@tacuchi/agent-workflow-cli 20.26.0 → 21.0.0

package/dist/domain/design/reference.js

@@ -0,0 +1,234 @@
+import { checkSafeRelativePath } from "../safe-path.js";
+import { isDigest, parseArtifactRef, parseBaselineRef, } from "./identity.js";
+const SPEC_SECTION = "## Design references";
+/**
+ * Forms that look like a reference and are not. Each one is recognized on
+ * purpose: telling an author "'latest' no fija una revisión" is worth far more
+ * than telling them the value did not match a pattern.
+ */
+const APPROXIMATE = [
+    {
+        test: /@latest\b/i,
+        why: "'latest' no fija ninguna revisión: mañana señala otra cosa",
+        action: "escribí la revisión exacta, por ejemplo DES-001@r4",
+    },
+    {
+        test: /@(head|current|latest|último|ultimo)\b/i,
+        why: "es un alias móvil, no una revisión",
+        action: "escribí la revisión exacta, por ejemplo DES-001@r4",
+    },
+    {
+        test: /^docs\/designs\//,
+        why: "es un path, y el path es un hint de ubicación, nunca la identidad",
+        action: "referenciá el package por su id y revisión, por ejemplo DES-001@r4",
+    },
+    {
+        test: /^\d{3}-design-/,
+        why: "es el slug de una carpeta, y la identidad no deriva del slug",
+        action: "referenciá el package por su id y revisión, por ejemplo DES-001@r4",
+    },
+    {
+        test: /^DES-\d{3,}$/,
+        why: "nombra el package pero no fija la revisión",
+        action: "agregá la revisión, por ejemplo DES-001@r4",
+    },
+];
+function approximate(value, artifact, field) {
+    for (const form of APPROXIMATE) {
+        if (!form.test.test(value))
+            continue;
+        return {
+            code: "DESIGN_REFERENCE_APPROXIMATE",
+            artifact,
+            message: `${field}: '${value}' ${form.why}`,
+            action: form.action,
+        };
+    }
+    return null;
+}
+/**
+ * Read the `## Design references` section of a spec. Absent section = no
+ * references, which is the normal state of a spec without UI — not an error.
+ */
+export function parseSpecDesignReferences(markdown, artifact) {
+    const references = [];
+    const failures = [];
+    const section = sectionBody(markdown, SPEC_SECTION);
+    if (section === null)
+        return { references, failures };
+    const blocks = splitBlocks(section);
+    // The section exists and says nothing parseable. Returning silently would let
+    // a spec claim it references a design while referencing none — the failure
+    // mode this whole contract removes.
+    if (blocks.length === 0) {
+        if (section.trim().length > 0) {
+            failures.push({
+                code: "DESIGN_REFERENCE_INCOMPLETE",
+                artifact,
+                message: `'${SPEC_SECTION}' tiene contenido y ninguna referencia legible`,
+                action: "escribí un bloque con 'package:', 'baseline_hint:' y 'digest:', o quitá la sección",
+            });
+        }
+        return { references, failures };
+    }
+    for (const block of blocks) {
+        const parsed = readSpecReference(block, artifact);
+        if ("code" in parsed)
+            failures.push(parsed);
+        else
+            references.push(parsed);
+    }
+    return { references, failures };
+}
+function readSpecReference(fields, artifact) {
+    const raw = fields.get("package") ?? "";
+    const missing = (field) => ({
+        code: "DESIGN_REFERENCE_INCOMPLETE",
+        artifact,
+        message: `la referencia de diseño no declara '${field}'`,
+        action: "una referencia publicada lleva package, baseline_hint y digest",
+    });
+    if (raw.length === 0)
+        return missing("package");
+    const near = approximate(raw, artifact, "package");
+    if (near !== null)
+        return near;
+    const baseline = parseBaselineRef(raw);
+    if (baseline === null) {
+        return {
+            code: "DESIGN_REFERENCE_APPROXIMATE",
+            artifact,
+            message: `package: '${raw}' no es una referencia exacta`,
+            action: "usá la forma DES-NNN@rN",
+        };
+    }
+    const hint = fields.get("baseline_hint") ?? "";
+    if (hint.length === 0)
+        return missing("baseline_hint");
+    const safe = checkSafeRelativePath(hint);
+    if (!safe.ok) {
+        return {
+            code: "DESIGN_PATH_UNSAFE",
+            artifact,
+            message: `baseline_hint: '${hint}' ${safe.why}`,
+            action: "el hint es un path relativo al workspace, bajo docs/designs/",
+        };
+    }
+    const digest = fields.get("digest") ?? "";
+    if (digest.length === 0)
+        return missing("digest");
+    if (!isDigest(digest)) {
+        return {
+            code: "DESIGN_REFERENCE_INCOMPLETE",
+            artifact,
+            message: `digest: '${digest}' no es 'sha256:' + 64 hex`,
+            action: "copiá el digest del baseline que estás fijando",
+        };
+    }
+    return { baseline, baseline_hint: safe.path, digest };
+}
+/**
+ * The shape of a task reference, matched LOOSELY on purpose: anything that
+ * looks like the two-part form is captured here and then judged. Matching only
+ * the canonical form would make `DES-001@latest / SCR-002@r2` invisible — and a
+ * reference that is silently ignored is worse than one that is rejected.
