@sensigo/realm-cli 0.12.1 → 0.14.0

package/dist/commands/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/commands/validate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,eAAO,MAAM,eAAe,SA+BxB,CAAC"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/commands/validate.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAuBpC,eAAO,MAAM,eAAe,SAiExB,CAAC"}

package/dist/commands/validate.js

@@ -1,12 +1,35 @@
 // realm validate <path> — validates a workflow YAML file without registering it.
+//
+// Strictness asymmetry (documented): extension-free workflows validate through the EXACT
+// from-string path used before project extensions existed (byte-identical behavior).
+// Workflows declaring `extensions:` (or validated with --extensions-module) go through
+// file-based loading so extension modules can be resolved, then a SECOND pass validates
+// step `config` against each resolved adapter's `config_schema` (two-pass).
 import { Command } from 'commander';
 import { join } from 'node:path';
 import { readFileSync } from 'node:fs';
-import { loadWorkflowFromString, WorkflowError } from '@sensigo/realm';
+import { load } from 'js-yaml';
+import { loadWorkflowFromString, loadWorkflowFromFile, WorkflowError } from '@sensigo/realm';
+import { loadProjectExtensions } from '../extensions/load-project-extensions.js';
+/** Pre-scan: does the YAML carry a top-level `extensions` key? (Parse errors → false; the
+ *  real loader below reports them with its existing error surface.) */
+function hasTopLevelExtensions(content) {
+    try {
+        const raw = load(content);
+        return (typeof raw === 'object' &&
+            raw !== null &&
+            !Array.isArray(raw) &&
+            'extensions' in raw);
+    }
+    catch {
+        return false;
+    }
+}
 export const validateCommand = new Command('validate')
     .argument('<path>', 'Path to workflow directory or workflow.yaml file')
+    .option('--extensions-module <path>', "Extensions module that REPLACES the workflow's declared 'extensions' modules (repair/override)")
     .description('Validate a workflow YAML file')
-    .action((inputPath) => {
+    .action(async (inputPath, opts) => {
     const filePath = inputPath.endsWith('.yaml') || inputPath.endsWith('.yml')
         ? inputPath
         : join(inputPath, 'workflow.yaml');
@@ -20,16 +43,43 @@ export const validateCommand = new Command('validate')
         process.exit(1);
         return;
     }
+    if (!hasTopLevelExtensions(content) && opts.extensionsModule === undefined) {
+        // Extension-free: the exact current from-string path — byte-identical behavior.
+        try {
+            const definition = loadWorkflowFromString(content);
+            console.log(`Valid: ${definition.id} v${definition.version} (${Object.keys(definition.steps).length} steps)`);
+        }
+        catch (err) {
+            if (err instanceof WorkflowError) {
+                console.error(`Invalid: ${err.message}`);
+                process.exit(1);
+            }
+            throw err;
+        }
+        return;
+    }
+    // Extensions declared (or an override supplied): file-based two-pass validation.
     try {
-        const definition = loadWorkflowFromString(content);
+        // Pass 1: structural validation + extension resolution metadata (source_dir/trust_root).
+        const definition = loadWorkflowFromFile(filePath);
+        const { registry, manifest, sentinelWarnings } = await loadProjectExtensions(definition, {
+            ...(opts.extensionsModule !== undefined ? { overrideModule: opts.extensionsModule } : {}),
+            secretMode: 'sentinel',
+        });
+        for (const warning of sentinelWarnings ?? [])
+            console.warn(`⚠  ${warning}`);
+        // Pass 2: step config validated against each resolved adapter's config_schema.
+        loadWorkflowFromFile(filePath, registry);
         console.log(`Valid: ${definition.id} v${definition.version} (${Object.keys(definition.steps).length} steps)`);
+        if (manifest.modules.length > 0) {
+            console.log(`Extensions: ${manifest.modules.map((m) => m.declared).join(', ')} ` +
+                `(adapters: ${manifest.adapters.length}, handlers: ${manifest.handlers.length}, ` +
+                `processors: ${manifest.processors.length})`);
+        }
     }
     catch (err) {
-        if (err instanceof WorkflowError) {
-            console.error(`Invalid: ${err.message}`);
-            process.exit(1);
-        }
-        throw err;
+        console.error(`Invalid: ${err instanceof Error ? err.message : String(err)}`);
+        process.exit(1);
     }
 });
 //# sourceMappingURL=validate.js.map

