@provos/ironcurtain 0.6.0 → 0.7.1

package/dist/persona/persona-customizer.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Interactive LLM-assisted constitution customizer for personas.
+ *
+ * Thin wrapper around the shared customizer loop, adding
+ * persona-specific context to the LLM system prompt.
+ */
+import type { GitHubIdentity } from '../pipeline/github-identity.js';
+import type { ToolAnnotation } from '../pipeline/types.js';
+/**
+ * Builds a system prompt for the persona constitution customizer.
+ * Extends the base customizer prompt with persona-specific context.
+ */
+export declare function buildPersonaCustomizerSystemPrompt(baseConstitution: string, toolAnnotations: ToolAnnotation[], personaDescription: string, serverAllowlist?: readonly string[], githubIdentity?: GitHubIdentity | null): string;
+/**
+ * Runs an interactive constitution customizer session for a persona.
+ * Operates on an in-memory constitution string (not the global file).
+ *
+ * @param initialConstitution - Starting constitution text (from generator or existing)
+ * @param personaDescription - The persona description (context for the LLM)
+ * @param serverAllowlist - Optional server allowlist (context for the LLM)
+ * @returns The final constitution text, or undefined if the user cancelled
+ */
+export declare function runPersonaConstitutionCustomizer(initialConstitution: string, personaDescription: string, serverAllowlist?: readonly string[]): Promise<string | undefined>;

package/dist/persona/persona-customizer.js

@@ -0,0 +1,52 @@
+/**
+ * Interactive LLM-assisted constitution customizer for personas.
+ *
+ * Thin wrapper around the shared customizer loop, adding
+ * persona-specific context to the LLM system prompt.
+ */
+import { buildSystemPrompt } from '../pipeline/constitution-customizer.js';
+import { runConstitutionCustomizerLoop } from '../pipeline/customizer-loop.js';
+// ---------------------------------------------------------------------------
+// Persona-Scoped System Prompt
+// ---------------------------------------------------------------------------
+/**
+ * Builds a system prompt for the persona constitution customizer.
+ * Extends the base customizer prompt with persona-specific context.
+ */
+export function buildPersonaCustomizerSystemPrompt(baseConstitution, toolAnnotations, personaDescription, serverAllowlist, githubIdentity) {
+    const basePrompt = buildSystemPrompt(baseConstitution, toolAnnotations, githubIdentity);
+    const serverContext = serverAllowlist
+        ? `\nThis persona only has access to these MCP servers: ${serverAllowlist.join(', ')}.`
+        : '';
+    return `${basePrompt}
+
+## Persona Context
+
+This constitution is for a persona with the following purpose:
+
+${personaDescription}
+${serverContext}
+
+Focus your suggestions on what this persona needs. Grant the minimum
+permissions required for the persona's purpose.`;
+}
+// ---------------------------------------------------------------------------
+// Main Entry Point
+// ---------------------------------------------------------------------------
+/**
+ * Runs an interactive constitution customizer session for a persona.
+ * Operates on an in-memory constitution string (not the global file).
+ *
+ * @param initialConstitution - Starting constitution text (from generator or existing)
+ * @param personaDescription - The persona description (context for the LLM)
+ * @param serverAllowlist - Optional server allowlist (context for the LLM)
+ * @returns The final constitution text, or undefined if the user cancelled
+ */
+export async function runPersonaConstitutionCustomizer(initialConstitution, personaDescription, serverAllowlist) {
+    return runConstitutionCustomizerLoop(initialConstitution, (ctx) => buildPersonaCustomizerSystemPrompt('', ctx.annotations, personaDescription, serverAllowlist, ctx.githubIdentity), {
+        stepName: 'persona-customize-policy',
+        noteTitle: 'Current Persona Constitution',
+        refinePlaceholder: 'e.g., "also allow fetching from news sites"',
+    });
+}
+//# sourceMappingURL=persona-customizer.js.map

