@paths.design/caws-cli 10.1.0 → 11.0.0

package/dist/store/init-store.js

@@ -0,0 +1,295 @@
+"use strict";
+// `caws init` — store-side bootstrap of the canonical vNext .caws/ shape.
+//
+// What this adapter creates (when absent):
+//
+//   .caws/
+//   .caws/specs/                  empty dir, multi-spec lives here
+//   .caws/waivers/                empty dir, slice-7a authority surface
+//   .caws/policy.yaml             kernel-validated default policy
+//   .caws/worktrees.json          {}
+//   .caws/agents.json             {}
+//
+// What this adapter intentionally does NOT create:
+//
+//   .caws/working-spec.yaml       legacy single-spec entry point — the
+//                                 vNext model is multi-spec under
+//                                 .caws/specs/<id>.yaml. Seeding
+//                                 working-spec.yaml would silently
+//                                 reintroduce the legacy authority.
+//   .caws/working-spec.schema.json  same reason.
+//   .caws/events.jsonl            evidence is append-only and
+//                                 created by the first event under
+//                                 lock. Manufacturing an empty file
+//                                 would either be a zero-event chain
+//                                 (no genesis) or require a synthetic
+//                                 init event that doesn't represent
+//                                 any real state transition. The
+//                                 store treats a missing file as
+//                                 `events: []`, so doctor / status /
+//                                 waiver list all work without it.
+//
+// Idempotence and refusal:
+//   - missing .caws            → create canonical state.
+//   - all canonical files exist → no-op, return AlreadyInitialized.
+//   - any LEGACY residue       → refuse with INIT_LEGACY_RESIDUE
+//                                naming each offending path. Do NOT
+//                                touch anything. Repair belongs to a
+//                                later doctor/repair surface.
+//
+// Authority discipline:
+//   - The seeded policy MUST pass `parseAndValidatePolicy` before
+//     hitting disk. If it doesn't, init refuses (this is a programmer
+//     error in our default, not a user-recoverable condition).
+//   - All writes go through `writeFileAtomic`. Concurrent invocations
+//     either both see "already initialized" or one wins and the other
+//     observes the same canonical state.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_POLICY_YAML = void 0;
+exports.initProject = initProject;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const caws_kernel_1 = require("@paths.design/caws-kernel");
+const caws_kernel_2 = require("@paths.design/caws-kernel");
+const atomic_write_1 = require("./atomic-write");
+const repo_root_1 = require("./repo-root");
+const rules_1 = require("./rules");
+// ---------------------------------------------------------------------------
+// Canonical layout
+// ---------------------------------------------------------------------------
+/** Canonical files/dirs init creates (or expects to be present already). */
+const CANONICAL_PATHS = {
+    cawsDir: '.caws',
+    specsDir: '.caws/specs',
+    waiversDir: '.caws/waivers',
+    policyFile: '.caws/policy.yaml',
+    worktreesFile: '.caws/worktrees.json',
+    agentsFile: '.caws/agents.json',
+};
+/**
+ * Files whose presence inside `.caws/` indicates legacy single-spec /
+ * pre-vNext state. init refuses to touch these — repair belongs to a
+ * later doctor/repair surface. Adding more entries here is the
+ * sanctioned way to extend the legacy-residue check.
+ */
+const LEGACY_PATHS = [
+    '.caws/working-spec.yaml',
+    '.caws/working-spec.schema.json',
