@syv-ai/rulecast 0.1.1 → 0.2.0

package/dist/chunk-3HRTZULM.js

@@ -1,3780 +0,0 @@
-// src/core/detection/registry.ts
-function createRegistry(detectors) {
-  const byKind = /* @__PURE__ */ new Map();
-  for (const detector of detectors) {
-    if (byKind.has(detector.kind)) throw new Error(`detector "${detector.kind}" registered twice`);
-    byKind.set(detector.kind, detector);
-  }
-  return {
-    get: (kind) => byKind.get(kind),
-    kinds: () => [...byKind.keys()]
-  };
-}
-
-// src/core/detection/per-rule.ts
-import { readFile } from "fs/promises";
-import path from "path";
-
-// src/core/errors.ts
-function isNotFound(error) {
-  return error instanceof Error && error.code === "ENOENT";
-}
-function errorMessage(error) {
-  return error instanceof Error ? error.message : String(error);
-}
-function formatZodError(error) {
-  return error.issues.map((issue) => `${issue.path.length ? issue.path.join(".") : "(root)"}: ${issue.message}`).join("; ");
-}
-
-// src/core/detection/per-rule.ts
-function perRule(detect) {
-  return async (input) => {
-    const result = { findings: [], errors: [] };
-    await Promise.all(
-      input.rules.map(async (rule) => {
-        try {
-          for (const match of await detect(rule, input)) result.findings.push({ rule: rule.id, match });
-        } catch (error) {
-          if (input.signal.aborted) throw error;
-          result.errors.push({ rule: rule.id, message: errorMessage(error) });
-        }
-      })
-    );
-    return result;
-  };
-}
-async function readSourceFile(cwd, file) {
-  try {
-    return await readFile(path.resolve(cwd, file), "utf8");
-  } catch (error) {
-    if (isNotFound(error)) return null;
-    throw error;
-  }
-}
-
-// src/detectors/llm/models.ts
-var ALIASES = {
-  haiku: {
-    "claude-code": "haiku",
-    anthropic: "claude-haiku-4-5-20251001",
-    opencode: "anthropic/claude-haiku-4-5-20251001"
-  },
-  sonnet: { "claude-code": "sonnet", anthropic: "claude-sonnet-5", opencode: "anthropic/claude-sonnet-5" },
-  opus: { "claude-code": "opus", anthropic: "claude-opus-5", opencode: "anthropic/claude-opus-5" },
-  fable: { "claude-code": "fable", anthropic: "claude-fable-5-1", opencode: "anthropic/claude-fable-5-1" }
-};
-var MODEL_ALIASES = Object.keys(ALIASES);
-function resolveModel(model, provider) {
-  const alias = ALIASES[model];
-  if (alias === void 0) return model;
-  return alias[provider] ?? null;
-}
-
-// src/detectors/llm/providers/types.ts
-import { z } from "zod";
-var responseSchema = z.object({
-  findings: z.array(
-    z.object({
-      rule: z.string(),
-      line: z.number().int().positive(),
-      /** The model's quote of the line. Asked for because quoting sharpens the line number; never rendered. */
-      text: z.string().optional(),
-      reason: z.string()
-    })
-  )
-});
-var FINDINGS_SCHEMA = {
-  type: "object",
-  properties: {
-    findings: {
-      type: "array",
-      items: {
-        type: "object",
-        properties: {
-          rule: { type: "string" },
-          line: { type: "integer" },
-          text: { type: "string" },
-          reason: { type: "string" }
-        },
-        required: ["rule", "line", "reason"]
-      }
-    }
-  },
-  required: ["findings"]
-};
-var LlmUnavailableError = class extends Error {
-};
-
-// src/detectors/llm/providers/extract.ts
-function extractFindingsJson(text2) {
-  let found = null;
-  for (let start = text2.indexOf("{"); start !== -1; start = text2.indexOf("{", start + 1)) {
-    const end = objectEnd(text2, start);
-    if (end === -1) continue;
-    let parsed;
-    try {
-      parsed = JSON.parse(text2.slice(start, end));
-    } catch {
-      continue;
-    }
-    if (typeof parsed === "object" && parsed !== null && Array.isArray(parsed.findings)) {
-      found = parsed;
-      start = end - 1;
-    }
-  }
-  return found;
-}
-function objectEnd(text2, start) {
-  let depth = 0;
-  let inString = false;
-  for (let i = start; i < text2.length; i++) {
-    const char = text2[i];
-    if (inString) {
-      if (char === "\\") i++;
-      else if (char === '"') inString = false;
-      continue;
-    }
-    if (char === '"') inString = true;
-    else if (char === "{") depth++;
-    else if (char === "}" && --depth === 0) return i + 1;
-  }
-  return -1;
-}
-
-// src/detectors/llm/providers/http.ts
-function endpoint(baseUrl, fallback, path21) {
-  return `${(baseUrl ?? fallback).replace(/\/+$/, "")}${path21}`;
-}
-function apiKey(request) {
-  const key = request.env[request.settings.apiKeyEnv];
-  if (!key) {
-    throw new LlmUnavailableError(
-      `${request.settings.apiKeyEnv} is not set; set it, or use the claude-code provider, which needs no API key`
-    );
-  }
-  return key;
-}
-async function postJson(url, headers, body, signal) {
-  const response = await fetch(url, {
-    method: "POST",
-    headers: { "content-type": "application/json", ...headers },
-    body: JSON.stringify(body),
-    signal
-  });
-  if (!response.ok) {
-    const detail = (await response.text().catch(() => "")).slice(0, 200);
-    const message = `${url} returned ${response.status}: ${detail}`;
-    if (response.status === 401 || response.status === 403) throw new LlmUnavailableError(message);
-    throw new Error(message);
-  }
-  return response.json();
-}
-function keyAvailability(settings, env, fallback, path21) {
-  return env[settings.apiKeyEnv] ? { ok: true, detail: endpoint(settings.baseUrl, fallback, path21) } : { ok: false, detail: `$${settings.apiKeyEnv} is not set` };
-}
-
-// src/detectors/llm/providers/anthropic.ts
-var API = "https://api.anthropic.com";
-var VERSION = "2023-06-01";
-var anthropicProvider = {
-  name: "anthropic",
-  async ask(request) {
-    const key = apiKey(request);
-    const reply = await postJson(
-      endpoint(request.settings.baseUrl, API, "/v1/messages"),
-      { "x-api-key": key, "anthropic-version": VERSION },
-      {
-        model: request.model,
-        max_tokens: 4096,
-        messages: [{ role: "user", content: request.prompt }]
-      },
-      request.signal
-    );
-    const parts = reply.content ?? [];
-    const text2 = parts.filter((part) => part.type === "text" && typeof part.text === "string").map((part) => part.text).join("");
-    const scanned = responseSchema.safeParse(extractFindingsJson(text2));
-    if (scanned.success) return scanned.data.findings;
-    throw new Error(`the anthropic API returned no usable JSON: ${text2.trim().slice(0, 200)}`);
-  },
-  available: async ({ settings, env }) => keyAvailability(settings, env, API, "/v1/messages")
-};
-
-// src/detectors/llm/providers/cli.ts
-import { spawn } from "child_process";
-import { access, constants } from "fs/promises";
-import path2 from "path";
-
-// src/core/which.ts
-import { execFile } from "child_process";
-import { promisify } from "util";
-var exec = promisify(execFile);
-async function onPath(command, signal) {
-  try {
-    await exec("/bin/sh", ["-c", 'command -v "$1" > /dev/null', "sh", command], { signal });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-// src/detectors/llm/providers/cli.ts
-async function resolveCli(name, root) {
-  const local = path2.join(root, "node_modules", ".bin", name);
-  try {
-    await access(local, constants.X_OK);
-    return local;
-  } catch {
-    return name;
-  }
-}
-function runCli(command, args, options) {
-  return new Promise((resolve, reject) => {
-    const child = spawn(command, args, {
-      cwd: options.cwd,
-      env: options.env,
-      signal: options.signal,
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-    const stdout = [];
-    const stderr = [];
-    child.stdout.on("data", (chunk) => stdout.push(chunk));
-    child.stderr.on("data", (chunk) => stderr.push(chunk));
-    child.stdin.on("error", () => {
-    });
-    child.stdin.end(options.input);
-    child.on("error", (error) => {
-      reject(isNotFound(error) ? new LlmUnavailableError(`${command} is not installed`) : error);
-    });
-    child.on("close", (code) => {
-      resolve({
-        stdout: Buffer.concat(stdout).toString("utf8"),
-        stderr: Buffer.concat(stderr).toString("utf8"),
-        code
-      });
-    });
-  });
-}
-async function cliAvailable(name, cwd, signal) {
-  const resolved = await resolveCli(name, cwd);
-  if (resolved !== name) return { ok: true, detail: resolved };
-  return await onPath(name, signal) ? { ok: true, detail: `${name} (PATH)` } : { ok: false, detail: `${name} is not installed` };
-}
-
-// src/detectors/llm/providers/claude-code.ts
-var SYSTEM_PROMPT = "You check one source file against a list of rules and answer only with the structured result. You never edit files, run commands or ask questions.";
-var claudeCodeProvider = {
-  name: "claude-code",
-  async ask(request) {
-    const command = await resolveCli("claude", request.cwd);
-    const args = [
-      "-p",
-      "--model",
-      request.model,
-      "--output-format",
-      "json",
-      "--json-schema",
-      JSON.stringify(FINDINGS_SCHEMA),
-      "--system-prompt",
-      SYSTEM_PROMPT,
-      "--tools",
-      "",
-      "--restricted",
-      "--strict-mcp-config",
-      "--no-session-persistence"
-    ];
-    const result = await runCli(command, args, {
-      cwd: request.cwd,
-      input: request.prompt,
-      env: request.env,
-      signal: request.signal
-    });
-    const envelope = parseJson(result.stdout);
-    if (isRecord(envelope)) {
-      if (envelope.is_error === true) {
-        throw new Error(`claude reported an error: ${firstLine(String(envelope.result ?? result.stderr))}`);
-      }
-      const structured = responseSchema.safeParse(envelope.structured_output);
-      if (structured.success) return structured.data.findings;
-      if (typeof envelope.result === "string") {
-        const fromResult = responseSchema.safeParse(parseJson(envelope.result));
-        if (fromResult.success) return fromResult.data.findings;
-        const scannedResult = responseSchema.safeParse(extractFindingsJson(envelope.result));
-        if (scannedResult.success) return scannedResult.data.findings;
-      }
-    }
-    const scanned = responseSchema.safeParse(extractFindingsJson(result.stdout));
-    if (scanned.success) return scanned.data.findings;
-    throw new Error(
-      `claude returned no usable JSON (exit ${result.code}): ${firstLine(result.stderr || result.stdout)}`
-    );
-  },
-  available: ({ cwd, signal }) => cliAvailable("claude", cwd, signal)
-};
-function parseJson(text2) {
-  try {
-    return JSON.parse(text2);
-  } catch {
-    return void 0;
-  }
-}
-function isRecord(value) {
-  return typeof value === "object" && value !== null;
-}
-function firstLine(text2) {
-  return text2.trim().split("\n")[0]?.slice(0, 200) ?? "";
-}
-
-// src/detectors/llm/providers/openai.ts
-var API2 = "https://api.openai.com/v1";
-var openaiCompatibleProvider = {
-  name: "openai-compatible",
-  async ask(request) {
-    const key = apiKey(request);
-    const reply = await postJson(
-      endpoint(request.settings.baseUrl, API2, "/chat/completions"),
-      { authorization: `Bearer ${key}` },
-      { model: request.model, messages: [{ role: "user", content: request.prompt }] },
-      request.signal
-    );
-    const content = reply.choices?.[0]?.message?.content;
-    const text2 = typeof content === "string" ? content : "";
-    const scanned = responseSchema.safeParse(extractFindingsJson(text2));
-    if (scanned.success) return scanned.data.findings;
-    throw new Error(`the ${request.settings.provider} API returned no usable JSON: ${text2.trim().slice(0, 200)}`);
-  },
-  available: async ({ settings, env }) => keyAvailability(settings, env, API2, "/chat/completions")
-};
-
-// src/detectors/llm/providers/opencode.ts
-var PROMPT_LIMIT_BYTES = 128 * 1024;
-var opencodeProvider = {
-  name: "opencode",
-  async ask(request) {
-    const size = Buffer.byteLength(request.prompt, "utf8");
-    if (size > PROMPT_LIMIT_BYTES) {
-      throw new Error(
-        `prompt is too large for the opencode provider: ${size} bytes against a limit of ${PROMPT_LIMIT_BYTES}. Narrow the rule's files, or use a provider that takes the prompt on stdin.`
-      );
-    }
-    const command = await resolveCli("opencode", request.cwd);
-    const result = await runCli(command, ["run", "--model", request.model, "--format", "default", request.prompt], {
-      cwd: request.cwd,
-      input: "",
-      env: request.env,
-      signal: request.signal
-    });
-    const scanned = responseSchema.safeParse(extractFindingsJson(result.stdout));
-    if (scanned.success) return scanned.data.findings;
-    throw new Error(
-      `opencode returned no usable JSON (exit ${result.code}): ${firstLine2(result.stderr || result.stdout)}`
-    );
-  },
-  available: ({ cwd, signal }) => cliAvailable("opencode", cwd, signal)
-};
-function firstLine2(text2) {
-  return text2.trim().split("\n")[0]?.slice(0, 200) ?? "";
-}
-
-// src/detectors/llm/providers/index.ts
-var PROVIDERS = {
-  "claude-code": claudeCodeProvider,
-  opencode: opencodeProvider,
-  anthropic: anthropicProvider,
-  "openai-compatible": openaiCompatibleProvider
-};
-function providerByName(name) {
-  const provider = PROVIDERS[name];
-  if (!provider) throw new LlmUnavailableError(`the ${name} provider is not available in this build`);
-  return provider;
-}
-
-// src/detectors/ast-grep/languages.ts
-var LANGUAGES = {
-  css: { builtin: "Css" },
-  html: { builtin: "Html" },
-  javascript: { builtin: "JavaScript" },
-  python: { load: () => import("@ast-grep/lang-python") },
-  tsx: { builtin: "Tsx" },
-  typescript: { builtin: "TypeScript" }
-};
-var LANGUAGE_NAMES = Object.keys(LANGUAGES);
-function napiLanguage(language) {
-  const entry = LANGUAGES[language];
-  return "builtin" in entry ? entry.builtin : language;
-}
-
-// src/detectors/ast-grep/load.ts
-var loading = null;
-async function load() {
-  loading ??= (async () => {
-    const napi = await import("@ast-grep/napi");
-    const dynamic = {};
-    for (const [name, entry] of Object.entries(LANGUAGES)) {
-      if (!("load" in entry)) continue;
-      const module = await entry.load();
-      dynamic[name] = module.default ?? module;
-    }
-    if (Object.keys(dynamic).length > 0) napi.registerDynamicLanguage(dynamic);
-    return napi;
-  })();
-  return loading;
-}
-var AstGrepUnavailable = class extends Error {
-  constructor(cause) {
-    super(`ast-grep is unavailable: ${errorMessage(cause)}`);
-  }
-};
-async function parserFor(language) {
-  let napi;
-  try {
-    napi = await load();
-  } catch (error) {
-    loading = null;
-    throw new AstGrepUnavailable(error);
-  }
-  const name = napiLanguage(language);
-  return { parse: (source) => napi.parse(name, source) };
-}
-
-// src/detectors/ast-grep/metavars.ts
-var METAVARIABLE = /\$\$\$([A-Z_][A-Z0-9_]*)|\$([A-Z_][A-Z0-9_]*)/g;
-function scan(value, into) {
-  if (typeof value === "string") {
-    for (const found of value.matchAll(METAVARIABLE)) {
-      const multi = found[1] !== void 0;
-      const name = found[1] ?? found[2];
-      if (name.startsWith("_")) continue;
-      into.set(name, (into.get(name) ?? false) || multi);
-    }
-    return;
-  }
-  if (Array.isArray(value)) {
-    for (const item of value) scan(item, into);
-    return;
-  }
-  if (typeof value === "object" && value !== null) {
-    for (const item of Object.values(value)) scan(item, into);
-  }
-}
-function metavariables(config) {
-  const found = /* @__PURE__ */ new Map();
-  scan(config, found);
-  return [...found].map(([name, multi]) => ({ name, multi }));
-}
-
-// src/detectors/ast-grep/schema.ts
-import { z as z2 } from "zod";
-var ruleObject = z2.record(z2.unknown()).refine((rule) => Object.keys(rule).length > 0, "rule must not be empty");
-var astGrepSchema = z2.object({
-  language: z2.enum(LANGUAGE_NAMES),
-  rule: ruleObject,
-  constraints: z2.record(ruleObject).optional(),
-  utils: z2.record(ruleObject).optional()
-}).strict().superRefine(async (config, ctx) => {
-  try {
-    const parser = await parserFor(config.language);
-    parser.parse("").root().findAll(matcher(config));
-  } catch (error) {
-    ctx.addIssue({ code: "custom", path: ["rule"], message: oneLine(errorMessage(error)) });
-  }
-});
-function oneLine(message) {
-  return message.split("\n").map((line) => line.replace(/^\s*\|->\s*/, "").trim()).filter(Boolean).join(" ");
-}
-function matcher(config) {
-  const { language: _language, ...rest } = config;
-  return rest;
-}
-function captureNames(config) {
-  return metavariables(matcher(config)).map((variable) => variable.name);
-}
-
-// src/detectors/ast-grep/detector.ts
-function capturesOf(node, variables) {
-  const captures = {};
-  for (const variable of variables) {
-    captures[variable.name] = variable.multi ? node.getMultipleMatches(variable.name).filter((match) => match.isNamed()).map((match) => match.text()).join(", ") : node.getMatch(variable.name)?.text() ?? "";
-  }
-  return captures;
-}
-function matchOf(file, node, variables) {
-  const range = node.range();
-  return {
-    file,
-    line: range.start.line + 1,
-    endLine: range.end.line + 1,
-    column: range.start.column + 1,
-    text: node.text(),
-    captures: capturesOf(node, variables)
-  };
-}
-var astGrepDetector = {
-  kind: "ast-grep",
-  schema: astGrepSchema,
-  captures: captureNames,
-  events: () => ["edit", "verify"],
-  guards: true,
-  async run(input) {
-    const result = { findings: [], errors: [] };
-    const byLanguage = /* @__PURE__ */ new Map();
-    for (const rule of input.rules) {
-      byLanguage.set(rule.config.language, [...byLanguage.get(rule.config.language) ?? [], rule]);
-    }
-    await Promise.all(
-      [...byLanguage].map(async ([language, rules]) => {
-        let parser;
-        try {
-          parser = await parserFor(language);
-        } catch (error) {
-          for (const rule of rules) result.errors.push({ rule: rule.id, message: errorMessage(error) });
-          return;
-        }
-        const variables = new Map(rules.map((rule) => [rule.id, metavariables(matcher(rule.config))]));
-        const files = [...new Set(rules.flatMap((rule) => rule.files))].sort();
-        for (const file of files) {
-          input.signal.throwIfAborted();
-          let root;
-          try {
-            const source = await input.read(file);
-            if (source === null) continue;
