@stalfh233/omc-cli 0.0.0-stage → 0.4.10

package/dist/code-rules.js

@@ -0,0 +1,69 @@
+/**
+ * CFG-naming rules (borrowed from cpdocs base3.0 `cp-bizmodel/model-code.js`
+ * and `cp-bizproperty/field-code.js`): model codes are at most 26 chars, field
+ * codes at most 28, both must be a single lowerCamel or lower_snake token, and
+ * platform system/reserved codes are refused. These are local dry-lint checks —
+ * a violation would otherwise only surface on the environment (or worse,
+ * silently poison the model, as the pre-fix tools did).
+ */
+export const MODEL_CODE_MAX_LENGTH = 26;
+export const FIELD_CODE_MAX_LENGTH = 28;
+const CODE_PATTERNS = {
+    lowerCamel: /^[a-z][A-Za-z0-9]*$/u,
+    lower_snake: /^[a-z][a-z0-9]*(?:_[a-z0-9]+)*$/u,
+};
+/**
+ * 8.6.26 system / audit column codes a business-authored model or field must
+ * never claim (they are minted by the platform; reusing one collides with the
+ * engine's own columns). Mirrors base3.0's reserved sets.
+ */
+export const RESERVED_CODES = new Set([
+    "id",
+    "name",
+    "creater",
+    "createdDeptId",
+    "owner",
+    "ownerDeptId",
+    "createdTime",
+    "modifier",
+    "modifiedTime",
+    "workflowInstanceId",
+    "sequenceNo",
+    "sequenceStatus",
+    "ownerDeptQueryCode",
+    "version",
+].map((code) => code.toLowerCase()));
+/** Infer the style a code is written in (underscores → snake, else camel). */
+export function inferCodeStyle(code) {
+    if (code.includes("_"))
+        return CODE_PATTERNS.lower_snake.test(code) ? "lower_snake" : null;
+    return CODE_PATTERNS.lowerCamel.test(code) ? "lowerCamel" : null;
+}
+/** Returns the (normalized) violations; an empty array means the code is valid. */
+export function validateBusinessCode(rawCode, options) {
+    const maxLength = options.kind === "model" ? MODEL_CODE_MAX_LENGTH : FIELD_CODE_MAX_LENGTH;
+    const code = typeof rawCode === "string" ? rawCode.trim() : "";
+    const violations = [];
+    if (!code) {
+        violations.push({ code, classification: "code_empty", message: "code 不能为空" });
+        return violations;
+    }
+    if (code.length > maxLength)
+        violations.push({ code, classification: "code_too_long", message: `code "${code}" 长 ${code.length} 字符，超过 ${options.kind === "model" ? "模型" : "字段"}上限 ${maxLength}（平台约束）` });
+    const detected = inferCodeStyle(code);
+    if (options.style) {
+        if (!CODE_PATTERNS[options.style].test(code))
+            violations.push({ code, classification: "code_style", message: `code "${code}" 不符合 ${options.style}（期望 ${options.style === "lowerCamel" ? "小驼峰 aBc" : "小写下划线 a_bc"}）` });
+    }
+    else if (!detected) {
+        violations.push({ code, classification: "code_style", message: `code "${code}" 既不是 lowerCamel 也不是 lower_snake（须以字母开头，仅含字母/数字/下划线，且不得连续或结尾下划线）` });
+    }
+    if (RESERVED_CODES.has(code.toLowerCase()))
+        violations.push({ code, classification: "code_reserved", message: `code "${code}" 是平台系统/保留字段编码，业务模型与字段不得使用（会与平台自身列冲突）` });
+    return violations;
+}
+/** Convenience for the dry-lint call sites: true when validateBusinessCode has no violations. */
+export function businessCodeValid(rawCode, options) {
+    return validateBusinessCode(rawCode, options).length === 0;
+}
+//# sourceMappingURL=code-rules.js.map

package/dist/command-transport.js

@@ -0,0 +1,155 @@
+import { homedir, tmpdir } from "node:os";
+import { realpathSync } from "node:fs";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { CLI_DEFAULT_OUTPUT_BYTES, CLI_MAX_OUTPUT_BYTES, createArtifact, isWithinRoot, readArtifact } from "./artifacts.js";
+import { CLI_EXIT_CODES, classifyResult, envelope, errorEnvelope } from "./cli-contract.js";
+import { writeEnvelope, outputOptions } from "./cli-output.js";
+const UNCERTAIN_NEXT_ACTION = "read back the requestId before retrying; retry only after the outcome is established";
+/**
+ * Run a CLI action inside the transport band: validate the budget up front (a
+ * bad `--max-output-bytes` becomes the shared invalid-input envelope, exactly
+ * once), then hand the handler its transport.