package/dist/commands/validate.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/commands/validate.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEvE,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC;KACnD,QAAQ,CAAC,QAAQ,EAAE,kDAAkD,CAAC;KACtE,WAAW,CAAC,+BAA+B,CAAC;KAC5C,MAAM,CAAC,CAAC,SAAiB,EAAE,EAAE;IAC5B,MAAM,QAAQ,GACZ,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;QACvD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IAEvC,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CACT,UAAU,UAAU,CAAC,EAAE,KAAK,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,SAAS,CACjG,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,OAAO,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC,CAAC,CAAC"}
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/commands/validate.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,EAAE;AACF,yFAAyF;AACzF,qFAAqF;AACrF,uFAAuF;AACvF,wFAAwF;AACxF,4EAA4E;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAC/B,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AAEjF;uEACuE;AACvE,SAAS,qBAAqB,CAAC,OAAe;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1B,OAAO,CACL,OAAO,GAAG,KAAK,QAAQ;YACvB,GAAG,KAAK,IAAI;YACZ,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YACnB,YAAY,IAAK,GAA+B,CACjD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC;KACnD,QAAQ,CAAC,QAAQ,EAAE,kDAAkD,CAAC;KACtE,MAAM,CACL,4BAA4B,EAC5B,gGAAgG,CACjG;KACA,WAAW,CAAC,+BAA+B,CAAC;KAC5C,MAAM,CAAC,KAAK,EAAE,SAAiB,EAAE,IAAmC,EAAE,EAAE;IACvE,MAAM,QAAQ,GACZ,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;QACvD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IAEvC,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IAED,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC3E,gFAAgF;QAChF,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;YACnD,OAAO,CAAC,GAAG,CACT,UAAU,UAAU,CAAC,EAAE,KAAK,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,SAAS,CACjG,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;gBACjC,OAAO,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO;IACT,CAAC;IAED,iFAAiF;IACjF,IAAI,CAAC;QACH,yFAAyF;QACzF,MAAM,UAAU,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,MAAM,qBAAqB,CAAC,UAAU,EAAE;YACvF,GAAG,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzF,UAAU,EAAE,UAAU;SACvB,CAAC,CAAC;QACH,KAAK,MAAM,OAAO,IAAI,gBAAgB,IAAI,EAAE;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC;QAC5E,+EAA+E;QAC/E,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CACT,UAAU,UAAU,CAAC,EAAE,KAAK,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,SAAS,CACjG,CAAC;QACF,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,GAAG,CACT,eAAe,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBAClE,cAAc,QAAQ,CAAC,QAAQ,CAAC,MAAM,eAAe,QAAQ,CAAC,QAAQ,CAAC,MAAM,IAAI;gBACjF,eAAe,QAAQ,CAAC,UAAU,CAAC,MAAM,GAAG,CAC/C,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,YAAY,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/commands/watch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"watch.d.ts","sourceRoot":"","sources":["../../src/commands/watch.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AA0BxD;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,iBAAiB,EACxB,MAAM,CAAC,EAAE,WAAW,EACpB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CA4Df;AAED,eAAO,MAAM,YAAY,SAoBrB,CAAC"}
+{"version":3,"file":"watch.d.ts","sourceRoot":"","sources":["../../src/commands/watch.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AA+BxD;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,iBAAiB,EACxB,MAAM,CAAC,EAAE,WAAW,EACpB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CA4Df;AAED,eAAO,MAAM,YAAY,SAoBrB,CAAC"}

package/dist/commands/watch.js

@@ -3,16 +3,21 @@ import { watch, existsSync } from 'node:fs';
 import { join, dirname, resolve } from 'node:path';
 import { Command } from 'commander';
 import { loadWorkflowFromFile, WorkflowError } from '@sensigo/realm';
+import { loadWorkflowForRegistration } from './register.js';
 /**
  * Attempts to load and register a workflow YAML file.
  * Logs the result (success or validation error) to stdout/stderr.
+ * Like `realm workflow register`, each (re-)registration mints the trust decision: when the
+ * workflow declares `extensions:`, the modules load + duck-validate and step config gets the
+ * config_schema two-pass BEFORE persisting. NOTE: long-lived watch processes keep the FIRST
+ * imported content of each module path (ESM cache) — restart watch to pick up module changes.
  * @param filePath Path to the workflow YAML file.
  * @param store    The registrar to register into.
  */
 async function registerFile(filePath, store) {
     const timestamp = new Date().toISOString();
     try {
-        const definition = loadWorkflowFromFile(filePath);
+        const definition = await loadWorkflowForRegistration(filePath);
         await store.register(definition);
         console.log(`[${timestamp}] Registered: ${definition.id} v${definition.version} (${Object.keys(definition.steps).length} steps)`);
     }

