@oscharko-dev/keiko 0.1.6 → 0.1.7

package/node_modules/@oscharko-dev/keiko-contracts/dist/index.d.ts

@@ -0,0 +1,22 @@
+export declare const KEIKO_CONTRACTS_VERSION: "0.1.0";
+export type { HarnessStateName, TerminalState, StateTransition, HarnessLimits, TaskType, GenerateUnitTestsInput, InvestigateBugInput, ExplainPlanInput, VerifyInput, TaskInput, RunCounters, RunOutcome, RunResult, RunManifest, HarnessCode, HarnessFailure, RunStartedEvent, StateTransitionEvent, ModelCallStartedEvent, ModelCallCompletedEvent, ModelCallFailedEvent, ToolCallStartedEvent, ToolCallCompletedEvent, ToolCallFailedEvent, CommandExecutedEvent, SandboxConfiguredEvent, PatchAppliedEvent, ReasoningTraceEvent, PatchProposedEvent, VerificationResultEvent, RunCompletedEvent, RunCancelledEvent, RunFailedEvent, BrowserSessionCloseReason, BrowserSessionOpenedEvent, BrowserNavigatedEvent, BrowserScreenshotCapturedEvent, BrowserPageContentCapturedEvent, BrowserSessionClosedEvent, BrowserTrustWarningEvent, BrowserErrorEvent, BrowserEvent, HarnessEvent, } from "./harness.js";
+export { TERMINAL_STATES, DEFAULT_LIMITS, HARNESS_CODES, HARNESS_VERSION } from "./harness.js";
+export type { WorkflowDescriptor, WorkflowInputSpec } from "./workflow-descriptor.js";
+export type { WorkspaceLanguage, TestFramework, WorkspaceInfo, DiscoveredFile, DiscoveryOptions, DiscoveryStats, ReadOptions, FileContent, SelectionReason, ContextRequest, ContextEntry, ContextPack, ContextEntrySummary, ContextPackSummary, WorkspaceSummary, AuditEntry, AuditSummary, } from "./workspace.js";
+export { DEFAULT_DISCOVERY_OPTIONS, DEFAULT_READ_OPTIONS, SELECTION_REASON_PRIORITY, DEFAULT_CONTEXT_REQUEST, } from "./workspace.js";
+export type { ModelKind, CostClass, LatencyClass, ModelCapability, ChatMessage, ToolDefinition, ResponseFormat, GatewayRequest, NormalizedToolCall, UsageMetadata, NormalizedResponse, FinishReason, StreamDelta, StreamEvent, } from "./gateway.js";
+export type { NetworkPolicy, SandboxPolicy, CommandRule, CommandRunInput, CommandResult, PatchChangeKind, PatchHunk, PatchFileChange, PatchRejectionCode, PatchRejection, PatchConflict, PatchValidation, PatchLimits, PatchApplyResult, ToolHostConfig, ToolHostConfigInput, ToolCallRequest, ToolCallMetadata, ToolCallResult, ToolPort, } from "./tools.js";
+export { DEFAULT_ENV_ALLOWLIST, DEFAULT_SANDBOX_POLICY, DEFAULT_COMMAND_RULES, DEFAULT_PATCH_LIMITS, DEFAULT_TOOL_HOST_CONFIG, } from "./tools.js";
+export type { VerificationKind, VerificationStatus, ResourceDimension, ResourceLimitDecision, VerificationResourceLimits, VerificationStep, VerificationPlan, VerificationResult, VerificationReport, ScriptCatalog, ScriptMapping, } from "./verification.js";
+export { DEFAULT_VERIFICATION_LIMITS } from "./verification.js";
+export type { EvaluationDimension, FixtureOracle, WorkflowKind, EvaluationFixture, DimensionOutcome, DimensionResult, FixtureRunResult, ScorecardEntry, SurfaceParityCheckResult, SurfaceParityResult, LiveRunContext, ScorecardSummary, EvalScorecard, EvaluationMode, } from "./evaluations.js";
+export { EVALUATION_DIMENSIONS, EVAL_SCORECARD_SCHEMA_VERSION } from "./evaluations.js";
+export type { WorkflowStatus, FileNamingStyle, WorkflowLimits, WorkflowEvent, WorkflowEventSink, } from "./unit-test-events.js";
+export { DEFAULT_WORKFLOW_LIMITS } from "./unit-test-events.js";
+export type { BugWorkflowStatus, BugWorkflowLimits, BugInvestigationStartedEvent, FailureParsedEvent, BugContextSelectedEvent, BugModelCallStartedEvent, BugModelCallCompletedEvent, RootCauseProposedEvent, BugPatchValidatedEvent, BugPatchAppliedEvent, BugVerificationResultEvent, BugInvestigationCompletedEvent, BugInvestigationFailedEvent, BugInvestigationEvent, BugWorkflowEventSink, } from "./bug-investigation-events.js";
