@zigrivers/scaffold 3.28.0 → 3.29.0

package/dist/knowledge-freshness/gates/lint-unsourced.d.ts

@@ -0,0 +1,40 @@
+export interface LintFinding {
+    /** Source path inside `content/knowledge/`. */
+    file: string;
+    /** 1-based line number in the FILE (post-patch). */
+    line: number;
+    /** Trimmed text of the offending line (no leading `+`). */
+    text: string;
+    /** Short reason, e.g. "no source link within 3 lines". */
+    reason: string;
+}
+export interface LintInput {
+    /** Path of the changed file. */
+    file: string;
+    /** Raw file contents AFTER the change. */
+    content: string;
+    /**
+     * Added-line records from the diff: line numbers (1-based, post-patch) and
+     * the line text WITHOUT the leading `+`. Caller is responsible for parsing
+     * the unified diff and producing this list — keeps this module pure.
+     */
+    addedLines: Array<{
+        line: number;
+        text: string;
+    }>;
+}
+export declare function lintUnsourcedClaims(inputs: LintInput[]): LintFinding[];
+/**
+ * Parse a unified diff (`git diff` output) into per-file added-line lists.
+ * Only `content/knowledge/**\/*.md` paths are emitted; other files are
+ * silently dropped so the caller can pipe an unfiltered diff in.
+ */
+export interface DiffParseResult {
+    file: string;
+    addedLines: Array<{
+        line: number;
+        text: string;
+    }>;
+}
+export declare function parseUnifiedDiff(diff: string): DiffParseResult[];
+//# sourceMappingURL=lint-unsourced.d.ts.map

package/dist/knowledge-freshness/gates/lint-unsourced.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lint-unsourced.d.ts","sourceRoot":"","sources":["../../../src/knowledge-freshness/gates/lint-unsourced.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,WAAW;IAC1B,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAA;IACZ,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAA;IACZ,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAA;IACZ,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,SAAS;IACxB,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAA;IACf;;;;OAIG;IACH,UAAU,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAClD;AAwCD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,WAAW,EAAE,CA4BtE;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAClD;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,EAAE,CAyChE"}