-            root = parser.parse(source).root();
-          } catch (error) {
-            if (input.signal.aborted) throw error;
-            const message = errorMessage(error);
-            for (const rule of rules) {
-              if (rule.files.includes(file) && !result.errors.some((existing) => existing.rule === rule.id)) {
-                result.errors.push({ rule: rule.id, message });
-              }
-            }
-            continue;
-          }
-          for (const rule of rules) {
-            if (!rule.files.includes(file)) continue;
-            try {
-              for (const node of root.findAll(matcher(rule.config))) {
-                result.findings.push({ rule: rule.id, match: matchOf(file, node, variables.get(rule.id)) });
-              }
-            } catch (error) {
-              if (input.signal.aborted) throw error;
-              if (!result.errors.some((existing) => existing.rule === rule.id)) {
-                result.errors.push({ rule: rule.id, message: errorMessage(error) });
-              }
-            }
-          }
-        }
-      })
-    );
-    return result;
-  },
-  async check(input) {
-    const languages = [...new Set(input.rules.map((rule) => rule.config.language))].sort();
-    for (const language of languages) await parserFor(language);
-    return [{ what: "ast-grep", level: "ok", detail: languages.join(", "), rules: [] }];
-  }
-};
-
-// src/detectors/command/detector.ts
-import { execFile as execFile2 } from "child_process";
-import { access as access2, constants as constants2 } from "fs/promises";
-import path4 from "path";
-import { promisify as promisify2 } from "util";
-
-// src/detectors/command/results.ts
-import { realpathSync } from "fs";
-import path3 from "path";
-import { fileURLToPath } from "url";
-var isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-function parseJson2(output) {
-  try {
-    return JSON.parse(output);
-  } catch {
-    throw new Error("output is not JSON");
-  }
-}
-function repoRelative(file, cwd) {
-  const withoutScheme = file.startsWith("file://") ? fileURLToPath(file) : file;
-  if (!path3.isAbsolute(withoutScheme)) return withoutScheme.split(path3.sep).join("/");
-  for (const root of rootsOf(cwd)) {
-    const relative = path3.relative(root, withoutScheme);
-    if (!relative.startsWith("..") && !path3.isAbsolute(relative)) return relative.split(path3.sep).join("/");
-  }
-  return path3.relative(cwd, withoutScheme).split(path3.sep).join("/");
-}
-function rootsOf(root) {
-  try {
-    const real = realpathSync(root);
-    return real === root ? [root] : [root, real];
-  } catch {
-    return [root];
-  }
-}
-function capturesOf2(source, names, where) {
-  const captures = {};
-  for (const name of names) {
-    const value = source[name];
-    if (typeof value !== "string") throw new Error(`${where}: capture "${name}" is not a string`);
-    captures[name] = value;
-  }
-  return captures;
-}
-function matchesFromJson(output, captures, cwd) {
-  const parsed = parseJson2(output);
-  if (!Array.isArray(parsed)) throw new Error("output is not a JSON array of results");
-  return parsed.map((result, index) => {
-    const where = `result ${index + 1}`;
-    if (!isObject(result)) throw new Error(`${where}: not an object`);
-    if (typeof result.file !== "string") throw new Error(`${where}: "file" must be a string`);
-    if (typeof result.line !== "number") throw new Error(`${where}: "line" must be a number`);
-    return {
-      file: repoRelative(result.file, cwd),
-      line: result.line,
-      endLine: typeof result.endLine === "number" ? result.endLine : result.line,
-      column: typeof result.column === "number" ? result.column : 1,
-      text: typeof result.text === "string" ? result.text : "",
-      captures: capturesOf2(result, captures, where)
-    };
-  });
-}
-function matchesFromSarif(output, captures, cwd) {
-  const parsed = parseJson2(output);
-  if (!isObject(parsed) || !Array.isArray(parsed.runs)) throw new Error("output is not SARIF 2.1.0");
-  const matches = [];
-  let index = 0;
-  for (const run2 of parsed.runs) {
-    if (!isObject(run2) || !Array.isArray(run2.results)) throw new Error("output is not SARIF 2.1.0");
-    for (const result of run2.results) {
-      index += 1;
-      const where = `result ${index}`;
-      if (!isObject(result)) throw new Error(`${where}: not an object`);
-      const location = Array.isArray(result.locations) ? result.locations[0] : void 0;
-      const physical = isObject(location) ? location.physicalLocation : void 0;
-      const artifact = isObject(physical) ? physical.artifactLocation : void 0;
-      if (!isObject(artifact) || typeof artifact.uri !== "string") continue;
-      const region = isObject(physical) && isObject(physical.region) ? physical.region : {};
-      const line = typeof region.startLine === "number" ? region.startLine : 1;
-      const message = isObject(result.message) && typeof result.message.text === "string" ? result.message.text : "";
-      const source = isObject(result.properties) ? { ...result, ...result.properties } : result;
-      matches.push({
-        file: repoRelative(artifact.uri, cwd),
-        line,
-        endLine: typeof region.endLine === "number" ? region.endLine : line,
-        column: typeof region.startColumn === "number" ? region.startColumn : 1,
-        text: message,
-        captures: capturesOf2(source, captures, where)
-      });
-    }
-  }
-  return matches;
-}
-
-// src/detectors/command/schema.ts
-import { z as z3 } from "zod";
-
-// src/core/template.ts
-var VARIABLE = /\{\{\s*([A-Za-z_][A-Za-z0-9_]*)\s*\}\}/g;
-var CORE_VARIABLES = ["file", "line", "column", "text", "rule"];
-var UnknownTemplateVariable = class extends Error {
-  constructor(variable) {
-    super(`template variable "${variable}" has no value`);
-    this.variable = variable;
-  }
-  variable;
-};
-function templateVariables(template) {
-  return [...new Set([...template.matchAll(VARIABLE)].map((match) => match[1]))];
-}
-function oneLine2(value) {
-  return value.replace(/\s+/g, " ").trim();
-}
-function renderTemplate(template, values) {
-  return template.replace(VARIABLE, (_, name) => {
-    const value = values[name];
-    if (value === void 0) throw new UnknownTemplateVariable(name);
-    return oneLine2(value);
-  });
-}
-function templateSkeleton(template) {
-  return template.replace(VARIABLE, (_, name) => `{${name}}`);
-}
-function templateLiteralLength(template) {
-  return oneLine2(template.replace(VARIABLE, "")).length;
-}
-var LOCATION_VARIABLES = /* @__PURE__ */ new Set(["file", "line", "column", "rule"]);
-function templateBindings(template) {
-  return templateVariables(template).filter((name) => !LOCATION_VARIABLES.has(name));
-}
-
-// src/detectors/command/schema.ts
-var VARIABLE_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
-var commandSchema = z3.object({
-  /** argv. The element exactly "{{files}}" is replaced by the rule's files; otherwise they are appended. */
-  run: z3.array(z3.string().min(1)).min(1),
-  output: z3.enum(["json", "sarif"]).default("json"),
-  captures: z3.array(z3.string().regex(VARIABLE_NAME, "a capture must be a template variable name")).default([]).superRefine((captures, ctx) => {
-    for (const name of captures) {
-      if (CORE_VARIABLES.includes(name)) {
-        ctx.addIssue({ code: "custom", message: `"${name}" is a core template variable` });
-      }
-    }
-  })
-}).strict();
-
-// src/detectors/command/detector.ts
-var exec2 = promisify2(execFile2);
-var FILES = "{{files}}";
-function argvFor(run2, files) {
-  if (!run2.includes(FILES)) return [...run2, ...files];
-  return run2.flatMap((argument) => argument === FILES ? files : [argument]);
-}
-async function reachable(command, cwd, signal) {
-  if (!command.includes("/")) {
-    return await onPath(command, signal) ? { level: "ok", detail: `${command} (PATH)` } : { level: "error", detail: "not installed" };
-  }
-  const full = path4.resolve(cwd, command);
-  try {
-    await access2(full, constants2.F_OK);
-  } catch {
-    return { level: "error", detail: "no such file" };
-  }
-  try {
-    await access2(full, constants2.X_OK);
-  } catch {
-    return { level: "error", detail: "not executable" };
-  }
-  return { level: "ok", detail: full };
-}
-var commandDetector = {
-  kind: "command",
-  schema: commandSchema,
-  captures: (config) => config.captures,
-  events: () => ["edit", "verify"],
-  run: perRule(async (rule, input) => {
-    if (rule.files.length === 0) return [];
-    const [command, ...rest] = argvFor(rule.config.run, rule.files);
-    let stdout;
-    try {
-      const result = await exec2(command, rest, { cwd: input.cwd, signal: input.signal, maxBuffer: 64 * 1024 * 1024 });
-      stdout = result.stdout;
-    } catch (error) {
-      if (input.signal.aborted) throw error;
-      if (isNotFound(error)) throw new Error(`command not found: ${command}`);
-      const failure = error;
-      if (typeof failure.stdout !== "string") throw error;
-      stdout = failure.stdout;
-    }
-    return rule.config.output === "sarif" ? matchesFromSarif(stdout, rule.config.captures, input.cwd) : matchesFromJson(stdout, rule.config.captures, input.cwd);
-  }),
-  async check(input) {
-    const byCommand = /* @__PURE__ */ new Map();
-    for (const rule of input.rules) {
-      const command = rule.config.run[0];
-      byCommand.set(command, [...byCommand.get(command) ?? [], rule.id]);
-    }
-    return Promise.all(
-      [...byCommand].map(async ([command, rules]) => {
-        const { level, detail } = await reachable(command, input.cwd, input.signal);
-        return { what: command, level, detail, rules: level === "ok" ? [] : rules };
-      })
-    );
-  }
-};
-
-// src/detectors/linter/detector.ts
-import { execFile as execFile3 } from "child_process";
-import { promisify as promisify3 } from "util";
-
-// src/core/detection/positions.ts
-function lineStarts(text2) {
-  const starts = [0];
-  for (let i = 0; i < text2.length; i++) {
-    if (text2.charCodeAt(i) === 10) starts.push(i + 1);
-  }
-  return starts;
-}
-function positionAt(starts, offset) {
-  let low = 0;
-  let high = starts.length - 1;
-  while (low < high) {
-    const mid = low + high + 1 >> 1;
-    if (starts[mid] <= offset) low = mid;
-    else high = mid - 1;
-  }
-  return { line: low + 1, column: offset - starts[low] + 1 };
-}
-function offsetAt(starts, line, column, length) {
-  const index = Math.min(Math.max(line, 1), starts.length) - 1;
-  const offset = starts[index] + Math.max(column, 1) - 1;
-  return Math.min(Math.max(offset, 0), length);
-}
-
-// src/detectors/linter/resolve.ts
-import { access as access3, constants as constants3 } from "fs/promises";
-import path5 from "path";
-var PYTHON_TOOLS = /* @__PURE__ */ new Set(["ruff"]);
-async function reachable2(file, mode) {
-  try {
-    await access3(file, mode);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function resolveTool(tool, root, available = onPath) {
-  const local = path5.join(root, "node_modules", ".bin", tool);
-  if (await reachable2(local, constants3.X_OK)) return { command: local, prefix: [] };
-  if (PYTHON_TOOLS.has(tool) && await reachable2(path5.join(root, "pyproject.toml"), constants3.F_OK) && await available("uv")) {
-    return { command: "uv", prefix: ["run", "--", tool] };
-  }
-  return { command: tool, prefix: [] };
-}
-async function describeTool(tool, root, options = {}) {
-  const available = options.available ?? ((command) => onPath(command, options.signal));
-  const resolved = await resolveTool(tool, root, available);
-  if (path5.isAbsolute(resolved.command)) {
-    const relative = path5.relative(root, resolved.command);
-    const inside = relative !== "" && !relative.startsWith("..") && !path5.isAbsolute(relative);
-    return { command: inside ? relative.split(path5.sep).join("/") : resolved.command, how: "local", found: true };
-  }
-  if (resolved.prefix.length > 0) {
-    return { command: [resolved.command, ...resolved.prefix].join(" "), how: "uv", found: true };
-  }
-  return { command: resolved.command, how: "path", found: await available(resolved.command) };
-}
-
-// src/detectors/linter/schema.ts
-import { z as z4 } from "zod";
-var TOOL_NAMES = ["eslint", "oxlint", "ruff"];
-var linterSchema = z4.object({
-  tool: z4.enum(TOOL_NAMES),
-  /** Linter rule ids to report. Omitted: every finding the tool reports. */
-  rules: z4.array(z4.string().min(1)).min(1).optional()
-}).strict();
-
-// src/detectors/linter/tools.ts
-import { realpathSync as realpathSync2 } from "fs";
-import path6 from "path";
-var isObject2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-function json(tool, stdout) {
-  try {
-    return JSON.parse(stdout);
-  } catch {
-    throw new Error(`${tool} output is not JSON`);
-  }
-}
-function relativeTo(roots, file) {
-  if (!path6.isAbsolute(file)) return file.split(path6.sep).join("/");
-  for (const root of roots) {
-    const relative = path6.relative(root, file);
-    if (!relative.startsWith("..") && !path6.isAbsolute(relative)) return relative.split(path6.sep).join("/");
-  }
-  return path6.relative(roots[0], file).split(path6.sep).join("/");
-}
-function rootsOf2(root) {
-  try {
-    const real = realpathSync2(root);
-    return real === root ? [root] : [root, real];
-  } catch {
-    return [root];
-  }
-}
-var number = (value, fallback) => typeof value === "number" ? value : fallback;
-var text = (value) => typeof value === "string" ? value : "";
-function oxlintRuleId(code) {
-  const raw = text(code);
-  return /^[\w-]+\((?<rule>[^)]+)\)$/.exec(raw)?.groups?.rule ?? raw;
-}
-var TOOLS = {
-  ruff: {
-    events: ["edit", "verify"],
-    args: (files) => ["check", "--output-format", "json", "--force-exclude", "--", ...files],
-    parse(stdout, root) {
-      const parsed = json("ruff", stdout);
-      if (!Array.isArray(parsed)) throw new Error("ruff output is not a JSON array of diagnostics");
-      const roots = rootsOf2(root);
-      return parsed.filter(isObject2).map((result) => {
-        const start = isObject2(result.location) ? result.location : {};
-        const end = isObject2(result.end_location) ? result.end_location : {};
-        const line = number(start.row, 1);
-        return {
-          file: relativeTo(roots, text(result.filename)),
-          line,
-          column: number(start.column, 1),
-          endLine: number(end.row, line),
-          endColumn: typeof end.column === "number" ? end.column : null,
-          ruleId: text(result.code),
-          message: text(result.message)
-        };
-      });
-    }
-  },
-  oxlint: {
-    events: ["edit", "verify"],
-    args: (files) => ["--format=json", "--", ...files],
-    parse(stdout, root) {
-      const parsed = json("oxlint", stdout);
-      if (!isObject2(parsed) || !Array.isArray(parsed.diagnostics)) {
-        throw new Error("oxlint output is not JSON with diagnostics");
-      }
-      const roots = rootsOf2(root);
-      return parsed.diagnostics.filter(isObject2).map((diagnostic) => {
-        const label = Array.isArray(diagnostic.labels) ? diagnostic.labels[0] : void 0;
-        const span = isObject2(label) && isObject2(label.span) ? label.span : {};
-        const line = number(span.line, 1);
-        return {
-          file: relativeTo(roots, text(diagnostic.filename)),
-          line,
-          column: number(span.column, 1),
-          endLine: line,
-          endColumn: null,
-          ruleId: oxlintRuleId(diagnostic.code),
-          message: text(diagnostic.message)
-        };
-      });
-    }
-  },
-  eslint: {
-    // eslint is the slow one: spec §6 keeps it off the edit hook by default.
-    events: ["verify"],
-    args: (files) => ["--format=json", "--no-error-on-unmatched-pattern", "--", ...files],
-    parse(stdout, root) {
-      const parsed = json("eslint", stdout);
-      if (!Array.isArray(parsed)) throw new Error("eslint output is not a JSON array of file results");
-      const roots = rootsOf2(root);
-      const findings = [];
-      for (const file of parsed.filter(isObject2)) {
-        const messages = Array.isArray(file.messages) ? file.messages : [];
-        for (const message of messages.filter(isObject2)) {
-          const line = number(message.line, 1);
-          findings.push({
-            file: relativeTo(roots, text(file.filePath)),
-            line,
-            column: number(message.column, 1),
-            endLine: number(message.endLine, line),
-            endColumn: typeof message.endColumn === "number" ? message.endColumn : null,
-            ruleId: text(message.ruleId),
-            message: text(message.message)
-          });
-        }
-      }
-      return findings;
-    }
-  }
-};
-
-// src/detectors/linter/detector.ts
-var exec3 = promisify3(execFile3);
-function sourceReader(cwd) {
-  const cache = /* @__PURE__ */ new Map();
-  return (file) => {
-    let source = cache.get(file);
-    if (source === void 0) {
-      source = readSourceFile(cwd, file);
-      cache.set(file, source);
-    }
-    return source;
-  };
-}
-function excerpt(source, finding) {
-  if (source === null) return "";
-  const starts = lineStarts(source);
-  const from = offsetAt(starts, finding.line, finding.column, source.length);
-  let to;
-  if (finding.endColumn === null) {
-    const newline = source.indexOf("\n", from);
-    to = newline === -1 ? source.length : newline;
-  } else {
-    to = offsetAt(starts, finding.endLine, finding.endColumn, source.length);
-  }
-  return source.slice(from, Math.max(from, to)).replace(/\n$/, "");
-}
-async function runTool(tool, files, cwd, signal) {
-  const resolved = await resolveTool(tool, cwd);
-  const args = [...resolved.prefix, ...TOOLS[tool].args(files)];
-  let stdout;
-  try {
-    const result = await exec3(resolved.command, args, { cwd, signal, maxBuffer: 64 * 1024 * 1024 });
-    stdout = result.stdout;
-  } catch (error) {
-    if (signal.aborted) throw error;
-    if (isNotFound(error)) throw new Error(`${tool} is not installed`);
-    const failure = error;
-    if (typeof failure.stdout !== "string") throw error;
-    stdout = failure.stdout;
-  }
-  return TOOLS[tool].parse(stdout, cwd);
-}
-var linterDetector = {
-  kind: "linter",
-  schema: linterSchema,
-  captures: () => ["message", "ruleId"],
-  // A copy: compileRule stores this as the rule's stages, and module-level data must not escape into it.
