@theglitchking/hit-em-with-the-docs 2.7.1 → 2.8.0

package/dist/action/utils/config.d.ts

@@ -35,16 +35,16 @@ export declare const customDomainSchema: z.ZodObject<{
     id: string;
     name: string;
     description: string;
+    category: "features" | "development" | "core" | "advanced";
     keywords: string[];
     loadPriority: number;
-    category: "features" | "core" | "development" | "advanced";
 }, {
     id: string;
     name: string;
     description: string;
+    category: "features" | "development" | "core" | "advanced";
     keywords: string[];
     loadPriority: number;
-    category: "features" | "core" | "development" | "advanced";
 }>;
 export type CustomDomainConfig = z.infer<typeof customDomainSchema>;
 /**
@@ -88,6 +88,22 @@ declare const archiveConfigSchema: z.ZodDefault<z.ZodObject<{
     require_orphaned?: boolean | undefined;
     auto?: boolean | undefined;
 }>>;
+/**
+ * Lifecycle enforcement (2.8.0). Governs the PreToolUse guard, which is what
+ * makes the policy binding on an agent rather than merely documented. Both
+ * rules default ON — but they are opt-out, because a guard nobody can disable
+ * is a guard people uninstall the plugin to escape.
+ */
+declare const enforcementConfigSchema: z.ZodDefault<z.ZodObject<{
+    block_index_edits: z.ZodDefault<z.ZodBoolean>;
+    block_doc_deletion: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    block_index_edits: boolean;
+    block_doc_deletion: boolean;
+}, {
+    block_index_edits?: boolean | undefined;
+    block_doc_deletion?: boolean | undefined;
+}>>;
 declare const pluginConfigSchema: z.ZodObject<{
     vault: z.ZodDefault<z.ZodObject<{
         root: z.ZodDefault<z.ZodString>;
@@ -102,6 +118,16 @@ declare const pluginConfigSchema: z.ZodObject<{
         playbook_paths?: string[] | undefined;
         audit_window_days?: number | undefined;
     }>>;
+    enforcement: z.ZodDefault<z.ZodObject<{
+        block_index_edits: z.ZodDefault<z.ZodBoolean>;
+        block_doc_deletion: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        block_index_edits: boolean;
+        block_doc_deletion: boolean;
+    }, {
+        block_index_edits?: boolean | undefined;
+        block_doc_deletion?: boolean | undefined;
+    }>>;
     domains: z.ZodDefault<z.ZodEffects<z.ZodArray<z.ZodObject<{
         id: z.ZodString;
         name: z.ZodString;
@@ -113,23 +139,23 @@ declare const pluginConfigSchema: z.ZodObject<{
         id: string;
         name: string;
         description: string;
+        category: "features" | "development" | "core" | "advanced";
         keywords: string[];
         loadPriority: number;
-        category: "features" | "core" | "development" | "advanced";
     }, {
         id: string;
         name: string;
         description: string;
+        category: "features" | "development" | "core" | "advanced";
         keywords: string[];
         loadPriority: number;
-        category: "features" | "core" | "development" | "advanced";
     }>, "many">, {
         id: string;
         name: string;
         description: string;
+        category: "features" | "development" | "core" | "advanced";
         keywords: string[];
         loadPriority: number;
-        category: "features" | "core" | "development" | "advanced";
     }[], unknown>>;
     archive: z.ZodDefault<z.ZodObject<{
         honor_status_deprecated: z.ZodDefault<z.ZodBoolean>;
@@ -161,6 +187,16 @@ declare const pluginConfigSchema: z.ZodObject<{
         playbook_paths?: string[] | undefined;
         audit_window_days?: number | undefined;
     }>>;
+    enforcement: z.ZodDefault<z.ZodObject<{
+        block_index_edits: z.ZodDefault<z.ZodBoolean>;
+        block_doc_deletion: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        block_index_edits: boolean;
+        block_doc_deletion: boolean;
+    }, {
+        block_index_edits?: boolean | undefined;
+        block_doc_deletion?: boolean | undefined;
+    }>>;
     domains: z.ZodDefault<z.ZodEffects<z.ZodArray<z.ZodObject<{
         id: z.ZodString;
         name: z.ZodString;
@@ -172,23 +208,23 @@ declare const pluginConfigSchema: z.ZodObject<{
         id: string;
         name: string;
         description: string;
+        category: "features" | "development" | "core" | "advanced";
         keywords: string[];
         loadPriority: number;
-        category: "features" | "core" | "development" | "advanced";
     }, {
         id: string;
         name: string;
         description: string;
+        category: "features" | "development" | "core" | "advanced";
         keywords: string[];
         loadPriority: number;
-        category: "features" | "core" | "development" | "advanced";
     }>, "many">, {
         id: string;
         name: string;
         description: string;
+        category: "features" | "development" | "core" | "advanced";
         keywords: string[];
         loadPriority: number;
-        category: "features" | "core" | "development" | "advanced";
     }[], unknown>>;
     archive: z.ZodDefault<z.ZodObject<{
         honor_status_deprecated: z.ZodDefault<z.ZodBoolean>;
@@ -220,6 +256,16 @@ declare const pluginConfigSchema: z.ZodObject<{
         playbook_paths?: string[] | undefined;
         audit_window_days?: number | undefined;
     }>>;
+    enforcement: z.ZodDefault<z.ZodObject<{
+        block_index_edits: z.ZodDefault<z.ZodBoolean>;
+        block_doc_deletion: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        block_index_edits: boolean;
+        block_doc_deletion: boolean;
+    }, {
+        block_index_edits?: boolean | undefined;
+        block_doc_deletion?: boolean | undefined;
+    }>>;
     domains: z.ZodDefault<z.ZodEffects<z.ZodArray<z.ZodObject<{
         id: z.ZodString;
         name: z.ZodString;
@@ -231,23 +277,23 @@ declare const pluginConfigSchema: z.ZodObject<{
         id: string;
         name: string;
         description: string;
+        category: "features" | "development" | "core" | "advanced";
         keywords: string[];
         loadPriority: number;
-        category: "features" | "core" | "development" | "advanced";
     }, {
         id: string;
         name: string;
         description: string;
+        category: "features" | "development" | "core" | "advanced";
         keywords: string[];
         loadPriority: number;
-        category: "features" | "core" | "development" | "advanced";
     }>, "many">, {
         id: string;
         name: string;
         description: string;
+        category: "features" | "development" | "core" | "advanced";
         keywords: string[];
         loadPriority: number;
-        category: "features" | "core" | "development" | "advanced";
     }[], unknown>>;
     archive: z.ZodDefault<z.ZodObject<{
         honor_status_deprecated: z.ZodDefault<z.ZodBoolean>;
@@ -267,6 +313,7 @@ declare const pluginConfigSchema: z.ZodObject<{
     }>>;
 }, z.ZodTypeAny, "passthrough">>;
 export type VaultConfig = z.infer<typeof vaultConfigSchema>;
+export type EnforcementConfig = z.infer<typeof enforcementConfigSchema>;
 export type ArchiveConfig = z.infer<typeof archiveConfigSchema>;
 export type PluginConfig = z.infer<typeof pluginConfigSchema>;
 /**

