"tab")&&Array.isArray(a.arguments)&&a.arguments.length===0),h=d.some(a=>o(a)&&a.type==="CallExpression"&&o(a.callee)&&a.callee.type==="MemberExpression"&&u(a.callee.property)==="toHaveFocus"&&o(a.callee.object)&&a.callee.object.type==="CallExpression"&&u(a.callee.object.callee)===i&&Array.isArray(a.callee.object.arguments)&&l.includes(u(a.callee.object.arguments[0])??""));return x&&h}function se(e,r){const t=b(e);if(o(t)&&["ArrowFunctionExpression","FunctionExpression"].includes(String(t.type)))return t;const s=u(t);if(!s||!o(t))return;const i=r.flatMap(d=>A(d).filter(x=>u(x.id)===s).map(x=>({kind:d.kind,declaration:x})));if(i.length!==1||i[0].kind!=="const")return;const f=i[0].declaration;if(typeof f.start!="number"||typeof t.start!="number"||f.start>=t.start)return;const n={body:r};if(g(n,"AssignmentExpression").some(d=>u(b(d.left))===s)||g(n,"UpdateExpression").some(d=>u(b(d.argument))===s))return;const l=b(f.init);return o(l)&&["ArrowFunctionExpression","FunctionExpression"].includes(String(l.type))?l:void 0}function oe(e,r,t){const s=`src/screens/${z(r)}/${z(r)}`,i=w(e,r.screenViewPath),f=K(S(i),r.screenViewExport);(!f||g(f,"JSXElement").length+g(f,"JSXFragment").length===0)&&p();const n=w(e,r.appRoutePath),l=Z(S(n),r.appRoutePath,r);re(n,l)||p();const d=`${s}.stories.tsx`,x=w(e,d),h=S(x),a=t==="storybook-react-vite"?"@storybook/react-vite":"@storybook/nextjs-vite";(!j(h,a,"Meta")||!j(h,a,"StoryObj"))&&p();const O=Z(h,d,r),D=h.filter(c=>c.type==="ExportDefaultDeclaration");D.length!==1&&p();const v=b(D[0].declaration),C=u(v)?te(h,u(v)):v;(u(m(C,"component"))!==O||E(m(C,"title"))!==`Screens/${r.screenId}`)&&p();const M=new Set;for(const c of r.states)for(const y of r.viewports){const J=`${R(c)}${R(y)}`;M.add(J);const I=K(h,J);if((!o(I)||I.type!=="ObjectExpression"||E(m(m(I,"args"),"state"))!==c||E(m(m(m(I,"parameters"),"viewport"),"defaultViewport"))!==y)&&p(),r.critical&&(c==="success"||c==="recovery")){const L=se(m(I,"play"),h);(!L||!ne(L,h))&&p()}}const F=h.filter(c=>c.type==="ExportNamedDeclaration");F.some(c=>!o(c.declaration)||A(c.declaration).length!==1||Array.isArray(c.specifiers)&&c.specifiers.length>0)&&p();const T=F.flatMap(c=>A(c.declaration)).map(c=>u(c.id)).filter(c=>!!c);(T.length!==M.size||T.some(c=>!M.has(c)))&&p();const W=w(e,`${s}.fixtures.ts`);S(W).filter(c=>c.type==="ExportNamedDeclaration").flatMap(c=>o(c.declaration)?A(c.declaration):[]).some(c=>{const y=m(c.init,"synthetic");return o(y)&&y.type==="BooleanLiteral"&&y.value===!0&&m(c.init,"data")!==void 0})||p();const X=w(e,`${s}.handlers.ts`),_=S(X);(!_.some(c=>c.type==="ImportDeclaration"&&o(c.source)&&c.source.value==="msw"&&Array.isArray(c.specifiers)&&c.specifiers.some(y=>o(y)&&o(y.imported)&&y.imported.name==="http"))||!_.some(c=>c.type==="ExportNamedDeclaration"&&o(c.declaration)&&A(c.declaration).some(y=>o(y.init)&&y.init.type==="ArrayExpression"&&Array.isArray(y.init.elements)&&y.init.elements.length>0))||!g(X,"CallExpression").some(c=>o(c.callee)&&c.callee.type==="MemberExpression"&&o(c.callee.object)&&c.callee.object.name==="http"))&&p();const N=k(e,`${s}.mdx`),B=new RegExp(`import\\s+\\*\\s+as\\s+([A-Za-z_$][\\w$]*)\\s+from\\s+['"]\\./${z(r)}\\.stories(?:\\.tsx)?['"];?\\r?\\n(?:[ \\t]*\\r?\\n)+`).exec(N);(!/import\s+\{\s*Meta\s*\}\s+from\s+['"]@storybook\/addon-docs\/blocks['"]/.test(N)||!B||!N.includes(`<Meta of={${B[1]}} />`))&&p()}function $(e){return Array.isArray(e)?`[${e.map($).join(",")}]`:e&&typeof e=="object"?`{${Object.entries(e).sort(([r],[t])=>r.localeCompare(t)).map(([r,t])=>`${JSON.stringify(r)}:${$(t)}`).join(",")}}`:JSON.stringify(e)??"null"}function ie(e){const r=$(e);let t=2166136261;for(let s=0;s<r.length;s++)t^=r.charCodeAt(s),t=Math.imul(t,16777619);return`uxm-${(t>>>0).toString(16).padStart(8,"0")}`}function ae(e,r){let t;try{t=JSON.parse(k(e,"docs/architecture/ux-coverage-manifest.json"))}catch{p()}(!o(t)||t.schemaVersion!==1||t.manifestId!=="P201-UX-MANIFEST-01"||!Array.isArray(t.entries)||typeof t.fingerprint!="string"||Object.keys(t).sort().join(",")!=="entries,fingerprint,manifestId,schemaVersion")&&p(),t.fingerprint!==ie(t.entries)&&p();const s=new Map;for(const n of r.screens)for(const l of n.states)for(const d of n.viewports)s.set(`Screens/${n.screenId}/${l}/${d}`,{screen:n,state:l,viewport:d});t.entries.length!==s.size&&p();const i=new Set;let f="";for(const n of t.entries){(!o(n)||typeof n.storyId!="string"||i.has(n.storyId))&&p(),f&&f.localeCompare(n.storyId)>=0&&p(),f=n.storyId,Object.keys(n).sort().join(",")!=="approvalEvidenceIds,fixtureId,handlerIds,journeyIds,screenId,screenViewPath,state,storyId,viewport"&&p(),i.add(n.storyId);const l=s.get(n.storyId);(!l||n.screenId!==l.screen.screenId||n.state!==l.state||n.viewport!==l.viewport||n.screenViewPath!==l.screen.screenViewPath||!Array.isArray(n.approvalEvidenceIds)||$([...n.approvalEvidenceIds].sort())!==$([...l.screen.approvalEvidenceIds].sort())||!Array.isArray(n.journeyIds)||n.journeyIds.length<1||n.journeyIds.some(d=>typeof d!="string"||!P.test(d))||new Set(n.journeyIds).size!==n.journeyIds.length||typeof n.fixtureId!="string"||!P.test(n.fixtureId)||!Array.isArray(n.handlerIds)||n.handlerIds.length<1||n.handlerIds.some(d=>typeof d!="string"||!P.test(d))||new Set(n.handlerIds).size!==n.handlerIds.length)&&p()}}function de(e,r){try{for(const[t,s]of[["docs/architecture/ux-design.md","P201-UX-STORYBOOK-01"],["docs/architecture/storybook-ux-contract.md","P201-UX-STORYBOOK-01"]])k(e,t).includes(s)||p();for(const t of r.screens)oe(e,t,r.adapterId);ae(e,r)}catch{p()}}export{de as validateUxCandidateSource};

