audit-tools 0.28.0

package/dist/shared/types/sessionConfig.d.ts

@@ -0,0 +1,294 @@
+import type { DispatchModelTier } from "./stepContract.js";
+export declare const PROVIDER_NAMES: readonly ["auto", "local-subprocess", "subprocess-template", "claude-code", "codex", "opencode", "openai-compatible", "vscode-task", "antigravity"];
+export type ProviderName = (typeof PROVIDER_NAMES)[number];
+export type ResolvedProviderName = Exclude<ProviderName, "auto">;
+export declare const SESSION_UI_MODES: readonly ["visible", "headless"];
+export type SessionUiMode = (typeof SESSION_UI_MODES)[number];
+export interface SubprocessTemplateConfig {
+    command_template: string[];
+    env?: Record<string, string>;
+}
+export interface ClaudeCodeConfig {
+    command?: string;
+    extra_args?: string[];
+    dangerously_skip_permissions?: boolean;
+    prompt_flag?: string;
+}
+export interface OpenCodeConfig {
+    command?: string;
+    extra_args?: string[];
+}
+/**
+ * Codex CLI backend config. Codex is a headless coding CLI (like claude-code):
+ * the non-interactive entrypoint is `codex exec`, which reads the rendered prompt
+ * from stdin and runs to completion editing files (verified against codex-cli
+ * 0.140.0). The provider manages the invocation; these fields tune it.
+ */
+export interface CodexConfig {
+    /** Launcher on PATH (default "codex"; on Windows resolved through cmd.exe). */
+    command?: string;
+    /**
+     * `codex exec --sandbox` policy. Default "workspace-write" — writes confined to
+     * the working root (the node's worktree) plus the result dir (granted via
+     * `--add-dir`), which reinforces worktree isolation. "danger-full-access" drops
+     * the sandbox (use only when the run is already externally isolated).
+     */
+    sandbox_mode?: "read-only" | "workspace-write" | "danger-full-access";
+    /** Model the agent should use (`codex exec --model`). Never defaulted here — codex's own default applies when unset (no hardcoded model identity). */
+    model?: string;
+    /** Extra argv appended after the managed `codex exec` flags. */
+    extra_args?: string[];
+}
+/**
+ * OpenAI-compatible chat-completions backend config (NVIDIA NIM, vLLM, LM Studio,
+ * OpenRouter, any `/chat/completions` endpoint). Unlike the agentic-CLI providers,
+ * this needs no installed agent — the provider itself is a single-shot worker that
+ * calls the endpoint and applies the returned edits to the worktree. Because it
+ * only needs an API key + URL, it is a portable, always-available background
+ * dispatch pool. The endpoint, model id, and key source are all operator-supplied
+ * (no hardcoded model identity); NIM is just one instance:
+ * `{ base_url: "https://integrate.api.nvidia.com/v1", model: "openai/gpt-oss-120b",
+ *    api_key_env: "NVIDIA_API_KEY" }`.
+ */
+export interface OpenAiCompatibleConfig {
+    /** Base URL of the OpenAI-compatible API, e.g. `https://integrate.api.nvidia.com/v1`. */
+    base_url?: string;
+    /** Model id (e.g. `openai/gpt-oss-120b`). Never defaulted — no hardcoded model identity. */
+    model?: string;
+    /** Name of the env var holding the API key (e.g. `NVIDIA_API_KEY`). Preferred over `api_key`. */
+    api_key_env?: string;
+    /** Inline API key. Discouraged (prefer `api_key_env` so the key never lands in config files). */
+    api_key?: string;
+    /** Extra HTTP headers merged into the request. */
+    headers?: Record<string, string>;
+    /** Sampling temperature (default 0 for deterministic edits). */
+    temperature?: number;
+    /** Completion token budget (`max_tokens`). Defaults to a generous value so full files fit. */
+    max_output_tokens?: number;
+    /** Send `response_format: {type:"json_object"}`. Off by default (not all endpoints accept it). */
+    response_format_json?: boolean;
+    /** Inline current contents of prompt-referenced files so edits are grounded. Default true. */
+    include_referenced_files?: boolean;
+}
+export interface VSCodeTaskConfig {
+    command_template: string[];
+    env?: Record<string, string>;
+}
+/**
+ * Antigravity backend config. Antigravity is an agentic IDE with no headless
+ * invocation, so it is driven by an operator-configured command/task template —
+ * the same shape as vscode_task.
+ */
+export interface AntigravityConfig {
+    command_template: string[];
+    env?: Record<string, string>;
+}
+export declare const PROVIDER_SECTION_KEYS: {
+    readonly "subprocess-template": "subprocess_template";
+    readonly "claude-code": "claude_code";
+    readonly codex: "codex";
+    readonly opencode: "opencode";
+    readonly "openai-compatible": "openai_compatible";