+];
+// ---------------------------------------------------------------------------
+// Default policy
+//
+// The seed below mirrors the gate set the vNext gates command knows
+// about. Block-mode for the structural gates (budget_limit,
+// spec_completeness, scope_boundary), warn for the heuristic gates
+// (god_object, todo_detection). edit_rules is set to the conservative
+// "policy and code may live in the same PR" default; teams can tighten.
+// ---------------------------------------------------------------------------
+exports.DEFAULT_POLICY_YAML = `version: 1
+risk_tiers:
+  '1':
+    max_files: 5
+    max_loc: 200
+  '2':
+    max_files: 15
+    max_loc: 600
+  '3':
+    max_files: 30
+    max_loc: 1500
+gates:
+  budget_limit:
+    enabled: true
+    mode: block
+  spec_completeness:
+    enabled: true
+    mode: block
+  scope_boundary:
+    enabled: true
+    mode: block
+  god_object:
+    enabled: true
+    mode: warn
+  todo_detection:
+    enabled: true
+    mode: warn
+edit_rules:
+  policy_and_code_same_pr: true
+  require_signed_commits: false
+  require_dual_control_for_governance: false
+`;
+// ---------------------------------------------------------------------------
+// Implementation
+// ---------------------------------------------------------------------------
+function abs(repoRoot, rel) {
+    return path.join(repoRoot, rel);
+}
+function existsCanonical(repoRoot) {
+    const isFile = (p) => fs.existsSync(p) && fs.statSync(p).isFile();
+    const isDir = (p) => fs.existsSync(p) && fs.statSync(p).isDirectory();
+    return {
+        cawsDir: isDir(abs(repoRoot, CANONICAL_PATHS.cawsDir)),
+        specsDir: isDir(abs(repoRoot, CANONICAL_PATHS.specsDir)),
+        waiversDir: isDir(abs(repoRoot, CANONICAL_PATHS.waiversDir)),
+        policyFile: isFile(abs(repoRoot, CANONICAL_PATHS.policyFile)),
+        worktreesFile: isFile(abs(repoRoot, CANONICAL_PATHS.worktreesFile)),
+        agentsFile: isFile(abs(repoRoot, CANONICAL_PATHS.agentsFile)),
+    };
+}
+function findLegacyResidue(repoRoot) {
+    // Use isFile semantics — must match observeInitResidue in
+    // doctor-snapshot.ts. A *file* at one of the legacy paths is
+    // residue; a *directory* at the same path is a different problem
+    // (not yet a separately-modeled rule) and must not be conflated
+    // with file-residue. Otherwise init refuses while doctor stays
+    // silent on the same project state.
+    const found = [];
+    for (const rel of LEGACY_PATHS) {
+        const p = abs(repoRoot, rel);
+        try {
+            if (fs.statSync(p).isFile())
+                found.push(p);
+        }
+        catch {
+            // ENOENT or similar — not residue.
+        }
+    }
+    return found;
+}
+function legacyDiag(found) {
+    return (0, repo_root_1.storeDiagnostic)(rules_1.STORE_RULES.INIT_LEGACY_RESIDUE, `caws init refuses to overwrite legacy state: ${found.join(', ')}.`, {
+        narrowRepair: 'Move or remove the listed files manually, then re-run `caws init`. Repair tooling belongs to a later doctor/repair surface; init is intentionally non-destructive.',
+        data: { legacy_paths: found.slice() },
+    });
+}
+function mkdirRecursive(target) {
+    try {
+        fs.mkdirSync(target, { recursive: true });
+        return (0, caws_kernel_2.ok)(true);
+    }
+    catch (e) {
+        return (0, caws_kernel_2.err)((0, repo_root_1.storeDiagnostic)(rules_1.STORE_RULES.WRITE_IO_FAILED, `Failed to create ${target}: ${e.message}.`, { subject: target }));
+    }
+}
+/**
+ * Idempotent vNext init. Returns:
+ *
+ *   Ok({ outcome: 'created', created: [...], policy })
+ *   Ok({ outcome: 'already_initialized', created: [], policy })
+ *   Err  on legacy residue (INIT_LEGACY_RESIDUE) or write failure