package/packages/client/dist/yolo/change-evidence-collector.d.ts

@@ -1,4 +1,4 @@
-import { type YoloChangeEvidenceV1 } from '../../../shared/dist/yolo/change-evidence.js';
+import { type YoloChangeEvidence } from '../../../shared/dist/yolo/change-evidence.js';
 /** Reacquire only an expired setup lease for this exact story through P207's CAS boundary. */
 export declare function reconcileYoloChangeEvidenceLease(options: {
     readonly projectRoot: string;
@@ -11,4 +11,4 @@ export declare function collectYoloChangeEvidence(options: {
     readonly expectedHeadSha: string;
     readonly storyId?: string;
     readonly epicId?: string;
-}): YoloChangeEvidenceV1;
+}): YoloChangeEvidence;

package/packages/client/dist/yolo/change-evidence-collector.js

@@ -1 +1 @@
-import{execFileSync as p}from"node:child_process";import{realpathSync as f}from"node:fs";import{createYoloChangeEvidenceV1 as w}from"../../../shared/dist/yolo/change-evidence.js";import{readGitLifecycleRuntimeSync as u}from"../git/git-lifecycle-store.js";async function j(e){let r;try{r=u(e.projectRoot,{required:!0}).epics[e.epicId]?.branch_lease}catch(c){if(c instanceof Error&&c.message==="git-lifecycle-runtime-missing")return;throw new Error("yolo-change-evidence-unavailable")}if(r==null)return;if(typeof r!="object"||Array.isArray(r)||r.ownerStoryId!==e.storyId||typeof r.expiresAt!="string")throw new Error("yolo-change-evidence-unavailable");const n=Date.parse(r.expiresAt);if(!Number.isFinite(n))throw new Error("yolo-change-evidence-unavailable");if(n>Date.now())return;if(typeof r.sessionId!="string"||!/^setup-[a-f0-9]{64}$/.test(r.sessionId)||r.idempotencyKey!==r.sessionId)throw new Error("yolo-change-evidence-unavailable");const{prepareDirectYoloSetup:o}=await import("../git/direct-yolo-checkpoint.js"),i=await o(e);if(!i.ok||i.value.storyId!==e.storyId||i.value.epicId!==e.epicId||Date.parse(i.value.leaseExpiresAt)<=Date.now())throw new Error("yolo-change-evidence-unavailable")}function t(e,r){try{return p("git",["-C",e,...r],{encoding:"utf8",timeout:3e3,maxBuffer:1024*1024,stdio:["ignore","pipe","ignore"]})}catch{throw new Error("yolo-change-evidence-unavailable")}}function x(e){if(!/^[A-Za-z0-9][A-Za-z0-9_./-]{0,119}$/.test(e.defaultBranch)||e.defaultBranch.includes(".."))throw new Error("yolo-change-evidence-unavailable");const r=t(e.projectRoot,["rev-parse","--show-toplevel"]).trim();if(f(r)!==f(e.projectRoot))throw new Error("yolo-change-evidence-unavailable");const n=t(e.projectRoot,["rev-parse","HEAD"]).trim();if(n!==e.expectedHeadSha)throw new Error("yolo-change-evidence-stale");let o,i=!1,c=null;if(e.storyId&&e.epicId)try{const a=u(e.projectRoot).epics[e.epicId],l=a?.branch_lease,h=t(e.projectRoot,["symbolic-ref","--quiet","--short","HEAD"]).trim();if(a?.branch_mode==="epic"&&a.execution_branch===h&&(c=h),l&&typeof l=="object"&&!Array.isArray(l)){const d=l;if(d.ownerStoryId!==e.storyId||typeof d.expiresAt!="string"||Date.parse(d.expiresAt)<=Date.now()||c===null)throw new Error("yolo-change-evidence-unavailable");i=!0}}catch{throw new Error("yolo-change-evidence-unavailable")}if(i)o=n;else{const s=c===null?"":t(e.projectRoot,["ls-remote","--heads","origin",`refs/heads/${c}`]).trim();if(s){const a=/^([a-f0-9]{40})\trefs\/heads\/([^\n]+)$/.exec(s);if(!a||a[2]!==c||t(e.projectRoot,["merge-base","HEAD",a[1]]).trim()!==a[1])throw new Error("yolo-change-evidence-unavailable");o=a[1]}else try{o=t(e.projectRoot,["merge-base","HEAD",e.defaultBranch]).trim()}catch{o=t(e.projectRoot,["merge-base","HEAD",`refs/remotes/origin/${e.defaultBranch}`]).trim()}}const y=t(e.projectRoot,["diff","--name-only","-z",o,"--"]).split("\0").filter(Boolean),m=t(e.projectRoot,["ls-files","--others","--exclude-standard","-z"]).split("\0").filter(Boolean),v=w({baseSha:o,headSha:n,changedPaths:[...y,...m]});if(t(e.projectRoot,["rev-parse","HEAD"]).trim()!==n)throw new Error("yolo-change-evidence-stale");return v}export{x as collectYoloChangeEvidence,j as reconcileYoloChangeEvidenceLease};
+import{execFileSync as p}from"node:child_process";import{realpathSync as f}from"node:fs";import{createYoloChangeEvidence as w}from"../../../shared/dist/yolo/change-evidence.js";import{readGitLifecycleRuntimeSync as u}from"../git/git-lifecycle-store.js";async function j(e){let r;try{r=u(e.projectRoot,{required:!0}).epics[e.epicId]?.branch_lease}catch(c){if(c instanceof Error&&c.message==="git-lifecycle-runtime-missing")return;throw new Error("yolo-change-evidence-unavailable")}if(r==null)return;if(typeof r!="object"||Array.isArray(r)||r.ownerStoryId!==e.storyId||typeof r.expiresAt!="string")throw new Error("yolo-change-evidence-unavailable");const n=Date.parse(r.expiresAt);if(!Number.isFinite(n))throw new Error("yolo-change-evidence-unavailable");if(n>Date.now())return;if(typeof r.sessionId!="string"||!/^setup-[a-f0-9]{64}$/.test(r.sessionId)||r.idempotencyKey!==r.sessionId)throw new Error("yolo-change-evidence-unavailable");const{prepareDirectYoloSetup:o}=await import("../git/direct-yolo-checkpoint.js"),i=await o(e);if(!i.ok||i.value.storyId!==e.storyId||i.value.epicId!==e.epicId||Date.parse(i.value.leaseExpiresAt)<=Date.now())throw new Error("yolo-change-evidence-unavailable")}function t(e,r){try{return p("git",["-C",e,...r],{encoding:"utf8",timeout:3e3,maxBuffer:1024*1024,stdio:["ignore","pipe","ignore"]})}catch{throw new Error("yolo-change-evidence-unavailable")}}function x(e){if(!/^[A-Za-z0-9][A-Za-z0-9_./-]{0,119}$/.test(e.defaultBranch)||e.defaultBranch.includes(".."))throw new Error("yolo-change-evidence-unavailable");const r=t(e.projectRoot,["rev-parse","--show-toplevel"]).trim();if(f(r)!==f(e.projectRoot))throw new Error("yolo-change-evidence-unavailable");const n=t(e.projectRoot,["rev-parse","HEAD"]).trim();if(n!==e.expectedHeadSha)throw new Error("yolo-change-evidence-stale");let o,i=!1,c=null;if(e.storyId&&e.epicId)try{const a=u(e.projectRoot).epics[e.epicId],l=a?.branch_lease,h=t(e.projectRoot,["symbolic-ref","--quiet","--short","HEAD"]).trim();if(a?.branch_mode==="epic"&&a.execution_branch===h&&(c=h),l&&typeof l=="object"&&!Array.isArray(l)){const d=l;if(d.ownerStoryId!==e.storyId||typeof d.expiresAt!="string"||Date.parse(d.expiresAt)<=Date.now()||c===null)throw new Error("yolo-change-evidence-unavailable");i=!0}}catch{throw new Error("yolo-change-evidence-unavailable")}if(i)o=n;else{const s=c===null?"":t(e.projectRoot,["ls-remote","--heads","origin",`refs/heads/${c}`]).trim();if(s){const a=/^([a-f0-9]{40})\trefs\/heads\/([^\n]+)$/.exec(s);if(!a||a[2]!==c||t(e.projectRoot,["merge-base","HEAD",a[1]]).trim()!==a[1])throw new Error("yolo-change-evidence-unavailable");o=a[1]}else try{o=t(e.projectRoot,["merge-base","HEAD",e.defaultBranch]).trim()}catch{o=t(e.projectRoot,["merge-base","HEAD",`refs/remotes/origin/${e.defaultBranch}`]).trim()}}const y=t(e.projectRoot,["diff","--name-only","-z",o,"--"]).split("\0").filter(Boolean),m=t(e.projectRoot,["ls-files","--others","--exclude-standard","-z"]).split("\0").filter(Boolean),v=w({baseSha:o,headSha:n,changedPaths:[...y,...m]});if(t(e.projectRoot,["rev-parse","HEAD"]).trim()!==n)throw new Error("yolo-change-evidence-stale");return v}export{x as collectYoloChangeEvidence,j as reconcileYoloChangeEvidenceLease};

