@pablozrrrr/jevguard 0.1.0

package/index.js

@@ -0,0 +1,2022 @@
+// @bun
+// packages/core/src/ports/types.ts
+var SCOPE_CREEP_ANSWER = "scopeCreep";
+var COMPLEXITY_ANSWER = "complexity";
+// packages/core/src/evaluation/build-request.ts
+var NOUL_INSTRUCTIONS = "Answer true when the attributed change violates the rule's Violation, excluding behavior described by the rule's Allowed exception. Answer false when the change does not violate the rule, including allowed behavior. Return the probability from 0 to 1 that the change violates the rule.";
+function buildJevRequest(task, rule, evidence) {
+  return {
+    kind: "RULE",
+    task,
+    question: {
+      type: "noul",
+      instructions: NOUL_INSTRUCTIONS,
+      criteria: {
+        id: rule.id,
+        description: rule.description,
+        violation: rule.violation,
+        ...rule.allowed === null ? {} : { allowed: rule.allowed }
+      }
+    },
+    change: { files: evidence.files, diff: evidence.diff }
+  };
+}
+// packages/core/src/evaluation/build-context.ts
+function buildReviewContext(turn, rule, scopedPaths) {
+  return {
+    kind: "RULE",
+    turnId: turn.id,
+    ruleId: rule.id,
+    severity: rule.severity,
+    scopedPaths
+  };
+}
+// packages/core/src/evidence/defaults.ts
+var DEFAULT_MAX_DIFF_LENGTH = 1e5;
+var DEFAULT_EVIDENCE_POLICY = {
+  maxDiffLength: DEFAULT_MAX_DIFF_LENGTH,
+  allowedExtensions: [
+    ".ts",
+    ".tsx",
+    ".mts",
+    ".cts",
+    ".js",
+    ".jsx",
+    ".mjs",
+    ".cjs",
+    ".json",
+    ".jsonc",
+    ".md",
+    ".mdx",
+    ".txt",
+    ".yaml",
+    ".yml",
+    ".toml",
+    ".css",
+    ".scss",
+    ".sass",
+    ".less",
+    ".html",
+    ".htm",
+    ".vue",
+    ".svelte",
+    ".py",
+    ".rb",
+    ".go",
+    ".rs",
+    ".java",
+    ".kt",
+    ".kts",
+    ".scala",
+    ".cs",
+    ".php",
+    ".c",
+    ".h",
+    ".cc",
+    ".cpp",
+    ".hpp",
+    ".cxx",
+    ".hh",
+    ".swift",
+    ".dart",
+    ".lua",
+    ".r",
+    ".ex",
+    ".exs",
+    ".erl",
+    ".sh",
+    ".bash",
+    ".zsh",
+    ".fish",
+    ".ps1",
+    ".bat",
+    ".cmd",
+    ".sql",
+    ".graphql",
+    ".gql",
+    ".proto",
+    ".tf",
+    ".hcl",
+    ".xml",
+    ".svg",
+    ".csv",
+    ".tsv",
+    ".diff",
+    ".patch"
+  ],
+  deniedFileNames: [
+    ".env",
+    ".envrc",
+    ".netrc",
+    "_netrc",
+    ".npmrc",
+    ".pypirc",
+    ".pgpass",
+    ".git-credentials",
+    ".htpasswd",
+    ".dockercfg",
+    "id_rsa",
+    "id_dsa",
+    "id_ecdsa",
+    "id_ed25519",
+    "credentials",
+    "credentials.json",
+    "credentials.yaml",
+    "credentials.yml",
+    "secrets",
+    "secrets.json",
+    "secrets.yaml",
+    "secrets.yml",
+    "shadow",
+    "master.key"
+  ],
+  deniedExtensions: [
+    ".pem",
+    ".key",
+    ".p12",
+    ".pfx",
+    ".pkcs12",
+    ".jks",
+    ".keystore",
+    ".ppk",
+    ".p8",
+    ".der"
+  ],
+  deniedDirectoryNames: [".ssh", ".aws", ".gnupg", ".gpg", ".azure", ".kube", ".docker"]
+};
+
+// packages/core/src/evidence/paths.ts
+function normalizePath(path) {
+  return path.replace(/\\/g, "/");
+}
+function pathSegments(path) {
+  return normalizePath(path).split("/").filter((segment) => segment !== "");
+}
+function pathBasename(path) {
+  const segments = pathSegments(path);
+  return segments[segments.length - 1] ?? "";
+}
+function fileExtension(path) {
+  const basename = pathBasename(path).toLowerCase();
+  const dot = basename.lastIndexOf(".");
+  return dot <= 0 ? "" : basename.slice(dot);
+}
+
+// packages/core/src/evidence/safety.ts
+var DENIED_SENSITIVE = { allowed: false, reason: "DENIED_SENSITIVE_PATH" };
+var DENIED_EXTENSION = { allowed: false, reason: "EXTENSION_NOT_ALLOWED" };
+function checkFilePath(path, policy) {
+  const basename = pathBasename(path).toLowerCase();
+  if (matchesDeniedFileName(basename, policy)) {
+    return DENIED_SENSITIVE;
+  }
+  const segments = pathSegments(path).map((segment) => segment.toLowerCase());
+  if (segments.some((segment) => policy.deniedDirectoryNames.includes(segment))) {
+    return DENIED_SENSITIVE;
+  }
+  const extension = fileExtension(path);
+  if (policy.deniedExtensions.includes(extension)) {
+    return DENIED_SENSITIVE;
+  }
+  if (!policy.allowedExtensions.includes(extension)) {
+    return DENIED_EXTENSION;
+  }
+  return { allowed: true };
+}
+function matchesDeniedFileName(basename, policy) {
+  return policy.deniedFileNames.some((name) => name.startsWith(".") ? basename === name || basename.startsWith(`${name}.`) : basename === name);
+}
+
+// packages/core/src/evidence/scope.ts
+function matchesScope(path, scope) {
+  return globToRegExp(scope).test(normalizePath(path));
+}
+function globToRegExp(glob) {
+  const source = glob.replace(/\\/g, "/");
+  let pattern = "";
+  for (let index = 0;index < source.length; index += 1) {
+    const char = source[index] ?? "";
+    if (char === "*") {
+      if (source[index + 1] === "*") {
+        const followedBySlash = source[index + 2] === "/";
+        pattern += followedBySlash ? "(?:.*/)?" : ".*";
+        index += followedBySlash ? 2 : 1;
+      } else {
+        pattern += "[^/]*";
+      }
+      continue;
+    }
+    if (char === "?") {
+      pattern += "[^/]";
+      continue;
+    }
+    pattern += char.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  }
+  return new RegExp(`^${pattern}$`);
+}
+
+// packages/core/src/evidence/select-evidence.ts
+function selectRuleEvidence(turn, rule, policy = DEFAULT_EVIDENCE_POLICY) {
+  if (hasNoAttributedPatch(turn)) {
+    return { status: "SKIPPED", reason: "NO_ATTRIBUTED_PATCH" };
+  }
+  const applicableFiles = selectApplicableFiles(turn.files, rule.scope);
+  if (applicableFiles.length === 0) {
+    return { status: "SKIPPED", reason: "NO_SCOPE_MATCH" };
+  }
+  return mountEvidence(applicableFiles, policy);
+}
+function selectTurnEvidence(turn, policy = DEFAULT_EVIDENCE_POLICY) {
+  if (hasNoAttributedPatch(turn)) {
+    return { status: "SKIPPED", reason: "NO_ATTRIBUTED_PATCH" };
+  }
+  const attributedFiles = turn.files.filter((file) => file.patch.trim() !== "");
+  return mountEvidence(attributedFiles, policy);
+}
+function mountEvidence(files, policy) {
+  const diff = assembleDiff(files);
+  if (diff.trim() === "") {
+    return { status: "SKIPPED", reason: "NO_ATTRIBUTED_PATCH" };
+  }
+  if (diff.length > policy.maxDiffLength) {
+    return { status: "UNAVAILABLE", reason: "OVERSIZED_DIFF" };
+  }
+  if (files.some((file) => !checkFilePath(file.path, policy).allowed)) {
+    return { status: "UNAVAILABLE", reason: "BLOCKED_EVIDENCE" };
+  }
+  return {
+    status: "SELECTED",
+    evidence: { files: files.map((file) => file.path), diff }
+  };
+}
+function hasNoAttributedPatch(turn) {
+  return turn.files.every((file) => file.patch.trim() === "");
+}
+function selectApplicableFiles(files, scope) {
+  if (scope === null) {
+    return files;
+  }
+  return files.filter((file) => matchesScope(file.path, scope));
+}
+function assembleDiff(files) {
+  return files.map((file) => file.patch).join(`
+`);
+}
+
+// packages/core/src/gate/probability.ts
+function isProbability(value) {
+  return typeof value === "number" && Number.isFinite(value) && value >= 0 && value <= 1;
+}
+
+// packages/core/src/gate/evaluate-gate.ts
+function evaluateGate(severity, violationProbability, config) {
+  if (!isProbability(violationProbability)) {
+    return { outcome: "UNAVAILABLE", reason: "JEV_FAILURE" };
+  }
+  switch (severity) {
+    case "error":
+      return evaluateErrorGate(violationProbability, config.thresholds.error);
+    case "warning":
