@oscharko-dev/keiko 0.1.0-beta.0

package/dist/workflows/bug-investigation/workflow.js

@@ -0,0 +1,74 @@
+// The single public entry: investigateBug (ADR-0009 D2/D6/D10/D11). A deterministic linear pipeline
+// (NOT the harness loop): intake precondition -> parse failure evidence -> build context -> [prompt
+// -> model -> parse -> validate -> scope-guard] (bounded retries) -> [investigation-only |
+// rejected | dry-run | apply -> verify] -> report. It composes #3-#7 UNCHANGED and emits redacted
+// progress events. The model loop, verify stage, and report stages live in sibling files to keep
+// each under the LOC limit; this file owns the stage sequencing, the intake precondition (return
+// `rejected` with no model call when no evidence is present), and the single top-level catch
+// boundary that maps a CancelledError to a "cancelled" report and any other IO failure to a
+// redacted "failed" report.
+import { CancelledError } from "../../gateway/errors.js";
+import { detectWorkspace } from "../../workspace/index.js";
+import { nodeWorkspaceFs } from "../../workspace/fs.js";
+import { buildBugContext } from "./context.js";
+import { computeBugFingerprint } from "./emit.js";
+import { parseFailureEvidence } from "./failure-parse.js";
+import { runBugModelLoop } from "./model-loop.js";
+import { cancelledReport, emitCompleted, failedReport, finishPipeline, insufficientInputReport, } from "./stages.js";
+import { buildBugRunState, EMPTY_BUG_LOOP } from "./internal.js";
+// Intake precondition (D2): at least one evidence field must be present, else there is nothing to
+// investigate and we reject WITHOUT calling the model.
+function hasEvidence(report) {
+    return (nonEmpty(report.description) ||
+        nonEmpty(report.failingOutput) ||
+        nonEmpty(report.stackTrace) ||
+        (report.targetFiles?.some((file) => nonEmpty(file)) ?? false));
+}
+function nonEmpty(value) {
+    return value !== undefined && value.trim().length > 0;
+}
+async function runPipeline(state) {
+    const report = state.input.report;
+    state.emitter.emit({
+        type: "bug:started",
+        workflowId: "bug-investigation",
+        modelId: state.input.modelId,
+        applyEnabled: state.input.apply === true,
+        limits: state.limits,
+    });
+    if (!hasEvidence(report)) {
+        return insufficientInputReport(state);
+    }
+    const fs = state.deps.fs ?? nodeWorkspaceFs;
+    const workspace = detectWorkspace(state.input.workspaceRoot, fs);
+    const evidence = parseFailureEvidence(report);
+    state.emitter.emit({
+        type: "bug:failure:parsed",
+        frameCount: evidence.frames.length,
+        messageCount: evidence.messages.length,
+    });
+    const pack = buildBugContext(workspace, report.description, evidence, state.limits, { fs });
+    state.emitter.emit({
+        type: "bug:context:selected",
+        entryCount: pack.selected.length,
+        usedBytes: pack.usedBytes,
+        budgetBytes: pack.budgetBytes,
+        droppedForBudget: pack.droppedForBudget,
+    });
+    const loop = await runBugModelLoop(state, workspace, report, evidence, pack);
+    return finishPipeline(state, workspace, loop, evidence);
+}
+export async function investigateBug(input, deps) {
+    const state = buildBugRunState(input, deps, computeBugFingerprint(input.report, input.modelId));
+    let report;
+    try {
+        report = await runPipeline(state);
+    }
+    catch (error) {
+        report =
+            error instanceof CancelledError
+                ? cancelledReport(state, EMPTY_BUG_LOOP, undefined, { frames: [], messages: [] })
+                : failedReport(state, error);
+    }
+    return emitCompleted(state, report);
+}

