@rasensio/aidlc 1.16.0 → 1.18.0

package/dist/compliance/report.js

@@ -0,0 +1,347 @@
+/**
+ * The evidence report — the artifact a buyer hands to an auditor.
+ *
+ * Derived entirely from state already on disk. That is the bet this whole feature
+ * rests on: if producing the report required a developer to write anything they would
+ * not otherwise write, the remaining feature would be a text file with a command
+ * group around it, and the design's stated fallback would be to ship that instead.
+ *
+ * Three properties are load-bearing, and each exists because its absence would make
+ * the report actively misleading:
+ *
+ * **A checked-only control never carries evidence.** CC8.1 is a control over the
+ * change process, and the artifact trail genuinely demonstrates it. The CC6 and CC7
+ * controls operate over a running system — no markdown file evidences "the entity
+ * monitors system components for anomalies". Reporting design-intent prose as
+ * evidence of an operating control is the overclaim this feature exists to prevent,
+ * and it would happen in precisely the document least able to survive it.
+ *
+ * **Absence is reported by name.** A control with no evidence appears as absent, not
+ * omitted. A report that silently drops what it could not find reads as a clean bill
+ * of health.
+ *
+ * **The unreviewed-draft notice is emitted from code.** Not copied from pack text: a
+ * notice living only in an installed file can be edited away permanently, because a
+ * locally edited layer is preserved forever by design.
+ *
+ * Read-only. Writes nothing under `.aidlc/`, and reads only from an allowlist.
+ *
+ * Requirements: compliance-packs/AC-30, AC-32, AC-33, AC-34, AC-59, AC-60, AC-61,
+ * AC-83, AC-84, AC-85, AC-90, AC-107
+ */
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { toPosixRelative } from '../core/paths.js';
+import { completionInfo, loadAllTemplates, loadInstance } from '../metrics/report.js';
+import { readComplianceConfig } from './config.js';
+import { complianceFindingsFilename, parseComplianceFindings } from './findings.js';
+import { resolvePack } from './resolver.js';
+/**
+ * Whether a path is one the report is permitted to read.
+ *
+ * Exported so a test can assert against the same predicate the module documents,
+ * rather than a re-typed copy of it that could drift.
+ */
+export function isAllowedReadPath(projectRoot, path) {
+    const rel = toPosixRelative(projectRoot, path);
+    if (rel === '.aidlc/config.yaml')
+        return true;
+    // Instance state: the metadata, the phase files, the transitions log, the
+    // compliance findings, the review findings, and the artifacts a control names.
+    if (/^\.aidlc\/state\/[^/]+\/(instance\.yaml|transitions\.log)$/.test(rel))
+        return true;
+    if (/^\.aidlc\/state\/[^/]+\/phase-[a-z-]+\.yaml$/.test(rel))
+        return true;
+    if (/^\.aidlc\/state\/[^/]+\/.+\.compliance\.md$/.test(rel))
+        return true;
+    if (/^\.aidlc\/state\/[^/]+\/.+\.review\.md$/.test(rel))
+        return true;
+    if (/^\.aidlc\/state\/[^/]+\/[A-Za-z0-9._-]+\.md$/.test(rel))
+        return true;
+    // Custom templates participate in resolving a completion moment.
+    if (/^\.aidlc\/templates\/[^/]+$/.test(rel))
+        return true;
+    return false;
+}
+/**
+ * The notice text, emitted from code for any pack whose control text is unreviewed.
+ *
+ * One of the notice's three enforcement points. The others are pack-source validation
+ * and a doctor check for the case where someone edits it out of an installed layer.
+ */
+export function unreviewedNoticeFor(meta) {
+    if (meta.reviewed_by !== null)
+        return null;
+    return (`The control text in the ${meta.regime} pack has not been reviewed by a compliance ` +
+        `practitioner. It is a working draft. This report describes what the lifecycle trail ` +
+        `records; it is not an assessment of whether your controls are adequate, and it does ` +
+        `not make this project certified or attested.`);
+}
+/** The sentence stating what a checked-only control does and does not establish. */
+export function checkedOnlyCaveat(controlId) {
+    return (`${controlId} is checked, not evidenced: the trail records that the check was ` +
+        `performed, never that the control operates. Do not present this as evidence.`);
+}
+/** Instance directories under `.aidlc/state/`. */
+function instanceNames(projectRoot) {
+    const stateDir = join(projectRoot, '.aidlc', 'state');
+    if (!existsSync(stateDir))
+        return [];
+    try {
+        return readdirSync(stateDir, { withFileTypes: true })
+            .filter((e) => e.isDirectory())
+            .map((e) => e.name)
+            .sort();
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Decide which instances the report covers.