+      return evaluateWarningGate(violationProbability, config.thresholds.warning);
+  }
+}
+function evaluateErrorGate(probability, thresholds) {
+  if (probability < thresholds.warn) {
+    return { outcome: "PASS", violationProbability: probability };
+  }
+  if (probability < thresholds.fail) {
+    return { outcome: "WARN", violationProbability: probability };
+  }
+  return { outcome: "FAIL", violationProbability: probability };
+}
+function evaluateWarningGate(probability, thresholds) {
+  if (probability < thresholds.warn) {
+    return { outcome: "PASS", violationProbability: probability };
+  }
+  return { outcome: "WARN", violationProbability: probability };
+}
+
+// packages/core/src/evaluation/evaluate-with-port.ts
+async function evaluateWithPort(port, request) {
+  try {
+    const result = await port.evaluate(request);
+    return result.kind === "RULE" ? result : { kind: "RULE", status: "FAILED", reason: "INVALID_RESPONSE" };
+  } catch {
+    return { kind: "RULE", status: "FAILED", reason: "API_ERROR" };
+  }
+}
+async function evaluateBuiltInBatchWithPort(port, request) {
+  try {
+    const result = await port.evaluate(request);
+    return result.kind === "BUILT_IN_BATCH" ? result : { kind: "BUILT_IN_BATCH", status: "FAILED", reason: "INVALID_RESPONSE" };
+  } catch {
+    return { kind: "BUILT_IN_BATCH", status: "FAILED", reason: "API_ERROR" };
+  }
+}
+
+// packages/core/src/evaluation/evaluate-rule.ts
+async function evaluateRule(input, dependencies) {
+  const selection = selectRuleEvidence(input.turn, input.rule, input.evidencePolicy);
+  if (selection.status === "SKIPPED") {
+    const context = buildReviewContext(input.turn, input.rule, []);
+    return { ...context, outcome: "SKIPPED", reason: selection.reason };
+  }
+  if (selection.status === "UNAVAILABLE") {
+    const context = buildReviewContext(input.turn, input.rule, []);
+    return { ...context, outcome: "UNAVAILABLE", reason: selection.reason };
+  }
+  const context = buildReviewContext(input.turn, input.rule, selection.evidence.files);
+  const request = buildJevRequest(input.turn.task, input.rule, selection.evidence);
+  const evaluation = await evaluateWithPort(dependencies.jev, request);
+  if (evaluation.status === "FAILED") {
+    return { ...context, outcome: "UNAVAILABLE", reason: "JEV_FAILURE" };
+  }
+  const gate = evaluateGate(input.rule.severity, evaluation.noul.violationProbability, input.gateConfig);
+  return { ...context, ...gate };
+}
+// packages/core/src/review/aggregate.ts
+var VERDICT_RANK = { PASS: 0, WARN: 1, FAIL: 2 };
+function aggregateReview(turnId, results) {
+  const snapshot = [...results];
+  return { turnId, results: snapshot, summary: summarize(snapshot) };
+}
+function summarize(results) {
+  const counts = countOutcomes(results);
+  return {
+    verdict: highestVerdict(results),
+    hasUnavailable: counts.unavailable > 0,
+    counts
+  };
+}
+function countOutcomes(results) {
+  const counts = { pass: 0, warn: 0, fail: 0, skipped: 0, unavailable: 0 };
+  for (const result of results) {
+    switch (result.outcome) {
+      case "PASS":
+        counts.pass += 1;
+        break;
+      case "WARN":
+        counts.warn += 1;
+        break;
+      case "FAIL":
+        counts.fail += 1;
+        break;
+      case "SKIPPED":
+        counts.skipped += 1;
+        break;
+      case "UNAVAILABLE":
+        counts.unavailable += 1;
+        break;
+    }
+  }
+  return counts;
+}
+function highestVerdict(results) {
+  let highest = null;
+  for (const result of results) {
+    if (!isSemanticVerdict(result.outcome)) {
+      continue;
+    }
+    if (highest === null || VERDICT_RANK[result.outcome] > VERDICT_RANK[highest]) {
+      highest = result.outcome;
+    }
+  }
+  return highest;
+}
+function isSemanticVerdict(outcome) {
+  return outcome === "PASS" || outcome === "WARN" || outcome === "FAIL";
+}
+
+// packages/core/src/evaluation/evaluate-rules.ts
+async function evaluateRules(input, dependencies) {
+  const results = [];
+  for (const rule of input.rules) {
+    results.push(await evaluateRuleResult(input, rule, dependencies));
+  }
+  return aggregateReview(input.turn.id, results);
+}
+async function evaluateRuleResult(input, rule, dependencies) {
+  if (rule.status === "INVALID") {
+    return invalidRuleResult(input.turn.id, rule);
+  }
+  if (input.gateConfig.status === "INVALID") {
+    return invalidConfigResult(input.turn, rule.rule);
+  }
+  const ruleInput = {
+    turn: input.turn,
+    rule: rule.rule,
+    gateConfig: input.gateConfig.config,
+    evidencePolicy: input.evidencePolicy
+  };
+  return evaluateRule(ruleInput, dependencies);
+}
+function invalidRuleResult(turnId, failure) {
+  return {
+    kind: "RULE",
+    turnId,
+    ruleId: failure.ruleId,
+    severity: null,
+    scopedPaths: [],
+    outcome: "UNAVAILABLE",
+    reason: "INVALID_RULE"
+  };
+}
+function invalidConfigResult(turn, rule) {
+  return {
+    ...buildReviewContext(turn, rule, []),
+    outcome: "UNAVAILABLE",
+    reason: "INVALID_CONFIG"
+  };
+}
+// packages/core/src/rules/headings.ts
+var RULE_HEADING = /^##\s+(.*)$/;
+var SECTION_HEADING = /^###\s+(.*)$/;
+function matchRuleHeading(line) {
+  const match = RULE_HEADING.exec(line);
+  if (match === null) {
+    return null;
+  }
+  return (match[1] ?? "").trim();
+}
+function matchSectionHeading(line) {
+  const match = SECTION_HEADING.exec(line);
+  if (match === null) {
+    return null;
+  }
+  return (match[1] ?? "").trim();
+}
+
+// packages/core/src/rules/metadata.ts
+var METADATA_ENTRY = /^([A-Za-z][A-Za-z0-9_-]*)\s*:\s*(.*)$/;
+function parseRuleMetadata(lines) {
+  let severity = null;
+  let scope = null;
+  const seenKeys = new Set;
+  for (const line of collectMetadataLines(lines)) {
+    const entry = parseMetadataEntry(line);
+    if (entry === null) {
+      return { ok: false, code: "MALFORMED_METADATA" };
+    }
+    if (seenKeys.has(entry.key)) {
+      return { ok: false, code: "DUPLICATE_METADATA" };
+    }
+    seenKeys.add(entry.key);
+    if (entry.key === "severity") {
+      const parsed = parseSeverity(entry.value);
+      if (parsed === null) {
+        return { ok: false, code: "INVALID_SEVERITY" };
+      }
+      severity = parsed;
+      continue;
+    }
+    if (entry.key === "scope") {
+      if (entry.value === "") {
+        return { ok: false, code: "MALFORMED_METADATA" };
+      }
+      scope = entry.value;
+      continue;
+    }
+    return { ok: false, code: "MALFORMED_METADATA" };
+  }
+  if (severity === null) {
+    return { ok: false, code: "MISSING_SEVERITY" };
+  }
+  return { ok: true, value: { severity, scope } };
+}
+function collectMetadataLines(lines) {
+  const collected = [];
+  for (const line of lines) {
+    if (matchSectionHeading(line) !== null) {
+      break;
+    }
+    if (line.trim() !== "") {
+      collected.push(line);
+    }
+  }
+  return collected;
+}
+function parseMetadataEntry(line) {
+  const match = METADATA_ENTRY.exec(line);
+  if (match === null) {
+    return null;
+  }
+  return { key: match[1] ?? "", value: (match[2] ?? "").trim() };
+}
+function parseSeverity(value) {
+  switch (value) {
+    case "error":
+    case "warning":
+      return value;
+    default:
+      return null;
+  }
+}
+
+// packages/core/src/rules/sections.ts
+var SECTION_NAMES = ["Rule", "Violation", "Allowed"];
+function parseRuleSections(lines) {
+  const collected = collectSections(lines);
+  if (!collected.ok) {
+    return collected;
+  }
+  return validateSections(collected.value);
+}
+function collectSections(lines) {
+  const sections = new Map;
+  let current = null;
+  let content = [];
+  for (const line of lines) {