-  events: (config) => [...TOOLS[config.tool].events],
-  async run(input) {
-    const result = { findings: [], errors: [] };
-    const byTool = /* @__PURE__ */ new Map();
-    for (const rule of input.rules) {
-      byTool.set(rule.config.tool, [...byTool.get(rule.config.tool) ?? [], rule]);
-    }
-    const read = sourceReader(input.cwd);
-    await Promise.all(
-      [...byTool].map(async ([tool, rules]) => {
-        const files = [...new Set(rules.flatMap((rule) => rule.files))].sort();
-        if (files.length === 0) return;
-        try {
-          const findings = await runTool(tool, files, input.cwd, input.signal);
-          for (const finding of findings) {
-            const match = {
-              file: finding.file,
-              line: finding.line,
-              endLine: finding.endLine,
-              column: finding.column,
-              text: excerpt(await read(finding.file), finding),
-              captures: { message: finding.message, ruleId: finding.ruleId }
-            };
-            for (const rule of rules) {
-              if (!rule.files.includes(finding.file)) continue;
-              if (rule.config.rules && !rule.config.rules.includes(finding.ruleId)) continue;
-              result.findings.push({ rule: rule.id, match });
-            }
-          }
-        } catch (error) {
-          if (input.signal.aborted) throw error;
-          const message = errorMessage(error);
-          for (const rule of rules) result.errors.push({ rule: rule.id, message });
-        }
-      })
-    );
-    return result;
-  },
-  async check(input) {
-    const byTool = /* @__PURE__ */ new Map();
-    for (const rule of input.rules) {
-      byTool.set(rule.config.tool, [...byTool.get(rule.config.tool) ?? [], rule.id]);
-    }
-    return Promise.all(
-      [...byTool].map(async ([tool, rules]) => {
-        const described = await describeTool(tool, input.cwd, { signal: input.signal });
-        if (!described.found) return { what: tool, level: "error", detail: "not installed", rules };
-        const detail = described.how === "path" ? `${described.command} (PATH)` : described.command;
-        return { what: tool, level: "ok", detail, rules: [] };
-      })
-    );
-  }
-};
-
-// src/detectors/llm/call.ts
-import { createHash } from "crypto";
-function callKey(input) {
-  const payload = {
-    file: input.file,
-    source: input.source,
-    changedLines: input.changedLines,
-    provider: input.provider,
-    baseUrl: input.baseUrl,
-    model: input.model,
-    rules: [...input.rules].sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0).map((rule) => ({ id: rule.id, config: rule.config, grounding: rule.grounding }))
-  };
-  return createHash("sha256").update(JSON.stringify(payload)).digest("hex");
-}
-async function askCached(provider, cache, key, request) {
-  const cached = await cache.get(key);
-  if (cached !== void 0) return cached;
-  const findings = await provider.ask(request);
-  await cache.set(key, findings);
-  return findings;
-}
-
-// src/detectors/llm/prompt.ts
-function buildPrompt(call) {
-  const marked = call.changedLines !== null;
-  const lines = [
-    "Check the file below against each rule. Report every line that breaks a rule.",
-    "",
-    'Answer with JSON only: {"findings": [{"rule": "<rule id>", "line": <number>, "text": "<the line>", "reason": "<why>"}]}',
-    "Report nothing when a rule is not broken. Use the rule ids exactly as given.",
-    marked ? 'Only lines marked with ">" were changed. Report findings on those lines only.' : "Judge the whole file.",
-    "",
-    "## Rules",
-    ""
-  ];
-  for (const rule of call.rules) {
-    lines.push(`### ${rule.id}`, rule.question, "");
-    for (const reference of rule.grounding) {
-      lines.push(`Reference \u2014 ${reference.ref}:`, '"""', reference.content.replace(/\n$/, ""), '"""', "");
-    }
-  }
-  lines.push(`## File: ${call.file}`, "");
-  const fence = fenceFor(call.source);
-  lines.push(fence, ...numbered(call.source, call.changedLines), fence);
-  return lines.join("\n");
-}
-function fenceFor(source) {
-  let longest = 2;
-  for (const run2 of source.match(/`+/g) ?? []) longest = Math.max(longest, run2.length);
-  return "`".repeat(longest + 1);
-}
-function numbered(source, changedLines2) {
-  const sourceLines = source.replace(/\n$/, "").split("\n");
-  const width = String(sourceLines.length).length;
-  return sourceLines.map((text2, index) => {
-    const number2 = index + 1;
-    const mark = changedLines2 !== null && isChanged(number2, changedLines2) ? "> " : "  ";
-    return `${mark}${String(number2).padStart(width)}  ${text2}`;
-  });
-}
-function isChanged(line, changedLines2) {
-  return changedLines2.some(([start, end]) => line >= start && line <= end);
-}
-
-// src/detectors/llm/schema.ts
-import { z as z5 } from "zod";
-var llmSchema = z5.object({
-  /**
-   * An alias from ./models.ts — haiku, sonnet, opus, fable — or the exact name the configured
-   * provider uses. Required: there is no project-wide default, so the cost of a rule is always
-   * chosen by whoever wrote it (plan 6a, Decision 1).
-   */
-  model: z5.string().trim().min(1),
-  question: z5.string().trim().min(1),
-  /** Send the rule's resolved context references with the question, whatever their delivery mode. */
-  grounding: z5.boolean().default(true)
-}).strict();
-
-// src/detectors/llm/detector.ts
-function sourceReader2(cwd) {
-  const cache = /* @__PURE__ */ new Map();
-  return (file) => {
-    let source = cache.get(file);
-    if (source === void 0) {
-      source = readSourceFile(cwd, file);
-      cache.set(file, source);
-    }
-    return source;
-  };
-}
-function changedLinesOf(changes, file) {
-  const change = changes.get(file);
-  if (change === void 0) return null;
-  return change.changedLines.length === 0 ? "skip" : change.changedLines;
-}
-async function groupCalls(rules, changes, read) {
-  const calls = /* @__PURE__ */ new Map();
-  for (const rule of rules) {
-    for (const file of rule.files) {
-      const changedLines2 = changedLinesOf(changes, file);
-      if (changedLines2 === "skip") continue;
-      const source = await read(file);
-      if (source === null) continue;
-      const key = `${file}\0${rule.config.model}`;
-      const call = calls.get(key);
-      if (call) call.rules.push(rule);
-      else calls.set(key, { file, source, changedLines: changedLines2, model: rule.config.model, rules: [rule] });
-    }
-  }
-  return [...calls.values()];
-}
-function promptRules(rules) {
-  return rules.map((rule) => ({
-    id: rule.id,
-    question: rule.config.question,
-    // Spec §6: the rule's resolved references, whatever their delivery mode.
-    grounding: rule.config.grounding ? rule.context.map((ref) => ({ ref: ref.ref, content: ref.content })) : []
-  }));
-}
-function toFindings(call, answered) {
-  const lines = call.source.replace(/\n$/, "").split("\n");
-  const ids = new Set(call.rules.map((rule) => rule.id));
-  const findings = [];
-  for (const finding of answered) {
-    if (!ids.has(finding.rule)) continue;
-    if (finding.line < 1 || finding.line > lines.length) continue;
-    if (call.changedLines !== null && !call.changedLines.some(([a, b]) => finding.line >= a && finding.line <= b)) {
-      continue;
-    }
-    findings.push({
-      rule: finding.rule,
-      match: {
-        file: call.file,
-        line: finding.line,
-        endLine: finding.line,
-        column: 1,
-        // The file's own line, not the model's quote: {{text}} is the matched source everywhere else.
-        text: lines[finding.line - 1],
-        captures: { reason: finding.reason }
-      }
-    });
-  }
-  return findings;
-}
-function unmappedModel(provider) {
-  return `no name for the ${provider} provider; use that provider's own model name`;
-}
-async function runCall(call, provider, settings, input) {
-  const model = resolveModel(call.model, settings.provider);
-  if (model === null) throw new Error(`model "${call.model}" has ${unmappedModel(settings.provider)}`);
-  const rules = promptRules(call.rules);
-  const key = callKey({
-    file: call.file,
-    source: call.source,
-    changedLines: call.changedLines,
-    provider: settings.provider,
-    baseUrl: settings.baseUrl,
-    model,
-    rules: call.rules.map((rule, index) => ({
-      id: rule.id,
-      config: rule.config,
-      grounding: rules[index].grounding
-    }))
-  });
-  const answered = await askCached(provider, input.cache, key, {
-    model,
-    prompt: buildPrompt({ file: call.file, source: call.source, changedLines: call.changedLines, rules }),
-    settings,
-    env: process.env,
-    cwd: input.cwd,
-    signal: input.signal
-  });
-  return toFindings(call, answered);
-}
-var llmDetector = {
-  kind: "llm",
-  schema: llmSchema,
-  captures: () => ["reason"],
-  // verify only by default (spec §6): a model call is far too slow for an edit hook. A rule opts
-  // in with `stages: [edit, verify]`.
-  events: () => ["verify"],
-  async run(input) {
-    const result = { findings: [], errors: [] };
-    const settings = input.settings.llm;
-    let provider;
-    try {
-      provider = providerByName(settings.provider);
-    } catch (error) {
-      return { findings: [], errors: [{ rule: null, message: errorMessage(error) }] };
-    }
-    const calls = await groupCalls(input.rules, input.changes, sourceReader2(input.cwd));
-    const outcomes = await Promise.all(
-      calls.map(async (call) => {
-        try {
-          return { call, findings: await runCall(call, provider, settings, input) };
-        } catch (error) {
-          if (input.signal.aborted) throw error;
-          return { call, error };
-        }
-      })
-    );
-    for (const outcome of outcomes) {
-      if ("error" in outcome && outcome.error instanceof LlmUnavailableError) {
-        return { findings: [], errors: [{ rule: null, message: outcome.error.message }] };
-      }
-    }
-    for (const outcome of outcomes) {
-      if ("error" in outcome) {
-        const message = errorMessage(outcome.error);
-        for (const rule of outcome.call.rules) result.errors.push({ rule: rule.id, message });
-        continue;
-      }
-      result.findings.push(...outcome.findings);
-    }
-    return result;
-  },
-  /**
-   * The two pre-flight checks plan 6a deferred here: is the backend reachable at all, and does
-   * every rule's model alias have a name for it. Both are environmental and free — nothing in this
-   * method calls a model, which is also why doctor does not dry-run llm rules.
-   */
-  async check(input) {
-    const settings = input.settings.llm;
-    const ids = input.rules.map((rule) => rule.id);
-    let provider;
-    try {
-      provider = providerByName(settings.provider);
-    } catch (error) {
-      return [{ what: settings.provider, level: "error", detail: errorMessage(error), rules: ids }];
-    }
-    const reachable3 = await provider.available({
-      settings,
-      env: input.env,
-      cwd: input.cwd,
-      signal: input.signal
-    });
-    const results = [
-      {
-        what: settings.provider,
-        level: reachable3.ok ? "ok" : "error",
-        detail: reachable3.detail,
-        rules: reachable3.ok ? [] : ids
-      }
-    ];
-    const byModel = /* @__PURE__ */ new Map();
-    for (const rule of input.rules) {
-      byModel.set(rule.config.model, [...byModel.get(rule.config.model) ?? [], rule.id]);
-    }
-    for (const [model, rules] of byModel) {
-      const resolved = resolveModel(model, settings.provider);
-      results.push(
-        resolved === null ? {
-          what: `model "${model}"`,
-          level: "error",
-          detail: unmappedModel(settings.provider),
-          rules
-        } : {
-          what: `model "${model}"`,
-          level: "ok",
-          // "passed through" is only true of a name that is not an alias at all. An alias that
-          // resolves to itself — haiku for the claude-code provider — is still an alias, and
-          // saying otherwise reads as "rulecast does not know this model".
-          detail: MODEL_ALIASES.includes(model) ? `${settings.provider} calls it ${resolved}` : "passed through",
-          rules: []
-        }
-      );
-    }
-    return results;
-  }
-};
-
-// src/detectors/path.ts
-import { z as z6 } from "zod";
-var schema = z6.object({}).strict();
-var pathDetector = {
-  kind: "path",
-  schema,
-  captures: () => [],
-  events: () => ["edit", "verify"],
-  guards: true,
-  run: perRule(async (rule, input) => {
-    const matches = [];
-    for (const file of rule.files) {
-      input.signal.throwIfAborted();
-      const text2 = await input.read(file);
-      if (text2 === null) continue;
-      matches.push({ file, line: 1, endLine: text2.split(/\r?\n/).length, column: 1, text: file, captures: {} });
-    }
-    return matches;
-  })
-};
-
-// src/detectors/regex.ts
-import { z as z7 } from "zod";
-var schema2 = z7.object({
-  pattern: z7.string().min(1),
-  flags: z7.string().regex(/^[dimsuvy]*$/, "allowed flags: d i m s u v y").default("")
-}).strict().superRefine((config, ctx) => {
-  try {
-    new RegExp(config.pattern, config.flags);
-  } catch (error) {
-    ctx.addIssue({ code: "custom", path: ["pattern"], message: errorMessage(error) });
-  }
-});
-var NAMED_GROUP = /\(\?<([A-Za-z_$][\w$]*)>/g;
-function groupNames(pattern) {
-  return [...new Set([...pattern.matchAll(NAMED_GROUP)].map((match) => match[1]))];
-}
-var regexDetector = {
-  kind: "regex",
-  schema: schema2,
-  captures: (config) => groupNames(config.pattern),
-  events: () => ["edit", "verify"],
-  guards: true,
-  run: perRule(async (rule, input) => {
-    const names = groupNames(rule.config.pattern);
-    const matches = [];
-    for (const file of rule.files) {
-      input.signal.throwIfAborted();
-      const text2 = await input.read(file);
-      if (text2 === null) continue;
-      const starts = lineStarts(text2);
-      for (const found of text2.matchAll(new RegExp(rule.config.pattern, `${rule.config.flags}g`))) {
-        const start = found.index;
-        const end = start + found[0].length;
-        const from = positionAt(starts, start);
-        const to = positionAt(starts, Math.max(start, end - 1));
-        matches.push({
-          file,
-          line: from.line,
-          endLine: to.line,
-          column: from.column,
-          text: found[0],
-          captures: Object.fromEntries(names.map((name) => [name, found.groups?.[name] ?? ""]))
-        });
-      }
-    }
-    return matches;
-  })
-};
-
-// src/detectors/index.ts
-var builtinDetectors = [
-  regexDetector,
-  pathDetector,
-  astGrepDetector,
-  commandDetector,
-  linterDetector,
-  llmDetector
-];
-
-// src/core/types.ts
-var LLM_PROVIDERS = ["claude-code", "opencode", "anthropic", "openai-compatible"];
-function defaultDetectorSettings() {
-  return { llm: { provider: "claude-code", baseUrl: null, apiKeyEnv: "ANTHROPIC_API_KEY", maxFilesPerVerify: 10 } };
-}
-function emptyDelivery() {
-  return {
-    findings: [],
-    preexistingSummary: [],
-    references: [],
-    touches: [],
-    stop: null,
-    warnings: [],
-    templates: {},
-    omitted: { findings: [], rules: 0, preexisting: 0 },
-    overflowPath: null
-  };
-}
-
-// src/core/config/load.ts
-import { readFile as readFile2 } from "fs/promises";
-import path8 from "path";
-import { parse } from "yaml";
-
-// src/core/config/schema.ts
-import { z as z9 } from "zod";
-
-// src/core/references.ts
-import path7 from "path";
-import { z as z8 } from "zod";
-var referenceInputSchema = z8.union([
-  z8.string(),
-  z8.object({ path: z8.string(), mode: z8.enum(["inject", "read"]).optional() }).strict()
-]);
-var ReferenceSyntaxError = class extends Error {
-};
-function parseReference(input, defaultMode, root) {
-  const raw = typeof input === "string" ? input : input.path;
-  const mode = typeof input === "string" ? defaultMode : input.mode ?? defaultMode;
-  if (!raw.startsWith("@")) throw new ReferenceSyntaxError(`reference "${raw}" must start with "@"`);
-  const body = raw.slice(1);
-  const hash = body.indexOf("#");
-  const file = hash === -1 ? body : body.slice(0, hash);
-  const anchor = hash === -1 ? null : body.slice(hash + 1);
-  if (!file) throw new ReferenceSyntaxError(`reference "${raw}" has no path`);
-  if (anchor === "") throw new ReferenceSyntaxError(`reference "${raw}" has an empty anchor`);
-  if (anchor !== null && !/\.mdx?$/.test(file)) {
-    throw new ReferenceSyntaxError(`anchors are only supported in .md and .mdx files: "${raw}"`);
-  }
-  const relative = path7.posix.normalize(file);
-  if (path7.posix.isAbsolute(relative) || relative === ".." || relative.startsWith("../")) {
-    throw new ReferenceSyntaxError(`reference "${raw}" leaves its root`);
-  }
-  const suffix = anchor === null ? "" : `#${anchor}`;
-  if (root.label === null) return { ref: `${relative}${suffix}`, path: relative, anchor, mode };
-  return { ref: `${root.label}:${relative}${suffix}`, path: path7.join(root.dir, relative), anchor, mode };
-}
-
-// src/core/config/schema.ts
-var STAGES = ["touch", "edit", "verify"];
-var RULE_ID = /^[a-z0-9-]+(\/[a-z0-9-]+)*$/;
-var idSchema = z9.string().regex(RULE_ID, "must be lowercase segments separated by /");
-var versionSchema = z9.string().regex(/^\d+\.\d+\.\d+$/, "must be a version like 0.2.0");
-var stagesSchema = z9.array(z9.enum(STAGES)).nonempty();
-var ruleKeys = {
-  alias: idSchema.optional(),
-  name: z9.string().min(1).optional(),
-  description: z9.string().optional(),
-  files: z9.string().optional(),
-  exclude: z9.string().optional(),
-  types: z9.array(z9.string()).optional(),
-  types_or: z9.array(z9.string()).optional(),
-  exclude_types: z9.array(z9.string()).optional(),
-  stages: stagesSchema.optional(),
-  minimum_rulecast_version: versionSchema.optional(),
-  severity: z9.enum(["error", "warning"]).optional(),
-  refuse_write: z9.boolean().optional(),
-  detect: z9.record(z9.unknown()).refine((value) => Object.keys(value).length === 1, "must name exactly one detector").optional(),
-  message: z9.string().optional(),
-  context: z9.array(referenceInputSchema).optional()
-};
-var overrideSchema = z9.object({ id: idSchema, ...ruleKeys }).strict();
-var ruleSchema = overrideSchema.extend({ name: z9.string().min(1) });
-var repoSchema = z9.object({
-  repo: z9.string().min(1),
-  rev: z9.string().min(1).optional(),
-  /** Parsed rule by rule in compile, so one bad rule does not reject the config. */
-  rules: z9.array(z9.unknown())
-}).strict();
-var configSchema = z9.object({
-  repos: z9.array(repoSchema),
-  minimum_rulecast_version: versionSchema.optional(),
-  files: z9.string().default(""),
-  exclude: z9.string().default("^$"),
-  default_stages: stagesSchema.optional(),
-  context: z9.object({
-    mode: z9.enum(["inject", "read"]).default("inject"),
-    max_bytes: z9.number().int().positive().default(32768)
-  }).strict().default({}),
-  max_matches_per_rule: z9.number().int().positive().default(10),
-  timeouts: z9.object({
-    edit_deadline_ms: z9.number().int().positive().default(350),
-    verify_ms: z9.number().int().positive().default(6e4)
-  }).strict().default({}),
-  stop_gate: z9.object({ max_blocks: z9.number().int().nonnegative().default(1) }).strict().default({}),
-  refuse_gate: z9.object({ max_refusals: z9.number().int().nonnegative().default(1) }).strict().default({}),
-  llm: z9.object({
-    // No `model`: every llm rule names its own (plan 6a, Decision 1).