+ */
+const TASK_REFERENCE_SHAPE = /(DES-[0-9]+(?:@[A-Za-z0-9]+)?)\s*\/\s*((?:FLW|SCR|RUL|TOK|VIS)-[0-9]+(?:@[A-Za-z0-9]+)?(?:#[A-Za-z0-9][A-Za-z0-9_-]*)?)/g;
+/**
+ * Read the design references a plan phase or task declares. Only the exact
+ * two-part form resolves; anything shaped like one but written approximately is
+ * REPORTED, never skipped.
+ */
+export function parseTaskDesignReferences(text, artifact) {
+    const references = [];
+    const failures = [];
+    const seen = new Set();
+    const pinned = new Set();
+    for (const match of text.matchAll(TASK_REFERENCE_SHAPE)) {
+        const raw = match[0];
+        if (seen.has(raw))
+            continue;
+        seen.add(raw);
+        const left = match[1];
+        const right = match[2];
+        const baseline = parseBaselineRef(left);
+        if (baseline === null) {
+            const near = approximate(left, artifact, `referencia de tarea '${raw}'`);
+            failures.push(near ?? malformed(raw, left, artifact));
+            continue;
+        }
+        const artifactRef = parseArtifactRef(`${baseline.package}/${right}`);
+        if (artifactRef === null) {
+            failures.push(malformed(raw, right, artifact));
+            continue;
+        }
+        pinned.add(baseline.package);
+        references.push({ baseline, artifact: artifactRef, raw });
+    }
+    // A package named without being pinned is the exact failure this contract
+    // removes — unless the same text pins it, where the bare mention is just prose.
+    for (const match of text.matchAll(/DES-[0-9]+(?:@[A-Za-z]+)?(?![@/\w-])/g)) {
+        const value = match[0];
+        const id = value.split("@")[0];
+        if (pinned.has(id))
+            continue;
+        const near = approximate(value, artifact, "referencia de tarea");
+        failures.push(near ?? malformed(value, value, artifact));
+    }
+    return { references, failures };
+}
+function malformed(raw, part, artifact) {
+    return {
+        code: "DESIGN_REFERENCE_APPROXIMATE",
+        artifact,
+        message: `referencia de tarea '${raw}': '${part}' no es una referencia exacta`,
+        action: "usá la forma DES-NNN@rN / XXX-NNN@rN[#estado], con la revisión sin ceros de más",
+    };
+}
+/** Body of a `## Heading` section, or null when the section is absent. */
+function sectionBody(markdown, heading) {
+    const lines = markdown.split(/\r?\n/);
+    const start = lines.findIndex((l) => l.trim() === heading);
+    if (start === -1)
+        return null;
+    const rest = lines.slice(start + 1);
+    const end = rest.findIndex((l) => /^##\s/.test(l));
+    return (end === -1 ? rest : rest.slice(0, end)).join("\n");
+}
+/**
+ * One block per reference, and a block STARTS at `package:`.
+ *
+ * Two reasons. A contiguous list of three-line references is the natural way to
+ * write several, and splitting only on blank lines silently kept the last. And
+ * prose in the section — "nota: ver el paquete de abajo" — parses as a
+ * `key: value` line, so anything before the first `package:` is commentary and
+ * must not become a half-built reference nobody wrote.