package/dist/action/utils/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["file:///home/tmarlette/workspace/the-glitch-kingdom/hit-em-with-the-docs/src/utils/config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,kBAAkB,mCAAmC,CAAC;AACnE,eAAO,MAAM,sBAAsB,UAA6B,CAAC;AACjE,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAK5C;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,0DAKzB,CAAC;AAEX;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;EAO7B,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAgBpE;;;;GAIG;AACH,QAAA,MAAM,iBAAiB;;;;;;;;;;;;GAMT,CAAC;AAEf,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAElD;;;;;GAKG;AACH,QAAA,MAAM,mBAAmB;;;;;;;;;;;;;;;GAWX,CAAC;AAEf,QAAA,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAMR,CAAC;AAEjB,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC5D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAI9D;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAkBlF;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,YAAY,CAiBvE;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAYlC;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAAC,MAAM,CAAC,CAKjB;AAED,2EAA2E;AAC3E,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,MAAM,CAElF;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,YAAY,GACnB,MAAM,EAAE,CAEV"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["file:///home/tmarlette/workspace/the-glitch-kingdom/hit-em-with-the-docs/src/utils/config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,kBAAkB,mCAAmC,CAAC;AACnE,eAAO,MAAM,sBAAsB,UAA6B,CAAC;AACjE,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAK5C;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,0DAKzB,CAAC;AAEX;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;EAO7B,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAgBpE;;;;GAIG;AACH,QAAA,MAAM,iBAAiB;;;;;;;;;;;;GAMT,CAAC;AAEf,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAElD;;;;;GAKG;AACH,QAAA,MAAM,mBAAmB;;;;;;;;;;;;;;;GAWX,CAAC;AAEf;;;;;GAKG;AACH,QAAA,MAAM,uBAAuB;;;;;;;;;GAKf,CAAC;AAEf,QAAA,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAOR,CAAC;AAEjB,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC5D,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAI9D;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAkBlF;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,YAAY,CAiBvE;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAYlC;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAAC,MAAM,CAAC,CAKjB;AAED,2EAA2E;AAC3E,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,MAAM,CAElF;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,YAAY,GACnB,MAAM,EAAE,CAEV"}