package/dist/knowledge-freshness/gates/lint-unsourced.js

@@ -0,0 +1,143 @@
+/**
+ * Advisory lint: scans a unified diff for ADDED lines in
+ * `content/knowledge/**\/*.md` that read like normative claims and don't have
+ * a nearby markdown link to a domain present in the entry's declared
+ * `sources:`. Emits one warning per offending line. Spec §A.5 explicitly says
+ * "Heuristic, advisory; flags for review, doesn't block" — never returns a
+ * non-OK status.
+ */
+import { parseEntry } from './parse-entry.js';
+/** Whole-word match for normative-claim keywords (case-insensitive). */
+const NORMATIVE_RE = /\b(must|should|never|always)\b/i;
+const NEAR_LINES = 3;
+/**
+ * Extract the set of source domains (hostnames) declared in the entry's
+ * frontmatter. Used to decide whether a nearby link "counts" — links to
+ * arbitrary unrelated URLs don't satisfy the heuristic.
+ */
+function sourceDomains(content) {
+    try {
+        const parsed = parseEntry(content);
+        const out = new Set();
+        for (const url of parsed.sourceUrls) {
+            try {
+                out.add(new URL(url).hostname);
+            }
+            catch { /* ignore unparseable */ }
+        }
+        return out;
+    }
+    catch {
+        return new Set();
+    }
+}
+/**
+ * True if `line` (a markdown line) contains a `[text](http...)` link whose
+ * hostname appears in `domains`.
+ */
+function lineHasSourceLink(line, domains) {
+    // Match every markdown link in the line. The regex is non-greedy on link
+    // text so back-to-back links don't merge into one match.
+    const re = /\[[^\]]*\]\((https?:\/\/[^\s)]+)\)/g;
+    for (let m = re.exec(line); m; m = re.exec(line)) {
+        try {
+            const h = new URL(m[1]).hostname;
+            if (domains.has(h))
+                return true;
+            // Accept subdomain matches so a source declared as "owasp.org" still
+            // covers a citation to "cheatsheetseries.owasp.org".
+            for (const d of domains)
+                if (h.endsWith('.' + d))
+                    return true;
+        }
+        catch { /* ignore */ }
+    }
+    return false;
+}
+export function lintUnsourcedClaims(inputs) {
+    const findings = [];
+    for (const input of inputs) {
+        if (input.addedLines.length === 0)
+            continue;
+        const domains = sourceDomains(input.content);
+        const fileLines = input.content.split('\n');
+        for (const added of input.addedLines) {
+            if (!NORMATIVE_RE.test(added.text))
+                continue;
+            // Look within ±NEAR_LINES of the offending line. `line` is 1-based.
+            const lo = Math.max(0, added.line - 1 - NEAR_LINES);
+            const hi = Math.min(fileLines.length - 1, added.line - 1 + NEAR_LINES);
+            let found = false;
+            for (let i = lo; i <= hi; i++) {
+                if (lineHasSourceLink(fileLines[i] ?? '', domains)) {
+                    found = true;
+                    break;
+                }
+            }
+            if (!found) {
+                findings.push({
+                    file: input.file,
+                    line: added.line,
+                    text: added.text.trim(),
+                    reason: domains.size === 0
+                        ? 'normative claim added but entry declares no sources'
+                        : `no link to a declared source within ${NEAR_LINES} lines`,
+                });
+            }
+        }
+    }
+    return findings;
+}
+export function parseUnifiedDiff(diff) {
+    const out = [];
+    const lines = diff.split('\n');
+    let i = 0;
+    while (i < lines.length) {
+        const line = lines[i];
+        if (line.startsWith('diff --git ')) {
+            // Header form: `diff --git a/path b/path`. Use the b-side as canonical.
+            const m = line.match(/^diff --git a\/(.+) b\/(.+)$/);
+            const file = m ? m[2] : '';
+            i++;
+            // Skip header lines until we hit a hunk or the next file.
+            while (i < lines.length && !lines[i].startsWith('@@') && !lines[i].startsWith('diff --git '))
+                i++;
+            if (!file.startsWith('content/knowledge/') || !file.endsWith('.md'))
+                continue;
+            const added = [];
+            while (i < lines.length && !lines[i].startsWith('diff --git ')) {
+                const hunk = lines[i].match(/^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/);
+                if (!hunk) {
+                    i++;
+                    continue;
+                }
+                let curLine = Number(hunk[1]);
+                i++;
+                while (i < lines.length && !lines[i].startsWith('@@') && !lines[i].startsWith('diff --git ')) {
+                    const ch = lines[i].charAt(0);
+                    if (ch === '+' && !lines[i].startsWith('+++')) {
+                        added.push({ line: curLine, text: lines[i].slice(1) });
+                        curLine++;
+                    }
+                    else if (ch === '-' && !lines[i].startsWith('---')) {
+                        // deletion — don't advance post-patch line counter
+                    }
+                    else if (ch === '\\') {
+                        // "" — skip
+                    }
+                    else {
+                        curLine++;
+                    }
+                    i++;
+                }
+            }
+            if (added.length > 0)
+                out.push({ file, addedLines: added });
+        }
+        else {
+            i++;
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=lint-unsourced.js.map

