@paths.design/caws-cli 10.2.0 → 11.0.0

package/dist/shell/gates/disposition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"disposition.js","sourceRoot":"","sources":["../../../src/shell/gates/disposition.ts"],"names":[],"mappings":";AAAA,mCAAmC;AACnC,EAAE;AACF,kEAAkE;AAClE,qEAAqE;AACrE,oEAAoE;AACpE,0DAA0D;AAC1D,EAAE;AACF,SAAS;AACT,EAAE;AACF,+EAA+E;AAC/E,+EAA+E;AAC/E,8EAA8E;AAC9E,+EAA+E;AAC/E,+EAA+E;AAC/E,EAAE;AACF,uEAAuE;AACvE,qEAAqE;AACrE,gEAAgE;AAChE,qEAAqE;AACrE,4CAA4C;;AA6C5C,gDAmDC;AApED,MAAM,cAAc,GAAG;IACrB,cAAc;IACd,mBAAmB;IACnB,gBAAgB;IAChB,YAAY;IACZ,gBAAgB;CACR,CAAC;AAEX,SAAS,aAAa,CACpB,MAAc,EACd,MAAuC;IAEvC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAgB,EAAE,CAAC;AAC9D,CAAC;AAED,SAAgB,kBAAkB,CAChC,MAAmB,EACnB,MAAc;IAEd,iCAAiC;IACjC,MAAM,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,IAAI,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;;YAC3C,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,MAAM,YAAY,GAAsB,EAAE,CAAC;IAC3C,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC1C,IAAI,GAAG,KAAK,SAAS;YAAE,SAAS,CAAC,8BAA8B;QAC/D,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAEtB,IAAI,OAAoB,CAAC;QACzB,IAAI,MAAe,CAAC;QACpB,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACjD,OAAO,GAAG,SAAS,CAAC;YACpB,MAAM,GAAG,KAAK,CAAC;QACjB,CAAC;aAAM,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,GAAG,MAAM,CAAC;YACjB,MAAM,GAAG,KAAK,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,MAAM,CAAC;YACjB,MAAM,GAAG,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC;QAChC,CAAC;QAED,YAAY,CAAC,IAAI,CAAC;YAChB,OAAO,EAAE,MAAM;YACf,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,OAAO;YACP,MAAM;YACN,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IAED,iEAAiE;IACjE,mDAAmD;IACnD,MAAM,mBAAmB,GAAqB,EAAE,CAAC;IACjD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE;QAAE,mBAAmB,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IAEtE,OAAO;QACL,YAAY;QACZ,mBAAmB;QACnB,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;KAC9C,CAAC;AACJ,CAAC"}

package/dist/shell/gates/gate-result-contract.d.ts

@@ -0,0 +1,39 @@
+import { type Result } from '@paths.design/caws-kernel';
+export interface GatesViolation {
+    /** The gate that detected this violation. May be any string. */
+    readonly gate: string;
+    /** Optional violation type id (e.g. 'banned_modifier', 'timeout'). */
+    readonly type?: string;
+    readonly message?: string;
+    readonly file?: string;
+    readonly line?: number;
+    readonly rule?: string;
+    /** Subprocess-reported severity. NOT trusted for blocking — policy decides. */
+    readonly severity?: string;
+}
+export interface GatesWarning {
+    readonly gate?: string;
+    readonly type?: string;
+    readonly message?: string;
+}
+export interface GatesReport {
+    readonly timestamp: string;
+    readonly context: string;
+    readonly files_scoped: number;
+    readonly warnings: readonly GatesWarning[];
+    readonly violations: readonly GatesViolation[];
+    readonly waivers?: {
+        readonly active: number;
+        readonly applied: number;
+    };
+    readonly performance?: {
+        readonly total_execution_time_ms?: number;
+    };
+}
+/**
+ * Parse + validate the subprocess JSON. Returns Ok(GatesReport) only when
+ * EVERY required field is present and well-typed. Returns Err with a
+ * specific shell.gates.* rule otherwise. Never throws on bad input.
+ */
+export declare function validateGatesReport(raw: string): Result<GatesReport>;
+//# sourceMappingURL=gate-result-contract.d.ts.map

package/dist/shell/gates/gate-result-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-result-contract.d.ts","sourceRoot":"","sources":["../../../src/shell/gates/gate-result-contract.ts"],"names":[],"mappings":"AAwBA,OAAO,EAA4B,KAAK,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAIlF,MAAM,WAAW,cAAc;IAC7B,gEAAgE;IAChE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sEAAsE;IACtE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,SAAS,YAAY,EAAE,CAAC;IAC3C,QAAQ,CAAC,UAAU,EAAE,SAAS,cAAc,EAAE,CAAC;IAC/C,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;KAC3C,CAAC;CACH;AAiED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,CA0GpE"}

