@unbrained/pm-cli 2026.8.12 → 2026.8.14

package/dist/sdk/governance/assurance-presets.js

@@ -0,0 +1,136 @@
+/**
+ * @module sdk/governance/assurance-presets
+ *
+ * Supplies readable assurance starter bundles and observation-derived proposals
+ * without introducing privileged evaluation semantics.
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="05c29627-6763-5aee-8579-71e563a98780")}catch(e){}}();
+import { evaluateMeasurement, putAssuranceDeclaration, putAssuranceDeclarationBundle, } from "./assurance.js";
+/** Built-in project shapes that can acquire a quality contract in one command. */
+export const ASSURANCE_PRESET_IDS = [
+    "software-delivery",
+    "research",
+    "agent-evaluation",
+    "operations",
+];
+function assertion(id, measurementId, ownerItemId, ceiling, enforcement) {
+    return {
+        id,
+        measurement_id: measurementId,
+        owner_item_id: ownerItemId,
+        scope: { kind: "active" },
+        ceiling,
+        lifetime: "hold",
+        enforcement,
+        negative_control: {
+            cases: [
+                { observed: ceiling, expected: "pass" },
+                { observed: ceiling + 1, expected: "fail" },
+            ],
+        },
+    };
+}
+function evidencePreset(id, title, description, ownerItemId, links) {
+    const prefix = `preset-${id}`;
+    const measurements = links.map((link) => ({
+        id: `${prefix}-missing-${link}`,
+        description: `Active items missing ${link} evidence.`,
+        source: { kind: "links", link, state: "missing" },
+    }));
+    const assertions = measurements.map((measurement) => assertion(`${measurement.id}-zero`, measurement.id, ownerItemId, 0, "warn"));
+    return {
+        id,
+        title,
+        description,
+        declarations: {
+            measurements,
+            assertions,
+            gates: [
+                {
+                    id: `${prefix}-readiness`,
+                    description,
+                    assertion_ids: assertions.map((entry) => entry.id),
+                    triggers: ["ci", "scheduled"],
+                },
+            ],
+        },
+    };
+}
+/** Materialize one built-in preset as ordinary declarations owned by a pm item. */
+export function createAssurancePreset(id, ownerItemId) {
+    if (id === "software-delivery") {
+        return evidencePreset(id, "Software delivery", "Warn when active delivery work lacks executable tests or documentation.", ownerItemId, ["tests", "docs"]);
+    }
+    if (id === "research") {
+        return evidencePreset(id, "Research", "Warn when active research work lacks reproducibility files or documentation.", ownerItemId, ["files", "docs"]);
+    }
+    if (id === "agent-evaluation") {
+        return evidencePreset(id, "Agent evaluation", "Warn when active evaluation work lacks executable scenarios or recorded artifacts.", ownerItemId, ["tests", "files"]);
+    }
+    return evidencePreset(id, "Operations", "Warn when active operational work lacks runbook documentation or repair evidence.", ownerItemId, ["docs", "files"]);
+}
+/** Apply one preset atomically; a second identical application is idempotent. */
+export function applyAssurancePreset(pmRoot, id, ownerItemId, options = {}) {
+    return putAssuranceDeclarationBundle(pmRoot, createAssurancePreset(id, ownerItemId).declarations, options);
+}
+/** Propose active-scope evidence ceilings from the record without persisting them. */
+export async function deriveAssuranceProposals(context, ownerItemId) {
+    const terminalStatuses = new Set(context.terminal_statuses ?? ["closed", "canceled"]);
+    const activeContext = {
+        ...context,
+        items: context.items.filter((item) => !terminalStatuses.has(item.status)),
+    };
+    const proposals = await Promise.all(["files", "tests", "docs"].map(async (link) => {
+        const measurement = {
+            id: `derived-active-missing-${link}`,
+            description: `Observed active items missing ${link} evidence.`,
+            source: { kind: "links", link, state: "missing" },
+        };