package/dist/knowledge-freshness/gates/lint-unsourced.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lint-unsourced.js","sourceRoot":"","sources":["../../../src/knowledge-freshness/gates/lint-unsourced.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE7C,wEAAwE;AACxE,MAAM,YAAY,GAAG,iCAAiC,CAAA;AAEtD,MAAM,UAAU,GAAG,CAAC,CAAA;AA0BpB;;;;GAIG;AACH,SAAS,aAAa,CAAC,OAAe;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAA;QAC7B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACpC,IAAI,CAAC;gBAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,GAAG,EAAE,CAAA;IAClB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,IAAY,EAAE,OAAoB;IAC3D,yEAAyE;IACzE,yDAAyD;IACzD,MAAM,EAAE,GAAG,qCAAqC,CAAA;IAChD,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;YAChC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAA;YAC/B,qEAAqE;YACrE,qDAAqD;YACrD,KAAK,MAAM,CAAC,IAAI,OAAO;gBAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC;oBAAE,OAAO,IAAI,CAAA;QAC/D,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAmB;IACrD,MAAM,QAAQ,GAAkB,EAAE,CAAA;IAClC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,SAAQ;QAC3C,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC5C,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC3C,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAQ;YAC5C,oEAAoE;YACpE,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,GAAG,UAAU,CAAC,CAAA;YACnD,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,GAAG,UAAU,CAAC,CAAA;YACtE,IAAI,KAAK,GAAG,KAAK,CAAA;YACjB,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC9B,IAAI,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC;oBAAC,KAAK,GAAG,IAAI,CAAC;oBAAC,MAAK;gBAAC,CAAC;YAC7E,CAAC;YACD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;oBACvB,MAAM,EAAE,OAAO,CAAC,IAAI,KAAK,CAAC;wBACxB,CAAC,CAAC,qDAAqD;wBACvD,CAAC,CAAC,uCAAuC,UAAU,QAAQ;iBAC9D,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAYD,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,GAAG,GAAsB,EAAE,CAAA;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC9B,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACrB,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACnC,wEAAwE;YACxE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAA;YACpD,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YAC1B,CAAC,EAAE,CAAA;YACH,0DAA0D;YAC1D,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC;gBAAE,CAAC,EAAE,CAAA;YACjG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,SAAQ;YAC7E,MAAM,KAAK,GAA0C,EAAE,CAAA;YACvD,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC/D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAA;gBACpE,IAAI,CAAC,IAAI,EAAE,CAAC;oBAAC,CAAC,EAAE,CAAC;oBAAC,SAAQ;gBAAC,CAAC;gBAC5B,IAAI,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;gBAC7B,CAAC,EAAE,CAAA;gBACH,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;oBAC7F,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;oBAC7B,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC9C,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;wBACtD,OAAO,EAAE,CAAA;oBACX,CAAC;yBAAM,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;wBACrD,mDAAmD;oBACrD,CAAC;yBAAM,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;wBACvB,uCAAuC;oBACzC,CAAC;yBAAM,CAAC;wBACN,OAAO,EAAE,CAAA;oBACX,CAAC;oBACD,CAAC,EAAE,CAAA;gBACL,CAAC;YACH,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;QAC7D,CAAC;aAAM,CAAC;YACN,CAAC,EAAE,CAAA;QACL,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/knowledge-freshness/gates/lint-unsourced.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=lint-unsourced.test.d.ts.map

package/dist/knowledge-freshness/gates/lint-unsourced.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lint-unsourced.test.d.ts","sourceRoot":"","sources":["../../../src/knowledge-freshness/gates/lint-unsourced.test.ts"],"names":[],"mappings":""}

package/dist/knowledge-freshness/gates/lint-unsourced.test.js

@@ -0,0 +1,68 @@
+import { describe, it, expect } from 'vitest';
+import { lintUnsourcedClaims, parseUnifiedDiff } from './lint-unsourced.js';
+const fmWithSource = [
+    '---',
+    'name: x',
+    'sources:',
+    '  - url: https://owasp.org/Top10/',
+    '---',
+].join('\n');
+describe('lintUnsourcedClaims', () => {
+    it('flags normative claims with no nearby source link', () => {
+        const content = `${fmWithSource}\n## Body\nYou must use bcrypt cost 12.\n`;
+        const findings = lintUnsourcedClaims([
+            { file: 'x.md', content, addedLines: [{ line: 7, text: 'You must use bcrypt cost 12.' }] },
+        ]);
+        expect(findings).toHaveLength(1);
+        expect(findings[0].reason).toMatch(/no link/);
+    });
+    it('does not flag claims with a nearby source link', () => {
+        const content = `${fmWithSource}
+## Body
+You must use bcrypt cost 12.
+See [OWASP](https://owasp.org/Top10/).
+`;
+        const findings = lintUnsourcedClaims([
+            { file: 'x.md', content, addedLines: [{ line: 7, text: 'You must use bcrypt cost 12.' }] },
+        ]);
+        expect(findings).toHaveLength(0);
+    });
+    it('does not flag non-normative additions', () => {
+        const content = `${fmWithSource}\n## Body\nThis section covers passwords.\n`;
+        const findings = lintUnsourcedClaims([
+            { file: 'x.md', content, addedLines: [{ line: 7, text: 'This section covers passwords.' }] },
+        ]);
+        expect(findings).toHaveLength(0);
+    });
+});
+describe('parseUnifiedDiff', () => {
+    it('extracts added lines from a unified diff for knowledge files', () => {
+        const diff = [
+            'diff --git a/content/knowledge/x/y.md b/content/knowledge/x/y.md',
+            'index abc..def 100644',
+            '--- a/content/knowledge/x/y.md',
+            '+++ b/content/knowledge/x/y.md',
+            '@@ -1,3 +1,4 @@',
+            ' line one',
+            '+new line two',
+            ' line three',
+            '+new line four',
+        ].join('\n');
+        const out = parseUnifiedDiff(diff);
+        expect(out).toHaveLength(1);
+        expect(out[0].file).toBe('content/knowledge/x/y.md');
+        expect(out[0].addedLines.map((l) => l.text)).toEqual(['new line two', 'new line four']);
+    });
+    it('ignores non-knowledge files', () => {
+        const diff = [
+            'diff --git a/src/foo.ts b/src/foo.ts',
+            '--- a/src/foo.ts',
+            '+++ b/src/foo.ts',
+            '@@ -1,1 +1,2 @@',
+            ' x',
+            '+y',
+        ].join('\n');
+        expect(parseUnifiedDiff(diff)).toEqual([]);
+    });
+});
+//# sourceMappingURL=lint-unsourced.test.js.map