package/dist/shell/gates/gate-result-contract.js

@@ -0,0 +1,150 @@
+"use strict";
+// Runtime validator for `caws-quality-gates --json` output.
+//
+// The subprocess emits a SINGLE aggregated JSON payload describing the full
+// gate run. We do NOT trust the shape — TypeScript types do not survive
+// `JSON.parse`. The validator below enforces the minimal contract the
+// vNext command needs to make a policy-derived decision.
+//
+// Accepted shape (narrowed; the real payload may carry more fields, which
+// we ignore):
+//
+//   {
+//     timestamp:    string  (ISO-8601)
+//     context:      string  (e.g. 'cli', 'commit', 'ci')
+//     files_scoped: number
+//     warnings:     Array<{ gate?: string; ... }>
+//     violations:   Array<{ gate: string; ... }>
+//     waivers?:     { active: number; applied: number; details: ... }
+//     performance?: { total_execution_time_ms?: number; ... }
+//   }
+//
+// Anything else is rejected. The contract is intentionally tighter than the
+// subprocess's actual payload — the command should only consume fields it
+// has validated.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateGatesReport = validateGatesReport;
+const caws_kernel_1 = require("@paths.design/caws-kernel");
+const rules_1 = require("../rules");
+function diag(rule, message, data) {
+    const base = {
+        rule,
+        authority: 'kernel/diagnostics',
+        severity: 'error',
+        message,
+    };
+    return data !== undefined ? { ...base, data } : base;
+}
+function isObject(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+function validateViolation(value, idx) {
+    if (!isObject(value)) {
+        return (0, caws_kernel_1.err)(diag(rules_1.SHELL_RULES.GATES_REPORT_INVALID_SHAPE, `violations[${idx}] is not an object.`, { index: idx }));
+    }
+    if (typeof value['gate'] !== 'string' || value['gate'].length === 0) {
+        return (0, caws_kernel_1.err)(diag(rules_1.SHELL_RULES.GATES_REPORT_INVALID_SHAPE, `violations[${idx}] is missing required string field 'gate'.`, { index: idx }));
+    }
+    const out = { gate: value['gate'] };
+    if (typeof value['type'] === 'string')
+        out.type = value['type'];
+    if (typeof value['message'] === 'string')
+        out.message = value['message'];
+    if (typeof value['file'] === 'string')
+        out.file = value['file'];
+    if (typeof value['line'] === 'number')
+        out.line = value['line'];
+    if (typeof value['rule'] === 'string')
+        out.rule = value['rule'];
+    if (typeof value['severity'] === 'string')
+        out.severity = value['severity'];
+    return (0, caws_kernel_1.ok)(out);
+}
+function validateWarning(value, idx) {
+    if (!isObject(value)) {
+        return (0, caws_kernel_1.err)(diag(rules_1.SHELL_RULES.GATES_REPORT_INVALID_SHAPE, `warnings[${idx}] is not an object.`, { index: idx }));
+    }
+    const out = {};
+    if (typeof value['gate'] === 'string')
+        out.gate = value['gate'];
+    if (typeof value['type'] === 'string')
+        out.type = value['type'];
+    if (typeof value['message'] === 'string')
+        out.message = value['message'];
+    return (0, caws_kernel_1.ok)(out);
+}
+/**
+ * Parse + validate the subprocess JSON. Returns Ok(GatesReport) only when
+ * EVERY required field is present and well-typed. Returns Err with a
+ * specific shell.gates.* rule otherwise. Never throws on bad input.
+ */
+function validateGatesReport(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (e) {
+        return (0, caws_kernel_1.err)(diag(rules_1.SHELL_RULES.GATES_REPORT_NOT_JSON, `quality-gates output is not valid JSON: ${e.message}`));
+    }
+    if (!isObject(parsed)) {
+        return (0, caws_kernel_1.err)(diag(rules_1.SHELL_RULES.GATES_REPORT_INVALID_SHAPE, 'quality-gates output is not a JSON object.'));
+    }
+    if (typeof parsed['timestamp'] !== 'string') {
+        return (0, caws_kernel_1.err)(diag(rules_1.SHELL_RULES.GATES_REPORT_INVALID_SHAPE, 'quality-gates output missing required string field `timestamp`.'));
+    }
+    if (typeof parsed['context'] !== 'string') {
+        return (0, caws_kernel_1.err)(diag(rules_1.SHELL_RULES.GATES_REPORT_INVALID_SHAPE, 'quality-gates output missing required string field `context`.'));
+    }
+    if (typeof parsed['files_scoped'] !== 'number') {
+        return (0, caws_kernel_1.err)(diag(rules_1.SHELL_RULES.GATES_REPORT_INVALID_SHAPE, 'quality-gates output missing required number field `files_scoped`.'));
+    }
+    const rawViolations = parsed['violations'];
+    if (!Array.isArray(rawViolations)) {
+        return (0, caws_kernel_1.err)(diag(rules_1.SHELL_RULES.GATES_REPORT_INVALID_SHAPE, 'quality-gates output missing required array field `violations`.'));
+    }
+    const violations = [];
+    for (let i = 0; i < rawViolations.length; i++) {
+        const r = validateViolation(rawViolations[i], i);
+        if (!r.ok)
+            return r;
+        violations.push(r.value);
+    }
+    const rawWarnings = parsed['warnings'];
+    if (!Array.isArray(rawWarnings)) {
+        return (0, caws_kernel_1.err)(diag(rules_1.SHELL_RULES.GATES_REPORT_INVALID_SHAPE, 'quality-gates output missing required array field `warnings`.'));
+    }
+    const warnings = [];
+    for (let i = 0; i < rawWarnings.length; i++) {
+        const r = validateWarning(rawWarnings[i], i);
+        if (!r.ok)
+            return r;
+        warnings.push(r.value);
+    }
+    const out = {
+        timestamp: parsed['timestamp'],
+        context: parsed['context'],
+        files_scoped: parsed['files_scoped'],
+        warnings,
+        violations,
+    };
+    // Optional fields — defensive: accept if shaped right, ignore otherwise.
+    if (isObject(parsed['waivers'])) {
+        const w = parsed['waivers'];
+        if (typeof w['active'] === 'number' && typeof w['applied'] === 'number') {
+            out.waivers = {
+                active: w['active'],
+                applied: w['applied'],
+            };
+        }
+    }
+    if (isObject(parsed['performance'])) {
+        const p = parsed['performance'];
+        if (typeof p['total_execution_time_ms'] === 'number') {
+            out.performance = {
+                total_execution_time_ms: p['total_execution_time_ms'],
+            };
+        }
+    }
+    return (0, caws_kernel_1.ok)(out);
+}
+//# sourceMappingURL=gate-result-contract.js.map