+        const measured = await evaluateMeasurement(measurement, activeContext);
+        const observed = measured.value;
+        const derivedAssertion = assertion(`${measurement.id}-ceiling`, measurement.id, ownerItemId, observed, "observe");
+        const id = `active-missing-${link}`;
+        return {
+            id,
+            population_size: activeContext.items.length,
+            scope: { kind: "active" },
+            observed,
+            declarations: {
+                measurements: [measurement],
+                assertions: [derivedAssertion],
+                gates: [
+                    {
+                        id: `derived-${id}`,
+                        description: `Observe the accepted ${link} evidence baseline.`,
+                        assertion_ids: [derivedAssertion.id],
+                        triggers: ["ci", "scheduled"],
+                    },
+                ],
+            },
+        };
+    }));
+    return proposals;
+}
+/** Accept all derived proposals in one audited registry transaction. */
+export function acceptAssuranceProposals(pmRoot, proposals, options = {}) {
+    return putAssuranceDeclarationBundle(pmRoot, {
+        measurements: proposals.flatMap((proposal) => proposal.declarations.measurements),
+        assertions: proposals.flatMap((proposal) => proposal.declarations.assertions),
+        gates: proposals.flatMap((proposal) => proposal.declarations.gates),
+    }, options);
+}
+/** Promote one assertion by exactly one enforcement level and audit the transition. */
+export async function promoteAssuranceAssertion(pmRoot, definition, enforcement, options = {}) {
+    const expected = definition.enforcement === "observe" ? "warn" : "block";
+    if (definition.enforcement === "block" || enforcement !== expected) {
+        throw new TypeError(`assurance assertion ${definition.id} promotion must be ${definition.enforcement} -> ${expected}`);
+    }
+    return putAssuranceDeclaration(pmRoot, "assertion", { ...definition, enforcement }, {
+        ...options,
+        message: options.message ??
+            `Promote assurance assertion ${definition.id} from ${definition.enforcement} to ${enforcement}`,
+    });
+}
+//# sourceMappingURL=assurance-presets.js.map
+//# debugId=05c29627-6763-5aee-8579-71e563a98780

package/dist/sdk/governance/assurance-runtime.d.ts

@@ -11,6 +11,10 @@ export interface CreateAssuranceWorkspaceContextOptions {
     resolve_tree?: boolean;
     /** Provider resolvers keyed by stable provider id. */
     providers?: Readonly<Record<string, AssuranceProviderResolver>>;
+    /** Capabilities for host-provided resolvers that are not extension registrations. */
+    provider_capabilities?: AssuranceEvaluationContext["provider_capabilities"];
+    /** Gate trigger supplied to extension provider resolvers. */
+    trigger?: string;
 }
 /**
  * Build an assurance context from authoritative workspace data and public SDK

package/dist/sdk/governance/assurance-runtime.js

@@ -5,15 +5,87 @@
  * and verdict semantics in the host-neutral assurance module.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="abb3946c-ec68-52af-8521-ae0389f31f54")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="7c99dfd8-2fa4-56c4-8191-229701eab251")}catch(e){}}();
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { runGraph } from "../graph/run.js";
 import { runHealth } from "./health.js";
 import { runValidate } from "./validate.js";
+import { getActiveExtensionRegistrations, resolvePortableWorkspaceContext, } from "../../core/extensions/index.js";
+import { resolveRegisteredAssuranceMeasurementProvider } from "../../core/extensions/runtime-registrations.js";
+import { stableStringify } from "../../core/shared/serialization.js";
 import { getHistoryPath, listAllItemMetadata, readHistoryEntries, readSettings, resolveItemTypeRegistry, resolveRuntimeStatusRegistry, } from "../runtime-primitives.js";
 const execFileAsync = promisify(execFile);
 const HISTORY_READ_CONCURRENCY = 16;
+const DEFAULT_PROVIDER_TIMEOUT_MS = 30_000;
+function assertProviderResult(provider, key, result) {
+    const keyDefinition = provider.keys[key];