package/dist/knowledge-freshness/gates/lint-unsourced.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lint-unsourced.test.js","sourceRoot":"","sources":["../../../src/knowledge-freshness/gates/lint-unsourced.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAE3E,MAAM,YAAY,GAAG;IACnB,KAAK;IACL,SAAS;IACT,UAAU;IACV,mCAAmC;IACnC,KAAK;CACN,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAEZ,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,OAAO,GAAG,GAAG,YAAY,2CAA2C,CAAA;QAC1E,MAAM,QAAQ,GAAG,mBAAmB,CAAC;YACnC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAC,EAAE;SAC3F,CAAC,CAAA;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QAChC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,OAAO,GAAG,GAAG,YAAY;;;;CAIlC,CAAA;QACG,MAAM,QAAQ,GAAG,mBAAmB,CAAC;YACnC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAC,EAAE;SAC3F,CAAC,CAAA;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,OAAO,GAAG,GAAG,YAAY,6CAA6C,CAAA;QAC5E,MAAM,QAAQ,GAAG,mBAAmB,CAAC;YACnC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAAC,EAAE;SAC7F,CAAC,CAAA;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,IAAI,GAAG;YACX,kEAAkE;YAClE,uBAAuB;YACvB,gCAAgC;YAChC,gCAAgC;YAChC,iBAAiB;YACjB,WAAW;YACX,eAAe;YACf,aAAa;YACb,gBAAgB;SACjB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACZ,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAA;QAClC,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QAC3B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAA;QACpD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC,CAAA;IACzF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,IAAI,GAAG;YACX,sCAAsC;YACtC,kBAAkB;YAClB,kBAAkB;YAClB,iBAAiB;YACjB,IAAI;YACJ,IAAI;SACL,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACZ,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/knowledge-freshness/gates/parse-entry.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Minimal frontmatter shape used by the freshness CI gates. We keep this
+ * deliberately narrow rather than reusing `KnowledgeEntry` from
+ * `src/types/index.ts` because the gates operate on raw `.md` files in a PR
+ * checkout (no project resolver, no overrides) and need to be tolerant of
+ * partially-populated frontmatter from in-progress drafts.
+ */
+export interface ParsedFreshnessEntry {
+    /** Raw frontmatter object (yaml.JSON_SCHEMA — ISO dates stay strings). */
+    frontmatter: Record<string, unknown>;
+    /** Markdown body (everything after the closing `---`). */
+    body: string;
+    /** Convenience accessor: declared `sources[].url` values (empty array if none). */
+    sourceUrls: string[];
+    /** Convenience accessor: declared `volatility` value (or null). */
+    volatility: 'stable' | 'evolving' | 'fast-moving' | null;
+}
+/**
+ * Parse a freshness-relevant entry. Throws only on unrecoverable shape errors
+ * (no frontmatter at all, unclosed `---`); a missing or non-array `sources`
+ * surfaces as an empty `sourceUrls` so gate callers can decide whether to
+ * treat that as a hard fail (link-check) or a noop (over-rewrite).
+ */
+export declare function parseEntry(raw: string): ParsedFreshnessEntry;
+//# sourceMappingURL=parse-entry.d.ts.map

package/dist/knowledge-freshness/gates/parse-entry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-entry.d.ts","sourceRoot":"","sources":["../../../src/knowledge-freshness/gates/parse-entry.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACpC,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAA;IACZ,mFAAmF;IACnF,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,mEAAmE;IACnE,UAAU,EAAE,QAAQ,GAAG,UAAU,GAAG,aAAa,GAAG,IAAI,CAAA;CACzD;AAID;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,oBAAoB,CAiC5D"}

