arkgate 4.8.23 → 4.8.24

package/bin/lib/start-install-recovery.mjs

@@ -5,7 +5,10 @@
  * pin-aware npx, and AgeExclude-must-be-in-config stay behind this module.
  */
 import { spawnSync } from 'node:child_process';
-import { arkPackageRecoveryCommand } from './package-manager.mjs';
+import fs from 'node:fs';
+import path from 'node:path';
+import { pinArkgateDevDependency } from './field-install.mjs';
+import { arkPackageRecoveryCommand, packageInstallArgv } from './package-manager.mjs';
 
 const AGE_MARK = /ERR_PNPM_NO_MATURE_MATCHING_VERSION|minimumReleaseAge/i;
 const AGE_EXCLUDE_LINE =
@@ -154,3 +157,70 @@ export function runStartPackageInstall(command, commandArgs, cwd) {
     stderr: result.stderr ?? '',
   };
 }
+
+// Setup-time arkgate pin shared by `ark start` and `ark init` (kept out of bin/ark.mjs).
+/**
+ * Pin arkgate in package.json (and optionally run the package manager).
+ * start calls this so CI/`npx` is not forced to rely on a stale global install.
+ *
+ * @param {string} root
+ * @param {{ install?: boolean, runPackageManager?: boolean }} [opts]
+ */
+export function ensureProjectArkgateDependency(root, opts = {}) {
+  const install = opts.install !== false;
+  const runPm = opts.runPackageManager === true;
+  if (!install) {
+    return { pinned: { changed: false, reason: 'skipped-no-install' }, installStatus: null };
+  }
+  const pinned = pinArkgateDevDependency(root);
+  let installStatus = null;
+  let hostOutput = '';
+  // Only run the package manager after a successful pin change — avoid surprise
+  // network on every start when arkgate is already listed.
+  if (runPm && pinned.changed) {
+    const [command, commandArgs] = packageInstallArgv(root, pinned.version);
+    const install = runStartPackageInstall(command, commandArgs, root);
+    installStatus = install.status;
+    hostOutput = `${install.stdout}\n${install.stderr}`;
+  }
+  return { pinned, installStatus, hostOutput };
+}
+
+/**
+ * Setup-time pin shared by `ark start` and `ark init`. With the pin, generated CI and host
+ * hooks call the local `ark-check` / `arkgate-mcp` bins through the project runner. Without
+ * it they run `npx -y -p arkgate@<this exact version> <bin>`, because a bare `npx ark-check`
+ * asks npm for a package named `ark-check` (404) or runs a stale global.
+ */
+export function pinArkgateForSetup(root, args, cliVersion) {
+  if (!args.install) {
+    console.log('  Skipping arkgate package pin (--no-install).');
+    return;
+  }
+  if (!fs.existsSync(path.join(root, 'package.json'))) {
+    console.log(
+      `  Warning: no package.json — the generated CI workflow and host hooks run npx -y -p arkgate@${cliVersion()} (downloaded on each run). To run a local install instead, create package.json, add arkgate@^${cliVersion()} to devDependencies, then re-run setup.`
+    );
+    return;
+  }
+  const { pinned, installStatus, hostOutput } = ensureProjectArkgateDependency(root, {
+    install: true,
+    runPackageManager: !args.skipPackageManager,
+  });
+  if (pinned.changed) {
+    console.log(`  Pinned arkgate@${pinned.version} in package.json devDependencies.`);
+    if (installStatus !== null && installStatus !== 0) {
+      const [command, commandArgs] = packageInstallArgv(root, pinned.version);
+      console.error(
+        formatStartPackageInstallFailure({
+          exitStatus: installStatus,
+          installCommand: `${command} ${commandArgs.join(' ')}`,
+          hostOutput,
+          packageVersion: cliVersion(),
+        })
+      );
+    }
+  } else if (pinned.reason === 'already-present') {
+    console.log(`  arkgate already in package.json (${pinned.version}).`);
+  }
+}

package/bin/lib/start-preview.mjs

@@ -20,6 +20,9 @@ import {
   grokHooks,
   grokProjectConfig,
   opencodeProjectConfig,
+  removeAntigravityArkHook,
+  removeClaudeStyleArkHooks,
+  removeCursorArkHook,
 } from './hook-templates.mjs';
 import { codexPrimaryTable, codexProjectMcpIsValid } from './codex-home.mjs';
 import { codexRuntimeActivation } from './enforcement-state.mjs';
@@ -56,6 +59,17 @@ const COMPACT_HOST_TEMPLATES = {
   gemini: (root) => [['GEMINI.md', instructionRule(root)]],
 };
 
+/**
+ * Host hook files the installer merges into (keeping user keys). Removal drops only the
+ * Ark-owned entries, with the same identity as the merge helper.
+ */
+const MERGED_HOOK_FILE_REMOVERS = {
+  '.claude/settings.json': removeClaudeStyleArkHooks,
+  '.codex/hooks.json': removeClaudeStyleArkHooks,
+  '.cursor/hooks.json': removeCursorArkHook,
+  '.agents/hooks.json': removeAntigravityArkHook,
+};
+
 function treeFiles(root) {
   const files = new Map();
   const visit = (dir) => {
@@ -334,6 +348,22 @@ function planHostRemoval(args, helpers) {
       changes.push(change(relativePath, before, after));
       continue;
     }
+    const remover = MERGED_HOOK_FILE_REMOVERS[relativePath];
+    if (remover && before.toString('utf8') !== expected) {
+      const removal = remover(before.toString('utf8'), expected);
+      if (removal.status === 'removed') {
+        changes.push(
+          change(relativePath, before, removal.text == null ? null : Buffer.from(removal.text))
+        );
+      } else if (removal.status === 'customized') {
+        unresolvedDecisions.push(
+          `${relativePath}: the Ark hook entry was customized and was left untouched.`
+        );
+      } else if (removal.status === 'unreadable') {
+        unresolvedDecisions.push(`${relativePath} is not readable JSON and was left untouched.`);
+      }
+      continue;
+    }
     if (before.toString('utf8') !== expected) {
       unresolvedDecisions.push(`${relativePath} was customized and was left untouched.`);
       continue;