+    readonly "vscode-task": "vscode_task";
+    readonly antigravity: "antigravity";
+};
+export interface BlockQuotaConfig {
+    context_tokens?: number;
+    reserved_output_tokens?: number;
+    host_model?: string;
+}
+export interface QuotaModelLimits {
+    context_tokens?: number;
+    output_tokens?: number;
+    requests_per_minute?: number;
+    input_tokens_per_minute?: number;
+    output_tokens_per_minute?: number;
+}
+export interface QuotaConfig {
+    enabled?: boolean;
+    safety_margin?: number;
+    unknown_hosted_concurrency?: number;
+    unknown_local_concurrency?: number | "unlimited";
+    default_context_tokens?: number;
+    reserved_output_tokens?: number;
+    empirical_half_life_hours?: number;
+    ramp_up_enabled?: boolean;
+    first_contact_concurrency?: number;
+    host_active_subagent_limit?: number;
+    models?: Record<string, QuotaModelLimits>;
+}
+export interface ObservabilityConfig {
+    /** Emit the structured run log (run.log.jsonl). Defaults to true. */
+    run_log?: boolean;
+}
+export interface SynthesisConfig {
+    /**
+     * Generate the optional LLM synthesis narrative (themes, executive summary,
+     * top risks) and append it to `audit-findings.json` / `audit-report.md`.
+     * Defaults to on when a provider/host agent is available; the deterministic
+     * report is unchanged when omitted.
+     */
+    narrative?: boolean;
+}
+/**
+ * Relative cut points (on the normalized [0,1] risk scale) that map a packet's
+ * `routing_risk` (max member risk) to a relative model rank. These are NOT
+ * model names or per-model windows — ranks stay relative and windows are
+ * discovered at the dispatch handshake (no-hardcoded-models invariant).
+ */
+export interface DispatchRoutingTiers {
+    /** routing_risk >= deep_at routes to the top rank. Default 0.66. */
+    deep_at?: number;
+    /** routing_risk >= standard_at routes to the middle rank. Default 0.33. */
+    standard_at?: number;
+}
+export interface DispatchConfig {
+    /**
+     * When `agent_count` (packets dispatched this run, after budget
+     * filtering) exceeds this value the loader should pause and ask the user to
+     * confirm before fan-out. Defaults to 10.
+     */
+    confirm_threshold?: number;
+    /**
+     * Hard cap on the number of review packets dispatched in a single run.
+     * Packets are already priority-ordered (high -> medium -> low) by
+     * `prepareDispatchArtifacts`; when `max_packets` is set, only the first K
+     * packets are emitted and the remainder are recorded as DEFERRED.
+     * Default: all packets (no cap).
+     */
+    max_packets?: number;
+    /**
+     * Risk-mass ceiling for the just-in-time graph partition (Phase B of the
+     * plan/dispatch seam): the maximum aggregate node-risk a single packet may
+     * accumulate before the partitioner splits a coherent cluster along its
+     * weakest internal edge. Node risk is in [0,1]. A ceiling, not a quota —
+     * high-risk clusters are never padded with low-risk filler. Model-parameterized
+     * in principle (a stronger model warrants a higher ceiling); until per-model
+     * values are discovered at handshake it defaults to DEFAULT_RISK_MASS_BUDGET.
+     */
+    risk_mass_budget?: number;
+    /**
+     * Override the relative risk→rank cut points used to derive each packet's
+     * `model_hint.tier` from its `routing_risk` at dispatch.
+     */
+    routing_tiers?: DispatchRoutingTiers;
+    /**
+     * Opt IN to the in-process rolling dispatch engine for remediate's implement
+     * phase (quota-derived concurrency + dispatch-next-on-complete + worktree
+     * isolation + per-node verify into merge). Defaults to OFF: the proven
+     * host-fanned wave path remains the default until a real multi-worker rolling
+     * dispatch has been validated end-to-end (CE-001 anti-wedge — the atomic
+     * removal of the host-wave fallback is gated on that proof). Also enabled via
+     * the `REMEDIATE_ROLLING_ENGINE=true` env var. Honoured only when a
+     * programmatic per-node dispatcher is available (a subprocess/CLI provider);
+     * the conversation host, which fans out its own subagents, never engages it.
+     */
+    rolling_engine?: boolean;
+}
+export interface GraphConfig {
+    /**
+     * Phase 4B: run the optional, bounded edge-reasoning pass that rewrites the
+     * human-readable `reason` of low-confidence graph edges (never the edge set
+     * itself). Defaults to off; it is a no-op without host-supplied rewrites.
+     */
+    llm_edge_reasoning?: boolean;
+    /** Model override for the edge-reasoning pass (host's choice otherwise). */
+    model?: string;
+}
+/**
