@pellux/goodvibes-toolchain 1.11.0

package/dist/lib/release-cut.js

@@ -0,0 +1,120 @@
+/**
+ * release-cut — local release preparation ONLY.
+ *
+ * Per the CI/CD design's principle 4 (CI owns validation), this tool never
+ * re-runs gates. It: guards a clean tree on the release branch, bumps the
+ * version across the root and configured manifests, runs the repo's version-
+ * sync commands, prepends a CHANGELOG section, commits, and creates an
+ * annotated tag. Validation happened on the push CI run; the tag is cut from an
+ * already-green tree and verified by-reference downstream.
+ */
+import { readFileSync, writeFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { realExec, consoleLogger } from './effects.js';
+/** Parse an exact X.Y.Z string; throws on anything else. */
+export function parseSemver(version) {
+    const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(version);
+    if (!match)
+        throw new Error(`Not an exact X.Y.Z version: ${version}`);
+    return { major: Number(match[1]), minor: Number(match[2]), patch: Number(match[3]) };
+}
+/** Compute the next version for a bump kind. */
+export function nextVersion(current, kind) {
+    const { major, minor, patch } = parseSemver(current);
+    if (kind === 'major')
+        return `${major + 1}.0.0`;
+    if (kind === 'minor')
+        return `${major}.${minor + 1}.0`;
+    return `${major}.${minor}.${patch + 1}`;
+}
+/** Render a CHANGELOG section heading for a version. */
+export function changelogHeading(version, style, date) {
+    return style === 'bracket' ? `## [${version}] - ${date}` : `## ${version} - ${date}`;
+}
+/** Build a full CHANGELOG section body from a heading and notes/commit lines. */
+export function buildChangelogSection(version, style, date, bodyLines) {
+    const lines = bodyLines.length > 0 ? bodyLines : ['- Release maintenance.'];
+    return `${changelogHeading(version, style, date)}\n\n### Changes\n\n${lines.join('\n')}\n`;
+}
+/**
+ * Insert a new section into changelog text. `top` prepends above the first
+ * `## ` heading; `first-separator` inserts after the first `---` line.
+ */
+export function insertChangelogSection(changelog, section, marker) {
+    if (marker === 'first-separator') {
+        const idx = changelog.indexOf('\n---\n');
+        if (idx === -1)
+            throw new Error('CHANGELOG has no "---" separator to insert after.');
+        const cut = idx + '\n---\n'.length;
+        return `${changelog.slice(0, cut)}\n${section}\n${changelog.slice(cut).replace(/^\n+/, '')}`;
+    }
+    const firstHeading = changelog.search(/^## /m);
+    if (firstHeading === -1)
+        return `${changelog.trimEnd()}\n\n${section}\n`;
+    return `${changelog.slice(0, firstHeading)}${section}\n\n${changelog.slice(firstHeading)}`;
+}
+function setManifestVersion(path, version) {
+    const text = readFileSync(path, 'utf8');
+    const manifest = JSON.parse(text);
+    manifest.version = version;
+    writeFileSync(path, `${JSON.stringify(manifest, null, 2)}\n`);
+}
+function requireClean(exec, cwd, branch) {
+    const status = exec('git', ['status', '--porcelain'], { cwd });
+    if (status.status !== 0)
+        throw new Error(`git status failed: ${status.stderr.trim()}`);
+    if (status.stdout.trim().length > 0) {
+        throw new Error(`Working tree is not clean:\n${status.stdout.trim()}`);
+    }
+    const current = exec('git', ['rev-parse', '--abbrev-ref', 'HEAD'], { cwd });
+    if (current.stdout.trim() !== branch) {
+        throw new Error(`Release cut must run on '${branch}' (on '${current.stdout.trim()}').`);
+    }
+}
+/**
+ * Perform a release cut. Uses real fs writes + the injected exec (git) against
+ * `cwd`; tests drive it against a temp-dir git fixture.
+ */
+export function runReleaseCut(options) {
+    const exec = options.exec ?? realExec;
+    const logger = options.logger ?? consoleLogger;
+    const { cwd, config } = options;
+    const date = options.date ?? new Date().toISOString().slice(0, 10);
+    requireClean(exec, cwd, config.branch);
+    const rootManifestPath = resolve(cwd, 'package.json');
+    const current = JSON.parse(readFileSync(rootManifestPath, 'utf8')).version;
+    const version = nextVersion(current, options.bump);
+    const tag = `v${version}`;
+    logger.info(`[release-cut] ${current} -> ${version} (${options.bump})`);
+    if (options.dryRun) {
+        logger.info(`[release-cut] dry-run: would bump, changelog, commit, and tag ${tag}`);
+        return { version, tag, committed: false };
+    }
+    setManifestVersion(rootManifestPath, version);
+    for (const rel of config.versionFiles) {
+        setManifestVersion(resolve(cwd, rel), version);
+    }
+    for (const cmd of config.syncCommands) {
+        const [bin, ...args] = cmd;
+        if (!bin)
+            continue;
+        const res = exec(bin, args, { cwd });
+        if (res.status !== 0)
+            throw new Error(`version-sync command failed: ${cmd.join(' ')}\n${res.stderr}`);
+    }
+    const changelogPath = resolve(cwd, 'CHANGELOG.md');
+    const changelog = readFileSync(changelogPath, 'utf8');
+    const section = buildChangelogSection(version, config.changelogHeading, date, options.notes ?? []);
+    writeFileSync(changelogPath, insertChangelogSection(changelog, section, config.changelogInsertMarker));
+    const add = exec('git', ['add', ...config.commitPaths], { cwd });
+    if (add.status !== 0)
+        throw new Error(`git add failed: ${add.stderr}`);
+    const commit = exec('git', ['commit', '-m', `chore: release ${version}`], { cwd });
+    if (commit.status !== 0)
+        throw new Error(`git commit failed: ${commit.stderr}`);
+    const tagRes = exec('git', ['tag', '-a', tag, '-m', `release ${version}`], { cwd });
+    if (tagRes.status !== 0)
+        throw new Error(`git tag failed: ${tagRes.stderr}`);
+    logger.info(`[release-cut] committed and tagged ${tag}. Push with: git push && git push origin ${tag}`);
+    return { version, tag, committed: true };
+}

