@zigrivers/scaffold 3.27.0 → 3.29.0

package/dist/knowledge-freshness/audit-prefilter.test.js

@@ -0,0 +1,78 @@
+import { describe, it, expect, vi } from 'vitest';
+import { selectAuditCandidates } from './audit-prefilter.js';
+const today = new Date('2026-05-24T00:00:00Z');
+function entry(overrides) {
+    return {
+        name: 'x', description: '', topics: [], content: '',
+        volatility: 'evolving', lastReviewed: null, versionPin: null, sources: [],
+        ...overrides,
+    };
+}
+describe('selectAuditCandidates', () => {
+    it('skips entries with no sources', async () => {
+        const fetch = vi.fn();
+        const out = await selectAuditCandidates([entry({ sources: [] })], { now: today, max: 10, fetch });
+        expect(out).toEqual([]);
+    });
+    it('selects entries that have never been reviewed', async () => {
+        const fetch = vi.fn().mockResolvedValue({ hash: 'h1' });
+        const out = await selectAuditCandidates([entry({ name: 'a', sources: [{ url: 'https://x' }], lastReviewed: null })], { now: today, max: 10, fetch });
+        expect(out.map(c => c.name)).toEqual(['a']);
+    });
+    it('selects fast-moving entries last reviewed >14d ago', async () => {
+        const fetch = vi.fn().mockResolvedValue({ hash: 'h1' });
+        const out = await selectAuditCandidates([entry({
+                name: 'a', volatility: 'fast-moving', lastReviewed: '2026-05-01',
+                sources: [{ url: 'https://x', hash: 'h1' }],
+            })], { now: today, max: 10, fetch });
+        expect(out.map(c => c.name)).toEqual(['a']);
+    });
+    it('selects entries whose source hash changed', async () => {
+        const fetch = vi.fn().mockResolvedValue({ hash: 'h2' });
+        const out = await selectAuditCandidates([entry({ name: 'a', lastReviewed: '2026-05-23', sources: [{ url: 'https://x', hash: 'h1' }] })], { now: today, max: 10, fetch });
+        expect(out.map(c => c.name)).toEqual(['a']);
+    });
+    it('skips stable entries within their 180d window with matching hashes', async () => {
+        const fetch = vi.fn().mockResolvedValue({ hash: 'h1' });
+        const out = await selectAuditCandidates([entry({
+                name: 'a', volatility: 'stable', lastReviewed: '2026-04-01',
+                sources: [{ url: 'https://x', hash: 'h1' }],
+            })], { now: today, max: 10, fetch });
+        expect(out).toEqual([]);
+    });
+    it('appends source.anchor to the fetched URL so the prefilter hashes the same target as the audit', async () => {
+        const fetch = vi.fn().mockResolvedValue({ hash: 'h1' });
+        await selectAuditCandidates([entry({
+                name: 'a', lastReviewed: '2026-05-23',
+                sources: [{ url: 'https://example.org/spec', anchor: '#section-2', hash: 'h1' }],
+            })], { now: today, max: 10, fetch });
+        expect(fetch).toHaveBeenCalledWith('https://example.org/spec#section-2');
+    });
+    it('respects max ceiling', async () => {
+        const fetch = vi.fn().mockResolvedValue({ hash: 'new' });
+        const entries = Array.from({ length: 5 }, (_, i) => entry({ name: `e${i}`, sources: [{ url: `https://x${i}`, hash: 'old' }], lastReviewed: null }));
+        const out = await selectAuditCandidates(entries, { now: today, max: 2, fetch });
+        expect(out).toHaveLength(2);
+    });
+    it('treats an invalid calendar date in lastReviewed as overdue (no NaN-skip)', async () => {
+        // Round-3 F-002: "2026-99-99" passed the regex but is not a real date.
+        // Cadence math (now - new Date('2026-99-99')) is NaN; without the guard,
+        // the entry would NEVER be selected by the cadence path even when its
+        // sources don't change. Verify it now gets picked up.
+        const fetch = vi.fn().mockResolvedValue({ hash: 'h1' });
+        const out = await selectAuditCandidates([entry({
+                name: 'a', volatility: 'fast-moving', lastReviewed: '2026-99-99',
+                sources: [{ url: 'https://x', hash: 'h1' }],
+            })], { now: today, max: 10, fetch });
+        expect(out.map((c) => c.name)).toEqual(['a']);
+    });
+    it('returns no candidates when max is 0, negative, or non-integer (no ceiling bypass)', async () => {
+        const fetch = vi.fn().mockResolvedValue({ hash: 'new' });
+        const entries = Array.from({ length: 5 }, (_, i) => entry({ name: `e${i}`, sources: [{ url: `https://x${i}`, hash: 'old' }], lastReviewed: null }));
+        // Negative would otherwise become `slice(0, -1)` → "all but last" (round-2 F-003).