+ * Per-analyzer resolution policy for the optional graph-enrichment pass
+ * (`analyzers.<id>`). Resolution order is repo node_modules → version-keyed
+ * analyzer cache → (for `ephemeral`/`permanent`) install into the cache, else
+ * the regex floor.
+ *
+ * - `repo`     — use only the audited repo's node_modules; absent ⇒ regex floor.
+ * - `ephemeral`/`permanent` — resolve repo→cache, installing into the shared
+ *   cache if absent (never touches the audited project). `permanent` is a
+ *   durable opt-in; `ephemeral` is a one-time/per-need install. Both behave the
+ *   same for resolution.
+ * - `skip`     — never run this analyzer.
+ * - `auto`     — resolve repo→cache; if absent and the analyzer has in-scope
+ *   files, the conversation-first flow proposes an install. Unanswered ⇒ skip.
+ */
+export declare const ANALYZER_SETTINGS: readonly ["repo", "ephemeral", "permanent", "skip", "auto"];
+export type AnalyzerSetting = (typeof ANALYZER_SETTINGS)[number];
+export interface DesignReviewConfig {
+    /**
+     * Maximum number of highest-risk units to include in the focused reading list
+     * rendered into the design-review prompt. The reviewer is asked to prioritise
+     * these units but may follow any thread that demands more context.
+     * Defaults to a value that scales with repo size (see renderDesignReviewPrompt).
+     */
+    max_units?: number;
+    /**
+     * Controls the depth of the conceptual design review pass.
+     * - `"shallow"` (default): single-agent conceptual review.
+     * - `"deep"`: instructs the host to fan out independent reviewers with
+     *   maximally dissimilar perspectives, then compile via an independent judge.
+     * Mirrors `IntentCheckpoint.design_review.conceptual_depth`; the checkpoint is
+     * the user-confirmed source and this config the host/session override.
+     */
+    conceptual_depth?: "shallow" | "deep";
+    /**
+     * Number of independent perspective subagents to fan out when
+     * `conceptual_depth` is `"deep"`. Ignored when shallow. Clamped to the
+     * supported range (2 … number of built-in perspectives); defaults to
+     * `DEFAULT_CONCEPTUAL_PERSPECTIVES`. Mirrors
+     * `IntentCheckpoint.design_review.perspectives`, which is the user-confirmed
+     * source; this config is the host/session override.
+     */
+    perspectives?: number;
+    /**
+     * Relative model rank for the deep conceptual pass's perspective subagents
+     * (divergent ideation rarely needs the top rank). Defaults to `"standard"`.
+     * The judge always routes `"deep"` — it merges/dedups/ranks across every
+     * perspective output, the hardest reasoning step in the pass.
+     */
+    perspective_tier?: DispatchModelTier;
+}
+/**
+ * Forward-declared shape for ConfirmedProviderPool so SessionConfig does not
+ * take a hard dependency on the providerConfirmation module (which imports from
+ * this file). The authoritative definition lives in providers/providerConfirmation.ts.
+ */
+export interface ConfirmedProviderPoolRef {
+    providers: unknown[];
+    excluded: string[];
+    addedUndetected: unknown[];
+}
+export interface SessionConfig {
+    provider?: ProviderName;
+    timeout_ms?: number;
+    ui_mode?: SessionUiMode;
+    host_can_dispatch_subagents?: boolean;
+    subprocess_template?: SubprocessTemplateConfig;
+    claude_code?: ClaudeCodeConfig;
+    codex?: CodexConfig;
+    opencode?: OpenCodeConfig;
+    openai_compatible?: OpenAiCompatibleConfig;
+    vscode_task?: VSCodeTaskConfig;
+    antigravity?: AntigravityConfig;
+    agent_task_batch_size?: number;
+    parallel_workers?: number;
+    block_quota?: BlockQuotaConfig;
+    quota?: QuotaConfig;
+    observability?: ObservabilityConfig;
+    synthesis?: SynthesisConfig;
+    /** Per-analyzer resolution policy for the optional graph-enrichment pass. */
+    analyzers?: Record<string, AnalyzerSetting>;
+    /** Optional graph-enrichment tuning (Phase 4B edge reasoning). */
+    graph?: GraphConfig;
+    /** Dispatch fan-out controls (confirmation threshold, packet budget). */
+    dispatch?: DispatchConfig;
+    /** Optional design-review tuning (focused reading list budget). */
+    design_review?: DesignReviewConfig;
+    /**
+     * Confirmed provider pool persisted after Gate-0 confirmation. Carries the
+     * operator-validated set of available providers across the audit→remediate
+     * session (INV-S03). Typed as ConfirmedProviderPoolRef here to avoid a
+     * circular import; the full ConfirmedProviderPool type lives in
+     * providers/providerConfirmation.ts.
+     */
+    confirmed_provider_pool?: ConfirmedProviderPoolRef;
+}
+//# sourceMappingURL=sessionConfig.d.ts.map