+ *
+ * Default scope is every instance whose completion moment falls at or after the
+ * earliest pack install. `completionInfo` from the metrics module is the single
+ * implementation of "when did this instance complete" — scope-aware, and handling the
+ * maintenance-terminal case. Re-deriving it here would give two answers differing on
+ * exactly that case, inside a document whose value is that it can be handed over.
+ */
+function selectInstances(projectRoot, packs, opts) {
+    const templates = loadAllTemplates(projectRoot);
+    const earliestInstall = packs
+        .map((p) => p.installed_at)
+        .sort()
+        .at(0);
+    const since = opts.since ?? earliestInstall ?? null;
+    const included = [];
+    const excluded = [];
+    for (const name of instanceNames(projectRoot)) {
+        if (opts.instance !== undefined && name !== opts.instance) {
+            excluded.push({ instance: name, reason: 'filtered', detail: `not --instance ${opts.instance}` });
+            continue;
+        }
+        const inst = loadInstance(projectRoot, name);
+        if (inst === null) {
+            excluded.push({ instance: name, reason: 'not-complete', detail: 'no readable instance state' });
+            continue;
+        }
+        const info = completionInfo(inst, templates);
+        if (!info.completed) {
+            excluded.push({ instance: name, reason: 'not-complete', detail: 'still in progress' });
+            continue;
+        }
+        // A pack cannot evidence a change that predates it. Excluded, and said out loud —
+        // the same principle absent evidence gets, applied to instances.
+        if (since !== null && info.completedAt !== null && info.completedAt < since) {
+            excluded.push({
+                instance: name,
+                reason: 'predates-pack',
+                detail: `completed ${info.completedAt}, before ${since}`,
+            });
+            continue;
+        }
+        included.push(name);
+    }
+    return { included, excluded };
+}
+/** Compliance findings files for one instance, keyed by artifact. */
+function findingsFor(projectRoot, instance, onRead) {
+    const byArtifact = new Map();
+    const warnings = [];
+    const dir = join(projectRoot, '.aidlc', 'state', instance);
+    let entries;
+    try {
+        entries = readdirSync(dir);
+    }
+    catch {
+        return { byArtifact, warnings };
+    }
+    for (const entry of entries.filter((f) => f.endsWith('.compliance.md')).sort()) {
+        const artifact = entry.replace('.compliance.md', '');
+        try {
+            const path = join(dir, entry);
+            onRead?.(path);
+            byArtifact.set(artifact, parseComplianceFindings(readFileSync(path, 'utf8')));
+        }
+        catch (err) {
+            warnings.push(`${instance}/${entry} is unreadable (${err.message})`);
+        }
+    }
+    return { byArtifact, warnings };
+}
+/**
+ * Build the report.
+ *
+ * Reads only: `.aidlc/config.yaml`, each in-scope instance's `instance.yaml` and
+ * `phase-*.yaml`, its compliance findings files, and the pack sources through the
+ * resolver. Creates and writes nothing.
+ */
+export function computeComplianceReport(projectRoot, opts = {}) {
+    const now = opts.now ?? new Date();
+    opts.onRead?.(join(projectRoot, '.aidlc', 'config.yaml'));
+    const config = readComplianceConfig(projectRoot);
+    const warnings = [];
+    const { included, excluded } = selectInstances(projectRoot, config.packs, opts);
+    // Findings, gathered once per in-scope instance.
+    const perInstance = new Map();
+    for (const instance of included) {
+        const gathered = findingsFor(projectRoot, instance, opts.onRead);
+        warnings.push(...gathered.warnings);
+        perInstance.set(instance, gathered);
+    }
+    const packs = [];
+    for (const record of config.packs) {
+        const resolved = resolvePack(record.id);
+        if (!resolved.ok) {
+            warnings.push(`installed pack '${record.id}' did not load: ${resolved.error.errors.join('; ')}`);
+            continue;
+        }
+        const pack = resolved.pack;
+        const controls = pack.controls.map((control) => {
+            const findings = [];
+            const clearedIn = [];
+            let evidenceFound = false;
+            for (const [instance, gathered] of perInstance) {
+                for (const [artifact, file] of gathered.byArtifact) {
+                    for (const finding of file.findings) {
+                        if (finding.control !== control.id)
+                            continue;
+                        findings.push({
+                            id: finding.id,
+                            severity: finding.severity,
+                            status: finding.status,
+                            // Rendered by the one path helper, so nothing absolute reaches the report.
