@zhixuan92/multi-model-agent-core 3.12.7 → 4.0.0

package/dist/tools/review/tool-config.js

@@ -0,0 +1,85 @@
+import { inputSchema } from './schema.js';
+import { qualityReviewTemplate } from '../../review/templates/quality-review-review.js';
+import { reviewBriefSlot } from '../../intake/brief-compiler-slots/review.js';
+import { reviewReportSchema } from '../../reporting/report-parser-slots/review-report.js';
+import { reviewHeadlineTemplate } from '../../reporting/headline-templates/review.js';
+import { DEFAULT_TASK_TIMEOUT_MS } from '../../config/schema.js';
+export function registerReview(registry) {
+    registry.register({
+        routeName: 'review',
+        httpMethod: 'POST',
+        httpPath: '/review',
+        surface: 'tool',
+        schema: inputSchema,
+        toolCategory: 'read_only',
+        agentTypeDefault: 'complex',
+        agentTypeOverridable: false,
+        responseShapeName: 'BatchResponse',
+    });
+}
+const REVIEW_DONE_CONDITIONS = {
+    security: 'Identify security vulnerabilities with severity, location, and remediation.',
+    performance: 'Identify performance issues with impact level, location, and fix recommendation.',
+    correctness: 'Identify logic errors, edge cases, and contract violations with severity and location.',
+    style: 'Identify style issues, naming inconsistencies, and dead code with location and fix.',
+};
+const DELTA_REVIEW_SUFFIX = ' Perform a full review (do not reduce thoroughness). Verify each prior finding as addressed or unaddressed. Omit addressed prior findings. Include unaddressed prior findings and new findings. End with a summary of which prior findings were resolved.';
+function resolveReviewDoneCondition(focus, hasContextBlocks) {
+    if (!focus || focus.length === 0) {
+        return `Review code for correctness, security, performance, and style. Each finding has category, severity, location, and recommendation.${hasContextBlocks ? DELTA_REVIEW_SUFFIX : ''}`;
+    }
+    const base = focus.map(f => REVIEW_DONE_CONDITIONS[f] ?? '').filter(Boolean).join(' ');
+    return hasContextBlocks ? base + DELTA_REVIEW_SUFFIX : base;
+}
+function buildReviewPrompt(brief) {
+    const { code, filePaths, focus, hasContextBlocks, filePath } = brief;
+    const parts = ['Review this code:'];
+    if (filePath) {
+        parts.push(`Read and analyze this file:\n- ${filePath}`);
+    }
+    else {
+        if (code)
+            parts.push(`\`\`\`\n${code}\n\`\`\``);
+        if (filePaths && filePaths.length > 0) {
+            parts.push(`Read and analyze these files:\n${filePaths.map(p => `- ${p}`).join('\n')}`);
+        }
+        if (focus && focus.length > 0)
+            parts.push(`Focus areas: ${focus.join(', ')}.`);
+    }
+    if (hasContextBlocks) {
+        parts.push('Context is provided above (e.g. a diff or prior review). Perform a full review as normal — do not skip areas or reduce thoroughness.', 'If the context contains prior review findings:', '- **Omit** findings that have been addressed — do not re-report them.', '- **Include** findings that are still present (mark as "unfixed from prior review").', '- **Include** any new findings.', '- End with a **Fixed** summary listing which prior findings were resolved.');
+    }
+    else {
+        parts.push('Produce a narrative code review. Use this EXACT per-finding format so the deterministic extractor can recover findings if the structured reviewer pass fails:', '', '## Finding 1: <one-line title>', '- Severity: critical | high | medium | low', '- Location: file:line', '- Issue: one-paragraph explanation', '- Suggestion: one-line fix recommendation', '', '## Finding 2: <one-line title>', '- Severity: ...', '- ...', '', 'Rules:', '- Each finding heading MUST start with "## Finding N: " (h2, "Finding ", number, colon, title) — number sequentially from 1.', '- Severity / Location / Issue / Suggestion bullets are on their own lines with the labels exactly as shown.', '- Do NOT emit JSON. Both the structured reviewer and the deterministic fallback extract from this same format — the format is the single source of truth.');
+    }
+    return parts.join('\n\n');
+}
+export const toolConfig = {
+    name: 'review',
+    category: 'read_only',
+    agentType: 'complex',
+    briefSlot: reviewBriefSlot,
+    buildTaskSpec: (brief, ctx) => {
+        const prompt = buildReviewPrompt(brief);
+        return {
+            prompt,
+            agentType: 'complex',
+            reviewPolicy: 'quality_only',
+            briefQualityPolicy: 'off',
+            done: resolveReviewDoneCondition(brief.focus, brief.hasContextBlocks),
+            tools: ctx.config.defaults?.tools ?? 'full',
+            timeoutMs: ctx.config.defaults?.timeoutMs ?? DEFAULT_TASK_TIMEOUT_MS,
+            maxCostUSD: ctx.config.defaults?.maxCostUSD ?? 10,
+            sandboxPolicy: ctx.config.defaults?.sandboxPolicy ?? 'cwd-only',
+            cwd: ctx.projectContext?.cwd ?? ctx.cwd,
+            contextBlockIds: brief.contextBlockIds,
+            autoCommit: false,
+        };
+    },
+    reportSchema: reviewReportSchema,
+    headlineTemplate: reviewHeadlineTemplate,
+    reviewTemplates: {
+        qualityAP: qualityReviewTemplate,
+    },
+};
+//# sourceMappingURL=tool-config.js.map

