@qa-ai-stlc/core 0.0.0

package/dist/hash.js

@@ -0,0 +1,19 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+import { createHash } from 'node:crypto';
+// A checkout on Windows can leave CRLF line endings for a file whose committed, hashed content
+// used LF, which would otherwise make the same artifact hash differently by OS (AGENTS.md 5.6).
+export function hashText(content) {
+    const normalized = content.replace(/\r\n/g, '\n');
+    return createHash('sha256').update(normalized, 'utf-8').digest('hex');
+}
+// Binary content (screenshots, traces, video) is hashed byte for byte: there is no line-ending
+// convention to normalize.
+export function hashBytes(content) {
+    return createHash('sha256').update(content).digest('hex');
+}
+/** Picks the text or binary hasher based on the content's runtime type. */
+export function hashContent(content) {
+    return typeof content === 'string' ? hashText(content) : hashBytes(content);
+}
+//# sourceMappingURL=hash.js.map

package/dist/hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.js","sourceRoot":"","sources":["../src/hash.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAEtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,+FAA+F;AAC/F,gGAAgG;AAChG,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAClD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxE,CAAC;AAED,+FAA+F;AAC/F,2BAA2B;AAC3B,MAAM,UAAU,SAAS,CAAC,OAAmB;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,WAAW,CAAC,OAA4B;IACtD,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AAC9E,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,20 @@
+export * from './errors.js';
+export * from './hash.js';
+export * from './json-file.js';
+export * from './paths.js';
+export * from './ports/clock.js';
+export * from './ports/file-system.js';
+export * from './ports/logger.js';
+export * from './qa-store.js';
+export * from './manifest-store.js';
+export * from './config-loader.js';
+export * from './ports/http-client.js';
+export * from './ports/process-runner.js';
+export * from './browser-doctor.js';
+export * from './secret-scan.js';
+export * from './redaction.js';
+export * from './evidence-store.js';
+export * from './ports/browser-launcher.js';
+export * from './auth.js';
+export * from './auth-session-store.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC;AACvC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,WAAW,CAAC;AAC1B,cAAc,yBAAyB,CAAC"}

package/dist/index.js

@@ -0,0 +1,22 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+export * from './errors.js';
+export * from './hash.js';
+export * from './json-file.js';
+export * from './paths.js';
+export * from './ports/clock.js';
+export * from './ports/file-system.js';
+export * from './ports/logger.js';
+export * from './qa-store.js';
+export * from './manifest-store.js';
+export * from './config-loader.js';
+export * from './ports/http-client.js';
+export * from './ports/process-runner.js';
+export * from './browser-doctor.js';
+export * from './secret-scan.js';
+export * from './redaction.js';
+export * from './evidence-store.js';
+export * from './ports/browser-launcher.js';
+export * from './auth.js';
+export * from './auth-session-store.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAEtC,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC;AACvC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,WAAW,CAAC;AAC1B,cAAc,yBAAyB,CAAC"}

package/dist/json-file.d.ts

@@ -0,0 +1,6 @@
+import type { z } from 'zod';
+import type { FileSystem } from './ports/file-system.js';
+export declare function toCanonicalJson(value: unknown): string;
+export declare function readJsonFile<Schema extends z.ZodType>(fs: FileSystem, absolutePath: string, schema: Schema): Promise<z.infer<Schema>>;
+export declare function writeJsonFile(fs: FileSystem, absolutePath: string, value: unknown): Promise<void>;
+//# sourceMappingURL=json-file.d.ts.map

package/dist/json-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-file.d.ts","sourceRoot":"","sources":["../src/json-file.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAKzD,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEtD;AAED,wBAAsB,YAAY,CAAC,MAAM,SAAS,CAAC,CAAC,OAAO,EACzD,EAAE,EAAE,UAAU,EACd,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAe1B;AAED,wBAAsB,aAAa,CAAC,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvG"}