package/packages/client/dist/yolo/spec-envelope-collector.js

@@ -1,5 +1,5 @@
-import{execFileSync as L}from"node:child_process";import{existsSync as S,readFileSync as T,realpathSync as w,statSync as E}from"node:fs";import{join as y,sep as b}from"node:path";import{createYoloSpecEnvelopeV1 as x,YOLO_SPEC_ARTIFACT_LIMIT_BYTES as C,YOLO_SPEC_MAX_ARTIFACTS as R,YOLO_SPEC_TOTAL_LIMIT_BYTES as g}from"../../../shared/dist/yolo/spec-envelope.js";import{inspectFrontmatterContext as $}from"../../../shared/dist/frontmatter-context-contract.js";const O=["core/templates/specs/feature-spec-template.md","core/templates/specs/architecture-spec-template.md","core/templates/specs/contract-spec-template.md","core/templates/specs/story-spec-template.md","core/templates/specs/traceability-matrix-template.md"],W=/(?:^|[\s([`'";])((?:docs\/(?:stories|epics|specs|architecture|examples)\/|core\/templates\/specs\/)[A-Za-z0-9_./-]+\.(?:md|mdx|feature))(?:$|[\s)\]`'",;])/gm;function I(e){return e.startsWith("core/templates/")?"template":e.startsWith("docs/epics/")?"epic":e.startsWith("docs/stories/")&&e.endsWith(".story.md")?"story":e.toLowerCase().includes("adr")?"adr":e.toLowerCase().includes("contract")?"contract":e.toLowerCase().includes("nfr")?"nfr":e.endsWith(".feature")?"bdd":e.toLowerCase().includes("traceability")?"traceability":e.startsWith("docs/examples/")?"example":"spec"}function P(e){return[...new Set([...e.matchAll(W)].map(r=>r[1]).filter(r=>!!r))].sort()}function i(e,r){const c=w(e);let o;try{o=w(y(c,r))}catch{throw new Error("yolo-spec-envelope-required")}if(!o.startsWith(`${c}${b}`))throw new Error("yolo-spec-envelope-path-out-of-scope");if(!E(o).isFile())throw new Error("yolo-spec-envelope-unsafe");if(E(o).size>C)throw new Error("yolo-spec-envelope-too-large");return T(o,"utf8")}function f(e,r){const o=$(e,{context:r==="story"?"story-target":"epic-target",explicitlySelected:!0});if(o.status==="malformed"||o.status==="oversized")throw new Error("yolo-spec-envelope-unsafe");if(o.status==="absent")return e;const a=e.match(/^---\r?\n[\s\S]*?\r?\n---\r?\n/);if(!a)throw new Error("yolo-spec-envelope-unsafe");return`---
+import{execFileSync as L}from"node:child_process";import{existsSync as S,readFileSync as T,realpathSync as w,statSync as E}from"node:fs";import{join as f,sep as b}from"node:path";import{createYoloSpecEnvelopeV1 as x,YOLO_SPEC_ARTIFACT_LIMIT_BYTES as C,YOLO_SPEC_MAX_ARTIFACTS as R,YOLO_SPEC_TOTAL_LIMIT_BYTES as g}from"../../../shared/dist/yolo/spec-envelope.js";import{inspectFrontmatterContext as $}from"../../../shared/dist/frontmatter-context-contract.js";const O=["core/templates/specs/feature-spec-template.md","core/templates/specs/architecture-spec-template.md","core/templates/specs/contract-spec-template.md","core/templates/specs/story-spec-template.md","core/templates/specs/traceability-matrix-template.md"],W=/(?:^|[\s([`'";])((?:docs\/(?:stories|epics|specs|architecture|examples)\/|core\/templates\/specs\/)[A-Za-z0-9_./-]+\.(?:md|mdx|feature))(?:$|[\s)\]`'",;])/gm;function I(e){return e.startsWith("core/templates/")?"template":e.startsWith("docs/epics/")?"epic":e.startsWith("docs/stories/")&&e.endsWith(".story.md")?"story":e.endsWith(".rtm.md")?"traceability":e.toLowerCase().includes("adr")?"adr":e.toLowerCase().includes("contract")?"contract":e.toLowerCase().includes("nfr")?"nfr":e.endsWith(".feature")?"bdd":e.toLowerCase().includes("traceability")?"traceability":e.startsWith("docs/examples/")?"example":"spec"}function P(e){return[...new Set([...e.matchAll(W)].map(r=>r[1]).filter(r=>!!r))].sort()}function i(e,r){const c=w(e);let o;try{o=w(f(c,r))}catch{throw new Error("yolo-spec-envelope-required")}if(!o.startsWith(`${c}${b}`))throw new Error("yolo-spec-envelope-path-out-of-scope");if(!E(o).isFile())throw new Error("yolo-spec-envelope-unsafe");if(E(o).size>C)throw new Error("yolo-spec-envelope-too-large");return T(o,"utf8")}function m(e,r){const o=$(e,{context:r==="story"?"story-target":"epic-target",explicitlySelected:!0});if(o.status==="malformed"||o.status==="oversized")throw new Error("yolo-spec-envelope-unsafe");if(o.status==="absent")return e;const a=e.match(/^---\r?\n[\s\S]*?\r?\n---\r?\n/);if(!a)throw new Error("yolo-spec-envelope-unsafe");return`---