-    provider: z9.enum(LLM_PROVIDERS).default("claude-code"),
-    base_url: z9.string().nullable().default(null),
-    api_key_env: z9.string().default("ANTHROPIC_API_KEY"),
-    max_files_per_verify: z9.number().int().positive().default(10)
-  }).strict().default({})
-}).strict().transform((input) => ({
-  repos: input.repos,
-  minimumRulecastVersion: input.minimum_rulecast_version ?? null,
-  files: input.files,
-  exclude: input.exclude,
-  defaultStages: input.default_stages ?? null,
-  context: { mode: input.context.mode, maxBytes: input.context.max_bytes },
-  maxMatchesPerRule: input.max_matches_per_rule,
-  timeouts: { editDeadlineMs: input.timeouts.edit_deadline_ms, verifyMs: input.timeouts.verify_ms },
-  stopGate: { maxBlocks: input.stop_gate.max_blocks },
-  refuseGate: { maxRefusals: input.refuse_gate.max_refusals },
-  llm: {
-    provider: input.llm.provider,
-    baseUrl: input.llm.base_url,
-    apiKeyEnv: input.llm.api_key_env,
-    maxFilesPerVerify: input.llm.max_files_per_verify
-  }
-}));
-function defaultConfig() {
-  return configSchema.parse({ repos: [] });
-}
-
-// src/core/config/load.ts
-var CONFIG_FILE = ".rulecast-config.yaml";
-var MANIFEST_FILE = ".rulecast-rules.yaml";
-async function readYamlFile(file) {
-  const name = path8.basename(file);
-  let text2;
-  try {
-    text2 = await readFile2(file, "utf8");
-  } catch (error) {
-    if (isNotFound(error)) return { ok: false, message: `${name} not found` };
-    throw error;
-  }
-  try {
-    return { ok: true, value: parse(text2) ?? null };
-  } catch (error) {
-    return { ok: false, message: `${name}: ${errorMessage(error)}` };
-  }
-}
-function readConfigData(root) {
-  return readYamlFile(path8.join(root, CONFIG_FILE));
-}
-function parseConfig(data) {
-  const result = configSchema.safeParse(data);
-  if (!result.success) return { ok: false, message: `${CONFIG_FILE}: ${formatZodError(result.error)}` };
-  return { ok: true, value: result.data };
-}
-async function readManifest(dir) {
-  const loaded = await readYamlFile(path8.join(dir, MANIFEST_FILE));
-  if (!loaded.ok) return loaded;
-  if (!Array.isArray(loaded.value)) return { ok: false, message: `${MANIFEST_FILE}: must be a list of rules` };
-  return { ok: true, value: loaded.value };
-}
-
-// src/core/version.ts
-var VERSION2 = "0.1.1";
-function parseVersion(text2) {
-  const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(text2);
-  return match ? [Number(match[1]), Number(match[2]), Number(match[3])] : null;
-}
-function isOlder(running, minimum) {
-  const a = parseVersion(running);
-  const b = parseVersion(minimum);
-  if (!a || !b) return false;
-  for (let i = 0; i < 3; i++) {
-    if (a[i] !== b[i]) return a[i] < b[i];
-  }
-  return false;
-}
-
-// src/core/delivery/render-agent.ts
-var GROUP_FROM = 3;
-var GROUP_MIN_LITERAL = 40;
-var MAX_LOCATION_PAD = 40;
-var WRAP = 96;
-var plural = (count, word) => `${count} ${word}${count === 1 ? "" : "s"}`;
-function header(delivery) {
-  if (delivery.findings.length > 0) {
-    const rules = new Set(delivery.findings.map((finding) => finding.rule)).size + delivery.omitted.rules;
-    const files = new Set(delivery.findings.map((finding) => finding.file));
-    const where = files.size === 1 && delivery.omitted.rules === 0 ? ` in ${[...files][0]}` : "";
-    return `rulecast: ${plural(rules, "rule")} violated${where}`;
-  }
-  if (delivery.references.length > 0 || delivery.preexistingSummary.length > 0) {
-    return "rulecast: conventions for the files you are working on";
-  }
-  return null;
-}
-var repeatOf = (finding) => finding.count > 1 ? ` (\xD7${finding.count})` : "";
-function findingLines(finding) {
-  const lines = finding.message.split("\n").map((line) => `  ${line}`);
-  lines[lines.length - 1] += repeatOf(finding);
-  return lines;
-}
-var locationOf = (finding, withLine) => withLine ? `${finding.file}:${finding.line}` : finding.file;
-function bindingValue(value) {
-  const text2 = (value ?? "").replace(/\s+/g, " ").trim();
-  if (text2 === "") return "\u2014";
-  return /\s/.test(text2) && !/^".*"$/.test(text2) ? `"${text2}"` : text2;
-}
-function packed(items) {
-  const lines = [];
-  for (const item of items) {
-    const last = lines.at(-1);
-    if (last !== void 0 && last.length + 2 + item.length <= WRAP) lines[lines.length - 1] = `${last}, ${item}`;
-    else lines.push(`  ${item}`);
-  }
-  return lines;
-}
-function groupedLines(findings, template) {
-  const names = templateBindings(template);
-  const withLine = templateVariables(template).includes("line");
-  const at = (finding) => locationOf(finding, withLine);
-  const out = templateSkeleton(template).split("\n").map((line) => `  ${line}`);
-  out.push("");
-  if (names.length === 0) {
-    out.push(...packed(findings.map((finding) => `${at(finding)}${repeatOf(finding)}`)));
-    return out;
-  }
-  const width = Math.min(MAX_LOCATION_PAD, Math.max(...findings.map((finding) => at(finding).length)));
-  for (const finding of findings) {
-    const values = names.map((name) => bindingValue(finding.captures?.[name])).join("  ");
-    out.push(`  ${at(finding).padEnd(width)}  ${values}${repeatOf(finding)}`.trimEnd());
-  }
-  return out;
-}
-function referenceLines(reference) {
-  switch (reference.state) {
-    case "full":
-      return [`--- ${reference.ref} ---`, ...(reference.content ?? "").split("\n"), ""];
-    case "pointer":
-      return [`--- ${reference.ref} (provided earlier in this session) ---`];
-    case "missing":
-      return [`--- ${reference.ref} (missing) ---`];
-    case "read": {
-      const what = reference.location === void 0 ? "read this" : `read ${reference.location}`;
-      return reference.reason === "mode" ? [`--- ${reference.ref}: ${what} before continuing ---`] : [`--- ${reference.ref}: ${what} before continuing (not included, too long for this message) ---`];
-    }
-  }
-}
-function omittedFor(omitted, rule) {
-  const entry = omitted.findings.find((finding) => finding.rule === rule);
-  return { count: entry?.count ?? 0, files: entry?.files ?? 0 };
-}
-function ruleBlock(rule, findings, template, dropped, options) {
-  const shown = findings.slice(0, options.maxMatchesPerRule);
-  const hidden = findings.slice(options.maxMatchesPerRule);
-  const total = findings.length + dropped.count;
-  const grouped = template !== void 0 && total >= GROUP_FROM && templateLiteralLength(template) >= GROUP_MIN_LITERAL;
-  const severity = findings[0].severity;
-  const files = new Set(findings.map((finding) => finding.file)).size + dropped.files;
-  const out = [grouped ? `${severity} ${rule} \u2014 ${total} in ${plural(files, "file")}` : `${severity} ${rule}`];
-  if (grouped && template !== void 0) out.push(...groupedLines(shown, template));
-  else for (const finding of shown) out.push(...findingLines(finding));
-  const more = hidden.length + dropped.count;
-  if (more > 0) {
-    const moreFiles = new Set(hidden.map((finding) => finding.file)).size + dropped.files;
-    out.push(`  \u2026and ${more} more in ${plural(moreFiles, "file")}`);
-  }
-  return out;
-}
-function measureRuleBlock(rule, findings, template, options) {
-  return ruleBlock(rule, findings, template, { count: 0, files: 0 }, options).join("\n").length + 1;
-}
-function renderAgentText(delivery, options) {
-  const title = header(delivery);
-  if (title === null && delivery.warnings.length === 0) return "";
-  const out = [];
-  if (title !== null) out.push(title, "");
-  const byRule = /* @__PURE__ */ new Map();
-  for (const finding of delivery.findings) byRule.set(finding.rule, [...byRule.get(finding.rule) ?? [], finding]);
-  for (const [rule, findings] of byRule) {
-    out.push(...ruleBlock(rule, findings, delivery.templates[rule], omittedFor(delivery.omitted, rule), options));
-    out.push("");
-  }
-  for (const summary of delivery.preexistingSummary) {
-    out.push(`pre-existing (not blocking): ${summary.rule} \xD7${summary.count} in ${summary.file}`);
-  }
-  if (delivery.omitted.preexisting > 0) {
-    out.push(`\u2026and ${delivery.omitted.preexisting} more pre-existing (not blocking)`);
-  }
-  if (delivery.preexistingSummary.length > 0 || delivery.omitted.preexisting > 0) out.push("");
-  for (const reference of delivery.references) out.push(...referenceLines(reference));
-  if (out.length > 0 && out.at(-1) !== "") out.push("");
-  if (delivery.warnings.length > 0) {
-    out.push("rulecast warnings:", ...delivery.warnings.map((warning) => `  - ${warning}`));
-  }
-  if (delivery.overflowPath !== null) {
-    if (out.at(-1) !== "") out.push("");
-    out.push(
-      `\u2026${plural(delivery.omitted.rules, "rule")} and the conventions they cite did not fit here.`,
-      "Every finding, with the doc sections it cites, is in:",
-      `  ${delivery.overflowPath}`
-    );
-  }
-  while (out.at(-1) === "") out.pop();
-  return out.join("\n");
-}
-
-// src/adapters/claude-code/parse.ts
-import { z as z10 } from "zod";
-var common = z10.object({
-  hook_event_name: z10.string(),
-  session_id: z10.string().min(1),
-  cwd: z10.string().min(1),
-  agent_id: z10.string().min(1).optional(),
-  agent_type: z10.string().optional(),
-  source: z10.string().optional(),
-  prompt: z10.string().optional()
-});
-var fileTool = z10.object({
-  tool_name: z10.string(),
-  tool_input: z10.object({ file_path: z10.string().min(1) })
-});
-var readResponse = z10.object({
-  tool_response: z10.object({
-    file: z10.object({ startLine: z10.number(), numLines: z10.number(), totalLines: z10.number() })
-  })
-});
-var writeInput = z10.object({
-  tool_input: z10.object({
-    file_path: z10.string().min(1),
-    content: z10.string().optional(),
-    old_string: z10.string().optional(),
-    new_string: z10.string().optional(),
-    replace_all: z10.boolean().optional()
-  })
-});
-function parseClaudeCode(input) {
-  const head = common.safeParse(input);
-  if (!head.success) return null;
-  const {
-    hook_event_name: hook,
-    session_id: id,
-    cwd,
-    agent_id: agentId,
-    agent_type: agentType,
-    source,
-    prompt
-  } = head.data;
-  const session = agentId === void 0 ? { id } : { id, agentId };
-  const result = (kind, files = [], completeRead) => ({
-    cwd,
-    event: kind === null ? null : { kind, files, cwd, session, ...completeRead === void 0 ? {} : { completeRead } },
-    warmup: false
-  });
-  switch (hook) {
-    case "PreToolUse": {
-      const tool = fileTool.safeParse(input);
-      if (!tool.success) return result(null);
-      const { tool_name: name } = tool.data;
-      if (name !== "Edit" && name !== "Write") return result(null);
-      const write = writeInput.safeParse(input);
-      if (!write.success) return result(null);
-      const {
-        file_path: file,
-        content,
-        old_string: find,
-        new_string: replace,
-        replace_all: all
-      } = write.data.tool_input;
-      const intent = content !== void 0 ? { content } : find !== void 0 && replace !== void 0 ? { edit: { find, replace, all: all === true } } : null;
-      if (intent === null) return result(null);
-      return { ...result("guard", [file]), event: { kind: "guard", files: [file], cwd, session, intent } };
-    }
-    case "PostToolUse": {
-      const tool = fileTool.safeParse(input);
-      if (!tool.success) return result(null);
-      const { tool_name: name, tool_input: toolInput } = tool.data;
-      if (name === "Edit" || name === "Write") return result("edit", [toolInput.file_path]);
-      if (name !== "Read") return result(null);
-      const read = readResponse.safeParse(input);
-      const file = read.success ? read.data.tool_response.file : null;
-      return result(
-        "touch",
-        [toolInput.file_path],
-        file !== null && file.startLine === 1 && file.numLines === file.totalLines
-      );
-    }
-    case "Stop":
-      return result("verify");
-    case "SubagentStop":
-      return result(agentType === "" ? null : "verify");
-    case "UserPromptSubmit":
-      return result(prompt?.startsWith("<task-notification>") ? null : "prompt");
-    case "SessionStart":
-      if (source === "compact") return result("reset");
-      return { ...result(null), warmup: source === "startup" || source === "resume" };
-    default:
-      return result(null);
-  }
-}
-
-// src/adapters/claude-code/settings.ts
-var SettingsError = class extends Error {
-};
-var RULECAST_HOOK = /\brulecast\b.*\bhook claude-code\b/;
-var isObject3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var isRulecastHook = (hook) => isObject3(hook) && typeof hook.command === "string" && RULECAST_HOOK.test(hook.command);
-function hookGroups(verifyMs) {
-  const verifyTimeout = Math.ceil(verifyMs / 1e3) + 10;
-  return [
-    // Before the write, for refuse_write rules. It answers nothing at all unless the project has
-    // one, so the cost on an ordinary edit is starting rulecast and compiling the config.