package/dist/shared/types/sessionConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionConfig.d.ts","sourceRoot":"","sources":["../../../src/shared/types/sessionConfig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,eAAO,MAAM,cAAc,qJAUjB,CAAC;AACX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAC3D,MAAM,MAAM,oBAAoB,GAAG,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;AAEjE,eAAO,MAAM,gBAAgB,kCAAmC,CAAC;AACjE,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D,MAAM,WAAW,wBAAwB;IACvC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,4BAA4B,CAAC,EAAE,OAAO,CAAC;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,WAAW,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;IACtE,sJAAsJ;IACtJ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,sBAAsB;IACrC,yFAAyF;IACzF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iGAAiG;IACjG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8FAA8F;IAC9F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kGAAkG;IAClG,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,8FAA8F;IAC9F,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AAED,MAAM,WAAW,gBAAgB;IAC/B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED,eAAO,MAAM,qBAAqB;;;;;;;;CAQxB,CAAC;AAEX,MAAM,WAAW,gBAAgB;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,yBAAyB,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;IACjD,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,iBAAiB,6DAMpB,CAAC;AACX,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjE,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IACtC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;CACtC;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,OAAO,EAAE,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,eAAe,EAAE,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC,mBAAmB,CAAC,EAAE,wBAAwB,CAAC;IAC/C,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;IAC3C,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC5C,kEAAkE;IAClE,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,mEAAmE;IACnE,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,wBAAwB,CAAC;CACpD"}