 ${Object.entries(o.metadata).map(([s,l])=>`${s}: ${JSON.stringify(l)}`).join(`
 `)}
 ---
-${e.slice(a[0].length)}`}function v(e){try{return L("git",["-C",e,"rev-parse","HEAD"],{encoding:"utf8",timeout:2e3,stdio:["ignore","pipe","ignore"]}).trim()}catch{throw new Error("yolo-spec-envelope-stale")}}function M(e){const r=`docs/stories/${e.storyId}.story.md`,c=`docs/epics/epic-${e.epicId}.md`,o=e.headSha??v(e.projectRoot),a=f(i(e.projectRoot,r),"story"),m=f(i(e.projectRoot,c),"epic"),s=[{kind:"story",path:r,content:a},{kind:"epic",path:c,content:m}],l=P(a),u=new Set([`docs/stories/${e.storyId}.spec.md`,`docs/stories/${e.storyId}.tasks.md`,`docs/stories/${e.storyId}.rtm.md`]),_=[...l.filter(t=>u.has(t)),...l.filter(t=>!u.has(t))];let p=s.reduce((t,n)=>t+Buffer.byteLength(n.content,"utf8"),0),h=0;for(const t of _){if(t===r||t===c||!S(y(e.projectRoot,t)))continue;if(t.startsWith("docs/stories/")&&t.endsWith(".story.md")||t.startsWith("docs/epics/"))throw new Error("yolo-spec-envelope-target-mismatch");const n=i(e.projectRoot,t),d=Buffer.byteLength(n,"utf8");if(s.length>=R||p+d>g){if(u.has(t))throw new Error("yolo-spec-envelope-too-large");h+=1;continue}s.push({kind:I(t),path:t,content:n}),p+=d}h&&e.onOmittedReferences?.(h);for(const t of O){if(t===r||t===c||l.includes(t)||!S(y(e.projectRoot,t)))continue;const n=i(e.projectRoot,t),d=Buffer.byteLength(n,"utf8");s.length>=R||p+d>g||(s.push({kind:I(t),path:t,content:n}),p+=d)}const j=x({storyId:e.storyId,epicId:e.epicId,targetPath:r,inputSha256:e.inputSha256,headSha:o,collectedAt:e.collectedAt??new Date().toISOString(),artifacts:s}),A=e.headSha??v(e.projectRoot);if(o!==A||f(i(e.projectRoot,r),"story")!==a||f(i(e.projectRoot,c),"epic")!==m||s.some(t=>t.kind!=="story"&&t.kind!=="epic"&&i(e.projectRoot,t.path)!==t.content))throw new Error("yolo-spec-envelope-stale");return j}export{M as collectYoloSpecEnvelope};
+${e.slice(a[0].length)}`}function j(e){try{return L("git",["-C",e,"rev-parse","HEAD"],{encoding:"utf8",timeout:2e3,stdio:["ignore","pipe","ignore"]}).trim()}catch{throw new Error("yolo-spec-envelope-stale")}}function M(e){const r=`docs/stories/${e.storyId}.story.md`,c=`docs/epics/epic-${e.epicId}.md`,o=e.headSha??j(e.projectRoot),a=m(i(e.projectRoot,r),"story"),u=m(i(e.projectRoot,c),"epic"),s=[{kind:"story",path:r,content:a},{kind:"epic",path:c,content:u}],l=new Set([`docs/stories/${e.storyId}.spec.md`,`docs/stories/${e.storyId}.tasks.md`,`docs/stories/${e.storyId}.rtm.md`]),h=[...new Set([...P(a),...[...l].filter(t=>S(f(e.projectRoot,t)))])].sort(),v=[...h.filter(t=>l.has(t)),...h.filter(t=>!l.has(t))];let p=s.reduce((t,n)=>t+Buffer.byteLength(n.content,"utf8"),0),y=0;for(const t of v){if(t===r||t===c||!S(f(e.projectRoot,t)))continue;if(t.startsWith("docs/stories/")&&t.endsWith(".story.md")||t.startsWith("docs/epics/"))throw new Error("yolo-spec-envelope-target-mismatch");const n=i(e.projectRoot,t),d=Buffer.byteLength(n,"utf8");if(s.length>=R||p+d>g){if(l.has(t))throw new Error("yolo-spec-envelope-too-large");y+=1;continue}s.push({kind:I(t),path:t,content:n}),p+=d}y&&e.onOmittedReferences?.(y);for(const t of O){if(t===r||t===c||h.includes(t)||!S(f(e.projectRoot,t)))continue;const n=i(e.projectRoot,t),d=Buffer.byteLength(n,"utf8");s.length>=R||p+d>g||(s.push({kind:I(t),path:t,content:n}),p+=d)}const _=x({storyId:e.storyId,epicId:e.epicId,targetPath:r,inputSha256:e.inputSha256,headSha:o,collectedAt:e.collectedAt??new Date().toISOString(),artifacts:s}),A=e.headSha??j(e.projectRoot);if(o!==A||m(i(e.projectRoot,r),"story")!==a||m(i(e.projectRoot,c),"epic")!==u||s.some(t=>t.kind!=="story"&&t.kind!=="epic"&&i(e.projectRoot,t.path)!==t.content))throw new Error("yolo-spec-envelope-stale");return _}export{M as collectYoloSpecEnvelope};