+    const heading = matchSectionHeading(line);
+    if (heading === null) {
+      if (current !== null) {
+        content.push(line);
+      }
+      continue;
+    }
+    if (current !== null) {
+      sections.set(current, joinContent(content));
+    }
+    if (!SECTION_NAMES.includes(heading)) {
+      return { ok: false, code: "UNKNOWN_SECTION" };
+    }
+    if (sections.has(heading)) {
+      return { ok: false, code: "DUPLICATE_SECTION" };
+    }
+    current = heading;
+    content = [];
+  }
+  if (current !== null) {
+    sections.set(current, joinContent(content));
+  }
+  return { ok: true, value: sections };
+}
+function validateSections(sections) {
+  const rule = sections.get("Rule");
+  const violation = sections.get("Violation");
+  const allowed = sections.get("Allowed") ?? null;
+  if (rule === undefined) {
+    return { ok: false, code: "MISSING_RULE" };
+  }
+  if (violation === undefined) {
+    return { ok: false, code: "MISSING_VIOLATION" };
+  }
+  if (rule === "") {
+    return { ok: false, code: "EMPTY_SECTION" };
+  }
+  if (violation === "") {
+    return { ok: false, code: "EMPTY_SECTION" };
+  }
+  if (allowed === "") {
+    return { ok: false, code: "EMPTY_ALLOWED" };
+  }
+  if (allowed !== null && allowed === violation) {
+    return { ok: false, code: "ALLOWED_EQUALS_VIOLATION" };
+  }
+  return { ok: true, value: { rule, violation, allowed } };
+}
+function joinContent(lines) {
+  return lines.join(`
+`).trim();
+}
+
+// packages/core/src/rules/blocks.ts
+var RULE_ID = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+function isValidRuleId(id) {
+  return RULE_ID.test(id);
+}
+function collectRuleBlocks(text) {
+  const blocks = [];
+  let current = null;
+  for (const line of splitLines(text)) {
+    const id = matchRuleHeading(line);
+    if (id !== null) {
+      current = { id, body: [] };
+      blocks.push(current);
+      continue;
+    }
+    if (current !== null) {
+      current.body.push(line);
+    }
+  }
+  return blocks;
+}
+function parseRuleBlock(block, duplicate) {
+  if (!isValidRuleId(block.id)) {
+    return ruleCandidateFailure("INVALID_ID", null);
+  }
+  if (duplicate) {
+    return ruleCandidateFailure("DUPLICATE_ID", block.id);
+  }
+  const metadata = parseRuleMetadata(block.body);
+  if (!metadata.ok) {
+    return ruleCandidateFailure(metadata.code, block.id);
+  }
+  const sections = parseRuleSections(block.body);
+  if (!sections.ok) {
+    return ruleCandidateFailure(sections.code, block.id);
+  }
+  return {
+    status: "PARSED",
+    rule: buildParsedRule(block.id, metadata.value, sections.value)
+  };
+}
+function ruleCandidateFailure(code, ruleId) {
+  return { status: "INVALID", reason: "INVALID_RULE", code, ruleId };
+}
+function splitLines(text) {
+  return text.replace(/\r\n?/g, `
+`).split(`
+`);
+}
+function buildParsedRule(id, metadata, sections) {
+  return {
+    id,
+    severity: metadata.severity,
+    scope: metadata.scope,
+    description: sections.rule,
+    violation: sections.violation,
+    allowed: sections.allowed
+  };
+}
+// packages/core/src/rules/parse-rules.ts
+function parseRules(text) {
+  const blocks = collectRuleBlocks(text);
+  if (blocks.length === 0) {
+    return [ruleCandidateFailure("MISSING_ID", null)];
+  }
+  const duplicates = findDuplicateIds(blocks.map((block) => block.id));
+  return blocks.map((block) => parseRuleBlock(block, duplicates.has(block.id)));
+}
+function findDuplicateIds(ids) {
+  const counts = new Map;
+  for (const id of ids) {
+    if (!isValidRuleId(id)) {
+      continue;
+    }
+    counts.set(id, (counts.get(id) ?? 0) + 1);
+  }
+  const duplicates = new Set;
+  for (const [id, count] of counts) {
+    if (count > 1) {
+      duplicates.add(id);
+    }
+  }
+  return duplicates;
+}
+// packages/core/src/builtins/complexity.ts
+var COMPLEXITY_CHECK_ID = "COMPLEXITY";
+var COMPLEXITY_GATE_CONFIG = {
+  version: 1,
+  thresholds: {
+    error: { warn: 0.4, fail: 0.7 },
+    warning: { warn: 0.5 }
+  }
+};
+var COMPLEXITY_INSTRUCTIONS = "Does this attributed change introduce material complexity that is disproportionate to, or not reasonably necessary for, completing the user's task? Necessary supporting changes, tests, validation, error handling, and complexity explicitly required by the task should not count as unnecessary complexity. Return the probability from 0 to 1 that the change introduces disproportionate or unnecessary complexity.";
+var COMPLEXITY_DESCRIPTION = "Material complexity introduced by the attributed change that is disproportionate to the problem and not reasonably necessary for completing the task.";
+var COMPLEXITY_VIOLATION = "The change adds unnecessary abstractions, layers or indirections without proportional gain, new dependencies without clear need, excessive configuration, premature generalization, or structure materially larger than the problem requires.";
+var COMPLEXITY_ALLOWED = "Complexity explicitly required by the task, and necessary supporting changes, tests, validation, error handling, auxiliary changes, or following an existing codebase abstraction to avoid breaking its pattern.";
+function buildComplexityQuestion() {
+  return {
+    type: "noul",
+    instructions: COMPLEXITY_INSTRUCTIONS,
+    criteria: {
+      id: COMPLEXITY_CHECK_ID,
+      description: COMPLEXITY_DESCRIPTION,
+      violation: COMPLEXITY_VIOLATION,
+      allowed: COMPLEXITY_ALLOWED
+    }
+  };
+}
+function buildComplexityContext(turn, scopedPaths) {
+  return {
+    kind: "BUILT_IN",
+    turnId: turn.id,
+    ruleId: null,
+    checkId: COMPLEXITY_CHECK_ID,
+    severity: "warning",
+    scopedPaths
+  };
+}
+
+// packages/core/src/builtins/scope-creep.ts
+var SCOPE_CREEP_CHECK_ID = "SCOPE-CREEP";
+var SCOPE_CREEP_GATE_CONFIG = {
+  version: 1,
+  thresholds: {
+    error: { warn: 0.65, fail: 0.9 },
+    warning: { warn: 0.6 }
+  }
+};
+var SCOPE_CREEP_INSTRUCTIONS = "Answer true when the attributed change contains scope creep: material functional, behavioral, architectural, dependency, configuration, documentation, or refactoring work that the task did not request and that is not reasonably necessary to complete the task. Answer false when every change is requested work, or supporting, testing, or documentation work reasonably necessary to complete the requested work, including immaterial incidental edits. Return the probability from 0 to 1 that the change is scope creep.";
+var SCOPE_CREEP_DESCRIPTION = "A change is scope creep when it introduces material functional, behavioral, architectural, dependency, configuration, documentation, or refactoring work that the task did not request and that is not reasonably necessary to complete it.";
+var SCOPE_CREEP_VIOLATION = "The change adds material functional, behavioral, architectural, dependency, configuration, documentation, or refactoring work that the task did not request and that is not reasonably necessary to complete the task.";
+var SCOPE_CREEP_ALLOWED = "Changes the task requested, and supporting, testing, and documentation changes reasonably necessary to complete the requested work, including immaterial incidental edits.";
+function buildScopeCreepQuestion() {
+  return {
+    type: "noul",
+    instructions: SCOPE_CREEP_INSTRUCTIONS,
+    criteria: {
+      id: SCOPE_CREEP_CHECK_ID,
+      description: SCOPE_CREEP_DESCRIPTION,
+      violation: SCOPE_CREEP_VIOLATION,
+      allowed: SCOPE_CREEP_ALLOWED
+    }
+  };
+}
+function buildScopeCreepContext(turn, scopedPaths) {
+  return {
+    kind: "BUILT_IN",
+    turnId: turn.id,
+    ruleId: null,
+    checkId: SCOPE_CREEP_CHECK_ID,
+    severity: "error",