package/dist/persona/persona-customizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"persona-customizer.js","sourceRoot":"","sources":["../../src/persona/persona-customizer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAC3E,OAAO,EAAE,6BAA6B,EAA8B,MAAM,gCAAgC,CAAC;AAI3G,8EAA8E;AAC9E,+BAA+B;AAC/B,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,kCAAkC,CAChD,gBAAwB,EACxB,eAAiC,EACjC,kBAA0B,EAC1B,eAAmC,EACnC,cAAsC;IAEtC,MAAM,UAAU,GAAG,iBAAiB,CAAC,gBAAgB,EAAE,eAAe,EAAE,cAAc,CAAC,CAAC;IAExF,MAAM,aAAa,GAAG,eAAe;QACnC,CAAC,CAAC,wDAAwD,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QACvF,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO,GAAG,UAAU;;;;;;EAMpB,kBAAkB;EAClB,aAAa;;;gDAGiC,CAAC;AACjD,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,mBAA2B,EAC3B,kBAA0B,EAC1B,eAAmC;IAEnC,OAAO,6BAA6B,CAClC,mBAAmB,EACnB,CAAC,GAA0B,EAAE,EAAE,CAC7B,kCAAkC,CAAC,EAAE,EAAE,GAAG,CAAC,WAAW,EAAE,kBAAkB,EAAE,eAAe,EAAE,GAAG,CAAC,cAAc,CAAC,EAClH;QACE,QAAQ,EAAE,0BAA0B;QACpC,SAAS,EAAE,8BAA8B;QACzC,iBAAiB,EAAE,6CAA6C;KACjE,CACF,CAAC;AACJ,CAAC"}

package/dist/persona/persona-prompt.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Persona system prompt augmentation.
+ *
+ * Builds the system prompt fragment injected when a session is
+ * created with a persona. Includes the persona description and
+ * the contents of the persistent memory file (workspace/memory.md).
+ */
+import type { PersonaDefinition } from './types.js';
+/**
+ * Builds the system prompt augmentation for a persona session.
+ *
+ * Includes the persona's description and the current contents of
+ * the memory file. The agent is instructed to read and update the
+ * memory file across sessions.
+ *
+ * @param persona - The persona definition.
+ * @param memoryPath - Absolute path to the memory file (workspace/memory.md).
+ */
+export declare function buildPersonaSystemPromptAugmentation(persona: PersonaDefinition, memoryPath: string): string;

package/dist/persona/persona-prompt.js

@@ -0,0 +1,42 @@
+/**
+ * Persona system prompt augmentation.
+ *
+ * Builds the system prompt fragment injected when a session is
+ * created with a persona. Includes the persona description and
+ * the contents of the persistent memory file (workspace/memory.md).
+ */
+import { existsSync, readFileSync } from 'node:fs';
+/**
+ * Builds the system prompt augmentation for a persona session.
+ *
+ * Includes the persona's description and the current contents of
+ * the memory file. The agent is instructed to read and update the
+ * memory file across sessions.
+ *
+ * @param persona - The persona definition.
+ * @param memoryPath - Absolute path to the memory file (workspace/memory.md).
+ */
+export function buildPersonaSystemPromptAugmentation(persona, memoryPath) {
+    const memoryContent = existsSync(memoryPath) ? readFileSync(memoryPath, 'utf-8') : '';
+    return `
+## Persona: ${persona.name}
+
+${persona.description}
+
+## Persistent Memory
+
+You have a persistent memory file at: ${memoryPath}
+This file survives across sessions. Use it to remember important context:
+- User preferences and patterns
+- Ongoing tasks and their status
+- Key decisions and their reasoning
+- Names, dates, and recurring items
+
+Read this file at the start of each session to recall prior context.
+Before the session ends, update it with anything worth remembering.
+Keep it concise and organized — this is your long-term memory.
+
+${memoryContent ? `### Current Memory Contents\n\n${memoryContent}` : 'The memory file is currently empty — this is your first session.'}
+`.trim();
+}
+//# sourceMappingURL=persona-prompt.js.map

package/dist/persona/persona-prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"persona-prompt.js","sourceRoot":"","sources":["../../src/persona/persona-prompt.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAGnD;;;;;;;;;GASG;AACH,MAAM,UAAU,oCAAoC,CAAC,OAA0B,EAAE,UAAkB;IACjG,MAAM,aAAa,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEtF,OAAO;cACK,OAAO,CAAC,IAAI;;EAExB,OAAO,CAAC,WAAW;;;;wCAImB,UAAU;;;;;;;;;;;EAWhD,aAAa,CAAC,CAAC,CAAC,kCAAkC,aAAa,EAAE,CAAC,CAAC,CAAC,kEAAkE;CACvI,CAAC,IAAI,EAAE,CAAC;AACT,CAAC"}