package/packages/shared/dist/invocation/index.js

@@ -177,10 +177,12 @@ export function lexInvocationEnvelope(input) {
         if (escaped) {
             const allowed = char === '\\' || char === ' ' || char === '\t' || char === '\r' || char === '\n'
                 || (quote === 'single' && char === "'") || (quote === 'double' && char === '"');
-            if (!allowed)
+            // A quoted Windows path such as src\win\async.c is literal user text.
+            // Keep unquoted shell-shaped escapes fail-closed.
+            if (!allowed && !quote)
                 return { ok: false, reason: 'unsupported_escape', tokenCount: tokens.length };
             startSegment(i - 1, quote);
-            value += char;
+            value += allowed ? char : `\\${char}`;
             escaped = false;
             continue;
         }

package/packages/shared/dist/invocation/packed-invoke.d.ts

@@ -0,0 +1,12 @@
+export declare const PACKED_INVOKE_MAX_UNCOMPRESSED_BYTES: number;
+interface PackedInvokeEnvelope {
+    readonly schemaVersion: 'PackedInvokeEnvelope/1';
+    readonly compression: 'gzip';
+    readonly uncompressedBytes: number;
+    readonly sha256: string;
+    readonly payload: string;
+}
+/** Keep the signed HTTP body below 256 KiB without changing the invoke JSON. */
+export declare function packInvokeEnvelope(body: Record<string, unknown>): PackedInvokeEnvelope;
+export declare function unpackInvokeEnvelope(value: unknown): Record<string, unknown>;
+export {};

package/packages/shared/dist/invocation/packed-invoke.js

@@ -0,0 +1,58 @@
+import { createHash } from 'node:crypto';
+import { gzipSync, gunzipSync } from 'node:zlib';
+export const PACKED_INVOKE_MAX_UNCOMPRESSED_BYTES = 512 * 1024;
+const PACKED_INVOKE_MAX_COMPRESSED_BYTES = 192 * 1024;
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+/** Keep the signed HTTP body below 256 KiB without changing the invoke JSON. */
+export function packInvokeEnvelope(body) {
+    const raw = Buffer.from(JSON.stringify(body), 'utf8');
+    if (raw.length > PACKED_INVOKE_MAX_UNCOMPRESSED_BYTES)
+        throw new Error('packed-invoke-too-large');
+    const compressed = gzipSync(raw, { level: 6 });
+    if (compressed.length > PACKED_INVOKE_MAX_COMPRESSED_BYTES)
+        throw new Error('packed-invoke-too-large');
+    return {
+        schemaVersion: 'PackedInvokeEnvelope/1',
+        compression: 'gzip',
+        uncompressedBytes: raw.length,
+        sha256: createHash('sha256').update(raw).digest('hex'),
+        payload: compressed.toString('base64'),
+    };
+}
+export function unpackInvokeEnvelope(value) {
+    if (!isRecord(value) || Object.keys(value).sort().join(',') !==
+        'compression,payload,schemaVersion,sha256,uncompressedBytes'
+        || value.schemaVersion !== 'PackedInvokeEnvelope/1' || value.compression !== 'gzip'
+        || !Number.isSafeInteger(value.uncompressedBytes) || value.uncompressedBytes < 1
+        || value.uncompressedBytes > PACKED_INVOKE_MAX_UNCOMPRESSED_BYTES
+        || typeof value.sha256 !== 'string' || !/^[a-f0-9]{64}$/.test(value.sha256)
+        || typeof value.payload !== 'string' || value.payload.length > Math.ceil(PACKED_INVOKE_MAX_COMPRESSED_BYTES * 4 / 3) + 4
+        || !/^[A-Za-z0-9+/]+={0,2}$/.test(value.payload))
+        throw new Error('packed-invoke-invalid');
+    const compressed = Buffer.from(value.payload, 'base64');
+    if (compressed.length > PACKED_INVOKE_MAX_COMPRESSED_BYTES
+        || compressed.toString('base64') !== value.payload)
+        throw new Error('packed-invoke-invalid');
+    let raw;
+    try {
+        raw = gunzipSync(compressed, { maxOutputLength: PACKED_INVOKE_MAX_UNCOMPRESSED_BYTES });
+    }
+    catch {
+        throw new Error('packed-invoke-invalid');
+    }
+    if (raw.length !== value.uncompressedBytes
+        || createHash('sha256').update(raw).digest('hex') !== value.sha256)
+        throw new Error('packed-invoke-invalid');
+    let parsed;
+    try {
+        parsed = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(raw));
+    }
+    catch {
+        throw new Error('packed-invoke-invalid');
+    }
+    if (!isRecord(parsed) || parsed.schemaVersion === 'PackedInvokeEnvelope/1')
+        throw new Error('packed-invoke-invalid');
+    return parsed;
+}

package/packages/shared/dist/invocation/packed-invoke.test.d.ts

@@ -0,0 +1 @@
+export {};