package/dist/workflows/descriptor.d.ts

@@ -0,0 +1,20 @@
+export interface WorkflowInputSpec {
+    readonly name: string;
+    readonly type: "string" | "boolean" | "string[]" | "object";
+    readonly required: boolean;
+    readonly description: string;
+    readonly defaultValue?: unknown;
+}
+export interface WorkflowDescriptor<TLimits = object> {
+    readonly workflowId: string;
+    readonly name: string;
+    readonly description: string;
+    readonly inputs: readonly WorkflowInputSpec[];
+    readonly defaultLimits: TLimits;
+    readonly modelSelectionOptions: {
+        readonly arbitrary: boolean;
+        readonly preferredCostClass: "low" | "medium" | "high";
+    };
+    readonly supportsDryRun: boolean;
+    readonly supportsApply: boolean;
+}

package/dist/workflows/descriptor.js

@@ -0,0 +1,8 @@
+// Shared UI workflow-descriptor interfaces (ADR-0009 D12). Extracted from the unit-test
+// workflow's descriptor so BOTH workflows depend on this common base and NEITHER depends on the
+// other — a clean dependency direction for the workflows layer. Pure types, no runtime logic.
+// Each workflow exports its own concrete `*_WORKFLOW_DESCRIPTOR: WorkflowDescriptor<TLimits>`
+// value; issue #13 reads those values to render the workflow UI without the implementation.
+// `TLimits` is the workflow's own frozen limits shape so each descriptor keeps precise typing on
+// `defaultLimits` (it defaults to `object` for callers that handle descriptors generically).
+export {};

package/dist/workflows/index.d.ts

@@ -0,0 +1,3 @@
+export type { WorkflowDescriptor, WorkflowInputSpec } from "./descriptor.js";
+export * from "./unit-tests/index.js";
+export * from "./bug-investigation/index.js";

package/dist/workflows/index.js

@@ -0,0 +1,2 @@
+export * from "./unit-tests/index.js";
+export * from "./bug-investigation/index.js";

package/dist/workflows/unit-tests/context.d.ts

@@ -0,0 +1,7 @@
+import { type ContextPack, type WorkspaceInfo } from "../../workspace/index.js";
+import { type WorkspaceFs } from "../../workspace/fs.js";
+import type { UnitTestWorkflowInput, WorkflowLimits } from "./types.js";
+export interface TestGenContextDeps {
+    readonly fs?: WorkspaceFs | undefined;
+}
+export declare function buildTestGenContext(workspace: WorkspaceInfo, input: UnitTestWorkflowInput, limits: WorkflowLimits, deps?: TestGenContextDeps): ContextPack;