+ */
+export async function withTransport(options, request, run) {
+    let budget;
+    try {
+        budget = options.maxOutputBytes === undefined ? CLI_DEFAULT_OUTPUT_BYTES : checkedOutputBudget(Number(options.maxOutputBytes));
+    }
+    catch (error) {
+        const parsed = errorEnvelope(error, "invalid-input", CLI_EXIT_CODES.invalidInput, request);
+        writeEnvelope(parsed.envelope);
+        return parsed.exitCode;
+    }
+    return await run({ request, maxOutputBytes: budget });
+}
+/**
+ * Write the single result envelope and return the exit code. An `uncertain`
+ * result always carries a recovery `nextAction` (the documented contract); a
+ * result that already states a structured one keeps it.
+ */
+export function emitTransportResult(result, transport) {
+    const classified = classifyResult(result);
+    const withRecovery = classified.status === "uncertain" && result.nextAction === undefined ? { ...result, nextAction: UNCERTAIN_NEXT_ACTION } : result;
+    writeEnvelope(envelope(classified.status, boundResult(withRecovery, transport.maxOutputBytes), transport.request, classified.error));
+    return classified.exitCode;
+}
+/** Write an invalid-input envelope (exit 10) — the shape every pre-wire refusal uses. */
+export const emitResult = emitTransportResult;
+export function emitInvalid(transport, options) {
+    const result = options.blocker === undefined ? {} : { status: "error", blocker: options.blocker };
+    const error = { code: options.code ?? "invalid-input", message: options.message, retryable: false };
+    writeEnvelope(envelope("error", result, transport.request, error));
+    return CLI_EXIT_CODES.invalidInput;
+}
+/** Map a thrown error to the shared invalid-input envelope. */
+export function emitThrown(error, transport) {
+    const parsed = errorEnvelope(error, "invalid-input", CLI_EXIT_CODES.invalidInput, transport.request);
+    writeEnvelope(parsed.envelope);
+    return parsed.exitCode;
+}
+export function outputBudget(args) {
+    const index = args.indexOf("--max-output-bytes");
+    if (index < 0)
+        return CLI_DEFAULT_OUTPUT_BYTES;
+    return checkedOutputBudget(Number(args[index + 1]));
+}
+export function checkedOutputBudget(value) {
+    if (!Number.isSafeInteger(value) || value < 1 || value > CLI_MAX_OUTPUT_BYTES)
+        throw new Error(`--max-output-bytes must be an integer from 1 to ${CLI_MAX_OUTPUT_BYTES}`);
+    return value;
+}
+export function artifactRoot() {
+    return resolve(process.env.OMC_ARTIFACTS_HOME ?? joinConfigRoot(), "artifacts");
+}
+export function joinConfigRoot() {
+    return resolve(process.env.OMC_CONFIG_HOME ?? process.cwd());
+}
+/** Bound a result to the stdout budget; over budget, spill it to an artifact reference. */
+export function boundResult(result, budget) {
+    const sanitized = sanitizePaths(result);
+    const serialized = JSON.stringify(sanitized);
+    if (outputOptions().outFile)
+        return sanitized;
+    if (Buffer.byteLength(serialized) <= budget)
+        return sanitized;
+    const artifact = createArtifact(artifactRoot(), JSON.stringify(sanitized, null, 2) + "\n");
+    return { status: sanitized.status ?? "ok", truncated: true, artifactId: artifact.artifactId, sha256: artifact.sha256, bytes: Buffer.byteLength(serialized), fetch: artifactFetchHint(artifact.artifactId) };
+}
+/** The retrieval command an agent should run for a spilled/compacted readback. */
+export function artifactFetchHint(artifactId) {
+    // Summary-first: the complex benchmark showed agents pulling 43–75 KB bodies
+    // raw. `--summary` shows the key/size map so they fetch only what they need.