package/packages/shared/dist/invocation/packed-invoke.test.js

@@ -0,0 +1,21 @@
+import { describe, expect, it } from 'vitest';
+import { packInvokeEnvelope, unpackInvokeEnvelope } from './packed-invoke.js';
+describe('signed invoke transport packing', () => {
+    it('round trips a large structural request within the HTTP body limit', () => {
+        const original = { args: '*yolo @docs/stories/P222.26.story.md', stateSnapshot: {
+                stories: Object.fromEntries(Array.from({ length: 27 }, (_, index) => [
+                    `P222.${index + 1}`, { checkpoint: { qaReceipt: 'verified'.repeat(1300), headSha: String(index) } },
+                ])),
+            } };
+        expect(Buffer.byteLength(JSON.stringify(original))).toBeGreaterThan(262_144);
+        const packed = packInvokeEnvelope(original);
+        expect(Buffer.byteLength(JSON.stringify(packed))).toBeLessThan(262_144);
+        expect(unpackInvokeEnvelope(packed)).toEqual(original);
+    });
+    it('rejects modified bytes, extra fields, and excess expansion', () => {
+        const packed = packInvokeEnvelope({ args: '*status' });
+        expect(() => unpackInvokeEnvelope({ ...packed, sha256: '0'.repeat(64) })).toThrow('packed-invoke-invalid');
+        expect(() => unpackInvokeEnvelope({ ...packed, injected: true })).toThrow('packed-invoke-invalid');
+        expect(() => packInvokeEnvelope({ data: 'x'.repeat(512 * 1024) })).toThrow('packed-invoke-too-large');
+    });
+});

package/packages/shared/dist/package.json

@@ -0,0 +1 @@
+{"type":"module"}

package/packages/shared/dist/planning/diagnosis-state.js

@@ -9,6 +9,8 @@ function record(value) {
     return value !== null && typeof value === 'object' && !Array.isArray(value);
 }
 const SCALARS = ['goal', 'problem', 'desiredOutcome', 'rawIntent'];
+/** Original selected input is preserved; ordinary summary fields stay at 512. */
+export const PLANNING_RAW_INTENT_MAX_CHARS = 4096;
 const LISTS = ['context', 'users', 'surfaces', 'constraints', 'assumptions', 'risks', 'nonGoals',
     'validationExpectations', 'debtRefs', 'repositoryEvidencePaths', 'journeyIds', 'screenIds',
     'storybookStoryIds', 'backendContractIds', 'featureBlockerIds', 'remediationRefs'];
@@ -39,8 +41,9 @@ export function canonicalPlanningIntake(value) {
     allowedKeys(value, [...SCALARS, ...LISTS, ...BOOLEANS, 'examples', 'contracts']);
     const result = {};
     for (const key of SCALARS)
-        if (value[key] !== undefined)
-            result[key] = safeText(value[key]);
+        if (value[key] !== undefined) {
+            result[key] = safeText(value[key], key === 'rawIntent' ? PLANNING_RAW_INTENT_MAX_CHARS : 512);
+        }
     for (const key of LISTS)
         if (value[key] !== undefined) {
             const entries = value[key];

package/packages/shared/dist/private-qa-structural-admission.js

@@ -0,0 +1,14 @@
+export function isPrivateQaStructuralAdmission(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const r = value, checks = r.checks;
+    return Object.keys(r).sort().join('|') === ['schemaVersion', 'kind', 'stepId', 'generationId', 'graphRevision', 'topologyGenerationId', 'tier', 'checks', 'publicSafe'].sort().join('|')
+        && r.schemaVersion === 1 && r.kind === 'server-private-qa-structural-admission' && r.stepId === 'step-8721319d'
+        && typeof r.generationId === 'string' && /^sha256:[a-f0-9]{64}$/.test(r.generationId)
+        && typeof r.graphRevision === 'string' && /^[a-f0-9]{64}$/.test(r.graphRevision)
+        && typeof r.topologyGenerationId === 'string' && /^sha256:[a-f0-9]{64}$/.test(r.topologyGenerationId)
+        && ['free', 'pro', 'enterprise'].includes(String(r.tier)) && r.publicSafe === true
+        && !!checks && typeof checks === 'object' && !Array.isArray(checks)
+        && Object.keys(checks).sort().join('|') === ['classifiedAssetDelivery', 'licensedCommandAdmission', 'registeredStatusMapping', 'prerequisiteStateAdmitted'].sort().join('|')
+        && Object.values(checks).every(result => result === true);
+}

package/packages/shared/dist/private-yolo-predecessor-decision.js

@@ -0,0 +1,32 @@
+export function isPrivateQaSkippedPredecessors(value) {
+    if (!Array.isArray(value) || value.length > 2)
+        return false;
+    const ids = [];
+    for (const item of value) {
+        if (isPrivateYoloSkippedPredecessors([item])) {
+            ids.push(item.stepId);
+            continue;
+        }
+        if (!item || typeof item !== 'object' || Array.isArray(item))
+            return false;
+        const r = item;
+        if (Object.keys(r).sort().join('|') !== ['stepId', 'featureGate', 'reason', 'tier', 'publicSafe'].sort().join('|')
+            || r.stepId !== 'step-b2fe7cb5' || r.featureGate !== 'validate-tests'
+            || r.reason !== 'subscription-tier' || r.tier !== 'free' || r.publicSafe !== true)
+            return false;
+        ids.push(r.stepId);
+    }
+    return new Set(ids).size === ids.length && (value.length < 2
+        || ids[0] === 'step-a8ce5c64' && ids[1] === 'step-b2fe7cb5' && value[0].tier === 'free');
+}
+export function isPrivateYoloSkippedPredecessors(value) {
+    return Array.isArray(value) && value.length <= 1 && value.every(item => {
+        if (!item || typeof item !== 'object' || Array.isArray(item))
+            return false;
+        const r = item;
+        return Object.keys(r).sort().join('|') === ['stepId', 'featureFlagId', 'enabled', 'tier', 'publicSafe'].sort().join('|')
+            && r.stepId === 'step-a8ce5c64' && r.featureFlagId === 'property-testing'
+            && typeof r.enabled === 'boolean' && ['free', 'pro', 'enterprise'].includes(String(r.tier))
+            && (r.enabled === false || r.tier === 'free') && r.publicSafe === true;
+    });
+}