package/bin/lib/status-command.mjs

@@ -17,6 +17,7 @@ import {
   unavailableStatusImprovementCompass,
 } from './status-manifest.mjs';
 import { createProjectId } from './project-identity.mjs';
+import { parseArkConfigJson } from './config-contract.mjs';
 import { resolveEffectiveProjectRoot } from './project-root.mjs';
 import { detectWritePathCapabilities } from './write-path-detect.mjs';
 import { buildWritePathHonesty } from './enforcement-honesty.mjs';
@@ -158,7 +159,7 @@ export function statusCompassFromSnapshot(latest, opts = {}) {
     return unavailableStatusImprovementCompass({
       reasonCode: 'NO_SESSION_SNAPSHOT',
       reason:
-        'No session report snapshot yet — run ark-check --doctor or --report for residual lenses. Status never invents green.',
+        'No session report snapshot yet — run ark-check --report to write the session snapshot (--doctor shows full lenses but does not write it). Status never invents green.',
       contractHash,
     });
   }
@@ -189,7 +190,7 @@ export function statusCompassFromSnapshot(latest, opts = {}) {
       reasonCode: complete ? undefined : 'FACTS_PARTIAL',
       reason: complete
         ? undefined
-        : 'Session snapshot residual is partial — re-run doctor/report for full compass.',
+        : 'Session snapshot residual is partial — re-run ark-check --report for full compass.',
       factsSource: 'report-snapshot',
       contractHash,
     });
@@ -198,7 +199,7 @@ export function statusCompassFromSnapshot(latest, opts = {}) {
   return unavailableStatusImprovementCompass({
     reasonCode: 'NO_SESSION_SNAPSHOT',
     reason:
-      'Session snapshot has no improvement compass facts — run ark-check --doctor or --report. Status never invents green.',
+      'Session snapshot has no improvement compass facts — run ark-check --report to refresh the session snapshot. Status never invents green.',
     contractHash,
   });
 }
@@ -242,6 +243,24 @@ export function thinStatusCompassFromDoctor(doctorCompass, opts = {}) {
  *   contractHash?: string | null,
  * }} [options]
  */
+/**
+ * Run the shared contract validator (same rules as ark-check / MCP / ESLint).
+ * @param {string} text
+ * @param {string} source
+ * @returns {string[]} `<path>: <message>` lines; empty when valid
+ */
+function validateConfigText(text, source) {
+  try {
+    parseArkConfigJson(text, source);
+    return [];
+  } catch (error) {
+    if (Array.isArray(error?.issues) && error.issues.length > 0) {
+      return error.issues.map((issue) => `${issue.path}: ${issue.message}`);
+    }
+    return [error instanceof Error ? error.message : String(error)];
+  }
+}
+
 export function collectStatusFacts(options = {}) {
   const startRoot = path.resolve(options.root || process.cwd());
   const configName = options.config || 'ark.config.json';
@@ -256,12 +275,17 @@ export function collectStatusFacts(options = {}) {
   const configExists = fs.existsSync(configPath);
 
   let config = null;
+  /** Shared contract validator messages — status must not look authoritative-green on a config every gate refuses. */
+  let configErrors = [];
   if (configExists) {
+    let text = '';
     try {
-      config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+      text = fs.readFileSync(configPath, 'utf8');
+      config = JSON.parse(text);
     } catch {
       config = null;
     }
+    configErrors = validateConfigText(text, path.basename(configPath));
   }
 
   const projectId = configExists
@@ -390,6 +414,7 @@ export function collectStatusFacts(options = {}) {
     arkgateVersion: options.arkgateVersion || packageVersion(),
     resolvedRoot: realpathOrResolve(resolvedRoot),
     resolvedConfigPath: configExists ? realpathOrResolve(configPath) : null,
+    configErrors,
     projectId,
     expectation,
     expectedRootRelation,
@@ -564,6 +589,10 @@ export function runStatusCommand(args = {}) {
             ' · not a score'
         );
       }
+      if (manifest.contract?.valid === false) {
+        write(`  contract: invalid (${manifest.contract.errors.length} issue(s)) — every enforcing surface refuses this config`);
+        for (const issue of manifest.contract.errors.slice(0, 5)) write(`    - ${issue}`);
+      }
       write(`  next: [${manifest.nextAction.id}] ${manifest.nextAction.summary}`);
     }
 

package/bin/lib/status-manifest.mjs

@@ -175,6 +175,11 @@ export function defaultHonestLabel(writePath, host) {
  * Deterministic next action from residual facts (no LLM).
  * Prefer explicit override from productHonesty when provided.
  */
+function normalizedConfigErrors(errors) {
+    if (!Array.isArray(errors))
+        return [];
+    return errors.filter((entry) => typeof entry === 'string' && entry.length > 0);
+}
 export function resolveStatusNextAction(facts, binding, activation, lastCheck, rules) {
     if (facts.nextActionOverride?.id && facts.nextActionOverride.summary) {
         return {
@@ -202,22 +207,31 @@ export function resolveStatusNextAction(facts, binding, activation, lastCheck, r
             summary: 'No ark.config.json found — run ark start (preview) then ark start --apply.',
         };
     }
+    const configErrors = normalizedConfigErrors(facts.configErrors);
+    if (configErrors.length > 0) {
+        return {
+            id: 'fix-config',
+            summary: `The Ark config is invalid, so ark-check, MCP and ESLint refuse it — fix: ${configErrors
+                .slice(0, 3)
+                .join('; ')}${configErrors.length > 3 ? ` (+${configErrors.length - 3} more)` : ''}`,
+        };
+    }
     if (lastCheck.verdict === 'fail' || (lastCheck.activeViolations ?? 0) > 0) {
         return {
             id: 'fix-active-violations',
-            summary: `Clear ${lastCheck.activeViolations ?? 'active'} blocking architecture finding(s), then re-run ark-check (or ark-check --doctor).`,
+            summary: `Clear ${lastCheck.activeViolations ?? 'active'} blocking architecture finding(s), then re-run ark-check --report to refresh the last-check snapshot (a plain check or --doctor does not update .ark/reports/latest.json).`,
         };
     }
     if (lastCheck.verdict === 'incomplete') {
         return {
             id: 'restore-complete-analysis',
-            summary: 'Last check was incomplete — restore TypeScript/analysis inputs and re-run ark-check.',
+            summary: 'Last check was incomplete — restore TypeScript/analysis inputs and re-run ark-check --report to refresh the snapshot.',
         };
     }
     if (lastCheck.verdict == null && lastCheck.at == null) {
         return {
             id: 'run-ark-check',
-            summary: 'No last-check snapshot yet — run ark-check --report (or --doctor) to freeze session evidence.',
+            summary: 'No last-check snapshot yet — run ark-check --report to freeze session evidence (--doctor does not write the snapshot).',
         };
     }
     if (activation.writePath === 'unavailable') {
@@ -334,6 +348,10 @@ export function buildStatusManifest(facts) {
         rules,
         nextAction: resolveStatusNextAction(facts, binding, activation, lastCheck, rules),
     };
+    const configErrors = normalizedConfigErrors(facts.configErrors);
+    if (projectIdentity.resolvedConfigPath && configErrors.length > 0) {
+        status.contract = { valid: false, errors: configErrors };
+    }
     const compass = normalizeStatusImprovementCompass(facts.improvementCompass);
     if (compass)
         status.improvementCompass = compass;
@@ -433,7 +451,7 @@ export function unavailableStatusImprovementCompass(input = {}) {
         topResidual: [],
         reasonCode: input.reasonCode ?? STATUS_COMPASS_REASON_CODES.NO_SESSION_SNAPSHOT,
         reason: input.reason ??
-            'No session compass facts yet — run ark-check --doctor or --report for residual lenses. Status never invents green.',
+            'No session compass facts yet — run ark-check --report to write the session snapshot (--doctor shows full lenses but does not write it). Status never invents green.',
         factsSource: 'none',
         contractHash: input.contractHash,
     });
@@ -591,6 +609,16 @@ export const ARK_STATUS_MANIFEST_SCHEMA = {
                 summary: { type: 'string', minLength: 1 },
             },
         },
+        contract: {
+            type: 'object',
+            description: 'Present only when the resolved config fails the shared contract validator (the same fail-closed rules ark-check, MCP and ESLint apply).',
+            additionalProperties: false,
+            required: ['valid', 'errors'],
+            properties: {
+                valid: { const: false },
+                errors: { type: 'array', minItems: 1, items: { type: 'string', minLength: 1 } },
+            },
+        },
         improvementCompass: {
             type: 'object',
             description: 'Thin improvement-compass residual ids with honesty mode (notAScore). full | subset | unavailable. Never a gate input; full lenses on doctor JSON. When full, residual ids ⊆ doctor residual for the same facts. unavailable never invents green residual.',