package/dist/action/utils/glob.d.ts

@@ -9,10 +9,21 @@ export interface GlobOptions {
  */
 export declare function glob(pattern: string, options?: GlobOptions): Promise<string[]>;
 /**
- * Reserved documentation subdirectory for DEPRECATED docs. Anything under
- * `<docs>/archive/` is intentionally excluded from every hewtd scan (audit,
- * link-check, metadata-sync, integrate dup-detection, link graph, search) —
- * it's a parking lot for retired docs, not part of the active corpus.
+ * Reserved documentation subdirectory for DEPRECATED docs.
+ *
+ * **Archived content is referenceable, never concrete.** A link *into* the
+ * archive still resolves — link-check validates targets by file existence, so
+ * history stays reachable. But nothing under an `archive/` folder is part of
+ * the active corpus: it is not indexed, not audited, not metadata-validated,
+ * not dup-checked, and never counted. It is what the docs *used* to say, and it
+ * is never evidence of what is true now.
+ *
+ * The exclusion applies at **any depth** — `<docs>/archive/` and
+ * `<docs>/features/archive/` alike. Before 2.8.0 the ignore glob was anchored
+ * at the docs root, so a nested `archive/` was still scanned and validated
+ * (while 2.7.1's indexer correctly skipped it) — archived docs could raise
+ * audit errors and stale-metadata warnings for content nobody was supposed to
+ * be reading.
  */
 export declare const ARCHIVE_DIR = "archive";
 /**

package/dist/action/utils/glob.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"glob.d.ts","sourceRoot":"","sources":["file:///home/tmarlette/workspace/the-glitch-kingdom/hit-em-with-the-docs/src/utils/glob.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED;;GAEG;AACH,wBAAsB,IAAI,CACxB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,MAAM,EAAE,CAAC,CAiBnB;AAED;;;;;GAKG;AACH,eAAO,MAAM,WAAW,YAAY,CAAC;AAUrC;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,IAAI,CAAC,WAAW,EAAE,UAAU,CAAM,GAC1C,OAAO,CAAC,MAAM,EAAE,CAAC,CAQnB;AAED;;GAEG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAO/D;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOhE;AAED;;GAEG;AACH,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAO3D;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAStE;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAEtE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGpD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAElD"}
+{"version":3,"file":"glob.d.ts","sourceRoot":"","sources":["file:///home/tmarlette/workspace/the-glitch-kingdom/hit-em-with-the-docs/src/utils/glob.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED;;GAEG;AACH,wBAAsB,IAAI,CACxB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,MAAM,EAAE,CAAC,CAiBnB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,WAAW,YAAY,CAAC;AAWrC;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,IAAI,CAAC,WAAW,EAAE,UAAU,CAAM,GAC1C,OAAO,CAAC,MAAM,EAAE,CAAC,CAQnB;AAED;;GAEG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAO/D;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOhE;AAED;;GAEG;AACH,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAO3D;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAStE;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAEtE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGpD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAElD"}

package/dist/core/enforce/guard.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Lifecycle enforcement — the decision function behind the PreToolUse hook.
+ *
+ * hewtd's lifecycle policy has always been enforced at the CLI boundary (the
+ * archive link guard, `auto: false`, the frontmatter schema). None of that
+ * binds an *agent*, which will happily `rm` a doc, hand-edit a generated
+ * INDEX.md, or invent its own `docs/` folder. This is the part the model
+ * cannot reason its way past: the harness runs it, and a `deny` is final.
+ *
+ * Two rules deny, because they destroy work or corrupt a generated artifact.
+ * Everything else at most warns. Anything unrecognized is allowed — this runs
+ * in every session the plugin is installed in, including repos that have
+ * nothing to do with hewtd, so the cost of a false positive is far higher
+ * than the cost of a miss.
+ */
+export type GuardDecision = {
+    action: 'allow';
+} | {
+    action: 'warn';
+    context: string;
+} | {
+    action: 'deny';
+    reason: string;
+};
+export interface GuardInput {
+    toolName: string;
+    /** `file_path` for Write/Edit. */
+    filePath?: string;
+    /** `command` for Bash. */
+    command?: string;
+    /** `content` (Write) or `new_string` (Edit) — used to spot lifecycle changes. */
+    text?: string;
+    /** Docs root relative to the project, e.g. `.documentation`. */
+    docsDir: string;
+}
+/** Which enforcement rules are active. Both default on; users can opt out. */
+export interface EnforcementPolicy {
+    blockIndexEdits: boolean;
+    blockDocDeletion: boolean;
+}
+export declare const DEFAULT_ENFORCEMENT: EnforcementPolicy;
+/**
+ * Is this path inside an `archive/` folder, at any depth?
+ *
+ * Archived docs are **referenceable but never concrete** — history you may cite,
+ * never evidence of what is true now. Nothing under an `archive/` folder is
+ * indexed, audited, link-checked, or validated.
+ */
+export declare function isArchived(path: string): boolean;
+/**
+ * Decide what to do about one tool call. Pure — all I/O lives in the hook.
+ */
+export declare function evaluate(input: GuardInput, policy?: EnforcementPolicy): GuardDecision;
+//# sourceMappingURL=guard.d.ts.map

package/dist/core/enforce/guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../../src/core/enforce/guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAOH,MAAM,MAAM,aAAa,GACrB;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GACnB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0BAA0B;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,8EAA8E;AAC9E,MAAM,WAAW,iBAAiB;IAChC,eAAe,EAAE,OAAO,CAAC;IACzB,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED,eAAO,MAAM,mBAAmB,EAAE,iBAGjC,CAAC;AAOF;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIhD;AA4BD;;GAEG;AACH,wBAAgB,QAAQ,CACtB,KAAK,EAAE,UAAU,EACjB,MAAM,GAAE,iBAAuC,GAC9C,aAAa,CA4Gf"}