+    const valueMatches = keyDefinition.value_type === "number"
+        ? typeof result.value === "number" && Number.isFinite(result.value)
+        : Array.isArray(result.value) &&
+            result.value.every((entry) => typeof entry === "string");
+    if (!valueMatches) {
+        throw new TypeError(`assurance provider ${provider.id} key ${key} returned the wrong value type`);
+    }
+    if (!Number.isInteger(result.population_size) ||
+        result.population_size < 0 ||
+        !Number.isFinite(result.cost) ||
+        result.cost < 0) {
+        throw new TypeError(`assurance provider ${provider.id} returned an invalid population or cost`);
+    }
+    return result;
+}
+function validateProviderParameters(provider, source) {
+    const keyDefinition = provider.keys[source.key];
+    if (!keyDefinition) {
+        throw new TypeError(`assurance provider ${provider.id} does not declare key ${source.key}`);
+    }
+    const parameters = source.parameters ?? {};
+    const schema = keyDefinition.parameters ?? {};
+    for (const required of Object.entries(schema)
+        .filter(([, definition]) => definition.required === true)
+        .map(([name]) => name)) {
+        if (!Object.hasOwn(parameters, required)) {
+            throw new TypeError(`assurance provider ${provider.id} key ${source.key} requires parameter ${required}`);
+        }
+    }
+    for (const [name, value] of Object.entries(parameters)) {
+        const definition = schema[name];
+        if (!definition) {
+            throw new TypeError(`assurance provider ${provider.id} key ${source.key} does not declare parameter ${name}`);
+        }
+        if (value === null || typeof value !== definition.type) {
+            throw new TypeError(`assurance provider ${provider.id} parameter ${name} must be ${definition.type}`);
+        }
+    }
+    return { ...parameters };
+}
+async function runRegisteredProvider(provider, source, pmRoot, trigger) {
+    const parameters = validateProviderParameters(provider, source);
+    const providerPromise = Promise.resolve().then(() => provider.resolve({
+        provider: provider.id,
+        key: source.key,
+        parameters,
+        trigger,
+        pm_root: pmRoot,
+        ...resolvePortableWorkspaceContext(pmRoot),
+    }));
+    providerPromise.catch(() => { });
+    let timeoutHandle;
+    try {
+        const result = await Promise.race([
+            providerPromise,
+            new Promise((_, reject) => {
+                timeoutHandle = setTimeout(() => reject(new TypeError(`assurance provider ${provider.id} timed out`)), provider.timeout_ms ?? DEFAULT_PROVIDER_TIMEOUT_MS);
+                timeoutHandle.unref?.();
+            }),
+        ]);
+        return assertProviderResult(provider, source.key, result);
+    }
+    finally {
+        clearTimeout(timeoutHandle);
+    }
+}
 function valueAtPath(input, field) {
     let current = input;
     for (const segment of field.split(".")) {
@@ -96,6 +168,17 @@ export async function createAssuranceWorkspaceContext(pmRoot, options = {}) {
         type: item.type,
     }));
     const global = { path: pmRoot };
+    const activeRegistrations = getActiveExtensionRegistrations();
+    const registeredProviderCapabilities = Object.fromEntries((activeRegistrations?.assurance_providers ?? []).map((registration) => [
+        registration.definition.id,
+        {
+            cost_class: registration.runtime_definition.cost_class,
+            network: registration.runtime_definition.network,
+        },
+    ]));
+    const graphRuns = new Map();
+    let validateRun;
+    let healthRun;
     return {
         tree_id: options.resolve_tree === false
             ? (options.tree_id ?? "working-copy")
@@ -105,9 +188,22 @@ export async function createAssuranceWorkspaceContext(pmRoot, options = {}) {
             ? []
             : await readWorkspaceHistory(pmRoot, items),
         terminal_statuses: [...statusRegistry.terminal_statuses],
+        provider_capabilities: {
+            ...registeredProviderCapabilities,
+            ...options.provider_capabilities,