package/bin/lib/team-parliament-io.mjs

@@ -2,11 +2,10 @@
  * Team parliament I/O — git base refs, changed paths, pin/contract/baseline compare.
  * Pure classification lives in team-parliament.mjs (Domain).
  */
-import { spawnSync } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
 import { createHash } from 'node:crypto';
-import { applyAdvisorySiblingRatchet } from '../ark-layer-match.mjs';
+import { applyAdvisorySiblingRatchet, globToRegExp } from '../ark-layer-match.mjs';
 import {
   baselineKeysFromDocument,
   classifyBaselineKeyDelta,
@@ -20,6 +19,15 @@ import {
   resolveStewardHandle,
   suggestStewards,
 } from './team-parliament.mjs';
+import {
+  SPAWN_TIMEOUT_MS,
+  TEAM_BASE_CANDIDATES,
+  discoverTeamBaseRef,
+  gitShowText,
+  listChangedPaths,
+  runGit,
+  safeGitRef,
+} from './git-change-scope.mjs';
 
 export {
   baselineKeysFromDocument,
@@ -34,25 +42,8 @@ export {
   resolveStewardHandle,
   suggestStewards,
 };
-
-/** Kill hung git instead of stalling CI. */
-export const SPAWN_TIMEOUT_MS = 8000;
-
-function runGit(cwd, args) {
-  return spawnSync('git', ['-C', cwd, ...args], {
-    encoding: 'utf8',
-    stdio: ['ignore', 'pipe', 'pipe'],
-    timeout: SPAWN_TIMEOUT_MS,
-  });
-}
-
-export function safeGitRef(value) {
-  return (
-    typeof value === 'string' &&
-    /^[A-Za-z0-9][A-Za-z0-9._/-]{0,200}$/.test(value) &&
-    !value.includes('..')
-  );
-}
+// prettier-ignore
+export { SPAWN_TIMEOUT_MS, TEAM_BASE_CANDIDATES, discoverTeamBaseRef, gitShowText, listChangedPaths, safeGitRef };
 
 export function contractSessionFrom(args, env = process.env) {
   if (args?.contractSession === true) return true;
@@ -70,49 +61,6 @@ export function resolveTeamAuthor(args, env = process.env) {
   });
 }
 
-export function discoverTeamBaseRef(root, preferred) {
-  if (safeGitRef(preferred)) return preferred;
-  const candidates = ['origin/dev', 'origin/main', 'origin/master', 'dev', 'main'];
-  for (const candidate of candidates) {
-    const exists = runGit(root, ['rev-parse', '--verify', `${candidate}^{commit}`]);
-    if (exists.status === 0) return candidate;
-  }
-  return null;
-}
-
-export function listChangedPaths(root, baseRef) {
-  if (!safeGitRef(baseRef)) {
-    return { ok: false, paths: [], error: 'Invalid or missing git base ref.' };
-  }
-  const verify = runGit(root, ['rev-parse', '--verify', `${baseRef}^{commit}`]);
-  if (verify.status !== 0) {
-    return { ok: false, paths: [], error: `Cannot resolve git ref ${baseRef}.` };
-  }
-  const diff = runGit(root, ['diff', '--name-only', `${baseRef}...HEAD`]);
-  const unstaged = runGit(root, ['diff', '--name-only']);
-  const staged = runGit(root, ['diff', '--name-only', '--cached']);
-  const untracked = runGit(root, ['ls-files', '--others', '--exclude-standard']);
-  if (diff.status !== 0) {
-    return { ok: false, paths: [], error: diff.stderr.trim() || `git diff ${baseRef} failed.` };
-  }
-  const paths = [
-    ...diff.stdout.split('\n'),
-    ...unstaged.stdout.split('\n'),
-    ...staged.stdout.split('\n'),
-    ...untracked.stdout.split('\n'),
-  ]
-    .map((line) => line.trim().replace(/\\/g, '/'))
-    .filter(Boolean);
-  return { ok: true, paths: [...new Set(paths)].sort(), error: null };
-}
-
-export function gitShowText(root, baseRef, relPath) {
-  if (!safeGitRef(baseRef) || !relPath) return null;
-  const shown = runGit(root, ['show', `${baseRef}:${relPath}`]);
-  if (shown.status !== 0) return null;
-  return shown.stdout;
-}
-
 export function readJsonMaybe(text) {
   if (typeof text !== 'string' || !text.trim()) return null;
   try {
@@ -193,8 +141,11 @@ export function bindTeamBaseRefs(args, root) {
     if (!next.against && (next.changed || next.contractDiff || next.persona)) {
       next.against = teamBase;
     }
-    if (!next.policyBaseRef && (next.contractDiff || next.changed || next.against)) {
+    // A contract session must classify the law change, or loosening skips steward/ack checks.
+    // policyBaseFromTeam: a base without the contract yet is adoption (no predecessor), not an error.
+    if (!next.policyBaseRef && (next.contractDiff || next.changed || next.against || next.contractSession)) {
       next.policyBaseRef = teamBase;
+      next.policyBaseFromTeam = true;
     }
     if (!next.baseRef && next.failOnNewSmells) next.baseRef = teamBase;
   }
@@ -236,17 +187,28 @@ export function runTeamPreflight({ root, args, config, policyDelta, teamBase })
     return { halt: null, teamParliament: null, changedPaths: [] };
   }
   const againstRef = args.against || teamBase;
-  if (args.local && !againstRef) {
-    const message =
-      '--local needs a git merge base so it can reuse --changed. Pass --base <ref> (for example --base HEAD or --base origin/main). The merge gate stays --strict-merge.';
-    const teamParliament = { deny: false, reasonId: 'local-needs-base', message };
+  if ((args.local || args.changed || args.contractDiff) && !againstRef) {
+    const reasonId = args.local
+      ? 'local-needs-base'
+      : args.changed
+        ? 'changed-needs-base'
+        : 'contract-diff-needs-base';
+    const message = args.local
+      ? '--local needs a git merge base so it can reuse --changed. Pass --base <ref> (for example --base HEAD or --base origin/main). The merge gate stays --strict-merge.'
+      : args.changed
+        ? changedNeedsBaseMessage(args)
+        : contractDiffNeedsBaseMessage(args);
+    const teamParliament = { deny: false, reasonId, message };
     return {
       halt: { exitCode: 2, message, teamParliament },
       teamParliament,
       changedPaths: [],
     };
   }
-  const listed = againstRef ? listChangedPaths(root, againstRef) : { ok: true, paths: [], error: null };
+  // No base ref means the change set was never computed: never report it as empty.
+  const listed = againstRef
+    ? listChangedPaths(root, againstRef)
+    : { ok: false, paths: [], error: 'No git base ref resolved.' };
   const changedPaths = listed.ok ? listed.paths : [];
   const changeSet = classifyChangeSet(changedPaths);
   const baseBaselineRaw = againstRef
@@ -279,8 +241,12 @@ export function runTeamPreflight({ root, args, config, policyDelta, teamBase })
     changedPathError: listed.ok ? null : listed.error,
   };
   if (!listed.ok && (args.changed || args.against || args.contractDiff)) {
+    // The verdict above ran over an uncomputed diff: never label it `ok`.
+    teamParliament.deny = false;
+    teamParliament.reasonId = 'changed-paths-unavailable';
+    teamParliament.message = `${listed.error || 'Cannot list changed paths.'} Pass --base <ref> or fix the git error, or run a full check without diff flags.`;
     return {
-      halt: { exitCode: 2, message: listed.error || 'Cannot resolve team base ref.', teamParliament },
+      halt: { exitCode: 2, message: teamParliament.message, teamParliament },
       teamParliament,
       changedPaths,
     };
@@ -302,6 +268,17 @@ export function runTeamPreflight({ root, args, config, policyDelta, teamBase })
   return { halt: null, teamParliament, changedPaths };
 }
 