+ *        (WRITE_IO_FAILED) or a default-policy that fails kernel
+ *        validation (INIT_DEFAULT_POLICY_INVALID).
+ */
+function initProject(repoRoot) {
+    if (typeof repoRoot !== 'string' || repoRoot.length === 0) {
+        throw new TypeError('initProject: repoRoot must be a non-empty string.');
+    }
+    // 1. Refuse if any legacy residue exists. Do this BEFORE any write so
+    //    the caller's repo is not mutated when we say "no".
+    const residue = findLegacyResidue(repoRoot);
+    if (residue.length > 0) {
+        return (0, caws_kernel_2.err)(legacyDiag(residue));
+    }
+    // 2. Validate the default policy through the kernel. If our seed is
+    //    bad, surface that as INIT_DEFAULT_POLICY_INVALID — do NOT write
+    //    a known-invalid policy to disk just to keep init succeeding.
+    const validatedPolicy = (0, caws_kernel_1.parseAndValidatePolicy)(exports.DEFAULT_POLICY_YAML);
+    if (!(0, caws_kernel_1.isOk)(validatedPolicy)) {
+        return (0, caws_kernel_2.err)((0, repo_root_1.storeDiagnostic)(rules_1.STORE_RULES.INIT_DEFAULT_POLICY_INVALID, `Default policy failed kernel validation: ${validatedPolicy.errors.map((d) => d.rule).join(', ')}.`, { data: { kernel_diagnostics: validatedPolicy.errors.slice() } }));
+    }
+    const policy = validatedPolicy.value;
+    // 3. Decide outcome. If every canonical file/dir is present, do nothing.
+    const present = existsCanonical(repoRoot);
+    const allPresent = present.cawsDir &&
+        present.specsDir &&
+        present.waiversDir &&
+        present.policyFile &&
+        present.worktreesFile &&
+        present.agentsFile;
+    if (allPresent) {
+        return (0, caws_kernel_2.ok)({
+            outcome: 'already_initialized',
+            created: [],
+            policy,
+        });
+    }
+    // 4. Create the missing pieces. We track what we actually wrote so the
+    //    shell can report "what changed" precisely. Each step is its own
+    //    Ok-or-Err — we abort on the first error rather than continue and
+    //    partially populate.
+    const created = [];
+    if (!present.cawsDir) {
+        const r = mkdirRecursive(abs(repoRoot, CANONICAL_PATHS.cawsDir));
+        if (!(0, caws_kernel_1.isOk)(r))
+            return r;
+        created.push(abs(repoRoot, CANONICAL_PATHS.cawsDir));
+    }
+    if (!present.specsDir) {
+        const r = mkdirRecursive(abs(repoRoot, CANONICAL_PATHS.specsDir));
+        if (!(0, caws_kernel_1.isOk)(r))
+            return r;
+        created.push(abs(repoRoot, CANONICAL_PATHS.specsDir));
+    }
+    if (!present.waiversDir) {
+        const r = mkdirRecursive(abs(repoRoot, CANONICAL_PATHS.waiversDir));
+        if (!(0, caws_kernel_1.isOk)(r))
+            return r;
+        created.push(abs(repoRoot, CANONICAL_PATHS.waiversDir));
+    }
+    if (!present.policyFile) {
+        const r = (0, atomic_write_1.writeFileAtomic)(abs(repoRoot, CANONICAL_PATHS.policyFile), exports.DEFAULT_POLICY_YAML);
+        if (!(0, caws_kernel_1.isOk)(r))
+            return r;
+        created.push(abs(repoRoot, CANONICAL_PATHS.policyFile));
+    }
+    if (!present.worktreesFile) {
+        const r = (0, atomic_write_1.writeFileAtomic)(abs(repoRoot, CANONICAL_PATHS.worktreesFile), '{}\n');
+        if (!(0, caws_kernel_1.isOk)(r))
+            return r;
+        created.push(abs(repoRoot, CANONICAL_PATHS.worktreesFile));
+    }
+    if (!present.agentsFile) {
+        const r = (0, atomic_write_1.writeFileAtomic)(abs(repoRoot, CANONICAL_PATHS.agentsFile), '{}\n');
+        if (!(0, caws_kernel_1.isOk)(r))
+            return r;
+        created.push(abs(repoRoot, CANONICAL_PATHS.agentsFile));
+    }
+    return (0, caws_kernel_2.ok)({
+        outcome: 'created',
+        created,
+        policy,
+    });
+}
+//# sourceMappingURL=init-store.js.map

