npm - audit-tools - Versions diffs - 0.55.10 → 0.55.12 - Mend

audit-tools 0.55.10 → 0.55.12

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (52) hide show

package/dist/shared/decompose/contentCoherence.js CHANGED Viewed

@@ -195,23 +195,35 @@ function normalizeRelationshipEvidence(value, itemIds) {
     return evidenceByPair;
 }
 function intersects(left, right) {
-    const values = new Set(left);
-    return right.some((entry) => values.has(entry));
+    const smaller = left.size <= right.size ? left : right;
+    const larger = smaller === left ? right : left;
+    for (const entry of smaller) {
+        if (larger.has(entry))
+            return true;
+    }
+    return false;
 }
 function parentDirectory(path) {
     const slash = path.lastIndexOf("/");
     return slash < 0 ? "" : path.slice(0, slash);
 }
+function indexEvidence(item) {
+    return {
+        filePaths: new Set(item.file_paths),
+        directories: new Set(item.file_paths.map(parentDirectory)),
+        unitIds: new Set(item.unit_ids),
+        tags: new Set(item.tags),
+        criticalFlowIds: new Set(item.critical_flow_ids ?? []),
+    };
+}
 function directEvidence(left, right) {
-    const leftDirectories = left.file_paths.map(parentDirectory);
-    const rightDirectories = right.file_paths.map(parentDirectory);
     return {
         call_import_reference_adjacency: false,
-        same_directory: intersects(leftDirectories, rightDirectories),
-        shared_critical_flow: intersects(left.critical_flow_ids ?? [], right.critical_flow_ids ?? []),
-        shared_file: intersects(left.file_paths, right.file_paths),
+        same_directory: intersects(left.directories, right.directories),
+        shared_critical_flow: intersects(left.criticalFlowIds, right.criticalFlowIds),
+        shared_file: intersects(left.filePaths, right.filePaths),
         shared_semantic_tag_or_same_lens: intersects(left.tags, right.tags),
-        shared_unit: intersects(left.unit_ids, right.unit_ids),
+        shared_unit: intersects(left.unitIds, right.unitIds),
     };
 }
 function scoreEvidence(evidence) {
@@ -304,6 +316,10 @@ export function buildContentCoherenceTrace(input, policy) {
     const normalizedItems = normalizeItems(input.items);
     const itemIds = new Set(normalizedItems.map((item) => item.id));
     const relationshipEvidence = normalizeRelationshipEvidence(input.relationships, itemIds);
+    // sites-pinned: tests/shared/content-coherence.test.ts
+    // Index only after item and relationship validation, preserving first errors.
+    // Each item's five sets and parent directories are built once per invocation.
+    const evidenceIndexes = normalizedItems.map(indexEvidence);
     // Only ELIGIBLE pairs are retained. The ineligible majority (82% of pairs on
     // the 3,194-finding dogfood run) can affect nothing downstream — union-find
     // consumes eligibility alone — so materializing the full O(N²) pair layer was
@@ -315,7 +331,7 @@ export function buildContentCoherenceTrace(input, policy) {
         for (let rightIndex = leftIndex + 1; rightIndex < normalizedItems.length; rightIndex += 1) {
             const left = normalizedItems[leftIndex];
             const right = normalizedItems[rightIndex];
-            const evidence = directEvidence(left, right);
+            const evidence = directEvidence(evidenceIndexes[leftIndex], evidenceIndexes[rightIndex]);
             // Captured BEFORE relationship evidence is folded in — the conjunctive
             // policy must read only what the items themselves assert.