+    scopedPaths
+  };
+}
+
+// packages/core/src/builtins/evaluate-builtins.ts
+function buildBuiltInBatchRequest(task, evidence) {
+  return {
+    kind: "BUILT_IN_BATCH",
+    task,
+    questions: {
+      [SCOPE_CREEP_ANSWER]: buildScopeCreepQuestion(),
+      [COMPLEXITY_ANSWER]: buildComplexityQuestion()
+    },
+    change: { files: evidence.files, diff: evidence.diff }
+  };
+}
+async function evaluateBuiltIns(input, dependencies) {
+  const selection = selectTurnEvidence(input.turn, input.evidencePolicy);
+  if (selection.status === "SKIPPED") {
+    return {
+      scopeCreep: {
+        ...buildScopeCreepContext(input.turn, []),
+        outcome: "SKIPPED",
+        reason: selection.reason
+      },
+      complexity: {
+        ...buildComplexityContext(input.turn, []),
+        outcome: "SKIPPED",
+        reason: selection.reason
+      }
+    };
+  }
+  if (selection.status === "UNAVAILABLE") {
+    return {
+      scopeCreep: {
+        ...buildScopeCreepContext(input.turn, []),
+        outcome: "UNAVAILABLE",
+        reason: selection.reason
+      },
+      complexity: {
+        ...buildComplexityContext(input.turn, []),
+        outcome: "UNAVAILABLE",
+        reason: selection.reason
+      }
+    };
+  }
+  const evidence = selection.evidence;
+  const request = buildBuiltInBatchRequest(input.turn.task, evidence);
+  const evaluation = await evaluateBuiltInBatchWithPort(dependencies.jev, request);
+  const scopeCreepContext = buildScopeCreepContext(input.turn, evidence.files);
+  const complexityContext = buildComplexityContext(input.turn, evidence.files);
+  if (evaluation.status === "FAILED") {
+    return {
+      scopeCreep: { ...scopeCreepContext, outcome: "UNAVAILABLE", reason: "JEV_FAILURE" },
+      complexity: { ...complexityContext, outcome: "UNAVAILABLE", reason: "JEV_FAILURE" }
+    };
+  }
+  return {
+    scopeCreep: gateScopeCreep(evaluation.answers.scopeCreep, scopeCreepContext),
+    complexity: gateComplexity(evaluation.answers.complexity, complexityContext)
+  };
+}
+function gateScopeCreep(answer, context) {
+  if (answer.status === "FAILED") {
+    return { ...context, outcome: "UNAVAILABLE", reason: "JEV_FAILURE" };
+  }
+  return {
+    ...context,
+    ...evaluateGate("error", answer.noul.violationProbability, SCOPE_CREEP_GATE_CONFIG)
+  };
+}
+function gateComplexity(answer, context) {
+  if (answer.status === "FAILED") {
+    return { ...context, outcome: "UNAVAILABLE", reason: "JEV_FAILURE" };
+  }
+  return {
+    ...context,
+    ...evaluateGate("warning", answer.noul.violationProbability, COMPLEXITY_GATE_CONFIG)
+  };
+}
+// packages/core/src/concurrency/fifo-port.ts
+function createFifoJevPort(port, config) {
+  const maxConcurrency = config.maxConcurrency;
+  if (!Number.isInteger(maxConcurrency) || maxConcurrency < 1) {
+    throw new RangeError("maxConcurrency must be a positive integer");
+  }
+  const queue = [];
+  let active = 0;
+  function drain() {
+    while (active < maxConcurrency && queue.length > 0) {
+      const pending = queue.shift();
+      if (pending === undefined) {
+        return;
+      }
+      active += 1;
+      start(pending);
+    }
+  }
+  function start(pending) {
+    Promise.resolve().then(() => port.evaluate(pending.request)).then((result) => {
+      active -= 1;
+      pending.settle(result);
+      drain();
+    }, (error) => {
+      active -= 1;
+      pending.fail(error);
+      drain();
+    });
+  }
+  return {
+    evaluate(request) {
+      return new Promise((settle, fail) => {
+        queue.push({ request, settle, fail });
+        drain();
+      });
+    }
+  };
+}
+// packages/core/src/gate/defaults.ts
+var DEFAULT_GATE_CONFIG = {
+  version: 1,
+  thresholds: {
+    error: { warn: 0.4, fail: 0.7 },
+    warning: { warn: 0.6 }
+  }
+};
+// packages/core/src/gate/config.ts
+function resolveGateConfig(value) {
+  if (value === null || value === undefined) {
+    return { status: "VALID", config: DEFAULT_GATE_CONFIG };
+  }
+  if (!isRecord(value) || value.version !== 1) {
+    return invalid();
+  }
+  const thresholds = value.thresholds;
+  if (!isRecord(thresholds)) {
+    return invalid();
+  }
+  const error = thresholds.error;
+  const warning = thresholds.warning;
+  if (!isRecord(error) || !isRecord(warning)) {
+    return invalid();
+  }
+  const errorWarn = error.warn;
+  const errorFail = error.fail;
+  const warningWarn = warning.warn;
+  if (!isProbability(errorWarn) || !isProbability(errorFail) || !isProbability(warningWarn)) {
+    return invalid();
+  }
+  if (errorWarn >= errorFail) {
+    return invalid();
+  }
+  return {
+    status: "VALID",
+    config: {
+      version: 1,
+      thresholds: {
+        error: { warn: errorWarn, fail: errorFail },
+        warning: { warn: warningWarn }
+      }
+    }
+  };
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function invalid() {
+  return { status: "INVALID", reason: "INVALID_CONFIG" };
+}
+// packages/opencode-adapter/src/attribution/locate-turn.ts
+function findCompletedAssistant(records) {
+  for (let index = records.length - 1;index >= 0; index -= 1) {
+    const record = records[index];
+    if (record !== undefined && isCompletedAssistant(record.info)) {
+      return record.info;
+    }
+  }
+  return null;
+}
+function findDirectParentRecord(records, assistant) {
+  const parentID = assistant.parentID;
+  if (typeof parentID !== "string" || parentID === "") {
+    return null;
+  }
+  const record = records.find((item) => item.info.id === parentID);
+  if (record === undefined || record.info.role !== "user") {
+    return null;
+  }
+  return record;
+}
+function isCompletedAssistant(info) {
+  if (info.role !== "assistant") {
+    return false;
+  }
+  if (typeof info.parentID !== "string" || info.parentID === "") {
+    return false;
+  }
+  if (info.error !== undefined && info.error !== null) {
+    return false;
+  }
+  if (info.summary === true) {
+    return false;
+  }
+  return Number.isFinite(info.time?.completed);
+}
+
+// packages/opencode-adapter/src/attribution/normalize-patch.ts
+function normalizeFileDiff(diff) {
+  const path = typeof diff.file === "string" ? diff.file.trim() : "";
+  if (path === "") {
+    return { status: "INCOMPLETE" };
+  }
+  if (typeof diff.patch === "string" && diff.patch.trim() !== "") {
+    return { status: "PATCH", file: { path, patch: diff.patch } };
+  }
+  const before = diff.before;
+  const after = diff.after;
+  if (typeof before !== "string" || typeof after !== "string") {
+    return { status: "INCOMPLETE" };
+  }
+  if (before === after) {
+    return { status: "EMPTY" };
+  }
+  return { status: "PATCH", file: { path, patch: buildReplacementPatch(path, before, after) } };
+}
+function buildReplacementPatch(path, before, after) {
+  const beforeLines = splitLines2(before);
+  const afterLines = splitLines2(after);
+  const fromPath = beforeLines.length === 0 ? "/dev/null" : `a/${path}`;
+  const toPath = afterLines.length === 0 ? "/dev/null" : `b/${path}`;
+  const header = `--- ${fromPath}
++++ ${toPath}`;
+  const range = `@@ -${hunkStart(beforeLines.length)},${beforeLines.length} +${hunkStart(afterLines.length)},${afterLines.length} @@`;
+  const removed = beforeLines.map((line) => `-${line}`);
+  const added = afterLines.map((line) => `+${line}`);
+  return [header, range, ...removed, ...added, ""].join(`
+`);
+}
+function splitLines2(text) {
+  if (text === "") {
+    return [];
+  }
+  const lines = text.split(`
+`);
+  if (lines[lines.length - 1] === "") {
+    lines.pop();
+  }
+  return lines;
+}
+function hunkStart(lineCount) {
+  return lineCount === 0 ? 0 : 1;
+}