package/dist/commands/watch.js.map

@@ -1 +1 @@
-{"version":3,"file":"watch.js","sourceRoot":"","sources":["../../src/commands/watch.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAGrE;;;;;GAKG;AACH,KAAK,UAAU,YAAY,CAAC,QAAgB,EAAE,KAAwB;IACpE,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACjC,OAAO,CAAC,GAAG,CACT,IAAI,SAAS,iBAAiB,UAAU,CAAC,EAAE,KAAK,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,SAAS,CACrH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,OAAO,CAAC,KAAK,CAAC,IAAI,SAAS,cAAc,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1D,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,CAAC,KAAK,CAAC,IAAI,SAAS,YAAY,OAAO,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAAgB,EAChB,KAAwB,EACxB,MAAoB,EACpB,WAAoB;IAEpB,MAAM,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAEpC,gFAAgF;IAChF,IAAI,mBAAmB,GAAG,WAAW,CAAC;IACtC,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YAClD,mBAAmB;gBACjB,UAAU,CAAC,YAAY,KAAK,SAAS;oBACnC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,YAAY,CAAC;oBAC/C,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;YACnE,mBAAmB,GAAG,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtD,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAE/D,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,SAAiB,EAAE,EAAE;YACzC,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC3B,KAAK,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YACrC,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;YACjC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,kDAAkD;IAClD,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACrC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,eAAe,GAAG,mBAAmB,CAAC;IAC5C,MAAM,aAAa,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1D,MAAM,OAAO,GAAG,KAAK,CAAC,eAAe,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAEtE,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;YACxB,KAAK,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;YACjC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;KAC7C,QAAQ,CAAC,QAAQ,EAAE,kDAAkD,CAAC;KACtE,WAAW,CAAC,+DAA+D,CAAC;KAC5E,MAAM,CAAC,KAAK,EAAE,SAAiB,EAAE,EAAE;IAClC,MAAM,QAAQ,GACZ,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;QACvD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IAEvC,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,IAAI,iBAAiB,EAAE,CAAC;IAEtC,OAAO,CAAC,GAAG,CAAC,YAAY,QAAQ,yBAAyB,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC"}
+{"version":3,"file":"watch.js","sourceRoot":"","sources":["../../src/commands/watch.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAErE,OAAO,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAC;AAE5D;;;;;;;;;GASG;AACH,KAAK,UAAU,YAAY,CAAC,QAAgB,EAAE,KAAwB;IACpE,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,2BAA2B,CAAC,QAAQ,CAAC,CAAC;QAC/D,MAAM,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACjC,OAAO,CAAC,GAAG,CACT,IAAI,SAAS,iBAAiB,UAAU,CAAC,EAAE,KAAK,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,SAAS,CACrH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,OAAO,CAAC,KAAK,CAAC,IAAI,SAAS,cAAc,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1D,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,CAAC,KAAK,CAAC,IAAI,SAAS,YAAY,OAAO,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAAgB,EAChB,KAAwB,EACxB,MAAoB,EACpB,WAAoB;IAEpB,MAAM,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAEpC,gFAAgF;IAChF,IAAI,mBAAmB,GAAG,WAAW,CAAC;IACtC,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YAClD,mBAAmB;gBACjB,UAAU,CAAC,YAAY,KAAK,SAAS;oBACnC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,YAAY,CAAC;oBAC/C,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;YACnE,mBAAmB,GAAG,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtD,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAE/D,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,SAAiB,EAAE,EAAE;YACzC,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC3B,KAAK,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YACrC,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;YACjC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,kDAAkD;IAClD,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACrC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,eAAe,GAAG,mBAAmB,CAAC;IAC5C,MAAM,aAAa,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1D,MAAM,OAAO,GAAG,KAAK,CAAC,eAAe,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAEtE,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;YACxB,KAAK,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;YACjC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;KAC7C,QAAQ,CAAC,QAAQ,EAAE,kDAAkD,CAAC;KACtE,WAAW,CAAC,+DAA+D,CAAC;KAC5E,MAAM,CAAC,KAAK,EAAE,SAAiB,EAAE,EAAE;IAClC,MAAM,QAAQ,GACZ,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;QACvD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IAEvC,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,IAAI,iBAAiB,EAAE,CAAC;IAEtC,OAAO,CAAC,GAAG,CAAC,YAAY,QAAQ,yBAAyB,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/extensions/extension-identity.d.ts