package/dist/store/init-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init-store.js","sourceRoot":"","sources":["../../src/store/init-store.ts"],"names":[],"mappings":";AAAA,0EAA0E;AAC1E,EAAE;AACF,2CAA2C;AAC3C,EAAE;AACF,WAAW;AACX,mEAAmE;AACnE,wEAAwE;AACxE,kEAAkE;AAClE,qCAAqC;AACrC,qCAAqC;AACrC,EAAE;AACF,mDAAmD;AACnD,EAAE;AACF,uEAAuE;AACvE,kEAAkE;AAClE,iEAAiE;AACjE,mEAAmE;AACnE,oEAAoE;AACpE,iDAAiD;AACjD,8DAA8D;AAC9D,mEAAmE;AACnE,oEAAoE;AACpE,qEAAqE;AACrE,sEAAsE;AACtE,oEAAoE;AACpE,iEAAiE;AACjE,iEAAiE;AACjE,qEAAqE;AACrE,mEAAmE;AACnE,EAAE;AACF,2BAA2B;AAC3B,yDAAyD;AACzD,oEAAoE;AACpE,iEAAiE;AACjE,oEAAoE;AACpE,qEAAqE;AACrE,8DAA8D;AAC9D,EAAE;AACF,wBAAwB;AACxB,kEAAkE;AAClE,sEAAsE;AACtE,+DAA+D;AAC/D,sEAAsE;AACtE,sEAAsE;AACtE,yCAAyC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuLzC,kCAiGC;AAtRD,uCAAyB;AACzB,2CAA6B;AAE7B,2DAMmC;AACnC,2DAAoD;AAEpD,iDAAiD;AACjD,2CAA8C;AAC9C,mCAAsC;AAEtC,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,4EAA4E;AAC5E,MAAM,eAAe,GAAG;IACtB,OAAO,EAAE,OAAO;IAChB,QAAQ,EAAE,aAAa;IACvB,UAAU,EAAE,eAAe;IAC3B,UAAU,EAAE,mBAAmB;IAC/B,aAAa,EAAE,sBAAsB;IACrC,UAAU,EAAE,mBAAmB;CACvB,CAAC;AAEX;;;;;GAKG;AACH,MAAM,YAAY,GAAG;IACnB,yBAAyB;IACzB,gCAAgC;CACxB,CAAC;AAEX,8EAA8E;AAC9E,iBAAiB;AACjB,EAAE;AACF,oEAAoE;AACpE,4DAA4D;AAC5D,mEAAmE;AACnE,sEAAsE;AACtE,wEAAwE;AACxE,8EAA8E;AAEjE,QAAA,mBAAmB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BlC,CAAC;AAgBF,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,SAAS,GAAG,CAAC,QAAgB,EAAE,GAAW;IACxC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB;IAQvC,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1E,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9E,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC;QACtD,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC;QACxD,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,UAAU,CAAC,CAAC;QAC5D,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,UAAU,CAAC,CAAC;QAC7D,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,aAAa,CAAC,CAAC;QACnE,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,UAAU,CAAC,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB;IACzC,0DAA0D;IAC1D,6DAA6D;IAC7D,iEAAiE;IACjE,gEAAgE;IAChE,+DAA+D;IAC/D,oCAAoC;IACpC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,mCAAmC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAwB;IAC1C,OAAO,IAAA,2BAAe,EACpB,mBAAW,CAAC,mBAAmB,EAC/B,gDAAgD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EACnE;QACE,YAAY,EACV,oKAAoK;QACtK,IAAI,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE;KACtC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,MAAc;IACpC,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,OAAO,IAAA,gBAAE,EAAC,IAAa,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,IAAA,iBAAG,EACR,IAAA,2BAAe,EACb,mBAAW,CAAC,eAAe,EAC3B,oBAAoB,MAAM,KAAM,CAAW,CAAC,OAAO,GAAG,EACtD,EAAE,OAAO,EAAE,MAAM,EAAE,CACpB,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,WAAW,CACzB,QAAgB;IAEhB,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,SAAS,CAAC,mDAAmD,CAAC,CAAC;IAC3E,CAAC;IAED,sEAAsE;IACtE,wDAAwD;IACxD,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,IAAA,iBAAG,EAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAClC,CAAC;IAED,oEAAoE;IACpE,qEAAqE;IACrE,kEAAkE;IAClE,MAAM,eAAe,GAAG,IAAA,oCAAsB,EAAC,2BAAmB,CAAC,CAAC;IACpE,IAAI,CAAC,IAAA,kBAAI,EAAC,eAAe,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAA,iBAAG,EACR,IAAA,2BAAe,EACb,mBAAW,CAAC,2BAA2B,EACvC,4CAA4C,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EACnG,EAAE,IAAI,EAAE,EAAE,kBAAkB,EAAE,eAAe,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,CACjE,CACF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC;IAErC,yEAAyE;IACzE,MAAM,OAAO,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,UAAU,GACd,OAAO,CAAC,OAAO;QACf,OAAO,CAAC,QAAQ;QAChB,OAAO,CAAC,UAAU;QAClB,OAAO,CAAC,UAAU;QAClB,OAAO,CAAC,aAAa;QACrB,OAAO,CAAC,UAAU,CAAC;IACrB,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,IAAA,gBAAE,EAAC;YACR,OAAO,EAAE,qBAAqB;YAC9B,OAAO,EAAE,EAAE;YACX,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,uEAAuE;IACvE,qEAAqE;IACrE,sEAAsE;IACtE,yBAAyB;IACzB,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC,IAAA,kBAAI,EAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC,IAAA,kBAAI,EAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,IAAA,kBAAI,EAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,IAAA,8BAAe,EACvB,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,UAAU,CAAC,EACzC,2BAAmB,CACpB,CAAC;QACF,IAAI,CAAC,IAAA,kBAAI,EAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,IAAA,8BAAe,EACvB,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,aAAa,CAAC,EAC5C,MAAM,CACP,CAAC;QACF,IAAI,CAAC,IAAA,kBAAI,EAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,IAAA,8BAAe,EACvB,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,UAAU,CAAC,EACzC,MAAM,CACP,CAAC;QACF,IAAI,CAAC,IAAA,kBAAI,EAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO,IAAA,gBAAE,EAAC;QACR,OAAO,EAAE,SAAS;QAClB,OAAO;QACP,MAAM;KACP,CAAC,CAAC;AACL,CAAC"}