+ */
+function splitBlocks(section) {
+    const blocks = [];
+    let current = null;
+    for (const line of section.split(/\r?\n/)) {
+        const match = /^\s*[-*]?\s*([a-z_]+):\s*(.+?)\s*$/.exec(line);
+        if (match === null) {
+            if (line.trim().length === 0)
+                current = null;
+            continue;
+        }
+        const key = match[1];
+        const value = match[2].replace(/^`|`$/g, "");
+        if (key === "package") {
+            current = new Map();
+            blocks.push(current);
+        }
+        if (current === null)
+            continue; // prosa antes de la primera referencia
+        if (current.has(key)) {
+            current = new Map([[key, value]]);
+            blocks.push(current);
+            continue;
+        }
+        current.set(key, value);
+    }
+    return blocks;
+}
+//# sourceMappingURL=reference.js.map

package/dist/domain/design/reference.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reference.js","sourceRoot":"","sources":["../../../src/domain/design/reference.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAGL,QAAQ,EACR,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAkCvB,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAE5C;;;;GAIG;AACH,MAAM,WAAW,GAAyD;IACxE;QACE,IAAI,EAAE,YAAY;QAClB,GAAG,EAAE,4DAA4D;QACjE,MAAM,EAAE,oDAAoD;KAC7D;IACD;QACE,IAAI,EAAE,yCAAyC;QAC/C,GAAG,EAAE,oCAAoC;QACzC,MAAM,EAAE,oDAAoD;KAC7D;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,GAAG,EAAE,mEAAmE;QACxE,MAAM,EAAE,oEAAoE;KAC7E;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,GAAG,EAAE,8DAA8D;QACnE,MAAM,EAAE,oEAAoE;KAC7E;IACD;QACE,IAAI,EAAE,cAAc;QACpB,GAAG,EAAE,4CAA4C;QACjD,MAAM,EAAE,4CAA4C;KACrD;CACF,CAAC;AAEF,SAAS,WAAW,CAAC,KAAa,EAAE,QAAgB,EAAE,KAAa;IACjE,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS;QACrC,OAAO;YACL,IAAI,EAAE,8BAA8B;YACpC,QAAQ;YACR,OAAO,EAAE,GAAG,KAAK,MAAM,KAAK,KAAK,IAAI,CAAC,GAAG,EAAE;YAC3C,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAOD;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAAgB,EAAE,QAAgB;IAC1E,MAAM,UAAU,GAA0B,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACpD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;IAEtD,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACpC,8EAA8E;IAC9E,2EAA2E;IAC3E,oCAAoC;IACpC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,6BAA6B;gBACnC,QAAQ;gBACR,OAAO,EAAE,IAAI,YAAY,gDAAgD;gBACzE,MAAM,EACJ,oFAAoF;aACvF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;IAClC,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAClD,IAAI,MAAM,IAAI,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;;YACvC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,iBAAiB,CACxB,MAA2B,EAC3B,QAAgB;IAEhB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,CAAC,KAAa,EAAiB,EAAE,CAAC,CAAC;QACjD,IAAI,EAAE,6BAA6B;QACnC,QAAQ;QACR,OAAO,EAAE,uCAAuC,KAAK,GAAG;QACxD,MAAM,EAAE,gEAAgE;KACzE,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IACnD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAE/B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,8BAA8B;YACpC,QAAQ;YACR,OAAO,EAAE,aAAa,GAAG,+BAA+B;YACxD,MAAM,EAAE,yBAAyB;SAClC,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IAC/C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,eAAe,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,QAAQ;YACR,OAAO,EAAE,mBAAmB,IAAI,KAAK,IAAI,CAAC,GAAG,EAAE;YAC/C,MAAM,EAAE,8DAA8D;SACvE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC1C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,6BAA6B;YACnC,QAAQ;YACR,OAAO,EAAE,YAAY,MAAM,4BAA4B;YACvD,MAAM,EAAE,gDAAgD;SACzD,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;AACxD,CAAC;AAED;;;;;GAKG;AACH,MAAM,oBAAoB,GACxB,0HAA0H,CAAC;AAO7H;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY,EAAE,QAAgB;IACtE,MAAM,UAAU,GAA0B,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IAEjC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACxD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEd,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;QAChC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;QACjC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,wBAAwB,GAAG,GAAG,CAAC,CAAC;YACzE,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACtD,SAAS;QACX,CAAC;QACD,MAAM,WAAW,GAAG,gBAAgB,CAAC,GAAG,QAAQ,CAAC,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC;QACrE,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC/C,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7B,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,0EAA0E;IAC1E,gFAAgF;IAChF,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,uCAAuC,CAAC,EAAE,CAAC;QAC3E,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAW,CAAC;QACzC,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QAC7B,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,EAAE,QAAQ,EAAE,qBAAqB,CAAC,CAAC;QACjE,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,IAAY,EAAE,QAAgB;IAC5D,OAAO;QACL,IAAI,EAAE,8BAA8B;QACpC,QAAQ;QACR,OAAO,EAAE,wBAAwB,GAAG,OAAO,IAAI,+BAA+B;QAC9E,MAAM,EAAE,iFAAiF;KAC1F,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,SAAS,WAAW,CAAC,QAAgB,EAAE,OAAe;IACpD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC,CAAC;IAC3D,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,WAAW,CAAC,OAAe;IAClC,MAAM,MAAM,GAA+B,EAAE,CAAC;IAC9C,IAAI,OAAO,GAA+B,IAAI,CAAC;IAE/C,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,GAAG,IAAI,CAAC;YAC7C,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;QAC/B,MAAM,KAAK,GAAI,KAAK,CAAC,CAAC,CAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACzD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,GAAG,IAAI,GAAG,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;QACD,IAAI,OAAO,KAAK,IAAI;YAAE,SAAS,CAAC,uCAAuC;QACvE,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/domain/design/retired.js

@@ -0,0 +1,61 @@
+/**
+ * The retired design path, reported instead of read (AC-COMP-01/02).