+        },
         external: async (source) => {
             if (source.kind === "graph") {
-                const result = await runGraph(source.operation, undefined, undefined, { ...source.parameters, full: true }, global);
+                const key = stableStringify({
+                    operation: source.operation,
+                    parameters: source.parameters ?? {},
+                });
+                let pending = graphRuns.get(key);
+                if (pending === undefined) {
+                    pending = runGraph(source.operation, undefined, undefined, { ...source.parameters, full: true }, global);
+                    graphRuns.set(key, pending);
+                }
+                const result = await pending;
                 return {
                     value: valueAtPath(result, source.field),
                     population_size: items.length,
@@ -115,20 +211,25 @@ export async function createAssuranceWorkspaceContext(pmRoot, options = {}) {
                 };
             }
             if (source.kind === "validate") {
-                const result = await runValidate({ counts: true }, global);
+                validateRun ??= runValidate({ counts: true }, global);
+                const result = await validateRun;
                 return checkValue(result, source.check, source.field);
             }
             if (source.kind === "health") {
-                const result = await runHealth(global, { checkOnly: true, full: true });
+                healthRun ??= runHealth(global, { checkOnly: true, full: true });
+                const result = await healthRun;
                 return checkValue(result, source.check, source.field);
             }
-            const provider = options.providers?.[source.provider];
-            if (!provider) {
+            const hostProvider = options.providers?.[source.provider];
+            if (hostProvider)
+                return hostProvider(source);
+            const registeredProvider = resolveRegisteredAssuranceMeasurementProvider(activeRegistrations, source.provider);
+            if (!registeredProvider) {
                 throw new TypeError(`assurance provider ${source.provider} is not registered`);
             }
-            return provider(source);
+            return runRegisteredProvider(registeredProvider.runtime_definition, source, pmRoot, options.trigger ?? "sdk");
         },
     };
 }
 //# sourceMappingURL=assurance-runtime.js.map
-//# debugId=abb3946c-ec68-52af-8521-ae0389f31f54
+//# debugId=7c99dfd8-2fa4-56c4-8191-229701eab251

package/dist/sdk/governance/assurance.d.ts

@@ -6,6 +6,8 @@ export declare const ASSURANCE_GATE_TRIGGERS: readonly ["pre-commit", "pre-push"
 export type AssuranceGateTrigger = (typeof ASSURANCE_GATE_TRIGGERS)[number];
 /** Assertion enforcement strength. */
 export type AssuranceEnforcement = "block" | "warn" | "observe";
+/** Provider execution classes ordered from cheapest to most expensive. */
+export type AssuranceProviderCostClass = "low" | "medium" | "high";
 /** Assertion lifetime after its owning work item becomes terminal. */
 export type AssuranceLifetime = "hold" | "retire";
 /** Numeric or labelled-set value produced by a measurement. */
@@ -246,6 +248,18 @@ export interface AssuranceGateDefinition {
     triggers: AssuranceGateTrigger[];
     /** Optional description. */
     description?: string;
+    /** Explicit provider allow-list and trigger-specific execution policy. */
+    provider_policy?: {
+        /** Provider ids this gate may invoke. An empty set refuses every provider. */
+        allowed_providers: string[];
+        /** Trigger rules; an omitted rule refuses provider execution for that trigger. */
+        triggers: Partial<Record<AssuranceGateTrigger, {
+            /** Highest provider cost class allowed at this trigger. */
+            max_cost_class: AssuranceProviderCostClass;
+            /** Whether network-declaring providers may run. */
+            allow_network: boolean;
+        }>>;
+    };
 }
 /** Complete persisted assurance registry. */
 export interface AssuranceDocument {