package/dist/core/enforce/guard.js

@@ -0,0 +1,201 @@
+/**
+ * Lifecycle enforcement — the decision function behind the PreToolUse hook.
+ *
+ * hewtd's lifecycle policy has always been enforced at the CLI boundary (the
+ * archive link guard, `auto: false`, the frontmatter schema). None of that
+ * binds an *agent*, which will happily `rm` a doc, hand-edit a generated
+ * INDEX.md, or invent its own `docs/` folder. This is the part the model
+ * cannot reason its way past: the harness runs it, and a `deny` is final.
+ *
+ * Two rules deny, because they destroy work or corrupt a generated artifact.
+ * Everything else at most warns. Anything unrecognized is allowed — this runs
+ * in every session the plugin is installed in, including repos that have
+ * nothing to do with hewtd, so the cost of a false positive is far higher
+ * than the cost of a miss.
+ */
+import { basename } from 'path';
+/** Files hewtd generates and owns. Hand-editing them is always wrong. */
+const GENERATED_FILES = new Set(['INDEX.md', 'REGISTRY.md']);
+export const DEFAULT_ENFORCEMENT = {
+    blockIndexEdits: true,
+    blockDocDeletion: true,
+};
+/** Posix-normalized, leading-`./`-stripped path for matching. */
+function normalize(p) {
+    return p.replace(/\\/g, '/').replace(/^\.\//, '');
+}
+/**
+ * Is this path inside an `archive/` folder, at any depth?
+ *
+ * Archived docs are **referenceable but never concrete** — history you may cite,
+ * never evidence of what is true now. Nothing under an `archive/` folder is
+ * indexed, audited, link-checked, or validated.
+ */
+export function isArchived(path) {
+    return normalize(path)
+        .split('/')
+        .some((segment) => segment === 'archive');
+}
+/** Is this path inside the documentation tree? */
+function inDocsTree(path, docsDir) {
+    const p = normalize(path);
+    const d = normalize(docsDir);
+    return p === d || p.includes(`/${d}/`) || p.startsWith(`${d}/`);
+}
+/**
+ * Shell commands that destroy a file. `mv` is deliberately absent: moving a
+ * doc is how `archive` itself works (via `git mv`), and a hand-rolled move is
+ * a warn, not a denial — it loses the frontmatter stamping, but loses nothing.
+ */
+const DESTRUCTIVE_RE = /(^|[\s;&|(])(rm|unlink|shred)\s|(^|[\s;&|(])git\s+rm\s/;
+/** Markdown paths a shell command names. */
+function markdownTargets(command, docsDir) {
+    const d = normalize(docsDir);
+    const re = new RegExp(`[^\\s'"\`;&|]*${d}/[^\\s'"\`;&|]*\\.md`, 'g');
+    return command.match(re) ?? [];
+}
+/** Does this text set `status: deprecated` in frontmatter? */
+function setsDeprecated(text) {
+    return /^\s*status:\s*['"]?deprecated['"]?\s*$/m.test(text);
+}
+/**
+ * Decide what to do about one tool call. Pure — all I/O lives in the hook.
+ */
+export function evaluate(input, policy = DEFAULT_ENFORCEMENT) {
+    const { toolName, filePath, command, text, docsDir } = input;
+    // ---- Write / Edit -------------------------------------------------------
+    if ((toolName === 'Write' || toolName === 'Edit') && filePath) {
+        const inTree = inDocsTree(filePath, docsDir);
+        // DENY: a generated index is not a document. Editing it by hand is either
+        // pointless (the next `hewtd index` overwrites it) or actively harmful
+        // (it is how people ended up hand-curating rows the indexer then deleted
+        // — see issue #12).
+        if (policy.blockIndexEdits && inTree && GENERATED_FILES.has(basename(filePath))) {
+            return {
+                action: 'deny',
+                reason: `${basename(filePath)} is a generated artifact, rebuilt from the documents ` +
+                    `on disk. Hand-edits are overwritten by the next \`hewtd index\` or ` +
+                    `\`hewtd maintain\`. To change what it lists, change the documents — then ` +
+                    `run \`hewtd index\`.`,
+            };
+        }
+        // WARN: a doc outside the tree is invisible to every hewtd scan. Scoped to
+        // markdown that is plausibly *documentation* — a rival `docs/` folder, or a
+        // loose doc at the repo root. Warning on every .md anywhere (a fixture, a
+        // subpackage README, a website's own docs) would be noise, and a noisy
+        // guard is one people switch off.
+        if (!inTree && looksLikeStrayDoc(filePath)) {
+            return {
+                action: 'warn',
+                context: `This project manages its documentation with hit-em-with-the-docs, under ` +
+                    `\`${docsDir}/\`. A markdown file outside that tree is not indexed, ` +
+                    `link-checked, or metadata-validated. \`hewtd integrate <file>\` classifies ` +
+                    `a doc into a domain and registers it.`,
+            };
+        }
+        // WARN: archived content is historical. Editing it is not destructive —
+        // hence a warn, not a denial — but it is almost always a mistake: the edit
+        // lands in a subtree that no scan reads and no index lists, so it changes
+        // nothing anyone will see.
+        if (inTree && isArchived(filePath)) {
