@ozzylabs/feedradar 0.1.0

package/dist/schemas/config.d.ts

@@ -0,0 +1,39 @@
+import { z } from "zod";
+/**
+ * Schema for `radar.config.yaml`, the workspace-level configuration file
+ * placed at the workspace root (next to `sources/`, `items/`, etc.).
+ *
+ * Fields are intentionally minimal in Phase 2; the config is designed to grow
+ * one field at a time as new defaults are needed (per [#25] Phase 2 epic).
+ *
+ * - `defaultResearchAgent`: agent used when `radar research` is run
+ *   without an explicit `--agent`. Falls through to the hard-coded default
+ *   (`claude-code`) when unset.
+ * - `defaultReviewAgent`: same idea for `radar review`.
+ *
+ * Out-of-scope (tracked separately):
+ *   - default agent for `update` (Phase 5)
+ *   - agent-specific knobs (timeout / API key / etc.)
+ */
+export declare const RadarConfigSchema: z.ZodObject<{
+    defaultResearchAgent: z.ZodOptional<z.ZodEnum<{
+        "claude-code": "claude-code";
+        "codex-cli": "codex-cli";
+        "gemini-cli": "gemini-cli";
+        copilot: "copilot";
+    }>>;
+    defaultReviewAgent: z.ZodOptional<z.ZodEnum<{
+        "claude-code": "claude-code";
+        "codex-cli": "codex-cli";
+        "gemini-cli": "gemini-cli";
+        copilot: "copilot";
+    }>>;
+}, z.core.$strip>;
+export type RadarConfig = z.infer<typeof RadarConfigSchema>;
+/**
+ * The set of commands for which a default agent can be configured. New
+ * commands are added here (rather than to a free-form `string`) so that the
+ * resolver below stays exhaustive and TypeScript flags missing branches.
+ */
+export type ConfigurableCommand = "research" | "review";
+//# sourceMappingURL=config.d.ts.map

package/dist/schemas/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/schemas/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;iBAG5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG,UAAU,GAAG,QAAQ,CAAC"}

package/dist/schemas/config.js

@@ -0,0 +1,23 @@
+import { z } from "zod";
+import { AgentIdSchema } from "./research.js";
+/**
+ * Schema for `radar.config.yaml`, the workspace-level configuration file
+ * placed at the workspace root (next to `sources/`, `items/`, etc.).
+ *
+ * Fields are intentionally minimal in Phase 2; the config is designed to grow
+ * one field at a time as new defaults are needed (per [#25] Phase 2 epic).
+ *
+ * - `defaultResearchAgent`: agent used when `radar research` is run
+ *   without an explicit `--agent`. Falls through to the hard-coded default
+ *   (`claude-code`) when unset.
+ * - `defaultReviewAgent`: same idea for `radar review`.
+ *
+ * Out-of-scope (tracked separately):
+ *   - default agent for `update` (Phase 5)
+ *   - agent-specific knobs (timeout / API key / etc.)
+ */
+export const RadarConfigSchema = z.object({
+    defaultResearchAgent: AgentIdSchema.optional(),
+    defaultReviewAgent: AgentIdSchema.optional(),
+});
+//# sourceMappingURL=config.js.map

package/dist/schemas/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/schemas/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,oBAAoB,EAAE,aAAa,CAAC,QAAQ,EAAE;IAC9C,kBAAkB,EAAE,aAAa,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC"}

package/dist/schemas/index.d.ts

@@ -0,0 +1,6 @@
+export * from "./config.js";
+export * from "./item.js";
+export * from "./research.js";
+export * from "./source.js";
+export * from "./state.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/schemas/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/schemas/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/schemas/index.js

@@ -0,0 +1,6 @@
+export * from "./config.js";
+export * from "./item.js";
+export * from "./research.js";
+export * from "./source.js";
+export * from "./state.js";
+//# sourceMappingURL=index.js.map

package/dist/schemas/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/schemas/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/schemas/item.d.ts