package/dist/json-file.js

@@ -0,0 +1,29 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+import { QaError } from './errors.js';
+// Two spaces, a trailing newline, and no other formatting choice, so the same value serializes
+// to byte-identical content on every OS and every run (AGENTS.md 12.6).
+export function toCanonicalJson(value) {
+    return `${JSON.stringify(value, null, 2)}\n`;
+}
+export async function readJsonFile(fs, absolutePath, schema) {
+    const raw = await fs.readFile(absolutePath);
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (error) {
+        throw new QaError('JSON_FILE_MALFORMED', `"${absolutePath}" is not valid JSON`, { cause: error });
+    }
+    const result = schema.safeParse(parsed);
+    if (!result.success) {
+        throw new QaError('JSON_FILE_INVALID', `"${absolutePath}" does not match its schema`, {
+            cause: result.error,
+        });
+    }
+    return result.data;
+}
+export async function writeJsonFile(fs, absolutePath, value) {
+    await fs.writeFile(absolutePath, toCanonicalJson(value));
+}
+//# sourceMappingURL=json-file.js.map

package/dist/json-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-file.js","sourceRoot":"","sources":["../src/json-file.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAItC,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC,+FAA+F;AAC/F,wEAAwE;AACxE,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,EAAc,EACd,YAAoB,EACpB,MAAc;IAEd,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,OAAO,CAAC,qBAAqB,EAAE,IAAI,YAAY,qBAAqB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,OAAO,CAAC,mBAAmB,EAAE,IAAI,YAAY,6BAA6B,EAAE;YACpF,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAc,EAAE,YAAoB,EAAE,KAAc;IACtF,MAAM,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/manifest-store.d.ts

@@ -0,0 +1,27 @@
+import { type Manifest, type RelativePath } from '@qa-ai-stlc/schemas';
+import { type Clock } from './ports/clock.js';
+import type { QaStore } from './qa-store.js';
+export interface ManifestStoreOptions {
+    readonly store: QaStore;
+    readonly clock?: Clock;
+}
+/**
+ * `.qa/manifest.json`: the hash of every artifact the engine has registered. `qa validate` and
+ * every MCP mutation reject a file that is unregistered or whose content no longer matches its
+ * recorded hash, so a direct filesystem write cannot pass for an engine-produced artifact
+ * (AGENTS.md 2.5, ADR-003).
+ */
+export declare class ManifestStore {
+    private readonly store;
+    private readonly clock;
+    constructor(options: ManifestStoreOptions);
+    load(): Promise<Manifest>;
+    save(manifest: Manifest): Promise<void>;
+    /** Hashes `content` and records it as the current registered version of `relativePath`. */
+    register(relativePath: RelativePath, content: string | Uint8Array): Promise<void>;
+    /** Reports whether `content` still matches the hash registered for `relativePath`, if any. */
+    verify(relativePath: RelativePath, content: string | Uint8Array): Promise<boolean>;
+    /** Throws a coded `QaError` when `relativePath` is unregistered or its content was tampered with. */
+    assertRegistered(relativePath: RelativePath, content: string | Uint8Array): Promise<void>;
+}
+//# sourceMappingURL=manifest-store.d.ts.map

package/dist/manifest-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-store.d.ts","sourceRoot":"","sources":["../src/manifest-store.ts"],"names":[],"mappings":"AAGA,OAAO,EAAkC,KAAK,QAAQ,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGvG,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAI7C,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB;AAED;;;;;GAKG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAU;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;gBAElB,OAAO,EAAE,oBAAoB;IAKnC,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC;IAQzB,IAAI,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7C,2FAA2F;IACrF,QAAQ,CAAC,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAYvF,8FAA8F;IACxF,MAAM,CAAC,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC;IAMxF,qGAAqG;IAC/F,gBAAgB,CAAC,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAchG"}