+/** `--changed` / `--persona touch|contributor|agent` without a resolvable merge base. */
+export function changedNeedsBaseMessage(args) {
+  const flag = args?.persona ? `--persona ${args.persona}` : '--changed';
+  return `${flag} needs a git merge base to know which files changed, and none was found (tried ${TEAM_BASE_CANDIDATES.join(', ')}; or this is not a git repository). Pass --base <ref> (for example --base HEAD or --base origin/main), or run without ${flag} for a full-tree check.`;
+}
+
+export function contractDiffNeedsBaseMessage(args) {
+  const flag = args?.persona ? `--persona ${args.persona}` : '--contract-diff';
+  return `${flag} compares the contract and .ark-baseline.json against a git base, and none was found (tried ${TEAM_BASE_CANDIDATES.join(', ')}; or this is not a git repository). Pass --base <ref> (for example --base origin/main), or run a plain full-tree check without ${flag}.`;
+}
+
 export function ungovernedDumpMessage(dumped) {
   return `New ungoverned source in this diff: ${dumped.slice(0, 8).join(', ')}${dumped.length > 8 ? '…' : ''}. Classify via /ark-adopt (contract session) or move into a governed layer.`;
 }
@@ -312,6 +289,29 @@ export function filterChangedGovernedFiles(allGovernedFiles, root, changedPaths,
   return allGovernedFiles.filter((abs) => changedSet.has(normalizeRel(path.relative(root, abs))));
 }
 
+/**
+ * `--changed` scans a subset, so a layer whose files were not touched looks empty to the
+ * kernel. Keep CONFIG_LAYER_PATTERN_NO_MATCHES only when the FULL governed tree has no
+ * match either (a real typo). `loadFullFiles` is lazy: the full walk runs only when needed.
+ */
+export function pruneScopedPatternWarnings(warnings, root, loadFullFiles) {
+  const isNoMatch = (w) =>
+    (w?.ruleId ?? w?.code) === 'CONFIG_LAYER_PATTERN_NO_MATCHES' && typeof w.pattern === 'string';
+  if (!Array.isArray(warnings) || !warnings.some(isNoMatch)) return warnings;
+  const rels = loadFullFiles().map((abs) => path.relative(root, abs).split(path.sep).join('/'));
+  for (let i = warnings.length - 1; i >= 0; i -= 1) {
+    if (!isNoMatch(warnings[i])) continue;
+    let expression;
+    try {
+      expression = globToRegExp(warnings[i].pattern);
+    } catch {
+      continue;
+    }
+    if (rels.some((rel) => expression.test(rel))) warnings.splice(i, 1);
+  }
+  return warnings;
+}
+
 export function applyAgainstRatchet({
   violations,
   againstRef,
@@ -319,16 +319,18 @@ export function applyAgainstRatchet({
   changed,
   changedPaths,
   occurrenceKeys,
+  rules,
+  layers,
 }) {
   const baseRaw = readJsonMaybe(gitShowText(root, againstRef, '.ark-baseline.json'));
   const baseKeys = new Set(baselineKeysFromDocument(baseRaw));
-  const judged = baseRaw ? applyAdvisorySiblingRatchet(violations, occurrenceKeys, baseKeys) : violations;
+  const judged = baseRaw ? applyAdvisorySiblingRatchet(violations, occurrenceKeys, baseKeys, { rules, layers }) : violations;
   const vsBaseActive = judged.filter((_, index) => !baseKeys.has(occurrenceKeys[index]));
   const changedSet = new Set(changedPaths ?? []);
+  // A CROSS_PARENT_VIA_SHARED path belongs to the change when any file on it changed.
+  const touched = (v) => [v.file, ...(Array.isArray(v.via) ? v.via : []), ...(v.reasonId === 'CROSS_PARENT_VIA_SHARED' ? [v.target] : [])];
   const activeViolations = changed
-    ? vsBaseActive.filter((violation) =>
-        changedSet.has(String(violation.file || '').replace(/\\/g, '/'))
-      )
+    ? vsBaseActive.filter((v) => touched(v).some((f) => changedSet.has(String(f || '').replace(/\\/g, '/'))))
     : vsBaseActive;
   return {
     activeViolations,

package/bin/lib/team-parliament.mjs

@@ -119,7 +119,12 @@ export function isGitHubEmail(value) {
     const email = value.trim().toLowerCase();
     if (!email.includes('@') || email.includes(' ') || isAutomationAuthor(email))
         return false;
-    return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email);
+    // local@domain.tld without a backtracking regex (CodeQL js/polynomial-redos).
+    const parts = email.split('@');
+    if (parts.length !== 2 || !parts[0] || /\s/.test(email))
+        return false;
+    const dot = parts[1].lastIndexOf('.');
+    return dot > 0 && dot < parts[1].length - 1;
 }
 /** `123+login@users.noreply.github.com` or `login@users.noreply.github.com` → login. */
 export function githubHandleFromEmail(email) {

package/bin/lib/write-path-capabilities.mjs

@@ -20,6 +20,7 @@ import {
 import { detectActiveAgentHost } from './skill-install.mjs';
 import { detectCiEnforcement } from './weakest-link.mjs';
 import { buildEnforcementState, packageInstallation } from './enforcement-state.mjs';
+import { npxArkgatePrefixLength } from './package-manager.mjs';
 