@@ -258,6 +272,24 @@ export interface AssuranceDocument {
     /** Gate declarations. */
     gates: AssuranceGateDefinition[];
 }
+/** Atomic set of ordinary declarations used by presets and accepted proposals. */
+export interface AssuranceDeclarationBundle {
+    /** Measurement declarations to create without overwriting divergent ids. */
+    measurements: AssuranceMeasurementDefinition[];
+    /** Assertion declarations to create without overwriting divergent ids. */
+    assertions: AssuranceAssertionDefinition[];
+    /** Gate declarations to create without overwriting divergent ids. */
+    gates: AssuranceGateDefinition[];
+}
+/** Audited receipt for one atomic assurance bundle application. */
+export interface AssuranceBundleMutationReceipt {
+    /** Whether persistence changed. */
+    changed: boolean;
+    /** Stable ids created by the bundle. */
+    created_ids: string[];
+    /** Stable ids already present with byte-equivalent declarations. */
+    unchanged_ids: string[];
+}
 /** Host adapter result for graph, validate, health, or provider sources. */
 export interface AssuranceExternalMeasurementResult {
     /** Observed value. */
@@ -279,6 +311,11 @@ export interface AssuranceEvaluationContext {
     history: AssuranceHistoryRecord[];
     /** Status ids that make an assertion owner terminal. */
     terminal_statuses?: string[];
+    /** Host-declared capabilities for provider-policy enforcement. */
+    provider_capabilities?: Readonly<Record<string, {
+        cost_class: AssuranceProviderCostClass;
+        network: boolean;
+    }>>;
     /** External source adapter. Implementations must enforce an appropriate timeout. */
     external: (source: AssuranceGraphSource | AssuranceValidateSource | AssuranceHealthSource | AssuranceProviderSource) => Promise<AssuranceExternalMeasurementResult>;
 }
@@ -427,6 +464,8 @@ export declare function listAssuranceDeclarations(pmRoot: string, kind: Assuranc
 export declare function getAssuranceDeclaration(pmRoot: string, kind: AssuranceDeclarationKind, id: string): Promise<AssuranceDeclaration>;
 /** Create or update one declaration through audited singleton persistence. */
 export declare function putAssuranceDeclaration(pmRoot: string, kind: AssuranceDeclarationKind, definition: AssuranceDeclaration, options?: AssuranceMutationOptions): Promise<AssuranceMutationReceipt>;
+/** Apply a declaration bundle atomically, idempotently, and without replacing divergent ids. */
+export declare function putAssuranceDeclarationBundle(pmRoot: string, bundle: AssuranceDeclarationBundle, options?: AssuranceMutationOptions): Promise<AssuranceBundleMutationReceipt>;
 /** Remove an unreferenced declaration through audited singleton persistence. */
 export declare function removeAssuranceDeclaration(pmRoot: string, kind: AssuranceDeclarationKind, id: string, options?: AssuranceMutationOptions): Promise<AssuranceMutationReceipt>;
 /** Append one immutable gate verdict without changing registry state. */

package/dist/sdk/governance/assurance.js

@@ -7,7 +7,7 @@
  * one deterministic SDK path.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ecc8eb89-b9e9-51fa-8573-2afb8ec801be")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="07889857-2176-5659-96f7-8f5591f4c692")}catch(e){}}();
 import { createHash } from "node:crypto";
 import path from "node:path";
 import { EXIT_CODE } from "../../core/shared/constants.js";
@@ -15,7 +15,7 @@ import { PmCliError } from "../../core/shared/errors.js";
 import { appendWorkspaceAuditEvent, mutateWorkspaceJsonWithHistory, readFileIfExists, readHistoryEntries, readSettings, resolveAuthor, stableStringify, WORKSPACE_HISTORY_ID, getWorkspaceHistoryPath, } from "../runtime-primitives.js";
 import { resolveCanonicalRelationshipKind } from "../relationships.js";
 import { MAX_ASSURANCE_VERDICT_LIMIT } from "./assurance-limits.js";
-import { AssuranceMutationRefusalError } from "./assurance-mutation-error.js";
+import { AssuranceEvaluationRefusalError, AssuranceMutationRefusalError, } from "./assurance-mutation-error.js";
 /** Current serialized assurance registry format. */