package/dist/tools/review/tool-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-config.js","sourceRoot":"","sources":["../../../src/tools/review/tool-config.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,iDAAiD,CAAC;AAGxF,OAAO,EAAE,eAAe,EAAoB,MAAM,6CAA6C,CAAC;AAChG,OAAO,EAAE,kBAAkB,EAAE,MAAM,sDAAsD,CAAC;AAC1F,OAAO,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAC;AACtF,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAEjE,MAAM,UAAU,cAAc,CAAC,QAA6B;IAC1D,QAAQ,CAAC,QAAQ,CAAC;QAChB,SAAS,EAAE,QAAQ;QACnB,UAAU,EAAE,MAAM;QAClB,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,MAAM;QACf,MAAM,EAAE,WAAW;QACnB,YAAY,EAAE,WAAW;QACzB,gBAAgB,EAAE,SAAS;QAC3B,oBAAoB,EAAE,KAAK;QAC3B,iBAAiB,EAAE,eAAe;KACnC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,sBAAsB,GAA2B;IACrD,QAAQ,EAAE,6EAA6E;IACvF,WAAW,EAAE,kFAAkF;IAC/F,WAAW,EAAE,wFAAwF;IACrG,KAAK,EAAE,qFAAqF;CAC7F,CAAC;AAEF,MAAM,mBAAmB,GAAG,2PAA2P,CAAC;AAExR,SAAS,0BAA0B,CAAC,KAA2B,EAAE,gBAAyB;IACxF,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,oIAAoI,gBAAgB,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC3L,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvF,OAAO,gBAAgB,CAAC,CAAC,CAAC,IAAI,GAAG,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAkB;IAC3C,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IACrE,MAAM,KAAK,GAAa,CAAC,mBAAmB,CAAC,CAAC;IAE9C,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC,kCAAkC,QAAQ,EAAE,CAAC,CAAC;IAC3D,CAAC;SAAM,CAAC;QACN,IAAI,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,UAAU,CAAC,CAAC;QAChD,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,kCAAkC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,gBAAgB,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CACR,sIAAsI,EACtI,gDAAgD,EAChD,uEAAuE,EACvE,sFAAsF,EACtF,iCAAiC,EACjC,4EAA4E,CAC7E,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,+JAA+J,EAC/J,EAAE,EACF,gCAAgC,EAChC,4CAA4C,EAC5C,uBAAuB,EACvB,oCAAoC,EACpC,2CAA2C,EAC3C,EAAE,EACF,gCAAgC,EAChC,iBAAiB,EACjB,OAAO,EACP,EAAE,EACF,QAAQ,EACR,8HAA8H,EAC9H,6GAA6G,EAC7G,2JAA2J,CAC5J,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAA4C;IACjE,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,WAAW;IACrB,SAAS,EAAE,SAAS;IACpB,SAAS,EAAE,eAAe;IAC1B,aAAa,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC5B,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACxC,OAAO;YACL,MAAM;YACN,SAAS,EAAE,SAAS;YACpB,YAAY,EAAE,cAAc;YAC5B,kBAAkB,EAAE,KAAK;YACzB,IAAI,EAAE,0BAA0B,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,gBAAgB,CAAC;YACrE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,IAAI,MAAM;YAC3C,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,IAAI,uBAAuB;YACpE,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,IAAI,EAAE;YACjD,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,aAAa,IAAI,UAAU;YAC/D,GAAG,EAAE,GAAG,CAAC,cAAc,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG;YACvC,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,UAAU,EAAE,KAAK;SAClB,CAAC;IACJ,CAAC;IACD,YAAY,EAAE,kBAAkB;IAChC,gBAAgB,EAAE,sBAAsB;IACxC,eAAe,EAAE;QACf,SAAS,EAAE,qBAAqB;KACjC;CACF,CAAC"}