             const direct = {

package/dist/shared/decompose/contentCoherence.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"contentCoherence.js","sourceRoot":"","sources":["../../../src/shared/decompose/contentCoherence.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EACL,cAAc,EACd,OAAO,EACP,gBAAgB,GAEjB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC,MAAM,CAAC;IACpD,+BAA+B,EAAE,EAAE;IACnC,cAAc,EAAE,EAAE;IAClB,oBAAoB,EAAE,EAAE;IACxB,WAAW,EAAE,GAAG;IAChB,gCAAgC,EAAE,EAAE;IACpC,WAAW,EAAE,EAAE;CACP,CAAC,CAAC;AAEZ,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAgC9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAA2B,MAAM,CAAC,MAAM,CAAC;IAC9E,WAAW,EAAE,0BAA0B;IACvC,sBAAsB,EAAE,KAAK;CAC9B,CAAC,CAAC;AAEH,yFAAyF;AACzF,MAAM,CAAC,MAAM,8BAA8B,GAA2B,MAAM,CAAC,MAAM,CAAC;IAClF,WAAW,EAAE,2BAA2B;IACxC,sBAAsB,EAAE,IAAI;CAC7B,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEhC;;;;GAIG;AACH,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAkEjC,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC;KAClD,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC/B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACzB,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAClD,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACzC,MAAM,CAAC;IACN,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,oCAAoC,CAAC;IAC/D,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;CACzC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,iBAAiB,GAEnB,MAAM,CAAC,MAAM,CAAC;IAChB,aAAa,EAAE,iCAAiC;IAChD,oBAAoB,EAAE,aAAa;IACnC,QAAQ,EAAE,gBAAgB;IAC1B,SAAS,EAAE,sBAAsB;IACjC,SAAS,EAAE,kCAAkC;IAC7C,SAAS,EAAE,aAAa;IACxB,WAAW,EAAE,aAAa;CAC3B,CAAC,CAAC;AAEH,SAAS,aAAa,CACpB,KAAc,EACd,KAAa,EACb,MAAc,EACd,YAAuC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;IAEvD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,KAAK,KAAK,oBAAoB,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,KAAK,KAAK,IAAI,KAAK,qBAAqB,CAC1E,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc,EAAE,MAAc;IACzD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO;IAChC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,kCAAkC,CACpE,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,iBAAiB,IAAI,mBAAmB,CAC1E,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACvC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,mCAAmC,KAAK,qBAAqB,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,mCAAmC,KAAK,mBAAmB,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,wCAAwC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;QACxE,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,mBAAmB,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;QACjD,MAAM,UAAU,GAAmC;YACjD,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,UAAU,EAAE,aAAa,CACvB,KAAK,CAAC,UAAU,EAChB,YAAY,EACZ,KAAK,CAAC,EAAE,EACR,WAAW,CACZ;YACD,QAAQ,EAAE,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC;YAC7D,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;SAClD,CAAC;QACF,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAC1C,UAAU,CAAC,iBAAiB,GAAG,aAAa,CAC1C,KAAK,CAAC,iBAAiB,EACvB,mBAAmB,EACnB,KAAK,CAAC,EAAE,CACT,CAAC;QACJ,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,KAAa;IAChD,OAAO,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,KAAa;IAC1C,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,6BAA6B,CACpC,KAAc,EACd,OAA4B;IAE5B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,GAAG,EAG3B,CAAC;IACJ,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,2CAA2C,KAAK,qBAAqB,CACtE,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CACb,2CAA2C,KAAK,0BAA0B,CAC3E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CACb,wDAAwD,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,KAAK,IAAI,CACxF,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,yDAAyD,KAAK,CAAC,IAAI,IAAI,CACxE,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,iBAAiB,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,KAAK,CACb,gDAAgD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CACvE,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;QACtD,QAAQ,CAAC,GAAG,CACV,iBAAiB,CAAC,KAAK,CAAC,IAAwC,CAAC,CAClE,CAAC;QACF,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,SAAS,UAAU,CAAC,IAAuB,EAAE,KAAwB;IACnE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7B,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,cAAc,CACrB,IAAoC,EACpC,KAAqC;IAErC,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC7D,MAAM,gBAAgB,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC/D,OAAO;QACL,+BAA+B,EAAE,KAAK;QACtC,cAAc,EAAE,UAAU,CAAC,eAAe,EAAE,gBAAgB,CAAC;QAC7D,oBAAoB,EAAE,UAAU,CAC9B,IAAI,CAAC,iBAAiB,IAAI,EAAE,EAC5B,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAC9B;QACD,WAAW,EAAE,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC;QAC1D,gCAAgC,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC;QACnE,WAAW,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC;KACvD,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,QAAkC;IACvD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAEnE,