@tangle-network/starter-foundry 0.5.3 → 0.7.0

package/dist/lib/reviewer-route.js

@@ -0,0 +1,99 @@
+// Reviewer route selection shared by every propose/review adapter. Picks the
+// highest-fidelity provider available: direct Anthropic → direct Groq →
+// tangle-router (OpenAI-compatible, rate-limited on free tier). The router
+// path is last because a local driver doesn't need the governance/billing
+// plane — and its 6k TPM free-tier cap starves long runs.
+export function selectReviewerRoute(overrideModel) {
+    const env = process.env;
+    if (env['ANTHROPIC_API_KEY']) {
+        return {
+            url: 'https://api.anthropic.com/v1/messages',
+            model: overrideModel ?? 'claude-sonnet-4-6',
+            style: 'anthropic',
+            headers: {
+                'x-api-key': env['ANTHROPIC_API_KEY'],
+                'anthropic-version': '2023-06-01',
+                'content-type': 'application/json',
+            },
+        };
+    }
+    if (env['GROQ_API_KEY']) {
+        return {
+            url: 'https://api.groq.com/openai/v1/chat/completions',
+            model: overrideModel ?? 'llama-3.3-70b-versatile',
+            style: 'openai',
+            headers: {
+                Authorization: `Bearer ${env['GROQ_API_KEY']}`,
+                'content-type': 'application/json',
+            },
+        };
+    }
+    if (env['TANGLE_ROUTER_USER_KEY']) {
+        return {
+            url: 'https://router.tangle.tools/v1/chat/completions',
+            model: overrideModel ?? 'llama-3.1-8b-instant',
+            style: 'openai',
+            headers: {
+                Authorization: `Bearer ${env['TANGLE_ROUTER_USER_KEY']}`,
+                'content-type': 'application/json',
+            },
+        };
+    }
+    return null;
+}
+export async function reviewerJsonCall(route, req) {
+    const body = route.style === 'anthropic'
+        ? {
+            model: route.model,
+            system: req.system,
+            messages: [{ role: 'user', content: `${req.user}\n\nReturn JSON only. No prose outside the object.` }],
+            max_tokens: 2048,
+            temperature: 0.2,
+        }
+        : {
+            model: route.model,
+            stream: false,
+            messages: [
+                { role: 'system', content: req.system },
+                { role: 'user', content: req.user },
+            ],
+            temperature: 0.2,
+            response_format: { type: 'json_object' },
+        };
+    const res = await fetch(route.url, {
+        method: 'POST',
+        headers: route.headers,
+        body: JSON.stringify(body),
+    });
+    if (!res.ok) {
+        const text = await res.text();
+        throw new Error(`reviewer ${res.status}: ${text.slice(0, 400)}`);
+    }
+    const json = (await res.json());
+    const content = route.style === 'anthropic'
+        ? extractAnthropicText(json)
+        : extractOpenAIText(json);
+    if (typeof content !== 'string')
+        throw new Error('reviewer returned no text content');
+    // Strip fenced code blocks that sonnet sometimes wraps around JSON despite instruction.
+    const stripped = content.trim().replace(/^```(?:json)?\s*/, '').replace(/```\s*$/, '');
+    return JSON.parse(stripped);
+}
+function extractAnthropicText(json) {
+    const content = json['content'];
+    if (!Array.isArray(content))
+        return undefined;
+    for (const block of content) {
+        if (block.type === 'text' && typeof block.text === 'string')
+            return block.text;
+    }
+    return undefined;
+}
+function extractOpenAIText(json) {
+    const choices = json['choices'];
+    if (!Array.isArray(choices))
+        return undefined;
+    const first = choices[0];
+    return first?.message?.content;
+}
+//# sourceMappingURL=reviewer-route.js.map