package/dist/workflows/unit-tests/context.js

@@ -0,0 +1,129 @@
+// Context assembly for the generation call (ADR-0008 D1). Delegates to #5 buildContextPack so the
+// target file, nearby test files, manifests/config, and type definitions are selected, ranked, and
+// excerpted under a byte budget — every excerpt already redacted by #5 at the IO boundary. Pure
+// except for the WorkspaceFs seam threaded into buildContextPack. The `task` hint is a forward-
+// compatible natural-language description of the target for a future embedding ranker; the Wave-1
+// lexical strategy tolerates it.
+import { buildContextPack, DEFAULT_DISCOVERY_OPTIONS, lexicalRetrievalStrategy, SELECTION_REASON_PRIORITY, } from "../../workspace/index.js";
+import { nodeWorkspaceFs } from "../../workspace/fs.js";
+function toPosix(path) {
+    return path.split("\\").join("/");
+}
+function underDir(path, dir) {
+    const normalized = toPosix(dir);
+    return path === normalized || path.startsWith(`${normalized}/`);
+}
+function basename(path) {
+    const normalized = toPosix(path);
+    const idx = normalized.lastIndexOf("/");
+    return idx === -1 ? normalized : normalized.slice(idx + 1);
+}
+function stem(path) {
+    const base = basename(path);
+    const idx = base.lastIndexOf(".");
+    return idx <= 0 ? base : base.slice(0, idx);
+}
+function testStem(path) {
+    const parts = stem(path).split(".");
+    const marker = parts.findIndex((part) => part === "test" || part === "spec");
+    return marker === -1 ? parts.join(".") : parts.slice(0, marker).join(".");
+}
+function targetPaths(target) {
+    if (target.kind === "file") {
+        return [toPosix(target.filePath)];
+    }
+    if (target.kind === "changedFiles") {
+        return target.filePaths.map(toPosix);
+    }
+    return [];
+}
+function moduleDir(target) {
+    return target.kind === "module" ? toPosix(target.moduleDir) : undefined;
+}
+function isRequestedTarget(path, input) {
+    const module = moduleDir(input.target);
+    return (targetPaths(input.target).includes(path) || (module !== undefined && underDir(path, module)));
+}
+function isTestCandidate(path, workspace, selectionReason) {
+    return (selectionReason === "test" ||
+        workspace.testDirs.some((testDir) => underDir(path, testDir)) ||
+        stem(path)
+            .split(".")
+            .some((part) => part === "test" || part === "spec"));
+}
+function isNearbyTest(path, workspace, input, selectionReason) {
+    if (!isTestCandidate(path, workspace, selectionReason)) {
+        return false;
+    }
+    const targets = targetPaths(input.target);
+    if (targets.length === 0) {
+        const module = moduleDir(input.target);
+        return module !== undefined && path.includes(basename(module));
+    }
+    const candidateStem = testStem(path);
+    return targets.some((target) => candidateStem === stem(target));
+}
+function priorityIndex(reason) {
+    return SELECTION_REASON_PRIORITY.indexOf(reason);
+}
+function issue8Priority(ranked, workspace, input) {
+    const path = toPosix(ranked.file.relativePath);
+    if (isRequestedTarget(path, input)) {
+        return 0;
+    }
+    if (isNearbyTest(path, workspace, input, ranked.selectionReason)) {
+        return 1;
+    }
+    return 2;
+}
+function isSupportContext(ranked) {
+    return ranked.selectionReason === "manifest" || ranked.selectionReason === "config";
+}
+function focusedContext(ranked, workspace, input) {
+    const focused = ranked.filter((item) => issue8Priority(item, workspace, input) < 2 || isSupportContext(item));
+    return focused.length === 0 ? ranked : focused;
+}
+function createUnitTestRetrievalStrategy(workspace, input) {
+    return {
+        rank: (files, task) => {
+            const ranked = focusedContext(lexicalRetrievalStrategy.rank(files, task), workspace, input);
+            return [...ranked].sort((a, b) => {
+                const byIssue8 = issue8Priority(a, workspace, input) - issue8Priority(b, workspace, input);
+                if (byIssue8 !== 0) {
+                    return byIssue8;
+                }
+                const byReason = priorityIndex(a.selectionReason) - priorityIndex(b.selectionReason);
+                if (byReason !== 0) {
+                    return byReason;
+                }
+                return a.file.relativePath.localeCompare(b.file.relativePath);
+            });
+        },
+    };
+}
+function taskHint(target) {
+    if (target.kind === "file") {
+        return target.targetFunction === undefined
+            ? `unit tests for ${target.filePath}`
+            : `unit tests for ${target.targetFunction} in ${target.filePath}`;
+    }
+    if (target.kind === "module") {
+        return `unit tests for module ${target.moduleDir}`;
+    }
+    return `unit tests for ${target.filePaths.join(", ")}`;
+}
+export function buildTestGenContext(workspace, input, limits, deps = {}) {
+    const request = {
+        task: taskHint(input.target),
+        budgetBytes: limits.contextBudgetBytes,
+        maxBytesPerFile: limits.maxBytesPerFile,
+        discovery: DEFAULT_DISCOVERY_OPTIONS,
+    };
+    // buildContextPack defaults to the lexical strategy, but ContextPackDeps requires the field; pass
+    // the #5 barrel default explicitly so we hand a complete deps object without reaching past #5.
+    const packDeps = {
+        fs: deps.fs ?? nodeWorkspaceFs,
+        strategy: createUnitTestRetrievalStrategy(workspace, input),
+    };
+    return buildContextPack(workspace, request, packDeps);
+}