+export { DEFAULT_BUG_WORKFLOW_LIMITS } from "./bug-investigation-events.js";
+export type { VerificationResultSummary, VerificationSummary, AuditResultEntry, VerificationAuditSummary, } from "./verification-summary.js";
+export type { EvidenceRunIdentity, EvidenceModel, EvidenceUsageTotals, EvidenceStateTransition, EvidenceToolCall, EvidenceCommandExecution, EvidenceSandboxConfiguration, EvidenceVerificationResult, EvidencePatch, EvidenceReasoningEntry, EvidenceFailure, EvidenceTaskType, EvidenceBrowserViewportPx, EvidenceBrowserEventType, EvidenceBrowserEvent, EvidenceBrowserScreenshot, EvidenceBrowserContentCapture, EvidenceBrowserCapture, EvidenceManifest, AuditRedactionConfig, RetentionPolicy, BuildOptions, EvidenceBuildInput, EvidenceDeps, EvidenceStore, SideFileWriteResult, } from "./evidence.js";
+export { EVIDENCE_SCHEMA_VERSION, DEFAULT_RETENTION } from "./evidence.js";
+export type { Project, Chat, ChatRole, CreateChatOptions, UpdateProjectPatch, UpdateChatPatch, NewChatMessage, UpdateChatMessagePatch, } from "./bff-wire.js";
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@oscharko-dev/keiko-contracts/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,uBAAuB,EAAG,OAAgB,CAAC;AAGxD,YAAY,EACV,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,aAAa,EACb,QAAQ,EACR,sBAAsB,EACtB,mBAAmB,EACnB,gBAAgB,EAChB,WAAW,EACX,SAAS,EACT,WAAW,EACX,UAAU,EACV,SAAS,EACT,WAAW,EACX,WAAW,EACX,cAAc,EACd,eAAe,EACf,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,yBAAyB,EACzB,yBAAyB,EACzB,qBAAqB,EACrB,8BAA8B,EAC9B,+BAA+B,EAC/B,yBAAyB,EACzB,wBAAwB,EACxB,iBAAiB,EACjB,YAAY,EACZ,YAAY,GACb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAG/F,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAGtF,YAAY,EACV,iBAAiB,EACjB,aAAa,EACb,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,WAAW,EACX,eAAe,EACf,cAAc,EACd,YAAY,EACZ,WAAW,EACX,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,UAAU,EACV,YAAY,GACb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AAGxB,YAAY,EACV,SAAS,EACT,SAAS,EACT,YAAY,EACZ,eAAe,EACf,WAAW,EACX,cAAc,EACd,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,WAAW,EACX,WAAW,GACZ,MAAM,cAAc,CAAC;AAGtB,YAAY,EACV,aAAa,EACb,aAAa,EACb,WAAW,EACX,eAAe,EACf,aAAa,EACb,eAAe,EACf,SAAS,EACT,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,QAAQ,GACT,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,YAAY,CAAC;AAGpB,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,0BAA0B,EAC1B,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,aAAa,GACd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAGhE,YAAY,EACV,mBAAmB,EACnB,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,wBAAwB,EACxB,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAGxF,YAAY,EACV,cAAc,EACd,eAAe,EACf,cAAc,EACd,aAAa,EACb,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGhE,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,4BAA4B,EAC5B,kBAAkB,EAClB,uBAAuB,EACvB,wBAAwB,EACxB,0BAA0B,EAC1B,sBAAsB,EACtB,sBAAsB,EACtB,oBAAoB,EACpB,0BAA0B,EAC1B,8BAA8B,EAC9B,2BAA2B,EAC3B,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAG5E,YAAY,EACV,yBAAyB,EACzB,mBAAmB,EACnB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AAGnC,YAAY,EACV,mBAAmB,EACnB,aAAa,EACb,mBAAmB,EACnB,uBAAuB,EACvB,gBAAgB,EAChB,wBAAwB,EACxB,4BAA4B,EAC5B,0BAA0B,EAC1B,aAAa,EACb,sBAAsB,EACtB,eAAe,EACf,gBAAgB,EAChB,yBAAyB,EACzB,wBAAwB,EACxB,oBAAoB,EACpB,yBAAyB,EACzB,6BAA6B,EAC7B,sBAAsB,EACtB,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,mBAAmB,GACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAM3E,YAAY,EACV,OAAO,EACP,IAAI,EACJ,QAAQ,EACR,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,sBAAsB,GACvB,MAAM,eAAe,CAAC"}