package/dist/lib/reviewer-route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reviewer-route.js","sourceRoot":"","sources":["../../src/lib/reviewer-route.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,wEAAwE;AACxE,2EAA2E;AAC3E,0EAA0E;AAC1E,0DAA0D;AAS1D,MAAM,UAAU,mBAAmB,CAAC,aAA6B;IAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;IACvB,IAAI,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,GAAG,EAAE,uCAAuC;YAC5C,KAAK,EAAE,aAAa,IAAI,mBAAmB;YAC3C,KAAK,EAAE,WAAW;YAClB,OAAO,EAAE;gBACP,WAAW,EAAE,GAAG,CAAC,mBAAmB,CAAC;gBACrC,mBAAmB,EAAE,YAAY;gBACjC,cAAc,EAAE,kBAAkB;aACnC;SACF,CAAA;IACH,CAAC;IACD,IAAI,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,GAAG,EAAE,iDAAiD;YACtD,KAAK,EAAE,aAAa,IAAI,yBAAyB;YACjD,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,GAAG,CAAC,cAAc,CAAC,EAAE;gBAC9C,cAAc,EAAE,kBAAkB;aACnC;SACF,CAAA;IACH,CAAC;IACD,IAAI,GAAG,CAAC,wBAAwB,CAAC,EAAE,CAAC;QAClC,OAAO;YACL,GAAG,EAAE,iDAAiD;YACtD,KAAK,EAAE,aAAa,IAAI,sBAAsB;YAC9C,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,GAAG,CAAC,wBAAwB,CAAC,EAAE;gBACxD,cAAc,EAAE,kBAAkB;aACnC;SACF,CAAA;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAoB,EACpB,GAAqC;IAErC,MAAM,IAAI,GACR,KAAK,CAAC,KAAK,KAAK,WAAW;QACzB,CAAC,CAAC;YACE,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,oDAAoD,EAAE,CAAC;YACtG,UAAU,EAAE,IAAI;YAChB,WAAW,EAAE,GAAG;SACjB;QACH,CAAC,CAAC;YACE,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE;gBACR,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE;gBACvC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE;aACpC;YACD,WAAW,EAAE,GAAG;YAChB,eAAe,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;SACzC,CAAA;IACP,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE;QACjC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAA;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAC7B,MAAM,IAAI,KAAK,CAAC,YAAY,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;IAClE,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAA;IAC1D,MAAM,OAAO,GACX,KAAK,CAAC,KAAK,KAAK,WAAW;QACzB,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC;QAC5B,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAA;IAC7B,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;IACrF,wFAAwF;IACxF,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IACtF,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAY,CAAA;AACxC,CAAC;AAMD,SAAS,oBAAoB,CAAC,IAA6B;IACzD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAA;IAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAA;IAC7C,KAAK,MAAM,KAAK,IAAI,OAAkC,EAAE,CAAC;QACvD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC,IAAI,CAAA;IAChF,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAKD,SAAS,iBAAiB,CAAC,IAA6B;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAA;IAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAA;IAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAA6B,CAAA;IACpD,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,CAAA;AAChC,CAAC"}

package/dist/lib/safety/license-check.d.ts

@@ -0,0 +1,9 @@
+export interface LicenseFlag {
+    package: string;
+    license: string;
+    severity: 'warn' | 'block';
+}
+export declare function scanLicenses(args: {
+    outDir: string;
+    commercialIntent: boolean;
+}): Promise<LicenseFlag[]>;

package/dist/lib/safety/license-check.js

@@ -0,0 +1,61 @@
+// License-awareness for composed scaffolds. Flags GPL / AGPL / SSPL deps
+// when the caller declares `commercialIntent: true`. Doesn't block compose
+// — surfaces advice in the ComposeResult so the consumer can decide.
+import fs from 'node:fs/promises';
+import path from 'node:path';
+// Conservative block list — scopes NOT to ship in a commercial scaffold
+// without the user's explicit acknowledgement.
+const COPYLEFT_LICENSES = new Set(['GPL-2.0', 'GPL-3.0', 'AGPL-3.0', 'SSPL-1.0', 'GPL-2.0-only', 'GPL-3.0-only', 'AGPL-3.0-only']);
+// Best-effort package-license lookup. For the hot path, we rely on the
+// consumer's node_modules/<pkg>/package.json license field (read once,
+// cached). For the deterministic dev path, we use a tiny hand-curated
+// override map + default to 'unknown'.
+const KNOWN_LICENSES = {
+    // (fill in over time from observed audit results — this is a seed).
+    'vllm': 'Apache-2.0',
+    'stripe': 'MIT',
+    'ethers': 'MIT',
+    'viem': 'MIT',
+    'react': 'MIT',
+    'next': 'MIT',
+    'svelte': 'MIT',
+    'vue': 'MIT',
+    'langchain': 'MIT',
+    '@mysten/sui': 'Apache-2.0',
+};
+async function readPackageLicense(outDir, name) {
+    try {
+        const raw = await fs.readFile(path.join(outDir, 'node_modules', name, 'package.json'), 'utf8');
+        const pkg = JSON.parse(raw);
+        if (typeof pkg.license === 'string')
+            return pkg.license;
+        if (pkg.license && typeof pkg.license === 'object' && 'type' in pkg.license)
+            return pkg.license.type ?? null;
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+export async function scanLicenses(args) {
+    const flags = [];
+    let pkg;
+    try {
+        pkg = JSON.parse(await fs.readFile(path.join(args.outDir, 'package.json'), 'utf8'));
+    }
+    catch {
+        return flags;
+    }
+    for (const name of Object.keys(pkg.dependencies ?? {})) {
+        const license = (await readPackageLicense(args.outDir, name)) ?? KNOWN_LICENSES[name] ?? 'unknown';
+        if (COPYLEFT_LICENSES.has(license)) {
+            flags.push({
+                package: name,
+                license,
+                severity: args.commercialIntent ? 'block' : 'warn',
+            });
+        }
+    }
+    return flags;
+}
+//# sourceMappingURL=license-check.js.map