+    // Kept terse on purpose: this line rides EVERY write and every spilled read
+    // (2026-09-25 cost pass — the parenthetical prose was 80 B of the 133 B).
+    return `omc artifact get ${artifactId} --summary（再 --keys/--jq）`;
+}
+/** Replace local paths with a redaction marker (never leak the host layout). */
+function sanitizePaths(value) {
+    if (typeof value === "string")
+        return redactLocalPath(value);
+    if (Array.isArray(value))
+        return value.map(sanitizePaths);
+    if (!value || typeof value !== "object")
+        return value;
+    const output = {};
+    for (const [key, entry] of Object.entries(value)) {
+        if ((key === "detailFile" || key === "progressFile") && typeof entry === "string") {
+            const content = safeToolArtifactContent(entry);
+            if (content) {
+                const artifact = createArtifact(artifactRoot(), content);
+                output[`${key === "detailFile" ? "detail" : "progress"}ArtifactId`] = artifact.artifactId;
+                output[`${key === "detailFile" ? "detail" : "progress"}Sha256`] = artifact.sha256;
+                output.fetch = artifactFetchHint(artifact.artifactId);
+            }
+            else {
+                output[`${key === "detailFile" ? "detail" : "progress"}ArtifactId`] = null;
+            }
+            continue;
+        }
+        output[key] = sanitizePaths(entry);
+    }
+    return output;
+}
+function safeToolArtifactContent(path) {
+    try {
+        const roots = [artifactRoot(), resolve(process.cwd(), ".omc", "artifacts")];
+        const resolved = resolve(path);
+        if (!roots.some((root) => isWithinRoot(root, resolved)))
+            return null;
+        if (realpathSync(resolved) !== resolved)
+            return null;
+        return readFileSync(resolved);
+    }
+    catch {
+        return null;
+    }
+}
+function escapeRegExp(text) {
+    return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+ * Redact local paths WITHIN a string, not the whole string. The old form tested
+ * `text.includes(prefix)` and replaced the entire value with the marker, so any
+ * text that merely MENTIONED a local path — e.g. a methodology section quoting
+ * `node .cpdocs/omc/cli.js` — came back as a bare `[local-path-redacted]` and its
+ * content was lost (bench40: `help omc-acceptance-criteria --section Per-write`
+ * returned nothing but the marker). Now only the matched path substrings are
+ * replaced, so the surrounding prose survives.
+ */
+function redactLocalPath(text) {
+    if (!/[\\/]/.test(text))
+        return text;
+    const roots = [joinConfigRoot(), process.cwd(), homedir(), tmpdir()]
+        .filter((root) => typeof root === "string" && root.length > 1)
+        .map((root) => root.replace(/[\\/]+$/, ""));
+    let output = text;
+    for (const root of roots) {
+        output = output.replace(new RegExp(`${escapeRegExp(root)}[\\/][^\\s"'\`)\\]}]*`, "g"), "[local-path-redacted]");
+    }
+    // A relative `.omc/...` artifact path is host-layout revealing too.
+    output = output.replace(/(?<![\w.-])\.omc[\\/][^\s"'\`)\]}]*/g, "[local-path-redacted]");
+    return output;
+}
+export { readArtifact };
+//# sourceMappingURL=command-transport.js.map

package/dist/config-store.js

@@ -0,0 +1,195 @@
+import { existsSync, readFileSync, copyFileSync, chmodSync, mkdirSync, statSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { homedir } from "node:os";
+import { sync as writeFileAtomicSync } from "write-file-atomic";
+/**
+ * Removed governance keys. This is a development branch: seeing one of these in
+ * an operator's omc.config.json is an error to be fixed, never silently ignored
+ * (silently ignoring `selfApprove` would leave a false sense that it still
+ * protects anything).