package/dist/lib/sdk-pin-gate.d.ts

@@ -0,0 +1,25 @@
+/**
+ * sdk-pin-gate — verifies a consumer repo pins the SDK correctly.
+ *
+ * Absorbs three parallel copies: tui/scripts/publish-check.ts (pin in
+ * `dependencies`), agent/scripts/sdk-release-gates.ts (pin in
+ * `devDependencies`), and webui/scripts/release-gate.ts (adds the exports-map
+ * import sweep). The tri-agreement (pin ⇄ lockfile ⇄ installed) catches the
+ * "pin bumped but lockfile lagged, ships old SDK silently" failure class.
+ */
+import type { FsReader } from './effects.js';
+import { type SdkPinConfig } from '../config.js';
+/** One gate outcome; ok=false carries a human-readable reason. */
+export interface GateResult {
+    readonly id: string;
+    readonly ok: boolean;
+    readonly detail: string;
+}
+/** Read the SDK pin from the configured manifest group. */
+export declare function readSdkPin(fs: FsReader, config: SdkPinConfig): string | null;
+/**
+ * Run every sdk-pin gate and return one result per gate. Pure over the injected
+ * FsReader — no process exit, no console. The bin maps results to exit codes.
+ */
+export declare function runSdkPinGate(fs: FsReader, partial: Partial<SdkPinConfig> | undefined): GateResult[];
+//# sourceMappingURL=sdk-pin-gate.d.ts.map

package/dist/lib/sdk-pin-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk-pin-gate.d.ts","sourceRoot":"","sources":["../../src/lib/sdk-pin-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,KAAK,YAAY,EAAuB,MAAM,cAAc,CAAC;AAItE,kEAAkE;AAClE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAYD,2DAA2D;AAC3D,wBAAgB,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,GAAG,MAAM,GAAG,IAAI,CAK5E;AA4CD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,SAAS,GAAG,UAAU,EAAE,CA8EpG"}