package/packages/shared/dist/project-memory-targets.js

@@ -0,0 +1,243 @@
+/**
+ * Canonical project-memory targets for agent platforms.
+ *
+ * Always-loaded memory files should stay compact: universal laws, active context,
+ * and references to deeper docs. They must not become full architecture dumps.
+ */
+function projectFileRefs(...paths) {
+    return paths.map((path) => ({ scope: 'project', path }));
+}
+export const CANONICAL_PROJECT_MEMORY_SOURCE = 'NEOCORTEX.md';
+const MANDATORY_SEMANTIC_SYMLINK = {
+    canonicalSource: CANONICAL_PROJECT_MEMORY_SOURCE,
+    semanticFileRequired: true,
+    symlinkBacked: true,
+    wrapperAllowed: false,
+    includeFallbackAllowed: false,
+    requiresWrapperPreservation: false,
+    fallbackIsCompatibilityRemediation: true,
+    policy: 'mandatory-semantic-symlink',
+    notes: 'Semantic platform memory file must resolve to NEOCORTEX.md through a symlink; do not replace it with an unrelated wrapper or copied frontmatter.',
+};
+const SYMLINK_BACKED_WRAPPER = {
+    canonicalSource: CANONICAL_PROJECT_MEMORY_SOURCE,
+    semanticFileRequired: true,
+    symlinkBacked: true,
+    wrapperAllowed: true,
+    includeFallbackAllowed: false,
+    requiresWrapperPreservation: true,
+    fallbackIsCompatibilityRemediation: true,
+    policy: 'symlink-backed-wrapper',
+    notes: 'Platform wrapper/frontmatter is allowed only when the semantic memory payload remains symlink-backed by NEOCORTEX.md.',
+};
+const SAFE_INCLUDE_FALLBACK = {
+    canonicalSource: CANONICAL_PROJECT_MEMORY_SOURCE,
+    semanticFileRequired: true,
+    symlinkBacked: true,
+    wrapperAllowed: true,
+    includeFallbackAllowed: true,
+    requiresWrapperPreservation: true,
+    fallbackIsCompatibilityRemediation: true,
+    policy: 'safe-include-fallback',
+    notes: 'Use a safe include/import only for platforms that cannot consume symlinks directly; the include must resolve back to NEOCORTEX.md.',
+};
+function bidirectionalReference(requirement) {
+    return {
+        canonicalSource: CANONICAL_PROJECT_MEMORY_SOURCE,
+        resolvesVia: requirement.policy,
+        feedbackTrigger: '*update-memory',
+        guidance: 'Treat NEOCORTEX.md as canonical project memory; consult it before platform-specific memory, and run *update-memory when durable project context changes should flow back to the canonical source.',
+    };
+}
+export const PROJECT_MEMORY_TARGET_IDS = [
+    'claude-code',
+    'codex',
+    'grok',
+    'gemini-cli',
+    'antigravity',
+    'vscode',
+    'cursor',
+    'opencode',
+    'openclaw',
+    'kimi',
+    'github-copilot-cli',
+];
+export const PROJECT_MEMORY_TARGETS = {
+    canonical: {
+        targetId: 'canonical',
+        platformName: 'Neocortex Canonical Memory',
+        canonicalSource: CANONICAL_PROJECT_MEMORY_SOURCE,
+        primaryFile: CANONICAL_PROJECT_MEMORY_SOURCE,
+        secondaryFiles: projectFileRefs('AGENTS.md', 'CLAUDE.md', 'GEMINI.md'),
+        ownedBlockName: 'NEOCORTEX-MEMORY',
+        templateKind: 'neocortex-md',
+        budget: { maxLines: 220, maxBytes: 18_000 },
+        linkRequirement: MANDATORY_SEMANTIC_SYMLINK,
+        bidirectionalReference: bidirectionalReference(MANDATORY_SEMANTIC_SYMLINK),
+        requiresWrapperPreservation: false,
+        notes: 'Canonical compact project memory source for platform symlinks and wrappers. Store only summaries, indexes, and links to architecture docs here.',
+    },
+    'claude-code': {
+        targetId: 'claude-code',
+        platformName: 'Claude Code',
+        canonicalSource: CANONICAL_PROJECT_MEMORY_SOURCE,
+        primaryFile: 'CLAUDE.md',
+        secondaryFiles: projectFileRefs('.claude/agents/neocortex.md'),
+        ownedBlockName: 'NEOCORTEX-MEMORY',
+        templateKind: 'claude-md',
+        budget: { maxLines: 320, maxBytes: 28_000 },
+        linkRequirement: MANDATORY_SEMANTIC_SYMLINK,
+        bidirectionalReference: bidirectionalReference(MANDATORY_SEMANTIC_SYMLINK),
+        requiresWrapperPreservation: false,
+        notes: 'Claude Code project memory. Resolve to NEOCORTEX.md; keep root content concise and link deeper docs with @path references.',
+    },
+    codex: {
+        targetId: 'codex',
+        platformName: 'Codex CLI',
+        canonicalSource: CANONICAL_PROJECT_MEMORY_SOURCE,
+        primaryFile: 'AGENTS.md',
+        secondaryFiles: projectFileRefs('.codex/agents/neocortex.toml'),
+        ownedBlockName: 'NEOCORTEX-MEMORY',
+        templateKind: 'agents-md',
+        budget: { maxLines: 220, maxBytes: 18_000 },
+        linkRequirement: MANDATORY_SEMANTIC_SYMLINK,
+        bidirectionalReference: bidirectionalReference(MANDATORY_SEMANTIC_SYMLINK),
+        requiresWrapperPreservation: true,
+        notes: 'Codex root instructions. Uppercase AGENTS.md is required on case-sensitive filesystems.',
+    },
+    grok: {
+        targetId: 'grok',
+        platformName: 'Grok Build',
+        canonicalSource: CANONICAL_PROJECT_MEMORY_SOURCE,
+        primaryFile: 'AGENTS.md',
+        secondaryFiles: projectFileRefs('.grok/skills/neocortex/SKILL.md'),
+        ownedBlockName: 'NEOCORTEX-MEMORY',
+        templateKind: 'agents-md',
+        budget: { maxLines: 220, maxBytes: 18_000 },
+        linkRequirement: MANDATORY_SEMANTIC_SYMLINK,
+        bidirectionalReference: bidirectionalReference(MANDATORY_SEMANTIC_SYMLINK),
+        requiresWrapperPreservation: true,
+        notes: 'Grok Build reads AGENTS.md and the project-local Neocortex Skill; both resolve to canonical NEOCORTEX.md context.',
+    },
+    'gemini-cli': {
+        targetId: 'gemini-cli',
+        platformName: 'Gemini CLI',
+        canonicalSource: CANONICAL_PROJECT_MEMORY_SOURCE,
+        primaryFile: 'GEMINI.md',
+        secondaryFiles: projectFileRefs('.gemini/agents/neocortex.md'),
+        ownedBlockName: 'NEOCORTEX-MEMORY',
+        templateKind: 'gemini-md',