+
+// packages/opencode-adapter/src/attribution/task.ts
+function extractTask(parts) {
+  const task = parts.filter(isTextPart).map((part) => part.text).join(`
+`);
+  return task.trim() === "" ? null : task;
+}
+function isTextPart(part) {
+  return part.type === "text" && typeof part.text === "string";
+}
+
+// packages/opencode-adapter/src/attribution/attribute-turn.ts
+async function attributeTurn(sessionID, dependencies) {
+  const facade = dependencies.facade;
+  const deduplicator = dependencies.deduplicator;
+  const records = await readMessages(facade, sessionID);
+  if (records === null) {
+    return unavailable("MESSAGE_READ_FAILURE");
+  }
+  const assistant = findCompletedAssistant(records);
+  if (assistant === null) {
+    return { status: "NONE" };
+  }
+  if (deduplicator.hasProcessed(assistant.id)) {
+    return { status: "ALREADY_PROCESSED" };
+  }
+  const parent = findDirectParentRecord(records, assistant);
+  if (parent === null) {
+    return unavailable("MISSING_PARENT_MESSAGE");
+  }
+  const task = extractTask(parent.parts);
+  if (task === null) {
+    return unavailable("EMPTY_TASK");
+  }
+  const diffs = await readDiff(facade, sessionID, parent.info.id);
+  if (diffs === null) {
+    return unavailable("DIFF_READ_FAILURE");
+  }
+  const files = normalizeDiffs(diffs);
+  if (files === null) {
+    return unavailable("INCOMPLETE_FILE_DIFF");
+  }
+  deduplicator.markProcessed(assistant.id);
+  const turn = { id: assistant.id, task, files };
+  return { status: "ATTRIBUTED", turn };
+}
+async function readMessages(facade, sessionID) {
+  try {
+    return await facade.listMessages({ sessionID });
+  } catch {
+    return null;
+  }
+}
+async function readDiff(facade, sessionID, messageID) {
+  try {
+    return await facade.fetchDiff({ sessionID, messageID });
+  } catch {
+    return null;
+  }
+}
+function normalizeDiffs(diffs) {
+  const files = [];
+  for (const diff of diffs) {
+    const result = normalizeFileDiff(diff);
+    if (result.status === "INCOMPLETE") {
+      return null;
+    }
+    if (result.status === "PATCH") {
+      files.push(result.file);
+    }
+  }
+  return files;
+}
+function unavailable(reason) {
+  return { status: "UNAVAILABLE", reason };
+}
+// packages/opencode-adapter/src/attribution/deduplicator.ts
+class InMemoryTurnDeduplicator {
+  processed = new Set;
+  hasProcessed(assistantMessageID) {
+    return this.processed.has(assistantMessageID);
+  }
+  markProcessed(assistantMessageID) {
+    this.processed.add(assistantMessageID);
+  }
+}
+// packages/opencode-adapter/src/attribution/opencode.ts
+function createOpenCodeSessionFacade(client) {
+  return {
+    async listMessages(input) {
+      const result = await client.session.messages({ path: { id: input.sessionID } });
+      if (result.data === undefined || result.error !== undefined) {
+        throw new Error("OpenCode session messages unavailable");
+      }
+      return result.data;
+    },
+    async fetchDiff(input) {
+      const result = await client.session.diff({
+        path: { id: input.sessionID },
+        query: { messageID: input.messageID }
+      });
+      if (result.data === undefined || result.error !== undefined) {
+        throw new Error("OpenCode session diff unavailable");
+      }
+      return result.data;
+    }
+  };
+}
+// packages/opencode-adapter/src/credentials/constants.ts
+var CREDENTIAL_SERVICE = "jevguard";
+var CREDENTIAL_ACCOUNT = "typesafe-api-key";
+var API_KEY_ENVIRONMENT_VARIABLE = "TYPESAFE_API_KEY";
+
+// packages/opencode-adapter/src/credentials/secret.ts
+function normalizeSecret(value) {
+  if (value === undefined) {
+    return null;
+  }
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+
+// packages/opencode-adapter/src/credentials/provider.ts
+function createCredentialProvider(dependencies) {
+  return {
+    async resolve() {
+      const override = normalizeSecret(dependencies.environment.get(API_KEY_ENVIRONMENT_VARIABLE));
+      if (override !== null) {
+        return { status: "AVAILABLE", source: "ENVIRONMENT", apiKey: override };
+      }
+      const stored = await readStored(dependencies.store);
+      switch (stored.status) {
+        case "FOUND": {
+          const secret = normalizeSecret(stored.apiKey);
+          if (secret === null) {
+            return { status: "UNAVAILABLE", reason: "MISSING_CREDENTIAL" };
+          }
+          return { status: "AVAILABLE", source: "STORE", apiKey: secret };
+        }
+        case "NOT_FOUND":
+          return { status: "UNAVAILABLE", reason: "MISSING_CREDENTIAL" };
+        case "FAILED":
+          return { status: "UNAVAILABLE", reason: stored.reason };
+      }
+    }
+  };
+}
+async function readStored(store) {
+  try {
+    return await store.read();
+  } catch {
+    return { status: "FAILED", reason: "STORE_READ_FAILURE" };
+  }
+}
+// packages/opencode-adapter/src/credentials/environment.ts
+function createProcessEnvironment() {
+  return {
+    get(name) {
+      return process.env[name];
+    }
+  };
+}
+// packages/opencode-adapter/src/credentials/keyring-store.ts
+var KEYRING_ENTRY_OPTIONS = { linux: { store: "secret-service" } };
+function createKeyringEntry(EntryConstructor) {
+  return new EntryConstructor(CREDENTIAL_SERVICE, CREDENTIAL_ACCOUNT, KEYRING_ENTRY_OPTIONS);
+}
+function createKeyringCredentialStore() {
+  return {
+    read: readCredential,
+    write: writeCredential,
+    delete: deleteCredential
+  };
+}
+async function readCredential() {
+  try {
+    const { AsyncEntry } = await import("@napi-rs/keyring");
+    const value = await createKeyringEntry(AsyncEntry).getPassword();
+    if (value === undefined || value.length === 0) {
+      return { status: "NOT_FOUND" };
+    }
+    return { status: "FOUND", apiKey: value };
+  } catch {
+    return { status: "FAILED", reason: "STORE_READ_FAILURE" };
+  }
+}
+async function writeCredential(apiKey) {
+  try {
+    const { AsyncEntry } = await import("@napi-rs/keyring");
+    await createKeyringEntry(AsyncEntry).setPassword(apiKey);
+    return { status: "SAVED" };
+  } catch {
+    return { status: "FAILED", reason: "STORE_WRITE_FAILURE" };
+  }
+}
+async function deleteCredential() {
+  try {
+    const { AsyncEntry } = await import("@napi-rs/keyring");
+    const deleted = await createKeyringEntry(AsyncEntry).deletePassword();
+    return deleted ? { status: "DELETED" } : { status: "NOT_FOUND" };
+  } catch {
+    return { status: "FAILED", reason: "STORE_DELETE_FAILURE" };
+  }
+}
+// packages/opencode-adapter/src/credentials/login.ts
+async function login(input) {
+  const prompted = await readPrompt(input.prompt);
+  const collected = collectSecret(prompted);
+  if (collected.status !== "READ") {
+    return collected;
+  }
+  const written = await writeSecret(input.store, collected.value);
+  if (written.status === "FAILED") {
+    return { status: "FAILED", reason: "STORE_WRITE_FAILURE" };
+  }
+  return { status: "SAVED" };
+}
+async function readPrompt(prompt) {
+  try {
+    return await prompt.read("TypeSafe API key: ");
+  } catch {
+    return { status: "FAILED", reason: "PROMPT_FAILURE" };
+  }
+}
+async function writeSecret(store, value) {
+  try {
+    return await store.write(value);
+  } catch {
+    return { status: "FAILED", reason: "STORE_WRITE_FAILURE" };
+  }
+}
+function collectSecret(prompted) {
+  if (prompted.status === "ABORTED") {
+    return { status: "ABORTED" };
+  }
+  if (prompted.status === "FAILED") {
+    return { status: "FAILED", reason: prompted.reason };
+  }
+  const secret = normalizeSecret(prompted.value);
+  if (secret === null) {
+    return { status: "FAILED", reason: "EMPTY_SECRET" };