package/node_modules/@oscharko-dev/keiko-contracts/dist/index.js

@@ -0,0 +1,19 @@
+// Public surface of @oscharko-dev/keiko-contracts. Issue #158 carries the first real type surface
+// out of `src/<layer>/types.ts` into this leaf package. Re-exports use the explicit `export type`
+// form for type-only names and `export` for value-emitting frozen const tables because
+// verbatimModuleSyntax is on in tsconfig.base.json.
+//
+// The workflow event families (unit-test, bug-investigation) reuse the harness event-type NAMES
+// (ModelCallStartedEvent, ModelCallCompletedEvent, PatchAppliedEvent, VerificationResultEvent) by
+// structural convention. We surface only the workflow event UNION types here; the harness member
+// names own the bare identifiers. Callers narrow on the union to reach the member shapes — the
+// same pattern src/index.ts already uses.
+export const KEIKO_CONTRACTS_VERSION = "0.1.0";
+export { TERMINAL_STATES, DEFAULT_LIMITS, HARNESS_CODES, HARNESS_VERSION } from "./harness.js";
+export { DEFAULT_DISCOVERY_OPTIONS, DEFAULT_READ_OPTIONS, SELECTION_REASON_PRIORITY, DEFAULT_CONTEXT_REQUEST, } from "./workspace.js";
+export { DEFAULT_ENV_ALLOWLIST, DEFAULT_SANDBOX_POLICY, DEFAULT_COMMAND_RULES, DEFAULT_PATCH_LIMITS, DEFAULT_TOOL_HOST_CONFIG, } from "./tools.js";
+export { DEFAULT_VERIFICATION_LIMITS } from "./verification.js";
+export { EVALUATION_DIMENSIONS, EVAL_SCORECARD_SCHEMA_VERSION } from "./evaluations.js";
+export { DEFAULT_WORKFLOW_LIMITS } from "./unit-test-events.js";
+export { DEFAULT_BUG_WORKFLOW_LIMITS } from "./bug-investigation-events.js";
+export { EVIDENCE_SCHEMA_VERSION, DEFAULT_RETENTION } from "./evidence.js";

package/node_modules/@oscharko-dev/keiko-contracts/dist/tools.d.ts

@@ -0,0 +1,137 @@
+import type { ToolDefinition } from "./gateway.js";
+export type NetworkPolicy = "inherit" | "none";
+export interface SandboxPolicy {
+    readonly envAllowlist: readonly string[];
+    readonly network: NetworkPolicy;
+    readonly maxOutputBytes: number;
+    readonly defaultTimeoutMs: number;
+    readonly terminationGraceMs: number;
+}
+export declare const DEFAULT_ENV_ALLOWLIST: readonly string[];
+export declare const DEFAULT_SANDBOX_POLICY: SandboxPolicy;
+export interface CommandRule {
+    readonly executable: string;
+    readonly allowedSubcommands?: readonly string[] | undefined;
+    readonly deniedSubcommands?: readonly string[] | undefined;
+    readonly valueFlags?: readonly string[] | undefined;
+    readonly denyFlags?: readonly string[] | undefined;
+    readonly knownSubcommands?: readonly string[] | undefined;
+}
+export declare const DEFAULT_COMMAND_RULES: readonly CommandRule[];
+export interface CommandRunInput {
+    readonly command: string;
+    readonly args?: readonly string[] | undefined;
+    readonly cwd?: string | undefined;
+    readonly timeoutMs?: number | undefined;
+    readonly signal: AbortSignal;
+}
+export interface CommandResult {
+    readonly command: string;
+    readonly args: readonly string[];
+    readonly exitCode: number | null;
+    readonly signal: string | null;
+    readonly stdout: string;
+    readonly stderr: string;
+    readonly durationMs: number;
+    readonly timedOut: boolean;
+    readonly truncated: boolean;
+}
+export type PatchChangeKind = "create" | "modify" | "delete";
+export interface PatchHunk {
+    readonly oldStart: number;
+    readonly oldLines: number;
+    readonly newStart: number;
+    readonly newLines: number;
+    readonly lines: readonly string[];
+}
+export interface PatchFileChange {
+    readonly path: string;
+    readonly kind: PatchChangeKind;
+    readonly hunks: readonly PatchHunk[];
+    readonly addedLines: number;
+    readonly removedLines: number;
+}
+export type PatchRejectionCode = "size-limit" | "binary" | "path-unsafe" | "path-denied" | "line-limit" | "file-limit" | "malformed";
+export interface PatchRejection {
+    readonly code: PatchRejectionCode;
+    readonly message: string;
+    readonly path?: string | undefined;
+}
+export interface PatchConflict {
+    readonly path: string;
+    readonly hunkIndex: number;
+    readonly reason: string;
+}
+export interface PatchValidation {
+    readonly ok: boolean;
+    readonly files: readonly PatchFileChange[];
+    readonly totalChangedLines: number;
+    readonly totalBytes: number;
+    readonly normalizedDiff?: string | undefined;
+    readonly reasons: readonly PatchRejection[];
+    readonly conflicts: readonly PatchConflict[];
+}
+export interface PatchLimits {
+    readonly maxPatchBytes: number;
+    readonly maxChangedLines: number;
+    readonly maxFilesChanged: number;
+}
+export declare const DEFAULT_PATCH_LIMITS: PatchLimits;
+export interface PatchApplyResult {
+    readonly changedFiles: readonly string[];
+    readonly created: readonly string[];
+    readonly deleted: readonly string[];
+}
+export interface ToolHostConfig {
+    readonly sandbox: SandboxPolicy;
+    readonly commandRules: readonly CommandRule[];
+    readonly patchLimits: PatchLimits;
+    readonly applyEnabled: boolean;
+    readonly maxReadBytes: number;
+}
+export declare const DEFAULT_TOOL_HOST_CONFIG: ToolHostConfig;
+export interface ToolHostConfigInput {
+    readonly sandbox?: Partial<SandboxPolicy> | undefined;
+    readonly commandRules?: readonly CommandRule[] | undefined;
+    readonly patchLimits?: Partial<PatchLimits> | undefined;
+    readonly applyEnabled?: boolean | undefined;
+    readonly maxReadBytes?: number | undefined;
+}
+export interface ToolCallRequest {
+    readonly toolCallId: string;
+    readonly toolName: string;
+    readonly arguments: Record<string, unknown>;
+    readonly signal: AbortSignal;
+}
+export type ToolCallMetadata = {
+    readonly kind: "command";
+    readonly executable: string;
+    readonly argCount: number;
+    readonly exitCode: number | null;
+    readonly timedOut: boolean;
+    readonly sandbox: {
+        readonly envAllowlist: readonly string[];
+        readonly network: "inherit" | "none";
+        readonly maxOutputBytes: number;
+        readonly timeoutMs: number;
+        readonly terminationGraceMs: number;
+        readonly cwdRequested: boolean;
+    };
+} | {
+    readonly kind: "patch-apply";
+    readonly changedFiles: number;
+    readonly created: number;
+    readonly deleted: number;
+};
+export interface ToolCallResult {
+    readonly toolCallId: string;
+    readonly output: string;
+    readonly durationMs: number;
+    readonly commandExecuted?: boolean | undefined;
+    readonly metadata?: ToolCallMetadata | undefined;
+}
+export interface ToolPort {
+    readonly execute: (request: ToolCallRequest) => Promise<ToolCallResult>;
+    readonly listTools: () => readonly ToolDefinition[];
+}
+//# sourceMappingURL=tools.d.ts.map