+        expect(await selectAuditCandidates(entries, { now: today, max: -1, fetch })).toEqual([]);
+        expect(await selectAuditCandidates(entries, { now: today, max: 0, fetch })).toEqual([]);
+        expect(await selectAuditCandidates(entries, { now: today, max: 1.5, fetch })).toEqual([]);
+    });
+});
+//# sourceMappingURL=audit-prefilter.test.js.map

package/dist/knowledge-freshness/audit-prefilter.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-prefilter.test.js","sourceRoot":"","sources":["../../src/knowledge-freshness/audit-prefilter.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AACjD,OAAO,EAAE,qBAAqB,EAAsB,MAAM,sBAAsB,CAAA;AAGhF,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,sBAAsB,CAAC,CAAA;AAE9C,SAAS,KAAK,CAAC,SAAkC;IAC/C,OAAO;QACL,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE;QACnD,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;QACzE,GAAG,SAAS;KACb,CAAA;AACH,CAAC;AAED,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE,EAA8B,CAAA;QACjD,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QACjG,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAA6B,CAAA;QACnF,MAAM,GAAG,GAAG,MAAM,qBAAqB,CACrC,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,EAC3E,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,CAC/B,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAA6B,CAAA;QACnF,MAAM,GAAG,GAAG,MAAM,qBAAqB,CACrC,CAAC,KAAK,CAAC;gBACL,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY;gBAChE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;aAC5C,CAAC,CAAC,EACH,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,CAC/B,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAA6B,CAAA;QACnF,MAAM,GAAG,GAAG,MAAM,qBAAqB,CACrC,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,EAC/F,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,CAC/B,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAA6B,CAAA;QACnF,MAAM,GAAG,GAAG,MAAM,qBAAqB,CACrC,CAAC,KAAK,CAAC;gBACL,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY;gBAC3D,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;aAC5C,CAAC,CAAC,EACH,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,CAC/B,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+FAA+F,EAAE,KAAK,IAAI,EAAE;QAC7G,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAA6B,CAAA;QACnF,MAAM,qBAAqB,CACzB,CAAC,KAAK,CAAC;gBACL,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,YAAY;gBACrC,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,0BAA0B,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;aACjF,CAAC,CAAC,EACH,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,CAC/B,CAAA;QACD,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAAC,oCAAoC,CAAC,CAAA;IAC1E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;QACpC,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAA6B,CAAA;QACpF,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACjD,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,YAAY,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAC/F,CAAA;QACD,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;QAC/E,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IAC7B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,uEAAuE;QACvE,yEAAyE;QACzE,sEAAsE;QACtE,sDAAsD;QACtD,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAA6B,CAAA;QACnF,MAAM,GAAG,GAAG,MAAM,qBAAqB,CACrC,CAAC,KAAK,CAAC;gBACL,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY;gBAChE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;aAC5C,CAAC,CAAC,EACH,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,CAC/B,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;QACjG,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAA6B,CAAA;QACpF,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACjD,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,YAAY,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAC/F,CAAA;QACD,mFAAmF;QACnF,MAAM,CAAC,MAAM,qBAAqB,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACxF,MAAM,CAAC,MAAM,qBAAqB,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACvF,MAAM,CAAC,MAAM,qBAAqB,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC3F,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/knowledge-freshness/audit-runner.d.ts

@@ -0,0 +1,135 @@
+import { z } from 'zod';
+import { type Resolver } from './source-url-validator.js';
+import { type FetchImpl } from './source-hash.js';
+export type Dispatcher = (prompt: string) => Promise<string>;
+declare const verdictSchema: z.ZodObject<{
+    entry_name: z.ZodString;
+    audit_date: z.ZodString;
+    model: z.ZodString;
+    verdict: z.ZodEnum<["current", "minor-drift", "major-drift", "superseded"]>;
+    sources_checked: z.ZodArray<z.ZodObject<{
+        url: z.ZodString;
+        retrieved_at: z.ZodString;
+        content_hash: z.ZodString;
+        summary: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        summary: string;
+        url: string;
+        retrieved_at: string;
+        content_hash: string;
+    }, {
+        summary: string;
+        url: string;
+        retrieved_at: string;
+        content_hash: string;
+    }>, "many">;
+    findings: z.ZodArray<z.ZodObject<{
+        claim_in_entry: z.ZodString;
+        evidence_url: z.ZodString;