 export const ASSURANCE_DOCUMENT_VERSION = 1;
 /** Supported lifecycle points that can evaluate a gate. */
@@ -213,6 +213,30 @@ export function validateAssertionDefinition(definition) {
     }
     return definition;
 }
+function validateGateProviderPolicy(policy) {
+    if (!Array.isArray(policy.allowed_providers)) {
+        throw new AssuranceMutationRefusalError("gate provider_policy.allowed_providers must be an array");
+    }
+    for (const provider of policy.allowed_providers) {
+        requireStableId(provider, "gate.provider_policy.allowed_provider");
+    }
+    if (typeof policy.triggers !== "object" ||
+        policy.triggers === null ||
+        Array.isArray(policy.triggers)) {
+        throw new AssuranceMutationRefusalError("gate provider_policy.triggers must be an object");
+    }
+    for (const [trigger, rule] of Object.entries(policy.triggers)) {
+        if (!ASSURANCE_GATE_TRIGGERS.includes(trigger)) {
+            throw new AssuranceMutationRefusalError(`gate provider policy has unknown trigger ${trigger}`);
+        }
+        if (typeof rule !== "object" ||
+            rule === null ||
+            !["low", "medium", "high"].includes(rule.max_cost_class) ||
+            typeof rule.allow_network !== "boolean") {
+            throw new AssuranceMutationRefusalError(`gate provider policy trigger ${trigger} is invalid`);
+        }
+    }
+}
 /** Validate and return one gate declaration. */
 export function validateGateDefinition(definition) {
     requireStableId(definition.id, "gate.id");
@@ -224,6 +248,9 @@ export function validateGateDefinition(definition) {
     if (definition.triggers.length === 0) {
         throw new AssuranceMutationRefusalError("gate requires at least one trigger");
     }
+    if (definition.provider_policy) {
+        validateGateProviderPolicy(definition.provider_policy);
+    }
     return definition;
 }
 /** Validate registry references, uniqueness, and declaration-local contracts. */
@@ -300,6 +327,33 @@ function collectMeasurementReferences(document) {
     }
     return references;
 }
+function collectGateProviderIds(gate, document) {
+    const pending = gate.assertion_ids.flatMap((assertionId) => {
+        const assertion = document.assertions.find((entry) => entry.id === assertionId);
+        return [
+            assertion.measurement_id,
+            ...(assertion.scope.kind === "filter"
+                ? [assertion.scope.measurement_id]
+                : []),
+        ];
+    });
+    const visited = new Set();
+    const providers = new Set();
+    while (pending.length > 0) {
+        const measurementId = pending.pop();
+        if (visited.has(measurementId))
+            continue;
+        visited.add(measurementId);
+        const measurement = document.measurements.find((entry) => entry.id === measurementId);
+        if (measurement.source.kind === "provider") {
+            providers.add(measurement.source.provider);
+        }
+        else if (measurement.source.kind === "derived") {
+            collectExpressionMeasurementReferences(measurement.source.expression, pending);
+        }
+    }
+    return providers;
+}
 /** Create an empty, valid assurance registry. */
 export function createEmptyAssuranceDocument() {
     return {
@@ -513,7 +567,7 @@ async function evaluateMeasurementInternal(definition, context, definitions, sta
     };
     const cost = sumCosts([...nestedCosts, ownCost], Date.now() - startedAt);
     if (definition.max_cost !== undefined && cost.units > definition.max_cost) {
-        throw new TypeError(`measurement ${definition.id} exceeded cost ceiling ${definition.max_cost} with ${cost.units}`);
+        throw new AssuranceEvaluationRefusalError(`measurement ${definition.id} exceeded cost ceiling ${definition.max_cost} with ${cost.units}`);
     }
     return {
         id: definition.id,
@@ -579,15 +633,47 @@ export function evaluateAssuranceAssertion(definition, measurement, options = {}
         contributors: measurement.contributors,
     };
 }
+function enforceGateProviderPolicy(gate, document, context, trigger) {