EAAE,CAAC;QACF,IAAI,QAAQ,CAAC,IAAI,CAAC;YAAE,KAAK,IAAI,MAAM,CAAC;IACtC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAgBD,SAAS,UAAU,CACjB,MAAuB,EACvB,KAAa,EACb,MAA8B;IAE9B,OAAO,MAAM,CAAC,WAAW,KAAK,2BAA2B;QACvD,CAAC,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ;QACtC,CAAC,CAAC,KAAK,IAAI,2BAA2B,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,sBAAsB,CAC7B,OAA0B,EAC1B,UAAyC;IAEzC,IAAI,OAAO,CAAC,MAAM,IAAI,sBAAsB;QAAE,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG;QACZ,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC;QACnB,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YACpC,CAAC,EAAE,SAAS,CAAC,IAAI;YACjB,CAAC,EAAE,SAAS,CAAC,KAAK;YAClB,MAAM,EAAE,SAAS,CAAC,KAAK;SACxB,CAAC,CAAC;KACJ,CAAC;IACF,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;IACvD,MAAM,KAAK,GAAc,IAAI,GAAG,CAC9B,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAU,CAAC,CACrD,CAAC;IACF,+EAA+E;IAC/E,8EAA8E;IAC9E,0EAA0E;IAC1E,0EAA0E;IAC1E,6CAA6C;IAC7C,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACnC,IACE,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,qBAAqB,CAAC;QACvD,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,qBAAqB,CAAC,EACpD,CAAC;QACD,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAoB,CAAC;IAChD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC;QACjD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,QAAQ,CAAC,MAA2B,EAAE,EAAU;IACvD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IAClC,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAsD,EACtD,MAA8B;IAE9B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,oBAAoB,GAAG,6BAA6B,CACxD,KAAK,CAAC,aAAa,EACnB,OAAO,CACR,CAAC;IACF,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,qEAAqE;IACrE,MAAM,kBAAkB,GAAyB,EAAE,CAAC;IAEpD,KAAK,IAAI,SAAS,GAAG,CAAC,EAAE,SAAS,GAAG,eAAe,CAAC,MAAM,EAAE,SAAS,IAAI,CAAC,EAAE,CAAC;QAC3E,KACE,IAAI,UAAU,GAAG,SAAS,GAAG,CAAC,EAC9B,UAAU,GAAG,eAAe,CAAC,MAAM,EACnC,UAAU,IAAI,CAAC,EACf,CAAC;YACD,MAAM,IAAI,GAAG,eAAe,CAAC,SAAS,CAAE,CAAC;YACzC,MAAM,KAAK,GAAG,eAAe,CAAC,UAAU,CAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC7C,uEAAuE;YACvE,0DAA0D;YAC1D,MAAM,MAAM,GAAoB;gBAC9B,UAAU,EAAE,QAAQ,CAAC,WAAW;gBAChC,QAAQ,EAAE,QAAQ,CAAC,gCAAgC;aACpD,CAAC;YACF,KAAK,MAAM,IAAI,IAAI,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC9E,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;YACxB,CAAC;YACD,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC;gBAAE,SAAS;YACjD,kBAAkB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAED,kBAAkB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACtC,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAChE,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1D,OAAO,SAAS,KAAK,CAAC;YACpB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1E,KAAK,MAAM,SAAS,IAAI,kBAAkB,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,QAAQ,KAAK,SAAS;YAAE,SAAS;QACrC,MAAM,IAAI,GACR,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QACpE,MAAM,KAAK,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;QACvD,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtB,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC;IACD,sEAAsE;IACtE,sEAAsE;IACtE,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAgC,CAAC;IACjE,IAAI,MAAM,CAAC,sBAAsB,EAAE,CAAC;QAClC,KAAK,MAAM,SAAS,IAAI,kBAAkB,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACvB,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CACtC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAU,CACrE,CAAC;IACF,MAAM,UAAU,GAAG,CACjB,MAAM,CAAC,sBAAsB;QAC3B,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CACjC,sBAAsB,CAAC,OAAO,EAAE,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAClE;QACH,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CACzC;SACE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;SACrD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACpB,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAChD,CAAC;IAEJ,OAAO;QACL,gBAAgB,EAAE,eAAe;QACjC,UAAU;KACX,CAAC;AACJ,CAAC"}
1	+ {"version":3,"file":"contentCoherence.js","sourceRoot":"","sources":["../../../src/shared/decompose/contentCoherence.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EACL,cAAc,EACd,OAAO,EACP,gBAAgB,GAEjB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC,MAAM,CAAC;IACpD,+BAA+B,EAAE,EAAE;IACnC,cAAc,EAAE,EAAE;IAClB,oBAAoB,EAAE,EAAE;IACxB,WAAW,EAAE,GAAG;IAChB,gCAAgC,EAAE,EAAE;IACpC,WAAW,EAAE,EAAE;CACP,CAAC,CAAC;AAEZ,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAgC9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAA2B,MAAM,CAAC,MAAM,CAAC;IAC9E,WAAW,EAAE,0BAA0B;IACvC,sBAAsB,EAAE,KAAK;CAC9B,CAAC,CAAC;AAEH,yFAAyF;AACzF,MAAM,CAAC,MAAM,8BAA8B,GAA2B,MAAM,CAAC,MAAM,CAAC;IAClF,WAAW,EAAE,2BAA2B;IACxC,sBAAsB,EAAE,IAAI;CAC7B,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEhC;;;;GAIG;AACH,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAkEjC,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC;KAClD,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC/B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACzB,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAClD,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACzC,MAAM,CAAC;IACN,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,oCAAoC,CAAC;IAC/D,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;CACzC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,iBAAiB,GAEnB,MAAM,CAAC,MAAM,CAAC;IAChB,aAAa,EAAE,iCAAiC;IAChD,oBAAoB,EAAE,aAAa;IACnC,QAAQ,EAAE,gBAAgB;IAC1B,SAAS,EAAE,sBAAsB;IACjC,SAAS,EAAE,kCAAkC;IAC7C,SAAS,EAAE,aAAa;IACxB,WAAW,EAAE,aAAa;CAC3B,CAAC,CAAC;AAEH,SAAS,aAAa,CACpB,KAAc,EACd,KAAa,EACb,MAAc,EACd,YAAuC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;IAEvD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,KAAK,KAAK,oBAAoB,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,KAAK,KAAK,IAAI,KAAK,qBAAqB,CAC1E,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc,EAAE,MAAc;IACzD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO;IAChC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,kCAAkC,CACpE,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,iBAAiB,IAAI,mBAAmB,CAC1E,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACvC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,mCAAmC,KAAK,qBAAqB,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,mCAAmC,KAAK,mBAAmB,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,wCAAwC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;QACxE,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,mBAAmB,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;QACjD,MAAM,UAAU,GAAmC;YACjD,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,UAAU,EAAE,aAAa,CACvB,KAAK,CAAC,UAAU,EAChB,YAAY,EACZ,KAAK,CAAC,EAAE,EACR,WAAW,CACZ;YACD,QAAQ,EAAE,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC;YAC7D,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;SAClD,CAAC;QACF,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAC1C,UAAU,CAAC,iBAAiB,GAAG,aAAa,CAC1C,KAAK,CAAC,iBAAiB,EACvB,mBAAmB,EACnB,KAAK,CAAC,EAAE,CACT,CAAC;QACJ,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,KAAa;IAChD,OAAO,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,KAAa;IAC1C,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,6BAA6B,CACpC,KAAc,EACd,OAA4B;IAE5B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,GAAG,EAG3B,CAAC;IACJ,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,2CAA2C,KAAK,qBAAqB,CACtE,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CACb,2CAA2C,KAAK,0BAA0B,CAC3E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CACb,wDAAwD,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,KAAK,IAAI,CACxF,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,yDAAyD,KAAK,CAAC,IAAI,IAAI,CACxE,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,iBAAiB,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,KAAK,CACb,gDAAgD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CACvE,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;QACtD,QAAQ,CAAC,GAAG,CACV,iBAAiB,CAAC,KAAK,CAAC,IAAwC,CAAC,CAClE,CAAC;QACF,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAYD,SAAS,UAAU,CAAC,IAAyB,EAAE,KAA0B;IACvE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;IACvD,MAAM,MAAM,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IACrC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,aAAa,CAAC,IAAoC;IACzD,OAAO;QACL,SAAS,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC;QACnC,WAAW,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC1D,OAAO,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC/B,IAAI,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;QACxB,eAAe,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC;KACvD,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,IAA4B,EAC5B,KAA6B;IAE7B,OAAO;QACL,+BAA+B,EAAE,KAAK;QACtC,cAAc,EAAE,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC;QAC/D,oBAAoB,EAAE,UAAU,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,eAAe,CAAC;QAC7E,WAAW,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC;QACxD,gCAAgC,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC;QACnE,WAAW,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC;KACrD,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,QAAkC;IACvD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAEnE,EAAE,CAAC;QACF,IAAI,QAAQ,CAAC,IAAI,CAAC;YAAE,KAAK,IAAI,MAAM,CAAC;IACtC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAgBD,SAAS,UAAU,CACjB,MAAuB,EACvB,KAAa,EACb,MAA8B;IAE9B,OAAO,MAAM,CAAC,WAAW,KAAK,2BAA2B;QACvD,CAAC,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ;QACtC,CAAC,CAAC,KAAK,IAAI,2BAA2B,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,sBAAsB,CAC7B,OAA0B,EAC1B,UAAyC;IAEzC,IAAI,OAAO,CAAC,MAAM,IAAI,sBAAsB;QAAE,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG;QACZ,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC;QACnB,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YACpC,CAAC,EAAE,SAAS,CAAC,IAAI;YACjB,CAAC,EAAE,SAAS,CAAC,KAAK;YAClB,MAAM,EAAE,SAAS,CAAC,KAAK;SACxB,CAAC,CAAC;KACJ,CAAC;IACF,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;IACvD,MAAM,KAAK,GAAc,IAAI,GAAG,CAC9B,