@@ -0,0 +1,38 @@
+import { z } from "zod";
+/**
+ * Item status state machine (ADR-0008).
+ *
+ *   detected ──► (dismissed | researched) ──► reviewed
+ *
+ * - `detected`: watch run emitted the item after filter
+ * - `dismissed`: user decided not to research (terminal)
+ * - `researched`: research report written
+ * - `reviewed`: research report reviewed (terminal happy path)
+ */
+export declare const ItemStatusSchema: z.ZodEnum<{
+    detected: "detected";
+    dismissed: "dismissed";
+    researched: "researched";
+    reviewed: "reviewed";
+}>;
+export type ItemStatus = z.infer<typeof ItemStatusSchema>;
+export declare const ItemSchema: z.ZodObject<{
+    id: z.ZodString;
+    sourceId: z.ZodString;
+    title: z.ZodString;
+    url: z.ZodString;
+    publishedAt: z.ZodOptional<z.ZodString>;
+    fetchedAt: z.ZodString;
+    summary: z.ZodOptional<z.ZodString>;
+    raw: z.ZodOptional<z.ZodUnknown>;
+    matchedKeywords: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    status: z.ZodDefault<z.ZodEnum<{
+        detected: "detected";
+        dismissed: "dismissed";
+        researched: "researched";
+        reviewed: "reviewed";
+    }>>;
+    injectionFlags: z.ZodDefault<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export type Item = z.infer<typeof ItemSchema>;
+//# sourceMappingURL=item.d.ts.map

package/dist/schemas/item.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"item.d.ts","sourceRoot":"","sources":["../../src/schemas/item.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB;;;;;EAA8D,CAAC;AAC5F,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;iBAoBrB,CAAC;AACH,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC"}

package/dist/schemas/item.js

@@ -0,0 +1,34 @@
+import { z } from "zod";
+/**
+ * Item status state machine (ADR-0008).
+ *
+ *   detected ──► (dismissed | researched) ──► reviewed
+ *
+ * - `detected`: watch run emitted the item after filter
+ * - `dismissed`: user decided not to research (terminal)
+ * - `researched`: research report written
+ * - `reviewed`: research report reviewed (terminal happy path)
+ */
+export const ItemStatusSchema = z.enum(["detected", "dismissed", "researched", "reviewed"]);
+export const ItemSchema = z.object({
+    id: z.string().min(1),
+    sourceId: z.string().min(1),
+    title: z.string(),
+    url: z.string().url(),
+    publishedAt: z.string().datetime().optional(),
+    fetchedAt: z.string().datetime(),
+    summary: z.string().optional(),
+    raw: z.unknown().optional(),
+    matchedKeywords: z.array(z.string()).default([]),
+    status: ItemStatusSchema.default("detected"),
+    /**
+     * Prompt-injection pattern labels that fired when the watcher scanned
+     * `title` / `summary` / `raw` (ADR-0009 M1a — Adopt). Audit-only: a
+     * non-empty value does NOT change `status`, sanitize content, or block
+     * downstream commands. Existing items written before this field landed
+     * default to `[]` thanks to the schema default, so load-side compat is
+     * automatic.
+     */
+    injectionFlags: z.array(z.string()).default([]),
+});
+//# sourceMappingURL=item.js.map

package/dist/schemas/item.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"item.js","sourceRoot":"","sources":["../../src/schemas/item.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;AAG5F,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC3B,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAChD,MAAM,EAAE,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC;IAC5C;;;;;;;OAOG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAChD,CAAC,CAAC"}