package/dist/persona/resolve.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Persona resolver -- locates persona directories, loads definitions,
+ * and validates compiled policy existence.
+ *
+ * Follows the same directory-layout pattern as job paths in
+ * src/config/paths.ts (getJobDir, getJobGeneratedDir, etc.).
+ */
+import { type PersonaDefinition, type PersonaName } from './types.js';
+import type { MCPServerConfig } from '../config/types.js';
+/** Returns the base directory for all personas: {home}/personas/ */
+export declare function getPersonasDir(): string;
+/** Returns the directory for a specific persona: {home}/personas/{name}/ */
+export declare function getPersonaDir(name: PersonaName): string;
+/** Returns the generated artifacts directory for a persona: {home}/personas/{name}/generated/ */
+export declare function getPersonaGeneratedDir(name: PersonaName): string;
+/** Returns the constitution path for a persona: {home}/personas/{name}/constitution.md */
+export declare function getPersonaConstitutionPath(name: PersonaName): string;
+/** Returns the workspace directory for a persona: {home}/personas/{name}/workspace/ */
+export declare function getPersonaWorkspaceDir(name: PersonaName): string;
+/** Returns the persona definition file path: {home}/personas/{name}/persona.json */
+export declare function getPersonaDefinitionPath(name: PersonaName): string;
+/**
+ * Loads a persona definition from disk.
+ * @throws if the persona directory or persona.json does not exist.
+ */
+export declare function loadPersona(name: PersonaName): PersonaDefinition;
+/** Result of resolving a persona name to runtime-usable paths. */
+export interface ResolvedPersona {
+    readonly policyDir: string;
+    readonly persona: PersonaDefinition;
+    readonly workspacePath: string;
+}
+/**
+ * Resolves a persona name to a validated policyDir, workspace path,
+ * and persona definition.
+ *
+ * @throws if persona does not exist or has no compiled policy.
+ */
+export declare function resolvePersona(nameRaw: string): ResolvedPersona;
+/**
+ * Filters MCP servers to only those in the allowlist.
+ * The "filesystem" server is always included even if omitted from
+ * the allowlist -- this is a hardcoded safety invariant since the
+ * agent sandbox requires filesystem access to function.
+ */
+export declare function applyServerAllowlist(mcpServers: Record<string, MCPServerConfig>, allowlist: readonly string[]): Record<string, MCPServerConfig>;

package/dist/persona/resolve.js

@@ -0,0 +1,108 @@
+/**
+ * Persona resolver -- locates persona directories, loads definitions,
+ * and validates compiled policy existence.
+ *
+ * Follows the same directory-layout pattern as job paths in
+ * src/config/paths.ts (getJobDir, getJobGeneratedDir, etc.).
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { getIronCurtainHome } from '../config/paths.js';
+import { createPersonaName } from './types.js';
+// ---------------------------------------------------------------------------
+// Path helpers
+// ---------------------------------------------------------------------------
+/** Returns the base directory for all personas: {home}/personas/ */
+export function getPersonasDir() {
+    return resolve(getIronCurtainHome(), 'personas');
+}
+/** Returns the directory for a specific persona: {home}/personas/{name}/ */
+export function getPersonaDir(name) {
+    return resolve(getPersonasDir(), name);
+}
+/** Returns the generated artifacts directory for a persona: {home}/personas/{name}/generated/ */
+export function getPersonaGeneratedDir(name) {
+    return resolve(getPersonaDir(name), 'generated');
+}
+/** Returns the constitution path for a persona: {home}/personas/{name}/constitution.md */
+export function getPersonaConstitutionPath(name) {
+    return resolve(getPersonaDir(name), 'constitution.md');
+}
+/** Returns the workspace directory for a persona: {home}/personas/{name}/workspace/ */
+export function getPersonaWorkspaceDir(name) {
+    return resolve(getPersonaDir(name), 'workspace');
+}
+/** Returns the persona definition file path: {home}/personas/{name}/persona.json */
+export function getPersonaDefinitionPath(name) {
+    return resolve(getPersonaDir(name), 'persona.json');
+}
+// ---------------------------------------------------------------------------
+// Loading
+// ---------------------------------------------------------------------------
+/**
+ * Loads a persona definition from disk.
+ * @throws if the persona directory or persona.json does not exist.
+ */
+export function loadPersona(name) {
+    const defPath = getPersonaDefinitionPath(name);
+    let raw;
+    try {
+        raw = readFileSync(defPath, 'utf-8');
+    }
+    catch (err) {
+        if (err.code === 'ENOENT') {
+            throw new Error(`Persona "${name}" not found: ${defPath} does not exist.`, { cause: err });
+        }
+        throw err;
+    }
+    return JSON.parse(raw);
+}
+/**
+ * Resolves a persona name to a validated policyDir, workspace path,
+ * and persona definition.
+ *
+ * @throws if persona does not exist or has no compiled policy.
+ */
+export function resolvePersona(nameRaw) {
+    const name = createPersonaName(nameRaw);
+    // Load persona.json first — validates the persona directory exists and
+    // produces a clear error ("not found") before checking for compiled policy.
+    const persona = loadPersona(name);
+    const generatedDir = getPersonaGeneratedDir(name);
+    if (!existsSync(resolve(generatedDir, 'compiled-policy.json'))) {
+        throw new Error(`Persona "${name}" has no compiled policy. ` + `Run: ironcurtain persona compile ${name}`);
+    }
+    return {
+        policyDir: generatedDir,
+        persona,
+        workspacePath: getPersonaWorkspaceDir(name),
+    };
+}
+// ---------------------------------------------------------------------------
+// Server allowlist filtering
+// ---------------------------------------------------------------------------
+/**
+ * Filters MCP servers to only those in the allowlist.
+ * The "filesystem" server is always included even if omitted from
+ * the allowlist -- this is a hardcoded safety invariant since the
+ * agent sandbox requires filesystem access to function.
+ */
+export function applyServerAllowlist(mcpServers, allowlist) {
+    // Warn about server names in the allowlist that don't exist in the
+    // global mcp-servers.json. This catches typos and stale references
+    // without breaking the persona (non-fatal warning).
+    const knownServers = new Set(Object.keys(mcpServers));
+    for (const name of allowlist) {
+        if (!knownServers.has(name) && name !== 'filesystem') {
+            process.stderr.write(`Warning: persona allowlist includes unknown server "${name}" (not in mcp-servers.json)\n`);
+        }
+    }
+    const filtered = {};
+    for (const [name, config] of Object.entries(mcpServers)) {
+        if (allowlist.includes(name) || name === 'filesystem') {
+            filtered[name] = config;
+        }
+    }
+    return filtered;
+}
+//# sourceMappingURL=resolve.js.map