package/dist/lib/sdk-pin-gate.js

@@ -0,0 +1,146 @@
+/**
+ * sdk-pin-gate — verifies a consumer repo pins the SDK correctly.
+ *
+ * Absorbs three parallel copies: tui/scripts/publish-check.ts (pin in
+ * `dependencies`), agent/scripts/sdk-release-gates.ts (pin in
+ * `devDependencies`), and webui/scripts/release-gate.ts (adds the exports-map
+ * import sweep). The tri-agreement (pin ⇄ lockfile ⇄ installed) catches the
+ * "pin bumped but lockfile lagged, ships old SDK silently" failure class.
+ */
+import { resolveSdkPinConfig } from '../config.js';
+const EXACT_SEMVER = /^\d+\.\d+\.\d+$/;
+function readManifest(fs, path) {
+    return JSON.parse(fs.readText(path));
+}
+/** Read the SDK pin from the configured manifest group. */
+export function readSdkPin(fs, config) {
+    const manifest = readManifest(fs, 'package.json');
+    const group = config.pinSource === 'devDependencies' ? manifest.devDependencies : manifest.dependencies;
+    const pin = group?.[config.sdkPackage];
+    return typeof pin === 'string' ? pin : null;
+}
+function collectImportSpecifiers(fs, roots, sdkPackage) {
+    const pattern = /(?:from\s+|require\(|import\()\s*['"]([^'"]*goodvibes-sdk[^'"]*)['"]/g;
+    const found = [];
+    const walk = (dir) => {
+        let entries;
+        try {
+            entries = fs.readDir(dir);
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            const path = `${dir}/${entry}`;
+            if (entry.endsWith('.ts') || entry.endsWith('.tsx')) {
+                const text = fs.readText(path);
+                for (const match of text.matchAll(pattern)) {
+                    if (match[1])
+                        found.push(match[1]);
+                }
+            }
+            else if (!entry.includes('.')) {
+                // No extension → treat as a subdirectory to recurse into.
+                walk(path);
+            }
+        }
+    };
+    for (const root of roots)
+        walk(root);
+    return found;
+}
+/** Build the set of allowed import specifiers from the installed SDK's exports map. */
+function allowedExportSpecifiers(fs, sdkPackage) {
+    const installed = `node_modules/${sdkPackage}/package.json`;
+    if (!fs.exists(installed))
+        return null;
+    const manifest = readManifest(fs, installed);
+    if (!manifest.exports || typeof manifest.exports !== 'object')
+        return new Set([sdkPackage]);
+    const allow = new Set();
+    for (const key of Object.keys(manifest.exports)) {
+        if (key === '.')
+            allow.add(sdkPackage);
+        else if (key.startsWith('./'))
+            allow.add(`${sdkPackage}/${key.slice(2)}`);
+    }
+    allow.add(sdkPackage);
+    return allow;
+}
+/**
+ * Run every sdk-pin gate and return one result per gate. Pure over the injected
+ * FsReader — no process exit, no console. The bin maps results to exit codes.
+ */
+export function runSdkPinGate(fs, partial) {
+    const config = resolveSdkPinConfig(partial);
+    const results = [];
+    const overlayPresent = fs.exists(config.overlayMarker);
+    results.push({
+        id: 'local-sdk-overlay-absent',
+        ok: !overlayPresent,
+        detail: overlayPresent
+            ? `dev-link overlay marker present at ${config.overlayMarker} — restore the published SDK before cutting`
+            : 'no dev-link overlay marker',
+    });
+    const pin = readSdkPin(fs, config);
+    const pinExact = pin !== null && EXACT_SEMVER.test(pin);
+    results.push({
+        id: 'sdk-pin-exact-semver',
+        ok: pinExact,
+        detail: pinExact
+            ? `${config.sdkPackage} pinned to ${pin}`
+            : `${config.sdkPackage} pin in ${config.pinSource} must be exact X.Y.Z (found: ${pin ?? 'missing'})`,
+    });
+    if (pinExact && pin) {
+        const installedPath = `node_modules/${config.sdkPackage}/package.json`;
+        const installedVersion = fs.exists(installedPath)
+            ? readManifest(fs, installedPath).version ?? null
+            : null;
+        results.push({
+            id: 'installed-matches-pin',
+            ok: installedVersion === pin,
+            detail: installedVersion === pin
+                ? `installed ${config.sdkPackage}@${installedVersion} matches pin`
+                : `installed ${config.sdkPackage}@${installedVersion ?? 'missing'} != pin ${pin} (run install)`,
+        });
+        const lockPresent = fs.exists(config.lockfile);
+        const lockResolves = lockPresent && fs.readText(config.lockfile).includes(`${config.sdkPackage}@${pin}`);
+        results.push({
+            id: 'lockfile-resolves-pin',
+            ok: lockResolves,
+            detail: lockResolves
+                ? `${config.lockfile} resolves ${config.sdkPackage}@${pin}`
+                : `${config.lockfile} does not resolve ${config.sdkPackage}@${pin} — lockfile lagged the pin bump`,
+        });
+    }
+    const specifiers = collectImportSpecifiers(fs, config.sourceRoots, config.sdkPackage);
+    const nonNpm = specifiers.filter((s) => !s.startsWith(config.sdkPackage));
+    results.push({
+        id: 'npm-specifier-only-imports',
+        ok: nonNpm.length === 0,
+        detail: nonNpm.length === 0
+            ? 'all SDK imports use the npm specifier'
+            : `non-npm SDK import(s): ${[...new Set(nonNpm)].join(', ')}`,
+    });
+    if (config.enforceExportsMap) {
+        const allow = allowedExportSpecifiers(fs, config.sdkPackage);
+        if (allow === null) {
+            results.push({
+                id: 'exports-map-only-imports',
+                ok: true,
+                detail: 'installed SDK package.json absent — exports-map check skipped',
+            });
+        }
+        else {
+            const offenders = specifiers.filter((s) => s.startsWith(config.sdkPackage) && !allow.has(s));
+            results.push({
+                id: 'exports-map-only-imports',
+                ok: offenders.length === 0,
+                detail: offenders.length === 0
+                    ? 'all SDK subpath imports resolve to a published exports key'
+                    : `SDK import(s) not in the published exports map: ${[...new Set(offenders)].join(', ')}`,
+            });
+        }
+    }
+    return results;
+}