package/dist/workflows/unit-tests/conventions.d.ts

@@ -0,0 +1,4 @@
+import type { ContextPack, WorkspaceInfo } from "../../workspace/index.js";
+import type { TestConventions } from "./types.js";
+export declare function isTestPath(workspace: WorkspaceInfo, relPath: string): boolean;
+export declare function detectConventions(workspace: WorkspaceInfo, pack: ContextPack): TestConventions;

package/dist/workflows/unit-tests/conventions.js

@@ -0,0 +1,87 @@
+// Convention detection (ADR-0008 D7) and the production-code guard predicate (D6). Pure except
+// for the WorkspaceInfo/ContextPack values handed in (no IO, no clock, no RNG). ALL path and
+// naming predicates use plain string ops (split('.'), startsWith, equality) — zero regex — so
+// there is no ReDoS surface (CodeQL js/polynomial-redos, steering note F).
+import { basename, dirname, extname } from "node:path";
+const MAX_ASSERTION_SAMPLES = 2;
+const TEST_SEGMENTS = ["test", "spec"];
+// Normalises a path to forward slashes so dir/segment checks are platform-independent.
+function toPosix(path) {
+    return path.split("\\").join("/");
+}
+// True when the basename (without its final extension) contains "test" or "spec" as a
+// dot-separated segment. `foo.test.ts` -> ["foo","test"] -> pass; `testUtils.ts` ->
+// ["testUtils"] -> FAIL (prefix, not a segment); `foo.spec.utils.ts` -> ["foo","spec","utils"] -> pass.
+function basenameMarksTest(path) {
+    const ext = extname(path);
+    const stem = basename(path, ext);
+    const segments = stem.split(".");
+    return segments.some((segment) => TEST_SEGMENTS.includes(segment));
+}
+// True when the path's directory equals or sits under one of the configured testDirs.
+function underTestDir(testDirs, posixPath) {
+    const dir = dirname(posixPath);
+    return testDirs.some((rawTestDir) => {
+        const testDir = toPosix(rawTestDir);
+        return dir === testDir || dir.startsWith(`${testDir}/`) || posixPath.startsWith(`${testDir}/`);
+    });
+}
+// A path containing a `..` segment or an absolute leading slash is traversal: it can resolve to a
+// production file OUTSIDE the apparent test directory. `tests/../src/auth.ts` lexically starts with
+// `tests/`, but #6 resolveWithinWorkspace collapses it to the in-workspace `src/auth.ts` and writes
+// THAT. A legitimately generated test path is always a clean workspace-relative path, so we reject
+// traversal fail-closed before any test/testDir check (security fix: D6 bypass via path traversal).
+function isTraversal(posixPath) {
+    return posixPath.startsWith("/") || posixPath.split("/").includes("..");
+}
+// The production-code guard predicate (D6): a path passes if its basename marks it a test file OR
+// it lies under a detected testDir. Used to reject any patch that touches a non-test path before
+// renderDryRun/applyPatch — the second barrier against prompt-injected source modification. Any
+// traversal/absolute path is rejected outright so the guarded path matches the path #6 would write.
+export function isTestPath(workspace, relPath) {
+    const posixPath = toPosix(relPath);
+    if (isTraversal(posixPath)) {
+        return false;
+    }
+    return basenameMarksTest(posixPath) || underTestDir(workspace.testDirs, posixPath);
+}
+// The set of test excerpts already selected by #5 (redacted, bounded), capped to MAX_ASSERTION_SAMPLES.
+function sampleAssertionStyle(pack) {
+    return pack.selected
+        .filter((entry) => entry.selectionReason === "test")
+        .slice(0, MAX_ASSERTION_SAMPLES)
+        .map((entry) => entry.excerpt);
+}
+// Whether any selected pack entry is a sibling test (a test file whose directory matches a
+// non-test source path's directory). We approximate "sibling" as a test-marked path NOT under a
+// configured testDir, and "mirrored" as a test-marked path under a testDir.
+function hasSiblingTest(workspace, pack) {
+    return pack.selected.some((entry) => basenameMarksTest(toPosix(entry.path)) &&
+        !underTestDir(workspace.testDirs, toPosix(entry.path)));
+}
+function hasMirroredTest(workspace, pack) {
+    return pack.selected.some((entry) => basenameMarksTest(toPosix(entry.path)) &&
+        underTestDir(workspace.testDirs, toPosix(entry.path)));
+}
+function deriveNamingStyle(workspace, pack) {
+    if (hasSiblingTest(workspace, pack)) {
+        return "sibling";
+    }
+    if (workspace.testDirs.length > 0 && hasMirroredTest(workspace, pack)) {
+        return "mirrored";
+    }
+    // testDirs present but no observed test sample: default to mirrored (the conventional placement
+    // under tests/). Only when there is neither a testDir nor a sample is the style unknown.
+    if (workspace.testDirs.length > 0) {
+        return "mirrored";
+    }
+    return "unknown";
+}
+export function detectConventions(workspace, pack) {
+    return {
+        framework: workspace.testFramework,
+        testDirs: workspace.testDirs,
+        fileNamingStyle: deriveNamingStyle(workspace, pack),
+        assertionStyleSamples: sampleAssertionStyle(pack),
+    };
+}