+                            source: toPosixRelative(projectRoot, join(projectRoot, '.aidlc', 'state', instance, complianceFindingsFilename(artifact))),
+                        });
+                    }
+                    if (file.cleared.includes(control.id)) {
+                        clearedIn.push(`${instance}/${artifact}`);
+                    }
+                }
+                // Evidence, for an evidenced control only: does the named artifact exist in
+                // this instance? That is the whole of what the trail can show.
+                if (control.kind === 'evidenced' && control.evidence_artifact !== undefined) {
+                    const artifactPath = join(projectRoot, '.aidlc', 'state', instance, control.evidence_artifact);
+                    opts.onRead?.(artifactPath);
+                    if (existsSync(artifactPath))
+                        evidenceFound = true;
+                }
+            }
+            const row = {
+                packId: record.id,
+                control: control.id,
+                kind: control.kind,
+                requires: control.requires,
+                findings,
+                clearedIn,
+            };
+            // The kind distinction, enforced structurally rather than by convention: the
+            // evidence fields are only ever set on an evidenced control.
+            if (control.kind === 'evidenced' && control.evidence_artifact !== undefined) {
+                row.evidenceArtifact = control.evidence_artifact;
+                row.evidenceFound = evidenceFound;
+            }
+            return row;
+        });
+        packs.push({
+            meta: pack.meta,
+            unreviewedNotice: unreviewedNoticeFor(pack.meta),
+            controls,
+            exclusions: pack.exclusions.map((e) => ({
+                id: e.id,
+                reason: e.reason,
+                ...(e.note !== undefined && { note: e.note }),
+            })),
+        });
+    }
+    return {
+        generatedAt: now.toISOString(),
+        instances: included,
+        excluded,
+        packs,
+        warnings,
+    };
+}
+/**
+ * Render the report as markdown.
+ *
+ * Every path is already repo-relative by construction. A final assertion checks the
+ * home directory does not appear, because that is the decidable form of the guarantee
+ * and it does not depend on secret redaction — the redaction helper explicitly does
+ * not classify paths as secrets.
+ */
+export function renderComplianceReport(report) {
+    const out = [];
+    out.push('# Compliance evidence report', '');
+    out.push(`Generated ${report.generatedAt}`, '');
+    if (report.packs.length === 0) {
+        out.push('No compliance pack is installed, so there is nothing to report.', '');
+        return out.join('\n');
+    }
+    for (const pack of report.packs) {
+        out.push(`## ${pack.meta.regime} (pack \`${pack.meta.id}\` ${pack.meta.version})`, '');
+        if (pack.unreviewedNotice !== null) {
+            out.push(`> **${pack.unreviewedNotice}**`, '');
+        }
+        out.push('### Controls covered', '');
+        for (const row of pack.controls) {
+            out.push(`#### ${row.control} — ${row.kind}`, '');
+            out.push(`- Requires: ${row.requires}`);
+            if (row.kind === 'evidenced') {
+                out.push(`- Evidence artifact: \`${row.evidenceArtifact}\``);
+                out.push(row.evidenceFound === true
+                    ? '- Evidence found: yes'
+                    : '- Evidence found: **no — absent for every in-scope instance**');
+            }
+            else {
+                out.push(`- ${checkedOnlyCaveat(row.control)}`);
+            }
+            if (row.clearedIn.length > 0) {
+                out.push(`- Checked with no issue in: ${row.clearedIn.join(', ')}`);
+            }
+            if (row.findings.length > 0) {
+                out.push('- Findings:');
+                for (const finding of row.findings) {
+                    out.push(`  - ${finding.id} (${finding.severity}, ${finding.status}) — \`${finding.source}\``);
+                }
+            }
+            if (row.clearedIn.length === 0 && row.findings.length === 0) {
+                out.push('- Not checked in any in-scope instance');
+            }
+            out.push('');
+        }
+        out.push('### Criteria this pack does not cover', '');
+        for (const exclusion of pack.exclusions) {
+            out.push(`- ${exclusion.id} — ${exclusion.reason}${exclusion.note ? `: ${exclusion.note}` : ''}`);
+        }
+        out.push('');
+    }
+    out.push('## Scope', '');
+    out.push(report.instances.length > 0
+        ? `Instances covered: ${report.instances.join(', ')}`
+        : 'No completed instance falls within the pack install window.');
+    out.push('');
+    if (report.excluded.length > 0) {
+        out.push('Instances excluded, with the reason:', '');
+        for (const item of report.excluded) {
+            out.push(`- ${item.instance} — ${item.reason}: ${item.detail}`);
+        }
+        out.push('');
+    }
+    if (report.warnings.length > 0) {
+        out.push('## Warnings', '');
+        for (const warning of report.warnings)
+            out.push(`- ${warning}`);
+        out.push('');
+    }
+    const rendered = out.join('\n');
+    // Defence in depth on the guarantee that matters most in a document meant to leave
+    // this machine. Throwing is right: emitting the path would be worse than failing.