package/dist/tools/shared-output.d.ts

@@ -0,0 +1,56 @@
+import { z } from 'zod';
+export declare const errorSchema: z.ZodObject<{
+    code: z.ZodString;
+    message: z.ZodString;
+    details: z.ZodOptional<z.ZodUnknown>;
+}, z.core.$strip>;
+export declare const batchTimingsSchema: z.ZodObject<{}, z.core.$loose>;
+export declare const costSummarySchema: z.ZodObject<{}, z.core.$loose>;
+export declare const structuredReportSchema: z.ZodObject<{}, z.core.$loose>;
+export declare function buildOutputEnvelopeSchema(resultItemSchema?: z.ZodTypeAny): z.ZodObject<{
+    headline: z.ZodString;
+    results: z.ZodUnion<readonly [z.ZodArray<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>, z.ZodObject<{
+        kind: z.ZodLiteral<"not_applicable">;
+        reason: z.ZodString;
+    }, z.core.$strip>]>;
+    batchTimings: z.ZodUnion<readonly [z.ZodObject<{}, z.core.$loose>, z.ZodObject<{
+        kind: z.ZodLiteral<"not_applicable">;
+        reason: z.ZodString;
+    }, z.core.$strip>]>;
+    costSummary: z.ZodUnion<readonly [z.ZodObject<{}, z.core.$loose>, z.ZodObject<{
+        kind: z.ZodLiteral<"not_applicable">;
+        reason: z.ZodString;
+    }, z.core.$strip>]>;
+    structuredReport: z.ZodUnion<readonly [z.ZodObject<{}, z.core.$loose>, z.ZodObject<{
+        kind: z.ZodLiteral<"not_applicable">;
+        reason: z.ZodString;
+    }, z.core.$strip>]>;
+    error: z.ZodUnion<readonly [z.ZodObject<{
+        code: z.ZodString;
+        message: z.ZodString;
+        details: z.ZodOptional<z.ZodUnknown>;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"not_applicable">;
+        reason: z.ZodString;
+    }, z.core.$strip>]>;
+    specReviewVerdict: z.ZodOptional<z.ZodEnum<{
+        approved: "approved";
+        concerns: "concerns";
+        changes_required: "changes_required";
+        annotated: "annotated";
+        error: "error";
+        skipped: "skipped";
+        not_applicable: "not_applicable";
+    }>>;
+    qualityReviewVerdict: z.ZodOptional<z.ZodEnum<{
+        approved: "approved";
+        concerns: "concerns";
+        changes_required: "changes_required";
+        annotated: "annotated";
+        error: "error";
+        skipped: "skipped";
+        not_applicable: "not_applicable";
+    }>>;
+    roundsUsed: z.ZodOptional<z.ZodNumber>;
+}, z.core.$loose>;
+//# sourceMappingURL=shared-output.d.ts.map

package/dist/tools/shared-output.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-output.d.ts","sourceRoot":"","sources":["../../src/tools/shared-output.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,WAAW;;;;iBAItB,CAAC;AAGH,eAAO,MAAM,kBAAkB,gCAA6B,CAAC;AAC7D,eAAO,MAAM,iBAAiB,gCAA6B,CAAC;AAC5D,eAAO,MAAM,sBAAsB,gCAA6B,CAAC;AAGjE,wBAAgB,yBAAyB,CAAC,gBAAgB,GAAE,CAAC,CAAC,UAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAYrF"}

package/dist/tools/shared-output.js

@@ -0,0 +1,33 @@
+// Schema infrastructure shared by all 8 per-tool schemas under tools/<tool>/schema.ts.
+// `buildOutputEnvelopeSchema` is the single source of truth for the terminal-envelope
+// shape every tool returns. Lives in tools/ (not reporting/) because it is part of the
+// per-tool input/output contract surface — any change here changes every tool's wire
+// schema in lockstep.
+import { z } from 'zod';
+import { notApplicableSchema } from '../reporting/not-applicable.js';
+import { ReviewVerdictEnum } from '../types/enums.js';
+// Shared, reusable concrete schemas for terminal-envelope fields.
+export const errorSchema = z.object({
+    code: z.string().min(1),
+    message: z.string().min(1),
+    details: z.unknown().optional(),
+});
+// These preserve 3.0.x openness — do NOT tighten here. Separate spec item if we ever do.
+export const batchTimingsSchema = z.object({}).passthrough();
+export const costSummarySchema = z.object({}).passthrough();
+export const structuredReportSchema = z.object({}).passthrough();
+// Envelope builder — single source of truth.
+export function buildOutputEnvelopeSchema(resultItemSchema = z.unknown()) {
+    return z.object({
+        headline: z.string().min(1),
+        results: z.union([z.array(resultItemSchema), notApplicableSchema]),
+        batchTimings: z.union([batchTimingsSchema, notApplicableSchema]),
+        costSummary: z.union([costSummarySchema, notApplicableSchema]),
+        structuredReport: z.union([structuredReportSchema, notApplicableSchema]),
+        error: z.union([errorSchema, notApplicableSchema]),
+        specReviewVerdict: ReviewVerdictEnum.optional(),
+        qualityReviewVerdict: ReviewVerdictEnum.optional(),
+        roundsUsed: z.number().int().min(0).optional(),
+    }).passthrough();
+}
+//# sourceMappingURL=shared-output.js.map