package/dist/store/json-store.d.ts

@@ -0,0 +1,3 @@
+import { type Result } from '@paths.design/caws-kernel';
+export declare function readJsonFile(filePath: string): Result<unknown>;
+//# sourceMappingURL=json-store.d.ts.map

package/dist/store/json-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-store.d.ts","sourceRoot":"","sources":["../../src/store/json-store.ts"],"names":[],"mappings":"AAIA,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAIjE,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAkC9D"}

package/dist/store/json-store.js

@@ -0,0 +1,65 @@
+"use strict";
+// JSON read helper. Same shape and discipline as yaml-store: report
+// missing/malformed via discrete rule ids.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readJsonFile = readJsonFile;
+const fs = __importStar(require("fs"));
+const caws_kernel_1 = require("@paths.design/caws-kernel");
+const repo_root_1 = require("./repo-root");
+const rules_1 = require("./rules");
+function readJsonFile(filePath) {
+    let raw;
+    try {
+        raw = fs.readFileSync(filePath, 'utf8');
+    }
+    catch (e) {
+        const cause = e;
+        if (cause.code === 'ENOENT') {
+            return (0, caws_kernel_1.err)((0, repo_root_1.storeDiagnostic)(rules_1.STORE_RULES.READ_MISSING_FILE, `File not found: ${filePath}.`, {
+                subject: filePath,
+            }));
+        }
+        return (0, caws_kernel_1.err)((0, repo_root_1.storeDiagnostic)(rules_1.STORE_RULES.READ_IO_FAILED, `Failed to read ${filePath}: ${cause.message ?? 'unknown error'}.`, { subject: filePath, data: { code: cause.code } }));
+    }
+    try {
+        return (0, caws_kernel_1.ok)(JSON.parse(raw));
+    }
+    catch (e) {
+        const cause = e;
+        return (0, caws_kernel_1.err)((0, repo_root_1.storeDiagnostic)(rules_1.STORE_RULES.READ_JSON_INVALID, `JSON parse failed in ${filePath}: ${cause.message ?? 'unknown error'}.`, { subject: filePath }));
+    }
+}
+//# sourceMappingURL=json-store.js.map