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAU,CAAC,CACrD,CAAC;IACF,+EAA+E;IAC/E,8EAA8E;IAC9E,0EAA0E;IAC1E,0EAA0E;IAC1E,6CAA6C;IAC7C,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACnC,IACE,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,qBAAqB,CAAC;QACvD,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,qBAAqB,CAAC,EACpD,CAAC;QACD,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAoB,CAAC;IAChD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC;QACjD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,QAAQ,CAAC,MAA2B,EAAE,EAAU;IACvD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IAClC,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAsD,EACtD,MAA8B;IAE9B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,oBAAoB,GAAG,6BAA6B,CACxD,KAAK,CAAC,aAAa,EACnB,OAAO,CACR,CAAC;IACF,uDAAuD;IACvD,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,eAAe,GAAG,eAAe,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC3D,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,qEAAqE;IACrE,MAAM,kBAAkB,GAAyB,EAAE,CAAC;IAEpD,KAAK,IAAI,SAAS,GAAG,CAAC,EAAE,SAAS,GAAG,eAAe,CAAC,MAAM,EAAE,SAAS,IAAI,CAAC,EAAE,CAAC;QAC3E,KACE,IAAI,UAAU,GAAG,SAAS,GAAG,CAAC,EAC9B,UAAU,GAAG,eAAe,CAAC,MAAM,EACnC,UAAU,IAAI,CAAC,EACf,CAAC;YACD,MAAM,IAAI,GAAG,eAAe,CAAC,SAAS,CAAE,CAAC;YACzC,MAAM,KAAK,GAAG,eAAe,CAAC,UAAU,CAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,cAAc,CAC7B,eAAe,CAAC,SAAS,CAAE,EAC3B,eAAe,CAAC,UAAU,CAAE,CAC7B,CAAC;YACF,uEAAuE;YACvE,0DAA0D;YAC1D,MAAM,MAAM,GAAoB;gBAC9B,UAAU,EAAE,QAAQ,CAAC,WAAW;gBAChC,QAAQ,EAAE,QAAQ,CAAC,gCAAgC;aACpD,CAAC;YACF,KAAK,MAAM,IAAI,IAAI,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC9E,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;YACxB,CAAC;YACD,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC;gBAAE,SAAS;YACjD,kBAAkB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAED,kBAAkB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACtC,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAChE,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1D,OAAO,SAAS,KAAK,CAAC;YACpB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1E,KAAK,MAAM,SAAS,IAAI,kBAAkB,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,QAAQ,KAAK,SAAS;YAAE,SAAS;QACrC,MAAM,IAAI,GACR,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QACpE,MAAM,KAAK,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;QACvD,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtB,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC;IACD,sEAAsE;IACtE,sEAAsE;IACtE,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAgC,CAAC;IACjE,IAAI,MAAM,CAAC,sBAAsB,EAAE,CAAC;QAClC,KAAK,MAAM,SAAS,IAAI,kBAAkB,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACvB,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CACtC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAU,CACrE,CAAC;IACF,MAAM,UAAU,GAAG,CACjB,MAAM,CAAC,sBAAsB;QAC3B,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CACjC,sBAAsB,CAAC,OAAO,EAAE,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAClE;QACH,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CACzC;SACE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;SACrD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACpB,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAChD,CAAC;IAEJ,OAAO;QACL,gBAAgB,EAAE,eAAe;QACjC,UAAU;KACX,CAAC;AACJ,CAAC"}

package/dist/shared/io/schemaVersion.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"schemaVersion.d.ts","sourceRoot":"","sources":["../../../src/shared/io/schemaVersion.ts"],"names":[],"mappings":"~~AAAA~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH;;;;GAIG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;aAEjC,YAAY,EAAE,MAAM;aACpB,QAAQ,EAAE,MAAM;aAChB,MAAM,EAAE,MAAM;gBAFd,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM;~~CASjC~~;AAsCD;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAAC,CAAC,SAAS,MAAM,EAC7D,KAAK,EAAE,CAAC,GAAG,SAAS,GAAG,IAAI,EAC3B,QAAQ,EAAE,MAAM,GACf,CAAC,GAAG,SAAS,CAGf;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EAChC,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GACf,IAAI,CASN"}
1	+ {"version":3,"file":"schemaVersion.d.ts","sourceRoot":"","sources":["../../../src/shared/io/schemaVersion.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH;;;;GAIG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;aAEjC,YAAY,EAAE,MAAM;aACpB,QAAQ,EAAE,MAAM;aAChB,MAAM,EAAE,MAAM;gBAFd,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM;CAUjC;AAsCD;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAAC,CAAC,SAAS,MAAM,EAC7D,KAAK,EAAE,CAAC,GAAG,SAAS,GAAG,IAAI,EAC3B,QAAQ,EAAE,MAAM,GACf,CAAC,GAAG,SAAS,CAGf;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EAChC,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GACf,IAAI,CASN"}

package/dist/shared/io/schemaVersion.js CHANGED Viewed

@@ -1,3 +1,4 @@
+// sites-pinned: tests/shared/schema-version-read-policy.test.ts, tests/remediate/store.test.ts
 /**
  * Schema-version read policy — the two directions, named so the choice is
  * unmissable at the call site.