+ *
+ * A document that still carries the legacy render is not an input this contract
+ * accepts and not evidence any gate honors. It is REPORTED — never parsed as a
+ * contract, never imported, converted, migrated on touch or bulk-migrated. The
+ * asymmetry is deliberate: reading it would make the old format a second source
+ * of truth, and the day the two disagree nothing could say which one governs.
+ *
+ * Retirement is not destruction. Nothing here writes, moves or rewrites a file:
+ * a `## UI spec` section written last year stays exactly where it is, byte for
+ * byte. What changes is that Workline answers `retired/unsupported` and asks for
+ * the result to be recreated over the UI Design Package.
+ */
+export const RETIRED_CODE = "DESIGN_RETIRED_UNSUPPORTED";
+const RECREATE = "recreá ese diseño sobre el UI Design Package: no hay importador, conversión ni migración";
+/**
+ * Each form is recognized on purpose rather than by one loose pattern: telling
+ * an author WHICH retired surface they presented is the difference between a
+ * diagnostic and a rejection.
+ */
+const FORMS = [
+    {
+        // A heading of its own, so prose that merely mentions the old name is not a
+        // false positive — a plan explaining the retirement is not carrying one.
+        test: /^\s*#{2,}\s+UI spec\s*$/m,
+        what: "una sección '## UI spec'",
+    },
+    {
+        // A real filename, so the literal placeholder `NNN-SPEC-<SLUG>.md` that the
+        // doctrine uses to NAME the retired shape is not itself an offender.
+        test: /\b\d{3}-SPEC-[A-Z0-9-]+\.md\b/,
+        what: "un design SPEC de sesión (NNN-SPEC-<SLUG>.md)",
+    },
+];
+/**
+ * Legacy surfaces this text presents. Empty for a document that carries none —
+ * which is every current document, so the check costs nothing to keep on.
+ */
+export function reportRetiredDesign(text, artifact) {
+    return FORMS.filter((form) => form.test.test(text)).map((form) => ({
+        code: RETIRED_CODE,
+        artifact,
+        message: `'${artifact}' presenta ${form.what}: es un camino retirado y no se lee como contrato ni cuenta como evidencia`,
+        action: RECREATE,
+    }));
+}
+/**
+ * A binding or invocation naming a retired identity is refused one layer up, by
+ * `RETIRED_SKILL_IDENTITIES` in the skills resolver: the line is ignored with a
+ * warning and the role keeps its built-in default, so the capability is never
+ * left mute. Nothing is duplicated here — one rule, one home.
+ *
+ * An **output of `ui-spec-generator`** is retired too, and is stated in the
+ * doctrine rather than pattern-matched: that repository is outside this topology
+ * and its output format is not ours to recognize. A detector keyed on the tool's
+ * NAME would fire on every document that explains the retirement, which is the
+ * opposite of a useful guard. What a document can actually carry — a `## UI spec`
+ * section or a session design SPEC — is what the forms above catch.
+ */
+//# sourceMappingURL=retired.js.map

package/dist/domain/design/retired.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retired.js","sourceRoot":"","sources":["../../../src/domain/design/retired.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,4BAA4B,CAAC;AAEzD,MAAM,QAAQ,GACZ,0FAA0F,CAAC;AAQ7F;;;;GAIG;AACH,MAAM,KAAK,GAA2B;IACpC;QACE,4EAA4E;QAC5E,yEAAyE;QACzE,IAAI,EAAE,0BAA0B;QAChC,IAAI,EAAE,0BAA0B;KACjC;IACD;QACE,4EAA4E;QAC5E,qEAAqE;QACrE,IAAI,EAAE,+BAA+B;QACrC,IAAI,EAAE,+CAA+C;KACtD;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,QAAgB;IAChE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACjE,IAAI,EAAE,YAAY;QAClB,QAAQ;QACR,OAAO,EAAE,IAAI,QAAQ,cAAc,IAAI,CAAC,IAAI,4EAA4E;QACxH,MAAM,EAAE,QAAQ;KACjB,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;;;;;;GAYG"}

package/dist/domain/design/revision.js

@@ -0,0 +1,219 @@
+import { ARTIFACT_PREFIX, isArtifactId } from "./identity.js";
+import { NAMING, revisionSegment } from "./naming.js";
+/**
+ * Changing published normative content.
+ *
+ * The rule has one shape: you never edit a published revision, you mint the
+ * next one. Everything else follows — the previous file keeps its name, every
+ * reference to it keeps resolving, and `supersedes` records the succession
+ * without rewriting what came before.
+ *
+ * This module answers the two questions that operation asks: *what is the next
+ * revision and where does it go*, and afterwards *did anything published
+ * disappear*. Writing the files is publication's job (F5); this is the arithmetic
+ * and the proof.