+        evidence_date: z.ZodString;
+        source_excerpt: z.ZodString;
+        severity: z.ZodEnum<["P0", "P1", "P2", "P3"]>;
+        drift_kind: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        severity: "P0" | "P1" | "P2" | "P3";
+        claim_in_entry: string;
+        evidence_url: string;
+        evidence_date: string;
+        source_excerpt: string;
+        drift_kind: string;
+    }, {
+        severity: "P0" | "P1" | "P2" | "P3";
+        claim_in_entry: string;
+        evidence_url: string;
+        evidence_date: string;
+        source_excerpt: string;
+        drift_kind: string;
+    }>, "many">;
+    proposed_changes: z.ZodArray<z.ZodObject<{
+        location: z.ZodString;
+        kind: z.ZodEnum<["replace", "insert", "delete"]>;
+        rationale: z.ZodString;
+        new_text: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        kind: "replace" | "delete" | "insert";
+        location: string;
+        rationale: string;
+        new_text?: string | undefined;
+    }, {
+        kind: "replace" | "delete" | "insert";
+        location: string;
+        rationale: string;
+        new_text?: string | undefined;
+    }>, "many">;
+    preserve_warnings: z.ZodArray<z.ZodString, "many">;
+}, "strip", z.ZodTypeAny, {
+    verdict: "current" | "superseded" | "minor-drift" | "major-drift";
+    findings: {
+        severity: "P0" | "P1" | "P2" | "P3";
+        claim_in_entry: string;
+        evidence_url: string;
+        evidence_date: string;
+        source_excerpt: string;
+        drift_kind: string;
+    }[];
+    model: string;
+    entry_name: string;
+    audit_date: string;
+    sources_checked: {
+        summary: string;
+        url: string;
+        retrieved_at: string;
+        content_hash: string;
+    }[];
+    proposed_changes: {
+        kind: "replace" | "delete" | "insert";
+        location: string;
+        rationale: string;
+        new_text?: string | undefined;
+    }[];
+    preserve_warnings: string[];
+}, {
+    verdict: "current" | "superseded" | "minor-drift" | "major-drift";
+    findings: {
+        severity: "P0" | "P1" | "P2" | "P3";
+        claim_in_entry: string;
+        evidence_url: string;
+        evidence_date: string;
+        source_excerpt: string;
+        drift_kind: string;
+    }[];
+    model: string;
+    entry_name: string;
+    audit_date: string;
+    sources_checked: {
+        summary: string;
+        url: string;
+        retrieved_at: string;
+        content_hash: string;
+    }[];
+    proposed_changes: {
+        kind: "replace" | "delete" | "insert";
+        location: string;
+        rationale: string;
+        new_text?: string | undefined;
+    }[];
+    preserve_warnings: string[];
+}>;
+export type AuditVerdict = z.infer<typeof verdictSchema>;
+export interface RunEntryAuditOptions {
+    /** Override the meta-prompt path. Defaults to the bundled `content/tools/knowledge-audit-entry.md`. */
+    promptPath?: string;
+    /** Override the DNS resolver used for the rebinding guard (round-5 F-001). Default: Node `dns.promises`. */
+    resolver?: Resolver;
+    /** Override the fetch implementation. Tests inject a mock. Default: undici fetch via fetchAndHash. */
+    fetchImpl?: FetchImpl;
+    /**
+     * Skip prefetching source bodies. Used only by tests that supply fixture
+     * URLs which aren't expected to resolve (e.g. `https://x`) and don't care
+     * about the prefetched-sources payload. Defaults to running the prefetch.
+     */
+    skipPrefetch?: boolean;
+}
+export declare function runEntryAudit(entryPath: string, dispatch: Dispatcher, opts?: RunEntryAuditOptions): Promise<AuditVerdict>;
+export {};
+//# sourceMappingURL=audit-runner.d.ts.map

package/dist/knowledge-freshness/audit-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-runner.d.ts","sourceRoot":"","sources":["../../src/knowledge-freshness/audit-runner.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,EAAmB,KAAK,QAAQ,EAAE,MAAM,2BAA2B,CAAA;AAC1E,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAS/D,MAAM,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;AAE5D,QAAA,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoBjB,CAAA;AAEF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAA;AAExD,MAAM,WAAW,oBAAoB;IACnC,uGAAuG;IACvG,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,4GAA4G;IAC5G,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,sGAAsG;IACtG,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB;AAED,wBAAsB,aAAa,CACjC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,UAAU,EACpB,IAAI,GAAE,oBAAyB,GAC9B,OAAO,CAAC,YAAY,CAAC,CAuFvB"}

package/dist/knowledge-freshness/audit-runner.js

@@ -0,0 +1,168 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { z } from 'zod';
+import { extractKBFrontmatter } from '../core/assembly/knowledge-loader.js';
+import { getPackageRoot } from '../utils/fs.js';
+import { defaultResolver } from './source-url-validator.js';
+import { fetchAndHash } from './source-hash.js';
+/**
+ * Max body bytes injected per source. Caps prompt size and keeps a malicious
+ * giant response from blowing the context window. 96 KiB is comfortably
+ * larger than current targets (OWASP Top 10 page ≈ 50 KiB).