package/dist/schemas/research.d.ts

@@ -0,0 +1,82 @@
+import { z } from "zod";
+export declare const AgentIdSchema: z.ZodEnum<{
+    "claude-code": "claude-code";
+    "codex-cli": "codex-cli";
+    "gemini-cli": "gemini-cli";
+    copilot: "copilot";
+}>;
+export type AgentId = z.infer<typeof AgentIdSchema>;
+/**
+ * Frontmatter persisted on disk in `research/<id>.md`.
+ *
+ * `outputPath` is intentionally **omitted** here: the path is encoded in the
+ * filename itself, so storing it in the frontmatter would be redundant and
+ * invite drift between the two. Anything that needs the path can construct it
+ * from `id` (filename) or read it from the file system. This split keeps the
+ * persisted artifact ADR-0003-compliant while letting in-memory orchestration
+ * carry the resolved path through `Research`.
+ *
+ * Phase 1 contract: `reviewedAt` / `reviewedBy` are **always written as
+ * `null`** by the `research` command. They become non-null when Phase 2's
+ * `review` command stamps the file. See ADR-0003.
+ *
+ * Phase 5 contract: `supersedes` records the lineage between research file
+ * versions. v1 files write `null`; v(N+1) files write the previous version's
+ * `id` (filename without the `.md` extension). The field is `null`-defaulted
+ * so existing v1 frontmatter generated before Phase 5 (which omits the field
+ * entirely) parses without violating the schema. See ADR-0003.
+ */
+export declare const ResearchFrontmatterSchema: z.ZodObject<{
+    id: z.ZodString;
+    itemIds: z.ZodArray<z.ZodString>;
+    agent: z.ZodEnum<{
+        "claude-code": "claude-code";
+        "codex-cli": "codex-cli";
+        "gemini-cli": "gemini-cli";
+        copilot: "copilot";
+    }>;
+    templateId: z.ZodString;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodNullable<z.ZodString>;
+    reviewedAt: z.ZodNullable<z.ZodString>;
+    reviewedBy: z.ZodNullable<z.ZodEnum<{
+        "claude-code": "claude-code";
+        "codex-cli": "codex-cli";
+        "gemini-cli": "gemini-cli";
+        copilot: "copilot";
+    }>>;
+    supersedes: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+export type ResearchFrontmatter = z.infer<typeof ResearchFrontmatterSchema>;
+/**
+ * In-memory Research record used by the orchestration layer.
+ *
+ * Extends `ResearchFrontmatter` with `outputPath`, which the CLI needs to
+ * pass through to the agent adapter (so the agent knows where to write) and
+ * back to the caller (so the CLI can verify the file after the adapter
+ * returns). Persisted frontmatter intentionally drops this field.
+ */
+export declare const ResearchSchema: z.ZodObject<{
+    id: z.ZodString;
+    itemIds: z.ZodArray<z.ZodString>;
+    agent: z.ZodEnum<{
+        "claude-code": "claude-code";
+        "codex-cli": "codex-cli";
+        "gemini-cli": "gemini-cli";
+        copilot: "copilot";
+    }>;
+    templateId: z.ZodString;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodNullable<z.ZodString>;
+    reviewedAt: z.ZodNullable<z.ZodString>;
+    reviewedBy: z.ZodNullable<z.ZodEnum<{
+        "claude-code": "claude-code";
+        "codex-cli": "codex-cli";
+        "gemini-cli": "gemini-cli";
+        copilot: "copilot";
+    }>>;
+    supersedes: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    outputPath: z.ZodString;
+}, z.core.$strip>;
+export type Research = z.infer<typeof ResearchSchema>;
+//# sourceMappingURL=research.d.ts.map

package/dist/schemas/research.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"research.d.ts","sourceRoot":"","sources":["../../src/schemas/research.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,aAAa;;;;;EAAgE,CAAC;AAC3F,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;iBAUpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;iBAEzB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC"}