package/dist/lib/sha256sums.d.ts

@@ -0,0 +1,41 @@
+/**
+ * sha256sums — generate and verify a SHA256SUMS manifest over release assets.
+ *
+ * Emits the standard `<hex>  <name>` format (two spaces, coreutils-compatible).
+ * A missing asset is a hard failure — a release must never ship an unlisted or
+ * absent binary.
+ */
+export interface Sha256Entry {
+    /** Name recorded in the manifest (typically the asset basename). */
+    readonly name: string;
+    /** Absolute or root-relative path to hash. */
+    readonly path: string;
+}
+/** Reads a file's bytes; returns null when the file is absent. */
+export type ReadBytes = (path: string) => Uint8Array | null;
+/** Computes a lowercase hex sha256 of bytes. */
+export type HashBytes = (bytes: Uint8Array) => string;
+export interface Sha256SumsResult {
+    readonly ok: boolean;
+    /** Manifest text (only meaningful when ok). */
+    readonly manifest: string;
+    /** Entries whose file was missing. */
+    readonly missing: readonly string[];
+}
+/**
+ * Produce a SHA256SUMS manifest. Every entry must resolve to bytes; any missing
+ * file yields ok=false and is listed in `missing`.
+ */
+export declare function generateSha256Sums(entries: readonly Sha256Entry[], readBytes: ReadBytes, hashBytes: HashBytes): Sha256SumsResult;
+export interface VerifyResult {
+    readonly ok: boolean;
+    /** Names whose recomputed hash differs from the manifest. */
+    readonly mismatched: readonly string[];
+    /** Names present in the manifest but absent on disk. */
+    readonly missing: readonly string[];
+}
+/** Parse a manifest into name→hash pairs. */
+export declare function parseSha256Manifest(manifest: string): Map<string, string>;
+/** Verify assets against a manifest by recomputing each hash. */
+export declare function verifySha256Sums(manifest: string, readBytes: ReadBytes, hashBytes: HashBytes): VerifyResult;
+//# sourceMappingURL=sha256sums.d.ts.map