package/dist/tools/shared-output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-output.js","sourceRoot":"","sources":["../../src/tools/shared-output.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,sFAAsF;AACtF,uFAAuF;AACvF,qFAAqF;AACrF,sBAAsB;AACtB,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,kEAAkE;AAClE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAEH,yFAAyF;AACzF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAC7D,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAC5D,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAEjE,6CAA6C;AAC7C,MAAM,UAAU,yBAAyB,CAAC,mBAAiC,CAAC,CAAC,OAAO,EAAE;IACpF,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,mBAAmB,CAAC,CAAC;QAClE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAAC;QAChE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;QAC9D,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,sBAAsB,EAAE,mBAAmB,CAAC,CAAC;QACxE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;QAClD,iBAAiB,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QAC/C,oBAAoB,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QAClD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC/C,CAAC,CAAC,WAAW,EAAE,CAAC;AACnB,CAAC"}

package/dist/tools/verify/schema.d.ts

@@ -0,0 +1,56 @@
+import { z } from 'zod';
+export declare const inputSchema: z.ZodObject<{
+    work: z.ZodOptional<z.ZodString>;
+    checklist: z.ZodArray<z.ZodString>;
+    filePaths: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    contextBlockIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export type Input = z.infer<typeof inputSchema>;
+export declare const outputSchema: z.ZodObject<{
+    headline: z.ZodString;
+    results: z.ZodUnion<readonly [z.ZodArray<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>, z.ZodObject<{
+        kind: z.ZodLiteral<"not_applicable">;
+        reason: z.ZodString;
+    }, z.core.$strip>]>;
+    batchTimings: z.ZodUnion<readonly [z.ZodObject<{}, z.core.$loose>, z.ZodObject<{
+        kind: z.ZodLiteral<"not_applicable">;
+        reason: z.ZodString;
+    }, z.core.$strip>]>;
+    costSummary: z.ZodUnion<readonly [z.ZodObject<{}, z.core.$loose>, z.ZodObject<{
+        kind: z.ZodLiteral<"not_applicable">;
+        reason: z.ZodString;
+    }, z.core.$strip>]>;
+    structuredReport: z.ZodUnion<readonly [z.ZodObject<{}, z.core.$loose>, z.ZodObject<{
+        kind: z.ZodLiteral<"not_applicable">;
+        reason: z.ZodString;
+    }, z.core.$strip>]>;
+    error: z.ZodUnion<readonly [z.ZodObject<{
+        code: z.ZodString;
+        message: z.ZodString;
+        details: z.ZodOptional<z.ZodUnknown>;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"not_applicable">;
+        reason: z.ZodString;
+    }, z.core.$strip>]>;
+    specReviewVerdict: z.ZodOptional<z.ZodEnum<{
+        approved: "approved";
+        concerns: "concerns";
+        changes_required: "changes_required";
+        annotated: "annotated";
+        error: "error";
+        skipped: "skipped";
+        not_applicable: "not_applicable";
+    }>>;
+    qualityReviewVerdict: z.ZodOptional<z.ZodEnum<{
+        approved: "approved";
+        concerns: "concerns";
+        changes_required: "changes_required";
+        annotated: "annotated";
+        error: "error";
+        skipped: "skipped";
+        not_applicable: "not_applicable";
+    }>>;
+    roundsUsed: z.ZodOptional<z.ZodNumber>;
+}, z.core.$loose>;
+export type Output = z.infer<typeof outputSchema>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/tools/verify/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/tools/verify/schema.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,WAAW;;;;;iBAOtB,CAAC;AAEH,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEhD,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAA8B,CAAC;AAExD,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC"}

package/dist/tools/verify/schema.js

@@ -0,0 +1,16 @@
+// packages/core/src/tool-schemas/verify.ts
+import { z } from 'zod';
+import { buildOutputEnvelopeSchema } from '../shared-output.js';
+// Ported verbatim from packages/mcp/src/tools/verify-work.ts (verifyWorkSchema).
+// commonToolFields (filePaths + contextBlockIds) are inlined here to avoid
+// cross-package coupling.
+export const inputSchema = z.object({
+    work: z.string().optional().describe('Inline work product to verify'),
+    checklist: z.array(z.string()).min(1).describe('Verification checklist items (at least 1)'),
+    filePaths: z.array(z.string()).optional()
+        .describe('Files the sub-agent should focus on. Multiple files are processed in parallel.'),
+    contextBlockIds: z.array(z.string()).optional()
+        .describe('IDs from register_context_block to prepend to prompt. Use for delta audits, diff-scoped reviews, or shared specs.'),
+});
+export const outputSchema = buildOutputEnvelopeSchema();
+//# sourceMappingURL=schema.js.map