+  }
+  return { status: "READ", value: secret };
+}
+// packages/opencode-adapter/src/credentials/prompt.ts
+function createSecretPrompt() {
+  return {
+    read: readSecret
+  };
+}
+async function readSecret(message) {
+  if (process.stdin.isTTY !== true) {
+    return { status: "FAILED", reason: "NOT_A_TTY" };
+  }
+  try {
+    const { default: password } = await import("@inquirer/password");
+    const value = await password({ message, mask: true });
+    return { status: "READ", value };
+  } catch (error) {
+    if (error instanceof Error && error.name === "ExitPromptError") {
+      return { status: "ABORTED" };
+    }
+    return { status: "FAILED", reason: "PROMPT_FAILURE" };
+  }
+}
+// packages/opencode-adapter/src/jev/transport.ts
+import { TypeSafeClient } from "@typesafe-ai/sdk";
+
+// packages/opencode-adapter/src/jev/types.ts
+var JEV_MODEL = "jev-latest";
+
+// packages/opencode-adapter/src/jev/transport.ts
+var DEFAULT_ALLOWED_CRITERION = "The change does not violate the rule's Violation.";
+function buildTypeSafeClientConfig(apiKey) {
+  return { apiKey, defaultModel: JEV_MODEL, logLevel: "off" };
+}
+function createJevTransport(dependencies) {
+  return {
+    async evaluate(request) {
+      const credential = await resolveCredential(dependencies.credentials);
+      if (credential.status === "UNAVAILABLE") {
+        return failedFor(request, toFailureReason(credential.reason));
+      }
+      let client;
+      try {
+        client = dependencies.createClient(credential.apiKey);
+      } catch {
+        return failedFor(request, "API_ERROR");
+      }
+      return evaluateWithClient(client, request);
+    }
+  };
+}
+function createTypeSafeJevTransport(credentials) {
+  return createJevTransport({ credentials, createClient: createTypeSafeSystemOneClient });
+}
+function createTypeSafeSystemOneClient(apiKey) {
+  const client = new TypeSafeClient(buildTypeSafeClientConfig(apiKey));
+  return {
+    systemOne: (request) => client.systemOne(request)
+  };
+}
+async function resolveCredential(provider) {
+  try {
+    return await provider.resolve();
+  } catch {
+    return { status: "UNAVAILABLE", reason: "STORE_READ_FAILURE" };
+  }
+}
+function toFailureReason(reason) {
+  return reason === "MISSING_CREDENTIAL" ? "MISSING_CREDENTIAL" : "API_ERROR";
+}
+async function evaluateWithClient(client, request) {
+  switch (request.kind) {
+    case "RULE":
+      return evaluateRuleWithClient(client, request);
+    case "BUILT_IN_BATCH":
+      return evaluateBatchWithClient(client, request);
+  }
+}
+async function evaluateRuleWithClient(client, request) {
+  let response;
+  try {
+    response = await client.systemOne(toRuleSystemOneRequest(request));
+  } catch {
+    return ruleFailed("API_ERROR");
+  }
+  const violationProbability = readViolationProbability(response);
+  if (violationProbability === null) {
+    return ruleFailed("INVALID_RESPONSE");
+  }
+  return { kind: "RULE", status: "EVALUATED", noul: { violationProbability } };
+}
+async function evaluateBatchWithClient(client, request) {
+  let response;
+  try {
+    response = await client.systemOne(toBatchSystemOneRequest(request));
+  } catch {
+    return batchFailed("API_ERROR");
+  }
+  return readBatchAnswers(response);
+}
+function toRuleSystemOneRequest(request) {
+  return {
+    state: {
+      task: request.task,
+      rule: toCriterion(request.question.criteria),
+      change: toChange(request.change)
+    },
+    questions: {
+      violation: toTypeSafeQuestion(request.question.instructions, request.question.criteria)
+    },
+    model: JEV_MODEL
+  };
+}
+function toBatchSystemOneRequest(request) {
+  const scopeCreep = request.questions.scopeCreep;
+  const complexity = request.questions.complexity;
+  return {
+    state: {
+      task: request.task,
+      checks: toChecks(scopeCreep.criteria, complexity.criteria),
+      change: toChange(request.change)
+    },
+    questions: {
+      [SCOPE_CREEP_ANSWER]: toTypeSafeQuestion(scopeCreep.instructions, scopeCreep.criteria),
+      [COMPLEXITY_ANSWER]: toTypeSafeQuestion(complexity.instructions, complexity.criteria)
+    },
+    model: JEV_MODEL
+  };
+}
+function toChecks(scopeCreep, complexity) {
+  return {
+    scopeCreep: toCriterion(scopeCreep),
+    complexity: toCriterion(complexity)
+  };
+}
+function toChange(change) {
+  return { files: [...change.files], diff: change.diff };
+}
+function toTypeSafeQuestion(instructions, criteria) {
+  return {
+    type: "noul",
+    instructions,
+    criteria: {
+      true: criteria.violation,
+      false: criteria.allowed ?? DEFAULT_ALLOWED_CRITERION
+    }
+  };
+}
+function toCriterion(criteria) {
+  return {
+    id: criteria.id,
+    description: criteria.description,
+    violation: criteria.violation,
+    ...criteria.allowed === undefined ? {} : { allowed: criteria.allowed }
+  };
+}
+function readViolationProbability(response) {
+  if (!isRecord2(response)) {
+    return null;
+  }
+  const answers = response.answers;
+  if (!isRecord2(answers)) {
+    return null;
+  }
+  const violation = answers.violation;
+  if (!isRecord2(violation) || violation.type !== "noul") {
+    return null;
+  }
+  const noul = violation.noul;
+  return isProbability2(noul) ? noul : null;
+}
+function readBatchAnswers(response) {
+  if (!isRecord2(response)) {
+    return batchFailed("INVALID_RESPONSE");
+  }
+  const answers = response.answers;
+  if (!isRecord2(answers)) {
+    return batchFailed("INVALID_RESPONSE");
+  }
+  return {
+    kind: "BUILT_IN_BATCH",
+    status: "EVALUATED",
+    answers: {
+      [SCOPE_CREEP_ANSWER]: readAnswer(answers, SCOPE_CREEP_ANSWER),
+      [COMPLEXITY_ANSWER]: readAnswer(answers, COMPLEXITY_ANSWER)
+    }
+  };
+}
+function readAnswer(answers, key) {
+  const answer = answers[key];
+  if (!isRecord2(answer) || answer.type !== "noul") {
+    return { status: "FAILED", reason: "INVALID_RESPONSE" };
+  }
+  const noul = answer.noul;
+  if (!isProbability2(noul)) {
+    return { status: "FAILED", reason: "INVALID_RESPONSE" };
+  }
+  return { status: "EVALUATED", noul: { violationProbability: noul } };
+}
+function isProbability2(value) {
+  return typeof value === "number" && Number.isFinite(value) && value >= 0 && value <= 1;
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function ruleFailed(reason) {
+  return { kind: "RULE", status: "FAILED", reason };
+}
+function batchFailed(reason) {
+  return { kind: "BUILT_IN_BATCH", status: "FAILED", reason };
+}
+function failedFor(request, reason) {
+  return request.kind === "RULE" ? ruleFailed(reason) : batchFailed(reason);
+}
+// packages/opencode-adapter/src/policy/config-yaml.ts
+import { parseDocument, visit } from "yaml";
+function parsePolicyConfig(text) {
+  const document = parseDocument(text, { strict: true, uniqueKeys: true });
+  if (document.errors.length > 0 || document.warnings.length > 0) {
+    return invalid2();
+  }
+  if (document.contents === null || containsAliasAnchorOrTag(document)) {
+    return invalid2();
+  }
+  try {
+    return { status: "PARSED", value: document.toJS({ maxAliasCount: 0 }) };
+  } catch {
+    return invalid2();
+  }
+}
+function containsAliasAnchorOrTag(document) {
+  let unsafe = false;
+  visit(document, {
+    Alias() {
+      unsafe = true;
+      return visit.BREAK;
+    },
+    Node(_key, node) {
+      if (node.anchor !== undefined || node.tag !== undefined) {
+        unsafe = true;
+        return visit.BREAK;
+      }
+    }
+  });
+  return unsafe;
+}
+function invalid2() {
+  return { status: "INVALID", reason: "INVALID_CONFIG" };
+}