package/dist/workflows/unit-tests/descriptor.d.ts

@@ -0,0 +1,4 @@
+import { type WorkflowLimits } from "./types.js";
+import type { WorkflowDescriptor } from "../descriptor.js";
+export type { WorkflowDescriptor, WorkflowInputSpec } from "../descriptor.js";
+export declare const UNIT_TEST_WORKFLOW_DESCRIPTOR: WorkflowDescriptor<WorkflowLimits>;

package/dist/workflows/unit-tests/descriptor.js

@@ -0,0 +1,43 @@
+// The static UI workflow descriptor (ADR-0008 D10). Issue #13 reads this to render the workflow
+// UI without knowing the implementation. Frozen and JSON-serializable. The descriptor interfaces
+// are the shared base (ADR-0009 D12) — re-exported here so #8's existing import surface (the
+// unit-tests barrel) is unchanged; both workflows depend on the base and neither on the other.
+import { DEFAULT_WORKFLOW_LIMITS } from "./types.js";
+export const UNIT_TEST_WORKFLOW_DESCRIPTOR = {
+    workflowId: "unit-test-generation",
+    name: "Unit Test Generation",
+    description: "Generates a reviewable unit-test patch for a target TypeScript file, function, or module. " +
+        "Detects the project's test framework and naming conventions. Dry-run by default; " +
+        "pass apply:true to write the tests and run verification.",
+    inputs: [
+        {
+            name: "target",
+            type: "object",
+            required: true,
+            description: "Target: { kind: 'file', filePath } | { kind: 'module', moduleDir } | { kind: 'changedFiles', filePaths }",
+        },
+        {
+            name: "apply",
+            type: "boolean",
+            required: false,
+            description: "Write tests to disk and run verification",
+            defaultValue: false,
+        },
+        {
+            name: "modelId",
+            type: "string",
+            required: true,
+            description: "Model ID registered in gateway config",
+        },
+        {
+            name: "limits",
+            type: "object",
+            required: false,
+            description: "Partial<WorkflowLimits> overrides",
+        },
+    ],
+    defaultLimits: DEFAULT_WORKFLOW_LIMITS,
+    modelSelectionOptions: { arbitrary: true, preferredCostClass: "medium" },
+    supportsDryRun: true,
+    supportsApply: true,
+};

package/dist/workflows/unit-tests/emit.d.ts

@@ -0,0 +1,12 @@
+import type { UnitTestTarget } from "./types.js";
+import type { WorkflowEvent, WorkflowEventSink } from "./events.js";
+export declare function computeFingerprint(target: UnitTestTarget, modelId: string): string;
+type EnvelopeFields = "schemaVersion" | "runId" | "fingerprint" | "seq" | "ts";
+export type WorkflowEventBody = {
+    [E in WorkflowEvent as E["type"]]: Omit<E, EnvelopeFields>;
+}[WorkflowEvent["type"]];
+export interface EventEmitter {
+    readonly emit: (body: WorkflowEventBody) => void;
+}
+export declare function createEventEmitter(sink: WorkflowEventSink, runId: string, fingerprint: string, now: () => number): EventEmitter;
+export {};