+    const providerIds = collectGateProviderIds(gate, document);
+    if (providerIds.size === 0)
+        return;
+    const policy = gate.provider_policy;
+    const triggerPolicy = policy?.triggers[trigger];
+    if (!policy || !triggerPolicy) {
+        throw new AssuranceEvaluationRefusalError(`assurance gate ${gate.id} refuses provider execution at trigger ${trigger} without an explicit provider policy`);
+    }
+    const allowedProviders = new Set(policy.allowed_providers);
+    const costRank = {
+        low: 0,
+        medium: 1,
+        high: 2,
+    };
+    for (const providerId of providerIds) {
+        if (!allowedProviders.has(providerId)) {
+            throw new AssuranceEvaluationRefusalError(`assurance gate ${gate.id} refuses provider ${providerId}`);
+        }
+        const capability = context.provider_capabilities?.[providerId];
+        if (!capability) {
+            throw new AssuranceEvaluationRefusalError(`assurance provider ${providerId} has no declared capabilities`);
+        }
+        if (costRank[capability.cost_class] > costRank[triggerPolicy.max_cost_class]) {
+            throw new AssuranceEvaluationRefusalError(`assurance gate ${gate.id} refuses ${capability.cost_class}-cost provider ${providerId} at trigger ${trigger}`);
+        }
+        if (capability.network && !triggerPolicy.allow_network) {
+            throw new AssuranceEvaluationRefusalError(`assurance gate ${gate.id} refuses network provider ${providerId} at trigger ${trigger}`);
+        }
+    }
+}
 /** Evaluate a named gate into one presentation-independent verdict document. */
 export async function evaluateAssuranceGate(gateId, document, context, options) {
     validateAssuranceDocument(document);
     const gateDefinition = document.gates.find((entry) => entry.id === gateId);
     if (!gateDefinition)
-        throw new TypeError(`assurance gate ${gateId} not found`);
+        throw new AssuranceEvaluationRefusalError(`assurance gate ${gateId} not found`);
     if (!gateDefinition.triggers.includes(options.trigger)) {
-        throw new TypeError(`assurance gate ${gateId} does not declare trigger ${options.trigger}`);
+        throw new AssuranceEvaluationRefusalError(`assurance gate ${gateId} does not declare trigger ${options.trigger}`);
     }
+    enforceGateProviderPolicy(gateDefinition, document, context, options.trigger);
     const assertions = await mapWithConcurrency(gateDefinition.assertion_ids, EVALUATION_CONCURRENCY, async (id) => {
         const assertionDefinition = document.assertions.find((entry) => entry.id === id);
         const measurementDefinition = document.measurements.find((entry) => entry.id === assertionDefinition.measurement_id);
@@ -726,6 +812,59 @@ export async function putAssuranceDeclaration(pmRoot, kind, definition, options
     });
     return { ...mutation.result, changed: mutation.changed };
 }
+/** Apply a declaration bundle atomically, idempotently, and without replacing divergent ids. */
+export async function putAssuranceDeclarationBundle(pmRoot, bundle, options = {}) {
+    const candidate = createEmptyAssuranceDocument();
+    candidate.measurements = structuredClone(bundle.measurements);
+    candidate.assertions = structuredClone(bundle.assertions);
+    candidate.gates = structuredClone(bundle.gates);
+    validateAssuranceDocument(candidate);
+    const settings = await readSettings(pmRoot);
+    const author = resolveAuthor(options.author, settings.author_default);
+    const mutation = await mutateWorkspaceJsonWithHistory({
+        pmRoot,
+        filePath: assurancePath(pmRoot),
+        op: "assurance:bundle:apply",
+        author,
+        message: options.message,
+        lockTtlSeconds: LOCK_TTL_SECONDS,
+        lockWaitMs: LOCK_WAIT_MS,
+        mutate: (beforeRaw) => {
+            const document = beforeRaw === null
+                ? createEmptyAssuranceDocument()
+                : parseAssuranceDocument(beforeRaw);
+            const createdIds = [];
+            const unchangedIds = [];
+            const apply = (target, additions, kind) => {