package/dist/knowledge-freshness/gates/parse-entry.js

@@ -0,0 +1,41 @@
+import yaml from 'js-yaml';
+const VOLATILITIES = new Set(['stable', 'evolving', 'fast-moving']);
+/**
+ * Parse a freshness-relevant entry. Throws only on unrecoverable shape errors
+ * (no frontmatter at all, unclosed `---`); a missing or non-array `sources`
+ * surfaces as an empty `sourceUrls` so gate callers can decide whether to
+ * treat that as a hard fail (link-check) or a noop (over-rewrite).
+ */
+export function parseEntry(raw) {
+    // Round-6 F-001: strip optional UTF-8 BOM (U+FEFF) so files authored on
+    // Windows or with a BOM don't crash gate processing. lines[0].trim() would
+    // see the BOM glyph in front of `---` and fail the equality check.
+    const BOM = '';
+    const normalized = raw.startsWith(BOM) ? raw.slice(BOM.length) : raw;
+    const lines = normalized.split(/\r?\n/);
+    if (lines[0]?.trim() !== '---') {
+        throw new Error('entry has no frontmatter');
+    }
+    let close = -1;
+    for (let i = 1; i < lines.length; i++) {
+        if (lines[i].trim() === '---') {
+            close = i;
+            break;
+        }
+    }
+    if (close === -1)
+        throw new Error('frontmatter unclosed');
+    const fm = yaml.load(lines.slice(1, close).join('\n'), { schema: yaml.JSON_SCHEMA });
+    const fmObj = fm && typeof fm === 'object' ? fm : {};
+    const body = lines.slice(close + 1).join('\n');
+    const sources = Array.isArray(fmObj['sources']) ? fmObj['sources'] : [];
+    const sourceUrls = sources
+        .map((s) => (s && typeof s === 'object' && 'url' in s ? s.url : undefined))
+        .filter((u) => typeof u === 'string' && u.length > 0);
+    const volRaw = fmObj['volatility'];
+    const volatility = typeof volRaw === 'string' && VOLATILITIES.has(volRaw)
+        ? volRaw
+        : null;
+    return { frontmatter: fmObj, body, sourceUrls, volatility };
+}
+//# sourceMappingURL=parse-entry.js.map

package/dist/knowledge-freshness/gates/parse-entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-entry.js","sourceRoot":"","sources":["../../../src/knowledge-freshness/gates/parse-entry.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,SAAS,CAAA;AAoB1B,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC,CAAA;AAEnE;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,wEAAwE;IACxE,2EAA2E;IAC3E,mEAAmE;IACnE,MAAM,GAAG,GAAG,GAAG,CAAA;IACf,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;IACpE,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACvC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;IAC7C,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,CAAC,CAAA;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;YAAC,KAAK,GAAG,CAAC,CAAC;YAAC,MAAK;QAAC,CAAC;IACrD,CAAC;IACD,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;IAEzD,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,CACnD,CAAA;IAChC,MAAM,KAAK,GAAG,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAEpD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAE9C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAc,CAAC,CAAC,CAAC,EAAE,CAAA;IACpF,MAAM,UAAU,GAAG,OAAO;SACvB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAE,CAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;SACjG,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAEpE,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,CAAC,CAAA;IAClC,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,QAAQ,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;QACvE,CAAC,CAAE,MAA6C;QAChD,CAAC,CAAC,IAAI,CAAA;IAER,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,CAAA;AAC7D,CAAC"}

package/dist/knowledge-freshness/gates/parse-entry.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=parse-entry.test.d.ts.map

package/dist/knowledge-freshness/gates/parse-entry.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-entry.test.d.ts","sourceRoot":"","sources":["../../../src/knowledge-freshness/gates/parse-entry.test.ts"],"names":[],"mappings":""}

package/dist/knowledge-freshness/gates/parse-entry.test.js

@@ -0,0 +1,34 @@
+import { describe, it, expect } from 'vitest';
+import { parseEntry } from './parse-entry.js';
+describe('parseEntry', () => {
+    it('extracts frontmatter, body, sources, and volatility', () => {
+        const raw = [
+            '---',
+            'name: x',
+            'volatility: stable',
+            'sources:',
+            '  - url: https://example.com/a',
+            '  - url: https://example.com/b',
+            '---',
+            '',
+            '## Summary',
+            'hello',
+        ].join('\n');
+        const parsed = parseEntry(raw);
+        expect(parsed.sourceUrls).toEqual(['https://example.com/a', 'https://example.com/b']);
+        expect(parsed.volatility).toBe('stable');
+        expect(parsed.body).toContain('## Summary');
+    });
+    it('returns null volatility for unknown values', () => {
+        const raw = '---\nname: x\nvolatility: glacial\n---\nbody';
+        expect(parseEntry(raw).volatility).toBeNull();
+    });
+    it('returns empty sourceUrls when sources key is missing', () => {
+        const raw = '---\nname: x\n---\nbody';
+        expect(parseEntry(raw).sourceUrls).toEqual([]);
+    });
+    it('throws on missing frontmatter', () => {
+        expect(() => parseEntry('no fm here')).toThrow(/frontmatter/);
+    });
+});
+//# sourceMappingURL=parse-entry.test.js.map