package/dist/shell/gates/gate-result-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-result-contract.js","sourceRoot":"","sources":["../../../src/shell/gates/gate-result-contract.ts"],"names":[],"mappings":";AAAA,4DAA4D;AAC5D,EAAE;AACF,4EAA4E;AAC5E,wEAAwE;AACxE,sEAAsE;AACtE,yDAAyD;AACzD,EAAE;AACF,0EAA0E;AAC1E,cAAc;AACd,EAAE;AACF,MAAM;AACN,uCAAuC;AACvC,yDAAyD;AACzD,2BAA2B;AAC3B,kDAAkD;AAClD,iDAAiD;AACjD,sEAAsE;AACtE,8DAA8D;AAC9D,MAAM;AACN,EAAE;AACF,4EAA4E;AAC5E,0EAA0E;AAC1E,iBAAiB;;AA4GjB,kDA0GC;AApND,2DAAkF;AAElF,oCAAuC;AAoCvC,SAAS,IAAI,CAAC,IAAY,EAAE,OAAe,EAAE,IAA8B;IACzE,MAAM,IAAI,GAAe;QACvB,IAAI;QACJ,SAAS,EAAE,oBAAoB;QAC/B,QAAQ,EAAE,OAAO;QACjB,OAAO;KACR,CAAC;IACF,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc,EAAE,GAAW;IACpD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,IAAA,iBAAG,EACR,IAAI,CACF,mBAAW,CAAC,0BAA0B,EACtC,cAAc,GAAG,qBAAqB,EACtC,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CACF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,OAAO,IAAA,iBAAG,EACR,IAAI,CACF,mBAAW,CAAC,0BAA0B,EACtC,cAAc,GAAG,4CAA4C,EAC7D,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CACF,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAmB,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IACpD,IAAI,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ;QAAG,GAAyB,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IACvF,IAAI,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,QAAQ;QACrC,GAA4B,CAAC,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;IAC3D,IAAI,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ;QAAG,GAAyB,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IACvF,IAAI,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ;QAAG,GAAyB,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IACvF,IAAI,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ;QAAG,GAAyB,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IACvF,IAAI,OAAO,KAAK,CAAC,UAAU,CAAC,KAAK,QAAQ;QACtC,GAA6B,CAAC,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9D,OAAO,IAAA,gBAAE,EAAC,GAAG,CAAC,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,GAAW;IAClD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,IAAA,iBAAG,EACR,IAAI,CACF,mBAAW,CAAC,0BAA0B,EACtC,YAAY,GAAG,qBAAqB,EACpC,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CACF,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ;QAAG,GAAyB,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IACvF,IAAI,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ;QAAG,GAAyB,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IACvF,IAAI,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,QAAQ;QACrC,GAA4B,CAAC,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;IAC3D,OAAO,IAAA,gBAAE,EAAC,GAAG,CAAC,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,SAAgB,mBAAmB,CAAC,GAAW;IAC7C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,IAAA,iBAAG,EACR,IAAI,CACF,mBAAW,CAAC,qBAAqB,EACjC,2CAA4C,CAAW,CAAC,OAAO,EAAE,CAClE,CACF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,OAAO,IAAA,iBAAG,EACR,IAAI,CACF,mBAAW,CAAC,0BAA0B,EACtC,4CAA4C,CAC7C,CACF,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,IAAA,iBAAG,EACR,IAAI,CACF,mBAAW,CAAC,0BAA0B,EACtC,iEAAiE,CAClE,CACF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,IAAA,iBAAG,EACR,IAAI,CACF,mBAAW,CAAC,0BAA0B,EACtC,+DAA+D,CAChE,CACF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,cAAc,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/C,OAAO,IAAA,iBAAG,EACR,IAAI,CACF,mBAAW,CAAC,0BAA0B,EACtC,oEAAoE,CACrE,CACF,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QAClC,OAAO,IAAA,iBAAG,EACR,IAAI,CACF,mBAAW,CAAC,0BAA0B,EACtC,iEAAiE,CAClE,CACF,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAqB,EAAE,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9C,MAAM,CAAC,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,CAAC,CAAC;QACpB,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAChC,OAAO,IAAA,iBAAG,EACR,IAAI,CACF,mBAAW,CAAC,0BAA0B,EACtC,+DAA+D,CAChE,CACF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7C,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,CAAC,CAAC;QACpB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,GAAG,GAAgB;QACvB,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC;QAC9B,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC;QAC1B,YAAY,EAAE,MAAM,CAAC,cAAc,CAAC;QACpC,QAAQ;QACR,UAAU;KACX,CAAC;IAEF,yEAAyE;IACzE,IAAI,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,MAAM,CAAC,SAAS,CAA4B,CAAC;QACvD,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ,EAAE,CAAC;YACvE,GAAyD,CAAC,OAAO,GAAG;gBACnE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC;gBACnB,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC;aACtB,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,MAAM,CAAC,aAAa,CAA4B,CAAC;QAC3D,IAAI,OAAO,CAAC,CAAC,yBAAyB,CAAC,KAAK,QAAQ,EAAE,CAAC;YACpD,GAA8D,CAAC,WAAW,GAAG;gBAC5E,uBAAuB,EAAE,CAAC,CAAC,yBAAyB,CAAC;aACtD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,IAAA,gBAAE,EAAC,GAAG,CAAC,CAAC;AACjB,CAAC"}