package/dist/lib/safety/license-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"license-check.js","sourceRoot":"","sources":["../../../src/lib/safety/license-check.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,2EAA2E;AAC3E,qEAAqE;AAErE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACjC,OAAO,IAAI,MAAM,WAAW,CAAA;AAE5B,wEAAwE;AACxE,+CAA+C;AAC/C,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC,CAAA;AAQlI,uEAAuE;AACvE,uEAAuE;AACvE,sEAAsE;AACtE,uCAAuC;AACvC,MAAM,cAAc,GAA2B;IAC7C,oEAAoE;IACpE,MAAM,EAAE,YAAY;IACpB,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,KAAK;IACf,MAAM,EAAE,KAAK;IACb,OAAO,EAAE,KAAK;IACd,MAAM,EAAE,KAAK;IACb,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,KAAK;IACZ,WAAW,EAAE,KAAK;IAClB,aAAa,EAAE,YAAY;CAC5B,CAAA;AAED,KAAK,UAAU,kBAAkB,CAAC,MAAc,EAAE,IAAY;IAC5D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAA;QAC9F,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA6C,CAAA;QACvE,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAC,OAAO,CAAA;QACvD,IAAI,GAAG,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAA;QAC5G,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAA;IAAC,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAmD;IACpF,MAAM,KAAK,GAAkB,EAAE,CAAA;IAC/B,IAAI,GAAG,CAAA;IACP,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAEjF,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;IAExB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;QACvD,MAAM,OAAO,GAAG,CAAC,MAAM,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,SAAS,CAAA;QAClG,IAAI,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,KAAK,CAAC,IAAI,CAAC;gBACT,OAAO,EAAE,IAAI;gBACb,OAAO;gBACP,QAAQ,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;aACnD,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/lib/safety/secret-scan.d.ts

@@ -0,0 +1,7 @@
+export interface SecretMatch {
+    file: string;
+    line: number;
+    kind: string;
+    snippet: string;
+}
+export declare function scanDirectory(dir: string): Promise<SecretMatch[]>;