@@ -0,0 +1,82 @@
+import type { ExtensionIdentityEntry, ExtensionIdentityModule, ExtensionIdentitySignals } from '@sensigo/realm';
+import { extensionIdentityDiffers } from '@sensigo/realm';
+/** The one sweep-rule version this module can compute. Comparison ALWAYS recomputes under
+ *  the RECORDED rule string — a future rules change must add a new version, never mutate v1. */
+export declare const DIR_TREE_V1_RULES = "dir_tree_v1: include .js,.mjs,.cjs,.ts,.mts,.cts,.json; exclude dirs node_modules,.git; skip symlinks; sort by relpath; sha256(relpath\\0filehash); caps 2000 files/50MB";
+/** Compares two identity entries — tree_hash + per-module entry hashes + override flag. */
+export { extensionIdentityDiffers as identityDiffers };
+export interface ComputeIdentityInput {
+    declared: string;
+    resolved: string;
+    format: ExtensionIdentityModule['format'];
+}
+export interface ComputeIdentityOptions {
+    /** Trust root for the advisory signals (package.json version, .git HEAD). */
+    trustRoot?: string;
+    /** Set when --extensions-module replaced the declared modules. */
+    overrideActive?: boolean;
+    /** Injected for tests; defaults to `new Date().toISOString()`. */
+    capturedAt?: string;
+    /** Injected for tests; defaults to `process.pid`. */
+    pid?: number;
+    /** Deployment-manifest identity (path + raw-bytes sha256) — recorded AND compared. */
+    manifest?: {
+        path: string;
+        content_hash: string;
+    };
+    /** Secret NAMES referenced by the manifest — recorded, never compared, never values. */
+    secretNames?: string[];
+}
+/** sha256 hex of raw bytes/text — exported for the loader's manifest content hash. */
+export declare function sha256HexOf(data: Buffer | string): string;
+/**
+ * Computes the dir_tree_v1 identity of a set of loaded extension modules: per-module
+ * sha256 entry hashes plus a deterministic directory-tree fingerprint over the deduped
+ * parent directories of the resolved entries. Pure fs + crypto — never loads code.
+ */
+export declare function computeExtensionIdentity(modules: ComputeIdentityInput[], opts?: ComputeIdentityOptions): ExtensionIdentityEntry;
+/**
+ * Builds an identity entry that records a capture/load FAILURE — the failure is itself
+ * evidence (WorkflowContextSnapshot.error precedent). Modules/tree are empty placeholders.
+ */
+export declare function errorExtensionIdentityEntry(message: string, opts?: Pick<ComputeIdentityOptions, 'capturedAt' | 'pid' | 'overrideActive'>): ExtensionIdentityEntry;
+/** Per-component result of a --check-drift recomputation against current disk state. */
+export interface RecomputeResult {
+    comparable: true;
+    /** Per recorded module: current entry hash (undefined = file unreadable/missing). */
+    modules: Array<{
+        resolved: string;
+        recorded_hash: string;
+        current_hash?: string;
+    }>;
+    tree: {
+        recorded_hash: string;
+        current_hash: string;
+        current_truncated: boolean;
+    };
+    /**
+     * Deployment-manifest bytes-hash recompute (pure fs read of entry.manifest.path — no
+     * YAML parsing, no secret resolution). Absent when the entry recorded no manifest
+     * (older entries); current_hash undefined = manifest file missing/unreadable.
+     */
+    manifest?: {
+        path: string;
+        recorded_hash: string;
+        current_hash?: string;
+    };
+    signals?: ExtensionIdentitySignals;
+}
+export interface RecomputeNotComparable {
+    comparable: false;
+    reason: string;
+}
+/**
+ * Recomputes an entry's identity from CURRENT disk state STRICTLY under the entry's
+ * RECORDED rules and roots — an unknown rules version yields an explicit cannot-compare
+ * rather than a guess (a rules change must never manufacture phantom drift).
+ * Pure fs + crypto — never loads code.
+ */
+export declare function recomputeIdentity(entry: ExtensionIdentityEntry, opts?: {
+    trustRoot?: string;
+}): RecomputeResult | RecomputeNotComparable;
+//# sourceMappingURL=extension-identity.d.ts.map

package/dist/extensions/extension-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension-identity.d.ts","sourceRoot":"","sources":["../../src/extensions/extension-identity.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EACV,sBAAsB,EACtB,uBAAuB,EACvB,wBAAwB,EACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE1D;gGACgG;AAChG,eAAO,MAAM,iBAAiB,6KAC8I,CAAC;AAO7K,2FAA2F;AAC3F,OAAO,EAAE,wBAAwB,IAAI,eAAe,EAAE,CAAC;AAEvD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,uBAAuB,CAAC,QAAQ,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,sBAAsB;IACrC,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,wFAAwF;IACxF,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,sFAAsF;AACtF,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAEzD;AAyHD;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,oBAAoB,EAAE,EAC/B,IAAI,GAAE,sBAA2B,GAChC,sBAAsB,CAyBxB;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,IAAI,CAAC,sBAAsB,EAAE,YAAY,GAAG,KAAK,GAAG,gBAAgB,CAAM,GAC/E,sBAAsB,CAiBxB;AAED,wFAAwF;AACxF,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,IAAI,CAAC;IACjB,qFAAqF;IACrF,OAAO,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnF,IAAI,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,OAAO,CAAA;KAAE,CAAC;IAClF;;;;OAIG;IACH,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1E,OAAO,CAAC,EAAE,wBAAwB,CAAC;CACpC;AAED,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,KAAK,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,sBAAsB,EAC7B,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAChC,eAAe,GAAG,sBAAsB,CAmD1C"}