@@ -41,7 +42,8 @@ export class SchemaVersionMismatchError extends Error {
     constructor(artifactName, expected, actual) {
         super(`Artifact "${artifactName}" has schema_version "${actual}" but expected "${expected}". ` +
             `This likely means the artifact was produced by an incompatible version of this tool. ` +
-            `Delete ${artifactName} from the artifacts directory to regenerate it.`);
+            `Preserve this artifact; do not delete it. Back up the run before recovery, ` +
+            `then use a compatible tool version or an explicitly supported migration.`);
         this.artifactName = artifactName;
         this.expected = expected;
         this.actual = actual;

package/dist/shared/io/schemaVersion.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"schemaVersion.js","sourceRoot":"","sources":["../../../src/shared/io/schemaVersion.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH;;;;GAIG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAEjC;IACA;IACA;IAHlB,YACkB,YAAoB,EACpB,QAAgB,EAChB,MAAc;QAE9B,KAAK,CACH,aAAa,YAAY,yBAAyB,MAAM,mBAAmB,QAAQ,KAAK;YACtF,uFAAuF;YACvF,~~UAAU~~,~~YAAY~~,~~iDAAiD~~,~~CAC1E,~~CAAC;~~QARc~~,iBAAY,GAAZ,YAAY,CAAQ;QACpB,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAAQ;~~QAO9B~~,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,8EAA8E;AAC9E,6EAA6E;AAC7E,mEAAmE;AACnE,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,uEAAuE;AACvE,6EAA6E;AAC7E,yEAAyE;AACzE,qDAAqD;AACrD,EAAE;AACF,gFAAgF;AAChF,4EAA4E;AAC5E,+EAA+E;AAC/E,gFAAgF;AAChF,2EAA2E;AAC3E,gFAAgF;AAChF,gFAAgF;AAChF,8EAA8E;AAC9E,gEAAgE;AAChE,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,IAAI,gBAAgB,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,cAAc,CAAC;IAC7D,IAAI,kBAAkB,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC;IACjE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/E,MAAM,KAAK,GAAG,OAAkC,CAAC;QACjD,IAAI,gBAAgB,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,cAAc,CAAC;QAC3D,IAAI,kBAAkB,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,gBAAgB,CAAC;IACjE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,8BAA8B,CAC5C,KAA2B,EAC3B,QAAgB;IAEhB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,OAAO,cAAc,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAChE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAC1C,KAAgC,EAChC,YAAoB,EACpB,QAAgB;IAEhB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO;IAClD,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,0BAA0B,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,MAAM,IAAI,0BAA0B,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACvE,CAAC;AACH,CAAC"}
1	+ {"version":3,"file":"schemaVersion.js","sourceRoot":"","sources":["../../../src/shared/io/schemaVersion.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH;;;;GAIG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAEjC;IACA;IACA;IAHlB,YACkB,YAAoB,EACpB,QAAgB,EAChB,MAAc;QAE9B,KAAK,CACH,aAAa,YAAY,yBAAyB,MAAM,mBAAmB,QAAQ,KAAK;YACtF,uFAAuF;YACvF,6EAA6E;YAC7E,0EAA0E,CAC7E,CAAC;QATc,iBAAY,GAAZ,YAAY,CAAQ;QACpB,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAAQ;QAQ9B,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,8EAA8E;AAC9E,6EAA6E;AAC7E,mEAAmE;AACnE,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,uEAAuE;AACvE,6EAA6E;AAC7E,yEAAyE;AACzE,qDAAqD;AACrD,EAAE;AACF,gFAAgF;AAChF,4EAA4E;AAC5E,+EAA+E;AAC/E,gFAAgF;AAChF,2EAA2E;AAC3E,gFAAgF;AAChF,gFAAgF;AAChF,8EAA8E;AAC9E,gEAAgE;AAChE,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,IAAI,gBAAgB,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,cAAc,CAAC;IAC7D,IAAI,kBAAkB,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC;IACjE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/E,MAAM,KAAK,GAAG,OAAkC,CAAC;QACjD,IAAI,gBAAgB,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,cAAc,CAAC;QAC3D,IAAI,kBAAkB,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,gBAAgB,CAAC;IACjE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,8BAA8B,CAC5C,KAA2B,EAC3B,QAAgB;IAEhB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,OAAO,cAAc,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAChE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAC1C,KAAgC,EAChC,YAAoB,EACpB,QAAgB;IAEhB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO;IAClD,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,0BAA0B,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,MAAM,IAAI,0BAA0B,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACvE,CAAC;AACH,CAAC"}

package/dist/shared/tooling/allowlistedExec.d.ts CHANGED Viewed

@@ -1,7 +1,7 @@
 import { type OwnedProcessCleanup } from "./ownedProcessLifecycle.js";
 /** Default per-anchor wall-clock budget; a slower command is killed and inconclusive. */
 export declare const ALLOWLISTED_EXEC_TIMEOUT_MS = 60000;
-/** Read-only git subcommands an anchor may run (no checkout/reset/clean/push/…). */
+/** Read-only Git subcommands, derived from the grammar used for admission. */
 export declare const GIT_READONLY_SUBCOMMANDS: ReadonlySet<string>;
 /**
  * The set of executables the runner will auto-run, for callers that want to
@@ -14,7 +14,7 @@ export declare function executableBaseName(token: string): string;
  * The single authority for what the tool will auto-run on the model's behalf:
  * `command[0]` must be an allowlisted inspection-only executable, AND every
  * argument must satisfy that executable's default-deny argument policy (git:
- * read-only subcommand + no write/reconfigure option). Anything else → false.
+ * subcommand-specific grammar). Anything else → false.