+ */
+const MAX_SOURCE_BODY_BYTES = 96 * 1024;
+const verdictSchema = z.object({
+    entry_name: z.string(),
+    audit_date: z.string(),
+    model: z.string(),
+    verdict: z.enum(['current', 'minor-drift', 'major-drift', 'superseded']),
+    sources_checked: z.array(z.object({
+        url: z.string().url(), retrieved_at: z.string(),
+        content_hash: z.string(), summary: z.string(),
+    })),
+    findings: z.array(z.object({
+        claim_in_entry: z.string(), evidence_url: z.string().url(),
+        evidence_date: z.string(), source_excerpt: z.string(),
+        severity: z.enum(['P0', 'P1', 'P2', 'P3']),
+        drift_kind: z.string(),
+    })),
+    proposed_changes: z.array(z.object({
+        location: z.string(), kind: z.enum(['replace', 'insert', 'delete']),
+        rationale: z.string(), new_text: z.string().optional(),
+    })),
+    preserve_warnings: z.array(z.string()),
+});
+export async function runEntryAudit(entryPath, dispatch, opts = {}) {
+    const content = fs.readFileSync(entryPath, 'utf8');
+    const fm = extractKBFrontmatter(content);
+    if (!fm)
+        throw new Error(`could not parse frontmatter at ${entryPath}`);
+    // SECURITY (round-6 F-001): the entry body is author-controlled. If the
+    // subprocess had WebFetch enabled, a prompt-injected body could direct it
+    // at arbitrary URLs — bypassing every Node-side URL guard, because the
+    // attacker URL never came through the declared sources array.
+    //
+    // Mitigation: pre-fetch source bodies in Node, where the SSRF / DNS /
+    // redirect-hop / timeout guards apply, and embed the bodies into the
+    // prompt. The model runs with NO tools (`--tools ""` set by the CLI
+    // wrapper). The only way to "fetch a URL" is to declare it in the entry's
+    // frontmatter sources — and those go through the guards.
+    //
+    // TOCTOU still possible between Node fetch and any future subprocess fetch,
+    // but a no-tools model can't re-fetch at all, so the window collapses to
+    // zero. The Phase 2 "constrained fetch tool with pre-validated IDs" idea
+    // can re-introduce WebFetch later if needed.
+    const resolver = opts.resolver ?? defaultResolver;
+    const prefetched = [];
+    if (!opts.skipPrefetch) {
+        for (const s of fm.sources) {
+            const targetUrl = s.url + (s.anchor ?? '');
+            const { body, hash } = await fetchAndHash(targetUrl, { resolver, fetchImpl: opts.fetchImpl });
+            const truncated = body.length > MAX_SOURCE_BODY_BYTES;
+            prefetched.push({
+                url: targetUrl,
+                body: truncated ? body.slice(0, MAX_SOURCE_BODY_BYTES) : body,
+                hash,
+                truncated,
+            });
+        }
+    }
+    // Re-emit the frontmatter with the same hyphenated keys the meta-prompt
+    // describes (`last-reviewed`, `version-pin`). The parser's TS-side shape
+    // is camelCase; the prompt and the on-disk YAML are hyphenated, and the
+    // model is told to expect hyphenated keys.
+    const fmForPrompt = {
+        name: fm.name,
+        description: fm.description,
+        topics: fm.topics,
+        volatility: fm.volatility,
+        'last-reviewed': fm.lastReviewed,
+        'version-pin': fm.versionPin,
+        sources: fm.sources,
+    };
+    // Resolve via the package-root helper so this works when scaffold is invoked
+    // from any cwd (installed globally via npm/brew, or run from a downstream
+    // project root). Pattern matches src/core/knowledge/knowledge-update-assembler.ts.
+    // Tests can pass `opts.promptPath` to inject a fixture.
+    const promptTemplate = fs.readFileSync(opts.promptPath ?? path.join(getPackageRoot(), 'content', 'tools', 'knowledge-audit-entry.md'), 'utf8');
+    // Single-pass substitution prevents template-collision: if one value
+    // happened to contain a later placeholder string like `{{entry_body}}`,
+    // a sequential .replaceAll chain would substitute into the substituted
+    // content. The single regex over all placeholders sidesteps that — each
+    // match site is resolved against the original template once.
+    // Replacer-function form also avoids String.replace's special-pattern
+    // handling (`$$`, `$&`, `$'`, `$1`) on values containing dollar signs.
+    const substitutions = {
+        '{{entry_path}}': entryPath,
+        '{{entry_frontmatter}}': JSON.stringify(fmForPrompt, null, 2),
+        '{{entry_body}}': content,
+        '{{prefetched_sources}}': JSON.stringify(prefetched, null, 2),
+    };
+    const filled = promptTemplate.replace(/\{\{(entry_path|entry_frontmatter|entry_body|prefetched_sources)\}\}/g, (match) => substitutions[match] ?? match);
+    const raw = await dispatch(filled);
+    const verdict = findFirstMatchingJson(raw, verdictSchema);
+    if (verdict === undefined) {
+        throw new Error('audit output contained no JSON object matching the verdict schema. ' +
+            'Check that the dispatcher returned the meta-prompt\'s expected shape.');
+    }
+    return verdict;
+}
+function findFirstMatchingJson(s, schema) {
+    const tryCandidate = (candidate) => {
+        let parsed;
+        try {
+            parsed = JSON.parse(candidate);
+        }
+        catch {
+            return undefined;
+        }
+        const result = schema.safeParse(parsed);
+        return result.success ? result.data : undefined;
+    };
+    for (let start = 0; start < s.length; start++) {
+        if (s[start] !== '{')
+            continue;
+        let depth = 0;
+        let inString = false;
+        let escaped = false;
+        for (let i = start; i < s.length; i++) {
+            const ch = s[i];
+            if (escaped) {
+                escaped = false;
+                continue;
+            }
+            if (inString) {
+                if (ch === '\\') {
+                    escaped = true;
+                    continue;
+                }
+                if (ch === '"')
+                    inString = false;
+                continue;
+            }
+            if (ch === '"') {
+                inString = true;
+                continue;
+            }
+            if (ch === '{')
+                depth++;
+            else if (ch === '}') {
+                depth--;
+                if (depth === 0) {
+                    const hit = tryCandidate(s.slice(start, i + 1));
+                    if (hit !== undefined)
+                        return hit;
+                    break; // skip past this candidate; outer loop continues at start+1
+                }
+            }
+        }
+    }
+    // The forward-walk scans every balanced {...} block in the response and
+    // try-parses each. A separate "strip ```json fences and try once more"
+    // fallback was considered, but the inner JSON inside a fence pair is
+    // itself a balanced {...} block that the primary loop already finds —
+    // the fallback was dead code in practice. If nothing matched, the
+    // dispatcher response is too degenerate to recover.