+            return {
+                action: 'warn',
+                context: `This file is under an \`archive/\` folder. Archived documentation is ` +
+                    `historical: it is excluded from every hewtd scan — not indexed, not ` +
+                    `audited, not link-checked, not validated — and describes what the docs ` +
+                    `used to say, not what is true now. It can be referenced, but it is never ` +
+                    `evidence of current behavior. \`hewtd unarchive <file>\` restores it to ` +
+                    `its domain as an active document.`,
+            };
+        }
+        // WARN: `status: deprecated` flags intent but leaves the doc live and
+        // indexed. Archiving is the separate step that actually retires it.
+        if (inTree && text && setsDeprecated(text)) {
+            return {
+                action: 'warn',
+                context: `\`status: deprecated\` marks intent but leaves the document in its domain ` +
+                    `folder, still indexed and still scanned. \`hewtd archive <file>\` retires ` +
+                    `it: the move is reversible (\`archived_from\` records the origin) and ` +
+                    `link-safe (it refuses if active docs still link to it).`,
+            };
+        }
+        return { action: 'allow' };
+    }
+    // ---- Bash ---------------------------------------------------------------
+    if (toolName === 'Bash' && command) {
+        const targets = markdownTargets(command, docsDir);
+        if (targets.length === 0)
+            return { action: 'allow' };
+        // DENY: deleting a doc is the one truly irreversible act, and hewtd has a
+        // purpose-built, reversible, link-safe alternative. This is the whole
+        // reason the plugin never calls rm/unlink anywhere in its own source.
+        if (policy.blockDocDeletion && DESTRUCTIVE_RE.test(command)) {
+            return {
+                action: 'deny',
+                reason: `Deleting documentation is destructive and hewtd never does it. ` +
+                    `\`hewtd archive ${targets[0]}\` retires a doc instead: it moves the file ` +
+                    `under \`archive/\` (preserving git history), stamps \`archived_from\` so ` +
+                    `\`hewtd unarchive\` can restore it exactly, and refuses if active docs ` +
+                    `still link to it. Use \`--force\` there to override the link guard.`,
+            };
+        }
+        // WARN: a hand-rolled move into archive/ skips the frontmatter stamping,
+        // so `unarchive` has no `archived_from` to restore from.
+        if (/(^|[\s;&|(])(mv|git\s+mv)\s/.test(command) && /archive\//.test(command)) {
+            return {
+                action: 'warn',
+                context: `Moving a doc into \`archive/\` by hand skips the lifecycle stamping. ` +
+                    `\`hewtd archive <file>\` records \`archived_on\`, \`archived_from\`, and ` +
+                    `\`archived_reason\`, which is what makes \`hewtd unarchive\` lossless; a ` +
+                    `plain move leaves nothing to restore from.`,
+            };
+        }
+        return { action: 'allow' };
+    }
+    return { action: 'allow' };
+}
+/** A repo's own top-level markdown — never documentation-tree content. */
+const PROJECT_FILES = new Set([
+    'README.MD',
+    'CHANGELOG.MD',
+    'CONTRIBUTING.MD',
+    'LICENSE.MD',
+    'CLAUDE.MD',
+    'AGENTS.MD',
+    'SECURITY.MD',
+    'CODE_OF_CONDUCT.MD',
+]);
+/** Folder names that mean "somebody is starting a rival documentation tree". */
+const RIVAL_DOC_DIRS = new Set(['docs', 'doc', 'documentation', 'wiki', 'guides']);
+/**
+ * Is this markdown a *stray document* — something that ought to have gone
+ * through `integrate`?
+ *
+ * Deliberately narrow. It catches the real failure mode (an agent creating
+ * `docs/how-it-works.md` in a repo that already has a managed tree, or dropping
+ * a loose doc at the root) and stays silent on markdown that is obviously not
+ * documentation: source fixtures, subpackage READMEs, a website's own content,
+ * agent scaffolding. Anything it misses is merely un-nagged; anything it
+ * over-claims is a papercut on every unrelated file the user writes.
+ */
+function looksLikeStrayDoc(filePath) {
+    const p = normalize(filePath);
+    if (!p.endsWith('.md'))
+        return false;
+    const segments = p.split('/');
+    const name = basename(p).toUpperCase();
+    // Agent/tooling scaffolding and dependencies are never docs.
+    if (segments.some((s) => s === 'node_modules' || s === '.planning' || s === '.claude')) {
+        return false;
+    }
+    // A rival docs folder anywhere in the path.
+    if (segments.slice(0, -1).some((s) => RIVAL_DOC_DIRS.has(s.toLowerCase()))) {
+        return true;
+    }
+    // A loose doc sitting at the repo root that isn't one of the standard
+    // project files.
+    if (segments.length === 1 && !PROJECT_FILES.has(name))
+        return true;
+    return false;
+}
+//# sourceMappingURL=guard.js.map