package/dist/store/json-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-store.js","sourceRoot":"","sources":["../../src/store/json-store.ts"],"names":[],"mappings":";AAAA,oEAAoE;AACpE,2CAA2C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAO3C,oCAkCC;AAvCD,uCAAyB;AACzB,2DAAiE;AACjE,2CAA8C;AAC9C,mCAAsC;AAEtC,SAAgB,YAAY,CAAC,QAAgB;IAC3C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,CAAwC,CAAC;QACvD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5B,OAAO,IAAA,iBAAG,EACR,IAAA,2BAAe,EAAC,mBAAW,CAAC,iBAAiB,EAAE,mBAAmB,QAAQ,GAAG,EAAE;gBAC7E,OAAO,EAAE,QAAQ;aAClB,CAAC,CACH,CAAC;QACJ,CAAC;QACD,OAAO,IAAA,iBAAG,EACR,IAAA,2BAAe,EACb,mBAAW,CAAC,cAAc,EAC1B,kBAAkB,QAAQ,KAAK,KAAK,CAAC,OAAO,IAAI,eAAe,GAAG,EAClE,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,CAClD,CACF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,OAAO,IAAA,gBAAE,EAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,CAAyB,CAAC;QACxC,OAAO,IAAA,iBAAG,EACR,IAAA,2BAAe,EACb,mBAAW,CAAC,iBAAiB,EAC7B,wBAAwB,QAAQ,KAAK,KAAK,CAAC,OAAO,IAAI,eAAe,GAAG,EACxE,EAAE,OAAO,EAAE,QAAQ,EAAE,CACtB,CACF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/store/policy-store.d.ts

@@ -0,0 +1,3 @@
+import type { PolicyLoadResult } from './types';
+export declare function loadPolicy(cawsDir: string): PolicyLoadResult;
+//# sourceMappingURL=policy-store.d.ts.map

package/dist/store/policy-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-store.d.ts","sourceRoot":"","sources":["../../src/store/policy-store.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAEhD,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,CAmB5D"}

package/dist/store/policy-store.js

@@ -0,0 +1,65 @@
+"use strict";
+// Policy loader.
+//
+// Loads `.caws/policy.yaml`, hands the source to the kernel's
+// `parseAndValidatePolicy`, and surfaces both the parsed value and any
+// non-fatal warnings the kernel emitted. Missing file is NOT an error
+// at the store level — doctor decides whether to emit `POLICY_MISSING`.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadPolicy = loadPolicy;
+const path = __importStar(require("path"));
+const caws_kernel_1 = require("@paths.design/caws-kernel");
+const rules_1 = require("./rules");
+const yaml_store_1 = require("./yaml-store");
+function loadPolicy(cawsDir) {
+    const policyPath = path.join(cawsDir, 'policy.yaml');
+    const source = (0, yaml_store_1.readYamlSource)(policyPath);
+    if (!(0, caws_kernel_1.isOk)(source)) {
+        // Distinguish missing file (Ok-shaped) from malformed file (Err).
+        const missing = source.errors.some((e) => e.rule === rules_1.STORE_RULES.READ_MISSING_FILE);
+        if (missing) {
+            return { warnings: [], errors: [] };
+        }
+        return { warnings: [], errors: [...source.errors] };
+    }
+    const result = (0, caws_kernel_1.parseAndValidatePolicy)(source.value);
+    if (!(0, caws_kernel_1.isOk)(result)) {
+        return { warnings: [], errors: [...result.errors] };
+    }
+    const warnings = result.warnings ?? [];
+    return { policy: result.value, warnings: [...warnings], errors: [] };
+}
+//# sourceMappingURL=policy-store.js.map

package/dist/store/policy-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-store.js","sourceRoot":"","sources":["../../src/store/policy-store.ts"],"names":[],"mappings":";AAAA,iBAAiB;AACjB,EAAE;AACF,8DAA8D;AAC9D,uEAAuE;AACvE,sEAAsE;AACtE,wEAAwE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAYxE,gCAmBC;AA7BD,2CAA6B;AAC7B,2DAImC;AACnC,mCAAsC;AACtC,6CAA8C;AAG9C,SAAgB,UAAU,CAAC,OAAe;IACxC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,IAAA,2BAAc,EAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAA,kBAAI,EAAC,MAAM,CAAC,EAAE,CAAC;QAClB,kEAAkE;QAClE,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,mBAAW,CAAC,iBAAiB,CAAC,CAAC;QACpF,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACtC,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IACtD,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,oCAAsB,EAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,IAAA,kBAAI,EAAC,MAAM,CAAC,EAAE,CAAC;QAClB,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IACtD,CAAC;IAED,MAAM,QAAQ,GAA0B,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;IAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AACvE,CAAC"}