-    { event: "PreToolUse", matcher: "Edit|Write", timeout: 5 },
-    { event: "PostToolUse", matcher: "Read", timeout: 5 },
-    { event: "PostToolUse", matcher: "Edit|Write", timeout: 5 },
-    { event: "Stop", timeout: verifyTimeout },
-    { event: "SubagentStop", timeout: verifyTimeout },
-    { event: "UserPromptSubmit", timeout: 5 },
-    { event: "SessionStart", matcher: "startup|resume|compact", timeout: 5 }
-  ];
-}
-function installed(groups, matcher2) {
-  return groups.some(
-    (group) => isObject3(group) && group.matcher === matcher2 && Array.isArray(group.hooks) && group.hooks.some(isRulecastHook)
-  );
-}
-function hooksOf(settings) {
-  if (!isObject3(settings)) throw new SettingsError("settings must be a JSON object");
-  const hooks = settings.hooks ?? {};
-  if (!isObject3(hooks)) throw new SettingsError('"hooks" must be an object');
-  return hooks;
-}
-function mergeHooks(settings, command, verifyMs) {
-  const merged = { ...hooksOf(settings) };
-  const added = [];
-  for (const { event, matcher: matcher2, timeout } of hookGroups(verifyMs)) {
-    const groups = merged[event] ?? [];
-    if (!Array.isArray(groups)) throw new SettingsError(`"hooks.${event}" must be an array`);
-    if (installed(groups, matcher2)) continue;
-    const hook = { type: "command", command, timeout };
-    merged[event] = [...groups, matcher2 === void 0 ? { hooks: [hook] } : { matcher: matcher2, hooks: [hook] }];
-    added.push(matcher2 === void 0 ? event : `${event} (${matcher2})`);
-  }
-  return { settings: { ...settings, hooks: merged }, added };
-}
-function removeHooks(settings) {
-  const hooks = hooksOf(settings);
-  const source = settings;
-  const kept = {};
-  const removed = [];
-  for (const [event, groups] of Object.entries(hooks)) {
-    if (!Array.isArray(groups)) throw new SettingsError(`"hooks.${event}" must be an array`);
-    const remaining = [];
-    for (const group of groups) {
-      if (!isObject3(group) || !Array.isArray(group.hooks) || !group.hooks.some(isRulecastHook)) {
-        remaining.push(group);
-        continue;
-      }
-      removed.push(typeof group.matcher === "string" ? `${event} (${group.matcher})` : event);
-      const others = group.hooks.filter((hook) => !isRulecastHook(hook));
-      if (others.length > 0) remaining.push({ ...group, hooks: others });
-    }
-    if (remaining.length > 0 || groups.length === 0) kept[event] = remaining;
-  }
-  if (removed.length === 0) return { settings: source, removed };
-  const result = {};
-  for (const [key, value] of Object.entries(source)) {
-    if (key !== "hooks") result[key] = value;
-    else if (Object.keys(kept).length > 0) result[key] = kept;
-  }
-  return { settings: result, removed };
-}
-
-// src/adapters/claude-code/adapter.ts
-var CONTEXT_LIMIT = 1e4;
-var CONTEXT_BUDGET = 9e3;
-var BLOCK_PREAMBLE = "This project's rulecast rules (.rulecast-config.yaml) found problems in code changed in this session. Fix them before you finish.";
-var CAP_PREAMBLE = "rulecast: the agent stopped with these findings unresolved (stop gate limit reached).";
-var DENY_PREAMBLE = "This project's rulecast rules (.rulecast-config.yaml) refuse this write. Change what you are writing, or the file you are writing it to, and try again.";
-function cutNotice(delivery, event) {
-  if (delivery.overflowPath !== null) {
-    return `
-
-\u2026cut to fit Claude Code's hook output limit. The whole delivery is in ${delivery.overflowPath}.`;
-  }
-  const session = event.session ? `--session ${event.session.id} ` : "";
-  return `
-
-\u2026cut to fit Claude Code's hook output limit. Run \`rulecast run ${session}--format agent\` for the full list.`;
-}
-function withinLimit(text2, delivery, event) {
-  if (text2.length <= CONTEXT_LIMIT) return text2;
-  const notice = cutNotice(delivery, event);
-  const room = CONTEXT_LIMIT - notice.length;
-  const cut = text2.slice(0, room);
-  const lastLine = cut.lastIndexOf("\n");
-  return (lastLine > room / 2 ? cut.slice(0, lastLine) : cut.trimEnd()) + notice;
-}
-var NONE = { stdout: "", exitCode: 0 };
-var json2 = (value) => ({ stdout: JSON.stringify(value), exitCode: 0 });
-var claudeCodeAdapter = {
-  name: "claude-code",
-  label: "Claude Code",
-  maxContextChars: CONTEXT_BUDGET,
-  /** Recorded from 2.1.278: /compact re-attaches the 5 most recently read, edited or written files. */
-  restoredFiles: 5,
-  parse: parseClaudeCode,
-  format(delivery, event, options) {
-    const text2 = renderAgentText(delivery, options);
-    if (text2 === "") return NONE;
-    switch (event.kind) {
-      case "guard":
-        return json2({
-          hookSpecificOutput: {
-            hookEventName: "PreToolUse",
-            permissionDecision: "deny",
-            permissionDecisionReason: withinLimit(`${DENY_PREAMBLE}
-
-${text2}`, delivery, event)
-          }
-        });
-      case "touch":
-      case "edit":
-        return json2({
-          hookSpecificOutput: { hookEventName: "PostToolUse", additionalContext: withinLimit(text2, delivery, event) }
-        });
-      case "reset":
-        return json2({
-          hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: withinLimit(text2, delivery, event) }
-        });
-      case "verify":
-        if (delivery.stop === "block")
-          return json2({ decision: "block", reason: withinLimit(`${BLOCK_PREAMBLE}
-
-${text2}`, delivery, event) });
-        if (delivery.stop === "capReached")
-          return json2({ systemMessage: withinLimit(`${CAP_PREAMBLE}
-
-${text2}`, delivery, event) });
-        return NONE;
-      default:
-        return NONE;
-    }
-  },
-  install: {
-    markers: [".claude/", "CLAUDE.md"],
-    scopes: [
-      { scope: "shared", file: ".claude/settings.json" },
-      { scope: "personal", file: ".claude/settings.local.json" }
-    ],
-    command: (local) => local ? '"$CLAUDE_PROJECT_DIR"/node_modules/.bin/rulecast hook claude-code' : "rulecast hook claude-code",
-    merge: mergeHooks,
-    remove: removeHooks
-  }
-};
-
-// src/adapters/index.ts
-var ADAPTERS = [claudeCodeAdapter];
-function adapterByName(name) {
-  return ADAPTERS.find((adapter) => adapter.name === name);
-}
-
-// src/core/home.ts
-import { createHash as createHash2 } from "crypto";
-import { appendFileSync, existsSync, mkdirSync, realpathSync as realpathSync3, writeFileSync } from "fs";
-import { homedir } from "os";
-import path9 from "path";
-function cacheHome(env) {
-  if (env.RULECAST_HOME) return path9.resolve(env.RULECAST_HOME);
-  if (env.XDG_CACHE_HOME) return path9.join(path9.resolve(env.XDG_CACHE_HOME), "rulecast");
-  return path9.join(homedir(), ".cache", "rulecast");
-}
-function projectStateDir(home, root) {
-  const hash = createHash2("sha256").update(realpathSync3(root)).digest("hex").slice(0, 16);
-  return path9.join(home, "projects", hash);
-}
-function ensureProjectState(home, root) {
-  const dir = projectStateDir(home, root);
-  const file = path9.join(dir, "root");
-  if (!existsSync(file)) {
-    mkdirSync(dir, { recursive: true });
-    writeFileSync(file, `${realpathSync3(root)}
-`);
-  }
-  return dir;
-}
-function debugLogger(stateDir, now = () => /* @__PURE__ */ new Date()) {
-  const file = path9.join(stateDir, "debug.log");
-  return (line) => {
-    try {
-      appendFileSync(file, `${now().toISOString()} ${line}
-`);
-    } catch {
-    }
-  };
-}
-
-// src/core/compile/project.ts
-import { readFile as readFile3 } from "fs/promises";
-
-// src/core/files.ts
-import path10 from "path";
-var TYPE_TABLE = {
-  ".py": ["text", "python"],
-  ".pyi": ["text", "python", "pyi"],
-  ".ts": ["text", "ts"],
-  ".mts": ["text", "ts"],
-  ".cts": ["text", "ts"],
-  ".tsx": ["text", "tsx"],
-  ".js": ["text", "javascript"],
-  ".mjs": ["text", "javascript"],
-  ".cjs": ["text", "javascript"],
-  ".jsx": ["text", "jsx"],
-  ".md": ["text", "markdown"],
-  ".mdx": ["text", "mdx"],
-  ".yaml": ["text", "yaml"],
-  ".yml": ["text", "yaml"],
-  ".json": ["text", "json"],
-  ".toml": ["text", "toml"],
-  ".css": ["text", "css"],
-  ".scss": ["text", "scss"],
-  ".html": ["text", "html"],
-  ".sh": ["text", "shell"],
-  ".sql": ["text", "sql"],
-  ".go": ["text", "go"],
-  ".rs": ["text", "rust"],
-  ".txt": ["text", "plain-text"]
-};
-var KNOWN_TAGS = /* @__PURE__ */ new Set(["file", ...Object.values(TYPE_TABLE).flat()]);
-var FILE_ONLY = /* @__PURE__ */ new Set(["file"]);
-function tagsOf(file) {
-  const tags = TYPE_TABLE[path10.posix.extname(file).toLowerCase()];
-  return tags ? /* @__PURE__ */ new Set(["file", ...tags]) : FILE_ONLY;
-}
-function compileRegex(key, source) {
-  try {
-    return new RegExp(source);
-  } catch (error) {
-    return `${key}: invalid regex: ${errorMessage(error)}`;
-  }
-}
-function compileFilter(input) {
-  const files = compileRegex("files", input.files);
-  if (typeof files === "string") return files;
-  const exclude = compileRegex("exclude", input.exclude);
-  if (typeof exclude === "string") return exclude;
-  const unknown = [...input.types, ...input.typesOr, ...input.excludeTypes].find((tag) => !KNOWN_TAGS.has(tag));
-  if (unknown !== void 0) return `unknown file type "${unknown}"`;
-  const { types, typesOr, excludeTypes } = input;
-  return (file) => {
-    if (!files.test(file) || exclude.test(file)) return false;
-    const tags = tagsOf(file);
-    return types.every((tag) => tags.has(tag)) && (typesOr.length === 0 || typesOr.some((tag) => tags.has(tag))) && !excludeTypes.some((tag) => tags.has(tag));
-  };
-}
-
-// src/core/compile/rule.ts
-import path11 from "path";
-
-// src/core/anchors.ts
-var FENCE_OPEN = /^ {0,3}(`{3,}|~{3,})/;
-var FENCE_CLOSE = /^ {0,3}(`{3,}|~{3,})[ \t]*$/;
-var ATX = /^ {0,3}(#{1,6})(?:[ \t]+(.*?))?(?:[ \t]+#+)?[ \t]*$/;
-var SETEXT_1 = /^ {0,3}=+[ \t]*$/;
-var SETEXT_2 = /^ {0,3}-+[ \t]*$/;
-var LIST_ITEM = /^ {0,3}[-*+][ \t]/;
-function linesOf(markdown2) {
-  return markdown2.split(/\r?\n/);
-}
-function slugify(text2) {
-  return text2.trim().toLowerCase().replace(/[^\p{L}\p{M}\p{N}\p{Pc} -]/gu, "").replace(/ /g, "-");
-}
-function scanHeadings(markdown2) {
-  const lines = linesOf(markdown2);
-  const headings = [];
-  const seen = /* @__PURE__ */ new Map();
-  let fence = null;
-  const add = (level, text2, line) => {
-    const base = slugify(text2);
-    const count = seen.get(base) ?? 0;
-    seen.set(base, count + 1);
-    headings.push({ level, text: text2, slug: count === 0 ? base : `${base}-${count}`, line });
-  };
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i];
-    if (fence) {
-      const close = line.match(FENCE_CLOSE);
-      if (close && close[1][0] === fence.char && close[1].length >= fence.length) fence = null;
-      continue;
-    }
-    const open2 = line.match(FENCE_OPEN);
-    if (open2) {
-      fence = { char: open2[1][0], length: open2[1].length };
-      continue;
-    }
-    const atx = line.match(ATX);
-    if (atx) {
-      add(atx[1].length, (atx[2] ?? "").trim(), i + 1);
-      continue;
-    }
-    const next = lines[i + 1];
-    if (next === void 0 || line.trim() === "") continue;
-    if (SETEXT_1.test(next)) {
-      add(1, line.trim(), i + 1);
-      i++;
-    } else if (SETEXT_2.test(next) && !LIST_ITEM.test(line)) {
-      add(2, line.trim(), i + 1);
-      i++;
-    }
-  }
-  return headings;
-}
-function sectionRange(markdown2, slug) {
-  const headings = scanHeadings(markdown2);
-  const index = headings.findIndex((heading2) => heading2.slug === slug);
-  if (index === -1) return null;
-  const heading = headings[index];
-  const next = headings.slice(index + 1).find((candidate) => candidate.level <= heading.level);
-  return { slug, start: heading.line, end: next ? next.line - 1 : linesOf(markdown2).length };
-}
-function sectionText(markdown2, section) {
-  return linesOf(markdown2).slice(section.start - 1, section.end).join("\n").trimEnd();
-}
-function sectionContains(markdown2, parentSlug, childSlug) {
-  const parent = sectionRange(markdown2, parentSlug);
-  const child = sectionRange(markdown2, childSlug);
-  if (!parent || !child) return false;
-  return child.start >= parent.start && child.end <= parent.end;
-}
-
-// src/core/compile/rule.ts
-function fileOf(spec) {
-  return spec.anchor === null ? spec.ref : spec.ref.slice(0, spec.ref.length - spec.anchor.length - 1);
-}
-async function compileRule(input, context) {
-  const { data } = input;
-  const minimum = data.minimum_rulecast_version;
-  if (minimum !== void 0 && isOlder(VERSION2, minimum)) {
-    return `requires rulecast ${minimum} or newer (running ${VERSION2})`;
-  }
-  let detector = null;
-  let defaultStages = ["touch"];
-  if (data.detect) {
-    const [kind, rawConfig] = Object.entries(data.detect)[0];
-    const implementation = context.registry.get(kind);
-    if (!implementation) return `unknown detector "${kind}"`;
-    const parsed = await implementation.schema.safeParseAsync(rawConfig ?? {});
-    if (!parsed.success) return `detect.${kind}: ${formatZodError(parsed.error)}`;
-    detector = { kind, config: parsed.data, captures: implementation.captures(parsed.data) };
-    defaultStages = implementation.events(parsed.data);
-  }
-  const stages = data.stages ?? context.config.defaultStages ?? defaultStages;
-  if (detector) {
-    if (data.message === void 0) return "rules with detect need a message";
-    if (!stages.includes("edit") && !stages.includes("verify")) {
-      return "stages [touch] never run the detector: add edit or verify, or remove detect";
-    }
-    if (data.refuse_write) {
-      if (context.registry.get(detector.kind)?.guards !== true) {
-        return `refuse_write needs a detector that can judge a file before it is written; ${detector.kind} cannot`;
-      }
-      if (!stages.includes("edit")) return "refuse_write needs edit among the rule's stages";
-    }
-    const known = /* @__PURE__ */ new Set([...CORE_VARIABLES, ...detector.captures]);
-    const unknown = templateVariables(data.message).find((name) => !known.has(name));
-    if (unknown) return `unknown template variable "${unknown}"`;
-  } else {
-    if (data.refuse_write) return "refuse_write needs detect: there is nothing to refuse a write for";
-    if (stages.some((stage) => stage !== "touch")) return "rules without detect need stages: [touch]";
-    if (data.message !== void 0) return "message needs detect";
-    if (!data.context?.length) return "rules without detect need context";
-  }
-  const filter = compileFilter({
-    files: data.files ?? "",
-    exclude: data.exclude ?? "^$",
-    types: data.types ?? ["file"],
-    typesOr: data.types_or ?? [],
-    excludeTypes: data.exclude_types ?? []
-  });
-  if (typeof filter === "string") return filter;
-  const references = [];
-  for (const reference of data.context ?? []) {
-    let spec;
-    try {
-      spec = parseReference(reference, context.config.context.mode, input.contextRoot);
-    } catch (error) {
-      if (error instanceof ReferenceSyntaxError) return error.message;
-      throw error;
-    }
-    const text2 = await context.read(path11.resolve(input.contextRoot.dir, spec.path));
-    if (text2 === null) return `referenced file not found: ${fileOf(spec)}`;
-    if (spec.anchor !== null && !sectionRange(text2, spec.anchor)) {
-      return `anchor "#${spec.anchor}" not found in ${fileOf(spec)}`;
-    }
-    references.push(spec);
-  }
-  const { global } = context;
-  return {
-    id: data.alias ?? data.id,
-    name: data.name,
-    description: data.description ?? null,
-    source: input.source,
-    severity: data.severity ?? "error",
-    refuseWrite: data.refuse_write === true,
-    stages,
-    matches: (file) => global(file) && filter(file),
-    detector,
-    message: data.message ?? null,
-    context: references
-  };
-}
-
-// src/core/compile/project.ts
-function diagnosticText(diagnostic) {
-  const rule = diagnostic.rule ? ` (${diagnostic.rule})` : "";
-  return `${diagnostic.source}${rule}: ${diagnostic.message}`;
-}
-function createReader() {
-  const texts = /* @__PURE__ */ new Map();
-  return (file) => {
-    let text2 = texts.get(file);
-    if (!text2) {
-      text2 = readFile3(file, "utf8").catch((error) => {
-        if (isNotFound(error)) return null;
-        throw error;
-      });
-      texts.set(file, text2);
-    }
-    return text2;
-  };
-}
-function idOf(raw) {
-  const id = raw?.id;
-  return typeof id === "string" ? id : null;
-}
-function isBranchLike(rev) {
-  return !rev.includes(".") && !/^[0-9a-f]+$/i.test(rev);
-}
-function uniqueRules(compiled, diagnostics, message) {
-  const counts = /* @__PURE__ */ new Map();
-  for (const { rule } of compiled) counts.set(rule.id, (counts.get(rule.id) ?? 0) + 1);
-  const rules = [];
-  for (const { rule, source } of compiled) {
-    if (counts.get(rule.id) === 1) rules.push(rule);
-    else diagnostics.push({ source, rule: rule.id, message: message(rule.id), level: "error" });
-  }
-  return rules;
-}
-async function compile(options) {
-  const { root } = options;
-  const configFailure = (message, config2 = defaultConfig()) => ({
-    root,
-    config: config2,
-    rules: [],
-    diagnostics: [{ source: CONFIG_FILE, rule: null, message, level: "error" }]
-  });
-  const data = options.configData !== void 0 ? { ok: true, value: options.configData } : await readConfigData(root);
-  if (!data.ok) return configFailure(data.message);
-  const parsed = parseConfig(data.value);
-  if (!parsed.ok) return configFailure(parsed.message);
-  const config = parsed.value;
-  if (config.minimumRulecastVersion !== null && isOlder(VERSION2, config.minimumRulecastVersion)) {
-    return configFailure(`requires rulecast ${config.minimumRulecastVersion} or newer (running ${VERSION2})`, config);
-  }
-  const global = compileFilter({
-    files: config.files,
-    exclude: config.exclude,
-    types: [],
-    typesOr: [],
-    excludeTypes: []
-  });
-  if (typeof global === "string") return configFailure(global, config);
-  const diagnostics = [];
-  const compiled = [];
-  const context = { config, registry: options.registry, global, read: createReader() };
-  const project = { dir: root, label: null };
-  const error = (source, rule, message, hint) => diagnostics.push({ source, rule, message, level: "error", ...hint === void 0 ? {} : { hint } });
-  const add = async (input, source) => {
-    const result = await compileRule(input, context);
-    if (typeof result === "string") error(source, input.data.alias ?? input.data.id, result);
-    else compiled.push({ rule: result, source });
-  };
-  for (const [index, entry] of config.repos.entries()) {
-    if (entry.repo === "local") {
-      if (entry.rev !== void 0) {
-        error(CONFIG_FILE, null, `repos[${index}]: local repos take no rev`);
-        continue;
-      }
-      for (const raw of entry.rules) {
-        const rule = ruleSchema.safeParse(raw);
-        if (!rule.success) error(CONFIG_FILE, idOf(raw), formatZodError(rule.error));
-        else await add({ data: rule.data, source: "local", contextRoot: project }, CONFIG_FILE);
-      }
-      continue;
-    }
-    if (entry.rev === void 0) {
-      error(CONFIG_FILE, null, `repos[${index}] ${entry.repo}: rev is required`);
-      continue;
-    }
-    const source = `${entry.repo}@${entry.rev}`;
-    if (isBranchLike(entry.rev)) {
-      diagnostics.push({
-        source,
-        rule: null,
-        message: `rev "${entry.rev}" looks like a branch: pin a tag or a full commit SHA`,
-        level: "warning"
-      });
-    }
-    const checkout = await options.repos.checkout(entry.repo, entry.rev);
-    if (!checkout.ok) {
-      error(source, null, checkout.message, checkout.missing ? "rulecast install" : void 0);
-      continue;
-    }
-    const manifest = await readManifest(checkout.dir);
-    if (!manifest.ok) {
-      error(source, null, manifest.message);
-      continue;
-    }
-    const byId = /* @__PURE__ */ new Map();
-    for (const raw of manifest.value) {
-      const id = idOf(raw);
-      if (id !== null) byId.set(id, [...byId.get(id) ?? [], raw]);
-    }
-    const repoRoot = { dir: checkout.dir, label: checkout.label };
-    for (const raw of entry.rules) {
-      const override = overrideSchema.safeParse(raw);
-      if (!override.success) {
-        error(CONFIG_FILE, idOf(raw), formatZodError(override.error));
-        continue;
-      }
-      const { id } = override.data;
-      const candidates = byId.get(id) ?? [];
-      if (candidates.length !== 1) {
-        error(source, id, candidates.length === 0 ? "not in the manifest" : "defined more than once in the manifest");