package/dist/persona/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/persona/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAA4C,MAAM,YAAY,CAAC;AAGzF,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,oEAAoE;AACpE,MAAM,UAAU,cAAc;IAC5B,OAAO,OAAO,CAAC,kBAAkB,EAAE,EAAE,UAAU,CAAC,CAAC;AACnD,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,aAAa,CAAC,IAAiB;IAC7C,OAAO,OAAO,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,sBAAsB,CAAC,IAAiB;IACtD,OAAO,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC,CAAC;AACnD,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,0BAA0B,CAAC,IAAiB;IAC1D,OAAO,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC,CAAC;AACzD,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,sBAAsB,CAAC,IAAiB;IACtD,OAAO,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC,CAAC;AACnD,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,wBAAwB,CAAC,IAAiB;IACxD,OAAO,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,CAAC;AACtD,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAiB;IAC3C,MAAM,OAAO,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,gBAAgB,OAAO,kBAAkB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAsB,CAAC;AAC9C,CAAC;AAaD;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAExC,uEAAuE;IACvE,4EAA4E;IAC5E,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAElC,MAAM,YAAY,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,YAAY,EAAE,sBAAsB,CAAC,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,4BAA4B,GAAG,oCAAoC,IAAI,EAAE,CAAC,CAAC;IAC7G,CAAC;IAED,OAAO;QACL,SAAS,EAAE,YAAY;QACvB,OAAO;QACP,aAAa,EAAE,sBAAsB,CAAC,IAAI,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAA2C,EAC3C,SAA4B;IAE5B,mEAAmE;IACnE,mEAAmE;IACnE,oDAAoD;IACpD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IACtD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;YACrD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uDAAuD,IAAI,+BAA+B,CAAC,CAAC;QACnH,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAoC,EAAE,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACxD,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;YACtD,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/persona/types.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Persona types -- named profiles bundling a constitution and compiled
+ * policy under ~/.ironcurtain/personas/<name>/.
+ *
+ * Follows the same branded-type pattern as JobId in src/cron/types.ts.
+ */
+/**
+ * Regex for valid persona names: 1-63 chars, lowercase alphanumeric,
+ * hyphens, or underscores. Same rules as JobId.
+ */
+export declare const PERSONA_NAME_PATTERN: RegExp;
+/**
+ * Branded persona name to prevent mixing with other string identifiers.
+ */
+export type PersonaName = string & {
+    readonly __brand: 'PersonaName';
+};
+/**
+ * Validates and creates a PersonaName from a user-provided string.
+ */
+export declare function createPersonaName(raw: string): PersonaName;
+/**
+ * Persisted persona definition. Stored as JSON at
+ * ~/.ironcurtain/personas/{name}/persona.json.
+ */
+export interface PersonaDefinition {
+    /** Persona name. Matches the directory name. */
+    readonly name: PersonaName;
+    /** Human-readable description of the persona's purpose. */
+    readonly description: string;
+    /** ISO 8601 timestamp of when the persona was created. */
+    readonly createdAt: string;
+    /**
+     * Optional allowlist of MCP server names from the global
+     * mcp-servers.json. When set, only these servers are available.
+     * When omitted, all global servers are enabled (default).
+     * The "filesystem" server is always included regardless.
+     */
+    readonly servers?: readonly string[];
+}