package/dist/extensions/extension-identity.js

@@ -0,0 +1,242 @@
+// extension-identity.ts — PURE fingerprint + compare for extension-code drift evidence
+// (issue #119). This module is STRUCTURALLY incapable of loading code: no dynamic import,
+// no module-require creation, anywhere. It only reads bytes (fs), hashes them (crypto),
+// and manipulates paths — which is exactly why read-only commands (`realm run inspect
+// --check-drift`) may use it without ever gaining the capability to execute project code.
+// A structural test (read-only-no-extensions.test.ts) enforces this.
+import { createHash } from 'node:crypto';
+import { readFileSync, readdirSync } from 'node:fs';
+import { dirname, join, relative, sep } from 'node:path';
+import { extensionIdentityDiffers } from '@sensigo/realm';
+/** The one sweep-rule version this module can compute. Comparison ALWAYS recomputes under
+ *  the RECORDED rule string — a future rules change must add a new version, never mutate v1. */
+export const DIR_TREE_V1_RULES = 'dir_tree_v1: include .js,.mjs,.cjs,.ts,.mts,.cts,.json; exclude dirs node_modules,.git; skip symlinks; sort by relpath; sha256(relpath\\0filehash); caps 2000 files/50MB';
+const INCLUDED_EXTENSIONS = new Set(['.js', '.mjs', '.cjs', '.ts', '.mts', '.cts', '.json']);
+const EXCLUDED_DIR_NAMES = new Set(['node_modules', '.git']);
+const MAX_FILES = 2000;
+const MAX_TOTAL_BYTES = 50 * 1024 * 1024;
+/** Compares two identity entries — tree_hash + per-module entry hashes + override flag. */
+export { extensionIdentityDiffers as identityDiffers };
+/** sha256 hex of raw bytes/text — exported for the loader's manifest content hash. */
+export function sha256HexOf(data) {
+    return sha256Hex(data);
+}
+function sha256Hex(data) {
+    return createHash('sha256').update(data).digest('hex');
+}
+function fileExtension(path) {
+    const base = path.slice(path.lastIndexOf(sep) + 1);
+    const dot = base.lastIndexOf('.');
+    return dot === -1 ? '' : base.slice(dot);
+}
+/**
+ * Deterministically enumerates the relative paths of sweep-eligible files under `root`
+ * per dir_tree_v1: included extensions only, `node_modules`/`.git` directories excluded at
+ * any depth, symlinks (files and directories) skipped, sorted by relative path.
+ * Enumeration is cap-free — caps apply at the hashing stage so the truncated fingerprint
+ * covers a DETERMINISTIC prefix of the sorted listing.
+ */
+function enumerateTreeFiles(root) {
+    const relPaths = [];
+    const walk = (dir) => {
+        let entries;
+        try {
+            entries = readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return; // unreadable directory — skipped (deterministic for a given tree state)
+        }
+        for (const entry of entries) {
+            const full = join(dir, entry.name);
+            if (entry.isSymbolicLink())
+                continue; // dir_tree_v1: symlinks skipped
+            if (entry.isDirectory()) {
+                if (EXCLUDED_DIR_NAMES.has(entry.name))
+                    continue;
+                walk(full);
+            }
+            else if (entry.isFile()) {
+                if (INCLUDED_EXTENSIONS.has(fileExtension(entry.name))) {
+                    relPaths.push(relative(root, full));
+                }
+            }
+        }
+    };
+    walk(root);
+    return relPaths.sort();
+}
+/** Hashes the sorted file listing of `roots` under the dir_tree_v1 caps. */
+function sweepTree(roots) {
+    // Enumerate everything first (cheap), THEN hash under caps — the truncation point is a
+    // deterministic prefix of the sorted listing, so truncated hashes stay comparable.
+    const perRoot = roots.map((root) => enumerateTreeFiles(root).map((rel) => ({ root, rel })));
+    const allFiles = perRoot.flat();
+    const lines = [];
+    let totalBytes = 0;
+    let truncated = false;
+    for (const file of allFiles) {
+        if (lines.length >= MAX_FILES || totalBytes >= MAX_TOTAL_BYTES) {
+            truncated = true;
+            break;
+        }
+        let bytes;
+        try {
+            bytes = readFileSync(join(file.root, file.rel));
+        }
+        catch {
+            // File disappeared between enumeration and hashing — record it as unreadable
+            // (deterministic for a given tree state; a vanishing file IS a tree change).
+            lines.push(`${file.rel}\u0000<unreadable>`);
+            continue;
+        }
+        totalBytes += bytes.length;
+        lines.push(`${file.rel}\u0000${sha256Hex(bytes)}`);
+    }
+    return {
+        file_count: lines.length,
+        total_bytes: totalBytes,
+        tree_hash: sha256Hex(lines.join('\n')),
+        truncated,
+    };
+}
+/** Advisory signals — each independently fail-soft to undefined; never compared. */
+function collectSignals(trustRoot) {
+    if (trustRoot === undefined)
+        return undefined;
+    const signals = {};
+    try {
+        const pkg = JSON.parse(readFileSync(join(trustRoot, 'package.json'), 'utf8'));
+        if (typeof pkg.version === 'string')