package/dist/shared/types/sessionConfig.js

@@ -0,0 +1,44 @@
+export const PROVIDER_NAMES = [
+    "auto",
+    "local-subprocess",
+    "subprocess-template",
+    "claude-code",
+    "codex",
+    "opencode",
+    "openai-compatible",
+    "vscode-task",
+    "antigravity",
+];
+export const SESSION_UI_MODES = ["visible", "headless"];
+export const PROVIDER_SECTION_KEYS = {
+    "subprocess-template": "subprocess_template",
+    "claude-code": "claude_code",
+    codex: "codex",
+    opencode: "opencode",
+    "openai-compatible": "openai_compatible",
+    "vscode-task": "vscode_task",
+    antigravity: "antigravity",
+};
+/**
+ * Per-analyzer resolution policy for the optional graph-enrichment pass
+ * (`analyzers.<id>`). Resolution order is repo node_modules → version-keyed
+ * analyzer cache → (for `ephemeral`/`permanent`) install into the cache, else
+ * the regex floor.
+ *
+ * - `repo`     — use only the audited repo's node_modules; absent ⇒ regex floor.
+ * - `ephemeral`/`permanent` — resolve repo→cache, installing into the shared
+ *   cache if absent (never touches the audited project). `permanent` is a
+ *   durable opt-in; `ephemeral` is a one-time/per-need install. Both behave the
+ *   same for resolution.
+ * - `skip`     — never run this analyzer.
+ * - `auto`     — resolve repo→cache; if absent and the analyzer has in-scope
+ *   files, the conversation-first flow proposes an install. Unanswered ⇒ skip.
+ */
+export const ANALYZER_SETTINGS = [
+    "repo",
+    "ephemeral",
+    "permanent",
+    "skip",
+    "auto",
+];
+//# sourceMappingURL=sessionConfig.js.map

package/dist/shared/types/sessionConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionConfig.js","sourceRoot":"","sources":["../../../src/shared/types/sessionConfig.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,MAAM;IACN,kBAAkB;IAClB,qBAAqB;IACrB,aAAa;IACb,OAAO;IACP,UAAU;IACV,mBAAmB;IACnB,aAAa;IACb,aAAa;CACL,CAAC;AAIX,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,SAAS,EAAE,UAAU,CAAU,CAAC;AAyFjE,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,qBAAqB,EAAE,qBAAqB;IAC5C,aAAa,EAAE,aAAa;IAC5B,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,mBAAmB,EAAE,mBAAmB;IACxC,aAAa,EAAE,aAAa;IAC5B,WAAW,EAAE,aAAa;CAClB,CAAC;AAiHX;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,MAAM;IACN,WAAW;IACX,WAAW;IACX,MAAM;IACN,MAAM;CACE,CAAC"}

package/dist/shared/types/stepContract.d.ts

@@ -0,0 +1,10 @@
+import { z } from "zod";
+export declare const StepStatusSchema: z.ZodEnum<["ready", "blocked", "complete"]>;
+export type StepStatus = z.infer<typeof StepStatusSchema>;
+export declare const DispatchModelTierSchema: z.ZodEnum<["small", "standard", "deep"]>;
+export type DispatchModelTier = z.infer<typeof DispatchModelTierSchema>;
+export interface DispatchModelHint {
+    tier: DispatchModelTier;
+    reasons: string[];
+}
+//# sourceMappingURL=stepContract.d.ts.map

package/dist/shared/types/stepContract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stepContract.d.ts","sourceRoot":"","sources":["../../../src/shared/types/stepContract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,gBAAgB,6CAA2C,CAAC;AACzE,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,uBAAuB,0CAAwC,CAAC;AAC7E,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,iBAAiB,CAAC;IACxB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB"}

package/dist/shared/types/stepContract.js

@@ -0,0 +1,4 @@
+import { z } from "zod";
+export const StepStatusSchema = z.enum(["ready", "blocked", "complete"]);
+export const DispatchModelTierSchema = z.enum(["small", "standard", "deep"]);
+//# sourceMappingURL=stepContract.js.map

package/dist/shared/types/stepContract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stepContract.js","sourceRoot":"","sources":["../../../src/shared/types/stepContract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;AAGzE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC"}