  *
  * CRIT ARC-a06a3945: argument validation is the point — an allowed executable
  * carrying a code-exec/file-write flag (`rg --pre`, `ast-grep --rewrite`,
@@ -41,7 +41,7 @@ export interface AllowlistedExecOutcome {
      * True when the internal allowlist gate refused `command` BEFORE any spawn
      * was attempted (`isAllowedAnchorCommand` returned false) — a structured
      * refusal, never a spawn, never a throw. Distinct from `spawn_error` (which
-     * means a spawn WAS attempted and the OS failed to launch it): a refusal
+     * means trusted resolution or launching failed): a refusal
      * never touches the child_process API at all. Absent (not `false`) on every
      * outcome that reached a real spawn attempt.
      */
@@ -53,10 +53,10 @@ export type AllowlistedExecRunner = (command: string[], cwd: string, timeoutMs:
 /**
  * Spawn an allowlisted read-only command argv-only (never a shell), capturing
  * combined stdout+stderr (bounded). Strips the host-signalling env
- * (`stripAuditToolsControlEnv`), resolves the platform-correct argv via the shared
- * `resolveExecArgv`, and kills a command that exceeds `timeoutMs`
- * (SIGTERM→SIGKILL). The single runner both orchestrators use for the grounding
- * anchor pass.
+ * (`stripAuditToolsControlEnv`), resolves a trusted native executable outside
+ * the inspected worktree and caller cwd, and kills commands exceeding `timeoutMs`
+ * with bounded owned-process cleanup. This library entry point is shared by
+ * callers of the exported inspection API.
  *
  * INTERNAL GATE (invariants[2]): enforces {@link isAllowedAnchorCommand} on
  * itself, unconditionally, before ever spawning — `isAllowedAnchorCommand` is

package/dist/shared/tooling/allowlistedExec.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"allowlistedExec.d.ts","sourceRoot":"","sources":["../../../src/shared/tooling/allowlistedExec.ts"],"names":[],"mappings":"~~AAgCA~~,OAAO,EAAmD,KAAK,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEvH,yFAAyF;AACzF,eAAO,MAAM,2BAA2B,QAAS,CAAC;~~AA6IlD~~,~~oFAAoF~~;~~AACpF~~,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,MAAM,~~CAUvD~~,CAAC;~~AAkBH~~;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAG/C,CAAC;AAEH,qFAAqF;AACrF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQxD;~~AA8DD~~;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,~~CASjE~~;~~AAED~~,iFAAiF;AACjF,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,oFAAoF;IACpF,OAAO,CAAC,EAAE,mBAAmB,CAAC;CAC/B;AAED,MAAM,MAAM,qBAAqB,GAAG,CAClC,OAAO,EAAE,MAAM,EAAE,EACjB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,KACd,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAErC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,6BAA6B,EAAE,~~qBAkF3C~~,CAAC"}
1	+ {"version":3,"file":"allowlistedExec.d.ts","sourceRoot":"","sources":["../../../src/shared/tooling/allowlistedExec.ts"],"names":[],"mappings":"AAoCA,OAAO,EAAmD,KAAK,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEvH,yFAAyF;AACzF,eAAO,MAAM,2BAA2B,QAAS,CAAC;AAiLlD,8EAA8E;AAC9E,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,MAAM,CAAgC,CAAC;AAE1F;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAG/C,CAAC;AAEH,qFAAqF;AACrF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQxD;AAsFD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAYjE;AAwFD,iFAAiF;AACjF,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,oFAAoF;IACpF,OAAO,CAAC,EAAE,mBAAmB,CAAC;CAC/B;AAED,MAAM,MAAM,qBAAqB,GAAG,CAClC,OAAO,EAAE,MAAM,EAAE,EACjB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,KACd,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAErC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,6BAA6B,EAAE,qBA4F3C,CAAC"}

package/dist/shared/tooling/allowlistedExec.js CHANGED Viewed

@@ -4,13 +4,12 @@
  * allowlist — single source for both orchestrators (drift-plan E2; CRIT
  * ARC-a06a3945).
  *
- * The auditor's executable-anchor pass (S7 tier-2) runs *model-authored* commands
- * at ingest to confirm/refute behavior claims. That is a trust surface: the tool
- * spawns whatever the model wrote. The earlier guard checked only `command[0]`
- * (the executable) against an allowlist and waved every argument through, so
- * `rg --pre <cmd>` (preprocessor exec), `rg --search-zip`, `ast-grep --rewrite`
- * (file write), a non-read-only `git` option, etc. slipped past — arbitrary
- * code-exec / file-writes at ingest.
+ * Exported inspection-command library boundary. There are currently no in-tree
+ * production callers. Admission rejects paths and flags outside declared policies;
+ * execution resolves a trusted native identity outside the inspected worktree
+ * and caller cwd. Git and ripgrep receive fixed configuration protections.