+    const home = homedir();
+    if (home.length > 1 && rendered.includes(home)) {
+        throw new Error('compliance report contained an absolute home-directory path — refusing to emit it');
+    }
+    return rendered;
+}
+//# sourceMappingURL=report.js.map

package/dist/compliance/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../../src/compliance/report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAsB,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,0BAA0B,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACpF,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAoF5C;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB,EAAE,IAAY;IACjE,MAAM,GAAG,GAAG,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,GAAG,KAAK,oBAAoB;QAAE,OAAO,IAAI,CAAC;IAC9C,0EAA0E;IAC1E,+EAA+E;IAC/E,IAAI,4DAA4D,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxF,IAAI,8CAA8C,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1E,IAAI,6CAA6C,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,IAAI,yCAAyC,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,8CAA8C,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1E,iEAAiE;IACjE,IAAI,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAc;IAChD,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO,CACL,2BAA2B,IAAI,CAAC,MAAM,8CAA8C;QACpF,sFAAsF;QACtF,sFAAsF;QACtF,8CAA8C,CAC/C,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IACjD,OAAO,CACL,GAAG,SAAS,mEAAmE;QAC/E,8EAA8E,CAC/E,CAAC;AACJ,CAAC;AAED,kDAAkD;AAClD,SAAS,aAAa,CAAC,WAAmB;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACtD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;aAClD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;aAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;aAClB,IAAI,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CACtB,WAAmB,EACnB,KAAsB,EACtB,IAAmB;IAEnB,MAAM,SAAS,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAChD,MAAM,eAAe,GAAG,KAAK;SAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;SAC1B,IAAI,EAAE;SACN,EAAE,CAAC,CAAC,CAAC,CAAC;IACT,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,eAAe,IAAI,IAAI,CAAC;IAEpD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAuB,EAAE,CAAC;IAExC,KAAK,MAAM,IAAI,IAAI,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9C,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1D,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,kBAAkB,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACjG,SAAS;QACX,CAAC;QAED,MAAM,IAAI,GAAG,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAC7C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC,CAAC;YAChG,SAAS;QACX,CAAC;QAED,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACvF,SAAS;QACX,CAAC;QAED,kFAAkF;QAClF,iEAAiE;QACjE,IAAI,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,IAAI,IAAI,CAAC,WAAW,GAAG,KAAK,EAAE,CAAC;YAC5E,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,eAAe;gBACvB,MAAM,EAAE,aAAa,IAAI,CAAC,WAAW,YAAY,KAAK,EAAE;aACzD,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED,qEAAqE;AACrE,SAAS,WAAW,CAClB,WAAmB,EACnB,QAAgB,EAChB,MAA+B;IAE/B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAsD,CAAC;IACjF,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAE3D,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;IAClC,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/E,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9B,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;YACf,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,uBAAuB,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAChF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,KAAK,mBAAoB,GAAa,CAAC,OAAO,GAAG,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAClC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,WAAmB,EACnB,OAAsB,EAAE;IAExB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,eAAe,CAAC,WAAW,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAEhF,iDAAiD;IACjD,MAAM,WAAW,GAAG,IAAI,GAAG,EAA0C,CAAC;IACtE,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACjE,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACpC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,KAAK,GAAkB,EAAE,CAAC;IAChC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,QAAQ,CAAC,IAAI,CACX,mBAAmB,MAAM,CAAC,EAAE,mBAAmB,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAClF,CAAC;YACF,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;QAE3B,MAAM,QAAQ,GAAiB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;YAC3D,MAAM,QAAQ,GAAoB,EAAE,CAAC;YACrC,MAAM,SAAS,GAAa,EAAE,CAAC;YAC/B,IAAI,aAAa,GAAG,KAAK,CAAC;YAE1B,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC;gBAC/C,KAAK,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;oBACnD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACpC,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,EAAE;4BAAE,SAAS;wBAC7C,QAAQ,CAAC,IAAI,CAAC;4BACZ,EAAE,EAAE,OAAO,CAAC,EAAE;4BACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;4BAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;4BACtB,2EAA2E;4BAC3E,MAAM,EAAE,eAAe,CACrB,WAAW,EACX,IAAI,CACF,WAAW,EACX,QAAQ,EACR,OAAO,EACP,QAAQ,EACR,0BAA0B,CAAC,QAAQ,CAAC,CACrC,CACF;yBACF,CAAC,CAAC;oBACL,CAAC;oBACD,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;wBACtC,SAAS,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,QAAQ,EAAE,CAAC,CAAC;oBAC5C,CAAC;gBACH,CAAC;gBAED,4EAA4E;gBAC5E,+DAA+D;gBAC/D,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;oBAC5E,MAAM,YAAY,GAAG,IAAI,CACvB,WAAW,EACX,QAAQ,EACR,OAAO,EACP,QAAQ,EACR,OAAO,CAAC,iBAAiB,CAC1B,CAAC;oBACF,IAAI,CAAC,MAAM,EAAE,CAAC,YAAY,CAAC,CAAC;oBAC5B,IAAI,UAAU,CAAC,YAAY,CAAC;wBAAE,aAAa,GAAG,IAAI,CAAC;gBACrD,CAAC;YACH,CAAC;YAED,MAAM,GAAG,GAAe;gBACtB,MAAM,EAAE,MAAM,CAAC,EAAE;gBACjB,OAAO,EAAE,OAAO,CAAC,EAAE;gBACnB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,QAAQ;gBACR,SAAS;aACV,CAAC;YAEF,6EAA6E;YAC7E,6DAA6D;YAC7D,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBAC5E,GAAG,CAAC,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC;gBACjD,GAAG,CAAC,aAAa,GAAG,aAAa,CAAC;YACpC,CAAC;YAED,OAAO,GAAG,CAAC;QACb,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,gBAAgB,EAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;YAChD,QAAQ;YACR,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtC,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;aAC9C,CAAC,CAAC;SACJ,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE;QAC9B,SAAS,EAAE,QAAQ;QACnB,QAAQ;QACR,KAAK;QACL,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAwB;IAC7D,MAAM,GAAG,GAAa,EAAE,CAAC;IAEzB,GAAG,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,CAAC,CAAC;IAC7C,GAAG,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;IAEhD,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC,iEAAiE,EAAE,EAAE,CAAC,CAAC;QAChF,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,YAAY,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,EAAE,EAAE,CAAC,CAAC;QACvF,IAAI,IAAI,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;YACnC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,gBAAgB,IAAI,EAAE,EAAE,CAAC,CAAC;QACjD,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC;QACrC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChC,GAAG,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YAClD,GAAG,CAAC,IAAI,CAAC,eAAe,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YACxC,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC7B,GAAG,CAAC,IAAI,CAAC,0BAA0B,GAAG,CAAC,gBAAgB,IAAI,CAAC,CAAC;gBAC7D,GAAG,CAAC,IAAI,CACN,GAAG,CAAC,aAAa,KAAK,IAAI;oBACxB,CAAC,CAAC,uBAAuB;oBACzB,CAAC,CAAC,+DAA+D,CACpE,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,IAAI,CAAC,KAAK,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAClD,CAAC;YACD,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,GAAG,CAAC,IAAI,CAAC,+BAA+B,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACtE,CAAC;YACD,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;gBACxB,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;oBACnC,GAAG,CAAC,IAAI,CAAC,OAAO,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,MAAM,SAAS,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;gBACjG,CAAC;YACH,CAAC;YACD,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5D,GAAG,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;YACrD,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;QACtD,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,EAAE,MAAM,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACzB,GAAG,CAAC,IAAI,CACN,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QACzB,CAAC,CAAC,sBAAsB,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACrD,CAAC,CAAC,6DAA6D,CAClE,CAAC;IACF,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,IAAI,CAAC,sCAAsC,EAAE,EAAE,CAAC,CAAC;QACrD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACnC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,MAAM,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QAC5B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;QAChE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEhC,mFAAmF;IACnF,kFAAkF;IAClF,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/compliance/resolver.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Pack resolution — the only module that reads pack sources.