package/node_modules/@oscharko-dev/keiko-contracts/dist/tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAOnD,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,MAAM,CAAC;AAE/C,MAAM,WAAW,aAAa;IAG5B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAEzC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAEhC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAElC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AASD,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAejD,CAAC;AAEH,eAAO,MAAM,sBAAsB,EAAE,aAM3B,CAAC;AAIX,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAE5D,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAI3D,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAGpD,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAGnD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CAC3D;AAGD,eAAO,MAAM,qBAAqB,EAAE,SAAS,WAAW,EAyDtD,CAAC;AAIH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAE/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAID,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE7D,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,MAAM,kBAAkB,GAC1B,YAAY,GACZ,QAAQ,GACR,aAAa,GACb,aAAa,GACb,YAAY,GACZ,YAAY,GACZ,WAAW,CAAC;AAEhB,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,SAAS,eAAe,EAAE,CAAC;IAC3C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;IAC5C,QAAQ,CAAC,SAAS,EAAE,SAAS,aAAa,EAAE,CAAC;CAC9C;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,eAAO,MAAM,oBAAoB,EAAE,WAIzB,CAAC;AAEX,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAID,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,SAAS,WAAW,EAAE,CAAC;IAC9C,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAElC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAE/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,eAAO,MAAM,wBAAwB,EAAE,cAM7B,CAAC;AAOX,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,SAAS,CAAC;IACtD,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,WAAW,EAAE,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,SAAS,CAAC;IACxD,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5C;AAID,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE5C,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B;AAKD,MAAM,MAAM,gBAAgB,GACxB;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;QACzC,QAAQ,CAAC,OAAO,EAAE,SAAS,GAAG,MAAM,CAAC;QACrC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;QACpC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;KAChC,CAAC;CACH,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEN,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAG5B,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAG/C,QAAQ,CAAC,QAAQ,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;CAClD;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IACxE,QAAQ,CAAC,SAAS,EAAE,MAAM,SAAS,cAAc,EAAE,CAAC;CACrD"}