 export const WRITE_CAPABILITY_NAMES = [
   'hard-write',
@@ -161,8 +162,9 @@ function arkMcpInvocation(server) {
   if (argv.filter(isArkMcpToken).length !== 1) return false;
   if (isArkMcpToken(server.command)) return { argv, binIndex: 0 };
   const runner = path.basename(server.command.trim().replace(/\\/g, '/'));
-  if (['npx', 'yarn'].includes(runner) && isArkMcpToken(args[0])) {
-    return { argv, binIndex: 1 };
+  const npxPrefix = runner === 'npx' ? npxArkgatePrefixLength(args) : 0;
+  if (['npx', 'yarn'].includes(runner) && isArkMcpToken(args[npxPrefix])) {
+    return { argv, binIndex: npxPrefix + 1 };
   }
   if (runner === 'node') {
     const script = args[0]?.replace(/\\/g, '/');

package/dist/chunk-A5EIY3HI.cjs

@@ -0,0 +1,5 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }var G=Object.defineProperty;var v=Object.getOwnPropertyDescriptor;var i=(n,e)=>G(n,"name",{value:e,configurable:!0});var Jn=(n,e,r,t)=>{for(var s=t>1?void 0:t?v(e,r):e,u=n.length-1,a;u>=0;u--)(a=n[u])&&(s=(t?a(e,r,s):a(s))||s);return t&&s&&G(e,r,s),s};var D="1.0",nn= exports.d =["singleton","transient"],en=["absorb","escalate_up","hold"],rn=new Set(nn);function E(n,e){return n<e?-1:n>e?1:0}i(E,"compare");function tn(n){return[...new Set(n)].sort(E)}i(tn,"uniqueSorted");function k(n){if(!Array.isArray(n))return[];let e=[];for(let r of n)typeof r=="string"&&r.length>0&&e.push(r);return tn(e)}i(k,"nameList");function on(n){if(n===null)return null;if(typeof n=="string"||typeof n=="boolean"||typeof n=="number"&&Number.isFinite(n))return n}i(on,"jsonPrimitive");function sn(n){return typeof n=="string"&&rn.has(n)?n:"singleton"}i(sn,"closedLifetime");function L(n){if(n===null||typeof n!="object"||Array.isArray(n))return;let e={};for(let r of Object.keys(n).sort(E)){if(r.length===0)continue;let t=on(n[r]);t!==void 0&&(e[r]=t)}return Object.keys(e).length>0?e:void 0}i(L,"sanitizeMetadata");function un(n){if(n===null||typeof n!="object"||Array.isArray(n))return;let e=n,r={};typeof e.label=="string"&&e.label.length>0&&(r.label=e.label),typeof e.architectureKind=="string"&&e.architectureKind.length>0&&(r.architectureKind=e.architectureKind);let t=k(e.tags);t.length>0&&(r.tags=t),typeof e.group=="string"&&e.group.length>0&&(r.group=e.group);let s=L(e.metadata);return s&&(r.metadata=s),Object.keys(r).length>0?r:void 0}i(un,"sanitizeArkRunExtendedInfo");function an(n){if(n===null||typeof n!="object"||Array.isArray(n))return;let e=n,r=typeof e.id=="string"?e.id.trim():"";if(!r)return;let t={id:r,lifetime:sn(e.lifetime),uses:k(e.uses),reactsTo:k(e.reactsTo),raises:k(e.raises),sends:k(e.sends)},s=un(e.extendedInfo);return s&&(t.extendedInfo=s),t}i(an,"sanitizeArkRunComponent");var cn=new Set(en);function dn(n){return L(n)}i(dn,"sanitizeTapePayload");function U(n){if(n===null||typeof n!="object"||Array.isArray(n))return;let e=n,r=typeof e.xiHash=="string"?e.xiHash.trim():"";if(!r)return;let t=e.event;if(t===null||typeof t!="object"||Array.isArray(t))return;let s=t,u=typeof s.kind=="string"?s.kind.trim():"";if(!u)return;let a=e.residual;if(a===null||typeof a!="object"||Array.isArray(a))return;let o=a,c=typeof o.kind=="string"&&cn.has(o.kind)?o.kind:void 0;if(!c)return;let d={kind:u},p=dn(s.payload);p&&(d.payload=p);let w={kind:c};return typeof o.reasonCode=="string"&&o.reasonCode.length>0&&(w.reasonCode=o.reasonCode),typeof o.eventId=="string"&&o.eventId.length>0&&(w.eventId=o.eventId),typeof o.target=="string"&&o.target.length>0&&(w.target=o.target),{xiHash:r,event:d,residual:w}}i(U,"sanitizeDecisionTapeRecord");function pn(n){if(!Array.isArray(n))return[];let e=[];for(let r of n){let t=U(r);t&&e.push(t)}return e}i(pn,"sanitizeDecisionTape");function R(n){let e=typeof n.kernelInstanceId=="string"?n.kernelInstanceId:"",r=Array.isArray(n.components)?n.components:[],t=new Set,s=[];for(let a of r){let o=an(a);!o||t.has(o.id)||(t.add(o.id),s.push(o))}s.sort((a,o)=>E(a.id,o.id));let u=pn(n.decisionTape);return{schemaVersion:"1.0",kernelInstanceId:e,components:s,...u.length>0?{decisionTape:u}:{}}}i(R,"buildDependencyInformationPackage");function Yn(n,e){let r=U(e),t=_nullishCoalesce(n.decisionTape, () => ([])),s=r?[...t,r]:[...t];return{schemaVersion:n.schemaVersion,kernelInstanceId:n.kernelInstanceId,components:n.components,...s.length>0?{decisionTape:s}:{}}}i(Yn,"appendDecisionTape");var fn="1.0",ln= exports.i ="process",gn= exports.j =["process","technical"],ee= exports.k =["component","interaction"],re= exports.l =["raises","reactsTo","sends"],te= exports.m =["uses"],l= exports.n =class extends Error{static{i(this,"InvalidArkRunGraphQueryError")}constructor(e,r){super(_nullishCoalesce(r, () => ((e==="slice"?'ArkRun graph slice must be "process" or "technical".':e==="degreesOfSeparation"?"ArkRun graph degreesOfSeparation must be a non-negative integer.":`ArkRun graph ${e} is not a closed query.`)))),this.name="InvalidArkRunGraphQueryError",this.option=e}},kn=new Set(gn),Rn=new Set(["slice","nodeIds","degreesOfSeparation","include","exclude"]),An=new Set(["ids","labels","tags","groups","architectureKinds"]);function y(n,e){return n<e?-1:n>e?1:0}i(y,"compare");function C(n){return[...new Set(n)].sort(y)}i(C,"uniqueSorted");function H(){return{tokens:[],ids:[],labels:[],tags:[],groups:[],architectureKinds:[]}}i(H,"emptyMatch");function T(n){return n.tokens.length+n.ids.length+n.labels.length+n.tags.length+n.groups.length+n.architectureKinds.length>0}i(T,"matchHasCriteria");function f(n,e){if(n==null||n==="")return[];if(typeof n=="string")return C(n.split(",").map(t=>t.trim()).filter(t=>t.length>0));if(!Array.isArray(n))throw new l(e);let r=[];for(let t of n){if(typeof t!