package/dist/shared/types/surfaces.d.ts

@@ -0,0 +1,73 @@
+import { z } from "zod";
+export declare const SurfaceKindSchema: z.ZodEnum<["interface", "background"]>;
+export declare const SURFACE_KINDS: ["interface", "background"];
+export type SurfaceKind = z.infer<typeof SurfaceKindSchema>;
+/** Discovered execution surfaces that define where the product can be reached. */
+export declare const SurfaceRecordSchema: z.ZodObject<{
+    id: z.ZodString;
+    kind: z.ZodEnum<["interface", "background"]>;
+    entrypoint: z.ZodString;
+    exposure: z.ZodOptional<z.ZodEnum<["network", "local"]>>;
+    methods: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    notes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strict", z.ZodTypeAny, {
+    id: string;
+    kind: "interface" | "background";
+    entrypoint: string;
+    notes?: string[] | undefined;
+    exposure?: "network" | "local" | undefined;
+    methods?: string[] | undefined;
+}, {
+    id: string;
+    kind: "interface" | "background";
+    entrypoint: string;
+    notes?: string[] | undefined;
+    exposure?: "network" | "local" | undefined;
+    methods?: string[] | undefined;
+}>;
+export type SurfaceRecord = z.infer<typeof SurfaceRecordSchema>;
+/** Intake output that summarizes externally reachable product surfaces. */
+export declare const SurfaceManifestSchema: z.ZodObject<{
+    surfaces: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        kind: z.ZodEnum<["interface", "background"]>;
+        entrypoint: z.ZodString;
+        exposure: z.ZodOptional<z.ZodEnum<["network", "local"]>>;
+        methods: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        notes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strict", z.ZodTypeAny, {
+        id: string;
+        kind: "interface" | "background";
+        entrypoint: string;
+        notes?: string[] | undefined;
+        exposure?: "network" | "local" | undefined;
+        methods?: string[] | undefined;
+    }, {
+        id: string;
+        kind: "interface" | "background";
+        entrypoint: string;
+        notes?: string[] | undefined;
+        exposure?: "network" | "local" | undefined;
+        methods?: string[] | undefined;
+    }>, "many">;
+}, "strict", z.ZodTypeAny, {
+    surfaces: {
+        id: string;
+        kind: "interface" | "background";
+        entrypoint: string;
+        notes?: string[] | undefined;
+        exposure?: "network" | "local" | undefined;
+        methods?: string[] | undefined;
+    }[];
+}, {
+    surfaces: {
+        id: string;
+        kind: "interface" | "background";
+        entrypoint: string;
+        notes?: string[] | undefined;
+        exposure?: "network" | "local" | undefined;
+        methods?: string[] | undefined;
+    }[];
+}>;
+export type SurfaceManifest = z.infer<typeof SurfaceManifestSchema>;
+//# sourceMappingURL=surfaces.d.ts.map

package/dist/shared/types/surfaces.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"surfaces.d.ts","sourceRoot":"","sources":["../../../src/shared/types/surfaces.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,iBAAiB,wCAAsC,CAAC;AACrE,eAAO,MAAM,aAAa,6BAA4B,CAAC;AACvD,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,kFAAkF;AAClF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;EASrB,CAAC;AACZ,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,2EAA2E;AAC3E,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAIvB,CAAC;AACZ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC"}

package/dist/shared/types/surfaces.js

@@ -0,0 +1,21 @@
+import { z } from "zod";
+export const SurfaceKindSchema = z.enum(["interface", "background"]);
+export const SURFACE_KINDS = SurfaceKindSchema.options;
+/** Discovered execution surfaces that define where the product can be reached. */
+export const SurfaceRecordSchema = z
+    .object({
+    id: z.string(),
+    kind: SurfaceKindSchema,
+    entrypoint: z.string(),
+    exposure: z.enum(["network", "local"]).optional(),
+    methods: z.array(z.string()).optional(),
+    notes: z.array(z.string()).optional(),
+})
+    .strict();
+/** Intake output that summarizes externally reachable product surfaces. */
+export const SurfaceManifestSchema = z
+    .object({
+    surfaces: z.array(SurfaceRecordSchema),
+})
+    .strict();
+//# sourceMappingURL=surfaces.js.map

package/dist/shared/types/surfaces.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"surfaces.js","sourceRoot":"","sources":["../../../src/shared/types/surfaces.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC;AACrE,MAAM,CAAC,MAAM,aAAa,GAAG,iBAAiB,CAAC,OAAO,CAAC;AAGvD,kFAAkF;AAClF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,iBAAiB;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACtC,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,2EAA2E;AAC3E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;CACvC,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/shared/validation/basic.d.ts