package/dist/schemas/research.js

@@ -0,0 +1,45 @@
+import { z } from "zod";
+export const AgentIdSchema = z.enum(["claude-code", "codex-cli", "gemini-cli", "copilot"]);
+/**
+ * Frontmatter persisted on disk in `research/<id>.md`.
+ *
+ * `outputPath` is intentionally **omitted** here: the path is encoded in the
+ * filename itself, so storing it in the frontmatter would be redundant and
+ * invite drift between the two. Anything that needs the path can construct it
+ * from `id` (filename) or read it from the file system. This split keeps the
+ * persisted artifact ADR-0003-compliant while letting in-memory orchestration
+ * carry the resolved path through `Research`.
+ *
+ * Phase 1 contract: `reviewedAt` / `reviewedBy` are **always written as
+ * `null`** by the `research` command. They become non-null when Phase 2's
+ * `review` command stamps the file. See ADR-0003.
+ *
+ * Phase 5 contract: `supersedes` records the lineage between research file
+ * versions. v1 files write `null`; v(N+1) files write the previous version's
+ * `id` (filename without the `.md` extension). The field is `null`-defaulted
+ * so existing v1 frontmatter generated before Phase 5 (which omits the field
+ * entirely) parses without violating the schema. See ADR-0003.
+ */
+export const ResearchFrontmatterSchema = z.object({
+    id: z.string().min(1),
+    itemIds: z.array(z.string().min(1)).min(1),
+    agent: AgentIdSchema,
+    templateId: z.string().min(1),
+    createdAt: z.string().datetime(),
+    updatedAt: z.string().datetime().nullable(),
+    reviewedAt: z.string().datetime().nullable(),
+    reviewedBy: AgentIdSchema.nullable(),
+    supersedes: z.string().min(1).nullable().default(null),
+});
+/**
+ * In-memory Research record used by the orchestration layer.
+ *
+ * Extends `ResearchFrontmatter` with `outputPath`, which the CLI needs to
+ * pass through to the agent adapter (so the agent knows where to write) and
+ * back to the caller (so the CLI can verify the file after the adapter
+ * returns). Persisted frontmatter intentionally drops this field.
+ */
+export const ResearchSchema = ResearchFrontmatterSchema.extend({
+    outputPath: z.string().min(1),
+});
+//# sourceMappingURL=research.js.map

package/dist/schemas/research.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"research.js","sourceRoot":"","sources":["../../src/schemas/research.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC;AAG3F;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,KAAK,EAAE,aAAa;IACpB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,UAAU,EAAE,aAAa,CAAC,QAAQ,EAAE;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACvD,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,yBAAyB,CAAC,MAAM,CAAC;IAC7D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9B,CAAC,CAAC"}