package/dist/shell/gates/quality-gates-adapter.d.ts

@@ -0,0 +1,55 @@
+import { type Result } from '@paths.design/caws-kernel';
+import { type GatesReport } from './gate-result-contract';
+/**
+ * Pure resolver: given the CLI install directory and the consumer project
+ * cwd, decide which on-disk path to spawn. Walks up from each starting
+ * point looking for `node_modules/.bin/<BIN_NAME>`.
+ *
+ * Resolution order (documented per CLI-GATES-003 A4):
+ *   1. CLI-install-local — walk up from cliDir. This wins when caws-cli is
+ *      installed globally or in a separate sandbox: caws-quality-gates
+ *      ships as a runtime dep of caws-cli, so it lives beside the caws
+ *      binary, not beside the consumer project.
+ *   2. Project-local — walk up from projectCwd. Preserves the prior
+ *      behavior for the project-local install pattern (CLI-GATES-002 A1).
+ *
+ * The CLI-install-local check wins when both exist. That ordering is by
+ * design: a global caws install was a deliberate choice to use one CLI
+ * version everywhere, and we want that single subprocess version too —
+ * not whatever happens to be in the consumer's node_modules from an older
+ * project-local install.
+ *
+ * Returns the resolved path on success, or { tried: string[] } so the
+ * adapter can surface both attempted paths in the GATES_SUBPROCESS_NOT_FOUND
+ * diagnostic.
+ */
+export declare function resolveQualityGatesBin(cliDir: string, projectCwd: string, fsCheck?: (p: string) => boolean): {
+    resolved: string;
+    source: 'cli-local' | 'project-local';
+} | {
+    tried: string[];
+};
+export interface SubprocessResult {
+    /** Exit code of the subprocess. */
+    readonly status: number | null;
+    /** stdout captured as UTF-8. */
+    readonly stdout: string;
+    /** stderr captured as UTF-8. */
+    readonly stderr: string;
+    /** Any error thrown by the spawn itself (ENOENT, etc.). */
+    readonly error?: Error;
+}
+export interface QualityGatesRunnerInput {
+    readonly cwd: string;
+    /** Extra CLI args after `--json` (e.g. ['--context=cli', '--quiet']). */
+    readonly args: readonly string[];
+}
+export type QualityGatesRunner = (input: QualityGatesRunnerInput) => SubprocessResult;
+export interface RunQualityGatesOptions {
+    readonly cwd: string;
+    readonly args?: readonly string[];
+    /** Inject a custom runner. Tests use this; production omits. */
+    readonly runner?: QualityGatesRunner;
+}
+export declare function runQualityGates(opts: RunQualityGatesOptions): Result<GatesReport>;
+//# sourceMappingURL=quality-gates-adapter.d.ts.map

package/dist/shell/gates/quality-gates-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quality-gates-adapter.d.ts","sourceRoot":"","sources":["../../../src/shell/gates/quality-gates-adapter.ts"],"names":[],"mappings":"AAmBA,OAAO,EAA4B,KAAK,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAGlF,OAAO,EAAuB,KAAK,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAI/E;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAuB,GAC9C;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,GAAG,eAAe,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAmBnF;AAED,MAAM,WAAW,gBAAgB;IAC/B,mCAAmC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,gCAAgC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,gCAAgC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAED,MAAM,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE,uBAAuB,KAAK,gBAAgB,CAAC;AAgDtF,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,gEAAgE;IAChE,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC;CACtC;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,sBAAsB,GAAG,MAAM,CAAC,WAAW,CAAC,CAqCjF"}