+ */
+export const REMOVED_PROFILE_KEYS = ["selfApprove", "productionWriteGrant", "mcpSelfApprove"];
+export function removedProfileKeys(profile) {
+    const raw = profile;
+    return REMOVED_PROFILE_KEYS.filter((key) => raw[key] !== undefined);
+}
+export class ConfigurationError extends Error {
+}
+export function defaultPaths(projectDir = process.cwd()) {
+    const configRoot = process.env.OMC_CONFIG_HOME
+        ? resolve(process.env.OMC_CONFIG_HOME)
+        : join(homedir(), ".config", "omc");
+    return {
+        configPath: join(configRoot, "omc.config.json"),
+        credentialsPath: join(configRoot, "credentials"),
+        projectEnvPath: join(resolve(projectDir), ".omc-env"),
+    };
+}
+export class ConfigStore {
+    paths;
+    constructor(paths = defaultPaths()) {
+        this.paths = paths;
+    }
+    atomicWrite(path, text, mode) {
+        mkdirSync(dirname(path), { recursive: true });
+        if (existsSync(path)) {
+            try {
+                const previousMode = statSync(path).mode & 0o777;
+                copyFileSync(path, `${path}.bak`);
+                chmodSync(`${path}.bak`, previousMode);
+            }
+            catch {
+                // best-effort backup: the atomic rename below is the durability guarantee
+            }
+        }
+        writeFileAtomicSync(path, text, { mode });
+    }
+    readConfig() {
+        if (!existsSync(this.paths.configPath))
+            return { environments: {} };
+        let parsed;
+        let text;
+        try {
+            text = readFileSync(this.paths.configPath, "utf8");
+        }
+        catch (error) {
+            throw new ConfigurationError(`omc.config.json is unreadable: ${error.message}`);
+        }
+        try {
+            parsed = JSON.parse(text);
+        }
+        catch (error) {
+            if (existsSync(`${this.paths.configPath}.bak`)) {
+                try {
+                    parsed = JSON.parse(readFileSync(`${this.paths.configPath}.bak`, "utf8"));
+                    console.error(`omc.config.json 损坏，已从 .bak 备份恢复（上次已知良好状态）: ${error.message}`);
+                }
+                catch {
+                    throw new ConfigurationError(`omc.config.json is not valid JSON: ${error.message}`);
+                }
+            }
+            else
+                throw new ConfigurationError(`omc.config.json is not valid JSON: ${error.message}`);
+        }
+        if (!parsed || typeof parsed !== "object" || !parsed || typeof parsed.environments !== "object")
+            throw new ConfigurationError("omc.config.json must contain an environments object");
+        const config = parsed;
+        const normalized = {};
+        for (const [name, profile] of Object.entries(config.environments)) {
+            if (!profile || typeof profile.baseUrl !== "string")
+                throw new ConfigurationError(`environment ${name} must declare baseUrl`);
+            // applicationCode is an optional default; an absent value is normalized
+            // to "" (the agent discovers applications at runtime).