package/dist/schemas/source.d.ts

@@ -0,0 +1,139 @@
+import { z } from "zod";
+export declare const SourceKindSchema: z.ZodEnum<{
+    rss: "rss";
+    html: "html";
+    "github-releases": "github-releases";
+    "npm-registry": "npm-registry";
+}>;
+export type SourceKind = z.infer<typeof SourceKindSchema>;
+/**
+ * Match modes for keyword evaluation (ADR-0006).
+ *
+ * - `word`: whole-word match (`\b<kw>\b`). Default; safest for casual blog feeds.
+ * - `substring`: simple substring match. Use for partial-token monitoring.
+ * - `regex`: keyword is compiled as a JavaScript RegExp. Invalid patterns throw.
+ *   Beware ReDoS; users own pattern complexity.
+ */
+export declare const MatchModeSchema: z.ZodEnum<{
+    word: "word";
+    substring: "substring";
+    regex: "regex";
+}>;
+export type MatchMode = z.infer<typeof MatchModeSchema>;
+/** Item fields a filter may inspect (ADR-0006). Adapters silently skip fields they cannot supply. */
+export declare const MatchFieldSchema: z.ZodEnum<{
+    title: "title";
+    summary: "summary";
+    body: "body";
+    tags: "tags";
+}>;
+export type MatchField = z.infer<typeof MatchFieldSchema>;
+/**
+ * Trust level for a Source (ADR-0009 M4).
+ *
+ * Tags whether the content returned by this source's adapter should be treated
+ * as agent-controllable. The default is `"untrusted"` so omitting the field
+ * (the only state existing source YAMLs are in) preserves the current
+ * defense-in-depth posture: every external feed is treated as adversarial
+ * until the user explicitly opts in.
+ *
+ * This issue only adds the field. Downstream policy branches (regex detection
+ * sensitivity, boundary marker strength, prompt builder behavior) land in a
+ * separate sub-issue so the schema change is reviewable in isolation.
+ */
+export declare const TrustLevelSchema: z.ZodEnum<{
+    trusted: "trusted";
+    untrusted: "untrusted";
+}>;
+export type TrustLevel = z.infer<typeof TrustLevelSchema>;
+export declare const SourceFiltersSchema: z.ZodObject<{
+    keywords: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    excludeKeywords: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    matchMode: z.ZodDefault<z.ZodEnum<{
+        word: "word";
+        substring: "substring";
+        regex: "regex";
+    }>>;
+    matchFields: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+        title: "title";
+        summary: "summary";
+        body: "body";
+        tags: "tags";
+    }>>>;
+    caseSensitive: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+export type SourceFilters = z.infer<typeof SourceFiltersSchema>;
+/**
+ * CSS selector ruleset for `kind: html` sources.
+ *
+ * HTML scraping cannot rely on a standard envelope the way RSS/Atom does, so
+ * each site declares the selectors needed to locate items and extract fields.
+ * The adapter walks every element matched by `item`, then applies the
+ * remaining selectors relative to that element.
+ *
+ * - `item` and `title` are required: without an item boundary or a title we
+ *   cannot derive a stable id or produce a meaningful `Item`.
+ * - `link` is required because `Item.url` is the only field every downstream
+ *   consumer (research / review / dedup) depends on.
+ * - `summary` / `publishedAt` / `body` / `tags` are optional; missing fields
+ *   simply drop out of the normalized item (mirrors RSS adapter behavior).
+ * - `publishedAt` is parsed via `new Date(text)`; the adapter prefers a
+ *   `datetime` / `content` attribute when the matched element exposes one
+ *   (e.g. `<time datetime="…">`), falling back to text content.
+ *
+ * See `docs/design/source-html.md` for the parser choice rationale and the
+ * selector contract in full.
+ */
+export declare const SourceSelectorsSchema: z.ZodObject<{
+    item: z.ZodString;
+    title: z.ZodString;
+    link: z.ZodString;
+    summary: z.ZodOptional<z.ZodString>;
+    publishedAt: z.ZodOptional<z.ZodString>;
+    body: z.ZodOptional<z.ZodString>;
+    tags: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type SourceSelectors = z.infer<typeof SourceSelectorsSchema>;
+export declare const SourceSchema: z.ZodObject<{
+    id: z.ZodString;
+    kind: z.ZodEnum<{
+        rss: "rss";
+        html: "html";
+        "github-releases": "github-releases";
+        "npm-registry": "npm-registry";
+    }>;
+    url: z.ZodString;
+    name: z.ZodOptional<z.ZodString>;
+    tags: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    filters: z.ZodDefault<z.ZodObject<{
+        keywords: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        excludeKeywords: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        matchMode: z.ZodDefault<z.ZodEnum<{
+            word: "word";
+            substring: "substring";
+            regex: "regex";
+        }>>;
+        matchFields: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+            title: "title";
+            summary: "summary";
+            body: "body";
+            tags: "tags";
+        }>>>;
+        caseSensitive: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    selectors: z.ZodOptional<z.ZodObject<{
+        item: z.ZodString;
+        title: z.ZodString;
+        link: z.ZodString;
+        summary: z.ZodOptional<z.ZodString>;
+        publishedAt: z.ZodOptional<z.ZodString>;
+        body: z.ZodOptional<z.ZodString>;
+        tags: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    trustLevel: z.ZodDefault<z.ZodEnum<{
+        trusted: "trusted";
+        untrusted: "untrusted";
+    }>>;
+}, z.core.$strip>;
+export type Source = z.infer<typeof SourceSchema>;
+//# sourceMappingURL=source.d.ts.map

package/dist/schemas/source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../src/schemas/source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,gBAAgB;;;;;EAA6D,CAAC;AAC3F,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;EAAyC,CAAC;AACtE,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,qGAAqG;AACrG,eAAO,MAAM,gBAAgB;;;;;EAA+C,CAAC;AAC7E,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gBAAgB;;;EAAmC,CAAC;AACjE,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;iBAM9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;iBAQhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAoBpE,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2CrB,CAAC;AACL,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC"}