package/dist/lib/safety/secret-scan.js

@@ -0,0 +1,67 @@
+// Secret detection on a composed scaffold. Run at the end of compose (or
+// as a CI gate on registry PRs) so we never ship a scaffold with a leaked
+// API key, session token, or hardcoded private key.
+import fs from 'node:fs/promises';
+import path from 'node:path';
+// Pattern → label. Narrow regexes — false positives are worse than misses
+// here because secret-scan errors must be CI-blocking.
+const PATTERNS = [
+    { re: /sk-(?:proj-)?[A-Za-z0-9_-]{30,}/g, kind: 'openai-secret-key' },
+    { re: /ghp_[A-Za-z0-9]{36,}/g, kind: 'github-personal-token' },
+    { re: /xoxb-[A-Za-z0-9-]{40,}/g, kind: 'slack-bot-token' },
+    { re: /AKIA[0-9A-Z]{16}/g, kind: 'aws-access-key' },
+    { re: /AIza[0-9A-Za-z_-]{35}/g, kind: 'google-api-key' },
+    { re: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----/g, kind: 'private-key-block' },
+    { re: /eyJ[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}/g, kind: 'jwt' },
+    { re: /postgres(?:ql)?:\/\/[^\s'"`]{10,}/g, kind: 'postgres-connection-string' },
+    { re: /mongodb(?:\+srv)?:\/\/[^\s'"`]{10,}/g, kind: 'mongodb-connection-string' },
+    // EVM private key shape (64 hex chars).
+    { re: /0x[a-fA-F0-9]{64}/g, kind: 'evm-private-key-candidate' },
+];
+// Directories we don't scan — binary / generated / huge.
+const SKIP_DIRS = new Set(['node_modules', 'pkg', 'target', 'dist', '.git', '.next', '.turbo']);
+// Extensions we don't bother reading.
+const SKIP_EXTS = new Set(['.png', '.jpg', '.jpeg', '.gif', '.webp', '.ico', '.svg', '.woff', '.woff2', '.ttf', '.otf', '.wasm', '.lockb']);
+async function walk(dir, onFile, root = dir) {
+    const entries = await fs.readdir(dir, { withFileTypes: true });
+    for (const entry of entries) {
+        if (SKIP_DIRS.has(entry.name))
+            continue;
+        const abs = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            await walk(abs, onFile, root);
+        }
+        else if (entry.isFile()) {
+            if (SKIP_EXTS.has(path.extname(entry.name).toLowerCase()))
+                continue;
+            await onFile(abs, path.relative(root, abs));
+        }
+    }
+}
+export async function scanDirectory(dir) {
+    const matches = [];
+    await walk(dir, async (abs, rel) => {
+        let source;
+        try {
+            source = await fs.readFile(abs, 'utf8');
+        }
+        catch {
+            return;
+        }
+        // Skip files > 1MB — they're probably not secrets-bearing source.
+        if (source.length > 1_000_000)
+            return;
+        const lines = source.split('\n');
+        for (const { re, kind } of PATTERNS) {
+            re.lastIndex = 0;
+            let m;
+            while ((m = re.exec(source)) !== null) {
+                const lineNum = source.slice(0, m.index).split('\n').length;
+                const snippet = (lines[lineNum - 1] ?? '').trim().slice(0, 240);
+                matches.push({ file: rel, line: lineNum, kind, snippet });
+            }
+        }
+    });
+    return matches;
+}
+//# sourceMappingURL=secret-scan.js.map

package/dist/lib/safety/secret-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-scan.js","sourceRoot":"","sources":["../../../src/lib/safety/secret-scan.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,0EAA0E;AAC1E,oDAAoD;AAEpD,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACjC,OAAO,IAAI,MAAM,WAAW,CAAA;AAS5B,0EAA0E;AAC1E,uDAAuD;AACvD,MAAM,QAAQ,GAAwC;IACpD,EAAE,EAAE,EAAE,kCAAkC,EAAE,IAAI,EAAE,mBAAmB,EAAE;IACrE,EAAE,EAAE,EAAE,uBAAuB,EAAE,IAAI,EAAE,uBAAuB,EAAE;IAC9D,EAAE,EAAE,EAAE,yBAAyB,EAAE,IAAI,EAAE,iBAAiB,EAAE;IAC1D,EAAE,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE;IACnD,EAAE,EAAE,EAAE,wBAAwB,EAAE,IAAI,EAAE,gBAAgB,EAAE;IACxD,EAAE,EAAE,EAAE,8DAA8D,EAAE,IAAI,EAAE,mBAAmB,EAAE;IACjG,EAAE,EAAE,EAAE,gEAAgE,EAAE,IAAI,EAAE,KAAK,EAAE;IACrF,EAAE,EAAE,EAAE,oCAAoC,EAAE,IAAI,EAAE,4BAA4B,EAAE;IAChF,EAAE,EAAE,EAAE,sCAAsC,EAAE,IAAI,EAAE,2BAA2B,EAAE;IACjF,wCAAwC;IACxC,EAAE,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,2BAA2B,EAAE;CAChE,CAAA;AAED,yDAAyD;AACzD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAA;AAC/F,sCAAsC;AACtC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAA;AAE3I,KAAK,UAAU,IAAI,CAAC,GAAW,EAAE,MAAmD,EAAE,OAAe,GAAG;IACtG,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAQ;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;QACtC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;QAC/B,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1B,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;gBAAE,SAAQ;YACnE,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAA;QAC7C,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW;IAC7C,MAAM,OAAO,GAAkB,EAAE,CAAA;IACjC,MAAM,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACjC,IAAI,MAAc,CAAA;QAClB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAM;QACR,CAAC;QACD,kEAAkE;QAClE,IAAI,MAAM,CAAC,MAAM,GAAG,SAAS;YAAE,OAAM;QACrC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAChC,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,QAAQ,EAAE,CAAC;YACpC,EAAE,CAAC,SAAS,GAAG,CAAC,CAAA;YAChB,IAAI,CAAyB,CAAA;YAC7B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACtC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAA;gBAC3D,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;gBAC/D,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;YAC3D,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IACF,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/lib/sbom.d.ts