package/dist/shell/gates/quality-gates-adapter.js

@@ -0,0 +1,161 @@
+"use strict";
+// Adapter for the `caws-quality-gates` subprocess.
+//
+// Single responsibility: invoke the subprocess in `--json` mode, capture
+// stdout, validate the JSON shape against `gate-result-contract`, and
+// return Ok(GatesReport) or Err(diagnostic).
+//
+// What this adapter does NOT do:
+//   - it does not interpret violations
+//   - it does not decide pass/fail/skip
+//   - it does not append events
+//   - it does not write to any file
+//
+// The runner is pluggable so tests can inject canned JSON without spawning
+// real subprocesses. Production uses a default child_process runner.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveQualityGatesBin = resolveQualityGatesBin;
+exports.runQualityGates = runQualityGates;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const node_child_process_1 = require("node:child_process");
+const caws_kernel_1 = require("@paths.design/caws-kernel");
+const rules_1 = require("../rules");
+const gate_result_contract_1 = require("./gate-result-contract");
+const BIN_NAME = 'caws-quality-gates';
+/**
+ * Pure resolver: given the CLI install directory and the consumer project
+ * cwd, decide which on-disk path to spawn. Walks up from each starting
+ * point looking for `node_modules/.bin/<BIN_NAME>`.
+ *
+ * Resolution order (documented per CLI-GATES-003 A4):
+ *   1. CLI-install-local — walk up from cliDir. This wins when caws-cli is
+ *      installed globally or in a separate sandbox: caws-quality-gates
+ *      ships as a runtime dep of caws-cli, so it lives beside the caws
+ *      binary, not beside the consumer project.
+ *   2. Project-local — walk up from projectCwd. Preserves the prior
+ *      behavior for the project-local install pattern (CLI-GATES-002 A1).
+ *
+ * The CLI-install-local check wins when both exist. That ordering is by
+ * design: a global caws install was a deliberate choice to use one CLI
+ * version everywhere, and we want that single subprocess version too —
+ * not whatever happens to be in the consumer's node_modules from an older
+ * project-local install.
+ *
+ * Returns the resolved path on success, or { tried: string[] } so the
+ * adapter can surface both attempted paths in the GATES_SUBPROCESS_NOT_FOUND
+ * diagnostic.
+ */
+function resolveQualityGatesBin(cliDir, projectCwd, fsCheck = fs.existsSync) {
+    const tried = [];
+    for (const [source, start] of [
+        ['cli-local', cliDir],
+        ['project-local', projectCwd],
+    ]) {
+        let dir = path.resolve(start);
+        while (true) {
+            const candidate = path.join(dir, 'node_modules', '.bin', BIN_NAME);
+            tried.push(candidate);
+            if (fsCheck(candidate)) {
+                return { resolved: candidate, source };
+            }
+            const parent = path.dirname(dir);
+            if (parent === dir)
+                break;
+            dir = parent;
+        }
+    }
+    return { tried };
+}
+function diag(rule, message, data) {
+    const base = {
+        rule,
+        authority: 'kernel/diagnostics',
+        severity: 'error',
+        message,
+    };
+    return data !== undefined ? { ...base, data } : base;
+}
+function defaultRunner(input) {
+    // CLI-GATES-003: resolve the subprocess from the installed CLI package
+    // location first (covers global / sandboxed install), then fall back to
+    // the consumer project (covers project-local install — CLI-GATES-002 A1).
+    // No PATH fallback — explicit failure beats a hijacked binary.
+    //
+    // Spawn cwd stays as input.cwd (CLI-GATES-003 A3): the analyzed files
+    // come from the consumer project, never from the CLI's install dir.
+    const resolution = resolveQualityGatesBin(__dirname, input.cwd);
+    if ('tried' in resolution) {
+        return {
+            status: null,
+            stdout: '',
+            stderr: '',
+            error: Object.assign(new Error(`caws-quality-gates not found. Tried ${resolution.tried.length} location(s): ${resolution.tried.join(', ')}`), { code: 'ENOENT' }),
+        };
+    }
+    const r = (0, node_child_process_1.spawnSync)(resolution.resolved, ['--json', ...input.args], { cwd: input.cwd, encoding: 'utf8' });
+    const out = {
+        status: r.status,
+        stdout: typeof r.stdout === 'string' ? r.stdout : '',
+        stderr: typeof r.stderr === 'string' ? r.stderr : '',
+        ...(r.error !== undefined ? { error: r.error } : {}),
+    };
+    return out;
+}
+function runQualityGates(opts) {
+    const runner = opts.runner ?? defaultRunner;
+    const result = runner({ cwd: opts.cwd, args: opts.args ?? [] });
+    // Subprocess could not be spawned (ENOENT, permission, etc.).
+    if (result.error !== undefined) {
+        return (0, caws_kernel_1.err)(diag(rules_1.SHELL_RULES.GATES_SUBPROCESS_NOT_FOUND, `Failed to spawn caws-quality-gates: ${result.error.message}`, { errno: result.error.code }));
+    }
+    // Nonzero exit is acceptable IF we still got valid JSON: violations
+    // routinely produce nonzero exit. We do NOT treat exit code as the
+    // disposition source — policy does. But if the subprocess didn't
+    // produce JSON at all, that's an integration failure.
+    if (result.stdout.trim().length === 0) {
+        return (0, caws_kernel_1.err)(diag(rules_1.SHELL_RULES.GATES_SUBPROCESS_FAILED, `caws-quality-gates produced no stdout (exit=${result.status}).`, {
+            exit: result.status,
+            stderr: result.stderr.slice(0, 4000),
+        }));
+    }
+    // Validate the JSON shape before trusting it. This is the contract gate.
+    const reportResult = (0, gate_result_contract_1.validateGatesReport)(result.stdout);
+    if (!reportResult.ok)
+        return reportResult;
+    return (0, caws_kernel_1.ok)(reportResult.value);
+}
+//# sourceMappingURL=quality-gates-adapter.js.map