+    return undefined;
+}
+//# sourceMappingURL=audit-runner.js.map

package/dist/knowledge-freshness/audit-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-runner.js","sourceRoot":"","sources":["../../src/knowledge-freshness/audit-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAA;AACxB,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAA;AAC3E,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,EAAE,eAAe,EAAiB,MAAM,2BAA2B,CAAA;AAC1E,OAAO,EAAE,YAAY,EAAkB,MAAM,kBAAkB,CAAA;AAE/D;;;;GAIG;AACH,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAA;AAIvC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;IACxE,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAChC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;QAC/C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;KAC9C,CAAC,CAAC;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACzB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QAC1D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;QACrD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC1C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;KACvB,CAAC,CAAC;IACH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACnE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACvD,CAAC,CAAC;IACH,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACvC,CAAC,CAAA;AAmBF,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,SAAiB,EACjB,QAAoB,EACpB,OAA6B,EAAE;IAE/B,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IAClD,MAAM,EAAE,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAA;IACxC,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,SAAS,EAAE,CAAC,CAAA;IAEvE,wEAAwE;IACxE,0EAA0E;IAC1E,uEAAuE;IACvE,8DAA8D;IAC9D,EAAE;IACF,sEAAsE;IACtE,qEAAqE;IACrE,oEAAoE;IACpE,0EAA0E;IAC1E,yDAAyD;IACzD,EAAE;IACF,4EAA4E;IAC5E,yEAAyE;IACzE,yEAAyE;IACzE,6CAA6C;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAA;IAEjD,MAAM,UAAU,GAAuB,EAAE,CAAA;IACzC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAA;YAC1C,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;YAC7F,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,qBAAqB,CAAA;YACrD,UAAU,CAAC,IAAI,CAAC;gBACd,GAAG,EAAE,SAAS;gBACd,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC,IAAI;gBAC7D,IAAI;gBACJ,SAAS;aACV,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,yEAAyE;IACzE,wEAAwE;IACxE,2CAA2C;IAC3C,MAAM,WAAW,GAAG;QAClB,IAAI,EAAE,EAAE,CAAC,IAAI;QACb,WAAW,EAAE,EAAE,CAAC,WAAW;QAC3B,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,UAAU,EAAE,EAAE,CAAC,UAAU;QACzB,eAAe,EAAE,EAAE,CAAC,YAAY;QAChC,aAAa,EAAE,EAAE,CAAC,UAAU;QAC5B,OAAO,EAAE,EAAE,CAAC,OAAO;KACpB,CAAA;IAED,6EAA6E;IAC7E,0EAA0E;IAC1E,mFAAmF;IACnF,wDAAwD;IACxD,MAAM,cAAc,GAAG,EAAE,CAAC,YAAY,CACpC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,0BAA0B,CAAC,EAC9F,MAAM,CACP,CAAA;IAED,qEAAqE;IACrE,wEAAwE;IACxE,uEAAuE;IACvE,wEAAwE;IACxE,6DAA6D;IAC7D,sEAAsE;IACtE,uEAAuE;IACvE,MAAM,aAAa,GAA2B;QAC5C,gBAAgB,EAAE,SAAS;QAC3B,uBAAuB,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,gBAAgB,EAAE,OAAO;QACzB,wBAAwB,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;KAC9D,CAAA;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CACnC,uEAAuE,EACvE,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,CACzC,CAAA;IAED,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAA;IAClC,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;IACzD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,qEAAqE;YACrE,uEAAuE,CACxE,CAAA;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAoBD,SAAS,qBAAqB,CAAI,CAAS,EAAE,MAAqB;IAChE,MAAM,YAAY,GAAG,CAAC,SAAiB,EAAiB,EAAE;QACxD,IAAI,MAAe,CAAA;QACnB,IAAI,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,SAAS,CAAA;QAAC,CAAC;QACjE,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QACvC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;IACjD,CAAC,CAAA;IAED,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9C,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG;YAAE,SAAQ;QAC9B,IAAI,KAAK,GAAG,CAAC,CAAA;QACb,IAAI,QAAQ,GAAG,KAAK,CAAA;QACpB,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;YACf,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,GAAG,KAAK,CAAC;gBAAC,SAAQ;YAAC,CAAC;YAC1C,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;oBAAC,OAAO,GAAG,IAAI,CAAC;oBAAC,SAAQ;gBAAC,CAAC;gBAC7C,IAAI,EAAE,KAAK,GAAG;oBAAE,QAAQ,GAAG,KAAK,CAAA;gBAChC,SAAQ;YACV,CAAC;YACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBAAC,QAAQ,GAAG,IAAI,CAAC;gBAAC,SAAQ;YAAC,CAAC;YAC7C,IAAI,EAAE,KAAK,GAAG;gBAAE,KAAK,EAAE,CAAA;iBAClB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACpB,KAAK,EAAE,CAAA;gBACP,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;oBAChB,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;oBAC/C,IAAI,GAAG,KAAK,SAAS;wBAAE,OAAO,GAAG,CAAA;oBACjC,MAAK,CAAC,4DAA4D;gBACpE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,wEAAwE;IACxE,uEAAuE;IACvE,qEAAqE;IACrE,sEAAsE;IACtE,kEAAkE;IAClE,oDAAoD;IACpD,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/dist/knowledge-freshness/audit-runner.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=audit-runner.test.d.ts.map

package/dist/knowledge-freshness/audit-runner.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-runner.test.d.ts","sourceRoot":"","sources":["../../src/knowledge-freshness/audit-runner.test.ts"],"names":[],"mappings":""}

package/dist/knowledge-freshness/audit-runner.test.js

@@ -0,0 +1,130 @@
+import { describe, it, expect, vi, beforeAll, afterAll } from 'vitest';
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { runEntryAudit } from './audit-runner.js';
+// Use temp fixtures rather than the real on-disk entry + meta-prompt so the
+// runner tests don't break when those files are edited. We inject the meta-
+// prompt path via opts.promptPath so the test never depends on cwd or on
+// scaffold's package layout.
+let tmpRoot;
+let entryFile;
+let promptFile;
+beforeAll(() => {
+    tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'runner-test-'));
+    promptFile = path.join(tmpRoot, 'audit.md');
+    fs.writeFileSync(promptFile, '# stub\n{{entry_path}} {{entry_frontmatter}} {{entry_body}}\n');
+    entryFile = path.join(tmpRoot, 'entry.md');
+    fs.writeFileSync(entryFile, '---\nname: stub\ndescription: y\n---\nbody\n');
+});
+afterAll(() => {
+    fs.rmSync(tmpRoot, { recursive: true, force: true });
+});
+const run = (dispatcher) => runEntryAudit(entryFile, dispatcher, { promptPath: promptFile });
+describe('runEntryAudit', () => {
+    it('returns the parsed verdict on a clean dispatcher response', async () => {
+        const dispatcher = vi.fn().mockResolvedValue(JSON.stringify({
+            entry_name: 'stub', audit_date: '2026-05-24', model: 'claude-opus-4-7',
+            verdict: 'superseded', sources_checked: [], findings: [], proposed_changes: [], preserve_warnings: [],
+        }));
+        const out = await run(dispatcher);
+        expect(out.verdict).toBe('superseded');
+        expect(out.entry_name).toBe('stub');
+    });
+    it('extracts JSON when the model wraps it in conversational preamble', async () => {
+        const dispatcher = vi.fn().mockResolvedValue(`Here's the verdict you asked for:\n\n${JSON.stringify({
+            entry_name: 'stub', audit_date: '2026-05-24', model: 'claude-opus-4-7',
+            verdict: 'current', sources_checked: [], findings: [], proposed_changes: [], preserve_warnings: [],
+        })}\n\nLet me know if you need anything else.`);
+        const out = await run(dispatcher);
+        expect(out.verdict).toBe('current');
+    });
+    it('skips brace-shaped noise in prose and finds the real JSON object', async () => {
+        // The first {...} block in this output is not JSON; the extractor must
+        // skip it and try the next balanced block.
+        const dispatcher = vi.fn().mockResolvedValue('Notes: I considered {alpha, beta} options but went with the second one.\n' +
+            `Result:\n${JSON.stringify({
+                entry_name: 'stub', audit_date: '2026-05-24', model: 'claude-opus-4-7',
+                verdict: 'minor-drift', sources_checked: [], findings: [], proposed_changes: [], preserve_warnings: [],
+            })}\n`);
+        const out = await run(dispatcher);
+        expect(out.verdict).toBe('minor-drift');
+    });
+    it('skips parseable-but-irrelevant JSON earlier in the output', async () => {
+        // The model emits a thinking-shaped JSON object before the verdict. The
+        // first is parseable, but doesn't match the verdict schema — the extractor
+        // must continue past it and find the actual verdict.