@@ -0,0 +1,24 @@
+export type ValidationSeverity = "error" | "warning";
+export interface ValidationIssue {
+    path: string;
+    message: string;
+    severity: ValidationSeverity;
+}
+export declare function describeValue(value: unknown): string;
+export declare function isRecord(value: unknown): value is Record<string, unknown>;
+export declare function createValidationIssue(path: string, message: string, severity?: ValidationSeverity): ValidationIssue;
+export declare function pushValidationIssue(issues: ValidationIssue[], path: string, message: string, severity?: ValidationSeverity): void;
+/**
+ * Prepends `prefix` to the `path` of each issue.
+ *
+ * Idempotency guard: if an issue's path is already equal to `prefix` or already
+ * starts with `${prefix}.`, it is passed through unchanged. This makes the
+ * function safe to call on a mix of already-prefixed and unprefixed issues without
+ * producing double-prefixed paths.
+ *
+ * Empty paths become `prefix` with no separator.
+ */
+export declare function prefixValidationIssues(prefix: string, issues: ValidationIssue[]): ValidationIssue[];
+export declare function formatValidationIssues(issues: ValidationIssue[]): string;
+export declare function requireKeys(value: unknown, path: string, keys: readonly string[]): ValidationIssue[];
+//# sourceMappingURL=basic.d.ts.map

package/dist/shared/validation/basic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"basic.d.ts","sourceRoot":"","sources":["../../../src/shared/validation/basic.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,SAAS,CAAC;AAErD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,kBAAkB,CAAC;CAC9B;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAQpD;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,QAAQ,GAAE,kBAA4B,GACrC,eAAe,CAEjB;AAED,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,eAAe,EAAE,EACzB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,QAAQ,GAAE,kBAA4B,GACrC,IAAI,CAEN;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,eAAe,EAAE,GACxB,eAAe,EAAE,CAUnB;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,CAIxE;AAED,wBAAgB,WAAW,CACzB,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,eAAe,EAAE,CAiBnB"}

package/dist/shared/validation/basic.js

@@ -0,0 +1,57 @@
+export function describeValue(value) {
+    if (Array.isArray(value)) {
+        return "array";
+    }
+    if (value === null) {
+        return "null";
+    }
+    return typeof value;
+}
+export function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+export function createValidationIssue(path, message, severity = "error") {
+    return { path, message, severity };
+}
+export function pushValidationIssue(issues, path, message, severity = "error") {
+    issues.push(createValidationIssue(path, message, severity));
+}
+/**
+ * Prepends `prefix` to the `path` of each issue.
+ *
+ * Idempotency guard: if an issue's path is already equal to `prefix` or already
+ * starts with `${prefix}.`, it is passed through unchanged. This makes the
+ * function safe to call on a mix of already-prefixed and unprefixed issues without
+ * producing double-prefixed paths.
+ *
+ * Empty paths become `prefix` with no separator.
+ */
+export function prefixValidationIssues(prefix, issues) {
+    return issues.map((issue) => ({
+        ...issue,
+        path: issue.path.length === 0
+            ? prefix
+            : issue.path === prefix || issue.path.startsWith(`${prefix}.`)
+                ? issue.path
+                : `${prefix}.${issue.path}`,
+    }));
+}
+export function formatValidationIssues(issues) {
+    return issues
+        .map((issue) => `  [${issue.severity}] ${issue.path}: ${issue.message}`)
+        .join("\n");
+}
+export function requireKeys(value, path, keys) {
+    const issues = [];
+    if (!isRecord(value)) {
+        pushValidationIssue(issues, path, `Expected an object, got ${describeValue(value)}.`);
+        return issues;
+    }
+    for (const key of keys) {
+        if (!(key in value)) {
+            pushValidationIssue(issues, path, `Missing required key: ${key}`);
+        }
+    }
+    return issues;
+}
+//# sourceMappingURL=basic.js.map