package/dist/shell/gates/quality-gates-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quality-gates-adapter.js","sourceRoot":"","sources":["../../../src/shell/gates/quality-gates-adapter.ts"],"names":[],"mappings":";AAAA,mDAAmD;AACnD,EAAE;AACF,yEAAyE;AACzE,sEAAsE;AACtE,6CAA6C;AAC7C,EAAE;AACF,iCAAiC;AACjC,uCAAuC;AACvC,wCAAwC;AACxC,gCAAgC;AAChC,oCAAoC;AACpC,EAAE;AACF,2EAA2E;AAC3E,qEAAqE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCrE,wDAuBC;AA0ED,0CAqCC;AAxKD,4CAA8B;AAC9B,gDAAkC;AAClC,2DAAsE;AAEtE,2DAAkF;AAElF,oCAAuC;AACvC,iEAA+E;AAE/E,MAAM,QAAQ,GAAG,oBAAoB,CAAC;AAEtC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAgB,sBAAsB,CACpC,MAAc,EACd,UAAkB,EAClB,UAAkC,EAAE,CAAC,UAAU;IAE/C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI;QAC5B,CAAC,WAAW,EAAE,MAAM,CAAC;QACrB,CAAC,eAAe,EAAE,UAAU,CAAC;KACrB,EAAE,CAAC;QACX,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACnE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,IAAI,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;YACzC,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,MAAM,KAAK,GAAG;gBAAE,MAAM;YAC1B,GAAG,GAAG,MAAM,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAqBD,SAAS,IAAI,CAAC,IAAY,EAAE,OAAe,EAAE,IAA8B;IACzE,MAAM,IAAI,GAAe;QACvB,IAAI;QACJ,SAAS,EAAE,oBAAoB;QAC/B,QAAQ,EAAE,OAAO;QACjB,OAAO;KACR,CAAC;IACF,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED,SAAS,aAAa,CAAC,KAA8B;IACnD,uEAAuE;IACvE,wEAAwE;IACxE,0EAA0E;IAC1E,+DAA+D;IAC/D,EAAE;IACF,sEAAsE;IACtE,oEAAoE;IACpE,MAAM,UAAU,GAAG,sBAAsB,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAChE,IAAI,OAAO,IAAI,UAAU,EAAE,CAAC;QAC1B,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,KAAK,EAAE,MAAM,CAAC,MAAM,CAClB,IAAI,KAAK,CACP,uCAAuC,UAAU,CAAC,KAAK,CAAC,MAAM,iBAAiB,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7G,EACD,EAAE,IAAI,EAAE,QAAQ,EAAE,CACnB;SACF,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAA6B,IAAA,8BAAS,EAC3C,UAAU,CAAC,QAAQ,EACnB,CAAC,QAAQ,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,EACzB,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CACrC,CAAC;IACF,MAAM,GAAG,GAAqB;QAC5B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QACpD,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QACpD,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AASD,SAAgB,eAAe,CAAC,IAA4B;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;IAEhE,8DAA8D;IAC9D,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,IAAA,iBAAG,EACR,IAAI,CACF,mBAAW,CAAC,0BAA0B,EACtC,uCAAuC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAC7D,EAAE,KAAK,EAAG,MAAM,CAAC,KAA+B,CAAC,IAAI,EAAE,CACxD,CACF,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,mEAAmE;IACnE,iEAAiE;IACjE,sDAAsD;IACtD,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,IAAA,iBAAG,EACR,IAAI,CACF,mBAAW,CAAC,uBAAuB,EACnC,+CAA+C,MAAM,CAAC,MAAM,IAAI,EAChE;YACE,IAAI,EAAE,MAAM,CAAC,MAAM;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;SACrC,CACF,CACF,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,MAAM,YAAY,GAAG,IAAA,0CAAmB,EAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxD,IAAI,CAAC,YAAY,CAAC,EAAE;QAAE,OAAO,YAAY,CAAC;IAE1C,OAAO,IAAA,gBAAE,EAAC,YAAY,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC"}