+        const dispatcher = vi.fn().mockResolvedValue(`${JSON.stringify({ thinking: 'first I will check OWASP', confidence: 0.9 })}\n\n` +
+            `${JSON.stringify({
+                entry_name: 'stub', audit_date: '2026-05-24', model: 'claude-opus-4-7',
+                verdict: 'superseded', sources_checked: [], findings: [], proposed_changes: [], preserve_warnings: [],
+            })}\n`);
+        const out = await run(dispatcher);
+        expect(out.verdict).toBe('superseded');
+    });
+    it('throws on non-JSON dispatcher output', async () => {
+        const dispatcher = vi.fn().mockResolvedValue('not json at all');
+        await expect(run(dispatcher)).rejects.toThrow();
+    });
+    it('throws on missing required fields', async () => {
+        const dispatcher = vi.fn().mockResolvedValue(JSON.stringify({ entry_name: 'x' }));
+        await expect(run(dispatcher)).rejects.toThrow();
+    });
+    it('pre-fetches declared sources and embeds bodies via {{prefetched_sources}} (round-6 F-001)', async () => {
+        // Use a fresh tmp setup with sources declared in the entry.
+        const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'runner-prefetch-'));
+        try {
+            const prompt = path.join(tmp, 'audit.md');
+            fs.writeFileSync(prompt, '{{prefetched_sources}}');
+            const entry = path.join(tmp, 'entry.md');
+            fs.writeFileSync(entry, '---\nname: stub\ndescription: y\nsources:\n  - url: https://example.org/spec\n---\nbody\n');
+            const fetchImpl = vi.fn(async () => new Response('upstream content here', { status: 200 }));
+            const publicResolver = async () => ['93.184.216.34'];
+            let promptSeen = '';
+            const dispatcher = async (p) => {
+                promptSeen = p;
+                return JSON.stringify({
+                    entry_name: 'stub', audit_date: '2026-05-24', model: 'claude-opus-4-7',
+                    verdict: 'current', sources_checked: [], findings: [],
+                    proposed_changes: [], preserve_warnings: [],
+                });
+            };
+            await runEntryAudit(entry, dispatcher, {
+                promptPath: prompt, resolver: publicResolver, fetchImpl,
+            });
+            // The prompt should now contain the pre-fetched source body verbatim.
+            expect(promptSeen).toContain('upstream content here');
+            expect(promptSeen).toContain('https://example.org/spec');
+            // And a hash that's deterministically computed in Node, not invented by
+            // the model. We don't assert the exact value to keep the test resilient,
+            // but it must look like a sha256 hex digest.
+            expect(promptSeen).toMatch(/sha256:[0-9a-f]{64}/);
+        }
+        finally {
+            fs.rmSync(tmp, { recursive: true, force: true });
+        }
+    });
+    it('skipPrefetch=true bypasses source fetching (test fixtures with unresolvable URLs)', async () => {
+        // With prefetch on, fixture URLs that don't resolve would throw. The opt
+        // exists so unit tests of the JSON-extraction path can supply stub
+        // entries with placeholder URLs without needing to mock fetch + DNS.
+        const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'runner-skip-'));
+        try {
+            const prompt = path.join(tmp, 'audit.md');
+            fs.writeFileSync(prompt, '{{prefetched_sources}}');
+            const entry = path.join(tmp, 'entry.md');
+            fs.writeFileSync(entry, '---\nname: stub\ndescription: y\nsources:\n  - url: https://x\n---\nbody\n');
+            const dispatcher = async () => JSON.stringify({
+                entry_name: 'stub', audit_date: '2026-05-24', model: 'claude-opus-4-7',
+                verdict: 'current', sources_checked: [], findings: [],
+                proposed_changes: [], preserve_warnings: [],
+            });
+            const out = await runEntryAudit(entry, dispatcher, { promptPath: prompt, skipPrefetch: true });
+            expect(out.verdict).toBe('current');
+        }
+        finally {
+            fs.rmSync(tmp, { recursive: true, force: true });
+        }
+    });
+});
+//# sourceMappingURL=audit-runner.test.js.map

package/dist/knowledge-freshness/audit-runner.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-runner.test.js","sourceRoot":"","sources":["../../src/knowledge-freshness/audit-runner.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAA;AACtE,OAAO,EAAE,MAAM,SAAS,CAAA;AACxB,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,MAAM,SAAS,CAAA;AACxB,OAAO,EAAE,aAAa,EAAmB,MAAM,mBAAmB,CAAA;AAElE,4EAA4E;AAC5E,4EAA4E;AAC5E,yEAAyE;AACzE,6BAA6B;AAC7B,IAAI,OAAe,CAAA;AACnB,IAAI,SAAiB,CAAA;AACrB,IAAI,UAAkB,CAAA;AAEtB,SAAS,CAAC,GAAG,EAAE;IACb,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAA;IAChE,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;IAC3C,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,+DAA+D,CAAC,CAAA;IAC7F,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;IAC1C,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,8CAA8C,CAAC,CAAA;AAC7E,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,GAAG,EAAE;IACZ,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AACtD,CAAC,CAAC,CAAA;AAEF,MAAM,GAAG,GAAG,CAAC,UAAsB,EAAE,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAA;AAExG,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,UAAU,GAAe,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC;YACtE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,iBAAiB;YACtE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE;SACtG,CAAC,CAAC,CAAA;QACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