package/dist/workflows/unit-tests/emit.js

@@ -0,0 +1,35 @@
+// Event emission helper for the workflow (ADR-0008 D4). Owns the monotonic seq counter and stamps
+// every event with the shared envelope ({ schemaVersion, runId, fingerprint, seq, ts }). The
+// fingerprint is SHA-256(workflowId + canonical(target) + modelId) truncated to 16 hex chars — the
+// same shape as the harness fingerprinter — reusing `canonicalise` from the harness barrel so two
+// structurally equal targets fingerprint identically regardless of key order. Sensitive fields are
+// redacted by the CALLER before handing the event here (this helper does not inspect payloads).
+import { createHash } from "node:crypto";
+import { canonicalise } from "../../harness/index.js";
+const FINGERPRINT_HEX_CHARS = 16;
+export function computeFingerprint(target, modelId) {
+    const canonical = canonicalise({ workflowId: "unit-test-generation", target, modelId });
+    return createHash("sha256")
+        .update(canonical, "utf8")
+        .digest("hex")
+        .slice(0, FINGERPRINT_HEX_CHARS);
+}
+export function createEventEmitter(sink, runId, fingerprint, now) {
+    let seq = 0;
+    return {
+        emit: (body) => {
+            seq += 1;
+            // The body is a complete discriminated-union member minus the envelope; re-attaching the
+            // envelope yields a valid WorkflowEvent. The cast is over the union, not a widening to any.
+            const event = {
+                schemaVersion: "1",
+                runId,
+                fingerprint,
+                seq,
+                ts: now(),
+                ...body,
+            };
+            sink.emit(event);
+        },
+    };
+}

package/dist/workflows/unit-tests/events.d.ts

@@ -0,0 +1,78 @@
+import type { TestFramework } from "../../workspace/index.js";
+import type { VerificationStatus } from "../../verification/index.js";
+import type { FileNamingStyle, WorkflowLimits, WorkflowStatus } from "./types.js";
+interface BaseWorkflowEvent {
+    readonly schemaVersion: "1";
+    readonly runId: string;
+    readonly fingerprint: string;
+    readonly seq: number;
+    readonly ts: number;
+}
+export interface WorkflowStartedEvent extends BaseWorkflowEvent {
+    readonly type: "workflow:started";
+    readonly workflowId: "unit-test-generation";
+    readonly modelId: string;
+    readonly applyEnabled: boolean;
+    readonly limits: WorkflowLimits;
+}
+export interface ConventionsDetectedEvent extends BaseWorkflowEvent {
+    readonly type: "conventions:detected";
+    readonly framework: TestFramework;
+    readonly testDirs: readonly string[];
+    readonly fileNamingStyle: FileNamingStyle;
+}
+export interface ContextSelectedEvent extends BaseWorkflowEvent {
+    readonly type: "context:selected";
+    readonly entryCount: number;
+    readonly usedBytes: number;
+    readonly budgetBytes: number;
+    readonly droppedForBudget: number;
+}
+export interface ModelCallStartedEvent extends BaseWorkflowEvent {
+    readonly type: "workflow:model:call:started";
+    readonly attempt: number;
+    readonly contextBytes: number;
+}
+export interface ModelCallCompletedEvent extends BaseWorkflowEvent {
+    readonly type: "workflow:model:call:completed";
+    readonly attempt: number;
+    readonly finishReason: string;
+    readonly promptTokens: number;
+    readonly completionTokens: number;
+    readonly latencyMs: number;
+}
+export interface PatchValidatedEvent extends BaseWorkflowEvent {
+    readonly type: "patch:validated";
+    readonly ok: boolean;
+    readonly patchBytes: number;
+    readonly filesChanged: number;
+    readonly rejectionCode?: string | undefined;
+}
+export interface PatchAppliedEvent extends BaseWorkflowEvent {
+    readonly type: "workflow:patch:applied";
+    readonly changedFiles: number;
+    readonly created: number;
+    readonly deleted: number;
+}
+export interface VerificationResultEvent extends BaseWorkflowEvent {
+    readonly type: "workflow:verification:result";
+    readonly overallStatus: VerificationStatus;
+    readonly stepCount: number;
+    readonly passedCount: number;
+    readonly durationMs: number;
+}
+export interface WorkflowCompletedEvent extends BaseWorkflowEvent {
+    readonly type: "workflow:completed";
+    readonly status: WorkflowStatus;
+    readonly durationMs: number;
+}
+export interface WorkflowFailedEvent extends BaseWorkflowEvent {
+    readonly type: "workflow:failed";
+    readonly errorCode: string;
+    readonly message: string;
+}
+export type WorkflowEvent = WorkflowStartedEvent | ConventionsDetectedEvent | ContextSelectedEvent | ModelCallStartedEvent | ModelCallCompletedEvent | PatchValidatedEvent | PatchAppliedEvent | VerificationResultEvent | WorkflowCompletedEvent | WorkflowFailedEvent;
+export interface WorkflowEventSink {
+    readonly emit: (event: WorkflowEvent) => void;
+}
+export {};