+            if (profile.applicationCode !== undefined && typeof profile.applicationCode !== "string")
+                throw new ConfigurationError(`environment ${name} applicationCode must be a string when present`);
+            if (profile.engineCode !== undefined && typeof profile.engineCode !== "string")
+                throw new ConfigurationError(`environment ${name} engineCode must be a string when present`);
+            for (const key of ["isDefault", "production", "writable"])
+                if (profile[key] !== undefined && typeof profile[key] !== "boolean")
+                    throw new ConfigurationError(`environment ${name} ${key} must be boolean when present`);
+            const removed = removedProfileKeys(profile);
+            if (removed.length > 0)
+                throw new ConfigurationError(`environment ${name} carries removed governance keys: ${removed.join(", ")}. Writing is decided by "writable" alone, and a production write needs a per-write confirmProduction — delete these keys.`);
+            const engineCode = profile.engineCode?.trim();
+            normalized[name] = { ...profile, applicationCode: profile.applicationCode ?? "", ...(engineCode ? { engineCode } : {}), writable: profile.writable === true };
+        }
+        return { environments: normalized };
+    }
+    writeConfig(config) {
+        this.atomicWrite(this.paths.configPath, JSON.stringify(config, null, 2) + "\n", 0o644);
+    }
+    upsertEnvironment(name, profile) {
+        if (!name.trim())
+            throw new ConfigurationError("environment name is required");
+        const config = this.readConfig();
+        const environments = { ...config.environments, [name]: profile };
+        if (profile.isDefault)
+            for (const [other, otherProfile] of Object.entries(environments))
+                if (other !== name)
+                    environments[other] = { ...otherProfile, isDefault: false };
+        const next = { environments };
+        this.writeConfig(next);
+        return next;
+    }
+    removeEnvironment(name) {
+        const config = this.readConfig();
+        const environments = { ...config.environments };
+        delete environments[name];
+        this.writeConfig({ environments });
+        return config;
+    }
+    listEnvironments() {
+        return Object.entries(this.readConfig().environments).map(([name, profile]) => ({ name, profile }));
+    }
+    readCredential(name) {
+        const inline = process.env.OMC_CLOUDPIVOT_CREDENTIAL;
+        if (inline) {
+            try {
+                const parsed = JSON.parse(inline);
+                if (typeof parsed.username === "string" && typeof parsed.password === "string")
+                    return parsed;
+            }
+            catch {
+                throw new ConfigurationError("OMC_CLOUDPIVOT_CREDENTIAL must be JSON {username,password}");
+            }
+        }
+        if (!existsSync(this.paths.credentialsPath))
+            throw new ConfigurationError(`no credentials for environment ${name}; run omc setup, or set OMC_CLOUDPIVOT_CREDENTIAL`);
+        const parsed = JSON.parse(readFileSync(this.paths.credentialsPath, "utf8"));
+        const credential = parsed[name];
+        if (!credential || typeof credential.username !== "string" || typeof credential.password !== "string")
+            throw new ConfigurationError(`credentials store has no entry for environment ${name}`);
+        return credential;
+    }
+    writeCredential(name, credential) {
+        mkdirSync(dirname(this.paths.credentialsPath), { recursive: true });
+        const existing = existsSync(this.paths.credentialsPath)
+            ? JSON.parse(readFileSync(this.paths.credentialsPath, "utf8"))
+            : {};
+        existing[name] = credential;
+        this.atomicWrite(this.paths.credentialsPath, JSON.stringify(existing, null, 2) + "\n", 0o600);
+        chmodSync(this.paths.credentialsPath, 0o600);
+    }
+    credentialsMode() {
+        return existsSync(this.paths.credentialsPath) ? statSync(this.paths.credentialsPath).mode & 0o777 : undefined;
+    }
+    /** Available environment names, for error messages — stops agents guessing or spelunking ~/.config. */
+    availableEnvironmentNames() {