="string")throw new l(e);let s=t.trim();s.length>0&&r.push(s)}return C(r)}i(f,"nameList");function V(n,e){if(e==="*")return n.length>0;if(!e.includes("*"))return n===e;let r="^";for(let t of e)t==="*"?r+=".*":/[.*+?^${}()|[\]\\]/.test(t)?r+=`\\${t}`:r+=t;return r+="$",new RegExp(r).test(n)}i(V,"globMatch");function A(n,e){return n?e.some(r=>V(n,r)):!1}i(A,"anyGlob");function j(n){if(n==null||n==="")return ln;if(typeof n=="string"&&kn.has(n))return n;throw new l("slice")}i(j,"closedSlice");function W(n){if(n==null||n==="")return null;if(typeof n=="string"&&/^(0|[1-9]\d*)$/.test(n))return Number(n);if(typeof n=="number"&&Number.isInteger(n)&&n>=0)return n;throw new l("degreesOfSeparation")}i(W,"closedDegrees");function F(n,e){if(n==null||n==="")return H();if(typeof n=="string"||Array.isArray(n))return{...H(),tokens:f(n,e)};if(typeof n!="object")throw new l(e);let r=n;for(let t of Object.keys(r))if(!An.has(t))throw new l(e);return{tokens:[],ids:f(r.ids,e),labels:f(r.labels,e),tags:f(r.tags,e),groups:f(r.groups,e),architectureKinds:f(r.architectureKinds,e)}}i(F,"closedMatch");function Q(n={}){if(n==null||n==="")return Q({});if(typeof n!="object"||Array.isArray(n))throw new l("slice","ArkRun graph query must be an object.");let e=n;for(let r of Object.keys(e))if(!Rn.has(r))throw new l("slice",`ArkRun graph query key "${r}" is not closed.`);return{slice:j(e.slice),nodeIds:f(e.nodeIds,"nodeIds"),degreesOfSeparation:W(e.degreesOfSeparation),include:F(e.include,"include"),exclude:F(e.exclude,"exclude")}}i(Q,"closeArkRunGraphQuery");function oe(n){let e={};n.slice&&(e.slice=j(n.slice));let r=f(_nullishCoalesce(n.nodeIds, () => (void 0)),"nodeIds");r.length>0&&(e.nodeIds=r);let t=W(_nullishCoalesce(n.degreesOfSeparation, () => (void 0)));t!==null&&(e.degreesOfSeparation=t);let s=f(_nullishCoalesce(n.include, () => (void 0)),"include");s.length>0&&(e.include=s);let u=f(_nullishCoalesce(n.exclude, () => (void 0)),"exclude");return u.length>0&&(e.exclude=u),e}i(oe,"arkRunGraphQueryFromSearchParams");function mn(n){let e=[n.id];return n.label&&e.push(n.label),n.group&&e.push(n.group),n.architectureKind&&e.push(n.architectureKind),n.tags&&e.push(...n.tags),e}i(mn,"nodeFields");function $(n,e){if(!T(e))return!0;let r=mn(n);return e.tokens.some(t=>r.some(s=>V(s,t)))||A(n.id,e.ids)||A(n.label,e.labels)||_optionalChain([n, 'access', _2 => _2.tags, 'optionalAccess', _3 => _3.some, 'call', _4 => _4(t=>A(t,e.tags))])||A(n.group,e.groups)?!0:A(n.architectureKind,e.architectureKinds)}i($,"nodeMatches");function yn(n){if(n&&typeof n=="object"&&!Array.isArray(n)){let e=n;return R({kernelInstanceId:e.kernelInstanceId,components:e.components})}return R({})}i(yn,"asPackage");function hn(n){let e={id:n.id,kind:"component",lifetime:n.lifetime},r=n.extendedInfo;return _optionalChain([r, 'optionalAccess', _5 => _5.label])&&(e.label=r.label),_optionalChain([r, 'optionalAccess', _6 => _6.group])&&(e.group=r.group),_optionalChain([r, 'optionalAccess', _7 => _7.architectureKind])&&(e.architectureKind=r.architectureKind),_optionalChain([r, 'optionalAccess', _8 => _8.tags])&&r.tags.length>0&&(e.tags=[...r.tags]),e}i(hn,"componentNode");function S(n){return{id:n,kind:"interaction"}}i(S,"interactionNode");function m(n,e){let r=n.get(e.id);(!r||r.kind==="interaction"&&e.kind==="component")&&n.set(e.id,e)}i(m,"addNode");function _(n,e,r,t,s){let u=`${r}\0${s}\0${t}`;e.has(u)||(e.add(u),n.push({from:r,to:t,kind:s}))}i(_,"addEdge");function bn(n,e){let r=new Map,t=[],s=new Set;for(let u of n){if(m(r,hn(u)),e==="technical"){for(let a of u.uses)m(r,_nullishCoalesce(r.get(a), () => (S(a)))),_(t,s,u.id,a,"uses");continue}for(let a of u.raises)m(r,_nullishCoalesce(r.get(a), () => (S(a)))),_(t,s,u.id,a,"raises");for(let a of u.reactsTo)m(r,_nullishCoalesce(r.get(a), () => (S(a)))),_(t,s,a,u.id,"reactsTo");for(let a of u.sends)m(r,_nullishCoalesce(r.get(a), () => (S(a)))),_(t,s,u.id,a,"sends")}return{nodes:r,edges:t}}i(bn,"buildSlice");function In(n){let e=new Map,r=i((t,s)=>{let u=e.get(t);u?u.push(s):e.set(t,[s])},"push");for(let t of n)r(t.from,t.to),r(t.to,t.from);return e}i(In,"adjacency");function wn(n,e,r,t){let s=e.filter(o=>n.has(o));if(s.length===0)return new Set;let u=new Set,a=s.map(o=>({id:o,depth:0}));for(;a.length>0;){let o=a.shift();if(!(!o||u.has(o.id))&&(u.add(o.id),!(r!==null&&o.depth>=r)))for(let c of _nullishCoalesce(t.get(o.id), () => ([])))!u.has(c)&&n.has(c)&&a.push({id:c,depth:o.depth+1})}return u}i(wn,"neighborhood");function h(n){let e=n.replace(/[^A-Za-z0-9_]/g,"_");return/^[A-Za-z_]/.test(e)?e:`n_${e}`}i(h,"mermaidSafeId");function B(n){return n.replace(/\\/g,"\\\\").replace(/"/g,"#quot;").replace(/]/g,"#93;")}i(B,"mermaidLabel");function Sn(n){let e=new Set,r=new Map;for(let t of n){let s=h(t),u=s,a=2;for(;e.has(u);)u=`${s}_${a}`,a+=1;e.add(u),r.set(t,u)}return r}i(Sn,"uniqueMermaidIds");function _n(n){let e=n.slice==="technical"?"TD":"LR",r=n.nodes.map(o=>o.id),t=Sn(r),s=C(n.nodes.map(o=>o.group).filter(o=>!!o)),u=[`flowchart ${e}`],a=i((o,c)=>{let d=_nullishCoalesce(t.get(o.id), () => (h(o.id))),p=B(_nullishCoalesce(o.label, () => (o.id)));u.push(`${c}${d}["${p}"]`)},"emitNode");for(let o of s){let c=h(`group_${o}`);u.push(`  subgraph ${c}["${B(o)}"]`);for(let d of n.nodes)d.group===o&&a(d,"    ");u.push("  end")}for(let o of n.nodes)o.group||a(o,"  ");for(let o of n.edges){let c=_nullishCoalesce(t.get(o.from), () => (h(o.from))),d=_nullishCoalesce(t.get(o.to), () => (h(o.to)));u.push(`  ${c} -->|${o.kind}| ${d}`)}return u.join(`