package/dist/schemas/source.js

@@ -0,0 +1,127 @@
+import { z } from "zod";
+export const SourceKindSchema = z.enum(["rss", "html", "github-releases", "npm-registry"]);
+/**
+ * Match modes for keyword evaluation (ADR-0006).
+ *
+ * - `word`: whole-word match (`\b<kw>\b`). Default; safest for casual blog feeds.
+ * - `substring`: simple substring match. Use for partial-token monitoring.
+ * - `regex`: keyword is compiled as a JavaScript RegExp. Invalid patterns throw.
+ *   Beware ReDoS; users own pattern complexity.
+ */
+export const MatchModeSchema = z.enum(["word", "substring", "regex"]);
+/** Item fields a filter may inspect (ADR-0006). Adapters silently skip fields they cannot supply. */
+export const MatchFieldSchema = z.enum(["title", "summary", "body", "tags"]);
+/**
+ * Trust level for a Source (ADR-0009 M4).
+ *
+ * Tags whether the content returned by this source's adapter should be treated
+ * as agent-controllable. The default is `"untrusted"` so omitting the field
+ * (the only state existing source YAMLs are in) preserves the current
+ * defense-in-depth posture: every external feed is treated as adversarial
+ * until the user explicitly opts in.
+ *
+ * This issue only adds the field. Downstream policy branches (regex detection
+ * sensitivity, boundary marker strength, prompt builder behavior) land in a
+ * separate sub-issue so the schema change is reviewable in isolation.
+ */
+export const TrustLevelSchema = z.enum(["trusted", "untrusted"]);
+export const SourceFiltersSchema = z.object({
+    keywords: z.array(z.string()).default([]),
+    excludeKeywords: z.array(z.string()).default([]),
+    matchMode: MatchModeSchema.default("word"),
+    matchFields: z.array(MatchFieldSchema).default(["title", "summary"]),
+    caseSensitive: z.boolean().default(false),
+});
+/**
+ * CSS selector ruleset for `kind: html` sources.
+ *
+ * HTML scraping cannot rely on a standard envelope the way RSS/Atom does, so
+ * each site declares the selectors needed to locate items and extract fields.
+ * The adapter walks every element matched by `item`, then applies the
+ * remaining selectors relative to that element.
+ *
+ * - `item` and `title` are required: without an item boundary or a title we
+ *   cannot derive a stable id or produce a meaningful `Item`.
+ * - `link` is required because `Item.url` is the only field every downstream
+ *   consumer (research / review / dedup) depends on.
+ * - `summary` / `publishedAt` / `body` / `tags` are optional; missing fields
+ *   simply drop out of the normalized item (mirrors RSS adapter behavior).
+ * - `publishedAt` is parsed via `new Date(text)`; the adapter prefers a
+ *   `datetime` / `content` attribute when the matched element exposes one
+ *   (e.g. `<time datetime="…">`), falling back to text content.
+ *
+ * See `docs/design/source-html.md` for the parser choice rationale and the
+ * selector contract in full.
+ */
+export const SourceSelectorsSchema = z.object({
+    item: z.string().min(1),
+    title: z.string().min(1),
+    link: z.string().min(1),
+    summary: z.string().optional(),
+    publishedAt: z.string().optional(),
+    body: z.string().optional(),
+    tags: z.string().optional(),
+});
+/**
+ * Validate `Source.url` per kind.
+ *
+ * Every kind except `npm-registry` requires a fully-qualified `http(s)` URL.
+ * The npm adapter accepts both the bare-package form (`@scope/pkg` or `pkg`)
+ * and the `https://www.npmjs.com/package/<pkg>` URL — see ADR-0002 — so we
+ * only enforce non-empty for that kind and let the adapter
+ * (`extractPackageName()`) canonicalize.
+ */
+function isValidHttpUrl(value) {
+    try {
+        const parsed = new URL(value);
+        return parsed.protocol === "http:" || parsed.protocol === "https:";
+    }
+    catch {
+        return false;
+    }
+}
+export const SourceSchema = z
+    .object({
+    id: z.string().min(1),
+    kind: SourceKindSchema,
+    url: z.string().min(1),
+    name: z.string().optional(),
+    tags: z.array(z.string()).default([]),
+    // Default `filters` to a fully-populated object so a source missing the
+    // entire `filters` block still parses. Zod 4's `.default()` takes the
+    // post-parse output (all required fields), so we cannot pass `{}`.
+    filters: SourceFiltersSchema.default({
+        keywords: [],
+        excludeKeywords: [],
+        matchMode: "word",
+        matchFields: ["title", "summary"],
+        caseSensitive: false,
+    }),
+    // `selectors` is required for `kind: html` and ignored for the other
+    // kinds. We model it as optional at the field level and enforce the
+    // "required when html" rule via a refinement so the same Source type
+    // serializes cleanly for both cases.
+    selectors: SourceSelectorsSchema.optional(),
+    // `trustLevel` defaults to `"untrusted"` so existing source YAMLs (which
+    // omit the field entirely) keep their current treatment. Per ADR-0009 M4
+    // this is schema-only; policy branches that read `trustLevel` arrive in a
+    // separate sub-issue.
+    trustLevel: TrustLevelSchema.default("untrusted"),
+})
+    .superRefine((value, ctx) => {
+    if (value.kind !== "npm-registry" && !isValidHttpUrl(value.url)) {
+        ctx.addIssue({
+            code: "custom",
+            path: ["url"],
+            message: "Invalid url",
+        });
+    }
+    if (value.kind === "html" && value.selectors === undefined) {
+        ctx.addIssue({
+            code: "custom",
+            path: ["selectors"],
+            message: "selectors is required when kind is 'html'",
+        });
+    }
+});
+//# sourceMappingURL=source.js.map