+ *
+ * Every other part of the feature (install, review, gate, check, report) goes
+ * through `listPacks` and `resolvePack` and never builds a path into a pack
+ * directory itself. That is what makes adding a licensed pack later a change to
+ * this file rather than a change to how everything loads, and it is asserted at
+ * source level rather than left as an intention.
+ *
+ * **Packs come only from the content package in this release.** A pack's control
+ * text becomes instructions an agent executes during review, so the pack source is
+ * a trust boundary of the same kind `security/action-trust.ts` was built for: in a
+ * cloned repository, a project-local file's contents are the repo author's. A
+ * `.aidlc/packs/` directory is therefore not enumerated and cannot be installed.
+ * Admitting a non-bundled source later needs a trust decision, not just a code
+ * path.
+ *
+ * **A pack id from the command line is matched, never joined.** `resolvePack`
+ * compares the requested id against the enumerated set before any path is built
+ * from it, so `aidlc compliance add ../../etc` takes the unknown-pack exit rather
+ * than reaching the filesystem.
+ *
+ * Requirements: compliance-packs/AC-8, AC-16, AC-47, AC-53, AC-64, AC-66, AC-67, AC-99
+ */
+import type { Pack, PackError, PackMeta, PackResult } from './types.js';
+/**
+ * Absolute path of the bundled packs directory.
+ *
+ * The single place a pack path originates. Exported for tests and for the
+ * publish-reachability assertion, not for callers wanting to read a pack.
+ */
+export declare function packsRoot(): string;
+/**
+ * Resolve one pack by id.
+ *
+ * The id is matched against the enumerated set **before** any path is built from
+ * it, so a traversal-shaped argument is an unknown pack rather than a filesystem
+ * read. Never returns null: an absent pack carries a reason.
+ */
+export declare function resolvePack(id: string): PackResult;
+/** Outcome of enumerating the available packs. */
+export interface PackListing {
+    /** Packs that resolved. */
+    packs: PackMeta[];
+    /**
+     * Packs that exist but did not resolve. Listed rather than hidden: a pack that
+     * is present and broken is a different situation from one that is absent, and
+     * silently dropping it is how a shipping defect stays invisible.
+     */
+    errors: PackError[];
+}
+/**
+ * Enumerate every available pack.
+ *
+ * Reads the content package only. Takes no project root, so there is no parameter
+ * through which a project-local pack could be offered.
+ */
+export declare function listPacks(): PackListing;
+/**
+ * Every pack id available, for exact-match validation of a command argument.
+ */
+export declare function availablePackIds(): string[];
+/** Resolve a pack and return only its controls, for the phases given. */
+export declare function controlsForPhase(pack: Pack, phase: string): import("./types.js").Control[];
+//# sourceMappingURL=resolver.d.ts.map

package/dist/compliance/resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../src/compliance/resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAQH,OAAO,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAUxE;;;;;GAKG;AACH,wBAAgB,SAAS,IAAI,MAAM,CAElC;AA4ED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,UAAU,CAmBlD;AAED,kDAAkD;AAClD,MAAM,WAAW,WAAW;IAC1B,2BAA2B;IAC3B,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB;;;;OAIG;IACH,MAAM,EAAE,SAAS,EAAE,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,IAAI,WAAW,CAcvC;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,EAAE,CAE3C;AAED,yEAAyE;AACzE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,kCAEzD"}

package/dist/compliance/resolver.js

@@ -0,0 +1,176 @@
+/**
+ * Pack resolution — the only module that reads pack sources.
+ *
+ * Every other part of the feature (install, review, gate, check, report) goes
+ * through `listPacks` and `resolvePack` and never builds a path into a pack
+ * directory itself. That is what makes adding a licensed pack later a change to
+ * this file rather than a change to how everything loads, and it is asserted at
+ * source level rather than left as an intention.