+        return Object.keys(this.readConfig().environments).join("、") || "(none configured; run omc setup)";
+    }
+    /** Resolve the active environment for a call. */
+    resolveEnvironment(explicit) {
+        if (explicit && explicit.trim()) {
+            const profile = this.readConfig().environments[explicit];
+            if (!profile)
+                throw new ConfigurationError(`unknown environment "${explicit}"; available: ${this.availableEnvironmentNames()} (doctor prints the bound 环境=; do not guess or read ~/.config/omc manually)`);
+            return { name: explicit, profile, source: "explicit" };
+        }
+        if (process.env.OMC_ENV) {
+            const profile = this.readConfig().environments[process.env.OMC_ENV];
+            if (!profile)
+                throw new ConfigurationError(`OMC_ENV=${process.env.OMC_ENV} is not configured; available: ${this.availableEnvironmentNames()}`);
+            return { name: process.env.OMC_ENV, profile, source: "OMC_ENV" };
+        }
+        if (existsSync(this.paths.projectEnvPath)) {
+            const name = readFileSync(this.paths.projectEnvPath, "utf8").trim();
+            if (name) {
+                const profile = this.readConfig().environments[name];
+                if (!profile)
+                    throw new ConfigurationError(`project .omc-env binds "${name}" which is not configured in omc.config.json; available: ${this.availableEnvironmentNames()} (run omc setup)`);
+                return { name, profile, source: ".omc-env" };
+            }
+        }
+        const entry = this.listEnvironments().find((item) => item.profile.isDefault);
+        if (!entry)
+            throw new ConfigurationError("no default environment; run omc setup or pass environment explicitly");
+        return { name: entry.name, profile: entry.profile, source: "default" };
+    }
+    bindProjectEnvironment(name) {
+        const config = this.readConfig();
+        if (!config.environments[name])
+            throw new ConfigurationError(`unknown environment "${name}"; available: ${this.availableEnvironmentNames()}`);
+        this.atomicWrite(this.paths.projectEnvPath, name + "\n", 0o644);
+    }
+}
+//# sourceMappingURL=config-store.js.map

package/dist/context.js

@@ -0,0 +1,21 @@
+import { join } from "node:path";
+import { WriteLeaseQueue } from "./write-lease.js";
+import { loadCoverageManifest } from "./coverage.js";
+/**
+ * Tool-context assembly: session manager + write lease + coverage manifest +
+ * artifact/cache stores. The one place the governed pipelines' collaborators
+ * are wired together.
+ */
+export function makeToolContext(input) {
+    return {
+        sessions: input.sessions,
+        lease: new WriteLeaseQueue(),
+        manifest: input.manifest ?? loadCoverageManifest(),
+        artifactsDir: input.artifactsDir ?? join(process.cwd(), ".omc", "artifacts"),
+        readbackCache: new Map(),
+        readbackCacheBypass: 0,
+        schemaCache: new Set(),
+        secretsOf: () => [],
+    };
+}
+//# sourceMappingURL=context.js.map

package/dist/contract-consistency.js

@@ -0,0 +1,66 @@
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { LANE_CONTRACTS } from "./contract-resources.js";
+export function assertContractBindings(contracts = LANE_CONTRACTS, bindings = {}) {
+    const contractLanes = new Set(contracts.map((contract) => contract.lane));
+    for (const lane of Object.keys(bindings)) {
+        if (!contractLanes.has(lane))
+            throw new Error(`contract binding lane ${lane} has no contract`);
+    }
+    for (const contract of contracts) {
+        const laneBindings = { ...(bindings[contract.lane] ?? {}), ...(contract.wireBindings ?? {}) };
+        const bindingKeys = new Set(Object.keys(laneBindings));
+        for (const key of Object.keys(contract.wire)) {
+            const id = `${contract.lane}.${key}`;
+            const factBindings = laneBindings[key];
+            if (factBindings === undefined)
+                throw new Error(`contract fact ${id} has no binding`);
+            if (factBindings.length === 0)
+                throw new Error(`contract fact ${id} has an empty binding list`);
+            for (const binding of factBindings)
+                assertBinding(id, binding);
+            bindingKeys.delete(key);