package/dist/core/enforce/guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../../../src/core/enforce/guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAC;AAEhC,yEAAyE;AACzE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC;AAyB7D,MAAM,CAAC,MAAM,mBAAmB,GAAsB;IACpD,eAAe,EAAE,IAAI;IACrB,gBAAgB,EAAE,IAAI;CACvB,CAAC;AAEF,iEAAiE;AACjE,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,SAAS,CAAC,IAAI,CAAC;SACnB,KAAK,CAAC,GAAG,CAAC;SACV,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC;AAC9C,CAAC;AAED,kDAAkD;AAClD,SAAS,UAAU,CAAC,IAAY,EAAE,OAAe;IAC/C,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,cAAc,GAAG,wDAAwD,CAAC;AAEhF,4CAA4C;AAC5C,SAAS,eAAe,CAAC,OAAe,EAAE,OAAe;IACvD,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC7B,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;IACrE,OAAO,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,8DAA8D;AAC9D,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ,CACtB,KAAiB,EACjB,SAA4B,mBAAmB;IAE/C,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAE7D,4EAA4E;IAC5E,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAE7C,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,oBAAoB;QACpB,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAChF,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,MAAM,EACJ,GAAG,QAAQ,CAAC,QAAQ,CAAC,uDAAuD;oBAC5E,qEAAqE;oBACrE,2EAA2E;oBAC3E,sBAAsB;aACzB,CAAC;QACJ,CAAC;QAED,2EAA2E;QAC3E,4EAA4E;QAC5E,0EAA0E;QAC1E,uEAAuE;QACvE,kCAAkC;QAClC,IAAI,CAAC,MAAM,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3C,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,OAAO,EACL,0EAA0E;oBAC1E,KAAK,OAAO,yDAAyD;oBACrE,6EAA6E;oBAC7E,uCAAuC;aAC1C,CAAC;QACJ,CAAC;QAED,wEAAwE;QACxE,2EAA2E;QAC3E,0EAA0E;QAC1E,2BAA2B;QAC3B,IAAI,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnC,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,OAAO,EACL,uEAAuE;oBACvE,sEAAsE;oBACtE,yEAAyE;oBACzE,2EAA2E;oBAC3E,0EAA0E;oBAC1E,mCAAmC;aACtC,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,oEAAoE;QACpE,IAAI,MAAM,IAAI,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,OAAO,EACL,4EAA4E;oBAC5E,4EAA4E;oBAC5E,wEAAwE;oBACxE,yDAAyD;aAC5D,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC7B,CAAC;IAED,4EAA4E;IAC5E,IAAI,QAAQ,KAAK,MAAM,IAAI,OAAO,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAErD,0EAA0E;QAC1E,sEAAsE;QACtE,sEAAsE;QACtE,IAAI,MAAM,CAAC,gBAAgB,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5D,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,MAAM,EACJ,iEAAiE;oBACjE,mBAAmB,OAAO,CAAC,CAAC,CAAC,8CAA8C;oBAC3E,2EAA2E;oBAC3E,yEAAyE;oBACzE,qEAAqE;aACxE,CAAC;QACJ,CAAC;QAED,yEAAyE;QACzE,yDAAyD;QACzD,IAAI,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7E,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,OAAO,EACL,uEAAuE;oBACvE,2EAA2E;oBAC3E,2EAA2E;oBAC3E,4CAA4C;aAC/C,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC7B,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC;AAED,0EAA0E;AAC1E,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,WAAW;IACX,cAAc;IACd,iBAAiB;IACjB,YAAY;IACZ,WAAW;IACX,WAAW;IACX,aAAa;IACb,oBAAoB;CACrB,CAAC,CAAC;AAEH,gFAAgF;AAChF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEnF;;;;;;;;;;GAUG;AACH,SAAS,iBAAiB,CAAC,QAAgB;IACzC,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAErC,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAEvC,6DAA6D;IAC7D,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,cAAc,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,SAAS,CAAC,EAAE,CAAC;QACvF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,4CAA4C;IAC5C,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sEAAsE;IACtE,iBAAiB;IACjB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnE,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/index.d.ts