@@ -0,0 +1,34 @@
+export interface SbomComponent {
+    name: string;
+    version: string;
+    'bom-ref': string;
+    type: 'library' | 'application' | 'framework';
+    purl?: string;
+}
+export interface Sbom {
+    bomFormat: 'CycloneDX';
+    specVersion: '1.5';
+    serialNumber: string;
+    version: 1;
+    metadata: {
+        timestamp: string;
+        tools: Array<{
+            vendor: string;
+            name: string;
+            version: string;
+        }>;
+        component: {
+            type: 'application';
+            name: string;
+            version: string;
+        };
+    };
+    components: SbomComponent[];
+}
+/**
+ * Read a composed scaffold's root `package.json` and synthesize an SBOM.
+ * For non-Node scaffolds (Rust/Go/Python), read the equivalent manifest
+ * (Cargo.toml, go.mod, requirements.txt).
+ */
+export declare function generateSbom(outDir: string, projectName: string): Promise<Sbom | null>;
+export declare function writeSbom(outDir: string, projectName: string): Promise<string | null>;

package/dist/lib/sbom.js

@@ -0,0 +1,89 @@
+// SBOM generation for a composed scaffold. CycloneDX-lite format — the
+// subset that matters: component list with (name, version, licenses, hashes).
+// Written to `.starter-foundry/sbom.cdx.json` alongside the compose report.
+//
+// Downstream: supply-chain scanners (sigstore, Dependency-Track, etc.) can
+// consume the CycloneDX output directly.
+import fs from 'node:fs/promises';
+import path from 'node:path';
+/**
+ * Read a composed scaffold's root `package.json` and synthesize an SBOM.
+ * For non-Node scaffolds (Rust/Go/Python), read the equivalent manifest
+ * (Cargo.toml, go.mod, requirements.txt).
+ */
+export async function generateSbom(outDir, projectName) {
+    const components = [];
+    const pkgPath = path.join(outDir, 'package.json');
+    try {
+        const pkg = JSON.parse(await fs.readFile(pkgPath, 'utf8'));
+        for (const [name, version] of Object.entries({ ...(pkg.dependencies ?? {}), ...(pkg.devDependencies ?? {}) })) {
+            components.push({
+                name,
+                version,
+                'bom-ref': `pkg:npm/${encodeURIComponent(name)}@${encodeURIComponent(version)}`,
+                type: 'library',
+                purl: `pkg:npm/${encodeURIComponent(name)}@${encodeURIComponent(version)}`,
+            });
+        }
+    }
+    catch {
+        // Not a Node project — try Cargo.toml.
+        try {
+            const cargo = await fs.readFile(path.join(outDir, 'Cargo.toml'), 'utf8');
+            for (const match of cargo.matchAll(/^(\w[\w-]*)\s*=\s*"([^"]+)"/gm)) {
+                const name = match[1];
+                const version = match[2];
+                components.push({
+                    name,
+                    version,
+                    'bom-ref': `pkg:cargo/${name}@${version}`,
+                    type: 'library',
+                    purl: `pkg:cargo/${name}@${version}`,
+                });
+            }
+        }
+        catch {
+            // Not Cargo either — try requirements.txt.
+            try {
+                const req = await fs.readFile(path.join(outDir, 'requirements.txt'), 'utf8');
+                for (const line of req.split('\n')) {
+                    const m = line.match(/^([a-zA-Z0-9_-]+)\s*[>=<~]+\s*([^\s#]+)/);
+                    if (!m)
+                        continue;
+                    components.push({
+                        name: m[1],
+                        version: m[2],
+                        'bom-ref': `pkg:pypi/${m[1]}@${m[2]}`,
+                        type: 'library',
+                        purl: `pkg:pypi/${m[1]}@${m[2]}`,
+                    });
+                }
+            }
+            catch {
+                return null;
+            }
+        }
+    }
+    return {
+        bomFormat: 'CycloneDX',
+        specVersion: '1.5',
+        serialNumber: `urn:uuid:sf-${Date.now()}-${Math.random().toString(36).slice(2, 10)}`,
+        version: 1,
+        metadata: {
+            timestamp: new Date().toISOString(),
+            tools: [{ vendor: 'tangle-network', name: 'starter-foundry', version: '0.5.4' }],
+            component: { type: 'application', name: projectName, version: '0.0.1' },
+        },
+        components,
+    };
+}
+export async function writeSbom(outDir, projectName) {
+    const sbom = await generateSbom(outDir, projectName);
+    if (!sbom)
+        return null;
+    const target = path.join(outDir, '.starter-foundry', 'sbom.cdx.json');
+    await fs.mkdir(path.dirname(target), { recursive: true });
+    await fs.writeFile(target, JSON.stringify(sbom, null, 2));
+    return target;
+}
+//# sourceMappingURL=sbom.js.map