+        }
+        for (const key of bindingKeys)
+            throw new Error(`contract binding ${contract.lane}.${key} has no wire fact`);
+    }
+}
+function assertBinding(id, binding) {
+    const kinds = ["emitter-constant", "behavior-test", "oracle"];
+    if (!kinds.includes(binding.kind))
+        throw new Error(`contract fact ${id} has unknown binding kind ${String(binding.kind)}`);
+    if (!binding.ref.trim())
+        throw new Error(`contract fact ${id} has an empty binding ref`);
+    try {
+        assertBindingReference(binding.ref);
+        binding.verify();
+    }
+    catch (error) {
+        throw new Error(`contract fact ${id} binding ${binding.ref} failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+function assertBindingReference(ref) {
+    const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
+    const [target, anchor] = ref.split("#", 2);
+    if (target.startsWith("test/")) {
+        const filePath = join(packageRoot, target);
+        if (!existsSync(filePath))
+            throw new Error(`binding file ${target} does not exist`);
+        if (anchor && !readFileSync(filePath, "utf8").includes(anchor))
+            throw new Error(`binding test anchor ${anchor} does not exist in ${target}`);
+        return;
+    }
+    const separator = target.lastIndexOf(".");
+    if (separator < 1 || separator === target.length - 1)
+        throw new Error(`binding reference ${ref} is not a module symbol reference`);
+    const moduleName = target.slice(0, separator);
+    const symbol = target.slice(separator + 1);
+    const filePath = join(packageRoot, "src", `${moduleName}.ts`);
+    if (!existsSync(filePath))
+        throw new Error(`binding module ${moduleName} does not exist`);
+    const source = readFileSync(filePath, "utf8");
+    if (!new RegExp(`export\\s+(?:async\\s+)?(?:const|function|class)\\s+${symbol}\\b`).test(source))
+        throw new Error(`binding symbol ${symbol} does not exist in ${moduleName}`);
+}
+//# sourceMappingURL=contract-consistency.js.map

package/dist/contract-resources.js

@@ -0,0 +1,62 @@
+import { APP_LANE_CONTRACT } from "./lanes/app-contract.js";
+import { B2_LANE_CONTRACT } from "./lanes/b2-registration-contract.js";
+import { BUSINESSRULE_LANE_CONTRACT } from "./lanes/businessrule-contract.js";
+import { DATARULE_LANE_CONTRACT } from "./lanes/datarule-contract.js";
+import { DICTIONARY_LANE_CONTRACT } from "./lanes/dictionary-contract.js";
+import { ENVIRONMENT_LANE_CONTRACT } from "./lanes/environment-contract.js";
+import { FIELD_LANE_CONTRACT } from "./lanes/field-contract.js";
+import { FORM_LANE_CONTRACT } from "./lanes/form-contract.js";
+import { LIST_VIEW_LANE_CONTRACT } from "./lanes/list-view-contract.js";
+import { META_LANE_CONTRACT } from "./lanes/meta-contract.js";
+import { MODEL_LANE_CONTRACT } from "./lanes/model-contract.js";
+import { ONLINE_JS_LANE_CONTRACT } from "./lanes/online-js-contract.js";
+import { RULE_LIFECYCLE_LANE_CONTRACT } from "./lanes/rule-lifecycle-contract.js";
+import { REPORT_LANE_CONTRACT } from "./lanes/report-contract.js";
+import { RUNTIME_DATA_LANE_CONTRACT } from "./lanes/runtime-data-contract.js";
+import { WORKFLOW_LANE_CONTRACT } from "./lanes/workflow-contract.js";
+export const LANE_CONTRACTS = Object.freeze([
+    APP_LANE_CONTRACT,
+    B2_LANE_CONTRACT,
+    BUSINESSRULE_LANE_CONTRACT,
+    DATARULE_LANE_CONTRACT,
+    DICTIONARY_LANE_CONTRACT,
+    ENVIRONMENT_LANE_CONTRACT,
+    FIELD_LANE_CONTRACT,
+    FORM_LANE_CONTRACT,
+    LIST_VIEW_LANE_CONTRACT,
+    META_LANE_CONTRACT,
+    MODEL_LANE_CONTRACT,
+    ONLINE_JS_LANE_CONTRACT,
+    RULE_LIFECYCLE_LANE_CONTRACT,
+    REPORT_LANE_CONTRACT,
+    RUNTIME_DATA_LANE_CONTRACT,
+    WORKFLOW_LANE_CONTRACT,
+]);
+export function contractMarkdown(contract) {
+    const tools = Object.entries(contract.tools).map(([name, tool]) => `- ${name} — ${tool.scope}\n  ${tool.description}`).join("\n");
+    // Ticket 55: the `evidence` ledger is maintainer-facing (coverage
+    // consistency keeps using LaneContractShape.evidence), and it names repo
+    // source paths (.ts / .scratch) that an agent would chase instead of
+    // trusting this self-contained contract. It is deliberately NOT rendered
+    // into the caller-facing markdown.