+ *
+ * **Packs come only from the content package in this release.** A pack's control
+ * text becomes instructions an agent executes during review, so the pack source is
+ * a trust boundary of the same kind `security/action-trust.ts` was built for: in a
+ * cloned repository, a project-local file's contents are the repo author's. A
+ * `.aidlc/packs/` directory is therefore not enumerated and cannot be installed.
+ * Admitting a non-bundled source later needs a trust decision, not just a code
+ * path.
+ *
+ * **A pack id from the command line is matched, never joined.** `resolvePack`
+ * compares the requested id against the enumerated set before any path is built
+ * from it, so `aidlc compliance add ../../etc` takes the unknown-pack exit rather
+ * than reaching the filesystem.
+ *
+ * Requirements: compliance-packs/AC-8, AC-16, AC-47, AC-53, AC-64, AC-66, AC-67, AC-99
+ */
+import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { getContentPackageRoot } from '../compile/content-root.js';
+import { isContainedRelative } from '../compile/layer-install.js';
+import { validatePack } from './schema.js';
+/** Pack slugs: lowercase alphanumeric with interior hyphens. */
+const SLUG_RE = /^[a-z][a-z0-9-]*$/;
+/** Filenames a pack must contain. */
+const PACK_FILE = 'pack.yaml';
+const CONTROLS_FILE = 'controls.yaml';
+const GUIDANCE_DIR = 'guidance';
+/**
+ * Absolute path of the bundled packs directory.
+ *
+ * The single place a pack path originates. Exported for tests and for the
+ * publish-reachability assertion, not for callers wanting to read a pack.
+ */
+export function packsRoot() {
+    return join(getContentPackageRoot(), 'packs');
+}
+/** Directory names under `packs/` that contain a `pack.yaml`. */
+function packDirs() {
+    const root = packsRoot();
+    if (!existsSync(root))
+        return [];
+    const out = [];
+    for (const name of readdirSync(root).sort()) {
+        // The directory name is the pack id, so it has to satisfy the id rule before
+        // it is joined — a stray file or an oddly named directory is not a pack.
+        if (!SLUG_RE.test(name))
+            continue;
+        const dir = join(root, name);
+        try {
+            if (statSync(dir).isDirectory() && existsSync(join(dir, PACK_FILE))) {
+                out.push(name);
+            }
+        }
+        catch {
+            // Unreadable entry — not a pack. Reported by `resolvePack` if asked for.
+        }
+    }
+    return out;
+}
+/** Read a pack's raw sources, or explain why it could not be read. */
+function readSources(id) {
+    const dir = join(packsRoot(), id);
+    const packYamlPath = join(dir, PACK_FILE);
+    const controlsPath = join(dir, CONTROLS_FILE);
+    let packYaml;
+    let controlsYaml;
+    try {
+        packYaml = readFileSync(packYamlPath, 'utf8');
+    }
+    catch {
+        return {
+            ok: false,
+            error: { code: 'unreadable', id, path: `packs/${id}/${PACK_FILE}`, errors: [`${PACK_FILE} is unreadable`] },
+        };
+    }
+    try {
+        controlsYaml = readFileSync(controlsPath, 'utf8');
+    }
+    catch {
+        return {
+            ok: false,
+            error: {
+                code: 'unreadable',
+                id,
+                path: `packs/${id}/${CONTROLS_FILE}`,
+                errors: [`${CONTROLS_FILE} is unreadable`],
+            },
+        };
+    }
+    // Layer bodies. The registration list lives inside `pack.yaml`, which is not
+    // parsed yet, so every readable file in the pack's guidance directory is
+    // offered and the validator decides which are registered. Containment is
+    // checked with the one exported helper rather than a second implementation.
+    const layerBodies = new Map();
+    const guidanceDir = join(dir, GUIDANCE_DIR);
+    if (existsSync(guidanceDir)) {
+        for (const name of readdirSync(guidanceDir).sort()) {
+            if (!isContainedRelative(guidanceDir, name))
+                continue;
+            const full = join(guidanceDir, name);
+            try {
+                if (statSync(full).isFile())
+                    layerBodies.set(name, readFileSync(full, 'utf8'));
+            }
+            catch {
+                // Unreadable layer file — surfaces as a missing-body validation error.
+            }
+        }
+    }
+    return { ok: true, sources: { id, packYaml, controlsYaml, layerBodies } };
+}
+/**
+ * Resolve one pack by id.