package/dist/shared/validation/basic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"basic.js","sourceRoot":"","sources":["../../../src/shared/validation/basic.ts"],"names":[],"mappings":"AAQA,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,OAAO,KAAK,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,IAAY,EACZ,OAAe,EACf,WAA+B,OAAO;IAEtC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,MAAyB,EACzB,IAAY,EACZ,OAAe,EACf,WAA+B,OAAO;IAEtC,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAc,EACd,MAAyB;IAEzB,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5B,GAAG,KAAK;QACR,IAAI,EACF,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YACrB,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC;gBAC5D,CAAC,CAAC,KAAK,CAAC,IAAI;gBACZ,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE;KAClC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAyB;IAC9D,OAAO,MAAM;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;SACvE,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,KAAc,EACd,IAAY,EACZ,IAAuB;IAEvB,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,mBAAmB,CACjB,MAAM,EACN,IAAI,EACJ,2BAA2B,aAAa,CAAC,KAAK,CAAC,GAAG,CACnD,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC;YACpB,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,yBAAyB,GAAG,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/shared/validation/findingGrounding.d.ts

@@ -0,0 +1,45 @@
+import type { Finding, FindingGrounding } from "../types/finding.js";
+/** Normalize text for content-matching: drop CR, collapse whitespace, trim. */
+export declare function normalizeForMatch(text: string): string;
+/**
+ * Repo-relative, separator- and case-normalized path for matching against a
+ * known-paths set: trim, backslash→slash, strip a leading `./`, lowercase.
+ *
+ * The single path normalizer (drift-plan P7) shared by the conceptual-review
+ * grounding and any other consumer that matches a cited `affected_files` path
+ * against a repo manifest. (Quote-and-verify resolves a cited path against the
+ * filesystem instead, so it does not lowercase — see `verifyFindingGrounding`.)
+ */
+export declare function normalizeRepoPath(p: string): string;
+/**
+ * True when the (normalized) quoted span appears anywhere in the (normalized)
+ * file content. An empty quote never matches (an empty quote grounds nothing).
+ */
+export declare function quoteMatches(fileContent: string, quotedText: string): boolean;
+/** Reads a source file's text; injectable so the verifier is testable without fs. */
+export type SourceReader = (absolutePath: string) => Promise<string>;
+/**
+ * Re-verify a finding's cited verbatim span(s) against disk. A finding is
+ * `grounded` as soon as ONE of its `affected_files[].quoted_text` spans matches
+ * its cited file; it is `ungrounded` when it carries no quote at all, or when no
+ * cited quote can be found on disk (with a reason naming the failed spans).
+ */
+export declare function verifyFindingGrounding(repoRoot: string, finding: Finding, readSource?: SourceReader): Promise<FindingGrounding>;
+/**
+ * INV-GND-02 (total function): classify a finding's grounding as a verdict that
+ * is ALWAYS defined. A finding whose `grounding` is undefined/absent is treated
+ * as **ungrounded** — it was never re-verified, so it must be verified before a
+ * fix is applied, never silently trusted. This is the single authority the
+ * remediator consults on the structured-audit path so a missing verdict can
+ * never be mistaken for a passing one.
+ */
+export declare function findingIsGrounded(finding: Pick<Finding, "grounding">): boolean;
+/**
+ * True when a finding must be verified-before-fix because it was NOT positively
+ * grounded: `ungrounded` (quote didn't re-verify), `refuted` (anchor disproved —
+ * normally already quarantined-excluded upstream), or no verdict at all
+ * (undefined → treated as ungrounded, INV-GND-02). The remediator uses this to
+ * flag such findings for a verify-first pass rather than blindly applying the fix.
+ */
+export declare function findingNeedsVerificationBeforeFix(finding: Pick<Finding, "grounding">): boolean;
+//# sourceMappingURL=findingGrounding.d.ts.map

package/dist/shared/validation/findingGrounding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"findingGrounding.d.ts","sourceRoot":"","sources":["../../../src/shared/validation/findingGrounding.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAErE,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAI7E;AAED,qFAAqF;AACrF,MAAM,MAAM,YAAY,GAAG,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAKrE;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,OAAO,EAChB,UAAU,GAAE,YAAkC,GAC7C,OAAO,CAAC,gBAAgB,CAAC,CA+B3B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,OAAO,CAE9E;AAED;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,GAClC,OAAO,CAET"}