package/dist/lib/sha256sums.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sha256sums.d.ts","sourceRoot":"","sources":["../../src/lib/sha256sums.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,WAAW;IAC1B,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8CAA8C;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,kEAAkE;AAClE,MAAM,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,GAAG,IAAI,CAAC;AAC5D,gDAAgD;AAChD,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,UAAU,KAAK,MAAM,CAAC;AAEtD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,+CAA+C;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,sCAAsC;IACtC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,GAAG,gBAAgB,CAehI;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,6DAA6D;IAC7D,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,wDAAwD;IACxD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,6CAA6C;AAC7C,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAOzE;AAED,iEAAiE;AACjE,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,GAAG,YAAY,CAa3G"}

package/dist/lib/sha256sums.js

@@ -0,0 +1,53 @@
+/**
+ * sha256sums — generate and verify a SHA256SUMS manifest over release assets.
+ *
+ * Emits the standard `<hex>  <name>` format (two spaces, coreutils-compatible).
+ * A missing asset is a hard failure — a release must never ship an unlisted or
+ * absent binary.
+ */
+/**
+ * Produce a SHA256SUMS manifest. Every entry must resolve to bytes; any missing
+ * file yields ok=false and is listed in `missing`.
+ */
+export function generateSha256Sums(entries, readBytes, hashBytes) {
+    const missing = [];
+    const lines = [];
+    for (const entry of entries) {
+        const bytes = readBytes(entry.path);
+        if (bytes === null) {
+            missing.push(entry.name);
+            continue;
+        }
+        lines.push(`${hashBytes(bytes)}  ${entry.name}`);
+    }
+    if (missing.length > 0) {
+        return { ok: false, manifest: '', missing };
+    }
+    return { ok: true, manifest: `${lines.join('\n')}\n`, missing: [] };
+}
+/** Parse a manifest into name→hash pairs. */
+export function parseSha256Manifest(manifest) {
+    const map = new Map();
+    for (const line of manifest.split('\n')) {
+        const match = /^([0-9a-f]{64})\s+(.+)$/.exec(line.trim());
+        if (match?.[1] && match[2])
+            map.set(match[2], match[1]);
+    }
+    return map;
+}
+/** Verify assets against a manifest by recomputing each hash. */
+export function verifySha256Sums(manifest, readBytes, hashBytes) {
+    const expected = parseSha256Manifest(manifest);
+    const mismatched = [];
+    const missing = [];
+    for (const [name, hash] of expected) {
+        const bytes = readBytes(name);
+        if (bytes === null) {
+            missing.push(name);
+            continue;
+        }
+        if (hashBytes(bytes) !== hash)
+            mismatched.push(name);
+    }
+    return { ok: mismatched.length === 0 && missing.length === 0, mismatched, missing };
+}

package/dist/lib/verification-ledger.d.ts

@@ -0,0 +1,30 @@
+/**
+ * verification-ledger — aggregation + rendering of a per-area verification
+ * inventory.
+ *
+ * The data collection is deeply repo-specific (each repo introspects its own
+ * settings/commands/panels), so it stays a per-repo hook. What is genuinely
+ * shared — the totals math and the JSON/Markdown rendering — lives here.
+ */
+export interface LedgerArea {
+    readonly area: string;
+    readonly total: number;
+    readonly localSignal: number;
+    readonly localBehavior: number;
+    readonly externalRequired: number;
+}
+export interface LedgerTotals {
+    readonly total: number;
+    readonly localSignal: number;
+    readonly localBehavior: number;
+    readonly externalRequired: number;
+    readonly localSignalPercent: number;
+    readonly localBehaviorPercent: number;
+}
+/** Sum areas and compute coverage percentages. */
+export declare function computeLedgerTotals(areas: readonly LedgerArea[]): LedgerTotals;
+/** Render the ledger as Markdown. */
+export declare function renderLedgerMarkdown(areas: readonly LedgerArea[]): string;
+/** Render the ledger as JSON (areas + computed totals). */
+export declare function renderLedgerJson(areas: readonly LedgerArea[]): string;
+//# sourceMappingURL=verification-ledger.d.ts.map

package/dist/lib/verification-ledger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification-ledger.d.ts","sourceRoot":"","sources":["../../src/lib/verification-ledger.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;CACvC;AAED,kDAAkD;AAClD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,GAAG,YAAY,CAO9E;AAED,qCAAqC;AACrC,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,GAAG,MAAM,CAczE;AAED,2DAA2D;AAC3D,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,GAAG,MAAM,CAErE"}