package/dist/knowledge-freshness/gates/parse-entry.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-entry.test.js","sourceRoot":"","sources":["../../../src/knowledge-freshness/gates/parse-entry.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE7C,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,GAAG,GAAG;YACV,KAAK;YACL,SAAS;YACT,oBAAoB;YACpB,UAAU;YACV,gCAAgC;YAChC,gCAAgC;YAChC,KAAK;YACL,EAAE;YACF,YAAY;YACZ,OAAO;SACR,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACZ,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;QAC9B,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,uBAAuB,EAAE,uBAAuB,CAAC,CAAC,CAAA;QACrF,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACxC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,GAAG,GAAG,8CAA8C,CAAA;QAC1D,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,GAAG,GAAG,yBAAyB,CAAA;QACrC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/knowledge-freshness/providers/anthropic.d.ts

@@ -0,0 +1,33 @@
+import { dispatchLlm } from '../../observability/engine/llm-dispatcher.js';
+import type { Dispatcher } from '../audit-runner.js';
+/**
+ * SECURITY: the dispatcher command is hardcoded to `claude -p --tools ""`,
+ * never loaded from project-local config. The parent knowledge-freshness
+ * design's decision #7 locked this in: a repo-local CLAUDE.md must NOT be
+ * able to inject `command: rm -rf /` into the subprocess invocation.
+ *
+ * The `--tools ""` flag disables every built-in tool. The audit prompt
+ * reads pre-fetched source bodies (round-6 F-001), so the model never
+ * needs WebFetch or any other tool.
+ *
+ * Earlier rounds experimented with `--bare`, which broke keychain auth
+ * for local devs. Reverted in Phase 1 Task 9 because the audit subcommand only
+ * operates on scaffold's own content/knowledge/, never on a downstream
+ * repo — so the round-7 isolation rationale doesn't apply.
+ */
+export declare const ANTHROPIC_COMMAND = "claude -p --tools \"\"";
+/**
+ * Injectable dispatch function. Production uses the real `dispatchLlm`;
+ * tests inject a mock. Typed via `typeof dispatchLlm` so the signature
+ * stays in lock-step with the production function — no `as` cast
+ * needed at the call site, and any future change to `DispatchResult`
+ * surfaces as a type error here instead of a runtime surprise.
+ */
+export type DispatchLlmFn = typeof dispatchLlm;
+export interface BuildAnthropicDispatcherOptions {
+    timeoutSec: number;
+    /** Injectable for tests. Defaults to the real `dispatchLlm`. */
+    dispatchLlmFn?: DispatchLlmFn;
+}
+export declare function buildAnthropicDispatcher(opts: BuildAnthropicDispatcherOptions): Dispatcher;
+//# sourceMappingURL=anthropic.d.ts.map

package/dist/knowledge-freshness/providers/anthropic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"anthropic.d.ts","sourceRoot":"","sources":["../../../src/knowledge-freshness/providers/anthropic.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,8CAA8C,CAAA;AAC1E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAEpD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,iBAAiB,2BAAyB,CAAA;AAEvD;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,WAAW,CAAA;AAE9C,MAAM,WAAW,+BAA+B;IAC9C,UAAU,EAAE,MAAM,CAAA;IAClB,gEAAgE;IAChE,aAAa,CAAC,EAAE,aAAa,CAAA;CAC9B;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,+BAA+B,GAAG,UAAU,CAiB1F"}