package/node_modules/@oscharko-dev/keiko-contracts/dist/tools.js

@@ -0,0 +1,106 @@
+// Tool-layer contract types and frozen default tables (env allowlist, command rules,
+// sandbox policy, limits, host config). No runtime logic lives here — the
+// `resolveToolHostConfig` helper stays in src/tools/types.ts because it is layer logic, not a
+// contract. `readonly` everywhere; optional props are `| undefined` because
+// exactOptionalPropertyTypes is on. Imports end `.js`, double quotes, `type` keyword.
+// Cross-platform name allowlist. Only names that are PRESENT in the parent are copied, so an
+// absent Windows var on POSIX (or vice versa) is simply skipped.
+//
+// HOME and USERPROFILE are deliberately ABSENT (C5). Forwarding the developer's real home would let
+// a subprocess read ~/.npmrc (npm tokens), ~/.git-credentials, and ~/.aws/… by standard home-dir
+// lookup. runCommand instead injects an ephemeral, EMPTY per-run dir as HOME/USERPROFILE so those
+// lookups resolve to nothing (ADR-0006 D2 Dimension 1).
+export const DEFAULT_ENV_ALLOWLIST = Object.freeze([
+    "PATH",
+    "LANG",
+    "LC_ALL",
+    "LC_CTYPE",
+    "TZ",
+    "TERM",
+    "TMPDIR",
+    // Windows essentials so spawned tools resolve the shell-less executable correctly.
+    "SystemRoot",
+    "SystemDrive",
+    "PATHEXT",
+    "COMSPEC",
+    "NUMBER_OF_PROCESSORS",
+    "WINDIR",
+]);
+export const DEFAULT_SANDBOX_POLICY = {
+    envAllowlist: DEFAULT_ENV_ALLOWLIST,
+    network: "inherit",
+    maxOutputBytes: 262_144,
+    defaultTimeoutMs: 30_000,
+    terminationGraceMs: 2_000,
+};
+// Minimal, justified default rules. Everything not listed is denied (deny-by-default).
+export const DEFAULT_COMMAND_RULES = Object.freeze([
+    {
+        executable: "npm",
+        // Read-only npm only. Mutating/package-installing subcommands are excluded by omission.
+        allowedSubcommands: Object.freeze([
+            "audit",
+            "ls",
+            "list",
+            "outdated",
+            "view",
+            "info",
+            "help",
+            "ping",
+        ]),
+        // `-c`/`--call` execute a command string in a shell; deny outright (S-H2).
+        denyFlags: Object.freeze(["-c", "--call"]),
+    },
+    {
+        executable: "git",
+        // READ-ONLY git only; push/reset/checkout/commit/merge/rebase/clean/config/remote denied.
+        allowedSubcommands: Object.freeze([
+            "status",
+            "diff",
+            "log",
+            "show",
+            "rev-parse",
+            "ls-files",
+            "describe",
+            "blame",
+            "cat-file",
+        ]),
+        // Global value flags that precede the subcommand (`git -C DIR <sub>`). Skipping them prevents
+        // the value (DIR) from being read as the subcommand (S-H2).
+        valueFlags: Object.freeze([
+            "-C",
+            "-c",
+            "--git-dir",
+            "--work-tree",
+            "--namespace",
+            "--exec-path",
+        ]),
+        // Deny git's code-execution / external-driver flags. `git -c diff.external=<cmd> diff` (and
+        // --config-env/--ext-diff/--textconv) make git spawn an arbitrary command via its OWN shell,
+        // defeating the Node spawn's shell:false; --exec-path redirects git to attacker-supplied sub-binaries.
+        // hasDeniedFlag runs BEFORE subcommand resolution and matches both `--flag value` and
+        // `--flag=value`. `-C`/--git-dir/--work-tree stay value-flags (location only, not execution).
+        denyFlags: Object.freeze([
+            "-c",
+            "--config-env",
+            "--exec-path",
+            "--ext-diff",
+            "--textconv",
+            "--no-index",
+            "--output",
+            "--contents",
+        ]),
+    },
+]);
+export const DEFAULT_PATCH_LIMITS = {
+    maxPatchBytes: 65_536,
+    maxChangedLines: 2_000,
+    maxFilesChanged: 50,
+};
+export const DEFAULT_TOOL_HOST_CONFIG = {
+    sandbox: DEFAULT_SANDBOX_POLICY,
+    commandRules: DEFAULT_COMMAND_RULES,
+    patchLimits: DEFAULT_PATCH_LIMITS,
+    applyEnabled: false,
+    maxReadBytes: 262_144,
+};