+        budget: { maxLines: 260, maxBytes: 22_000 },
+        linkRequirement: MANDATORY_SEMANTIC_SYMLINK,
+        bidirectionalReference: bidirectionalReference(MANDATORY_SEMANTIC_SYMLINK),
+        requiresWrapperPreservation: false,
+        notes: 'Gemini CLI context file. Prefer shallow @file.md imports for detailed architecture docs.',
+    },
+    antigravity: {
+        targetId: 'antigravity',
+        platformName: 'Antigravity',
+        canonicalSource: CANONICAL_PROJECT_MEMORY_SOURCE,
+        primaryFile: 'GEMINI.md',
+        secondaryFiles: projectFileRefs('.gemini/agents/neocortex.md'),
+        ownedBlockName: 'NEOCORTEX-MEMORY',
+        templateKind: 'gemini-md',
+        budget: { maxLines: 260, maxBytes: 22_000 },
+        linkRequirement: MANDATORY_SEMANTIC_SYMLINK,
+        bidirectionalReference: bidirectionalReference(MANDATORY_SEMANTIC_SYMLINK),
+        requiresWrapperPreservation: false,
+        notes: 'Antigravity currently shares GEMINI.md behavior with the Gemini target stubs.',
+    },
+    vscode: {
+        targetId: 'vscode',
+        platformName: 'VS Code / GitHub Copilot',
+        canonicalSource: CANONICAL_PROJECT_MEMORY_SOURCE,
+        primaryFile: '.github/copilot-instructions.md',
+        secondaryFiles: projectFileRefs('.github/instructions/neocortex.instructions.md', '.github/agents/neocortex.agent.md'),
+        ownedBlockName: 'NEOCORTEX-MEMORY',
+        templateKind: 'copilot-instructions',
+        budget: { maxLines: 180, maxBytes: 14_000 },
+        linkRequirement: SYMLINK_BACKED_WRAPPER,
+        bidirectionalReference: bidirectionalReference(SYMLINK_BACKED_WRAPPER),
+        requiresWrapperPreservation: true,
+        notes: 'VS Code and GitHub Copilot always-on repository instructions.',
+    },
+    cursor: {
+        targetId: 'cursor',
+        platformName: 'Cursor',
+        canonicalSource: CANONICAL_PROJECT_MEMORY_SOURCE,
+        primaryFile: '.cursor/rules/neocortex.mdc',
+        secondaryFiles: projectFileRefs('AGENTS.md'),
+        ownedBlockName: 'NEOCORTEX-MEMORY',
+        templateKind: 'cursor-rule',
+        budget: { maxLines: 180, maxBytes: 14_000 },
+        linkRequirement: SYMLINK_BACKED_WRAPPER,
+        bidirectionalReference: bidirectionalReference(SYMLINK_BACKED_WRAPPER),
+        requiresWrapperPreservation: true,
+        notes: 'Cursor rule memory. Use AGENTS.md as compatibility fallback when Cursor rules are absent.',
+    },
+    opencode: {
+        targetId: 'opencode',
+        platformName: 'OpenCode',
+        canonicalSource: CANONICAL_PROJECT_MEMORY_SOURCE,
+        primaryFile: 'AGENTS.md',
+        secondaryFiles: projectFileRefs('.opencode/AGENTS.md', '.opencode/agents/neocortex-root.md', '.opencode/agents/neocortex.md', '.agent/skills/neocortex/SKILL.md'),
+        ownedBlockName: 'NEOCORTEX-MEMORY',
+        templateKind: 'agents-md',
+        budget: { maxLines: 220, maxBytes: 18_000 },
+        linkRequirement: MANDATORY_SEMANTIC_SYMLINK,
+        bidirectionalReference: bidirectionalReference(MANDATORY_SEMANTIC_SYMLINK),
+        requiresWrapperPreservation: true,
+        notes: 'OpenCode agent memory. It consumes AGENTS.md-compatible instructions and must resolve to canonical NEOCORTEX.md.',
+    },
+    openclaw: {
+        targetId: 'openclaw',
+        platformName: 'OpenClaw',
+        canonicalSource: CANONICAL_PROJECT_MEMORY_SOURCE,
+        primaryFile: '.openclaw/skills/neocortex/SKILL.md',
+        secondaryFiles: [{ scope: 'user', path: '.openclaw/skills/neocortex/SKILL.md' }],
+        ownedBlockName: 'NEOCORTEX-MEMORY',
+        templateKind: 'agents-md',
+        budget: { maxLines: 220, maxBytes: 18_000 },
+        linkRequirement: SAFE_INCLUDE_FALLBACK,
+        bidirectionalReference: bidirectionalReference(SAFE_INCLUDE_FALLBACK),
+        requiresWrapperPreservation: true,
+        notes: 'OpenClaw Skill thin-client memory entrypoint. Use the project Skill path when --create-project is requested; do not mutate ~/.openclaw/openclaw.json, and keep memory content public-safe.',
+    },
+    kimi: {
+        targetId: 'kimi',
+        platformName: 'Kimi',
+        canonicalSource: CANONICAL_PROJECT_MEMORY_SOURCE,
+        primaryFile: 'KIMI.md',
+        secondaryFiles: projectFileRefs('AGENTS.md', '.kimi/skills/neocortex/SKILL.md'),
+        ownedBlockName: 'NEOCORTEX-MEMORY',
+        templateKind: 'agents-md',
+        budget: { maxLines: 220, maxBytes: 18_000 },
+        linkRequirement: SAFE_INCLUDE_FALLBACK,
+        bidirectionalReference: bidirectionalReference(SAFE_INCLUDE_FALLBACK),
+        requiresWrapperPreservation: true,
+        notes: 'Kimi memory entrypoint. Prefer a symlink to NEOCORTEX.md; use a compact include only if the host cannot follow symlinks.',
+    },
+    'github-copilot-cli': {
+        targetId: 'github-copilot-cli',
+        platformName: 'GitHub Copilot CLI / gh alias',
+        canonicalSource: CANONICAL_PROJECT_MEMORY_SOURCE,
+        primaryFile: '.github/copilot-instructions.md',
+        secondaryFiles: projectFileRefs('AGENTS.md'),
+        ownedBlockName: 'NEOCORTEX-MEMORY',
+        templateKind: 'copilot-instructions',
+        budget: { maxLines: 180, maxBytes: 14_000 },
+        linkRequirement: SAFE_INCLUDE_FALLBACK,
+        bidirectionalReference: bidirectionalReference(SAFE_INCLUDE_FALLBACK),
+        requiresWrapperPreservation: true,
+        notes: 'GitHub Copilot CLI or gh alias instructions. Resolve compact memory back to NEOCORTEX.md without copying private prompt bodies.',
+    },
+};
+export function getProjectMemoryTarget(targetId) {
+    return PROJECT_MEMORY_TARGETS[targetId];
+}
+export function isProjectMemoryTargetId(value) {
+    return value === 'canonical' || PROJECT_MEMORY_TARGET_IDS.includes(value);
+}
+export function listProjectMemoryTargets() {
+    return PROJECT_MEMORY_TARGET_IDS.map((targetId) => PROJECT_MEMORY_TARGETS[targetId]);
+}