,CAAA;QACjC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACtC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,UAAU,GAAe,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CACtD,wCAAwC,IAAI,CAAC,SAAS,CAAC;YACrD,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,iBAAiB;YACtE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE;SACnG,CAAC,4CAA4C,CAC/C,CAAA;QACD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,CAAA;QACjC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,uEAAuE;QACvE,2CAA2C;QAC3C,MAAM,UAAU,GAAe,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CACtD,2EAA2E;YAC3E,YAAY,IAAI,CAAC,SAAS,CAAC;gBACzB,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,iBAAiB;gBACtE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE;aACvG,CAAC,IAAI,CACP,CAAA;QACD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,CAAA;QACjC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IACzC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,wEAAwE;QACxE,2EAA2E;QAC3E,qDAAqD;QACrD,MAAM,UAAU,GAAe,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CACtD,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,0BAA0B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM;YAClF,GAAG,IAAI,CAAC,SAAS,CAAC;gBAChB,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,iBAAiB;gBACtE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE;aACtG,CAAC,IAAI,CACP,CAAA;QACD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,CAAA;QACjC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,UAAU,GAAe,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,CAAA;QAC3E,MAAM,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAA;IACjD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,UAAU,GAAe,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;QAC7F,MAAM,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAA;IACjD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;QACzG,4DAA4D;QAC5D,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAA;QACtE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;YACzC,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAA;YAClD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;YACxC,EAAE,CAAC,aAAa,CACd,KAAK,EACL,2FAA2F,CAC5F,CAAA;YAED,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CACjC,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAG/C,CAAA;YACT,MAAM,cAAc,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,eAAe,CAAC,CAAA;YAEpD,IAAI,UAAU,GAAG,EAAE,CAAA;YACnB,MAAM,UAAU,GAAe,KAAK,EAAE,CAAC,EAAE,EAAE;gBACzC,UAAU,GAAG,CAAC,CAAA;gBACd,OAAO,IAAI,CAAC,SAAS,CAAC;oBACpB,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,iBAAiB;oBACtE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE;oBACrD,gBAAgB,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE;iBAC5C,CAAC,CAAA;YACJ,CAAC,CAAA;YAED,MAAM,aAAa,CAAC,KAAK,EAAE,UAAU,EAAE;gBACrC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS;aACxD,CAAC,CAAA;YACF,sEAAsE;YACtE,MAAM,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAA;YACrD,MAAM,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAA;YACxD,wEAAwE;YACxE,yEAAyE;YACzE,6CAA6C;YAC7C,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAA;QACnD,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAClD,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;QACjG,yEAAyE;QACzE,mEAAmE;QACnE,qEAAqE;QACrE,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAA;QAClE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;YACzC,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAA;YAClD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;YACxC,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,4EAA4E,CAAC,CAAA;YAErG,MAAM,UAAU,GAAe,KAAK,IAAI,EAAE,CACxC,IAAI,CAAC,SAAS,CAAC;gBACb,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,iBAAiB;gBACtE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE;gBACrD,gBAAgB,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE;aAC5C,CAAC,CAAA;YAEJ,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAA;YAC9F,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACrC,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAClD,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/knowledge-freshness/bump-version.d.ts

@@ -0,0 +1,24 @@
+export type BumpKind = 'major' | 'minor' | 'patch';
+/**
+ * Derive the bump kind from a Conventional Commits-flavored PR title and body.
+ *
+ * Rules (first match wins):
+ *   1. `BREAKING CHANGE:` token anywhere in title or body → major
+ *   2. `feat(knowledge):` or `feat(knowledge-freshness):` title prefix → minor
+ *   3. `chore(knowledge):` or `chore(knowledge-freshness):` title prefix → patch
+ *   4. Anything else → patch (the workflow logs a `::notice::` for this case)
+ *
+ * Title matching is case-sensitive against the literal prefix (Conventional
+ * Commits canonicalizes to lowercase). The BREAKING CHANGE token is matched
+ * case-sensitively as well — that's the canonical form.
+ */
+export declare function deriveBumpKind(prTitle: string, prBody: string): BumpKind;
+/**
+ * Bump a `X.Y.Z` SemVer string by the given kind. Throws on invalid input.
+ *
+ *  - `major`: `X.Y.Z` → `(X+1).0.0`
+ *  - `minor`: `X.Y.Z` → `X.(Y+1).0`
+ *  - `patch`: `X.Y.Z` → `X.Y.(Z+1)`
+ */
+export declare function bumpSemver(current: string, kind: BumpKind): string;
+//# sourceMappingURL=bump-version.d.ts.map

package/dist/knowledge-freshness/bump-version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bump-version.d.ts","sourceRoot":"","sources":["../../src/knowledge-freshness/bump-version.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAA;AAElD;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,QAAQ,CAmBxE;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,MAAM,CAkBlE"}