package/node_modules/@oscharko-dev/keiko-contracts/dist/unit-test-events.d.ts

@@ -0,0 +1,87 @@
+import type { TestFramework } from "./workspace.js";
+import type { VerificationStatus } from "./verification.js";
+export type WorkflowStatus = "completed" | "dry-run" | "rejected" | "cancelled" | "failed";
+export type FileNamingStyle = "sibling" | "mirrored" | "unknown";
+export interface WorkflowLimits {
+    readonly maxModelCalls: number;
+    readonly maxRetries: number;
+    readonly contextBudgetBytes: number;
+    readonly maxBytesPerFile: number;
+}
+export declare const DEFAULT_WORKFLOW_LIMITS: WorkflowLimits;
+interface BaseWorkflowEvent {
+    readonly schemaVersion: "1";
+    readonly runId: string;
+    readonly fingerprint: string;
+    readonly seq: number;
+    readonly ts: number;
+}
+export interface WorkflowStartedEvent extends BaseWorkflowEvent {
+    readonly type: "workflow:started";
+    readonly workflowId: "unit-test-generation";
+    readonly modelId: string;
+    readonly applyEnabled: boolean;
+    readonly limits: WorkflowLimits;
+}
+export interface ConventionsDetectedEvent extends BaseWorkflowEvent {
+    readonly type: "conventions:detected";
+    readonly framework: TestFramework;
+    readonly testDirs: readonly string[];
+    readonly fileNamingStyle: FileNamingStyle;
+}
+export interface ContextSelectedEvent extends BaseWorkflowEvent {
+    readonly type: "context:selected";
+    readonly entryCount: number;
+    readonly usedBytes: number;
+    readonly budgetBytes: number;
+    readonly droppedForBudget: number;
+}
+export interface ModelCallStartedEvent extends BaseWorkflowEvent {
+    readonly type: "workflow:model:call:started";
+    readonly attempt: number;
+    readonly contextBytes: number;
+}
+export interface ModelCallCompletedEvent extends BaseWorkflowEvent {
+    readonly type: "workflow:model:call:completed";
+    readonly attempt: number;
+    readonly finishReason: string;
+    readonly promptTokens: number;
+    readonly completionTokens: number;
+    readonly latencyMs: number;
+}
+export interface PatchValidatedEvent extends BaseWorkflowEvent {
+    readonly type: "patch:validated";
+    readonly ok: boolean;
+    readonly patchBytes: number;
+    readonly filesChanged: number;
+    readonly rejectionCode?: string | undefined;
+}
+export interface PatchAppliedEvent extends BaseWorkflowEvent {
+    readonly type: "workflow:patch:applied";
+    readonly changedFiles: number;
+    readonly created: number;
+    readonly deleted: number;
+}
+export interface VerificationResultEvent extends BaseWorkflowEvent {
+    readonly type: "workflow:verification:result";
+    readonly overallStatus: VerificationStatus;
+    readonly stepCount: number;
+    readonly passedCount: number;
+    readonly durationMs: number;
+}
+export interface WorkflowCompletedEvent extends BaseWorkflowEvent {
+    readonly type: "workflow:completed";
+    readonly status: WorkflowStatus;
+    readonly durationMs: number;
+}
+export interface WorkflowFailedEvent extends BaseWorkflowEvent {
+    readonly type: "workflow:failed";
+    readonly errorCode: string;
+    readonly message: string;
+}
+export type WorkflowEvent = WorkflowStartedEvent | ConventionsDetectedEvent | ContextSelectedEvent | ModelCallStartedEvent | ModelCallCompletedEvent | PatchValidatedEvent | PatchAppliedEvent | VerificationResultEvent | WorkflowCompletedEvent | WorkflowFailedEvent;
+export interface WorkflowEventSink {
+    readonly emit: (event: WorkflowEvent) => void;
+}
+export {};
+//# sourceMappingURL=unit-test-events.d.ts.map

package/node_modules/@oscharko-dev/keiko-contracts/dist/unit-test-events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unit-test-events.d.ts","sourceRoot":"","sources":["../src/unit-test-events.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAI5D,MAAM,MAAM,cAAc,GACtB,WAAW,GACX,SAAS,GACT,UAAU,GACV,WAAW,GACX,QAAQ,CAAC;AAIb,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAIjE,MAAM,WAAW,cAAc;IAE7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAE/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IAEpC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,eAAO,MAAM,uBAAuB,EAAE,cAK5B,CAAC;AAIX,UAAU,iBAAiB;IACzB,QAAQ,CAAC,aAAa,EAAE,GAAG,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAGD,MAAM,WAAW,oBAAqB,SAAQ,iBAAiB;IAC7D,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;CACjC;AAGD,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB;IACjE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;CAC3C;AAGD,MAAM,WAAW,oBAAqB,SAAQ,iBAAiB;IAC7D,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAGD,MAAM,WAAW,qBAAsB,SAAQ,iBAAiB;IAC9D,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAC;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAGD,MAAM,WAAW,uBAAwB,SAAQ,iBAAiB;IAChE,QAAQ,CAAC,IAAI,EAAE,+BAA+B,CAAC;IAC/C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAGD,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;IAC5D,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C;AAGD,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IACxC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAGD,MAAM,WAAW,uBAAwB,SAAQ,iBAAiB;IAChE,QAAQ,CAAC,IAAI,EAAE,8BAA8B,CAAC;IAC9C,QAAQ,CAAC,aAAa,EAAE,kBAAkB,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAGD,MAAM,WAAW,sBAAuB,SAAQ,iBAAiB;IAC/D,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAGD,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;IAC5D,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,aAAa,GACrB,oBAAoB,GACpB,wBAAwB,GACxB,oBAAoB,GACpB,qBAAqB,GACrB,uBAAuB,GACvB,mBAAmB,GACnB,iBAAiB,GACjB,uBAAuB,GACvB,sBAAsB,GACtB,mBAAmB,CAAC;AAExB,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC;CAC/C"}

package/node_modules/@oscharko-dev/keiko-contracts/dist/unit-test-events.js

@@ -0,0 +1,14 @@
+// The WorkflowEvent discriminated union and its BaseWorkflowEvent envelope (ADR-0008 D4) plus the
+// sibling status / limits / file-naming-style names the event types reference. The envelope reuses
+// the harness BaseEvent field shape ({ schemaVersion, runId, fingerprint, seq, ts }) by structural
+// convention — NOT a TypeScript import — so the #10 audit ledger and #13 UI can narrow workflow
+// events with the same envelope logic they apply to HarnessEvent. This union is SEPARATE from
+// HarnessEvent because the workflow does not pass through the harness state machine. No runtime
+// logic lives here beyond the frozen DEFAULT_WORKFLOW_LIMITS table. Every SENSITIVE field is
+// redacted before emit.
+export const DEFAULT_WORKFLOW_LIMITS = {
+    maxModelCalls: 3,
+    maxRetries: 2,
+    contextBudgetBytes: 65_536,
+    maxBytesPerFile: 8_192,
+};

package/node_modules/@oscharko-dev/keiko-contracts/dist/verification-summary.d.ts