package/dist/workflows/unit-tests/events.js

@@ -0,0 +1,7 @@
+// The WorkflowEvent discriminated union and its BaseWorkflowEvent envelope (ADR-0008 D4). The
+// envelope reuses the harness BaseEvent field shape ({ schemaVersion, runId, fingerprint, seq,
+// ts }) by structural convention — NOT a TypeScript import — so the #10 audit ledger and #13 UI
+// can narrow workflow events with the same envelope logic they apply to HarnessEvent. This union
+// is SEPARATE from HarnessEvent because the workflow does not pass through the harness state
+// machine. No runtime logic lives here. Every SENSITIVE field is redacted before emit.
+export {};

package/dist/workflows/unit-tests/index.d.ts

@@ -0,0 +1,6 @@
+export { generateUnitTests } from "./workflow.js";
+export { assembleReport, renderMarkdownReport, type ReportParts } from "./report.js";
+export { UNIT_TEST_WORKFLOW_DESCRIPTOR, type WorkflowDescriptor, type WorkflowInputSpec, } from "./descriptor.js";
+export { detectConventions, isTestPath } from "./conventions.js";
+export { DEFAULT_WORKFLOW_LIMITS, type AddedTestFile, type FileNamingStyle, type TestConventions, type UnitTestTarget, type UnitTestWorkflowDeps, type UnitTestWorkflowInput, type UnitTestWorkflowReport, type WorkflowLimits, type WorkflowStatus, } from "./types.js";
+export type { ConventionsDetectedEvent, ContextSelectedEvent, ModelCallCompletedEvent, ModelCallStartedEvent, PatchAppliedEvent, PatchValidatedEvent, VerificationResultEvent, WorkflowCompletedEvent, WorkflowEvent, WorkflowEventSink, WorkflowFailedEvent, WorkflowStartedEvent, } from "./events.js";

package/dist/workflows/unit-tests/index.js

@@ -0,0 +1,10 @@
+// Public barrel for the unit-test generation workflow (ADR-0008 D1). Re-exports the single entry
+// (generateUnitTests), the static UI descriptor, the Markdown renderer, the WorkflowEvent family,
+// and all public types. Internal pipeline modules (internal, model-loop, verify-stage, stages,
+// emit, parse, context, prompt) are NOT re-exported — they are implementation detail. Explicit
+// named re-exports, `type` keyword for type-only, double quotes, `.js`.
+export { generateUnitTests } from "./workflow.js";
+export { assembleReport, renderMarkdownReport } from "./report.js";
+export { UNIT_TEST_WORKFLOW_DESCRIPTOR, } from "./descriptor.js";
+export { detectConventions, isTestPath } from "./conventions.js";
+export { DEFAULT_WORKFLOW_LIMITS, } from "./types.js";