@@ -34,6 +34,7 @@ export * from './reports/link-report.js';
 export * from './core/archive/manage.js';
 export * from './core/archive/candidates.js';
 export * from './core/archive/links.js';
+export * from './core/enforce/guard.js';
 export * from './core/metadata/errors.js';
 export * from './core/knowledge-base/citers.js';
 export * from './generators/facts-index.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,cAAc,6BAA6B,CAAC;AAC5C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,8BAA8B,CAAC;AAG7C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,8BAA8B,CAAC;AAG7C,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AAGpC,cAAc,0BAA0B,CAAC;AACzC,cAAc,iCAAiC,CAAC;AAChD,cAAc,oCAAoC,CAAC;AACnD,cAAc,4BAA4B,CAAC;AAG3C,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iCAAiC,CAAC;AAGhD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iCAAiC,CAAC;AAChD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iCAAiC,CAAC;AAGhD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AAGzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,yBAAyB,CAAC;AAGxC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iCAAiC,CAAC;AAChD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,cAAc,6BAA6B,CAAC;AAC5C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,8BAA8B,CAAC;AAG7C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,8BAA8B,CAAC;AAG7C,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AAGpC,cAAc,0BAA0B,CAAC;AACzC,cAAc,iCAAiC,CAAC;AAChD,cAAc,oCAAoC,CAAC;AACnD,cAAc,4BAA4B,CAAC;AAG3C,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iCAAiC,CAAC;AAGhD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iCAAiC,CAAC;AAChD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iCAAiC,CAAC;AAGhD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AAGzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,yBAAyB,CAAC;AAGxC,cAAc,yBAAyB,CAAC;AAGxC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iCAAiC,CAAC;AAChD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC"}

package/dist/index.js

@@ -42,6 +42,8 @@ export * from './reports/link-report.js';
 export * from './core/archive/manage.js';
 export * from './core/archive/candidates.js';
 export * from './core/archive/links.js';
+// Lifecycle enforcement (2.8.0+)
+export * from './core/enforce/guard.js';
 // Knowledge-base primitives (2.3.0+)
 export * from './core/metadata/errors.js';
 export * from './core/knowledge-base/citers.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,qBAAqB;AACrB,cAAc,6BAA6B,CAAC;AAC5C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,8BAA8B,CAAC;AAE7C,kBAAkB;AAClB,cAAc,2BAA2B,CAAC;AAC1C,cAAc,8BAA8B,CAAC;AAE7C,YAAY;AACZ,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AAEpC,aAAa;AACb,cAAc,0BAA0B,CAAC;AACzC,cAAc,iCAAiC,CAAC;AAChD,cAAc,oCAAoC,CAAC;AACnD,cAAc,4BAA4B,CAAC;AAE3C,kBAAkB;AAClB,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iCAAiC,CAAC;AAEhD,mBAAmB;AACnB,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iCAAiC,CAAC;AAChD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iCAAiC,CAAC;AAEhD,UAAU;AACV,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AAEzC,4BAA4B;AAC5B,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,yBAAyB,CAAC;AAExC,qCAAqC;AACrC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iCAAiC,CAAC;AAChD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,qBAAqB;AACrB,cAAc,6BAA6B,CAAC;AAC5C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,8BAA8B,CAAC;AAE7C,kBAAkB;AAClB,cAAc,2BAA2B,CAAC;AAC1C,cAAc,8BAA8B,CAAC;AAE7C,YAAY;AACZ,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AAEpC,aAAa;AACb,cAAc,0BAA0B,CAAC;AACzC,cAAc,iCAAiC,CAAC;AAChD,cAAc,oCAAoC,CAAC;AACnD,cAAc,4BAA4B,CAAC;AAE3C,kBAAkB;AAClB,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iCAAiC,CAAC;AAEhD,mBAAmB;AACnB,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iCAAiC,CAAC;AAChD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iCAAiC,CAAC;AAEhD,UAAU;AACV,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AAEzC,4BAA4B;AAC5B,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,yBAAyB,CAAC;AAExC,iCAAiC;AACjC,cAAc,yBAAyB,CAAC;AAExC,qCAAqC;AACrC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iCAAiC,CAAC;AAChD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC"}