@@ -0,0 +1,38 @@
+import type { ResourceLimitDecision, VerificationResult, VerificationStatus } from "./verification.js";
+export interface VerificationResultSummary {
+    readonly kind: VerificationResult["kind"];
+    readonly scriptName: string | undefined;
+    readonly command: string;
+    readonly status: VerificationStatus;
+    readonly exitCode: number | null;
+    readonly durationMs: number;
+    readonly truncated: boolean;
+    readonly outputSummary: string;
+    readonly appliedLimits: readonly ResourceLimitDecision[];
+    readonly detail: string | undefined;
+}
+export interface VerificationSummary {
+    readonly workspaceRoot: string;
+    readonly overallStatus: VerificationStatus;
+    readonly durationMs: number;
+    readonly counts: Readonly<Record<VerificationStatus, number>>;
+    readonly results: readonly VerificationResultSummary[];
+}
+export interface AuditResultEntry {
+    readonly kind: VerificationResult["kind"];
+    readonly scriptName: string | undefined;
+    readonly command: string;
+    readonly status: VerificationStatus;
+    readonly exitCode: number | null;
+    readonly durationMs: number;
+    readonly truncated: boolean;
+    readonly appliedLimits: readonly ResourceLimitDecision[];
+}
+export interface VerificationAuditSummary {
+    readonly workspaceRoot: string;
+    readonly overallStatus: VerificationStatus;
+    readonly durationMs: number;
+    readonly counts: Readonly<Record<VerificationStatus, number>>;
+    readonly results: readonly AuditResultEntry[];
+}
+//# sourceMappingURL=verification-summary.d.ts.map

package/node_modules/@oscharko-dev/keiko-contracts/dist/verification-summary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification-summary.d.ts","sourceRoot":"","sources":["../src/verification-summary.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,qBAAqB,EACrB,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACzD,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,kBAAkB,CAAC;IAC3C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9D,QAAQ,CAAC,OAAO,EAAE,SAAS,yBAAyB,EAAE,CAAC;CACxD;AAID,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,SAAS,qBAAqB,EAAE,CAAC;CAC1D;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,kBAAkB,CAAC;IAC3C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9D,QAAQ,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,CAAC;CAC/C"}

package/node_modules/@oscharko-dev/keiko-contracts/dist/verification-summary.js

@@ -0,0 +1,5 @@
+// Pure type interfaces for the verification summary layer (ADR-0007). The runtime functions
+// (buildVerificationSummary, summarizeForAudit, renderMarkdownSummary) stay in
+// src/verification/summary.ts. These types were extracted to contracts (issue #158) so the
+// audit ledger (#10) and evidence layer can reference them without a circular dependency.
+export {};

package/node_modules/@oscharko-dev/keiko-contracts/dist/verification.d.ts

@@ -0,0 +1,64 @@
+import type { NetworkPolicy } from "./tools.js";
+export type VerificationKind = "test" | "targeted-test" | "typecheck" | "lint" | "build";
+export type VerificationStatus = "passed" | "failed" | "skipped" | "denied" | "timed-out" | "cancelled" | "resource-exceeded";
+export type ResourceDimension = "wall-time" | "output-size" | "memory" | "network";
+export interface ResourceLimitDecision {
+    readonly dimension: ResourceDimension;
+    readonly limit: number | string;
+    readonly enforced: boolean;
+    readonly note?: string | undefined;
+    readonly breached?: boolean | undefined;
+}
+export interface VerificationResourceLimits {
+    readonly wallTimeMs: number;
+    readonly maxOutputBytes: number;
+    readonly maxMemoryBytes: number | undefined;
+    readonly network: NetworkPolicy;
+}
+export declare const DEFAULT_VERIFICATION_LIMITS: VerificationResourceLimits;
+export interface VerificationStep {
+    readonly kind: VerificationKind;
+    readonly scriptName: string | undefined;
+    readonly command: string;
+    readonly args: readonly string[];
+    readonly limits: VerificationResourceLimits;
+    readonly skipReason?: string | undefined;
+}
+export interface VerificationPlan {
+    readonly workspaceRoot: string;
+    readonly steps: readonly VerificationStep[];
+}
+export interface VerificationResult {
+    readonly kind: VerificationKind;
+    readonly scriptName: string | undefined;
+    readonly command: string;
+    readonly args: readonly string[];
+    readonly status: VerificationStatus;
+    readonly exitCode: number | null;
+    readonly signal: string | null;
+    readonly durationMs: number;
+    readonly truncated: boolean;
+    readonly redacted: boolean;
+    readonly outputSummary: string;
+    readonly appliedLimits: readonly ResourceLimitDecision[];
+    readonly detail?: string | undefined;
+}
+export interface VerificationReport {
+    readonly workspaceRoot: string;
+    readonly results: readonly VerificationResult[];
+    readonly overallStatus: VerificationStatus;
+    readonly startedAtMs: number;
+    readonly durationMs: number;
+    readonly counts: Readonly<Record<VerificationStatus, number>>;
+}
+export interface ScriptCatalog {
+    readonly scripts: Readonly<Record<string, string>>;
+    readonly mapping: ScriptMapping;
+}
+export interface ScriptMapping {
+    readonly test: string | undefined;
+    readonly typecheck: string | undefined;
+    readonly lint: string | undefined;
+    readonly build: string | undefined;
+}
+//# sourceMappingURL=verification.d.ts.map