package/dist/lib/verification-ledger.js

@@ -0,0 +1,37 @@
+/**
+ * verification-ledger — aggregation + rendering of a per-area verification
+ * inventory.
+ *
+ * The data collection is deeply repo-specific (each repo introspects its own
+ * settings/commands/panels), so it stays a per-repo hook. What is genuinely
+ * shared — the totals math and the JSON/Markdown rendering — lives here.
+ */
+/** Sum areas and compute coverage percentages. */
+export function computeLedgerTotals(areas) {
+    const total = areas.reduce((n, a) => n + a.total, 0);
+    const localSignal = areas.reduce((n, a) => n + a.localSignal, 0);
+    const localBehavior = areas.reduce((n, a) => n + a.localBehavior, 0);
+    const externalRequired = areas.reduce((n, a) => n + a.externalRequired, 0);
+    const pct = (n) => (total === 0 ? 0 : Math.round((n / total) * 1000) / 10);
+    return { total, localSignal, localBehavior, externalRequired, localSignalPercent: pct(localSignal), localBehaviorPercent: pct(localBehavior) };
+}
+/** Render the ledger as Markdown. */
+export function renderLedgerMarkdown(areas) {
+    const totals = computeLedgerTotals(areas);
+    const rows = areas.map((a) => `| ${a.area} | ${a.total} | ${a.localSignal} | ${a.localBehavior} | ${a.externalRequired} |`);
+    return [
+        '# Verification Ledger',
+        '',
+        '| Area | Total | Local signal | Local behavior | External required |',
+        '| --- | ---: | ---: | ---: | ---: |',
+        ...rows,
+        `| **Total** | **${totals.total}** | **${totals.localSignal}** | **${totals.localBehavior}** | **${totals.externalRequired}** |`,
+        '',
+        `Local-signal coverage: ${totals.localSignalPercent}% · local-behavior coverage: ${totals.localBehaviorPercent}%`,
+        '',
+    ].join('\n');
+}
+/** Render the ledger as JSON (areas + computed totals). */
+export function renderLedgerJson(areas) {
+    return `${JSON.stringify({ areas, totals: computeLedgerTotals(areas) }, null, 2)}\n`;
+}

package/package.json

@@ -0,0 +1,59 @@
+{
+  "name": "@pellux/goodvibes-toolchain",
+  "version": "1.11.0",
+  "engines": {
+    "bun": "1.3.10",
+    "node": ">=22.0.0"
+  },
+  "description": "Shared GoodVibes CI/CD toolchain: parameterized release, publish, and verification tools (sdk-pin gate, build-binaries, release-cut, coverage-gate, per-job-green, and more) consumed by every GoodVibes repo.",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./config": {
+      "types": "./dist/config.d.ts",
+      "import": "./dist/config.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "bin": {
+    "goodvibes-sdk-pin-gate": "./dist/bin/sdk-pin-gate.js",
+    "goodvibes-build-binaries": "./dist/bin/build-binaries.js",
+    "goodvibes-release-cut": "./dist/bin/release-cut.js",
+    "goodvibes-coverage-gate": "./dist/bin/coverage-gate.js",
+    "goodvibes-verification-ledger": "./dist/bin/verification-ledger.js",
+    "goodvibes-post-build-smoke": "./dist/bin/post-build-smoke.js",
+    "goodvibes-package-install-check": "./dist/bin/package-install-check.js",
+    "goodvibes-publish-package": "./dist/bin/publish-package.js",
+    "goodvibes-per-job-green": "./dist/bin/per-job-green.js",
+    "goodvibes-changelog-gate": "./dist/bin/changelog-gate.js",
+    "goodvibes-sha256sums": "./dist/bin/sha256sums.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "sideEffects": false,
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/mgd34msu/goodvibes-sdk.git"
+  },
+  "bugs": {
+    "url": "https://github.com/mgd34msu/goodvibes-sdk/issues"
+  },
+  "homepage": "https://github.com/mgd34msu/goodvibes-sdk",
+  "keywords": [
+    "goodvibes",
+    "toolchain",
+    "ci",
+    "release",
+    "publish"
+  ],
+  "publishConfig": {
+    "access": "public"
+  }
+}