package/dist/tools/verify/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/tools/verify/schema.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAEhE,iFAAiF;AACjF,2EAA2E;AAC3E,0BAA0B;AAC1B,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;IACrE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,2CAA2C,CAAC;IAC3F,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;SACtC,QAAQ,CAAC,gFAAgF,CAAC;IAC7F,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;SAC5C,QAAQ,CAAC,mHAAmH,CAAC;CACjI,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,YAAY,GAAG,yBAAyB,EAAE,CAAC"}

package/dist/tools/verify/tool-config.d.ts

@@ -0,0 +1,14 @@
+import { ToolSurfaceRegistry } from '../../tool-surface/tool-surface-registry.js';
+import type { Input } from './schema.js';
+import type { ToolConfig } from '../../lifecycle/tool-config-types.js';
+export declare function registerVerify(registry: ToolSurfaceRegistry): void;
+export interface VerifyBrief {
+    work?: string;
+    filePaths: string[];
+    checklist: string[];
+    contextBlockIds: string[];
+    /** For fan_out mode, the base prompt template without per-file header. */
+    promptTemplate?: string;
+}
+export declare const toolConfig: ToolConfig<Input, VerifyBrief, unknown>;
+//# sourceMappingURL=tool-config.d.ts.map

package/dist/tools/verify/tool-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-config.d.ts","sourceRoot":"","sources":["../../../src/tools/verify/tool-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAElF,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAC;AAMvE,wBAAgB,cAAc,CAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAYlE;AAID,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,0EAA0E;IAC1E,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAqDD,eAAO,MAAM,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAoD9D,CAAC"}

package/dist/tools/verify/tool-config.js

@@ -0,0 +1,112 @@
+import { inputSchema } from './schema.js';
+import { qualityVerifyTemplate } from '../../review/reviewer-engine.js';
+import { verifyReportSchema } from '../../reporting/report-parser-slots/verify-report.js';
+import { verifyHeadlineTemplate } from '../../reporting/headline-templates/verify.js';
+import { DEFAULT_TASK_TIMEOUT_MS } from '../../config/schema.js';
+export function registerVerify(registry) {
+    registry.register({
+        routeName: 'verify',
+        httpMethod: 'POST',
+        httpPath: '/verify',
+        surface: 'tool',
+        schema: inputSchema,
+        toolCategory: 'read_only',
+        agentTypeDefault: 'complex',
+        agentTypeOverridable: false,
+        responseShapeName: 'BatchResponse',
+    });
+}
+// ── Prompt builders (lifted from legacy executor) ──
+const FINDING_FORMAT_INSTRUCTIONS = [
+    'For each checklist item, use this EXACT per-finding format so the deterministic extractor can recover findings if the structured reviewer pass fails:',
+    '',
+    '## Finding 1: <one-line title (the criterion summary)>',
+    '- Severity: critical | high | medium | low (low = pass; high/medium = fail)',
+    '- Item: the criterion text',
+    '- Result: PASS or FAIL',
+    '- Evidence: file:line + what it shows, OR command + output',
+    '',
+    '## Finding 2: <one-line title>',
+    '- Severity: ...',
+    '- ...',
+    '',
+    'Rules:',
+    '- Each finding heading MUST start with "## Finding N: " (h2, "Finding ", number, colon, title) — number sequentially from 1, one per checklist item.',
+    '- Severity / Item / Result / Evidence bullets are on their own lines with the labels exactly as shown.',
+    '- Do NOT emit JSON. Both the structured reviewer and the deterministic fallback extract from this same format — the format is the single source of truth.',
+].join('\n');
+function buildFilePathsPrompt(filePaths) {
+    if (!filePaths || filePaths.length === 0)
+        return '';
+    return `Read and analyze these files:\n${filePaths.map(p => `- ${p}`).join('\n')}`;
+}
+function buildVerifyPrompt(work, filePaths, checklist) {
+    const parts = ['Verify this work:'];
+    if (work)
+        parts.push(work);
+    const fileSection = buildFilePathsPrompt(filePaths);
+    if (fileSection)
+        parts.push(fileSection);
+    const checklistText = checklist.map((item, i) => `${i + 1}. ${item}`).join('\n');
+    parts.push(`Checklist:\n${checklistText}`);
+    parts.push(FINDING_FORMAT_INSTRUCTIONS);
+    return parts.join('\n\n');
+}
+function buildPerFilePrompt(filePath, promptTemplate) {
+    return `${promptTemplate}\n\nRead and analyze this file:\n- ${filePath}`;
+}
+function hasContent(value) {
+    return value !== undefined && value.trim().length > 0;
+}
+// ── ToolConfig ──
+export const toolConfig = {
+    name: 'verify',
+    category: 'read_only',
+    agentType: 'complex',
+    briefSlot: (input) => {
+        const filePaths = (input.filePaths ?? []).filter(p => p.trim().length > 0);
+        if (!hasContent(input.work) && filePaths.length >= 2) {
+            // Fan-out: one task per file, shared prompt template
+            const promptTemplate = buildVerifyPrompt(undefined, undefined, input.checklist);
+            return filePaths.map(fp => ({
+                work: input.work,
+                filePaths: [fp],
+                checklist: input.checklist,
+                contextBlockIds: input.contextBlockIds ?? [],
+                promptTemplate,
+            }));
+        }
+        // Single task
+        return [{
+                work: input.work,
+                filePaths,
+                checklist: input.checklist,
+                contextBlockIds: input.contextBlockIds ?? [],
+            }];
+    },
+    buildTaskSpec: (brief, ctx) => {
+        const prompt = brief.promptTemplate
+            ? buildPerFilePrompt(brief.filePaths[0], brief.promptTemplate)
+            : buildVerifyPrompt(brief.work, brief.filePaths.length > 0 ? brief.filePaths : undefined, brief.checklist);
+        return {
+            prompt,
+            agentType: 'complex',
+            reviewPolicy: 'quality_only',
+            briefQualityPolicy: 'off',
+            done: `Every checklist item (${brief.checklist.length} total) has a pass/fail verdict with supporting evidence from the code.`,
+            tools: ctx.config.defaults?.tools ?? 'full',
+            timeoutMs: ctx.config.defaults?.timeoutMs ?? DEFAULT_TASK_TIMEOUT_MS,
+            maxCostUSD: ctx.config.defaults?.maxCostUSD ?? 10,
+            sandboxPolicy: ctx.config.defaults?.sandboxPolicy ?? 'cwd-only',
+            cwd: ctx.projectContext?.cwd ?? ctx.cwd,
+            contextBlockIds: brief.contextBlockIds,
+            filePaths: brief.filePaths.length > 0 ? brief.filePaths : undefined,
+        };
+    },
+    reportSchema: verifyReportSchema,
+    headlineTemplate: verifyHeadlineTemplate,
+    reviewTemplates: {
+        qualityAP: qualityVerifyTemplate,
+    },
+};
+//# sourceMappingURL=tool-config.js.map