package/dist/shell/gates/waiver-filter.d.ts

@@ -0,0 +1,58 @@
+import { type Waiver } from '@paths.design/caws-kernel';
+import type { GatesReport } from './gate-result-contract';
+export interface WaiverFilterInput {
+    readonly report: GatesReport;
+    readonly waivers: readonly Waiver[];
+    readonly specId: string;
+    readonly now: Date;
+    /**
+     * Gate ids the policy declares. Violations targeting any other gate
+     * pass through the filter unmodified — waivers MUST NOT promote an
+     * unmatched (subprocess-only) violation to a policy-suppressed state,
+     * because policy doesn't own that gate. Treating waivers as scoped to
+     * policy-declared gates keeps the unmatched bucket purely
+     * observational, which is the contract `deriveDispositions` relies on.
+     *
+     * If omitted, every gate is considered policy-declared (legacy / test
+     * convenience). Production callers should always pass this.
+     */
+    readonly policyGateIds?: readonly string[];
+}
+export interface WaiverEvidence {
+    /** Number of violations on this gate that an effective waiver suppressed. */
+    readonly waived_count: number;
+    /** Stable ids of the waivers credited with the suppression, deduped + sorted. */
+    readonly waiver_ids: readonly string[];
+}
+export interface WaiverFilterResult {
+    /**
+     * The same report shape, but with `violations` reduced to those NOT
+     * suppressed by an effective waiver. `warnings`, `timestamp`,
+     * `context`, `files_scoped`, and the optional `waivers` / `performance`
+     * blocks are passed through unchanged.
+     */
+    readonly reportForDisposition: GatesReport;
+    /**
+     * Per-gate evidence keyed by the violation's `gate` field. Only gates
+     * that actually had at least one suppression appear here. Gates with
+     * zero suppressions are intentionally omitted: callers should default
+     * them to `{ waived_count: 0, waiver_ids: [] }` if they need a uniform
+     * shape, but the canonical form is "absent means zero".
+     */
+    readonly waivedByGate: Readonly<Record<string, WaiverEvidence>>;
+}
+/**
+ * Filter `report.violations` against the supplied effective waivers.
+ *
+ * For each violation:
+ *   - look up the effective waivers for that violation's gate (kernel call)
+ *   - if any are effective, the violation is suppressed and the waivers'
+ *     ids are recorded as evidence on that gate's bucket
+ *   - if none are effective, the violation passes through unchanged
+ *
+ * The kernel's effectiveness rule (active && not expired && gate matches
+ * && (no spec_id OR matches input.specId)) is the only applicability
+ * decision. Path scoping is not consulted (see file header).
+ */
+export declare function filterWaivedViolations(input: WaiverFilterInput): WaiverFilterResult;
+//# sourceMappingURL=waiver-filter.d.ts.map

package/dist/shell/gates/waiver-filter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waiver-filter.d.ts","sourceRoot":"","sources":["../../../src/shell/gates/waiver-filter.ts"],"names":[],"mappings":"AAiCA,OAAO,EAEL,KAAK,MAAM,EACZ,MAAM,2BAA2B,CAAC;AAEnC,OAAO,KAAK,EAAE,WAAW,EAAkB,MAAM,wBAAwB,CAAC;AAE1E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;IACnB;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAED,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iFAAiF;IACjF,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,oBAAoB,EAAE,WAAW,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;CACjE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,iBAAiB,GACvB,kBAAkB,CAuEpB"}

package/dist/shell/gates/waiver-filter.js

@@ -0,0 +1,119 @@
+"use strict";
+// Waiver filter — shell-level helper that removes effective-waiver-suppressed
+// violations from a GatesReport before disposition.
+//
+// Discipline:
+//
+//   1. This helper does NOT mutate `policy.gates[gate].mode`. A waived
+//      violation is removed from the blocking calculation, but the gate's
+//      block/warn/skip meaning still comes only from policy. After filtering,
+//      `deriveDispositions(filteredReport, policy)` is run unchanged.
+//
+//   2. Applicability is delegated to the kernel
+//      (`effectiveWaiversForGate`) so kernel rules stay the single source
+//      of truth. The shell only knows: "given the per-gate effective
+//      waivers, drop the violations that match this gate."
+//
+//   3. Path scoping (`scope.paths`) is intentionally absent. The kernel
+//      type does not include it. Doing it half-way here would be worse
+//      than deferring it to a later slice.
+//
+//   4. The "violation matched this gate" rule is the same as
+//      `deriveDispositions`'s grouping rule: violations whose `gate`
+//      field equals a gate in the waiver's `gates` list. We do NOT use
+//      the violation's `severity` field for matching — policy and waivers
+//      are both gate-level constructs in this slice; per-violation
+//      identity (e.g. by rule + subject) is not yet a thing waivers
+//      address.
+//
+//   5. Subprocess "unmatched" gates (gates the subprocess reports but
+//      policy doesn't declare) are never waiver-suppressed: waivers
+//      filter violations that policy can act on, and unmatched gates
+//      are observational by construction. Leaving them untouched here
+//      preserves the existing `unmatchedViolations` surface.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.filterWaivedViolations = filterWaivedViolations;
+const caws_kernel_1 = require("@paths.design/caws-kernel");
+/**
+ * Filter `report.violations` against the supplied effective waivers.
+ *
+ * For each violation:
+ *   - look up the effective waivers for that violation's gate (kernel call)
+ *   - if any are effective, the violation is suppressed and the waivers'
+ *     ids are recorded as evidence on that gate's bucket
+ *   - if none are effective, the violation passes through unchanged
+ *
+ * The kernel's effectiveness rule (active && not expired && gate matches
+ * && (no spec_id OR matches input.specId)) is the only applicability
+ * decision. Path scoping is not consulted (see file header).
+ */
+function filterWaivedViolations(input) {
+    // Per-gate effective waivers, computed lazily so we don't pay the cost
+    // for gates that have no violations in this report.
+    const effectiveByGate = new Map();
+    const policyGateSet = input.policyGateIds === undefined
+        ? undefined
+        : new Set(input.policyGateIds);
+    function effectiveFor(gate) {
+        // Waivers only touch policy-declared gates. An unmatched (subprocess-
+        // only) violation is observational by construction; letting waivers
+        // suppress it would break that contract and confuse the unmatched
+        // surface in `deriveDispositions`.
+        if (policyGateSet !== undefined && !policyGateSet.has(gate)) {
+            return [];
+        }
+        const cached = effectiveByGate.get(gate);
+        if (cached !== undefined)
+            return cached;
+        const computed = (0, caws_kernel_1.effectiveWaiversForGate)({
+            waivers: input.waivers,
+            gate,
+            specId: input.specId,
+            now: input.now,
+        });
+        effectiveByGate.set(gate, computed);
+        return computed;
+    }
+    const survivors = [];
+    const evidenceByGate = new Map();
+    for (const v of input.report.violations) {
+        const effective = effectiveFor(v.gate);
+        if (effective.length === 0) {
+            survivors.push(v);
+            continue;
+        }
+        // Suppressed. Credit every effective waiver — overlapping coverage is
+        // fine; the audit record names every authorized exception.
+        let bucket = evidenceByGate.get(v.gate);
+        if (bucket === undefined) {
+            bucket = new Set();
+            evidenceByGate.set(v.gate, bucket);
+        }
+        for (const w of effective)
+            bucket.add(w.id);
+    }
+    const waivedByGate = {};
+    for (const [gate, ids] of evidenceByGate) {
+        const sorted = Array.from(ids).sort();
+        // waived_count counts violations on this gate that were suppressed,
+        // not waivers credited. Recompute by re-walking; cheaper than carrying
+        // a parallel counter and keeps the meaning explicit.
+        let count = 0;
+        for (const v of input.report.violations) {
+            if (v.gate !== gate)
+                continue;
+            if (effectiveFor(v.gate).length > 0)
+                count++;
+        }
+        waivedByGate[gate] = {
+            waived_count: count,
+            waiver_ids: sorted,
+        };
+    }
+    const reportForDisposition = {
+        ...input.report,
+        violations: survivors,
+    };
+    return { reportForDisposition, waivedByGate };
+}
+//# sourceMappingURL=waiver-filter.js.map