+ */
+/** Where each artifact kind is catalogued. One rule, one place. */
+export const KIND_LIST = {
+    flow: "flows",
+    screen: "screens",
+    rule: "rules",
+    token: "tokens",
+    rendition: "renditions",
+};
+/**
+ * The next revision of `id`, or the first one when the artifact is new.
+ * `slug` only shapes the file name; identity never derives from it.
+ */
+export function planNextRevision(manifest, kind, id, slug, artifact) {
+    // The id shapes the PATH this function returns, so validating the cosmetic
+    // slug and not the identity would let `../../evil` out of here as a path.
+    if (!isArtifactId(id, kind)) {
+        return {
+            ok: false,
+            failure: {
+                code: "DESIGN_FIELD_INVALID",
+                artifact,
+                message: `'${id}' no es un id de ${kind}`,
+                action: `usá ${ARTIFACT_PREFIX[kind]}-NNN`,
+            },
+        };
+    }
+    if (!/^[a-z0-9]+(-[a-z0-9]+)*$/.test(slug)) {
+        return {
+            ok: false,
+            failure: {
+                code: "DESIGN_FIELD_INVALID",
+                artifact,
+                message: `'${slug}' no es un slug: solo minúsculas, números y guiones`,
+                action: "usá algo como 'alta-miembro'",
+            },
+        };
+    }
+    const existing = manifest.catalog[KIND_LIST[kind]].filter((e) => e.id === id);
+    const highest = existing.reduce((max, e) => Math.max(max, e.revision), 0);
+    const revision = highest + 1;
+    const rule = NAMING[kind];
+    const path = `${rule.dir}/${id}-${revisionSegment(revision)}-${slug}${rule.suffix}`;
+    // No collision check here on purpose: `revision` is always max+1 and the
+    // revision is part of the path, so the new file CANNOT be one the catalog
+    // already holds. The impossibility is structural — an `if` would only be
+    // dead code pretending to be a safeguard.
+    return {
+        ok: true,
+        value: {
+            id,
+            revision,
+            path,
+            supersedes: highest === 0 ? null : `${manifest.id}/${id}@r${highest}`,
+            preserves: existing.map((e) => e.path).sort(),
+        },
+    };
+}
+/**
+ * What a publication lost, comparing the manifest before and after.
+ *
+ * A published revision may gain nothing and lose nothing: not its path, and —
+ * for a baseline — not its digest. Anything else means a reference somebody
+ * already wrote now resolves to different bytes, which is the one thing the
+ * whole revision model exists to prevent.
+ */
+export function findHistoryLoss(before, after) {
+    return [
+        ...artifactLosses(before, after),
+        ...baselineLosses(before, after),
+        ...addressedLosses(before, after),
+    ];
+}
+/**
+ * Assets and governance records are addressed by content and by id: an asset
+ * that leaves the catalog breaks whatever depended on that digest, and a review
+ * that changes its target changes what it approved.
+ */
+function artifactLosses(before, after) {
+    const losses = [];
+    const current = publishedArtifacts(after);
+    for (const [ref, entry] of publishedArtifacts(before)) {
+        const now = current.get(ref);
+        if (now === undefined) {
+            losses.push({ ref, kind: "removed", before: entry.path, after: null });
+            continue;
+        }
+        if (now.path !== entry.path) {
+            losses.push({ ref, kind: "moved", before: entry.path, after: now.path });
+        }
+        // Promoting a published revision in place is a mutation of what someone
+        // already pinned: `outline` and `handoff` mean different things to a gate,
+        // so the promotion is the NEXT revision, never an edit of this one.
+        for (const field of ["maturity", "supersedes"]) {
+            const was = entry[field] ?? null;
+            const is = now[field] ?? null;
+            if (was === is)
+                continue;
+            losses.push({
+                ref,
+                kind: "rewritten",
+                field,
+                before: String(was),
+                after: is === null ? null : String(is),
+            });
+        }
+    }
+    return losses;
+}
+function baselineLosses(before, after) {
+    const losses = [];
+    // Changing a package's identity orphans every reference ever written to it —
+    // the largest history loss there is, and the one nobody would think to look for.