package/dist/tools/verify/tool-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-config.js","sourceRoot":"","sources":["../../../src/tools/verify/tool-config.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAGxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sDAAsD,CAAC;AAC1F,OAAO,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAC;AACtF,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAEjE,MAAM,UAAU,cAAc,CAAC,QAA6B;IAC1D,QAAQ,CAAC,QAAQ,CAAC;QAChB,SAAS,EAAE,QAAQ;QACnB,UAAU,EAAE,MAAM;QAClB,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,MAAM;QACf,MAAM,EAAE,WAAW;QACnB,YAAY,EAAE,WAAW;QACzB,gBAAgB,EAAE,SAAS;QAC3B,oBAAoB,EAAE,KAAK;QAC3B,iBAAiB,EAAE,eAAe;KACnC,CAAC,CAAC;AACL,CAAC;AAaD,sDAAsD;AAEtD,MAAM,2BAA2B,GAAG;IAClC,uJAAuJ;IACvJ,EAAE;IACF,wDAAwD;IACxD,6EAA6E;IAC7E,4BAA4B;IAC5B,wBAAwB;IACxB,4DAA4D;IAC5D,EAAE;IACF,gCAAgC;IAChC,iBAAiB;IACjB,OAAO;IACP,EAAE;IACF,QAAQ;IACR,sJAAsJ;IACtJ,wGAAwG;IACxG,2JAA2J;CAC5J,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,SAAS,oBAAoB,CAAC,SAAoB;IAChD,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpD,OAAO,kCAAkC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACrF,CAAC;AAED,SAAS,iBAAiB,CACxB,IAAwB,EACxB,SAA+B,EAC/B,SAAmB;IAEnB,MAAM,KAAK,GAAa,CAAC,mBAAmB,CAAC,CAAC;IAC9C,IAAI,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,WAAW,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IACpD,IAAI,WAAW;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,aAAa,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjF,KAAK,CAAC,IAAI,CAAC,eAAe,aAAa,EAAE,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACxC,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB,EAAE,cAAsB;IAClE,OAAO,GAAG,cAAc,sCAAsC,QAAQ,EAAE,CAAC;AAC3E,CAAC;AAED,SAAS,UAAU,CAAC,KAAyB;IAC3C,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,mBAAmB;AAEnB,MAAM,CAAC,MAAM,UAAU,GAA4C;IACjE,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,WAAW;IACrB,SAAS,EAAE,SAAS;IACpB,SAAS,EAAE,CAAC,KAAY,EAAiB,EAAE;QACzC,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAE3E,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACrD,qDAAqD;YACrD,MAAM,cAAc,GAAG,iBAAiB,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YAChF,OAAO,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,SAAS,EAAE,CAAC,EAAE,CAAC;gBACf,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,EAAE;gBAC5C,cAAc;aACf,CAAC,CAAC,CAAC;QACN,CAAC;QAED,cAAc;QACd,OAAO,CAAC;gBACN,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,SAAS;gBACT,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,EAAE;aAC7C,CAAC,CAAC;IACL,CAAC;IACD,aAAa,EAAE,CAAC,KAAkB,EAAE,GAAqB,EAAE,EAAE;QAC3D,MAAM,MAAM,GAAG,KAAK,CAAC,cAAc;YACjC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAE,EAAE,KAAK,CAAC,cAAc,CAAC;YAC/D,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAE7G,OAAO;YACL,MAAM;YACN,SAAS,EAAE,SAAS;YACpB,YAAY,EAAE,cAAc;YAC5B,kBAAkB,EAAE,KAAK;YACzB,IAAI,EAAE,yBAAyB,KAAK,CAAC,SAAS,CAAC,MAAM,yEAAyE;YAC9H,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,IAAI,MAAM;YAC3C,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,IAAI,uBAAuB;YACpE,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,IAAI,EAAE;YACjD,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,aAAa,IAAI,UAAU;YAC/D,GAAG,EAAE,GAAG,CAAC,cAAc,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG;YACvC,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;SACpE,CAAC;IACJ,CAAC;IACD,YAAY,EAAE,kBAAkB;IAChC,gBAAgB,EAAE,sBAAsB;IACxC,eAAe,EAAE;QACf,SAAS,EAAE,qBAAqB;KACjC;CACF,CAAC"}