package/dist/schemas/source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source.js","sourceRoot":"","sources":["../../src/schemas/source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,cAAc,CAAC,CAAC,CAAC;AAG3F;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAGtE,qGAAqG;AACrG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAG7E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;AAGjE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACzC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAChD,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC;IAC1C,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACpE,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC1C,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,IAAI,EAAE,gBAAgB;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrC,wEAAwE;IACxE,sEAAsE;IACtE,mEAAmE;IACnE,OAAO,EAAE,mBAAmB,CAAC,OAAO,CAAC;QACnC,QAAQ,EAAE,EAAE;QACZ,eAAe,EAAE,EAAE;QACnB,SAAS,EAAE,MAAM;QACjB,WAAW,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC;QACjC,aAAa,EAAE,KAAK;KACrB,CAAC;IACF,qEAAqE;IACrE,oEAAoE;IACpE,qEAAqE;IACrE,qCAAqC;IACrC,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAC3C,yEAAyE;IACzE,yEAAyE;IACzE,0EAA0E;IAC1E,sBAAsB;IACtB,UAAU,EAAE,gBAAgB,CAAC,OAAO,CAAC,WAAW,CAAC;CAClD,CAAC;KACD,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,KAAK,CAAC;YACb,OAAO,EAAE,aAAa;SACvB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC3D,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,OAAO,EAAE,2CAA2C;SACrD,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/schemas/state.d.ts

@@ -0,0 +1,19 @@
+import { z } from "zod";
+export declare const SourceStateSchema: z.ZodObject<{
+    sourceId: z.ZodString;
+    lastFetchedAt: z.ZodOptional<z.ZodString>;
+    lastEtag: z.ZodOptional<z.ZodString>;
+    lastSeenIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export type SourceState = z.infer<typeof SourceStateSchema>;
+export declare const StateFileSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    sources: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        sourceId: z.ZodString;
+        lastFetchedAt: z.ZodOptional<z.ZodString>;
+        lastEtag: z.ZodOptional<z.ZodString>;
+        lastSeenIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type StateFile = z.infer<typeof StateFileSchema>;
+//# sourceMappingURL=state.d.ts.map

package/dist/schemas/state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../src/schemas/state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,iBAAiB;;;;;iBAK5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,eAAe;;;;;;;;iBAG1B,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC"}

package/dist/schemas/state.js

@@ -0,0 +1,12 @@
+import { z } from "zod";
+export const SourceStateSchema = z.object({
+    sourceId: z.string().min(1),
+    lastFetchedAt: z.string().datetime().optional(),
+    lastEtag: z.string().optional(),
+    lastSeenIds: z.array(z.string()).default([]),
+});
+export const StateFileSchema = z.object({
+    version: z.literal(1),
+    sources: z.array(SourceStateSchema).default([]),
+});
+//# sourceMappingURL=state.js.map

package/dist/schemas/state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../../src/schemas/state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC7C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAChD,CAAC,CAAC"}