+`)}i(_n,"formatArkRunGraphMermaid");function xn(n,e,r){let t=new Set(n.keys());if(T(r.include)&&(t=new Set([...t].filter(o=>{let c=n.get(o);return c!==void 0&&$(c,r.include)}))),T(r.exclude))for(let o of[...t]){let c=n.get(o);c&&$(c,r.exclude)&&t.delete(o)}let s=e.filter(o=>t.has(o.from)&&t.has(o.to));r.nodeIds.length>0&&(t=wn(t,r.nodeIds,r.degreesOfSeparation,In(s)));let u=[...t].sort(y).map(o=>n.get(o)).filter(o=>!!o),a=s.filter(o=>t.has(o.from)&&t.has(o.to)).sort((o,c)=>y(o.from,c.from)||y(o.kind,c.kind)||y(o.to,c.to));return{nodes:u,edges:a}}i(xn,"filterGraph");function se(n={},e={}){let r=yn(n),t=Q(e),s=bn(r.components,t.slice),u=xn(s.nodes,s.edges,t),a={schemaVersion:fn,kernelInstanceId:r.kernelInstanceId,slice:t.slice,query:t,nodes:u.nodes,edges:u.edges,mermaid:""};return a.mermaid=_n(a),a}i(se,"requestArkRunGraph");var O=["local","localBlocking","broker"],z= exports.t =!0,Nn=new Set(O),x= exports.u =class extends Error{static{i(this,"InvalidArkRunSendOptionError")}constructor(e){super(e==="transport"?'ArkRun transport must be "local", "localBlocking", or "broker".':"ArkRun ephemeral must be a boolean."),this.name="InvalidArkRunSendOptionError",this.option=e}};function En(n){if(n===void 0)return"local";if(typeof n=="string"&&Nn.has(n))return n;throw new x("transport")}i(En,"closedArkRunTransportKind");function Cn(n){if(n===void 0)return!0;if(n===!0||n===!1)return n;throw new x("ephemeral")}i(Cn,"closedArkRunEphemeral");function ae(n){let e=En(n.transport),r=Cn(n.ephemeral),t=e==="broker"&&n.brokerBound!==!0,s=e==="broker"&&!t?"broker":"local",u=e==="localBlocking";return{transport:e,ephemeral:r,deliveredVia:s,fallbackToLocal:t,notifySubscribers:s==="local",awaitHandlers:u,awaitHandoff:r||u}}i(ae,"resolveArkRunSendPlan");var Tn="1.0",q= exports.z ="127.0.0.1",On= exports.A =0,le= exports.B ="/snapshot",ge= exports.C ="/events",ke= exports.D ="/graph",Re= exports.E ="/outbox",Ae= exports.F ="/workflows",Kn= exports.G ="snapshot",Mn= exports.H ="in-process-local",b= exports.I =32;var P=class extends Error{static{i(this,"ArkRunInspectorProductionError")}constructor(){super("ArkRun inspector refuses to start when NODE_ENV=production."),this.name="ArkRunInspectorProductionError"}},I= exports.K =class extends Error{static{i(this,"ArkRunInspectorBindError")}constructor(e){super(`ArkRun inspector binds loopback only (default 127.0.0.1). Public host "${e}" is rejected.`),this.name="ArkRunInspectorBindError"}},Pn=new Set(["","*","0","0.0.0.0","::","::0","[::]","[::0]","::ffff:0.0.0.0","[::ffff:0.0.0.0]"]);function J(n){return n==="production"}i(J,"isArkRunInspectorProductionEnv");function Gn(n){let e=n.split(".");if(e.length!==4)return;let r=[];for(let t of e){if(!/^\d{1,3}$/.test(t))return;let s=Number(t);if(s>255)return;r.push(s)}return r}i(Gn,"ipv4Octets");function X(n){if(n.startsWith("[::ffff:")&&n.endsWith("]"))return n.slice(8,-1);if(n.startsWith("::ffff:"))return n.slice(7)}i(X,"unwrapIpv4Mapped");function Y(n){if(typeof n!="string")return!1;let e=n.trim().toLowerCase();if(e==="localhost"||e==="::1"||e==="[::1]")return!0;let r=X(e);if(r)return Y(r);let t=Gn(e);return t!==void 0&&t[0]===127}i(Y,"isArkRunInspectorLoopbackHost");function Z(n){if(n===void 0)return q;if(typeof n!="string")throw new I(String(n));let e=n.trim();if(Pn.has(e.toLowerCase())||!Y(e))throw new I(e);let r=e.toLowerCase();if(r==="localhost")return q;if(r==="[::1]")return"::1";let t=X(r);return t?Z(t):r}i(Z,"closedHost");function Dn(n){if(n===void 0)return On;if(typeof n!="number"||!Number.isInteger(n)||n<0||n>65535)throw new I(`port:${String(n)}`);return n}i(Dn,"closedPort");function Ln(n={}){if(J(n.nodeEnv)||J(n.processNodeEnv))throw new P;return{host:Z(n.host),port:Dn(n.port)}}i(Ln,"resolveArkRunInspectorBind");function me(n,e,r){return`http://${n.includes(":")?`[${n}]`:n}:${e}${r}`}i(me,"arkRunInspectorUrl");function Un(n){if(n!==void 0)try{return JSON.parse(JSON.stringify(n))}catch (e2){return}}i(Un,"jsonClone");function Hn(n){return{kinds:[...O],ephemeralDefault:n.ephemeralDefault===!1?!1:!0,brokerBound:n.brokerBound===!0,cloudSdksShipped:!1,fallback:Mn}}i(Hn,"closedTransportFacts");function g(n){if(!(!n||typeof n!="object"||Array.isArray(n)))return n}i(g,"asRecord");function Fn(n){let e=g(n);if(!e||typeof e.id!="string")return;let r=e.status;if(r!=="pending"&&r!=="failed")return;let t=g(e.event),s=t&&typeof t.intent=="string"?t.intent:typeof e.intent=="string"?e.intent:void 0,u={id:e.id,status:r,attempts:typeof e.attempts=="number"&&Number.isFinite(e.attempts)?e.attempts:0};return s&&(u.intent=s),typeof e.error=="string"&&e.error.length>0&&(u.error=e.error),typeof e.updatedAt=="string"&&(u.updatedAt=e.updatedAt),u}i(Fn,"closedOutboxSummary");function N(n){if(typeof n!