package/dist/transport/http-listener.d.ts

@@ -0,0 +1,37 @@
+import { type IncomingMessage, type ServerResponse } from 'node:http';
+/**
+ * Spec C1 HTTPListener — bind loopback, accept HTTP. Supports a graceful
+ * shutdown state where new requests are rejected with 503 while in-flight
+ * async batches complete and TelemetryChannel (C7) drains.
+ *
+ * The listener owns the socket lifecycle. Routing and request pipeline are
+ * separate (RouteDispatcher + RequestPipeline). Wire them together in the
+ * server boot, not here.
+ */
+export type HTTPRequestHandler = (req: IncomingMessage, res: ServerResponse) => void | Promise<void>;
+export interface HTTPListenerOptions {
+    /** Bind address — must be a loopback interface in production (127.0.0.1 or ::1). */
+    bind: string;
+    /** Listening port. Pass 0 for ephemeral allocation. */
+    port: number;
+    /** Application handler. Called for every accepted request unless draining. */
+    handler: HTTPRequestHandler;
+}
+export declare class HTTPListener {
+    private readonly options;
+    private server;
+    private draining;
+    private startedAt;
+    constructor(options: HTTPListenerOptions);
+    start(): Promise<{
+        port: number;
+        address: string | null;
+    }>;
+    /** Begin graceful shutdown — new requests get 503; existing ones complete. */
+    beginDraining(): void;
+    isDraining(): boolean;
+    /** Wall-clock ms when the listener started. Zero if never started. */
+    getStartedAt(): number;
+    stop(): Promise<void>;
+}
+//# sourceMappingURL=http-listener.d.ts.map

package/dist/transport/http-listener.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-listener.d.ts","sourceRoot":"","sources":["../../src/transport/http-listener.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,eAAe,EAAE,KAAK,cAAc,EAAe,MAAM,WAAW,CAAC;AAEjG;;;;;;;;GAQG;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAErG,MAAM,WAAW,mBAAmB;IAClC,oFAAoF;IACpF,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,OAAO,EAAE,kBAAkB,CAAC;CAC7B;AAED,qBAAa,YAAY;IAKX,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJpC,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,SAAS,CAAK;gBAEO,OAAO,EAAE,mBAAmB;IAEnD,KAAK,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAsBhE,8EAA8E;IAC9E,aAAa,IAAI,IAAI;IAIrB,UAAU,IAAI,OAAO;IAIrB,sEAAsE;IACtE,YAAY,IAAI,MAAM;IAIhB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAM5B"}