package/dist/utils/config.d.ts

@@ -88,6 +88,22 @@ declare const archiveConfigSchema: z.ZodDefault<z.ZodObject<{
     require_orphaned?: boolean | undefined;
     auto?: boolean | undefined;
 }>>;
+/**
+ * Lifecycle enforcement (2.8.0). Governs the PreToolUse guard, which is what
+ * makes the policy binding on an agent rather than merely documented. Both
+ * rules default ON — but they are opt-out, because a guard nobody can disable
+ * is a guard people uninstall the plugin to escape.
+ */
+declare const enforcementConfigSchema: z.ZodDefault<z.ZodObject<{
+    block_index_edits: z.ZodDefault<z.ZodBoolean>;
+    block_doc_deletion: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    block_index_edits: boolean;
+    block_doc_deletion: boolean;
+}, {
+    block_index_edits?: boolean | undefined;
+    block_doc_deletion?: boolean | undefined;
+}>>;
 declare const pluginConfigSchema: z.ZodObject<{
     vault: z.ZodDefault<z.ZodObject<{
         root: z.ZodDefault<z.ZodString>;
@@ -102,6 +118,16 @@ declare const pluginConfigSchema: z.ZodObject<{
         playbook_paths?: string[] | undefined;
         audit_window_days?: number | undefined;
     }>>;
+    enforcement: z.ZodDefault<z.ZodObject<{
+        block_index_edits: z.ZodDefault<z.ZodBoolean>;
+        block_doc_deletion: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        block_index_edits: boolean;
+        block_doc_deletion: boolean;
+    }, {
+        block_index_edits?: boolean | undefined;
+        block_doc_deletion?: boolean | undefined;
+    }>>;
     domains: z.ZodDefault<z.ZodEffects<z.ZodArray<z.ZodObject<{
         id: z.ZodString;
         name: z.ZodString;
@@ -161,6 +187,16 @@ declare const pluginConfigSchema: z.ZodObject<{
         playbook_paths?: string[] | undefined;
         audit_window_days?: number | undefined;
     }>>;
+    enforcement: z.ZodDefault<z.ZodObject<{
+        block_index_edits: z.ZodDefault<z.ZodBoolean>;
+        block_doc_deletion: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        block_index_edits: boolean;
+        block_doc_deletion: boolean;
+    }, {
+        block_index_edits?: boolean | undefined;
+        block_doc_deletion?: boolean | undefined;
+    }>>;
     domains: z.ZodDefault<z.ZodEffects<z.ZodArray<z.ZodObject<{
         id: z.ZodString;
         name: z.ZodString;
@@ -220,6 +256,16 @@ declare const pluginConfigSchema: z.ZodObject<{
         playbook_paths?: string[] | undefined;
         audit_window_days?: number | undefined;
     }>>;
+    enforcement: z.ZodDefault<z.ZodObject<{
+        block_index_edits: z.ZodDefault<z.ZodBoolean>;
+        block_doc_deletion: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        block_index_edits: boolean;
+        block_doc_deletion: boolean;
+    }, {
+        block_index_edits?: boolean | undefined;
+        block_doc_deletion?: boolean | undefined;
+    }>>;
     domains: z.ZodDefault<z.ZodEffects<z.ZodArray<z.ZodObject<{
         id: z.ZodString;
         name: z.ZodString;
@@ -267,6 +313,7 @@ declare const pluginConfigSchema: z.ZodObject<{
     }>>;
 }, z.ZodTypeAny, "passthrough">>;
 export type VaultConfig = z.infer<typeof vaultConfigSchema>;
+export type EnforcementConfig = z.infer<typeof enforcementConfigSchema>;
 export type ArchiveConfig = z.infer<typeof archiveConfigSchema>;
 export type PluginConfig = z.infer<typeof pluginConfigSchema>;
 /**

package/dist/utils/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/utils/config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,kBAAkB,mCAAmC,CAAC;AACnE,eAAO,MAAM,sBAAsB,UAA6B,CAAC;AACjE,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAK5C;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,0DAKzB,CAAC;AAEX;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;EAO7B,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAgBpE;;;;GAIG;AACH,QAAA,MAAM,iBAAiB;;;;;;;;;;;;GAMT,CAAC;AAEf,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAElD;;;;;GAKG;AACH,QAAA,MAAM,mBAAmB;;;;;;;;;;;;;;;GAWX,CAAC;AAEf,QAAA,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAMR,CAAC;AAEjB,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC5D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAI9D;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAkBlF;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,YAAY,CAiBvE;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAYlC;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAAC,MAAM,CAAC,CAKjB;AAED,2EAA2E;AAC3E,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,MAAM,CAElF;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,YAAY,GACnB,MAAM,EAAE,CAEV"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/utils/config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,kBAAkB,mCAAmC,CAAC;AACnE,eAAO,MAAM,sBAAsB,UAA6B,CAAC;AACjE,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAK5C;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,0DAKzB,CAAC;AAEX;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;EAO7B,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAgBpE;;;;GAIG;AACH,QAAA,MAAM,iBAAiB;;;;;;;;;;;;GAMT,CAAC;AAEf,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAElD;;;;;GAKG;AACH,QAAA,MAAM,mBAAmB;;;;;;;;;;;;;;;GAWX,CAAC;AAEf;;;;;GAKG;AACH,QAAA,MAAM,uBAAuB;;;;;;;;;GAKf,CAAC;AAEf,QAAA,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAOR,CAAC;AAEjB,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC5D,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAI9D;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAkBlF;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,YAAY,CAiBvE;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAYlC;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAAC,MAAM,CAAC,CAKjB;AAED,2EAA2E;AAC3E,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,MAAM,CAElF;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,YAAY,GACnB,MAAM,EAAE,CAEV"}

package/dist/utils/config.js

@@ -87,9 +87,22 @@ const archiveConfigSchema = z
     auto: z.boolean().default(false),
 })
     .default({});
+/**
+ * Lifecycle enforcement (2.8.0). Governs the PreToolUse guard, which is what
+ * makes the policy binding on an agent rather than merely documented. Both
+ * rules default ON — but they are opt-out, because a guard nobody can disable
+ * is a guard people uninstall the plugin to escape.
+ */
+const enforcementConfigSchema = z
+    .object({
+    block_index_edits: z.boolean().default(true),
+    block_doc_deletion: z.boolean().default(true),
+})
+    .default({});
 const pluginConfigSchema = z
     .object({
     vault: vaultConfigSchema,
+    enforcement: enforcementConfigSchema,
     domains: lenientDomainsArray,
     archive: archiveConfigSchema,
 })