package/dist/store/repo-root.d.ts

@@ -0,0 +1,46 @@
+import { type Diagnostic, type Result } from '@paths.design/caws-kernel';
+export interface RepoRoot {
+    /** Absolute path to the main repository root (parent of .git common dir). */
+    readonly repoRoot: string;
+    /** Absolute path to the .caws/ directory under the repo root. */
+    readonly cawsDir: string;
+}
+/**
+ * Pluggable git invoker. Tests stub this; production uses execFileSync.
+ *
+ * Returns the trimmed stdout on success, or throws on non-zero exit. The
+ * caller distinguishes "not a git repo" by inspecting the thrown error's
+ * stderr / status, which production execFileSync surfaces.
+ */
+export type GitRunner = (args: readonly string[], options: {
+    cwd: string;
+}) => string;
+export declare const defaultGitRunner: GitRunner;
+export interface ResolveRepoRootOptions {
+    readonly git?: GitRunner;
+    /**
+     * If true, the .caws/ directory must already exist on disk. When false
+     * (default) the function only resolves where it WOULD be, leaving
+     * creation to a different layer (e.g., `caws init`).
+     */
+    readonly requireCawsDir?: boolean;
+}
+/**
+ * Resolve the main-repo root from `cwd`, even when cwd is inside a linked
+ * worktree.
+ *
+ * Returns Err when:
+ *  - cwd is not inside a git repository, OR
+ *  - git invocation fails for another reason, OR
+ *  - `requireCawsDir: true` and `.caws/` does not exist.
+ *
+ * Programmer errors (cwd not a string, git binary missing) throw.
+ */
+export declare function resolveRepoRoot(cwd: string, options?: ResolveRepoRootOptions): Result<RepoRoot>;
+/** Construct a structured Diagnostic with the canonical store authority. */
+export declare function storeDiagnostic(rule: string, message: string, extra?: {
+    subject?: string;
+    narrowRepair?: string;
+    data?: Record<string, unknown>;
+}): Diagnostic;
+//# sourceMappingURL=repo-root.d.ts.map

package/dist/store/repo-root.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-root.d.ts","sourceRoot":"","sources":["../../src/store/repo-root.ts"],"names":[],"mappings":"AAoBA,OAAO,EAIL,KAAK,UAAU,EACf,KAAK,MAAM,EACZ,MAAM,2BAA2B,CAAC;AAOnC,MAAM,WAAW,QAAQ;IACvB,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG,CACtB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,KACrB,MAAM,CAAC;AAEZ,eAAO,MAAM,gBAAgB,EAAE,SAO9B,CAAC;AAMF,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;CACnC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,sBAA2B,GACnC,MAAM,CAAC,QAAQ,CAAC,CA6DlB;AAMD,4EAA4E;AAC5E,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,KAAK,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAO,GACtF,UAAU,CASZ"}