="number"||!Number.isFinite(n))return b;let e=Math.trunc(n);return e<0?0:e>b?b:e}i(N,"closedSampleLimit");function $n(n,e){let r=typeof n=="string"&&n.trim().length>0?n.trim():n&&typeof n=="object"&&"constructor"in n?String(_nullishCoalesce(_optionalChain([n, 'access', _9 => _9.constructor, 'optionalAccess', _10 => _10.name]), () => (e))):e,t=/^InMemory/i.test(r)?"memory":"durable";return{role:e,id:r,kind:t}}i($n,"classifyArkRunInspectorStoreDurability");function Bn(n={}){let e=g(n),r=_nullishCoalesce(g(_optionalChain([e, 'optionalAccess', _11 => _11.durability])), () => (e)),t=Array.isArray(_optionalChain([r, 'optionalAccess', _12 => _12.stores]))?r.stores:Array.isArray(_optionalChain([e, 'optionalAccess', _13 => _13.stores]))?e.stores:[],s=[];for(let u of t){let a=g(u);if(!a)continue;let o=a.role;if(o!=="outbox"&&o!=="audit"&&o!=="workflow")continue;let c=typeof a.id=="string"?a.id:typeof a.name=="string"?a.name:void 0;if(!c)continue;let d=a.kind==="memory"||a.kind==="durable"?a.kind:$n(c,o).kind;s.push({role:o,id:c,kind:d})}return{durability:{stores:s}}}i(Bn,"buildArkRunInspectorHardening");function Vn(n=[],e={}){let r=N(e.sampleLimit),t=Array.isArray(n)?n:[],s=[],u=[];for(let a of t){let o=Fn(a);o&&(o.status==="pending"?s.push(o):u.push(o))}return{available:!0,pendingCount:s.length,failedCount:u.length,pending:s.slice(0,r),failed:u.slice(0,r),sampleLimit:r}}i(Vn,"buildArkRunInspectorOutboxMonitor");function K(){return{available:!1,pendingCount:0,failedCount:0,pending:[],failed:[],sampleLimit:b}}i(K,"unavailableArkRunInspectorOutboxMonitor");function jn(n){let e=g(n);if(!e||typeof e.id!="string")return;let r=typeof e.workflowName=="string"?e.workflowName:typeof e.name=="string"?e.name:void 0;if(!r)return;let t={id:e.id,name:r,status:typeof e.status=="string"?e.status:"unknown"};return typeof e.currentStep=="string"&&(t.currentStep=e.currentStep),typeof e.error=="string"&&e.error.length>0&&(t.error=e.error),t}i(jn,"closedWorkflowSummary");function Wn(n){return n==="idle"||n==="waiting"}i(Wn,"isPendingWorkflowStatus");function Qn(n=[],e={}){let r=N(e.sampleLimit),t=Array.isArray(n)?n:[],s=[],u=0,a=0,o=0,c=0;for(let d of t){let p=jn(d);p&&(s.push(p),p.status==="running"?u+=1:p.status==="compensating"?a+=1:p.status==="failed"?o+=1:Wn(p.status)&&(c+=1))}return{available:!0,total:s.length,runningCount:u,compensatingCount:a,failedCount:o,pendingCount:c,workflows:s.slice(0,r),sampleLimit:r}}i(Qn,"buildArkRunInspectorWorkflowsMonitor");function M(){return{available:!1,total:0,runningCount:0,compensatingCount:0,failedCount:0,pendingCount:0,workflows:[],sampleLimit:b}}i(M,"unavailableArkRunInspectorWorkflowsMonitor");function zn(n){if(n===void 0)return;let e=g(n);if(!e||e.available===!1)return K();let r=N(e.sampleLimit);if(Array.isArray(e.pending)||Array.isArray(e.failed)||Array.isArray(e.records)){let t=[...Array.isArray(e.pending)?e.pending:[],...Array.isArray(e.failed)?e.failed:[],...Array.isArray(e.records)?e.records:[]],s=Vn(t,{sampleLimit:r}),u=typeof e.pendingCount=="number"&&Number.isFinite(e.pendingCount)?Math.max(0,Math.trunc(e.pendingCount)):s.pendingCount,a=typeof e.failedCount=="number"&&Number.isFinite(e.failedCount)?Math.max(0,Math.trunc(e.failedCount)):s.failedCount;return{...s,pendingCount:u,failedCount:a,sampleLimit:r}}return K()}i(zn,"closedOutboxMonitor");function qn(n){if(n===void 0)return;let e=g(n);if(!e||e.available===!1)return M();let r=N(e.sampleLimit);if(Array.isArray(e.workflows)){let t=Qn(e.workflows,{sampleLimit:r}),s=typeof e.total=="number"&&Number.isFinite(e.total)?Math.max(0,Math.trunc(e.total)):t.total,u=typeof e.runningCount=="number"&&Number.isFinite(e.runningCount)?Math.max(0,Math.trunc(e.runningCount)):t.runningCount,a=typeof e.compensatingCount=="number"&&Number.isFinite(e.compensatingCount)?Math.max(0,Math.trunc(e.compensatingCount)):t.compensatingCount,o=typeof e.failedCount=="number"&&Number.isFinite(e.failedCount)?Math.max(0,Math.trunc(e.failedCount)):t.failedCount,c=typeof e.pendingCount=="number"&&Number.isFinite(e.pendingCount)?Math.max(0,Math.trunc(e.pendingCount)):t.pendingCount;return{...t,total:s,runningCount:u,compensatingCount:a,failedCount:o,pendingCount:c,sampleLimit:r}}return M()}i(qn,"closedWorkflowsMonitor");function ye(n={}){let e=Ln({host:n.host,port:n.port}),r=R({kernelInstanceId:n.kernelInstanceId,components:n.package&&typeof n.package=="object"&&!Array.isArray(n.package)&&Array.isArray(n.package.components)?n.package.components:[]}),t=zn(n.outbox),s=qn(n.workflows),u={schemaVersion:Tn,kernelInstanceId:typeof n.kernelInstanceId=="string"?n.kernelInstanceId:r.kernelInstanceId,bind:{host:e.host,port:e.port,loopback:!0},package:{...r,schemaVersion:"1.0"},transport:Hn(n),observability:_nullishCoalesce(Un(n.observability), () => ({})),hardening:Bn(n.hardening)};return t&&(u.outbox=t),s&&(u.workflows=s),u}i(ye,"buildArkRunInspectorSnapshot");function he(n){return`event: ${Kn}
+data: ${JSON.stringify(n)}
+
+`}i(he,"formatArkRunInspectorSseEvent");exports.a = i; exports.b = Jn; exports.c = D; exports.d = nn; exports.e = an; exports.f = R; exports.g = Yn; exports.h = fn; exports.i = ln; exports.j = gn; exports.k = ee; exports.l = re; exports.m = te; exports.n = l; exports.o = Q; exports.p = oe; exports.q = _n; exports.r = se; exports.s = O; exports.t = z; exports.u = x; exports.v = En; exports.w = Cn; exports.x = ae; exports.y = Tn; exports.z = q; exports.A = On; exports.B = le; exports.C = ge; exports.D = ke; exports.E = Re; exports.F = Ae; exports.G = Kn; exports.H = Mn; exports.I = b; exports.J = P; exports.K = I; exports.L = J; exports.M = Y; exports.N = Ln; exports.O = me; exports.P = $n; exports.Q = Bn; exports.R = Vn; exports.S = K; exports.T = Qn; exports.U = M; exports.V = ye; exports.W = he;