package/dist/manifest-store.js

@@ -0,0 +1,65 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+import { ManifestSchema, SCHEMA_VERSION } from '@qa-ai-stlc/schemas';
+import { QaError } from './errors.js';
+import { hashContent } from './hash.js';
+import { systemClock } from './ports/clock.js';
+const MANIFEST_PATH = 'manifest.json';
+/**
+ * `.qa/manifest.json`: the hash of every artifact the engine has registered. `qa validate` and
+ * every MCP mutation reject a file that is unregistered or whose content no longer matches its
+ * recorded hash, so a direct filesystem write cannot pass for an engine-produced artifact
+ * (AGENTS.md 2.5, ADR-003).
+ */
+export class ManifestStore {
+    store;
+    clock;
+    constructor(options) {
+        this.store = options.store;
+        this.clock = options.clock ?? systemClock;
+    }
+    async load() {
+        const exists = await this.store.pathExists(MANIFEST_PATH);
+        if (!exists) {
+            return { schemaVersion: SCHEMA_VERSION, artifacts: {} };
+        }
+        return this.store.readJson(MANIFEST_PATH, ManifestSchema);
+    }
+    async save(manifest) {
+        await this.store.writeJson(MANIFEST_PATH, manifest);
+    }
+    /** Hashes `content` and records it as the current registered version of `relativePath`. */
+    async register(relativePath, content) {
+        const manifest = await this.load();
+        const nextManifest = {
+            ...manifest,
+            artifacts: {
+                ...manifest.artifacts,
+                [relativePath]: { sha256: hashContent(content), registeredAt: this.clock.now().toISOString() },
+            },
+        };
+        await this.save(nextManifest);
+    }
+    /** Reports whether `content` still matches the hash registered for `relativePath`, if any. */
+    async verify(relativePath, content) {
+        const manifest = await this.load();
+        const entry = manifest.artifacts[relativePath];
+        return entry?.sha256 === hashContent(content);
+    }
+    /** Throws a coded `QaError` when `relativePath` is unregistered or its content was tampered with. */
+    async assertRegistered(relativePath, content) {
+        const manifest = await this.load();
+        const entry = manifest.artifacts[relativePath];
+        if (entry === undefined) {
+            throw new QaError('ARTIFACT_UNREGISTERED', `"${relativePath}" is not registered in the manifest`, {
+                remediation: 'Register the artifact through the engine before referencing it.',
+            });
+        }
+        if (entry.sha256 !== hashContent(content)) {
+            throw new QaError('ARTIFACT_HASH_MISMATCH', `"${relativePath}" does not match its registered hash`, {
+                remediation: 'The file changed outside the engine; regenerate or re-register it through the engine.',
+            });
+        }
+    }
+}
+//# sourceMappingURL=manifest-store.js.map

package/dist/manifest-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-store.js","sourceRoot":"","sources":["../src/manifest-store.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAEtC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAoC,MAAM,qBAAqB,CAAC;AACvG,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,WAAW,EAAc,MAAM,kBAAkB,CAAC;AAG3D,MAAM,aAAa,GAAiB,eAAe,CAAC;AAOpD;;;;;GAKG;AACH,MAAM,OAAO,aAAa;IACP,KAAK,CAAU;IACf,KAAK,CAAQ;IAE9B,YAAY,OAA6B;QACvC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,WAAW,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QAC1D,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAkB;QAC3B,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IACtD,CAAC;IAED,2FAA2F;IAC3F,KAAK,CAAC,QAAQ,CAAC,YAA0B,EAAE,OAA4B;QACrE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,YAAY,GAAa;YAC7B,GAAG,QAAQ;YACX,SAAS,EAAE;gBACT,GAAG,QAAQ,CAAC,SAAS;gBACrB,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE;aAC/F;SACF,CAAC;QACF,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAChC,CAAC;IAED,8FAA8F;IAC9F,KAAK,CAAC,MAAM,CAAC,YAA0B,EAAE,OAA4B;QACnE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC/C,OAAO,KAAK,EAAE,MAAM,KAAK,WAAW,CAAC,OAAO,CAAC,CAAC;IAChD,CAAC;IAED,qGAAqG;IACrG,KAAK,CAAC,gBAAgB,CAAC,YAA0B,EAAE,OAA4B;QAC7E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC/C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,OAAO,CAAC,uBAAuB,EAAE,IAAI,YAAY,qCAAqC,EAAE;gBAChG,WAAW,EAAE,iEAAiE;aAC/E,CAAC,CAAC;QACL,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,OAAO,CAAC,wBAAwB,EAAE,IAAI,YAAY,sCAAsC,EAAE;gBAClG,WAAW,EAAE,uFAAuF;aACrG,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/paths.d.ts