package/dist/persona/types.js

@@ -0,0 +1,20 @@
+/**
+ * Persona types -- named profiles bundling a constitution and compiled
+ * policy under ~/.ironcurtain/personas/<name>/.
+ *
+ * Follows the same branded-type pattern as JobId in src/cron/types.ts.
+ */
+import { SLUG_PATTERN, validateSlug } from '../types/slug.js';
+/**
+ * Regex for valid persona names: 1-63 chars, lowercase alphanumeric,
+ * hyphens, or underscores. Same rules as JobId.
+ */
+export const PERSONA_NAME_PATTERN = SLUG_PATTERN;
+/**
+ * Validates and creates a PersonaName from a user-provided string.
+ */
+export function createPersonaName(raw) {
+    validateSlug(raw, 'persona name');
+    return raw;
+}
+//# sourceMappingURL=types.js.map

package/dist/persona/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/persona/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAE9D;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAW,YAAY,CAAC;AAOzD;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,YAAY,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAClC,OAAO,GAAkB,CAAC;AAC5B,CAAC"}

package/dist/pipeline/annotate.js

@@ -10,6 +10,7 @@ import { resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { Client } from '@modelcontextprotocol/sdk/client/index.js';
 import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
+import { permissiveJsonSchemaValidator } from '../trusted-process/permissive-output-validator.js';
 import chalk from 'chalk';
 import { computeHash, createPipelineLlm, loadExistingArtifact, loadPipelineConfig, showCached, writeArtifact, withSpinner, } from './pipeline-shared.js';
 import { annotateTools, buildAnnotationPrompt, validateAnnotationsHeuristic } from './tool-annotator.js';
@@ -33,7 +34,7 @@ async function connectAndDiscoverTools(mcpServers) {
                 if (transport.stderr) {
                     transport.stderr.on('data', () => { });
                 }
-                client = new Client({ name: 'ironcurtain-annotator', version: VERSION });
+                client = new Client({ name: 'ironcurtain-annotator', version: VERSION }, { jsonSchemaValidator: permissiveJsonSchemaValidator });
                 await client.connect(transport);
                 const toolsResult = await client.listTools();
                 totalTools += toolsResult.tools.length;
@@ -78,9 +79,9 @@ async function annotateServerTools(serverName, tools, existingAnnotations, llm)
         });
         const validation = validateAnnotationsHeuristic(tools, annotations);
         if (!validation.valid) {
-            for (const w of validation.warnings) {
-                spinner.text = `${stepText} — WARNING: ${w}`;
-            }
+            const summary = validation.warnings.join('\n  - ');
+            throw new Error(`Path-gap validation failed for server "${serverName}":\n  - ${summary}\n` +
+                'Annotations are part of the TCB — every path-bearing argument must have a path role.');
         }
         return annotations;
     }, (annotations, elapsed) => `${stepText}: ${annotations.length} tools annotated (${elapsed.toFixed(1)}s)`);
@@ -124,6 +125,11 @@ export async function main() {
     const config = loadPipelineConfig();
     console.error(chalk.bold('Tool Annotation Pipeline'));
     console.error(chalk.bold('========================'));
+    console.error('');
+    console.error(chalk.yellow.bold('⚠  WARNING: Tool annotations are part of the IronCurtain TCB (Trusted Computing Base).'));
+    console.error(chalk.yellow('   This is a developer tool and should not be run lightly. All annotation'));
+    console.error(chalk.yellow('   output must be manually reviewed for correctness before use in production.'));
+    console.error('');
     console.error(`Output: ${chalk.dim(config.generatedDir + '/')}`);
     console.error('');
     const { model: llm, logContext, logPath } = await createPipelineLlm(config.generatedDir, 'annotate');