package/dist/workflows/unit-tests/internal.d.ts

@@ -0,0 +1,35 @@
+import type { PatchValidation } from "../../tools/index.js";
+import { type EventEmitter } from "./emit.js";
+import { type UnitTestWorkflowDeps, type UnitTestWorkflowInput, type WorkflowLimits } from "./types.js";
+import type { WorkflowEventSink } from "./events.js";
+export declare const NO_OP_SINK: WorkflowEventSink;
+export interface WorkflowProgress {
+    modelCallCount: number;
+    patchRetryCount: number;
+}
+export interface RunState {
+    readonly input: UnitTestWorkflowInput;
+    readonly deps: UnitTestWorkflowDeps;
+    readonly limits: WorkflowLimits;
+    readonly signal: AbortSignal;
+    readonly now: () => number;
+    readonly emitter: EventEmitter;
+    readonly startedAt: number;
+    readonly progress: WorkflowProgress;
+}
+export interface AcceptedPatch {
+    readonly diff: string;
+    readonly validation: PatchValidation;
+    readonly coveredBehavior: string | undefined;
+    readonly knownGaps: string | undefined;
+}
+export interface ModelLoopResult {
+    readonly accepted: AcceptedPatch | undefined;
+    readonly modelCallCount: number;
+    readonly patchRetryCount: number;
+    readonly lastRejectionCode: string | undefined;
+}
+export declare const EMPTY_LOOP: ModelLoopResult;
+export declare function resolveLimits(input: UnitTestWorkflowInput): WorkflowLimits;
+export declare function buildRunState(input: UnitTestWorkflowInput, deps: UnitTestWorkflowDeps, fingerprint: string): RunState;
+export declare function nextActionsFor(applied: boolean, files: readonly string[]): readonly string[];

package/dist/workflows/unit-tests/internal.js

@@ -0,0 +1,43 @@
+// Shared internal types and small pure helpers used across the workflow pipeline stages (the
+// model loop, the verify stage, and the report stages). Kept private to the module — none of these
+// are re-exported from index.ts. Splitting them out keeps each pipeline file under the LOC limit
+// while leaving a single source of truth for the resolved RunState and the loop result shape.
+import { createEventEmitter } from "./emit.js";
+import { DEFAULT_WORKFLOW_LIMITS, } from "./types.js";
+// A no-op sink used when the caller injects none. emit is synchronous (ADR-0004 EventSink contract).
+export const NO_OP_SINK = { emit: () => undefined };
+// The zero-progress loop used to assemble a cancelled/failed report before the model loop ran.
+export const EMPTY_LOOP = {
+    accepted: undefined,
+    modelCallCount: 0,
+    patchRetryCount: 0,
+    lastRejectionCode: undefined,
+};
+export function resolveLimits(input) {
+    return { ...DEFAULT_WORKFLOW_LIMITS, ...input.limits };
+}
+export function buildRunState(input, deps, fingerprint) {
+    const now = deps.now ?? Date.now;
+    const idSource = deps.idSource ?? (() => crypto.randomUUID());
+    return {
+        input,
+        deps,
+        limits: resolveLimits(input),
+        signal: deps.signal ?? new AbortController().signal,
+        now,
+        emitter: createEventEmitter(deps.sink ?? NO_OP_SINK, idSource(), fingerprint, now),
+        startedAt: now(),
+        progress: { modelCallCount: 0, patchRetryCount: 0 },
+    };
+}
+// UI-renderable next actions for the report. Pure.
+export function nextActionsFor(applied, files) {
+    const first = files[0] ?? "the generated test file";
+    if (applied) {
+        return [`Review the generated tests in ${first}`, "Run `keiko verify` to confirm they pass"];
+    }
+    return [
+        `Review the proposed tests for ${first}`,
+        "Re-run with --apply to write the tests and verify",
+    ];
+}

package/dist/workflows/unit-tests/model-loop.d.ts

@@ -0,0 +1,4 @@
+import type { ContextPack, WorkspaceInfo } from "../../workspace/index.js";
+import type { ModelLoopResult, RunState } from "./internal.js";
+import type { TestConventions } from "./types.js";
+export declare function runModelLoop(state: RunState, workspace: WorkspaceInfo, conventions: TestConventions, pack: ContextPack): Promise<ModelLoopResult>;