package/dist/transport/http-listener.js

@@ -0,0 +1,50 @@
+import { createServer } from 'node:http';
+export class HTTPListener {
+    options;
+    server = null;
+    draining = false;
+    startedAt = 0;
+    constructor(options) {
+        this.options = options;
+    }
+    async start() {
+        const server = createServer((req, res) => {
+            if (this.draining) {
+                res.statusCode = 503;
+                res.setHeader('Retry-After', '5');
+                res.setHeader('Content-Type', 'application/json');
+                res.end(JSON.stringify({ error: { code: 'shutting_down', message: 'Server is shutting down' } }));
+                return;
+            }
+            void this.options.handler(req, res);
+        });
+        await new Promise((resolve) => {
+            server.listen(this.options.port, this.options.bind, resolve);
+        });
+        this.server = server;
+        this.startedAt = Date.now();
+        const addr = server.address();
+        const port = typeof addr === 'object' && addr !== null ? addr.port : this.options.port;
+        const address = typeof addr === 'object' && addr !== null ? (addr.address ?? null) : null;
+        return { port, address };
+    }
+    /** Begin graceful shutdown — new requests get 503; existing ones complete. */
+    beginDraining() {
+        this.draining = true;
+    }
+    isDraining() {
+        return this.draining;
+    }
+    /** Wall-clock ms when the listener started. Zero if never started. */
+    getStartedAt() {
+        return this.startedAt;
+    }
+    async stop() {
+        if (!this.server)
+            return;
+        const server = this.server;
+        await new Promise((resolve) => server.close(() => resolve()));
+        this.server = null;
+    }
+}
+//# sourceMappingURL=http-listener.js.map

package/dist/transport/http-listener.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-listener.js","sourceRoot":"","sources":["../../src/transport/http-listener.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AAuBjG,MAAM,OAAO,YAAY;IAKM;IAJrB,MAAM,GAAkB,IAAI,CAAC;IAC7B,QAAQ,GAAG,KAAK,CAAC;IACjB,SAAS,GAAG,CAAC,CAAC;IAEtB,YAA6B,OAA4B;QAA5B,YAAO,GAAP,OAAO,CAAqB;IAAG,CAAC;IAE7D,KAAK,CAAC,KAAK;QACT,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACvC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;gBAClC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;gBAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,CAAC,CAAC,CAAC;gBAClG,OAAO;YACT,CAAC;YACD,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAE,IAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;QAC7G,MAAM,OAAO,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAE,IAA6B,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,8EAA8E;IAC9E,aAAa;QACX,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;IACvB,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,sEAAsE;IACtE,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACrB,CAAC;CACF"}

package/dist/transport/index.d.ts

@@ -0,0 +1,4 @@
+export { HTTPListener, type HTTPListenerOptions, type HTTPRequestHandler } from './http-listener.js';
+export { RouteDispatcher, type RouteMetadata, type ResponseShape } from './route-dispatcher.js';
+export { isLoopbackAddress, shouldRejectNonLoopback, isAllowedHostHeader, } from './loopback-enforcer.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/transport/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/transport/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,KAAK,mBAAmB,EAAE,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACrG,OAAO,EAAE,eAAe,EAAE,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAChG,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,wBAAwB,CAAC"}

package/dist/transport/index.js

@@ -0,0 +1,4 @@
+export { HTTPListener } from './http-listener.js';
+export { RouteDispatcher } from './route-dispatcher.js';
+export { isLoopbackAddress, shouldRejectNonLoopback, isAllowedHostHeader, } from './loopback-enforcer.js';
+//# sourceMappingURL=index.js.map

package/dist/transport/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/transport/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAqD,MAAM,oBAAoB,CAAC;AACrG,OAAO,EAAE,eAAe,EAA0C,MAAM,uBAAuB,CAAC;AAChG,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,wBAAwB,CAAC"}

package/dist/transport/loopback-enforcer.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Spec C1 LoopbackEnforcer — two-check enforcement against DNS rebinding:
+ *   (a) IP-level: socket remote address must be loopback (127/8 or ::1)
+ *   (b) Host/Origin header: must be localhost / 127.0.0.1 / [::1]
+ *
+ * The IP check defends against external network access; the header check
+ * defends against rebinding attacks where a malicious site resolves a
+ * controlled hostname to 127.0.0.1.
+ */
+/**
+ * Returns true iff the given address string refers to the loopback interface.
+ * Accepts all forms Node's socket layer surfaces:
+ *   - IPv4 loopback (any 127.0.0.0/8 address): 127.0.0.1, 127.0.1.1, etc.
+ *   - IPv6 loopback: ::1
+ *   - IPv4-mapped IPv6 loopback: ::ffff:127.0.0.1
+ *   - Hostname: localhost
+ */
+export declare function isLoopbackAddress(addr: string | undefined): boolean;
+/**
+ * Returns true iff the request should be rejected because the socket
+ * remote address is not loopback.
+ */
+export declare function shouldRejectNonLoopback(remoteAddress: string | undefined): boolean;
+/**
+ * Validates the Host (or Origin) header against a small allowlist.
+ * Strips any port suffix before comparing.
+ */
+export declare function isAllowedHostHeader(host: string | undefined): boolean;
+//# sourceMappingURL=loopback-enforcer.d.ts.map

package/dist/transport/loopback-enforcer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback-enforcer.d.ts","sourceRoot":"","sources":["../../src/transport/loopback-enforcer.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AAEH;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAkBnE;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAElF;AAID;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAarE"}