package/dist/lib/sbom.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sbom.js","sourceRoot":"","sources":["../../src/lib/sbom.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,8EAA8E;AAC9E,4EAA4E;AAC5E,EAAE;AACF,2EAA2E;AAC3E,yCAAyC;AAEzC,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACjC,OAAO,IAAI,MAAM,WAAW,CAAA;AAuB5B;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,WAAmB;IACpE,MAAM,UAAU,GAAoB,EAAE,CAAA;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAGxD,CAAA;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;YAC9G,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI;gBACJ,OAAO;gBACP,SAAS,EAAE,WAAW,kBAAkB,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE;gBAC/E,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,WAAW,kBAAkB,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE;aAC3E,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;QACvC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAA;YACxE,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,+BAA+B,CAAC,EAAE,CAAC;gBACpE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAA;gBACtB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAE,CAAA;gBACzB,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI;oBACJ,OAAO;oBACP,SAAS,EAAE,aAAa,IAAI,IAAI,OAAO,EAAE;oBACzC,IAAI,EAAE,SAAS;oBACf,IAAI,EAAE,aAAa,IAAI,IAAI,OAAO,EAAE;iBACrC,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,2CAA2C;YAC3C,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAAE,MAAM,CAAC,CAAA;gBAC5E,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAA;oBAC/D,IAAI,CAAC,CAAC;wBAAE,SAAQ;oBAChB,UAAU,CAAC,IAAI,CAAC;wBACd,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE;wBACX,OAAO,EAAE,CAAC,CAAC,CAAC,CAAE;wBACd,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;wBACrC,IAAI,EAAE,SAAS;wBACf,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;qBACjC,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,SAAS,EAAE,WAAW;QACtB,WAAW,EAAE,KAAK;QAClB,YAAY,EAAE,eAAe,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;QACpF,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE;YACR,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YAChF,SAAS,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE;SACxE;QACD,UAAU;KACX,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,WAAmB;IACjE,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IACpD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,kBAAkB,EAAE,eAAe,CAAC,CAAA;IACrE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACzD,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IACzD,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/lib/selection.d.ts

@@ -1,4 +1,26 @@
 import type { SelectionResult } from '../types.js';
+/**
+ * Pick a template-library version for `familyId`, optionally diverse-serving
+ * from the top-N candidates when `STARTER_FOUNDRY_DIVERSE_SERVE=1` is set.
+ *
+ * Default behavior (env unset or 0): returns the `current` pointer from
+ * `.evolve/template-library/<family>/_index.json`. Same version every call
+ * — no behavior change vs today.
+ *
+ * Diverse-serve (env=1): hashes the project name (or any stable seed) into
+ * a deterministic index within `topN`, so two different projects can land
+ * on two different versions but the same project name always gets the same
+ * version. Gives us production-grade A/B across the top-quality candidates
+ * without per-user randomization breaking replay.
+ *
+ * Returns null when no `_index.json` exists (family isn't in the library
+ * yet) so callers can fall through to the canonical `registry/layers/`
+ * serve path unchanged.
+ */
+export declare function selectTemplateVersion(familyId: string, seed: string, opts?: {
+    repoRoot?: string;
+    envDiverseServe?: string;
+}): string | null;
 export declare function selectStarter({ prompt, partner, }: {
     prompt: string;
     partner?: string | null;