-        continue;
-      }
-      const base = ruleSchema.safeParse(candidates[0]);
-      if (!base.success) {
-        error(source, id, `manifest: ${formatZodError(base.error)}`);
-        continue;
-      }
-      const data2 = { ...base.data, ...override.data };
-      const contextRoot = "context" in override.data ? project : repoRoot;
-      await add({ data: data2, source: checkout.label, contextRoot }, source);
-    }
-  }
-  const rules = uniqueRules(
-    compiled,
-    diagnostics,
-    (id) => `rule "${id}" is configured more than once: give one an alias`
-  );
-  return { root, config, rules, diagnostics };
-}
-async function compileManifest(dir, registry) {
-  const manifest = await readManifest(dir);
-  if (!manifest.ok) {
-    return {
-      rules: [],
-      diagnostics: [{ source: MANIFEST_FILE, rule: null, message: manifest.message, level: "error" }]
-    };
-  }
-  const diagnostics = [];
-  const compiled = [];
-  const context = { config: defaultConfig(), registry, global: () => true, read: createReader() };
-  for (const raw of manifest.value) {
-    const rule = ruleSchema.safeParse(raw);
-    if (!rule.success) {
-      diagnostics.push({ source: MANIFEST_FILE, rule: idOf(raw), message: formatZodError(rule.error), level: "error" });
-      continue;
-    }
-    const result = await compileRule({ data: rule.data, source: "local", contextRoot: { dir, label: null } }, context);
-    if (typeof result === "string") {
-      diagnostics.push({
-        source: MANIFEST_FILE,
-        rule: rule.data.alias ?? rule.data.id,
-        message: result,
-        level: "error"
-      });
-    } else compiled.push({ rule: result, source: MANIFEST_FILE });
-  }
-  const rules = uniqueRules(compiled, diagnostics, (id) => `rule "${id}" is defined more than once`);
-  return { rules, diagnostics };
-}
-
-// src/core/detection/check.ts
-function checkableKinds(project, registry) {
-  const kinds = /* @__PURE__ */ new Set();
-  for (const rule of project.rules) {
-    const kind = rule.detector?.kind;
-    if (kind !== void 0 && registry.get(kind)?.check !== void 0) kinds.add(kind);
-  }
-  return [...kinds];
-}
-async function checkDetectors(options) {
-  const { project, registry } = options;
-  const kinds = checkableKinds(project, registry);
-  const signal = AbortSignal.timeout(options.timeoutMs);
-  const perKind = await Promise.all(
-    kinds.map(async (kind) => {
-      const detector = registry.get(kind);
-      const rules = project.rules.filter((rule) => rule.detector?.kind === kind).map((rule) => ({ id: rule.id, config: rule.detector.config }));
-      try {
-        const results = await detector.check({
-          rules,
-          settings: options.settings,
-          env: options.env,
-          cwd: project.root,
-          signal
-        });
-        return results.map((result) => ({ kind, ...result }));
-      } catch (error) {
-        return [
-          {
-            kind,
-            what: kind,
-            level: "error",
-            detail: errorMessage(error),
-            rules: rules.map((rule) => rule.id)
-          }
-        ];
-      }
-    })
-  );
-  return perKind.flat();
-}
-
-// src/core/repos/fetch.ts
-import { randomUUID } from "crypto";
-import { existsSync as existsSync2 } from "fs";
-import { mkdir as mkdir2, rename, rm as rm2 } from "fs/promises";
-import path14 from "path";
-
-// src/core/git.ts
-import { execFile as execFile4 } from "child_process";
-import { promisify as promisify4 } from "util";
-var exec4 = promisify4(execFile4);
-var INHERITED = [
-  "GIT_DIR",
-  "GIT_WORK_TREE",
-  "GIT_INDEX_FILE",
-  "GIT_COMMON_DIR",
-  "GIT_OBJECT_DIRECTORY",
-  "GIT_ALTERNATE_OBJECT_DIRECTORIES",
-  "GIT_PREFIX"
-];
-function environment(extra) {
-  const env = { ...process.env, ...extra };
-  for (const name of INHERITED) delete env[name];
-  return env;
-}
-async function git(cwd, args, env) {
-  try {
-    const { stdout } = await exec4("git", args, {
-      cwd,
-      maxBuffer: 64 * 1024 * 1024,
-      env: environment(env)
-    });
-    return { ok: true, stdout };
-  } catch (error) {
-    const failure = error;
-    if (failure.code === "ENOENT") throw new Error("git is not installed or not on PATH");
-    if (typeof failure.code === "number") return { ok: false, stderr: failure.stderr ?? "" };
-    throw error;
-  }
-}
-async function headCommit(cwd) {
-  const result = await git(cwd, ["rev-parse", "--verify", "-q", "HEAD"]);
-  return result.ok ? result.stdout.trim() : null;
-}
-async function fileAtCommit(cwd, commit, file) {
-  const result = await git(cwd, ["show", `${commit}:./${file}`]);
-  return result.ok ? result.stdout : null;
-}
-async function mergeBase(cwd, ref, other = "HEAD") {
-  const result = await git(cwd, ["merge-base", other, ref]);
-  if (!result.ok) throw new Error(`cannot find merge base with ${ref}: ${result.stderr.trim()}`);
-  return result.stdout.trim();
-}
-async function changedFilesSince(cwd, commit) {
-  const diff = await git(cwd, ["diff", "--name-only", "--relative", "--diff-filter=d", commit]);
-  if (!diff.ok) throw new Error(`git diff against ${commit} failed: ${diff.stderr.trim()}`);
-  const untracked = await git(cwd, ["ls-files", "--others", "--exclude-standard"]);
-  if (!untracked.ok) throw new Error(`git ls-files failed: ${untracked.stderr.trim()}`);
-  const files = [...diff.stdout.split("\n"), ...untracked.stdout.split("\n")].filter(Boolean);
-  return [...new Set(files)].sort();
-}
-function nulSeparated(stdout) {
-  return [...new Set(stdout.split("\0").filter(Boolean))].sort();
-}
-async function allFiles(cwd) {
-  const result = await git(cwd, ["ls-files", "-z", "--cached", "--others", "--exclude-standard"]);
-  if (!result.ok) throw new Error(`git ls-files failed: ${result.stderr.trim()}`);
-  return nulSeparated(result.stdout);
-}
-async function stagedFiles(cwd) {
-  const result = await git(cwd, ["diff", "--cached", "--name-only", "-z", "--relative", "--diff-filter=d"]);
-  if (!result.ok) throw new Error(`git diff --cached failed: ${result.stderr.trim()}`);
-  return nulSeparated(result.stdout);
-}
-async function changedFilesBetween(cwd, from, to) {
-  const result = await git(cwd, ["diff", "--name-only", "-z", "--relative", "--diff-filter=d", from, to]);
-  if (!result.ok) throw new Error(`git diff ${from} ${to} failed: ${result.stderr.trim()}`);
-  return nulSeparated(result.stdout);
-}
-
-// src/core/session/lock.ts
-import { mkdir, rm, stat } from "fs/promises";
-import path12 from "path";
-var LockTimeoutError = class extends Error {
-};
-var DEFAULTS = { waitMs: 2e3, staleMs: 5e3, retryMs: 20 };
-function isAlreadyExists(error) {
-  return error instanceof Error && error.code === "EEXIST";
-}
-async function withLock(dir, fn, options = DEFAULTS) {
-  const lock = path12.join(dir, ".lock");
-  await mkdir(dir, { recursive: true });
-  const started = Date.now();
-  for (; ; ) {
-    try {
-      await mkdir(lock);
-      break;
-    } catch (error) {
-      if (!isAlreadyExists(error)) throw error;
-    }
-    try {
-      const { mtimeMs } = await stat(lock);
-      if (Date.now() - mtimeMs > options.staleMs) {
-        await rm(lock, { recursive: true, force: true });
-        continue;
-      }
-    } catch (error) {
-      if (!isNotFound(error)) throw error;
-      continue;
-    }
-    if (Date.now() - started > options.waitMs)
-      throw new LockTimeoutError(`could not lock ${dir} within ${options.waitMs} ms`);
-    await new Promise((resolve) => setTimeout(resolve, options.retryMs));
-  }
-  try {
-    return await fn();
-  } finally {
-    await rm(lock, { recursive: true, force: true });
-  }
-}
-
-// src/core/repos/layout.ts
-import { createHash as createHash3 } from "crypto";
-import path13 from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
-var SCHEME = /^[a-z][a-z0-9+.-]*:\/\//i;
-var SCP_LIKE = /^[^@/\s]+@([^:/\s]+):(.+)$/;
-function segmentsOf(repoPath) {
-  return repoPath.replace(/\/+$/, "").replace(/\.git$/, "").split("/").filter(Boolean);
-}
-function localName(file) {
-  return path13.basename(file.replace(/[\\/]+$/, "")).replace(/\.git$/, "");
-}
-function parseUrl(url) {
-  if (SCHEME.test(url)) {
-    const parsed = new URL(url);
-    if (parsed.protocol === "file:") return { kind: "local", name: localName(fileURLToPath2(parsed)) };
-    return { kind: "hosted", host: parsed.hostname, segments: segmentsOf(decodeURIComponent(parsed.pathname)) };
-  }
-  const scp = url.match(SCP_LIKE);
-  if (scp) return { kind: "hosted", host: scp[1], segments: segmentsOf(scp[2]) };
-  return { kind: "local", name: localName(url) };
-}
-function safeSegment(value) {
-  const segment = value.replace(/[^A-Za-z0-9._-]/g, "_");
-  return /^\.*$/.test(segment) ? `_${segment}` : segment;
-}
-function repoName(url) {
-  const parsed = parseUrl(url);
-  return parsed.kind === "hosted" ? parsed.segments.join("/") || parsed.host : parsed.name;
-}
-function repoSlug(url) {
-  const parsed = parseUrl(url);
-  if (parsed.kind === "hosted") return safeSegment([parsed.host, ...parsed.segments].join("_"));
-  const hash = createHash3("sha256").update(url).digest("hex").slice(0, 8);
-  return safeSegment(`local_${parsed.name}_${hash}`);
-}
-function repoDir(home, url, rev) {
-  return path13.join(home, "repos", repoSlug(url), safeSegment(rev));
-}
-function repoLabel(url, rev) {
-  return `${repoName(url)}@${rev}`;
-}
-
-// src/core/repos/fetch.ts
-var RepoFetchError = class extends Error {
-};
-var NO_PROMPT = { GIT_TERMINAL_PROMPT: "0" };
-var FETCH_LOCK = { waitMs: 12e4, staleMs: 5 * 6e4, retryMs: 50 };
-async function run(cwd, args) {
-  const result = await git(cwd, args, NO_PROMPT);
-  if (!result.ok) throw new RepoFetchError(result.stderr.trim() || `git ${args[0]} failed`);
-}
-async function fetchCheckout(url, rev, into) {
-  await mkdir2(into, { recursive: true });
-  await run(into, ["init", "-q"]);
-  await run(into, ["fetch", "-q", "--depth", "1", url, rev]);
-  await run(into, ["-c", "advice.detachedHead=false", "checkout", "-q", "FETCH_HEAD"]);
-  await rm2(path14.join(into, ".git"), { recursive: true, force: true });
-}
-function cachedRepo(home, url, rev) {
-  const dir = repoDir(home, url, rev);
-  return existsSync2(dir) ? dir : null;
-}
-async function ensureRepo(home, url, rev) {
-  const dir = repoDir(home, url, rev);
-  if (existsSync2(dir)) return dir;
-  const parent = path14.dirname(dir);
-  await withLock(
-    parent,
-    async () => {
-      if (existsSync2(dir)) return;
-      const temp = path14.join(parent, `.tmp-${randomUUID()}`);
-      try {
-        await fetchCheckout(url, rev, temp);
-        await rename(temp, dir);
-      } finally {
-        await rm2(temp, { recursive: true, force: true });
-      }
-    },
-    FETCH_LOCK
-  );
-  return dir;
-}
-
-// src/core/repos/provider.ts
-function cachedRepos(home) {
-  return {
-    async checkout(url, rev) {
-      const dir = cachedRepo(home, url, rev);
-      if (dir === null) return { ok: false, missing: true, message: "not in the cache" };
-      return { ok: true, dir, label: repoLabel(url, rev) };
-    }
-  };
-}
-function fetchingRepos(home) {
-  return {
-    async checkout(url, rev) {
-      try {
-        return { ok: true, dir: await ensureRepo(home, url, rev), label: repoLabel(url, rev) };
-      } catch (error) {
-        return { ok: false, missing: false, message: `fetch failed: ${errorMessage(error)}` };
-      }
-    }
-  };
-}
-function fixedRepo(dir, label) {
-  return {
-    async checkout() {
-      return { ok: true, dir, label };
-    }
-  };
-}
-
-// src/core/baseline/changes.ts
-import { diffArrays } from "diff";
-function changedLines(before, after) {
-  const ranges = [];
-  const mark = (start, end) => {
-    const previous = ranges.at(-1);
-    if (previous && start <= previous[1] + 1) previous[1] = Math.max(previous[1], end);
-    else ranges.push([start, end]);
-  };
-  let line = 1;
-  for (const part of diffArrays(Array.from(before), Array.from(after))) {
-    const count = part.count ?? part.value.length;
-    if (part.added) {
-      mark(line, line + count - 1);
-      line += count;
-    } else if (part.removed) {
-      if (after.length > 0) {
-        const at = Math.min(line, after.length);
-        mark(at, at);
-      }
-    } else {
-      line += count;
-    }
-  }
-  return ranges;
-}
-
-// src/core/baseline/hash.ts
-var OFFSET_BASIS = 2166136261;
-var PRIME = 16777619;
-function fnv1a(text2) {
-  let hash = OFFSET_BASIS;
-  for (let i = 0; i < text2.length; i++) {
-    hash ^= text2.charCodeAt(i);
-    hash = Math.imul(hash, PRIME);
-  }
-  return hash >>> 0;
-}
-function hashLines(text2) {
-  const lines = text2.split(/\r?\n/);
-  const hashes = new Uint32Array(lines.length);
-  lines.forEach((line, index) => {
-    hashes[index] = fnv1a(line.trim());
-  });
-  return hashes;
-}
-function hashOfHashes(lines) {
-  let hash = OFFSET_BASIS;
-  for (const value of lines) {
-    for (let shift = 0; shift < 32; shift += 8) {
-      hash ^= value >>> shift & 255;
-      hash = Math.imul(hash, PRIME);
-    }
-  }
-  return hash >>> 0;
-}
-function snapshotOf(text2) {
-  const lines = hashLines(text2);
-  return { fileHash: hashOfHashes(lines), lines };
-}
-
-// src/core/baseline/baseline.ts
-async function computeChanges(root, files, sources) {
-  const changes = /* @__PURE__ */ new Map();
-  for (const file of files) {
-    if (!sources.snapshots.has(file) && !sources.fallbackCommit) continue;
-    let before = sources.snapshots.get(file) ?? null;
-    if (!before && sources.fallbackCommit) {
-      const text2 = await fileAtCommit(root, sources.fallbackCommit, file);
-      before = text2 === null ? null : snapshotOf(text2);
-    }
-    if (!before) continue;
-    const current = await readSourceFile(root, file);
-    if (current === null) continue;
-    const after = snapshotOf(current);
-    changes.set(file, {
-      changedLines: after.fileHash === before.fileHash ? [] : changedLines(before.lines, after.lines)
-    });
-  }
-  return changes;
-}
-function isNew(match, changes) {
-  const change = changes.get(match.file);
-  if (!change) return true;
-  return change.changedLines.some(([start, end]) => match.line <= end && match.endLine >= start);
-}
-
-// src/core/baseline/store.ts
-import path16 from "path";
-
-// src/core/jsonl.ts
-import { mkdir as mkdir3, open, readFile as readFile4 } from "fs/promises";
-import path15 from "path";
-var CorruptStoreError = class extends Error {
-};
-async function appendRecords(file, records) {
-  if (records.length === 0) return;
-  await mkdir3(path15.dirname(file), { recursive: true });
-  const handle = await open(file, "a+");
-  try {
-    await dropPartialRecord(handle);
-    await handle.appendFile(records.map((record) => `${JSON.stringify(record)}
-`).join(""));
-  } finally {
-    await handle.close();
-  }
-}
-var TAIL_CHUNK = 64 * 1024;
-async function dropPartialRecord(handle) {
-  const { size } = await handle.stat();
-  let end = size;
-  while (end > 0) {
-    const start = Math.max(0, end - TAIL_CHUNK);
-    const chunk = Buffer.alloc(end - start);
-    await handle.read(chunk, 0, chunk.length, start);
-    const newline = chunk.lastIndexOf(10);
-    if (newline !== -1) {
-      end = start + newline + 1;
-      break;
-    }
-    end = start;
-  }
-  if (end < size) await handle.truncate(end);
-}
-async function readRecords(file) {
-  let text2;
-  try {
-    text2 = await readFile4(file, "utf8");
-  } catch (error) {
-    if (isNotFound(error)) return [];
-    throw error;
-  }
-  const lines = text2.split("\n");
-  const records = [];
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i];
-    if (line.trim() === "") continue;
-    try {
-      records.push(JSON.parse(line));
-    } catch {
-      if (i === lines.length - 1) break;
-      throw new CorruptStoreError(`${file}: unparseable record on line ${i + 1}`);
-    }
-  }
-  return records;
-}
-
-// src/core/baseline/store.ts
-function storeFile(sessionDir2) {
-  return path16.join(sessionDir2, "baseline.jsonl");
-}
-function encodeLines(lines) {
-  return Buffer.from(lines.buffer, lines.byteOffset, lines.byteLength).toString("base64");
-}
-function decodeLines(encoded) {
-  const bytes = Buffer.from(encoded, "base64");
-  const aligned = new Uint8Array(bytes.length);
-  aligned.set(bytes);
-  return new Uint32Array(aligned.buffer);
-}
-function startRecord(commit) {
-  return { t: "start", commit };
-}
-function snapshotRecord(file, snapshot) {
-  return { t: "snapshot", file, fileHash: snapshot.fileHash, lines: encodeLines(snapshot.lines) };
-}
-async function appendBaseline(sessionDir2, records) {
-  await appendRecords(storeFile(sessionDir2), records);
-}
-async function readBaseline(sessionDir2) {
-  const state = { started: false, startCommit: null, snapshots: /* @__PURE__ */ new Map() };
-  for (const record of await readRecords(storeFile(sessionDir2))) {
-    if (record.t === "start" && !state.started) {
-      state.started = true;
-      state.startCommit = record.commit;
-    } else if (record.t === "snapshot" && !state.snapshots.has(record.file)) {
-      state.snapshots.set(record.file, { fileHash: record.fileHash, lines: decodeLines(record.lines) });
-    }
-  }
-  return state;
-}
-
-// src/core/delivery/persist.ts
-import { mkdirSync as mkdirSync2, readdirSync, rmSync, writeFileSync as writeFileSync2 } from "fs";
-import path17 from "path";
-var KEEP = 3;
-var UNLIMITED = { maxMatchesPerRule: Number.MAX_SAFE_INTEGER };
-var safeSegment2 = (value) => value.replace(/[^A-Za-z0-9._-]/g, "_");
-function markdown(delivery, now) {
-  const body = renderAgentText({ ...delivery, overflowPath: null }, UNLIMITED);
-  return [
-    `# rulecast delivery \u2014 ${now.toISOString()}`,
-    "",
-    "Too much to fit in one hook message. Everything rulecast found for the files in this session,",
-    "with the doc section each rule cites:",
-    "",
-    body,
-    ""
-  ].join("\n");
-}
-function writeOverflow(stateDir, session, delivery, now = /* @__PURE__ */ new Date()) {
-  const prefix = safeSegment2(session ?? "no-session");
-  const dir = path17.join(stateDir, "deliveries");
-  const file = path17.join(dir, `${prefix}-${now.toISOString().replace(/[:.]/g, "-")}.md`);
-  try {
-    mkdirSync2(dir, { recursive: true });
-    writeFileSync2(file, markdown(delivery, now));
-    const mine = readdirSync(dir).filter((name) => name.startsWith(`${prefix}-`)).sort();
-    for (const old of mine.slice(0, Math.max(0, mine.length - KEEP))) rmSync(path17.join(dir, old), { force: true });
-    return file;
-  } catch {
-    return null;
-  }
-}
-
-// src/core/delivery/resolve.ts
-function createReferenceResolver(root) {
-  const texts = /* @__PURE__ */ new Map();
-  const read = (path21) => {
-    let text2 = texts.get(path21);
-    if (!text2) {
-      text2 = readSourceFile(root, path21);
-      texts.set(path21, text2);
-    }
-    return text2;
-  };
-  const contentOf = async (path21, anchor) => {
-    const text2 = await read(path21);
-    if (text2 === null) return null;
-    if (anchor === null) return text2.trimEnd();
-    const section = sectionRange(text2, anchor);
-    return section ? sectionText(text2, section) : null;
-  };
-  return {
-    async resolve(spec) {
-      const content = await contentOf(spec.path, spec.anchor);
-      if (content === null) return { spec, found: false };
-      return { spec, found: true, content, hash: fnv1a(content), bytes: Buffer.byteLength(content) };
-    },
-    async currentHash(path21, anchor) {
-      const content = await contentOf(path21, anchor);
-      return content === null ? null : fnv1a(content);
-    },
-    async contains(path21, parent, child) {
-      if (parent === null) return true;
-      if (child === null) return false;
-      const text2 = await read(path21);
-      return text2 !== null && sectionContains(text2, parent, child);
-    }
-  };
-}
-
-// src/core/detection/budget.ts
-function applyFileBudget(kind, selections, maxFiles, recent) {
-  const ofKind = selections.filter((selection) => selection.rule.detector?.kind === kind);
-  const files = [...new Set(ofKind.flatMap((selection) => selection.files))];
-  if (files.length <= maxFiles) return { selections, skipped: [] };
-  const rank = new Map(recent.map((file, index) => [file, index]));
-  const ordered = [...files].sort((a, b) => (rank.get(a) ?? recent.length) - (rank.get(b) ?? recent.length));
-  const keep = new Set(ordered.slice(0, maxFiles));
-  return {
-    selections: selections.map(