+                for (const definition of additions) {
+                    const existing = target.find((entry) => entry.id === definition.id);
+                    if (!existing) {
+                        target.push(structuredClone(definition));
+                        createdIds.push(`${kind}:${definition.id}`);
+                        continue;
+                    }
+                    if (stableStringify(existing) !== stableStringify(definition)) {
+                        throw new AssuranceMutationRefusalError(`assurance bundle refuses to replace divergent ${kind} ${definition.id}`);
+                    }
+                    unchangedIds.push(`${kind}:${definition.id}`);
+                }
+            };
+            apply(document.measurements, candidate.measurements, "measurement");
+            apply(document.assertions, candidate.assertions, "assertion");
+            apply(document.gates, candidate.gates, "gate");
+            validateAssuranceDocument(document);
+            return {
+                raw: `${JSON.stringify(document, null, 2)}\n`,
+                result: {
+                    changed: createdIds.length > 0,
+                    created_ids: createdIds,
+                    unchanged_ids: unchangedIds,
+                },
+            };
+        },
+    });
+    return { ...mutation.result, changed: mutation.changed };
+}
 /** Remove an unreferenced declaration through audited singleton persistence. */
 export async function removeAssuranceDeclaration(pmRoot, kind, id, options = {}) {
     const settings = await readSettings(pmRoot);
@@ -801,4 +940,4 @@ export async function listAssuranceVerdicts(pmRoot, options = {}) {
         .slice(0, limit);
 }
 //# sourceMappingURL=assurance.js.map
-//# debugId=ecc8eb89-b9e9-51fa-8573-2afb8ec801be
+//# debugId=07889857-2176-5659-96f7-8f5591f4c692

package/dist/sdk/governance/gc.js

@@ -4,13 +4,13 @@
  * Implements the pm gc command surface and its agent-facing runtime behavior.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="0973a87f-2b63-5fa1-9624-82897d181f71")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e982158e-4a8d-57a9-bd0b-24bd73aef342")}catch(e){}}();
 import fs from "node:fs/promises";
 import path from "node:path";
 import { runCheckpointGc } from "../../core/checkpoint/checkpoint-gc.js";
 import { runWorkspaceTransactionGc } from "../workspace-transaction-gc.js";
 import { runActiveOnIndexHooks, runActiveOnReadHooks, runActiveOnWriteHooks, } from "../../core/extensions/index.js";
-import { pathExists } from "../../core/fs/fs-utils.js";
+import { isFileMissingError, pathExists } from "../../core/fs/fs-utils.js";
 import { runLockGc } from "../../core/lock/lock-gc.js";
 import { EXIT_CODE } from "../../core/shared/constants.js";
 import { PmCliError } from "../../core/shared/errors.js";
@@ -73,12 +73,6 @@ const GC_TARGETS = [
         kind: "file",
     },
 ];
-function isErrno(error, code) {
-    return (typeof error === "object" &&
-        error !== null &&
-        "code" in error &&
-        error.code === code);
-}
 async function removeCacheFile(pmRoot, target, dryRun) {
     const relativePath = target.relativePath;
     const absolutePath = path.join(pmRoot, relativePath);
@@ -123,7 +117,7 @@ async function removeCacheFile(pmRoot, target, dryRun) {
         };
     }
     catch (error) {
-        if (isErrno(error, "ENOENT")) {
+        if (isFileMissingError(error)) {
             return {
                 removed: false,
                 warnings,
@@ -163,7 +157,7 @@ async function sweepWorkspaceSnapshotTemps(pmRoot, dryRun) {
                 scope: "project",
             })));
             const stats = await fs.stat(absolutePath).catch((error) => {
-                if (isErrno(error, "ENOENT")) {
+                if (isFileMissingError(error)) {
                     return undefined;
                 }
                 throw error;
@@ -373,4 +367,4 @@ export async function runGc(global, options = {}) {
     };
 }
 //# sourceMappingURL=gc.js.map
-//# debugId=0973a87f-2b63-5fa1-9624-82897d181f71
+//# debugId=e982158e-4a8d-57a9-bd0b-24bd73aef342