package/dist/pipeline/annotate.js.map

@@ -1 +1 @@
-{"version":3,"file":"annotate.js","sourceRoot":"","sources":["../../src/pipeline/annotate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,WAAW,GACZ,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AAEzG,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAWxC,KAAK,UAAU,uBAAuB,CACpC,UAA2C;IAE3C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,WAAW,CAClC,iCAAiC,EACjC,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,WAAW,GAAG,IAAI,GAAG,EAA4B,CAAC;QACxD,MAAM,OAAO,GAAuC,EAAE,CAAC;QACvD,IAAI,UAAU,GAAG,CAAC,CAAC;QAEnB,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9D,OAAO,CAAC,IAAI,GAAG,mCAAmC,UAAU,KAAK,CAAC;YAClE,IAAI,MAA0B,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,IAAI,oBAAoB,CAAC;oBACzC,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,GAAG,EAAE,EAAE,GAAI,OAAO,CAAC,GAA8B,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE;oBAClE,MAAM,EAAE,MAAM;iBACf,CAAC,CAAC;gBACH,kEAAkE;gBAClE,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;oBACrB,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACxC,CAAC;gBACD,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;gBACzE,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAEhC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC7C,UAAU,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC;gBAEvC,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;YACpE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,wDAAwD;gBACxD,IAAI,MAAM,EAAE,CAAC;oBACX,IAAI,CAAC;wBACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;oBACvB,CAAC;oBAAC,MAAM,CAAC;wBACP,sBAAsB;oBACxB,CAAC;gBACH,CAAC;gBACD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IAC9C,CAAC,EACD,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,UAAU,WAAW,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAC7E,CAAC;IAEF,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC9C,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,uBAAuB,IAAI,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,MAAM,CAAC,WAAW,CAAC;AAC5B,CAAC;AAWD,SAAS,qBAAqB,CAAC,UAAkB,EAAE,KAAgC;IACjF,OAAO,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,qBAAqB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;AAClG,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,UAAkB,EAClB,KAAgC,EAChC,mBAAoD,EACpD,GAAkB;IAElB,MAAM,SAAS,GAAG,qBAAqB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,8BAA8B,UAAU,EAAE,CAAC;IAE5D,uDAAuD;IACvD,MAAM,MAAM,GAAG,mBAAmB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACxD,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC7C,UAAU,CAAC,QAAQ,CAAC,CAAC;QACrB,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC;IAClD,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,WAAW,CAClC,QAAQ,EACR,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;YACtE,OAAO,CAAC,IAAI,GAAG,GAAG,QAAQ,MAAM,GAAG,EAAE,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,4BAA4B,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACpE,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACpC,OAAO,CAAC,IAAI,GAAG,GAAG,QAAQ,eAAe,CAAC,EAAE,CAAC;YAC/C,CAAC;QACH,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC,EACD,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC,GAAG,QAAQ,KAAK,WAAW,CAAC,MAAM,qBAAqB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CACxG,CAAC;IAEF,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E,SAAS,wBAAwB,CAAC,iBAAgD;IAChF,MAAM,OAAO,GAAmC,EAAE,CAAC;IACnD,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,iBAAiB,EAAE,CAAC;QACrD,OAAO,CAAC,UAAU,CAAC,GAAG;YACpB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,KAAK,EAAE,MAAM,CAAC,WAAW;SAC1B,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC;AAC5D,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,KAAK,UAAU,aAAa,CAAC,WAA0C;IACrE,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,IAAI;IACxB,6EAA6E;IAC7E,oEAAoE;IACpE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,iBAAiB,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IAEpC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC;IACjE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAElB,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IAErG,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAErE,IAAI,CAAC;QACH,MAAM,mBAAmB,GAAG,oBAAoB,CAC9C,MAAM,CAAC,YAAY,EACnB,uBAAuB,EACvB,MAAM,CAAC,mBAAmB,CAC3B,CAAC;QAEF,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAA4B,CAAC;QAC9D,KAAK,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC;YAC7C,UAAU,CAAC,QAAQ,GAAG,YAAY,UAAU,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC;YAC3F,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,mBAAmB,GAAG,wBAAwB,CAAC,iBAAiB,CAAC,CAAC;QACxE,aAAa,CAAC,MAAM,CAAC,YAAY,EAAE,uBAAuB,EAAE,mBAAmB,CAAC,CAAC;QAEjF,MAAM,UAAU,GAAG,CAAC,GAAG,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACrG,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,sBAAsB,UAAU,EAAE,CAAC,CAAC;QAClD,OAAO,CAAC,KAAK,CAAC,0BAA0B,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,GAAG,wBAAwB,CAAC,EAAE,CAAC,CAAC;QACrG,OAAO,CAAC,KAAK,CAAC,0BAA0B,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,CAAC;IACjE,CAAC;YAAS,CAAC;QACT,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAED,gEAAgE;AAChE,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACnF,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IAC9B,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QAC5B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,EAAE,GAAG,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"annotate.js","sourceRoot":"","sources":["../../src/pipeline/annotate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,mDAAmD,CAAC;AAClG,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