@@ -0,0 +1,15 @@
+import { type RelativePath } from '@qa-ai-stlc/schemas';
+/**
+ * Validates and returns a project-relative path (AGENTS.md 5.6): forward-slash separators, no
+ * leading slash, no ".." segment. Throws `QaError` rather than a bare Zod error so callers get a
+ * stable `code` regardless of which artifact schema is involved.
+ */
+export declare function assertRelativePath(value: string): RelativePath;
+/**
+ * Computes the path from `rootDir` to `absolutePath` in the canonical forward-slash form
+ * artifacts are hashed and referenced by, independent of the host OS path separator.
+ */
+export declare function toRelativePath(rootDir: string, absolutePath: string): RelativePath;
+/** Resolves a validated project-relative path to an absolute, OS-native path under `rootDir`. */
+export declare function resolveRelativePath(rootDir: string, relativePath: RelativePath): string;
+//# sourceMappingURL=paths.d.ts.map

package/dist/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAIA,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAG5E;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,CAQ9D;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,YAAY,CAGlF;AAED,iGAAiG;AACjG,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,GAAG,MAAM,CAGvF"}

package/dist/paths.js

@@ -0,0 +1,33 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+import { join, relative } from 'node:path';
+import { RelativePathSchema } from '@qa-ai-stlc/schemas';
+import { QaError } from './errors.js';
+/**
+ * Validates and returns a project-relative path (AGENTS.md 5.6): forward-slash separators, no
+ * leading slash, no ".." segment. Throws `QaError` rather than a bare Zod error so callers get a
+ * stable `code` regardless of which artifact schema is involved.
+ */
+export function assertRelativePath(value) {
+    const result = RelativePathSchema.safeParse(value);
+    if (!result.success) {
+        throw new QaError('INVALID_RELATIVE_PATH', `"${value}" is not a valid project-relative path`, {
+            remediation: 'Use a forward-slash path relative to the store root with no ".." segment.',
+        });
+    }
+    return result.data;
+}
+/**
+ * Computes the path from `rootDir` to `absolutePath` in the canonical forward-slash form
+ * artifacts are hashed and referenced by, independent of the host OS path separator.
+ */
+export function toRelativePath(rootDir, absolutePath) {
+    const posixPath = relative(rootDir, absolutePath).split('\\').join('/');
+    return assertRelativePath(posixPath);
+}
+/** Resolves a validated project-relative path to an absolute, OS-native path under `rootDir`. */
+export function resolveRelativePath(rootDir, relativePath) {
+    assertRelativePath(relativePath);
+    return join(rootDir, ...relativePath.split('/'));
+}
+//# sourceMappingURL=paths.js.map

package/dist/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAEtC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAqB,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,OAAO,CAAC,uBAAuB,EAAE,IAAI,KAAK,wCAAwC,EAAE;YAC5F,WAAW,EAAE,2EAA2E;SACzF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,YAAoB;IAClE,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxE,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC;AACvC,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,mBAAmB,CAAC,OAAe,EAAE,YAA0B;IAC7E,kBAAkB,CAAC,YAAY,CAAC,CAAC;IACjC,OAAO,IAAI,CAAC,OAAO,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;AACnD,CAAC"}

package/dist/ports/browser-launcher.d.ts

@@ -0,0 +1,31 @@
+import type { BrowserContext as PlaywrightBrowserContext } from 'playwright';
+/** Playwright's own `BrowserContext.storageState()` return shape: cookies plus per-origin storage. */
+export type StorageState = Awaited<ReturnType<PlaywrightBrowserContext['storageState']>>;
+/**
+ * The narrow slice of Playwright's `Page` API authentication needs. A real Playwright `Page`
+ * satisfies this structurally; unit tests supply a small fake instead (AGENTS.md 5.3, 13).
+ */
+export interface AuthPage {
+    goto(url: string): Promise<unknown>;
+    fill(selector: string, value: string): Promise<void>;
+    click(selector: string): Promise<void>;
+    waitForLoadState(state?: 'load' | 'domcontentloaded' | 'networkidle'): Promise<void>;
+}
+export interface AuthBrowserContext {
+    newPage(): Promise<AuthPage>;
+    storageState(): Promise<StorageState>;
+    close(): Promise<void>;
+}
+export interface AuthBrowser {
+    newContext(): Promise<AuthBrowserContext>;
+    /** The contexts an attached, already-authenticated browser owns (ADR-004, section 6.2 step 1). */
+    contexts(): readonly AuthBrowserContext[];
+    close(): Promise<void>;
+}
+/** Injected so authentication is testable without actually launching or attaching to a browser. */
+export interface BrowserLauncher {
+    launch(): Promise<AuthBrowser>;
+    connectOverCdp(endpointUrl: string): Promise<AuthBrowser>;
+}
+export declare const playwrightBrowserLauncher: BrowserLauncher;
+//# sourceMappingURL=browser-launcher.d.ts.map