+            signals.package_version = pkg.version;
+    }
+    catch {
+        // fail-soft
+    }
+    try {
+        // Read .git/HEAD; dereference ONE ref file. No child processes, ever.
+        const head = readFileSync(join(trustRoot, '.git', 'HEAD'), 'utf8').trim();
+        if (head.startsWith('ref: ')) {
+            const refPath = head.slice('ref: '.length).trim();
+            const refValue = readFileSync(join(trustRoot, '.git', refPath), 'utf8').trim();
+            if (refValue !== '')
+                signals.git_head = refValue;
+        }
+        else if (head !== '') {
+            signals.git_head = head; // detached HEAD — the hash itself
+        }
+    }
+    catch {
+        // fail-soft (packed refs, no .git, unreadable — all acceptable)
+    }
+    return signals.package_version === undefined && signals.git_head === undefined
+        ? undefined
+        : signals;
+}
+/**
+ * Computes the dir_tree_v1 identity of a set of loaded extension modules: per-module
+ * sha256 entry hashes plus a deterministic directory-tree fingerprint over the deduped
+ * parent directories of the resolved entries. Pure fs + crypto — never loads code.
+ */
+export function computeExtensionIdentity(modules, opts = {}) {
+    const moduleEntries = modules.map((m) => ({
+        declared: m.declared,
+        resolved: m.resolved,
+        entry_hash: sha256Hex(readFileSync(m.resolved)),
+        format: m.format,
+    }));
+    const roots = [...new Set(modules.map((m) => dirname(m.resolved)))].sort();
+    const tree = sweepTree(roots);
+    const signals = collectSignals(opts.trustRoot);
+    return {
+        captured_at: opts.capturedAt ?? new Date().toISOString(),
+        pid: opts.pid ?? process.pid,
+        modules: moduleEntries,
+        tree: { roots, rules: DIR_TREE_V1_RULES, ...tree },
+        ...(signals !== undefined ? { signals } : {}),
+        coverage: 'dir_tree_v1',
+        ...(opts.manifest !== undefined ? { manifest: opts.manifest } : {}),
+        ...(opts.secretNames !== undefined && opts.secretNames.length > 0
+            ? { secret_names: opts.secretNames }
+            : {}),
+        ...(opts.overrideActive === true ? { override_active: true } : {}),
+    };
+}
+/**
+ * Builds an identity entry that records a capture/load FAILURE — the failure is itself
+ * evidence (WorkflowContextSnapshot.error precedent). Modules/tree are empty placeholders.
+ */
+export function errorExtensionIdentityEntry(message, opts = {}) {
+    return {
+        captured_at: opts.capturedAt ?? new Date().toISOString(),
+        pid: opts.pid ?? process.pid,
+        modules: [],
+        tree: {
+            roots: [],
+            rules: DIR_TREE_V1_RULES,
+            file_count: 0,
+            total_bytes: 0,
+            tree_hash: '',
+            truncated: false,
+        },
+        coverage: 'dir_tree_v1',
+        ...(opts.overrideActive === true ? { override_active: true } : {}),
+        error: message,
+    };
+}
+/**
+ * Recomputes an entry's identity from CURRENT disk state STRICTLY under the entry's
+ * RECORDED rules and roots — an unknown rules version yields an explicit cannot-compare
+ * rather than a guess (a rules change must never manufacture phantom drift).
+ * Pure fs + crypto — never loads code.
+ */
+export function recomputeIdentity(entry, opts = {}) {
+    if (entry.tree.rules !== DIR_TREE_V1_RULES) {
+        return {
+            comparable: false,
+            reason: `cannot compare (unknown rules '${entry.tree.rules}')`,
+        };
+    }
+    const modules = entry.modules.map((m) => {
+        let currentHash;
+        try {
+            currentHash = sha256Hex(readFileSync(m.resolved));
+        }
+        catch {
+            currentHash = undefined;
+        }
+        return {
+            resolved: m.resolved,
+            recorded_hash: m.entry_hash,
+            ...(currentHash !== undefined ? { current_hash: currentHash } : {}),
+        };
+    });
+    const tree = sweepTree(entry.tree.roots);
+    let manifestResult;
+    if (entry.manifest !== undefined) {
+        let currentHash;
+        try {
+            currentHash = sha256Hex(readFileSync(entry.manifest.path));
+        }
+        catch {
+            currentHash = undefined; // missing/unreadable — reported as MISSING by inspect
+        }
+        manifestResult = {
+            path: entry.manifest.path,
+            recorded_hash: entry.manifest.content_hash,
+            ...(currentHash !== undefined ? { current_hash: currentHash } : {}),
+        };
+    }
+    const signals = collectSignals(opts.trustRoot);
+    return {
+        comparable: true,
+        modules,
+        tree: {
+            recorded_hash: entry.tree.tree_hash,
+            current_hash: tree.tree_hash,
+            current_truncated: tree.truncated,
+        },
+        ...(manifestResult !== undefined ? { manifest: manifestResult } : {}),
+        ...(signals !== undefined ? { signals } : {}),
+    };
+}
+//# sourceMappingURL=extension-identity.js.map