package/dist/shell/gates/waiver-filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"waiver-filter.js","sourceRoot":"","sources":["../../../src/shell/gates/waiver-filter.ts"],"names":[],"mappings":";AAAA,8EAA8E;AAC9E,oDAAoD;AACpD,EAAE;AACF,cAAc;AACd,EAAE;AACF,uEAAuE;AACvE,0EAA0E;AAC1E,8EAA8E;AAC9E,sEAAsE;AACtE,EAAE;AACF,gDAAgD;AAChD,0EAA0E;AAC1E,qEAAqE;AACrE,2DAA2D;AAC3D,EAAE;AACF,wEAAwE;AACxE,uEAAuE;AACvE,2CAA2C;AAC3C,EAAE;AACF,6DAA6D;AAC7D,qEAAqE;AACrE,uEAAuE;AACvE,0EAA0E;AAC1E,mEAAmE;AACnE,oEAAoE;AACpE,gBAAgB;AAChB,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,qEAAqE;AACrE,sEAAsE;AACtE,6DAA6D;;AAkE7D,wDAyEC;AAzID,2DAGmC;AAgDnC;;;;;;;;;;;;GAYG;AACH,SAAgB,sBAAsB,CACpC,KAAwB;IAExB,uEAAuE;IACvE,oDAAoD;IACpD,MAAM,eAAe,GAAG,IAAI,GAAG,EAA6B,CAAC;IAC7D,MAAM,aAAa,GACjB,KAAK,CAAC,aAAa,KAAK,SAAS;QAC/B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,GAAG,CAAS,KAAK,CAAC,aAAa,CAAC,CAAC;IAE3C,SAAS,YAAY,CAAC,IAAY;QAChC,sEAAsE;QACtE,oEAAoE;QACpE,kEAAkE;QAClE,mCAAmC;QACnC,IAAI,aAAa,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5D,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAA,qCAAuB,EAAC;YACvC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,IAAI;YACJ,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,EAAE,KAAK,CAAC,GAAG;SACf,CAAC,CAAC;QACH,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACpC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,SAAS,GAAqB,EAAE,CAAC;IACvC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEtD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,SAAS;QACX,CAAC;QACD,sEAAsE;QACtE,2DAA2D;QAC3D,IAAI,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;YAC3B,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,YAAY,GAAmC,EAAE,CAAC;IACxD,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,cAAc,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,oEAAoE;QACpE,uEAAuE;QACvE,qDAAqD;QACrD,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YACxC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;gBAAE,SAAS;YAC9B,IAAI,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,KAAK,EAAE,CAAC;QAC/C,CAAC;QACD,YAAY,CAAC,IAAI,CAAC,GAAG;YACnB,YAAY,EAAE,KAAK;YACnB,UAAU,EAAE,MAAM;SACnB,CAAC;IACJ,CAAC;IAED,MAAM,oBAAoB,GAAgB;QACxC,GAAG,KAAK,CAAC,MAAM;QACf,UAAU,EAAE,SAAS;KACtB,CAAC;IAEF,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,CAAC;AAChD,CAAC"}