package/dist/ports/browser-launcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-launcher.d.ts","sourceRoot":"","sources":["../../src/ports/browser-launcher.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,IAAI,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE7E,sGAAsG;AACtG,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;AAEzF;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,gBAAgB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,kBAAkB,GAAG,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtF;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7B,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC,CAAC;IACtC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC1C,kGAAkG;IAClG,QAAQ,IAAI,SAAS,kBAAkB,EAAE,CAAC;IAC1C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,mGAAmG;AACnG,MAAM,WAAW,eAAe;IAC9B,MAAM,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/B,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CAC3D;AAED,eAAO,MAAM,yBAAyB,EAAE,eAGvC,CAAC"}

package/dist/ports/browser-launcher.js

@@ -0,0 +1,8 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+import { chromium } from 'playwright';
+export const playwrightBrowserLauncher = {
+    launch: () => chromium.launch(),
+    connectOverCdp: (endpointUrl) => chromium.connectOverCDP(endpointUrl),
+};
+//# sourceMappingURL=browser-launcher.js.map

package/dist/ports/browser-launcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-launcher.js","sourceRoot":"","sources":["../../src/ports/browser-launcher.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAEtC,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAoCtC,MAAM,CAAC,MAAM,yBAAyB,GAAoB;IACxD,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE;IAC/B,cAAc,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC;CACtE,CAAC"}

package/dist/ports/clock.d.ts

@@ -0,0 +1,6 @@
+/** The current time, injected so artifact timestamps are deterministic in tests. */
+export interface Clock {
+    now(): Date;
+}
+export declare const systemClock: Clock;
+//# sourceMappingURL=clock.d.ts.map

package/dist/ports/clock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clock.d.ts","sourceRoot":"","sources":["../../src/ports/clock.ts"],"names":[],"mappings":"AAGA,oFAAoF;AACpF,MAAM,WAAW,KAAK;IACpB,GAAG,IAAI,IAAI,CAAC;CACb;AAED,eAAO,MAAM,WAAW,EAAE,KAEzB,CAAC"}

package/dist/ports/clock.js

@@ -0,0 +1,6 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+export const systemClock = {
+    now: () => new Date(),
+};
+//# sourceMappingURL=clock.js.map

package/dist/ports/clock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clock.js","sourceRoot":"","sources":["../../src/ports/clock.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAOtC,MAAM,CAAC,MAAM,WAAW,GAAU;IAChC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;CACtB,CAAC"}

package/dist/ports/file-system.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The filesystem operations the engine needs, injected so store and manifest logic can be
+ * tested without touching a real disk (AGENTS.md 5.3). Paths are always absolute, OS-native
+ * paths; project-relative path handling lives in `paths.ts`.
+ */
+export interface FileSystem {
+    readFile(absolutePath: string): Promise<string>;
+    writeFile(absolutePath: string, content: string | Uint8Array): Promise<void>;
+    mkdir(absolutePath: string): Promise<void>;
+    pathExists(absolutePath: string): Promise<boolean>;
+}
+export declare const nodeFileSystem: FileSystem;
+//# sourceMappingURL=file-system.d.ts.map

package/dist/ports/file-system.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-system.d.ts","sourceRoot":"","sources":["../../src/ports/file-system.ts"],"names":[],"mappings":"AAKA;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,KAAK,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACpD;AAED,eAAO,MAAM,cAAc,EAAE,UAoB5B,CAAC"}

package/dist/ports/file-system.js

@@ -0,0 +1,25 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+import { mkdir, readFile, stat, writeFile } from 'node:fs/promises';
+export const nodeFileSystem = {
+    readFile: (absolutePath) => readFile(absolutePath, 'utf-8'),
+    writeFile: (absolutePath, content) => typeof content === 'string'
+        ? writeFile(absolutePath, content, 'utf-8')
+        : writeFile(absolutePath, content),
+    mkdir: async (absolutePath) => {
+        await mkdir(absolutePath, { recursive: true });
+    },
+    pathExists: async (absolutePath) => {
+        try {
+            await stat(absolutePath);
+            return true;
+        }
+        catch (error) {
+            if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
+                return false;
+            }
+            throw error;
+        }
+    },
+};
+//# sourceMappingURL=file-system.js.map

package/dist/ports/file-system.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-system.js","sourceRoot":"","sources":["../../src/ports/file-system.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAEtC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAcpE,MAAM,CAAC,MAAM,cAAc,GAAe;IACxC,QAAQ,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC3D,SAAS,EAAE,CAAC,YAAY,EAAE,OAAO,EAAE,EAAE,CACnC,OAAO,OAAO,KAAK,QAAQ;QACzB,CAAC,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC;QAC3C,CAAC,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC;IACtC,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;QAC5B,MAAM,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;QACjC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACzE,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/ports/http-client.d.ts