package/dist/knowledge-freshness/providers/anthropic.js

@@ -0,0 +1,36 @@
+import { dispatchLlm } from '../../observability/engine/llm-dispatcher.js';
+/**
+ * SECURITY: the dispatcher command is hardcoded to `claude -p --tools ""`,
+ * never loaded from project-local config. The parent knowledge-freshness
+ * design's decision #7 locked this in: a repo-local CLAUDE.md must NOT be
+ * able to inject `command: rm -rf /` into the subprocess invocation.
+ *
+ * The `--tools ""` flag disables every built-in tool. The audit prompt
+ * reads pre-fetched source bodies (round-6 F-001), so the model never
+ * needs WebFetch or any other tool.
+ *
+ * Earlier rounds experimented with `--bare`, which broke keychain auth
+ * for local devs. Reverted in Phase 1 Task 9 because the audit subcommand only
+ * operates on scaffold's own content/knowledge/, never on a downstream
+ * repo — so the round-7 isolation rationale doesn't apply.
+ */
+export const ANTHROPIC_COMMAND = 'claude -p --tools ""';
+export function buildAnthropicDispatcher(opts) {
+    const dispatch = opts.dispatchLlmFn ?? dispatchLlm;
+    const timeoutMs = opts.timeoutSec * 1000;
+    return async (prompt) => {
+        const result = await dispatch({ prompt, command: ANTHROPIC_COMMAND, timeoutMs });
+        if (!result.ok) {
+            // Use the `anthropic dispatcher: …` prefix for consistency with
+            // `deepseek dispatcher: …` — operators can filter cron logs by a
+            // single `dispatcher:` substring across both providers
+            // (PR #393 MMR F-003).
+            throw new Error(`anthropic dispatcher: ${result.reason}`);
+        }
+        // Return raw stdout. The audit runner's schema-aware extractor walks
+        // the full response; the dispatcher's last-→-first parser is the
+        // wrong shape for our use case (see audit-runner.ts findFirstMatchingJson).
+        return result.raw;
+    };
+}
+//# sourceMappingURL=anthropic.js.map

package/dist/knowledge-freshness/providers/anthropic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anthropic.js","sourceRoot":"","sources":["../../../src/knowledge-freshness/providers/anthropic.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,8CAA8C,CAAA;AAG1E;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,sBAAsB,CAAA;AAiBvD,MAAM,UAAU,wBAAwB,CAAC,IAAqC;IAC5E,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,IAAI,WAAW,CAAA;IAClD,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAA;IACxC,OAAO,KAAK,EAAE,MAAM,EAAE,EAAE;QACtB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,gEAAgE;YAChE,iEAAiE;YACjE,uDAAuD;YACvD,uBAAuB;YACvB,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;QAC3D,CAAC;QACD,qEAAqE;QACrE,iEAAiE;QACjE,4EAA4E;QAC5E,OAAO,MAAM,CAAC,GAAG,CAAA;IACnB,CAAC,CAAA;AACH,CAAC"}

package/dist/knowledge-freshness/providers/anthropic.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=anthropic.test.d.ts.map

package/dist/knowledge-freshness/providers/anthropic.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"anthropic.test.d.ts","sourceRoot":"","sources":["../../../src/knowledge-freshness/providers/anthropic.test.ts"],"names":[],"mappings":""}

package/dist/knowledge-freshness/providers/anthropic.test.js

@@ -0,0 +1,32 @@
+import { describe, it, expect, vi } from 'vitest';
+import { ANTHROPIC_COMMAND, buildAnthropicDispatcher } from './anthropic.js';
+describe('anthropic provider', () => {
+    it('exports the exact hardcoded command (decision #7 invariant)', () => {
+        // The command MUST be literal — never read from project config — so the
+        // threat model from the parent design's decision #7 holds. This test
+        // acts as a tripwire if a future contributor introduces a templated
+        // command string.
+        expect(ANTHROPIC_COMMAND).toBe('claude -p --tools ""');
+    });
+    it('builds a Dispatcher that calls dispatchLlm with the hardcoded command + timeout', async () => {
+        // We can't run a real subprocess in unit tests; we mock dispatchLlm at
+        // the module level. The mock returns the full DispatchResult shape
+        // (`parsed: unknown` on success, `raw?: string` on failure) so the
+        // production typeof-derived DispatchLlmFn signature is satisfied.
+        const dispatchSpy = vi.fn().mockResolvedValue({ ok: true, raw: 'verdict json here', parsed: undefined });
+        const dispatcher = buildAnthropicDispatcher({ timeoutSec: 600, dispatchLlmFn: dispatchSpy });
+        const result = await dispatcher('hello world');
+        expect(dispatchSpy).toHaveBeenCalledWith({
+            prompt: 'hello world',
+            command: 'claude -p --tools ""',
+            timeoutMs: 600_000,
+        });
+        expect(result).toBe('verdict json here');
+    });
+    it('throws with the dispatcher reason verbatim when dispatchLlm fails', async () => {
+        const dispatchSpy = vi.fn().mockResolvedValue({ ok: false, reason: 'subprocess exit 127' });
+        const dispatcher = buildAnthropicDispatcher({ timeoutSec: 60, dispatchLlmFn: dispatchSpy });
+        await expect(dispatcher('x')).rejects.toThrow(/subprocess exit 127/);
+    });
+});
+//# sourceMappingURL=anthropic.test.js.map