,WAAW,GACZ,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AAEzG,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAWxC,KAAK,UAAU,uBAAuB,CACpC,UAA2C;IAE3C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,WAAW,CAClC,iCAAiC,EACjC,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,WAAW,GAAG,IAAI,GAAG,EAA4B,CAAC;QACxD,MAAM,OAAO,GAAuC,EAAE,CAAC;QACvD,IAAI,UAAU,GAAG,CAAC,CAAC;QAEnB,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9D,OAAO,CAAC,IAAI,GAAG,mCAAmC,UAAU,KAAK,CAAC;YAClE,IAAI,MAA0B,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,IAAI,oBAAoB,CAAC;oBACzC,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,GAAG,EAAE,EAAE,GAAI,OAAO,CAAC,GAA8B,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE;oBAClE,MAAM,EAAE,MAAM;iBACf,CAAC,CAAC;gBACH,kEAAkE;gBAClE,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;oBACrB,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACxC,CAAC;gBACD,MAAM,GAAG,IAAI,MAAM,CACjB,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,OAAO,EAAE,EACnD,EAAE,mBAAmB,EAAE,6BAA6B,EAAE,CACvD,CAAC;gBACF,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAEhC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC7C,UAAU,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC;gBAEvC,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;YACpE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,wDAAwD;gBACxD,IAAI,MAAM,EAAE,CAAC;oBACX,IAAI,CAAC;wBACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;oBACvB,CAAC;oBAAC,MAAM,CAAC;wBACP,sBAAsB;oBACxB,CAAC;gBACH,CAAC;gBACD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IAC9C,CAAC,EACD,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,UAAU,WAAW,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAC7E,CAAC;IAEF,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC9C,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,uBAAuB,IAAI,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,MAAM,CAAC,WAAW,CAAC;AAC5B,CAAC;AAWD,SAAS,qBAAqB,CAAC,UAAkB,EAAE,KAAgC;IACjF,OAAO,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,qBAAqB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;AAClG,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,UAAkB,EAClB,KAAgC,EAChC,mBAA0D,EAC1D,GAAkB;IAElB,MAAM,SAAS,GAAG,qBAAqB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,8BAA8B,UAAU,EAAE,CAAC;IAE5D,uDAAuD;IACvD,MAAM,MAAM,GAAG,mBAAmB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACxD,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC7C,UAAU,CAAC,QAAQ,CAAC,CAAC;QACrB,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC;IAClD,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,WAAW,CAClC,QAAQ,EACR,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;YACtE,OAAO,CAAC,IAAI,GAAG,GAAG,QAAQ,MAAM,GAAG,EAAE,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,4BAA4B,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACpE,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnD,MAAM,IAAI,KAAK,CACb,0CAA0C,UAAU,WAAW,OAAO,IAAI;gBACxE,sFAAsF,CACzF,CAAC;QACJ,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC,EACD,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC,GAAG,QAAQ,KAAK,WAAW,CAAC,MAAM,qBAAqB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CACxG,CAAC;IAEF,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E,SAAS,wBAAwB,CAAC,iBAAgD;IAChF,MAAM,OAAO,GAAyC,EAAE,CAAC;IACzD,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,iBAAiB,EAAE,CAAC;QACrD,OAAO,CAAC,UAAU,CAAC,GAAG;YACpB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,KAAK,EAAE,MAAM,CAAC,WAAW;SAC1B,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC;AAC5D,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,KAAK,UAAU,aAAa,CAAC,WAA0C;IACrE,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,IAAI;IACxB,6EAA6E;IAC7E,oEAAoE;IACpE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,iBAAiB,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IAEpC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,wFAAwF,CAAC,CAC5G,CAAC;IACF,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,2EAA2E,CAAC,CAAC,CAAC;IACzG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,+EAA+E,CAAC,CAAC,CAAC;IAC7G,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC;IACjE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAElB,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IAErG,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAErE,IAAI,CAAC;QACH,MAAM,mBAAmB,GAAG,oBAAoB,CAC9C,MAAM,CAAC,YAAY,EACnB,uBAAuB,EACvB,MAAM,CAAC,mBAAmB,CAC3B,CAAC;QAEF,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAA4B,CAAC;QAC9D,KAAK,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC;YAC7C,UAAU,CAAC,QAAQ,GAAG,YAAY,UAAU,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC;YAC3F,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,mBAAmB,GAAG,wBAAwB,CAAC,iBAAiB,CAAC,CAAC;QACxE,aAAa,CAAC,MAAM,CAAC,YAAY,EAAE,uBAAuB,EAAE,mBAAmB,CAAC,CAAC;QAEjF,MAAM,UAAU,GAAG,CAAC,GAAG,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACrG,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,sBAAsB,UAAU,EAAE,CAAC,CAAC;QAClD,OAAO,CAAC,KAAK,CAAC,0BAA0B,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,GAAG,wBAAwB,CAAC,EAAE,CAAC,CAAC;QACrG,OAAO,CAAC,KAAK,CAAC,0BAA0B,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,CAAC;IACjE,CAAC;YAAS,CAAC;QACT,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAED,gEAAgE;AAChE,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACnF,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IAC9B,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QAC5B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,EAAE,GAAG,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/pipeline/compile.d.ts