+// packages/opencode-adapter/src/policy/file-source.ts
+import { readFile } from "fs/promises";
+import { join } from "path";
+function createPolicyFileLoader(dependencies) {
+  return {
+    async load() {
+      const rules = await readOptionalFile(dependencies.fileSystem, join(dependencies.root, ".jev", "rules.md"));
+      if (rules.status === "FAILED") {
+        return { status: "FAILED", reason: "RULES_READ_FAILURE" };
+      }
+      const config = await readOptionalFile(dependencies.fileSystem, join(dependencies.root, ".jev", "config.yaml"));
+      if (config.status === "FAILED") {
+        return { status: "FAILED", reason: "CONFIG_READ_FAILURE" };
+      }
+      return {
+        status: "LOADED",
+        source: { rules: rules.value, config: config.value }
+      };
+    }
+  };
+}
+function createNodePolicyFileSystem() {
+  return {
+    readFile: (path) => readFile(path, "utf8")
+  };
+}
+async function readOptionalFile(fileSystem, path) {
+  try {
+    return { status: "READ", value: await fileSystem.readFile(path) };
+  } catch (error) {
+    if (isMissingFileError(error)) {
+      return { status: "READ", value: null };
+    }
+    return { status: "FAILED" };
+  }
+}
+function isMissingFileError(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+// packages/opencode-adapter/src/presentation/display.ts
+function displayOutcome(counts) {
+  if (counts.fail > 0) {
+    return "FAIL";
+  }
+  if (counts.unavailable > 0) {
+    return "UNAVAILABLE";
+  }
+  if (counts.warn > 0) {
+    return "WARN";
+  }
+  if (counts.pass > 0) {
+    return "PASS";
+  }
+  return "SKIPPED";
+}
+
+// packages/opencode-adapter/src/presentation/log.ts
+function toReviewLogEntry(review) {
+  return {
+    turnId: review.turnId,
+    summary: {
+      highestVerdict: review.summary.verdict,
+      hasUnavailable: review.summary.hasUnavailable,
+      counts: { ...review.summary.counts }
+    },
+    results: review.results.map(toReviewLogResult)
+  };
+}
+function toReviewLogResult(result) {
+  switch (result.kind) {
+    case "RULE":
+      return ruleLogResult(result);
+    case "BUILT_IN":
+      return builtInLogResult(result);
+    case "REVIEW":
+      return reviewLevelLogResult(result);
+  }
+}
+function logLevelFor(outcome) {
+  switch (outcome) {
+    case "PASS":
+    case "SKIPPED":
+      return "info";
+    case "WARN":
+      return "warn";
+    case "FAIL":
+    case "UNAVAILABLE":
+      return "error";
+  }
+}
+function reviewLogMessage(entry) {
+  return `JevGuard ${displayOutcome(entry.summary.counts)} for turn ${entry.turnId}`;
+}
+function ruleLogResult(result) {
+  const identity = {
+    kind: "RULE",
+    ruleId: result.ruleId,
+    severity: result.severity,
+    scopedPaths: [...result.scopedPaths]
+  };
+  switch (result.outcome) {
+    case "PASS":
+    case "WARN":
+    case "FAIL":
+      return {
+        ...identity,
+        outcome: result.outcome,
+        violationProbability: result.violationProbability
+      };
+    case "SKIPPED":
+    case "UNAVAILABLE":
+      return { ...identity, outcome: result.outcome, reason: result.reason };
+  }
+}
+function builtInLogResult(result) {
+  const identity = {
+    kind: "BUILT_IN",
+    checkId: result.checkId,
+    severity: result.severity,
+    scopedPaths: [...result.scopedPaths]
+  };
+  switch (result.outcome) {
+    case "PASS":
+    case "WARN":
+    case "FAIL":
+      return {
+        ...identity,
+        outcome: result.outcome,
+        violationProbability: result.violationProbability
+      };
+    case "SKIPPED":
+    case "UNAVAILABLE":
+      return { ...identity, outcome: result.outcome, reason: result.reason };
+  }
+}
+function reviewLevelLogResult(result) {
+  return { kind: "REVIEW", outcome: result.outcome, reason: result.reason };
+}
+
+// packages/opencode-adapter/src/presentation/toast.ts
+function toReviewToast(review) {
+  const outcome = displayOutcome(review.summary.counts);
+  return {
+    title: `JevGuard ${outcome}`,
+    message: countSummary(review.summary.counts),
+    variant: toastVariantFor(outcome)
+  };
+}
+function toastVariantFor(outcome) {
+  switch (outcome) {
+    case "PASS":
+      return "success";
+    case "WARN":
+      return "warning";
+    case "FAIL":
+    case "UNAVAILABLE":
+      return "error";
+    case "SKIPPED":
+      return "info";
+  }
+}
+function countSummary(counts) {
+  return `pass ${counts.pass} \xB7 warn ${counts.warn} \xB7 fail ${counts.fail} \xB7 skipped ${counts.skipped} \xB7 unavailable ${counts.unavailable}`;
+}
+// packages/opencode-adapter/src/presentation/opencode.ts
+var SERVICE_NAME = "jevguard";
+var TOAST_DURATION_MS = 5000;
+function createOpenCodePresentationClient(client) {
+  return {
+    app: {
+      log: (input) => client.app.log({ body: input.body })
+    },
+    tui: {
+      showToast: (input) => client.tui.showToast({ body: input.body })
+    }
+  };
+}
+function createOpenCodeLogSink(client) {
+  return {
+    async write(entry) {
+      try {
+        const result = await client.app.log({
+          body: {
+            service: SERVICE_NAME,
+            level: logLevelFor(displayOutcome(entry.summary.counts)),
+            message: reviewLogMessage(entry),
+            extra: toLogExtra(entry)
+          }
+        });
+        return result.error === undefined ? "DELIVERED" : "FAILED";
+      } catch {
+        return "FAILED";
+      }
+    }
+  };
+}
+function createOpenCodeToastSink(client) {
+  return {
+    async show(toast) {
+      try {
+        const result = await client.tui.showToast({
+          body: {
+            title: toast.title,
+            message: toast.message,
+            variant: toast.variant,
+            duration: TOAST_DURATION_MS
+          }
+        });
+        return result.error === undefined ? "DELIVERED" : "FAILED";
+      } catch {
+        return "FAILED";
+      }
+    }
+  };
+}
+function toLogExtra(entry) {
+  return {
+    turnId: entry.turnId,
+    summary: {
+      highestVerdict: entry.summary.highestVerdict,
+      hasUnavailable: entry.summary.hasUnavailable,
+      counts: { ...entry.summary.counts }
+    },
+    results: entry.results.map(toResultExtra)
+  };
+}
+function toResultExtra(result) {
+  return { ...toIdentityExtra(result), ...toOutcomeExtra(result) };
+}
+function toIdentityExtra(result) {
+  switch (result.kind) {
+    case "RULE":
+      return {
+        kind: result.kind,
+        ruleId: result.ruleId,
+        severity: result.severity,
+        scopedPaths: [...result.scopedPaths]
+      };
+    case "BUILT_IN":
+      return {
+        kind: result.kind,
+        checkId: result.checkId,
+        severity: result.severity,
+        scopedPaths: [...result.scopedPaths]
+      };
+    case "REVIEW":
+      return { kind: result.kind };
+  }
+}
+function toOutcomeExtra(result) {
+  switch (result.outcome) {
+    case "PASS":
+    case "WARN":
+    case "FAIL":
+      return { outcome: result.outcome, violationProbability: result.violationProbability };
+    case "SKIPPED":
+    case "UNAVAILABLE":
+      return { outcome: result.outcome, reason: result.reason };
+  }
+}
+
+// packages/opencode-adapter/src/presentation/index.ts
+function createReviewPresenter(ports) {
+  return {
+    async present(review) {
+      const log = await deliverLog(ports.log, toReviewLogEntry(review));
+      const toast = await deliverToast(ports.toast, toReviewToast(review));
+      return { log, toast };
+    }
+  };
+}
+async function deliverLog(sink, entry) {
+  try {
+    return await sink.write(entry);
+  } catch {
+    return "FAILED";
+  }
+}
+async function deliverToast(sink, toast) {
+  try {