package/dist/extensions/extension-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension-identity.js","sourceRoot":"","sources":["../../src/extensions/extension-identity.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,0FAA0F;AAC1F,wFAAwF;AACxF,sFAAsF;AACtF,0FAA0F;AAC1F,qEAAqE;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAMzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE1D;gGACgG;AAChG,MAAM,CAAC,MAAM,iBAAiB,GAC5B,0KAA0K,CAAC;AAE7K,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAC7F,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;AAC7D,MAAM,SAAS,GAAG,IAAI,CAAC;AACvB,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEzC,2FAA2F;AAC3F,OAAO,EAAE,wBAAwB,IAAI,eAAe,EAAE,CAAC;AAuBvD,sFAAsF;AACtF,MAAM,UAAU,WAAW,CAAC,IAAqB;IAC/C,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,SAAS,CAAC,IAAqB;IACtC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;QACjC,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,wEAAwE;QAClF,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,KAAK,CAAC,cAAc,EAAE;gBAAE,SAAS,CAAC,gCAAgC;YACtE,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAE,SAAS;gBACjD,IAAI,CAAC,IAAI,CAAC,CAAC;YACb,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1B,IAAI,mBAAmB,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;oBACvD,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,CAAC;IACX,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AASD,4EAA4E;AAC5E,SAAS,SAAS,CAAC,KAAe;IAChC,uFAAuF;IACvF,mFAAmF;IACnF,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5F,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAEhC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS,IAAI,UAAU,IAAI,eAAe,EAAE,CAAC;YAC/D,SAAS,GAAG,IAAI,CAAC;YACjB,MAAM;QACR,CAAC;QACD,IAAI,KAAa,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,6EAA6E;YAC7E,6EAA6E;YAC7E,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,oBAAoB,CAAC,CAAC;YAC5C,SAAS;QACX,CAAC;QACD,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,SAAS,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,MAAM;QACxB,WAAW,EAAE,UAAU;QACvB,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,SAAS;KACV,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,SAAS,cAAc,CAAC,SAA6B;IACnD,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC9C,MAAM,OAAO,GAA6B,EAAE,CAAC;IAE7C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAE3E,CAAC;QACF,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,CAAC,eAAe,GAAG,GAAG,CAAC,OAAO,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IAED,IAAI,CAAC;QACH,sEAAsE;QACtE,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1E,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YAClD,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/E,IAAI,QAAQ,KAAK,EAAE;gBAAE,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACnD,CAAC;aAAM,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YACvB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,kCAAkC;QAC7D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;IAClE,CAAC;IAED,OAAO,OAAO,CAAC,eAAe,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;QAC5E,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,OAAO,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAA+B,EAC/B,OAA+B,EAAE;IAEjC,MAAM,aAAa,GAA8B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnE,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,UAAU,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,EAAE,CAAC,CAAC,MAAM;KACjB,CAAC,CAAC,CAAC;IAEJ,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3E,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAE9B,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/C,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACxD,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG;QAC5B,OAAO,EAAE,aAAa;QACtB,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,IAAI,EAAE;QAClD,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,QAAQ,EAAE,aAAa;QACvB,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;YAC/D,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,WAAW,EAAE;YACpC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5E,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAAe,EACf,OAA8E,EAAE;IAEhF,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACxD,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG;QAC5B,OAAO,EAAE,EAAE;QACX,IAAI,EAAE;YACJ,KAAK,EAAE,EAAE;YACT,KAAK,EAAE,iBAAiB;YACxB,UAAU,EAAE,CAAC;YACb,WAAW,EAAE,CAAC;YACd,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,KAAK;SACjB;QACD,QAAQ,EAAE,aAAa;QACvB,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,KAAK,EAAE,OAAO;KACf,CAAC;AACJ,CAAC;AAsBD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAA6B,EAC7B,OAA+B,EAAE;IAEjC,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,iBAAiB,EAAE,CAAC;QAC3C,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,MAAM,EAAE,kCAAkC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI;SAC/D,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACtC,IAAI,WAA+B,CAAC;QACpC,IAAI,CAAC;YACH,WAAW,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,GAAG,SAAS,CAAC;QAC1B,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,aAAa,EAAE,CAAC,CAAC,UAAU;YAC3B,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAEzC,IAAI,cAA2C,CAAC;IAChD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,WAA+B,CAAC;QACpC,IAAI,CAAC;YACH,WAAW,GAAG,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,GAAG,SAAS,CAAC,CAAC,sDAAsD;QACjF,CAAC;QACD,cAAc,GAAG;YACf,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;YACzB,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY;YAC1C,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/C,OAAO;QACL,UAAU,EAAE,IAAI;QAChB,OAAO;QACP,IAAI,EAAE;YACJ,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS;YACnC,YAAY,EAAE,IAAI,CAAC,SAAS;YAC5B,iBAAiB,EAAE,IAAI,CAAC,SAAS;SAClC;QACD,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC"}