+    if (before.id !== after.id) {
+        losses.push({
+            ref: before.id,
+            kind: "rewritten",
+            field: "id",
+            before: before.id,
+            after: after.id,
+        });
+    }
+    for (const baseline of before.baselines) {
+        const ref = `${before.id}@r${baseline.revision}`;
+        const now = after.baselines.find((b) => b.revision === baseline.revision);
+        if (now === undefined) {
+            losses.push({ ref, kind: "removed", before: baseline.path, after: null });
+            continue;
+        }
+        if (now.path !== baseline.path) {
+            losses.push({ ref, kind: "moved", before: baseline.path, after: now.path });
+        }
+        if (now.digest !== baseline.digest) {
+            losses.push({ ref, kind: "rewritten", before: baseline.digest, after: now.digest });
+        }
+    }
+    return losses;
+}
+function addressedLosses(before, after) {
+    return [...assetLosses(before, after), ...governanceLosses(before, after)];
+}
+/** An asset that leaves the catalog breaks whatever depended on that digest. */
+function assetLosses(before, after) {
+    const losses = [];
+    for (const asset of before.catalog.assets) {
+        const now = after.catalog.assets.find((a) => a.digest === asset.digest);
+        if (now === undefined) {
+            losses.push({ ref: asset.digest, kind: "removed", before: asset.path, after: null });
+        }
+        else if (now.path !== asset.path) {
+            losses.push({ ref: asset.digest, kind: "moved", before: asset.path, after: now.path });
+        }
+    }
+    return losses;
+}
+/** A review that changes its target changes what it approved. */
+function governanceLosses(before, after) {
+    const losses = [];
+    for (const key of ["reviews", "revocations"]) {
+        for (const record of before.governance[key]) {
+            const now = after.governance[key].find((g) => g.id === record.id);
+            if (now === undefined) {
+                losses.push({ ref: record.id, kind: "removed", before: record.path, after: null });
+                continue;
+            }
+            for (const field of ["digest", "target"]) {
+                if (now[field] === record[field])
+                    continue;
+                losses.push({
+                    ref: record.id,
+                    kind: "rewritten",
+                    field,
+                    before: record[field],
+                    after: now[field],
+                });
+            }
+        }
+    }
+    return losses;
+}
+/** Turn a loss into the diagnostic a publication should refuse with. */
+export function historyLossFailure(loss, artifact) {
+    const what = loss.field ?? "digest";
+    const message = {
+        removed: `${loss.ref} estaba publicada y ya no está en el catálogo`,
+        moved: `${loss.ref} cambió de path: '${loss.before}' → '${loss.after}'`,
+        rewritten: `${loss.ref} cambió de ${what}: '${loss.before}' → '${String(loss.after)}'`,
+    }[loss.kind];
+    return {
+        code: "DESIGN_HISTORY_MUTATED",
+        artifact,
+        message,
+        action: "una revisión publicada no se toca: creá la siguiente y dejá la anterior como está",
+    };
+}
+function publishedArtifacts(manifest) {
+    const out = new Map();
+    for (const key of Object.values(KIND_LIST)) {
+        for (const entry of manifest.catalog[key]) {
+            out.set(`${manifest.id}/${entry.id}@r${entry.revision}`, entry);
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=revision.js.map

package/dist/domain/design/revision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revision.js","sourceRoot":"","sources":["../../../src/domain/design/revision.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE9D,OAAO,EAAE,MAAM,EAAkB,eAAe,EAAE,MAAM,aAAa,CAAC;AAGtE;;;;;;;;;;;;GAYG;AAEH,mEAAmE;AACnE,MAAM,CAAC,MAAM,SAAS,GAA2C;IAC/D,IAAI,EAAE,OAAO;IACb,MAAM,EAAE,SAAS;IACjB,IAAI,EAAE,OAAO;IACb,KAAK,EAAE,QAAQ;IACf,SAAS,EAAE,YAAY;CACxB,CAAC;AAiBF;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAwB,EACxB,IAAe,EACf,EAAU,EACV,IAAY,EACZ,QAAgB;IAEhB,2EAA2E;IAC3E,0EAA0E;IAC1E,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,sBAAsB;gBAC5B,QAAQ;gBACR,OAAO,EAAE,IAAI,EAAE,oBAAoB,IAAI,EAAE;gBACzC,MAAM,EAAE,OAAO,eAAe,CAAC,IAAI,CAAC,MAAM;aAC3C;SACF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,sBAAsB;gBAC5B,QAAQ;gBACR,OAAO,EAAE,IAAI,IAAI,qDAAqD;gBACtE,MAAM,EAAE,8BAA8B;aACvC;SACF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAI,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAClG,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,EAAE,IAAI,eAAe,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAEpF,yEAAyE;IACzE,0EAA0E;IAC1E,yEAAyE;IACzE,0CAA0C;IAE1C,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACL,EAAE;YACF,QAAQ;YACR,IAAI;YACJ,UAAU,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,EAAE,IAAI,EAAE,KAAK,OAAO,EAAE;YACrE,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE;SAC9C;KACF,CAAC;AACJ,CAAC;AAaD;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,MAAsB,EAAE,KAAqB;IAC3E,OAAO;QACL,GAAG,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC;QAChC,GAAG,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC;QAChC,GAAG,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC;KAClC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,MAAsB,EAAE,KAAqB;IACnE,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAE1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACvE,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,wEAAwE;QACxE,2EAA2E;QAC3E,oEAAoE;QACpE,KAAK,MAAM,KAAK,IAAI,CAAC,UAAU,EAAE,YAAY,CAAU,EAAE,CAAC;YACxD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;YACjC,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;YAC9B,IAAI,GAAG,KAAK,EAAE;gBAAE,SAAS;YACzB,MAAM,CAAC,IAAI,CAAC;gBACV,GAAG;gBACH,IAAI,EAAE,WAAW;gBACjB,KAAK;gBACL,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC;gBACnB,KAAK,EAAE,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;aACvC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,MAAsB,EAAE,KAAqB;IACnE,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,6EAA6E;IAC7E,iFAAiF;IACjF,IAAI,MAAM,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC;YACV,GAAG,EAAE,MAAM,CAAC,EAAE;YACd,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,MAAM,CAAC,EAAE;YACjB,KAAK,EAAE,KAAK,CAAC,EAAE;SAChB,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACjD,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC1E,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1E,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,MAAsB,EAAE,KAAqB;IACpE,OAAO,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,gFAAgF;AAChF,SAAS,WAAW,CAAC,MAAsB,EAAE,KAAqB;IAChE,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC;QACxE,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACvF,CAAC;aAAM,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,iEAAiE;AACjE,SAAS,gBAAgB,CAAC,MAAsB,EAAE,KAAqB;IACrE,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAAU,EAAE,CAAC;QACtD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC;YAClE,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnF,SAAS;YACX,CAAC;YACD,KAAK,MAAM,KAAK,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAU,EAAE,CAAC;gBAClD,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC;oBAAE,SAAS;gBAC3C,MAAM,CAAC,IAAI,CAAC;oBACV,GAAG,EAAE,MAAM,CAAC,EAAE;oBACd,IAAI,EAAE,WAAW;oBACjB,KAAK;oBACL,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC;oBACrB,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,kBAAkB,CAAC,IAAiB,EAAE,QAAgB;IACpE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC;IACpC,MAAM,OAAO,GAAG;QACd,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,+CAA+C;QACnE,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,qBAAqB,IAAI,CAAC,MAAM,QAAQ,IAAI,CAAC,KAAK,GAAG;QACvE,SAAS,EAAE,GAAG,IAAI,CAAC,GAAG,cAAc,IAAI,MAAM,IAAI,CAAC,MAAM,QAAQ,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG;KACvF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,OAAO;QACL,IAAI,EAAE,wBAAwB;QAC9B,QAAQ;QACR,OAAO;QACP,MAAM,EAAE,mFAAmF;KAC5F,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAwB;IAClD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAmB,EAAE,CAAC;YAC5D,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,EAAE,IAAI,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/domain/design/secrets.js

@@ -0,0 +1,86 @@
+/**
+ * Credentials never enter a package.
+ *
+ * A package records an ACCESS CLASSIFICATION — `private`, `team`, `public` —
+ * and never the thing that grants access. The distinction matters because a
+ * package is a durable, committed, shareable dossier: a token that lands in one
+ * is a token in every clone of the repo, forever, and rotating it does not
+ * remove it from history.
+ *
+ * The repo's `code-scan-service` greps source trees with regexes; this walks an
+ * already-parsed document instead, which is a different shape — the values are
+ * structured, so the key is as much a signal as the value.
+ */
+/** Keys that hold a secret by definition. Their presence is the finding. */
+const SECRET_KEYS = /^(password|passwd|pwd|secret|client_secret|token|access_token|refresh_token|id_token|api_?key|apikey|private_?key|secret_?key|access_?key|credential|credentials|auth_?token|bearer|session_?id|cookie)$/i;
+/** Shapes that are a credential wherever they appear, whatever the key. */
+const SECRET_VALUES = [
+    { test: /-----BEGIN [A-Z ]*PRIVATE KEY-----/, what: "una clave privada PEM" },
+    { test: /\bgh[pousr]_[A-Za-z0-9]{16,}\b/, what: "un token de GitHub" },
+    { test: /\bgithub_pat_[A-Za-z0-9_]{20,}\b/, what: "un token de GitHub" },
+    { test: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/, what: "un token de Slack" },
+    { test: /\bAKIA[0-9A-Z]{16}\b/, what: "una access key de AWS" },
+    { test: /\bsk-[A-Za-z0-9]{20,}\b/, what: "una API key" },
+    // Los proveedores que la spec declara obligatorios para v1 tienen su propio
+    // prefijo, y no reconocerlos dejaba a AC-SEC-02 sin cubrir justo donde importa.