package/dist/store/repo-root.js

@@ -0,0 +1,145 @@
+"use strict";
+// Resolve the canonical CAWS repo root.
+//
+// CAWS lives under a single `.caws/` directory in the *main* repository,
+// not under linked worktrees. A worktree's `.git` is a file pointing at
+// `<main>/.git/worktrees/<name>/`. Using `git rev-parse --show-toplevel`
+// from inside a worktree would return the WORKTREE's filesystem root,
+// not the main repo's — and any path derived from it would write state
+// into the worktree's filesystem.
+//
+// The correct authority is:
+//
+//   git rev-parse --path-format=absolute --git-common-dir
+//
+// which returns `<main>/.git` regardless of where the caller stands. The
+// CAWS repo root is the parent of that directory. The `.caws/` directory
+// is one level deeper.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultGitRunner = void 0;
+exports.resolveRepoRoot = resolveRepoRoot;
+exports.storeDiagnostic = storeDiagnostic;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const caws_kernel_1 = require("@paths.design/caws-kernel");
+const rules_1 = require("./rules");
+const defaultGitRunner = (args, options) => {
+    const execOptions = {
+        cwd: options.cwd,
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'pipe'],
+    };
+    return (0, child_process_1.execFileSync)('git', args, execOptions).trim();
+};
+exports.defaultGitRunner = defaultGitRunner;
+/**
+ * Resolve the main-repo root from `cwd`, even when cwd is inside a linked
+ * worktree.
+ *
+ * Returns Err when:
+ *  - cwd is not inside a git repository, OR
+ *  - git invocation fails for another reason, OR
+ *  - `requireCawsDir: true` and `.caws/` does not exist.
+ *
+ * Programmer errors (cwd not a string, git binary missing) throw.
+ */
+function resolveRepoRoot(cwd, options = {}) {
+    if (typeof cwd !== 'string' || cwd.length === 0) {
+        throw new TypeError('resolveRepoRoot: cwd must be a non-empty string.');
+    }
+    const git = options.git ?? exports.defaultGitRunner;
+    let commonDir;
+    try {
+        commonDir = git(['rev-parse', '--path-format=absolute', '--git-common-dir'], {
+            cwd,
+        });
+    }
+    catch (e) {
+        const cause = e;
+        const stderr = typeof cause.stderr === 'string'
+            ? cause.stderr
+            : cause.stderr instanceof Buffer
+                ? cause.stderr.toString('utf8')
+                : '';
+        // "not a git repository" surfaces on stderr.
+        if (stderr.toLowerCase().includes('not a git repository')) {
+            return (0, caws_kernel_1.err)((0, caws_kernel_1.diagnostic)({
+                rule: rules_1.STORE_RULES.REPO_ROOT_NOT_A_GIT_REPO,
+                authority: 'kernel/diagnostics',
+                message: `${cwd} is not inside a git repository.`,
+                subject: cwd,
+                narrowRepair: 'Run `git init` or change directory to a repository.',
+            }));
+        }
+        return (0, caws_kernel_1.err)((0, caws_kernel_1.diagnostic)({
+            rule: rules_1.STORE_RULES.REPO_ROOT_GIT_INVOCATION_FAILED,
+            authority: 'kernel/diagnostics',
+            message: `git rev-parse failed: ${cause.message ?? 'unknown error'}.`,
+            subject: cwd,
+            data: { stderr },
+        }));
+    }
+    // commonDir is the path to <main>/.git (or a separate gitdir). The
+    // repository root is its parent. We do NOT use --show-toplevel.
+    const repoRoot = path.dirname(commonDir);
+    const cawsDir = path.join(repoRoot, '.caws');
+    if (options.requireCawsDir && !fs.existsSync(cawsDir)) {
+        return (0, caws_kernel_1.err)((0, caws_kernel_1.diagnostic)({
+            rule: rules_1.STORE_RULES.REPO_ROOT_CAWS_DIR_MISSING,
+            authority: 'kernel/diagnostics',
+            message: `Resolved repo root has no .caws/ directory: ${repoRoot}.`,
+            subject: repoRoot,
+            narrowRepair: 'Run `caws init` to bootstrap the repository.',
+        }));
+    }
+    return (0, caws_kernel_1.ok)({ repoRoot, cawsDir });
+}
+// ----------------------------------------------------------------------------
+// Helpers exposed for tests
+// ----------------------------------------------------------------------------
+/** Construct a structured Diagnostic with the canonical store authority. */
+function storeDiagnostic(rule, message, extra = {}) {
+    return (0, caws_kernel_1.diagnostic)({
+        rule,
+        authority: 'kernel/diagnostics',
+        message,
+        ...(extra.subject !== undefined ? { subject: extra.subject } : {}),
+        ...(extra.narrowRepair !== undefined ? { narrowRepair: extra.narrowRepair } : {}),
+        ...(extra.data !== undefined ? { data: extra.data } : {}),
+    });
+}
+//# sourceMappingURL=repo-root.js.map