+    return await sink.show(toast);
+  } catch {
+    return "FAILED";
+  }
+}
+// packages/plugin/src/idle-event.ts
+function idleSessionID(event) {
+  if (!isRecord3(event) || event.type !== "session.status") {
+    return null;
+  }
+  const properties = event.properties;
+  if (!isRecord3(properties)) {
+    return null;
+  }
+  const status = properties.status;
+  if (!isRecord3(status) || status.type !== "idle") {
+    return null;
+  }
+  const sessionID = properties.sessionID;
+  return typeof sessionID === "string" && sessionID !== "" ? sessionID : null;
+}
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// packages/plugin/src/present.ts
+async function presentReview(presenter, review) {
+  try {
+    await presenter.present(review);
+  } catch {
+    return;
+  }
+}
+
+// packages/plugin/src/review-result.ts
+function reviewLevelUnavailable(turnId, reason) {
+  return {
+    kind: "REVIEW",
+    turnId,
+    ruleId: null,
+    severity: null,
+    scopedPaths: [],
+    outcome: "UNAVAILABLE",
+    reason
+  };
+}
+function unavailableReview(turnId, reason) {
+  return aggregateReview(turnId, [reviewLevelUnavailable(turnId, reason)]);
+}
+
+// packages/plugin/src/review.ts
+async function reviewAttributedTurn(turn, dependencies) {
+  const loaded = await loadPolicy(dependencies.policy);
+  const builtInInput = { turn, evidencePolicy: DEFAULT_EVIDENCE_POLICY };
+  const [ruleResults, builtIns] = await Promise.all([
+    evaluateRuleLane(turn, loaded, dependencies),
+    evaluateBuiltIns(builtInInput, { jev: dependencies.jev })
+  ]);
+  const review = aggregateReview(turn.id, [
+    ...ruleResults,
+    builtIns.scopeCreep,
+    builtIns.complexity
+  ]);
+  await presentReview(dependencies.presenter, review);
+}
+async function evaluateRuleLane(turn, loaded, dependencies) {
+  if (loaded === null) {
+    return [reviewLevelUnavailable(turn.id, "INVALID_RULE")];
+  }
+  if (loaded.status === "FAILED") {
+    const reason = loaded.reason === "CONFIG_READ_FAILURE" ? "INVALID_CONFIG" : "INVALID_RULE";
+    return [reviewLevelUnavailable(turn.id, reason)];
+  }
+  const rules = loaded.source.rules;
+  if (rules === null) {
+    return [reviewLevelUnavailable(turn.id, "INVALID_RULE")];
+  }
+  const parsedRules = parseRules(rules);
+  const gateConfig = readGateConfig(loaded.source.config);
+  const review = await evaluateRules({
+    turn,
+    rules: parsedRules,
+    gateConfig,
+    evidencePolicy: DEFAULT_EVIDENCE_POLICY
+  }, { jev: dependencies.jev });
+  return review.results;
+}
+async function loadPolicy(policy) {
+  try {
+    return await policy.load();
+  } catch {
+    return null;
+  }
+}
+function readGateConfig(config) {
+  const value = readConfigValue(config);
+  if (value.status === "INVALID") {
+    return { status: "INVALID", reason: "INVALID_CONFIG" };
+  }
+  return resolveGateConfig(value.value);
+}
+function readConfigValue(config) {
+  if (config === null) {
+    return { status: "VALUE", value: null };
+  }
+  const parsed = parsePolicyConfig(config);
+  return parsed.status === "PARSED" ? { status: "VALUE", value: parsed.value } : { status: "INVALID" };
+}
+
+// packages/plugin/src/runtime.ts
+function createPluginRuntime(dependencies) {
+  let attributionTail = Promise.resolve();
+  const backgroundJobs = new Set;
+  function track(work) {
+    const contained = work.then(ignore, ignore);
+    backgroundJobs.add(contained);
+    contained.then(() => {
+      backgroundJobs.delete(contained);
+    });
+  }
+  function enqueueAttribution(sessionID) {
+    const run = attributionTail.then(() => processIdle(sessionID));
+    attributionTail = run.then(ignore, ignore);
+  }
+  async function processIdle(sessionID) {
+    try {
+      const attribution = await attributeTurn(sessionID, {
+        facade: dependencies.facade,
+        deduplicator: dependencies.deduplicator
+      });
+      switch (attribution.status) {
+        case "NONE":
+        case "ALREADY_PROCESSED":
+          return;
+        case "UNAVAILABLE":
+          track(presentReview(dependencies.presenter, unavailableReview(sessionID, "MISSING_ATTRIBUTED_DIFF")));
+          return;
+        case "ATTRIBUTED":
+          track(reviewAttributedTurn(attribution.turn, dependencies));
+          return;
+      }
+    } catch {
+      return;
+    }
+  }
+  async function drain() {
+    while (true) {
+      await attributionTail;
+      if (backgroundJobs.size === 0) {
+        return;
+      }
+      await Promise.all([...backgroundJobs]);
+    }
+  }
+  return {
+    hooks: {
+      event: (input) => {
+        const sessionID = idleSessionID(input.event);
+        if (sessionID === null) {
+          return Promise.resolve();
+        }
+        enqueueAttribution(sessionID);
+        return Promise.resolve();
+      }
+    },
+    drain
+  };
+}
+function ignore() {
+  return;
+}
+
+// packages/plugin/src/skills/config-hook.ts
+var SKILLS_KEY = "skills";
+var PATHS_KEY = "paths";
+function isRecord4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isMutableArray(value) {
+  return Array.isArray(value);
+}
+function appendSkillPath(config, skillDirectory) {
+  if (!isRecord4(config)) {
+    return;
+  }
+  const skills = config[SKILLS_KEY];
+  if (skills === undefined) {
+    config[SKILLS_KEY] = { [PATHS_KEY]: [skillDirectory] };
+    return;
+  }
+  if (!isRecord4(skills)) {
+    return;
+  }
+  const paths = skills[PATHS_KEY];
+  if (paths === undefined) {
+    skills[PATHS_KEY] = [skillDirectory];
+    return;
+  }
+  if (!isMutableArray(paths)) {
+    return;
+  }
+  if (paths.some((entry) => entry === skillDirectory)) {
+    return;
+  }
+  paths.push(skillDirectory);
+}
+function createConfigHook(options) {
+  return async (input) => {
+    if (options.skillDirectory === null) {
+      return;
+    }
+    try {
+      appendSkillPath(input, options.skillDirectory);
+    } catch {
+      return;
+    }
+  };
+}
+
+// packages/plugin/src/skills/skill-directory.ts
+import { existsSync } from "fs";
+import { join as join2 } from "path";
+import { fileURLToPath } from "url";
+var SKILL_ENTRY_FILE = "SKILL.md";
+var SKILL_DIRECTORY_CANDIDATES = ["./skills/jevguard-rules", "../skills/jevguard-rules"];
+function resolveSkillDirectory(moduleUrl, exists) {
+  for (const candidate of SKILL_DIRECTORY_CANDIDATES) {
+    const directory = fileURLToPath(new URL(candidate, moduleUrl));
+    if (exists(join2(directory, SKILL_ENTRY_FILE))) {
+      return directory;
+    }
+  }
+  return null;
+}
+function resolveInstalledSkillDirectory(moduleUrl) {
+  return resolveSkillDirectory(moduleUrl, existsSync);
+}
+
+// packages/plugin/src/plugin.ts
+var DEFAULT_JEV_MAX_CONCURRENCY = 2;
+var JevGuardPlugin = async (input) => {
+  const presentationClient = createOpenCodePresentationClient(input.client);
+  const dependencies = {
+    facade: createOpenCodeSessionFacade(input.client),
+    deduplicator: new InMemoryTurnDeduplicator,
+    policy: createPolicyFileLoader({
+      root: input.worktree,
+      fileSystem: createNodePolicyFileSystem()
+    }),
+    presenter: createReviewPresenter({
+      log: createOpenCodeLogSink(presentationClient),
+      toast: createOpenCodeToastSink(presentationClient)
+    }),
+    jev: createFifoJevPort(createTypeSafeJevTransport(createCredentialProvider({
+      environment: createProcessEnvironment(),
+      store: createKeyringCredentialStore()
+    })), { maxConcurrency: DEFAULT_JEV_MAX_CONCURRENCY })
+  };
+  return {
+    ...createPluginRuntime(dependencies).hooks,
+    config: createConfigHook({ skillDirectory: resolveInstalledSkillDirectory(import.meta.url) })
+  };
+};
+export {
+  JevGuardPlugin
+};