+    return [
+        `# ${contract.lane}`,
+        `Family: ${contract.family}`,
+        `Reference version: ${contract.referenceVersion}`,
+        "",
+        "## Wire",
+        "```json",
+        JSON.stringify(contract.wire, null, 2),
+        "```",
+        "",
+        "## Endpoints",
+        "```json",
+        JSON.stringify(contract.endpoints, null, 2),
+        "```",
+        "",
+        "## Tools",
+        tools,
+        "",
+    ].join("\n");
+}
+//# sourceMappingURL=contract-resources.js.map

package/dist/coverage-consistency.js

@@ -0,0 +1,62 @@
+import { loadCoverageManifest } from "./coverage.js";
+import { assertDeclarationsAlignWithManifest, laneCoverageDeclarations } from "./coverage-registry.js";
+import { assertContractBindings } from "./contract-consistency.js";
+import { isLaneId } from "./lanes/lane-ids.js";
+import { buildToolRegistry } from "./tools.js";
+/**
+ * Tool-surface half of the three-way consistency guard: every registered tool
+ * that declares a lane/scope must be claimed by exactly one lane declaration
+ * with the same lane and scope, and every declared tool must be registered.
+ * Accepts the tool list explicitly so a tampered surface can be asserted in
+ * tests (the real entry point passes `buildToolRegistry()`).
+ *
+ * This guard is NOT a duplicate-of-a-duplicate: lane registrations read their
+ * scope/description from the lane contract, so it does not reconcile two copies
+ * of the metadata. It enforces two things that genuinely can drift — a
+ * registered capability tool must carry a coverage claim (or the runtime
+ * coverage gate would refuse it), and a coverage declaration must not claim a
+ * tool that no longer exists. Keep coverage claims sourcing their scope from
+ * the contract (`claim("tool", TOOLS["tool"].scope)`) rather than a local literal;
+ * a literal is only held equal by this guard, which is the smell to avoid.
+ */
+export function assertToolSurfaceConsistent(tools) {
+    const declaredTools = new Map();
+    for (const declaration of laneCoverageDeclarations()) {
+        for (const toolClaim of declaration.tools) {
+            declaredTools.set(toolClaim.tool, { lane: declaration.lane, scope: toolClaim.scope });
+        }
+    }
+    for (const tool of tools) {
+        if (!tool.lane && !tool.scope)
+            continue;
+        if (!tool.lane || !tool.scope)
+            throw new Error(`tool ${tool.name} declares lane/scope incompletely`);
+        if (!isLaneId(tool.lane))
+            throw new Error(`tool ${tool.name} declares unknown lane ${tool.lane}`);
+        const declared = declaredTools.get(tool.name);
+        if (!declared) {
+            throw new Error(`registered tool ${tool.name} (${tool.lane} / ${tool.scope}) has no lane coverage declaration`);
+        }
+        if (declared.lane !== tool.lane || declared.scope !== tool.scope) {
+            throw new Error(`tool ${tool.name} registration (${tool.lane} / ${tool.scope}) disagrees with its declaration ` +
+                `(${declared.lane} / ${declared.scope})`);
+        }
+    }
+    const registered = new Set(tools.map((tool) => tool.name));
+    for (const [name] of declaredTools) {
+        if (!registered.has(name))
+            throw new Error(`coverage declaration claims unregistered tool ${name}`);
+    }
+}
+/**
+ * Full build-time guard: lane declarations ↔ generated/committed manifest ↔
+ * registered tool surface. Run by `scripts/coverage-manifest.ts --check` and
+ * by `test/coverage-consistency.test.ts`; it is intentionally outside the
+ * runtime import graph so the gate stays cycle-free.
+ */
+export function assertCoverageConsistency() {
+    assertDeclarationsAlignWithManifest(loadCoverageManifest());
+    assertToolSurfaceConsistent(buildToolRegistry());
+    assertContractBindings();
+}
+//# sourceMappingURL=coverage-consistency.js.map