@@ -0,0 +1,13 @@
+export interface HttpResponse {
+    readonly ok: boolean;
+    readonly status: number;
+}
+export interface HttpRequestOptions {
+    readonly signal?: AbortSignal;
+}
+/** The one network operation `qa doctor` needs: injected so reachability checks never make a real network call in tests (AGENTS.md 5.3, 13). */
+export interface HttpClient {
+    get(url: string, options?: HttpRequestOptions): Promise<HttpResponse>;
+}
+export declare const fetchHttpClient: HttpClient;
+//# sourceMappingURL=http-client.d.ts.map

package/dist/ports/http-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-client.d.ts","sourceRoot":"","sources":["../../src/ports/http-client.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED,gJAAgJ;AAChJ,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CACvE;AAED,eAAO,MAAM,eAAe,EAAE,UAQ7B,CAAC"}

package/dist/ports/http-client.js

@@ -0,0 +1,12 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+export const fetchHttpClient = {
+    get: async (url, options) => {
+        const response = await fetch(url, {
+            method: 'GET',
+            ...(options?.signal ? { signal: options.signal } : {}),
+        });
+        return { ok: response.ok, status: response.status };
+    },
+};
+//# sourceMappingURL=http-client.js.map

package/dist/ports/http-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-client.js","sourceRoot":"","sources":["../../src/ports/http-client.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAgBtC,MAAM,CAAC,MAAM,eAAe,GAAe;IACzC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;QAC1B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,KAAK;YACb,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvD,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACtD,CAAC;CACF,CAAC"}

package/dist/ports/logger.d.ts

@@ -0,0 +1,9 @@
+export type LogMeta = Readonly<Record<string, unknown>>;
+export interface Logger {
+    debug(message: string, meta?: LogMeta): void;
+    info(message: string, meta?: LogMeta): void;
+    warn(message: string, meta?: LogMeta): void;
+    error(message: string, meta?: LogMeta): void;
+}
+export declare const noopLogger: Logger;
+//# sourceMappingURL=logger.d.ts.map

package/dist/ports/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/ports/logger.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAIxD,MAAM,WAAW,MAAM;IACrB,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAC7C,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAC5C,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAC5C,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CAC9C;AAED,eAAO,MAAM,UAAU,EAAE,MAKxB,CAAC"}

package/dist/ports/logger.js

@@ -0,0 +1,9 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+export const noopLogger = {
+    debug: () => undefined,
+    info: () => undefined,
+    warn: () => undefined,
+    error: () => undefined,
+};
+//# sourceMappingURL=logger.js.map

package/dist/ports/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/ports/logger.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAatC,MAAM,CAAC,MAAM,UAAU,GAAW;IAChC,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS;IACtB,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS;IACrB,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS;IACrB,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS;CACvB,CAAC"}

package/dist/ports/process-runner.d.ts

@@ -0,0 +1,17 @@
+export interface ProcessResult {
+    readonly exitCode: number;
+    readonly stdout: string;
+    readonly stderr: string;
+}
+export interface ProcessRunOptions {
+    readonly signal?: AbortSignal;
+}
+/**
+ * Runs an external command, injected so browser installation is testable without actually
+ * spawning one (AGENTS.md 5.3). Always an argument array, never a shell string (AGENTS.md 5.6).
+ */
+export interface ProcessRunner {
+    run(command: string, args: readonly string[], options?: ProcessRunOptions): Promise<ProcessResult>;
+}
+export declare const nodeProcessRunner: ProcessRunner;
+//# sourceMappingURL=process-runner.d.ts.map

package/dist/ports/process-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-runner.d.ts","sourceRoot":"","sources":["../../src/ports/process-runner.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CACpG;AAMD,eAAO,MAAM,iBAAiB,EAAE,aAiB/B,CAAC"}