package/node_modules/@oscharko-dev/keiko-contracts/dist/verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification.d.ts","sourceRoot":"","sources":["../src/verification.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAIhD,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,eAAe,GAAG,WAAW,GAAG,MAAM,GAAG,OAAO,CAAC;AAKzF,MAAM,MAAM,kBAAkB,GAC1B,QAAQ,GACR,QAAQ,GACR,SAAS,GACT,QAAQ,GACR,WAAW,GACX,WAAW,GACX,mBAAmB,CAAC;AAIxB,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,aAAa,GAAG,QAAQ,GAAG,SAAS,CAAC;AAKnF,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IAEtC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACzC;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;CACjC;AAID,eAAO,MAAM,2BAA2B,EAAE,0BAKhC,CAAC;AAIX,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAGhC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;IAE5C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,SAAS,gBAAgB,EAAE,CAAC;CAC7C;AAID,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAE5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAE3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAEzD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAChD,QAAQ,CAAC,aAAa,EAAE,kBAAkB,CAAC;IAC3C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,CAAC;CAC/D;AAKD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC"}

package/node_modules/@oscharko-dev/keiko-contracts/dist/verification.js

@@ -0,0 +1,13 @@
+// All verification-layer interfaces and the frozen default limits. No runtime logic lives here
+// beyond the frozen constant tables the type layer exposes as values, mirroring the
+// ADR-0003/0004/0005/0006 `types.ts` precedent. `readonly` everywhere; optional props are
+// `| undefined` because exactOptionalPropertyTypes is on. Every shape is plain JSON-serializable
+// so the #10 audit ledger can persist a VerificationReport without ad-hoc parsing.
+// Wave-1 defaults. maxMemoryBytes is undefined by default: memory enforcement is opt-in and
+// Linux-only (ADR-0007 D2/D3). network defaults to the no-network posture, documented-not-enforced.
+export const DEFAULT_VERIFICATION_LIMITS = {
+    wallTimeMs: 120_000,
+    maxOutputBytes: 1_048_576,
+    maxMemoryBytes: undefined,
+    network: "none",
+};

package/node_modules/@oscharko-dev/keiko-contracts/dist/workflow-descriptor.d.ts

@@ -0,0 +1,21 @@
+export interface WorkflowInputSpec {
+    readonly name: string;
+    readonly type: "string" | "boolean" | "string[]" | "object";
+    readonly required: boolean;
+    readonly description: string;
+    readonly defaultValue?: unknown;
+}
+export interface WorkflowDescriptor<TLimits = object> {
+    readonly workflowId: string;
+    readonly name: string;
+    readonly description: string;
+    readonly inputs: readonly WorkflowInputSpec[];
+    readonly defaultLimits: TLimits;
+    readonly modelSelectionOptions: {
+        readonly arbitrary: boolean;
+        readonly preferredCostClass: "low" | "medium" | "high";
+    };
+    readonly supportsDryRun: boolean;
+    readonly supportsApply: boolean;
+}
+//# sourceMappingURL=workflow-descriptor.d.ts.map

package/node_modules/@oscharko-dev/keiko-contracts/dist/workflow-descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-descriptor.d.ts","sourceRoot":"","sources":["../src/workflow-descriptor.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;IAC5D,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,kBAAkB,CAAC,OAAO,GAAG,MAAM;IAClD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC9C,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,qBAAqB,EAAE;QAE9B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;QAE5B,QAAQ,CAAC,kBAAkB,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;KACxD,CAAC;IACF,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;CACjC"}

package/node_modules/@oscharko-dev/keiko-contracts/dist/workflow-descriptor.js

@@ -0,0 +1,8 @@
+// Shared UI workflow-descriptor interfaces (ADR-0009 D12). Extracted from the unit-test
+// workflow's descriptor so BOTH workflows depend on this common base and NEITHER depends on the
+// other — a clean dependency direction for the workflows layer. Pure types, no runtime logic.
+// Each workflow exports its own concrete `*_WORKFLOW_DESCRIPTOR: WorkflowDescriptor<TLimits>`
+// value; issue #13 reads those values to render the workflow UI without the implementation.
+// `TLimits` is the workflow's own frozen limits shape so each descriptor keeps precise typing on
+// `defaultLimits` (it defaults to `object` for callers that handle descriptors generically).
+export {};