-      (selection) => selection.rule.detector?.kind === kind ? { ...selection, files: selection.files.filter((file) => keep.has(file)) } : selection
-    ).filter((selection) => selection.files.length > 0),
-    skipped: ordered.slice(maxFiles)
-  };
-}
-
-// src/core/detection/cache.ts
-import { createHash as createHash4, randomUUID as randomUUID2 } from "crypto";
-import { mkdir as mkdir4, readFile as readFile5, rename as rename2, writeFile } from "fs/promises";
-import path18 from "path";
-function memoryCache() {
-  const values = /* @__PURE__ */ new Map();
-  return {
-    async get(key) {
-      return values.has(key) ? structuredClone(values.get(key)) : void 0;
-    },
-    async set(key, value) {
-      values.set(key, structuredClone(value));
-    }
-  };
-}
-function diskCache(dir) {
-  const fileFor = (key) => path18.join(dir, `${createHash4("sha256").update(key).digest("hex")}.json`);
-  return {
-    async get(key) {
-      try {
-        return JSON.parse(await readFile5(fileFor(key), "utf8"));
-      } catch (error) {
-        if (isNotFound(error)) return void 0;
-        throw error;
-      }
-    },
-    async set(key, value) {
-      await mkdir4(dir, { recursive: true });
-      const target = fileFor(key);
-      const temp = `${target}.${randomUUID2()}.tmp`;
-      await writeFile(temp, JSON.stringify(value));
-      await rename2(temp, target);
-    }
-  };
-}
-function detectorCacheDir(stateDir, kind) {
-  return path18.join(stateDir, "cache", kind);
-}
-
-// src/core/detection/run.ts
-var TIMED_OUT = /* @__PURE__ */ Symbol("timed out");
-async function runDetection(input) {
-  const output = { findings: [], errors: [], timedOut: [] };
-  const byKind = /* @__PURE__ */ new Map();
-  for (const selection of input.selections) {
-    const kind = selection.rule.detector.kind;
-    byKind.set(kind, [...byKind.get(kind) ?? [], selection]);
-  }
-  const controller = new AbortController();
-  const deadline = new Promise((resolve) => {
-    controller.signal.addEventListener("abort", () => resolve(TIMED_OUT), { once: true });
-  });
-  const timer = setTimeout(() => controller.abort(), input.timeoutMs);
-  const perKind = await Promise.all(
-    [...byKind].map(async ([kind, selections]) => {
-      const detector = input.registry.get(kind);
-      if (!detector) return { status: "error", kind, selections, message: `detector "${kind}" is not registered` };
-      try {
-        const rules = await Promise.all(
-          selections.map(async ({ rule, files }) => ({
-            id: rule.id,
-            config: rule.detector.config,
-            files,
-            context: await input.contextFor(rule)
-          }))
-        );
-        const result = await Promise.race([
-          detector.run({
-            event: input.event,
-            rules,
-            read: input.read,
-            changes: input.changes,
-            cache: input.cacheFor(kind),
-            settings: input.settings,
-            cwd: input.root,
-            signal: controller.signal
-          }),
-          deadline
-        ]);
-        if (result === TIMED_OUT) return { status: "timedOut", kind, selections };
-        return { status: "ok", kind, selections, result };
-      } catch (error) {
-        if (controller.signal.aborted) return { status: "timedOut", kind, selections };
-        return { status: "error", kind, selections, message: errorMessage(error) };
-      }
-    })
-  );
-  clearTimeout(timer);
-  for (const outcome of perKind) {
-    const ids = outcome.selections.map((selection) => selection.rule.id);
-    if (outcome.status === "timedOut") {
-      output.timedOut.push({ kind: outcome.kind, rules: ids });
-      continue;
-    }
-    if (outcome.status === "error") {
-      output.errors.push({ kind: outcome.kind, rules: ids, message: outcome.message });
-      continue;
-    }
-    const result = outcome.result;
-    const rulesById = new Map(outcome.selections.map((selection) => [selection.rule.id, selection.rule]));
-    const stray = result.findings.find((finding) => !rulesById.has(finding.rule));
-    const wholeRun = result.errors.find((error) => error.rule === null);
-    if (stray || wholeRun) {
-      const message = stray ? `detector reported unknown rule "${stray.rule}"` : wholeRun.message;
-      output.errors.push({ kind: outcome.kind, rules: ids, message });
-      continue;
-    }
-    const failed = /* @__PURE__ */ new Map();
-    for (const error of result.errors) failed.set(error.rule, error.message);
-    for (const finding of result.findings) {
-      const rule = rulesById.get(finding.rule);
-      const missing = rule.detector.captures.find((name) => typeof finding.match.captures[name] !== "string");
-      if (missing && !failed.has(rule.id)) failed.set(rule.id, `match is missing declared capture "${missing}"`);
-    }
-    for (const [rule, message] of failed) output.errors.push({ kind: outcome.kind, rules: [rule], message });
-    for (const finding of result.findings) {
-      if (!failed.has(finding.rule)) output.findings.push({ rule: rulesById.get(finding.rule), match: finding.match });
-    }
-  }
-  return output;
-}
-
-// src/core/detection/select.ts
-function selectDetectorRules(rules, event, files, disabled) {
-  return rules.filter((rule) => rule.detector !== null && rule.stages.includes(event) && !disabled.has(rule.id)).map((rule) => ({ rule, files: files.filter((file) => rule.matches(file)) })).filter((selection) => selection.files.length > 0);
-}
-function selectTouchRules(rules, files, touched, disabled) {
-  return rules.filter(
-    (rule) => rule.stages.includes("touch") && !touched.has(rule.id) && !disabled.has(rule.id) && files.some((file) => rule.matches(file))
-  );
-}
-
-// src/core/detection/proposal.ts
-function propose(current, intent) {
-  if (intent.content !== void 0) {
-    return { content: intent.content, inserts: intent.content === "" ? [] : [[0, intent.content.length]] };
-  }
-  if (intent.edit === void 0 || current === null) return null;
-  const { find, replace, all } = intent.edit;
-  if (find === "") return null;
-  const first = current.indexOf(find);
-  if (first === -1) return null;
-  if (!all && current.indexOf(find, first + find.length) !== -1) return null;
-  let content = "";
-  let rest = current;
-  const inserts = [];
-  for (; ; ) {
-    const at = rest.indexOf(find);
-    if (at === -1) break;
-    const start = content.length + at;
-    content += rest.slice(0, at) + replace;
-    if (replace !== "") inserts.push([start, start + replace.length]);
-    rest = rest.slice(at + find.length);
-    if (!all) break;
-  }
-  return { content: content + rest, inserts };
-}
-function isInserted(proposal, match, detector) {
-  if (detector === "path") return true;
-  const starts = lineStarts(proposal.content);
-  const lineStart = starts[match.line - 1];
-  if (lineStart === void 0) return false;
-  const start = lineStart + match.column - 1;
-  const end = start + match.text.length;
-  return proposal.inserts.some(([from, to]) => start < to && end > from);
-}
-
-// src/core/session/decide.ts
-import path19 from "path";
-
-// src/core/session/state.ts
-function preexistingKey(rule, file) {
-  return `${rule} ${file}`;
-}
-var refusalKey = preexistingKey;
-function emptyWork() {
-  return { edited: [], stopBlocks: /* @__PURE__ */ new Map(), refusals: /* @__PURE__ */ new Map(), disabled: /* @__PURE__ */ new Map(), accessed: /* @__PURE__ */ new Map() };
-}
-function emptyContext() {
-  return { delivered: [], touched: /* @__PURE__ */ new Set(), preexisting: /* @__PURE__ */ new Set(), warned: /* @__PURE__ */ new Set() };
-}
-function foldWork(records) {
-  const state = emptyWork();
-  for (const record of records) {
-    switch (record.t) {
-      case "edited":
-        state.edited = [...state.edited.filter((file) => file !== record.file), record.file];
-        break;
-      case "accessed": {
-        const files = state.accessed.get(record.agent) ?? [];
-        state.accessed.set(record.agent, [...files.filter((file) => file !== record.file), record.file]);
-        break;
-      }
-      case "stopBlock":
-        state.stopBlocks.set(record.agent, (state.stopBlocks.get(record.agent) ?? 0) + 1);
-        break;
-      case "refused": {
-        const key = refusalKey(record.rule, record.file);
-        state.refusals.set(key, (state.refusals.get(key) ?? 0) + 1);
-        break;
-      }
-      case "prompt":
-        state.stopBlocks.delete(record.agent);
-        break;
-      case "disabled":
-        if (!state.disabled.has(record.rule)) state.disabled.set(record.rule, record.reason);
-        break;
-    }
-  }
-  return state;
-}
-function foldContext(records) {
-  let state = emptyContext();
-  for (const record of records) {
-    switch (record.t) {
-      case "reset":
-        state = emptyContext();
-        break;
-      case "delivered":
-        state.delivered.push({ path: record.path, anchor: record.anchor, hash: record.hash });
-        break;
-      case "touched":
-        state.touched.add(record.rule);
-        break;
-      case "preexisting":
-        state.preexisting.add(preexistingKey(record.rule, record.file));
-        break;
-      case "warned":
-        state.warned.add(record.key);
-        break;
-    }
-  }
-  return state;
-}
-
-// src/core/session/decide.ts
-var ITEM_OVERHEAD = 64;
-var HEADER_OVERHEAD = 128;
-var OVERFLOW_NOTICE = 256;
-var REFERENCE_OVERHEAD = 96;
-function locationOf2(spec) {
-  return path19.isAbsolute(spec.path) ? { location: spec.path } : {};
-}
-function capturesFor(rule, match) {
-  const names = templateBindings(rule.message ?? "");
-  if (names.length === 0) return void 0;
-  const values = {};
-  for (const name of names) {
-    const value = name === "text" ? match.text : match.captures[name];
-    if (value !== void 0) values[name] = value;
-  }
-  return values;
-}
-function renderFindings(findings) {
-  const merged = /* @__PURE__ */ new Map();
-  for (const { rule, match } of findings) {
-    const message = renderTemplate(rule.message ?? "", {
-      ...match.captures,
-      file: match.file,
-      line: String(match.line),
-      column: String(match.column),
-      text: match.text,
-      rule: rule.id
-    });
-    const key = `${rule.id} ${match.file} ${message}`;
-    const existing = merged.get(key);
-    if (existing) existing.count++;
-    else
-      merged.set(key, {
-        rule: rule.id,
-        severity: rule.severity,
-        status: "new",
-        file: match.file,
-        line: match.line,
-        column: match.column,
-        message,
-        count: 1,
-        captures: capturesFor(rule, match)
-      });
-  }
-  return [...merged.values()].sort(
-    (a, b) => Number(a.severity === "warning") - Number(b.severity === "warning") || (a.rule < b.rule ? -1 : a.rule > b.rule ? 1 : 0) || (a.file < b.file ? -1 : a.file > b.file ? 1 : 0) || a.line - b.line
-  );
-}
-function referencesInOrder(rules) {
-  const seen = /* @__PURE__ */ new Set();
-  const specs = [];
-  for (const rule of rules) {
-    for (const spec of rule.context) {
-      if (seen.has(spec.ref)) continue;
-      seen.add(spec.ref);
-      specs.push(spec);
-    }
-  }
-  return specs;
-}
-async function isCovered(spec, delivered, resolver) {
-  for (const entry of delivered) {
-    if (entry.path !== spec.path) continue;
-    if (!await resolver.contains(spec.path, entry.anchor, spec.anchor)) continue;
-    if (await resolver.currentHash(entry.path, entry.anchor) === entry.hash) return true;
-  }
-  return false;
-}
-async function decide(input) {
-  const delivery = emptyDelivery();
-  const work = [];
-  const context = [];
-  const fresh = input.findings.filter((finding) => finding.status === "new");
-  delivery.findings = renderFindings(fresh);
-  const rulesById = new Map(fresh.map(({ rule }) => [rule.id, rule]));
-  for (const { rule } of fresh) if (rule.message !== null) delivery.templates[rule.id] = rule.message;
-  const summaries = /* @__PURE__ */ new Map();
-  for (const { rule, match, status } of input.findings) {
-    if (status !== "preexisting") continue;
-    const key = preexistingKey(rule.id, match.file);
-    if (input.context.preexisting.has(key)) continue;
-    const summary = summaries.get(key) ?? { rule: rule.id, file: match.file, count: 0 };
-    summary.count++;
-    summaries.set(key, summary);
-  }
-  delivery.preexistingSummary = [...summaries.values()];
-  for (const warning of input.warnings) {
-    if (input.context.warned.has(warning.key)) continue;
-    delivery.warnings.push(warning.text);
-    context.push({ t: "warned", key: warning.key });
-  }
-  delivery.touches = input.touches.map((rule) => rule.id);
-  for (const rule of input.touches) context.push({ t: "touched", rule: rule.id });
-  const delivered = [...input.context.delivered];
-  if (input.agentRead !== null) {
-    const hash = await input.resolver.currentHash(input.agentRead, null);
-    if (hash !== null) {
-      delivered.push({ path: input.agentRead, anchor: null, hash });
-      context.push({ t: "delivered", path: input.agentRead, anchor: null, hash });
-    }
-  }
-  const ruleOrder = [...new Map(fresh.map((finding) => [finding.rule.id, finding.rule])).values(), ...input.touches];
-  const candidates = [];
-  for (const spec of referencesInOrder(ruleOrder)) {
-    const resolved = await input.resolver.resolve(spec);
-    if (!resolved.found) {
-      delivery.references.push({ ref: spec.ref, state: "missing" });
-    } else if (await isCovered(spec, delivered, input.resolver)) {
-      delivery.references.push({ ref: spec.ref, state: "pointer" });
-    } else if (spec.mode === "read") {
-      delivery.references.push({ ref: spec.ref, state: "read", reason: "mode", ...locationOf2(spec) });
-    } else if (resolved.bytes > input.maxBytes) {
-      delivery.references.push({ ref: spec.ref, state: "read", reason: "tooLarge", ...locationOf2(spec) });
-    } else {
-      candidates.push({ index: delivery.references.length, resolved });
-      delivery.references.push({ ref: spec.ref, state: "full", content: resolved.content });
-    }
-  }
-  const limit = input.maxContextChars;
-  const render = { maxMatchesPerRule: input.maxMatchesPerRule };
-  const complete = {
-    ...delivery,
-    findings: [...delivery.findings],
-    preexistingSummary: [...delivery.preexistingSummary],
-    references: [...delivery.references],
-    omitted: { findings: [], rules: 0, preexisting: 0 }
-  };
-  const byRule = /* @__PURE__ */ new Map();
-  for (const finding of delivery.findings) byRule.set(finding.rule, [...byRule.get(finding.rule) ?? [], finding]);
-  let used = HEADER_OVERHEAD + delivery.warnings.reduce((sum, warning) => sum + warning.length + ITEM_OVERHEAD, 0);
-  const fits = (size) => limit === null || used + size <= limit;
-  const kept = /* @__PURE__ */ new Map();
-  const lineCost = (ref) => ref.length + REFERENCE_OVERHEAD;
-  const resolvedRefs = new Set(delivery.references.map((reference) => reference.ref));
-  const charged = /* @__PURE__ */ new Set();
-  const orphaned = /* @__PURE__ */ new Set();
-  const floorWithin = (cap) => {
-    const spent = { chars: 0, kept: /* @__PURE__ */ new Map(), refs: /* @__PURE__ */ new Set(), dropped: 0 };
-    const uncharged = (rule) => [
-      ...new Set(rule.context.map((spec) => spec.ref).filter((ref) => resolvedRefs.has(ref) && !spent.refs.has(ref)))
-    ];
-    for (const [id, findings] of byRule) {
-      const rule = rulesById.get(id);
-      const refs = rule === void 0 ? [] : uncharged(rule);
-      const size = measureRuleBlock(id, [findings[0]], delivery.templates[id], render) + refs.reduce((sum, ref) => sum + lineCost(ref), 0);
-      if (used + spent.chars + size > cap) {
-        spent.dropped++;
-        continue;
-      }
-      spent.chars += size;
-      for (const ref of refs) spent.refs.add(ref);
-      spent.kept.set(id, [findings[0]]);
-    }
-    for (const touch of input.touches) {
-      for (const ref of uncharged(touch)) {
-        spent.chars += lineCost(ref);
-        spent.refs.add(ref);
-      }
-    }
-    return spent;
-  };
-  if (limit !== null) {
-    let floor = floorWithin(limit);
-    if (floor.dropped > 0) floor = floorWithin(limit - OVERFLOW_NOTICE);
-    used += floor.chars + (floor.dropped > 0 ? OVERFLOW_NOTICE : 0);
-    delivery.omitted.rules = floor.dropped;
-    for (const [id, findings] of floor.kept) kept.set(id, findings);
-    for (const ref of floor.refs) charged.add(ref);
-    for (const ref of resolvedRefs) if (!charged.has(ref)) orphaned.add(ref);
-  }
-  for (const { index, resolved } of candidates) {
-    const size = resolved.content.length;
-    if (orphaned.has(resolved.spec.ref)) continue;
-    if (!fits(size)) {
-      delivery.references[index] = {
-        ref: resolved.spec.ref,
-        state: "read",
-        reason: "budget",
-        ...locationOf2(resolved.spec)
-      };
-      continue;
-    }
-    used += size;
-    context.push({ t: "delivered", path: resolved.spec.path, anchor: resolved.spec.anchor, hash: resolved.hash });
-  }
-  const summariesKept = [];
-  for (const summary of delivery.preexistingSummary) {
-    if (!fits(summary.rule.length + summary.file.length + ITEM_OVERHEAD)) {
-      delivery.omitted.preexisting++;
-      continue;
-    }
-    used += summary.rule.length + summary.file.length + ITEM_OVERHEAD;
-    summariesKept.push(summary);
-    context.push({ t: "preexisting", rule: summary.rule, file: summary.file });
-  }
-  delivery.preexistingSummary = summariesKept;
-  if (orphaned.size > 0) delivery.references = delivery.references.filter((one) => !orphaned.has(one.ref));
-  if (limit !== null) {
-    for (let added = true; added; ) {
-      added = false;
-      for (const [rule, findings] of byRule) {
-        const shown = kept.get(rule);
-        if (shown === void 0 || shown.length >= Math.min(findings.length, input.maxMatchesPerRule)) continue;
-        const template = delivery.templates[rule];
-        const delta = measureRuleBlock(rule, [...shown, findings[shown.length]], template, render) - measureRuleBlock(rule, shown, template, render);
-        if (!fits(delta)) continue;
-        used += delta;
-        shown.push(findings[shown.length]);
-        added = true;
-      }
-    }
-    for (const [rule, findings] of byRule) {
-      const shown = kept.get(rule) ?? [];
-      if (shown.length === 0 || shown.length === findings.length) continue;
-      const shownFiles = new Set(shown.map((finding) => finding.file));
-      const dropped = findings.slice(shown.length);
-      delivery.omitted.findings.push({
-        rule,
-        count: dropped.length,
-        files: new Set(dropped.map((finding) => finding.file).filter((file) => !shownFiles.has(file))).size
-      });
-    }
-    delivery.findings = delivery.findings.filter((finding) => kept.get(finding.rule)?.includes(finding) === true);
-  }
-  if (input.stopGate) {
-    const newErrors = delivery.findings.some((finding) => finding.severity === "error");
-    const blocks = input.work.stopBlocks.get(input.agent) ?? 0;
-    if (!newErrors) delivery.stop = "allow";
-    else if (blocks < input.maxBlocks) {
-      delivery.stop = "block";
-      work.push({ t: "stopBlock", agent: input.agent });
-    } else delivery.stop = "capReached";
-    if (delivery.stop !== "block") return { delivery, overflow: null, work, context: [] };
-  }
-  return { delivery, overflow: delivery.omitted.rules > 0 ? complete : null, work, context };
-}
-
-// src/core/guard.ts
-async function guardWrite(input) {
-  const file = input.event.files[0];
-  const intent = input.event.intent;
-  if (file === void 0 || intent === void 0) return emptyDelivery();
-  const rules = input.rules.filter((rule) => rule.refuseWrite && !input.disabled.has(rule.id) && rule.matches(file));
-  if (rules.length === 0) return emptyDelivery();
-  const proposal = propose(await readSourceFile(input.root, file), intent);
-  if (proposal === null) {
-    input.log(`guard: ${file} could not be reconstructed from the tool call; allowing the write`);
-    return emptyDelivery();
-  }
-  if (proposal.inserts.length === 0) return emptyDelivery();
-  const selections = selectDetectorRules(rules, "edit", [file], input.disabled);
-  if (selections.length === 0) return emptyDelivery();
-  const output = await runDetection({
-    root: input.root,
-    event: "edit",
-    selections,
-    changes: /* @__PURE__ */ new Map(),
-    // The proposed file for the one being written; anything else a detector reaches for is real.