package/dist/ports/process-runner.js

@@ -0,0 +1,24 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+import { execFile } from 'node:child_process';
+function hasNumericCode(error) {
+    return typeof error.code === 'number';
+}
+export const nodeProcessRunner = {
+    run: (command, args, options) => new Promise((resolve, reject) => {
+        execFile(command, args, { signal: options?.signal }, (error, stdout, stderr) => {
+            if (error === null) {
+                resolve({ exitCode: 0, stdout, stderr });
+                return;
+            }
+            // A numeric `code` is the child process's own exit code; anything else (a string like
+            // "ENOENT") means the command itself could not be spawned at all.
+            if (hasNumericCode(error)) {
+                resolve({ exitCode: error.code, stdout, stderr });
+                return;
+            }
+            reject(new Error(`Failed to spawn "${command}": ${error.message}`, { cause: error }));
+        });
+    }),
+};
+//# sourceMappingURL=process-runner.js.map

package/dist/ports/process-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-runner.js","sourceRoot":"","sources":["../../src/ports/process-runner.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAEtC,OAAO,EAAE,QAAQ,EAAsB,MAAM,oBAAoB,CAAC;AAoBlE,SAAS,cAAc,CAAC,KAAoB;IAC1C,OAAO,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAkB;IAC9C,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAC9B,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC9B,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YAC7E,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;gBACzC,OAAO;YACT,CAAC;YACD,sFAAsF;YACtF,kEAAkE;YAClE,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,OAAO,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACxF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;CACL,CAAC"}

package/dist/qa-store.d.ts

@@ -0,0 +1,33 @@
+import type { z } from 'zod';
+import type { RelativePath } from '@qa-ai-stlc/schemas';
+import { type FileSystem } from './ports/file-system.js';
+export interface QaStoreOptions {
+    readonly projectRoot: string;
+    readonly fs?: FileSystem;
+}
+/**
+ * The `.qa/` store: resolves an artifact's project-relative path to a real file under `.qa/`,
+ * creates the documented directory layout, and reads or writes JSON through the injected
+ * `FileSystem` port so callers never touch `node:fs` directly (AGENTS.md 5.3).
+ */
+export declare class QaStore {
+    readonly projectRoot: string;
+    readonly qaDir: string;
+    private readonly fs;
+    constructor(options: QaStoreOptions);
+    /** Resolves a project-relative artifact path (e.g. `manifest.json`) to an absolute path. */
+    resolve(relativePath: RelativePath): string;
+    /** Converts an absolute path under `.qa/` back to the project-relative form artifacts use. */
+    toRelativePath(absolutePath: string): RelativePath;
+    exists(): Promise<boolean>;
+    /** Creates `.qa/` and every committed subdirectory from the documented layout, if missing. */
+    ensureLayout(): Promise<void>;
+    readJson<Schema extends z.ZodType>(relativePath: RelativePath, schema: Schema): Promise<z.infer<Schema>>;
+    writeJson(relativePath: RelativePath, value: unknown): Promise<void>;
+    pathExists(relativePath: RelativePath): Promise<boolean>;
+    readText(relativePath: RelativePath): Promise<string>;
+    writeText(relativePath: RelativePath, content: string): Promise<void>;
+    /** Like `writeText`, but also accepts raw bytes for binary artifacts such as evidence. */
+    writeBytes(relativePath: RelativePath, content: string | Uint8Array): Promise<void>;
+}
+//# sourceMappingURL=qa-store.d.ts.map

package/dist/qa-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"qa-store.d.ts","sourceRoot":"","sources":["../src/qa-store.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAGzE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC;CAC1B;AAOD;;;;GAIG;AACH,qBAAa,OAAO;IAClB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAa;gBAEpB,OAAO,EAAE,cAAc;IAMnC,4FAA4F;IAC5F,OAAO,CAAC,YAAY,EAAE,YAAY,GAAG,MAAM;IAI3C,8FAA8F;IAC9F,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,YAAY;IAI5C,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC;IAIhC,8FAA8F;IACxF,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAK7B,QAAQ,CAAC,MAAM,SAAS,CAAC,CAAC,OAAO,EACrC,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAIrB,SAAS,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAMpE,UAAU,CAAC,YAAY,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC;IAIxD,QAAQ,CAAC,YAAY,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;IAIrD,SAAS,CAAC,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI3E,0FAA0F;IACpF,UAAU,CAAC,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAK1F"}