+ *
+ * The id is matched against the enumerated set **before** any path is built from
+ * it, so a traversal-shaped argument is an unknown pack rather than a filesystem
+ * read. Never returns null: an absent pack carries a reason.
+ */
+export function resolvePack(id) {
+    if (!SLUG_RE.test(id)) {
+        return { ok: false, error: { code: 'not-found', id, errors: [`'${id}' is not a pack id`] } };
+    }
+    if (!packDirs().includes(id)) {
+        return { ok: false, error: { code: 'not-found', id, errors: [`no pack named '${id}'`] } };
+    }
+    const read = readSources(id);
+    if (!read.ok)
+        return { ok: false, error: read.error };
+    const validation = validatePack(read.sources);
+    if (!validation.ok) {
+        return {
+            ok: false,
+            error: { code: 'invalid', id, path: `packs/${id}`, errors: validation.errors },
+        };
+    }
+    return { ok: true, pack: validation.pack };
+}
+/**
+ * Enumerate every available pack.
+ *
+ * Reads the content package only. Takes no project root, so there is no parameter
+ * through which a project-local pack could be offered.
+ */
+export function listPacks() {
+    const packs = [];
+    const errors = [];
+    for (const id of packDirs()) {
+        const result = resolvePack(id);
+        if (result.ok) {
+            packs.push(result.pack.meta);
+        }
+        else {
+            errors.push(result.error);
+        }
+    }
+    return { packs, errors };
+}
+/**
+ * Every pack id available, for exact-match validation of a command argument.
+ */
+export function availablePackIds() {
+    return packDirs();
+}
+/** Resolve a pack and return only its controls, for the phases given. */
+export function controlsForPhase(pack, phase) {
+    return pack.controls.filter((c) => c.phases.includes(phase));
+}
+//# sourceMappingURL=resolver.js.map

package/dist/compliance/resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../src/compliance/resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,YAAY,EAAoB,MAAM,aAAa,CAAC;AAG7D,gEAAgE;AAChE,MAAM,OAAO,GAAG,mBAAmB,CAAC;AAEpC,qCAAqC;AACrC,MAAM,SAAS,GAAG,WAAW,CAAC;AAC9B,MAAM,aAAa,GAAG,eAAe,CAAC;AACtC,MAAM,YAAY,GAAG,UAAU,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,UAAU,SAAS;IACvB,OAAO,IAAI,CAAC,qBAAqB,EAAE,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC;AAED,iEAAiE;AACjE,SAAS,QAAQ;IACf,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAEjC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5C,6EAA6E;QAC7E,yEAAyE;QACzE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;gBACpE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;QAC3E,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sEAAsE;AACtE,SAAS,WAAW,CAAC,EAAU;IAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;IAElC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC1C,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAE9C,IAAI,QAAgB,CAAC;IACrB,IAAI,YAAoB,CAAC;IACzB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,SAAS,gBAAgB,CAAC,EAAE;SAC5G,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,YAAY,GAAG,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,YAAY;gBAClB,EAAE;gBACF,IAAI,EAAE,SAAS,EAAE,IAAI,aAAa,EAAE;gBACpC,MAAM,EAAE,CAAC,GAAG,aAAa,gBAAgB,CAAC;aAC3C;SACF,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,yEAAyE;IACzE,yEAAyE;IACzE,4EAA4E;IAC5E,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC5C,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACnD,IAAI,CAAC,mBAAmB,CAAC,WAAW,EAAE,IAAI,CAAC;gBAAE,SAAS;YACtD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACrC,IAAI,CAAC;gBACH,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE;oBAAE,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YACjF,CAAC;YAAC,MAAM,CAAC;gBACP,uEAAuE;YACzE,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,EAAE,CAAC;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,EAAU;IACpC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,oBAAoB,CAAC,EAAE,EAAE,CAAC;IAC/F,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,kBAAkB,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5F,CAAC;IAED,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7B,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IAEtD,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE;SAC/E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC;AAcD;;;;;GAKG;AACH,MAAM,UAAU,SAAS;IACvB,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAgB,EAAE,CAAC;IAE/B,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,QAAQ,EAAE,CAAC;AACpB,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,gBAAgB,CAAC,IAAU,EAAE,KAAa;IACxD,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAC,CAAC,MAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7E,CAAC"}