package/dist/extensions/load-project-extensions.d.ts

@@ -0,0 +1,59 @@
+import { ExtensionRegistry } from '@sensigo/realm';
+import type { ExtensionManifest, SlackGateNotifierConfig, WorkflowDefinition } from '@sensigo/realm';
+import { type SecretMode } from './manifest-secrets.js';
+export interface LoadProjectExtensionsOptions {
+    /**
+     * Operator-typed module path that REPLACES the workflow's declared extension CODE
+     * modules (repair/override tool). Containment does not apply to an operator-typed path.
+     * The deployment manifest (config) still loads — `--project` is the manifest override.
+     */
+    overrideModule?: string;
+    /**
+     * The daemon's deployment root (`--project <dir>`), used for definitions WITHOUT
+     * trust_root. Absent → no manifest for such definitions (defaults only).
+     */
+    projectDir?: string;
+    /**
+     * 'real' (default): secrets resolve from the declared sources — any miss is a loud
+     * aggregated error, construction failures are errors (fail-before-create).
+     * 'sentinel' (validate/test; register/watch degrade-with-WARN): `${secret:}` refs
+     * resolve to `<sentinel:NAME>` labels and construction failures downgrade to warnings.
+     */
+    secretMode?: SecretMode;
+}
+export interface LoadedProjectExtensions {
+    registry: ExtensionRegistry;
+    manifest: ExtensionManifest;
+    /** Secret-resolved notifier configs from the deployment manifest, when declared. */
+    notifiers?: {
+        slack_gate?: SlackGateNotifierConfig['config'];
+    };
+    /** Sentinel-mode construction warnings (entries skipped, listed — never silent). */
+    sentinelWarnings?: string[];
+    /**
+     * REAL resolved manifest-secret VALUES (values only, frozen, never names→values;
+     * sentinel-mode values excluded; values < 4 chars excluded). Consumed by the agent
+     * redaction pass — must never ride any persisted or serialized structure.
+     */
+    secretValues?: readonly string[];
+}
+/** @internal Test-only: clears the process-lifetime registry cache. */
+export declare function clearProjectExtensionsCache(): void;
+/**
+ * Loads the project extensions and deployment configuration for a definition:
+ * workflow-declared CODE modules + the deployment manifest's constructed instances,
+ * one registry, one namespace, one collision map. No extensions, no manifest → the
+ * process-stable filesystem-only default registry.
+ *
+ * CONTRACT: returned registries are shared process-lifetime cache entries. The only
+ * permitted mutation is `getOrCreateRateLimiter` (serve bucket persistence, by design).
+ */
+export declare function loadProjectExtensions(definition: WorkflowDefinition, opts?: LoadProjectExtensionsOptions): Promise<LoadedProjectExtensions>;
+/**
+ * Builds a `registryProvider` for the MCP server (serve / mcp stdio): resolves each
+ * definition through the process-lifetime project loader. `--extensions-module` overrides
+ * CODE modules; `projectDir` anchors the manifest for definitions without trust_root
+ * (`realm mcp` passes it ONLY when --project was given — no cwd default there).
+ */
+export declare function makeRegistryProvider(overrideModule?: string, projectDir?: string): (definition: WorkflowDefinition) => Promise<ExtensionRegistry>;
+//# sourceMappingURL=load-project-extensions.d.ts.map

package/dist/extensions/load-project-extensions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-project-extensions.d.ts","sourceRoot":"","sources":["../../src/extensions/load-project-extensions.ts"],"names":[],"mappings":"AAwBA,OAAO,EAEL,iBAAiB,EAgBlB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAGV,iBAAiB,EAGjB,uBAAuB,EACvB,kBAAkB,EACnB,MAAM,gBAAgB,CAAC;AAMxB,OAAO,EAA8C,KAAK,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEpG,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,oFAAoF;IACpF,SAAS,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,uBAAuB,CAAC,QAAQ,CAAC,CAAA;KAAE,CAAC;IAC/D,oFAAoF;IACpF,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;;;;OAIG;IACH,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAmDD,uEAAuE;AACvE,wBAAgB,2BAA2B,IAAI,IAAI,CAElD;AAiGD;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,kBAAkB,EAC9B,IAAI,CAAC,EAAE,4BAA4B,GAClC,OAAO,CAAC,uBAAuB,CAAC,CA6IlC;AAqiBD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,cAAc,CAAC,EAAE,MAAM,EACvB,UAAU,CAAC,EAAE,MAAM,GAClB,CAAC,UAAU,EAAE,kBAAkB,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAQhE"}