-    read: async (name) => name === file ? proposal.content : readSourceFile(input.root, name),
-    registry: input.registry,
-    cacheFor: (kind) => diskCache(detectorCacheDir(input.stateDir, kind)),
-    contextFor: async (rule) => {
-      const references = [];
-      for (const spec of rule.context) {
-        const resolved = await input.resolver.resolve(spec);
-        if (resolved.found) references.push({ ref: spec.ref, content: resolved.content });
-      }
-      return references;
-    },
-    settings: { llm: input.config.llm },
-    timeoutMs: input.config.timeouts.editDeadlineMs
-  });
-  const evidence = output.findings.filter(({ rule, match }) => isInserted(proposal, match, rule.detector.kind));
-  if (evidence.length === 0) return emptyDelivery();
-  const spent = (rule) => (input.work.refusals.get(refusalKey(rule, file)) ?? 0) >= input.config.refuseGate.maxRefusals;
-  const refusing = evidence.filter(({ rule }) => !spent(rule.id));
-  if (refusing.length === 0) {
-    input.log(`guard: ${file} has spent its refusals; allowing the write`);
-    return emptyDelivery();
-  }
-  const { delivery } = await decide({
-    agent: "main",
-    findings: refusing.map(({ rule, match }) => ({ rule, match, status: "new" })),
-    touches: [],
-    agentRead: null,
-    warnings: [],
-    work: input.work,
-    // An empty context, so the sections come with the refusal even if they were delivered earlier:
-    // the message has to stand on its own, and nothing here is recorded as delivered because the
-    // write it explains never happened.
-    context: emptyContext(),
-    resolver: input.resolver,
-    maxBytes: input.config.context.maxBytes,
-    maxBlocks: input.config.stopGate.maxBlocks,
-    maxContextChars: input.maxContextChars,
-    maxMatchesPerRule: input.config.maxMatchesPerRule,
-    stopGate: false
-  });
-  await input.record(
-    [...new Set(refusing.map(({ rule }) => rule.id))].map((rule) => ({ t: "refused", rule, file }))
-  );
-  return delivery;
-}
-
-// src/core/session/session.ts
-import path20 from "path";
-function safeSegment3(value) {
-  const segment = value.replace(/[^A-Za-z0-9._-]/g, "_");
-  return /^\.*$/.test(segment) ? `_${segment}` : segment;
-}
-function sessionDir(stateDir, sessionId) {
-  return path20.join(stateDir, "sessions", safeSegment3(sessionId));
-}
-var workFile = (dir) => path20.join(dir, "work.jsonl");
-var contextFile = (dir, agent) => path20.join(dir, `context.${safeSegment3(agent)}.jsonl`);
-async function appendWork(dir, records) {
-  await appendRecords(workFile(dir), records);
-}
-async function appendContext(dir, agent, records) {
-  await appendRecords(contextFile(dir, agent), records);
-}
-async function openSession(dir, agent) {
-  const [work, context] = await Promise.all([
-    readRecords(workFile(dir)),
-    readRecords(contextFile(dir, agent))
-  ]);
-  return { work: foldWork(work), context: foldContext(context) };
-}
-async function commitSession(dir, agent, decideWith) {
-  return withLock(dir, async () => {
-    const decision = await decideWith(await openSession(dir, agent));
-    await appendWork(dir, decision.work);
-    await appendContext(dir, agent, decision.context);
-    return decision;
-  });
-}
-
-// src/core/pipeline.ts
-async function runPipeline(options) {
-  const { project, stateDir, event, registry } = options;
-  const { root, config } = project;
-  const log = options.log ?? (() => {
-  });
-  const errors = project.diagnostics.filter((diagnostic) => diagnostic.level === "error");
-  const warnings = errors.map((diagnostic) => ({
-    key: `diagnostic:${diagnostic.source}:${diagnostic.rule ?? ""}:${diagnostic.message}`,
-    text: `${diagnostic.source}${diagnostic.rule ? ` (${diagnostic.rule})` : ""}: ${diagnostic.message} (run ${diagnostic.hint ?? "rulecast validate"})`
-  }));
-  let failed = errors.length > 0;
-  const deadlineMissed = [];
-  const session = event.session ? { dir: sessionDir(stateDir, event.session.id), agent: event.session.agentId ?? "main" } : null;
-  const restoredFiles = options.restoredFiles ?? 0;
-  if (event.kind === "prompt") {
-    if (session) await appendWork(session.dir, [{ t: "prompt", agent: session.agent }]);
-    return { delivery: emptyDelivery(), failed, deadlineMissed };
-  }
-  if (event.kind === "reset") {
-    if (session) await appendContext(session.dir, session.agent, [{ t: "reset" }]);
-    if (!session || restoredFiles === 0) return { delivery: emptyDelivery(), failed, deadlineMissed };
-  }
-  let baseline = { started: false, startCommit: null, snapshots: /* @__PURE__ */ new Map() };
-  if (session && event.kind !== "reset" && event.kind !== "guard") {
-    baseline = await readBaseline(session.dir);
-    if (!baseline.started) {
-      await appendBaseline(session.dir, [startRecord(await headCommit(root))]);
-      baseline = await readBaseline(session.dir);
-    }
-  }
-  const view = session ? await openSession(session.dir, session.agent) : { work: emptyWork(), context: emptyContext() };
-  const disabled = new Set(view.work.disabled.keys());
-  const resolver = createReferenceResolver(root);
-  const workRecords = [];
-  const relevant = (files) => files.filter((file) => project.rules.some((rule) => rule.matches(file)));
-  if (event.kind === "guard") {
-    const delivery = await guardWrite({
-      root,
-      config,
-      registry,
-      stateDir,
-      event,
-      rules: project.rules,
-      disabled,
-      work: view.work,
-      resolver,
-      maxContextChars: options.maxContextChars,
-      log,
-      record: session ? (records) => appendWork(session.dir, records) : async () => {
-      }
-    });
-    return { delivery, failed, deadlineMissed };
-  }
-  let touches = [];
-  let findings = [];
-  let agentRead = null;
-  if (event.kind === "touch" || event.kind === "edit") {
-    touches = selectTouchRules(project.rules, event.files, view.context.touched, disabled);
-    if (session) {
-      await appendWork(
-        session.dir,
-        event.files.map((file) => ({ t: "accessed", agent: session.agent, file }))
-      );
-    }
-  }
-  if (event.kind === "reset" && session) {
-    const recent = (view.work.accessed.get(session.agent) ?? []).slice(-restoredFiles).reverse();
-    touches = selectTouchRules(project.rules, recent, view.context.touched, disabled);
-  }
-  if (event.kind === "touch") {
-    if (event.completeRead) agentRead = event.files[0] ?? null;
-    if (session) {
-      const records = [];
-      for (const file of relevant(event.files)) {
-        if (baseline.snapshots.has(file)) continue;
-        const text2 = await readSourceFile(root, file);
-        if (text2 !== null) records.push(snapshotRecord(file, snapshotOf(text2)));
-      }
-      await appendBaseline(session.dir, records);
-    }
-  }
-  if (event.kind === "edit" || event.kind === "verify") {
-    let files = relevant(event.files);
-    let snapshots = session ? baseline.snapshots : /* @__PURE__ */ new Map();
-    let fallbackCommit = session ? baseline.startCommit : null;
-    if (event.kind === "edit" && session) {
-      await appendWork(
-        session.dir,
-        files.map((file) => ({ t: "edited", file }))
-      );
-    }
-    if (event.kind === "verify") {
-      if (event.baseCommit) {
-        fallbackCommit = event.baseCommit;
-        snapshots = /* @__PURE__ */ new Map();
-      }
-      if (event.files.length === 0 && session) files = relevant(view.work.edited);
-    }
-    const changes = await computeChanges(root, files, { snapshots, fallbackCommit });
-    if (event.kind === "verify" && session && !event.baseCommit) {
-      files = files.filter((file) => changes.get(file)?.changedLines.length !== 0);
-    }
-    const skip = options.skipDetectorKinds ?? /* @__PURE__ */ new Set();
-    let selections = selectDetectorRules(project.rules, event.kind, files, disabled).filter(
-      (selection) => !skip.has(selection.rule.detector.kind) && (options.onlyRules?.has(selection.rule.id) ?? true)
-    );
-    let overBudget = [];
-    if (event.kind === "verify") {
-      const budgeted = applyFileBudget("llm", selections, config.llm.maxFilesPerVerify, [...view.work.edited].reverse());
-      selections = budgeted.selections;
-      overBudget = budgeted.skipped;
-    }
-    const output = await runDetection({
-      root,
-      event: event.kind,
-      selections,
-      changes,
-      read: (file) => readSourceFile(root, file),
-      registry,
-      cacheFor: (kind) => diskCache(detectorCacheDir(stateDir, kind)),
-      contextFor: async (rule) => {
-        const references = [];
-        for (const spec of rule.context) {
-          const resolved = await resolver.resolve(spec);
-          if (resolved.found) references.push({ ref: spec.ref, content: resolved.content });
-        }
-        return references;
-      },
-      settings: { llm: config.llm },
-      timeoutMs: event.kind === "edit" ? config.timeouts.editDeadlineMs : config.timeouts.verifyMs
-    });
-    findings = output.findings.map(({ rule, match }) => ({
-      rule,
-      match,
-      status: isNew(match, changes) ? "new" : "preexisting"
-    }));
-    for (const error of output.errors) {
-      failed = true;
-      for (const rule of error.rules) workRecords.push({ t: "disabled", rule, reason: error.message });
-      warnings.push({
-        key: `detector:${error.kind}:${error.rules.join(",")}:${error.message}`,
-        text: `${error.kind} detector failed for ${error.rules.join(", ")}: ${error.message}. Disabled for this session.`
-      });
-    }
-    if (overBudget.length > 0) {
-      warnings.push({
-        key: `llm-budget:${overBudget.join(",")}`,
-        text: `llm rules checked ${config.llm.maxFilesPerVerify} files; ${overBudget.length} were not checked: ${overBudget.join(", ")}. Raise llm.max_files_per_verify, or run rulecast run --files on them.`
-      });
-    }
-    for (const timeout of output.timedOut) {
-      if (event.kind === "edit") {
-        log(`edit deadline passed for ${timeout.kind}: ${timeout.rules.join(", ")}`);
-        deadlineMissed.push(timeout.kind);
-      } else {
-        failed = true;
-        warnings.push({
-          key: `timeout:${timeout.kind}:${timeout.rules.join(",")}`,
-          // Naming the lever matters: dogfooding measured a single haiku call on a 135-line file
-          // at 89 s against a 60 s default, and "timed out" alone leaves nobody knowing what to do.
-          text: `${timeout.kind} detector timed out after ${config.timeouts.verifyMs} ms for ${timeout.rules.join(", ")}. Raise timeouts.verify_ms${timeout.kind === "llm" ? " (an llm rule on a large file can need 120000 or more)" : ""}.`
-        });
-      }
-    }
-  }
-  const inputFor = (state) => ({
-    agent: session?.agent ?? "main",
-    findings,
-    touches: touches.filter((rule) => !state.context.touched.has(rule.id)),
-    agentRead,
-    warnings,
-    work: state.work,
-    context: state.context,
-    resolver,
-    maxBytes: config.context.maxBytes,
-    maxBlocks: config.stopGate.maxBlocks,
-    maxContextChars: options.maxContextChars,
-    maxMatchesPerRule: config.maxMatchesPerRule,
-    stopGate: options.stopGate === true && event.kind === "verify" && session !== null
-  });
-  const persisted = (decision) => {
-    if (decision.overflow !== null) {
-      decision.delivery.overflowPath = writeOverflow(stateDir, event.session?.id ?? null, decision.overflow);
-    }
-    return decision.delivery;
-  };
-  if (!session) return { delivery: persisted(await decide(inputFor(view))), failed, deadlineMissed };
-  await appendWork(session.dir, workRecords);
-  try {
-    const decision = await commitSession(session.dir, session.agent, (state) => decide(inputFor(state)));
-    return { delivery: persisted(decision), failed, deadlineMissed };
-  } catch (error) {
-    if (!(error instanceof LockTimeoutError)) throw error;
-    warnings.push({ key: "lock", text: "session state was locked; delivered without session memory" });
-    const decision = await decide({ ...inputFor({ work: emptyWork(), context: emptyContext() }), stopGate: false });
-    return { delivery: persisted(decision), failed, deadlineMissed };
-  }
-}
-
-export {
-  createRegistry,
-  isNotFound,
-  errorMessage,
-  perRule,
-  readSourceFile,
-  MODEL_ALIASES,
-  resolveModel,
-  LlmUnavailableError,
-  providerByName,
-  builtinDetectors,
-  defaultDetectorSettings,
-  emptyDelivery,
-  defaultConfig,
-  CONFIG_FILE,
-  MANIFEST_FILE,
-  readConfigData,
-  parseConfig,
-  readManifest,
-  git,
-  mergeBase,
-  changedFilesSince,
-  allFiles,
-  stagedFiles,
-  changedFilesBetween,
-  VERSION2 as VERSION,
-  parseVersion,
-  LockTimeoutError,
-  withLock,
-  repoLabel,
-  RepoFetchError,
-  NO_PROMPT,
-  fetchCheckout,
-  cachedRepo,
-  ensureRepo,
-  renderAgentText,
-  claudeCodeAdapter,
-  ADAPTERS,
-  adapterByName,
-  cacheHome,
-  projectStateDir,
-  ensureProjectState,
-  debugLogger,
-  tagsOf,
-  scanHeadings,
-  diagnosticText,
-  compile,
-  compileManifest,
-  memoryCache,
-  diskCache,
-  detectorCacheDir,
-  checkableKinds,
-  checkDetectors,
-  runDetection,
-  cachedRepos,
-  fetchingRepos,
-  fixedRepo,
-  runPipeline
-};