package/dist/knowledge-freshness/providers/anthropic.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anthropic.test.js","sourceRoot":"","sources":["../../../src/knowledge-freshness/providers/anthropic.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AACjD,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAA;AAE5E,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,wEAAwE;QACxE,qEAAqE;QACrE,oEAAoE;QACpE,kBAAkB;QAClB,MAAM,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;IACxD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,uEAAuE;QACvE,mEAAmE;QACnE,mEAAmE;QACnE,kEAAkE;QAClE,MAAM,WAAW,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,mBAAmB,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAA;QACxG,MAAM,UAAU,GAAG,wBAAwB,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,CAAA;QAC5F,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,aAAa,CAAC,CAAA;QAC9C,MAAM,CAAC,WAAW,CAAC,CAAC,oBAAoB,CAAC;YACvC,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,sBAAsB;YAC/B,SAAS,EAAE,OAAO;SACnB,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;IAC1C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,WAAW,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAA;QAC3F,MAAM,UAAU,GAAG,wBAAwB,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,CAAA;QAC3F,MAAM,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACtE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/knowledge-freshness/providers/deepseek.d.ts

@@ -0,0 +1,33 @@
+import { fetch as undiciFetch } from 'undici';
+import type { Dispatcher } from '../audit-runner.js';
+/**
+ * SECURITY: like decision #7's anthropic-subprocess invariant, the
+ * DeepSeek URL and the model-name allowlist are HARDCODED. Project-local
+ * config can never redirect this dispatcher at a different host or run
+ * an unsupported model. Future contributors who feel tempted to read a
+ * URL from `.scaffold/observability.yaml` here should re-read the parent
+ * design doc's Resolved Decisions table first.
+ */
+export declare const DEEPSEEK_URL = "https://api.deepseek.com/chat/completions";
+/**
+ * Hardcoded allowlist of DeepSeek model names. KNOWLEDGE_FRESHNESS_DEEPSEEK_MODEL
+ * may override the default, but only to a value in this set — never to
+ * arbitrary text. The previously-supported `deepseek-chat` and
+ * `deepseek-reasoner` IDs are deprecated and intentionally excluded.
+ */
+declare const ALLOWED_MODELS: readonly ["deepseek-v4-flash", "deepseek-v4-pro"];
+export type DeepseekModel = typeof ALLOWED_MODELS[number];
+export declare const DEFAULT_DEEPSEEK_MODEL: DeepseekModel;
+/** Test-injectable fetch. Production uses undici's fetch. */
+export type DeepseekFetch = typeof undiciFetch;
+export interface BuildDeepseekDispatcherOptions {
+    apiKey: string;
+    timeoutSec: number;
+    /** Optional model override (must be in the allowlist). */
+    model?: string;
+    /** Test-injectable fetch implementation. Default: undici's fetch. */
+    fetchImpl?: DeepseekFetch;
+}
+export declare function buildDeepseekDispatcher(opts: BuildDeepseekDispatcherOptions): Dispatcher;
+export {};
+//# sourceMappingURL=deepseek.d.ts.map

package/dist/knowledge-freshness/providers/deepseek.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deepseek.d.ts","sourceRoot":"","sources":["../../../src/knowledge-freshness/providers/deepseek.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,IAAI,WAAW,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAEpD;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,8CAA8C,CAAA;AAEvE;;;;;GAKG;AACH,QAAA,MAAM,cAAc,mDAAoD,CAAA;AACxE,MAAM,MAAM,aAAa,GAAG,OAAO,cAAc,CAAC,MAAM,CAAC,CAAA;AACzD,eAAO,MAAM,sBAAsB,EAAE,aAAmC,CAAA;AAiBxE,6DAA6D;AAC7D,MAAM,MAAM,aAAa,GAAG,OAAO,WAAW,CAAA;AAE9C,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,qEAAqE;IACrE,SAAS,CAAC,EAAE,aAAa,CAAA;CAC1B;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,8BAA8B,GAAG,UAAU,CA2GxF"}