@@ -1,40 +1,23 @@
 /**
  * CLI entry point for `ironcurtain compile-policy`.
  *
- * Orchestrates the policy compilation pipeline (stages 1-3):
- *   1. Compile constitution into declarative rules via LLM
- *   2. Generate test scenarios via LLM
- *   3. Verify compiled policy against real engine + LLM judge
+ * Thin wrapper over PipelineRunner that handles CLI-specific concerns:
+ * loading config, printing the progress banner, and exit codes.
  *
- * Requires tool-annotations.json to exist on disk. Run
- * `npm run annotate-tools` first to generate it.
- */
-import type { MCPServerConfig } from '../config/types.js';
-import { type McpServerConnection } from './list-resolver.js';
-import type { CompiledRule, DiscardedScenario, ListDefinition, TestScenario } from './types.js';
-/**
- * Merges replacement scenarios from the regeneration session into the
- * scenario list. Removes corrected and discarded scenarios, then adds
- * unique replacements that don't duplicate any remaining scenario.
- */
-export declare function mergeReplacements(scenarios: TestScenario[], replacements: TestScenario[], corrections: ReadonlyArray<{
-    scenarioDescription: string;
-}>, discardedScenarios: ReadonlyArray<DiscardedScenario>): TestScenario[];
-/**
- * Resolves all `paths.within` values in compiled rules to their real
- * filesystem paths, following symlinks. This ensures that symlinked
- * directories (e.g., ~/Downloads -> /mnt/c/.../Downloads on WSL) are
- * resolved to their canonical form so that runtime path comparisons
- * match correctly.
+ * The core compile-verify-repair loop lives in PipelineRunner.
  *
- * Falls back to path.resolve() if the path does not exist on disk.
+ * CLI flags:
+ *   --constitution <path>  Use an alternative constitution file
+ *   --output-dir <path>    Write compiled artifacts to this directory
  */
-export declare function resolveRulePaths(rules: CompiledRule[]): CompiledRule[];
+export { resolveRulePaths, mergeReplacements } from './pipeline-shared.js';
+export interface CompilePolicyCliArgs {
+    constitution?: string;
+    outputDir?: string;
+}
 /**
- * Connects to MCP servers needed for data-backed list resolution.
- * Only connects to servers hinted by list definitions with requiresMcp: true.
- * Returns a map keyed by server name for the resolver.
+ * Parses --constitution and --output-dir from process.argv.
+ * Returns resolved absolute paths when provided.
  */
-export declare function connectMcpServersForLists(definitions: ListDefinition[], mcpServers: Record<string, MCPServerConfig>): Promise<Map<string, McpServerConnection>>;
-export declare function disconnectMcpServers(connections: Map<string, McpServerConnection>): Promise<void>;
+export declare function parseCompilePolicyArgs(argv?: string[]): CompilePolicyCliArgs;
 export declare function main(): Promise<void>;