+    { test: /\bfigd_[A-Za-z0-9_-]{20,}\b/, what: "un token de Figma" },
+    { test: /\bfigu_[A-Za-z0-9_-]{20,}\b/, what: "un token de Figma" },
+    { test: /\bAIza[0-9A-Za-z_-]{35}\b/, what: "una API key de Google" },
+    { test: /\bya29\.[0-9A-Za-z_-]{20,}\b/, what: "un token OAuth de Google" },
+    { test: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/, what: "una API key de Anthropic" },
+    { test: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/, what: "un JWT" },
+    { test: /\b(?:Bearer|Basic)\s+[A-Za-z0-9._~+/=-]{16,}/, what: "un header de autorización" },
+    // `https://user:password@host` — the one credential form that hides in a URL.
+    {
+        test: /\b[a-z][a-z0-9+.-]*:\/\/[^/\s:@]+:[^/\s@]+@/i,
+        what: "una URL con usuario y contraseña",
+    },
+];
+/**
+ * Walk a parsed document for credentials. Returns every finding: a document
+ * with two leaked tokens should report two, not stop at the first.
+ */
+export function findSecrets(document, at = "") {
+    if (typeof document === "string") {
+        const shape = SECRET_VALUES.find((s) => s.test.test(document));
+        return shape === undefined ? [] : [{ at, what: shape.what }];
+    }
+    if (Array.isArray(document)) {
+        return document.flatMap((v, i) => findSecrets(v, `${at}[${i}]`));
+    }
+    if (typeof document !== "object" || document === null)
+        return [];
+    const findings = [];
+    for (const [key, value] of Object.entries(document)) {
+        const path = at.length === 0 ? key : `${at}.${key}`;
+        // A key named `token` with ANY content is the finding — there is no value of
+        // that field a package may carry, and wrapping it in an object
+        // (`token: { value: … }`) does not make it a different field.
+        if (SECRET_KEYS.test(key) && !isEmpty(value)) {
+            findings.push({ at: path, what: `un campo '${key}'` });
+            continue;
+        }
+        findings.push(...findSecrets(value, path));
+    }
+    return findings;
+}
+export function secretFailures(document, artifact) {
+    return findSecrets(document).map((finding) => ({
+        code: "DESIGN_SECRET_PRESENT",
+        artifact,
+        message: `'${finding.at}' parece contener ${finding.what}`,
+        action: "un package registra la CLASIFICACIÓN de acceso, nunca la credencial: quitala y rotala, ya está en el historial de git",
+    }));
+}
+function isEmpty(value) {
+    if (value === null || value === undefined)
+        return true;
+    if (typeof value === "string")
+        return value.trim().length === 0;
+    if (Array.isArray(value))
+        return value.length === 0;
+    if (typeof value === "object")
+        return Object.keys(value).length === 0;
+    return false;
+}
+//# sourceMappingURL=secrets.js.map

package/dist/domain/design/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../../src/domain/design/secrets.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AAEH,4EAA4E;AAC5E,MAAM,WAAW,GACf,2MAA2M,CAAC;AAE9M,2EAA2E;AAC3E,MAAM,aAAa,GAA0C;IAC3D,EAAE,IAAI,EAAE,oCAAoC,EAAE,IAAI,EAAE,uBAAuB,EAAE;IAC7E,EAAE,IAAI,EAAE,gCAAgC,EAAE,IAAI,EAAE,oBAAoB,EAAE;IACtE,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,oBAAoB,EAAE;IACxE,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,mBAAmB,EAAE;IACvE,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,uBAAuB,EAAE;IAC/D,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,aAAa,EAAE;IACxD,4EAA4E;IAC5E,gFAAgF;IAChF,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,mBAAmB,EAAE;IAClE,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,mBAAmB,EAAE;IAClE,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,uBAAuB,EAAE;IACpE,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,0BAA0B,EAAE;IAC1E,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,0BAA0B,EAAE;IAC3E,EAAE,IAAI,EAAE,iEAAiE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3F,EAAE,IAAI,EAAE,8CAA8C,EAAE,IAAI,EAAE,2BAA2B,EAAE;IAC3F,8EAA8E;IAC9E;QACE,IAAI,EAAE,8CAA8C;QACpD,IAAI,EAAE,kCAAkC;KACzC;CACF,CAAC;AAQF;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,QAAiB,EAAE,EAAE,GAAG,EAAE;IACpD,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/D,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAEjE,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAmC,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,GAAG,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,GAAG,EAAE,CAAC;QACpD,6EAA6E;QAC7E,+DAA+D;QAC/D,8DAA8D;QAC9D,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7C,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,GAAG,GAAG,EAAE,CAAC,CAAC;YACvD,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAiB,EAAE,QAAgB;IAChE,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC7C,IAAI,EAAE,uBAAuB;QAC7B,QAAQ;QACR,OAAO,EAAE,IAAI,OAAO,CAAC,EAAE,qBAAqB,OAAO,CAAC,IAAI,EAAE;QAC1D,MAAM,EACJ,uHAAuH;KAC1H,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC;IAChE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IAChF,OAAO,KAAK,CAAC;AACf,CAAC"}