+ * Other tools retain their existing argument policies; this is no general
+ * sandbox or claim about Madge configuration trust.
  *
  * This module replaces that denylist posture with a **default-deny allowlist of
  * arguments**: each allowed executable declares the exact set of flags it may
@@ -22,14 +21,19 @@
  *
  * SAFETY of the runner: commands run only via `runAllowlistedReadOnlyCommand`,
  * which spawns argv-only (never a shell), under a timeout, with the
- * wrapper-only control env stripped (`stripAuditToolsControlEnv`), platform-resolved via the
- * shared `resolveExecArgv`, and SIGTERM→SIGKILL on timeout. The runner ENFORCES
+ * wrapper-only control env stripped (`stripAuditToolsControlEnv`), a trusted
+ * native executable identity, and bounded owned-process cleanup. It ENFORCES
  * `isAllowedAnchorCommand` on itself, unconditionally, before ever spawning
  * (invariants[2]) — a caller-side pre-check is only an OPTIONAL fast path,
  * never the sole guarantee: correctness must not rest on every call site
  * remembering to gate first.
  */
-import { resolveExecArgv, stripAuditToolsControlEnv } from "./exec.js";
+import { accessSync, constants, existsSync, realpathSync, statSync } from "node:fs";
+import { delimiter, dirname, isAbsolute, join, resolve } from "node:path";
+import { devNull } from "node:os";
+import { stripAuditToolsControlEnv } from "./exec.js";
+import { resolveExecutableFile } from "./resolveExecutable.js";
+import { resolveWithinRoot } from "../io/pathContainment.js";
 import { beginOwnedProcessTermination, spawnOwnedProcess } from "./ownedProcessLifecycle.js";
 /** Default per-anchor wall-clock budget; a slower command is killed and inconclusive. */
 export const ALLOWLISTED_EXEC_TIMEOUT_MS = 60_000;
@@ -37,9 +41,10 @@ export const ALLOWLISTED_EXEC_TIMEOUT_MS = 60_000;
 const MAX_CAPTURED_OUTPUT = 256 * 1024;
 /**
  * The inspection-only executables a model-authored anchor may invoke, each with
- * the explicit set of flags it may carry. Every listed flag is read-only: it
- * cannot write a file, execute a sub-process/preprocessor, or decompress
- * arbitrary input. Deliberately ABSENT (so default-deny refuses them):
+ * the explicit set of flags it may carry. These historical policies do not
+ * establish configuration/subcommand safety for every analyzer: Madge config
+ * modules and ast-grep positional subcommands/config discovery remain separate
+ * review scopes. Deliberately ABSENT (so default-deny refuses them):
  *   - ripgrep:  --pre / --pre-glob (run a preprocessor), --search-zip / -z
  *               (decompress), --hostname-bin, -o is fine (only-matching) but
  *               --files-from style file reads are omitted out of caution.
@@ -83,7 +88,7 @@ const ARG_POLICIES = new Map([
                 "--hidden", "--no-ignore", "--color", "--colors", "-H", "--with-filename",
                 "--no-filename", "--no-heading", "--heading", "-U", "--multiline",
                 "--multiline-dotall", "-P", "--pcre2", "--json", "--vimgrep", "-0",
-                "--null", "-m", "--max-count", "--max-depth", "--maxdepth",
+                "--null", "-m", "--max-count", "--max-depth", "--maxdepth", "--no-config",
             ]),
             allowPositionals: true,
         },
@@ -103,7 +108,7 @@ const ARG_POLICIES = new Map([
                 "--hidden", "--no-ignore", "--color", "--colors", "-H", "--with-filename",
                 "--no-filename", "--no-heading", "--heading", "-U", "--multiline",
                 "--multiline-dotall", "-P", "--pcre2", "--json", "--vimgrep", "-0",
-                "--null", "-m", "--max-count", "--max-depth", "--maxdepth",
+                "--null", "-m", "--max-count", "--max-depth", "--maxdepth", "--no-config",
             ]),
             allowPositionals: true,
         },
@@ -121,7 +126,7 @@ const ARG_POLICIES = new Map([
     [
         "madge",
         {
-            // Read-only dependency analysis: circular detection, orphans, JSON. The
+            // Dependency-reporting flags; config modules remain a separate trust surface. The
             // image/dot/svg output-writing flags are absent → refused.
             flags: new Set([
                 "--circular", "-c", "--orphans", "--leaves", "--summary", "-s",
@@ -134,8 +139,8 @@ const ARG_POLICIES = new Map([
     [
         "ast-grep",
         {
-            // Structural search only. --rewrite/-r/--update-all/-U/--interactive/-i
-            // (all of which edit files) are absent → refused. `run`/`scan` are positional.
+            // Known editing flags are absent. Positional subcommands and configuration/
+            // native parser discovery remain separate review scopes.
             flags: new Set([
                 "-p", "--pattern", "-l", "--lang", "--language", "--json", "--globs",
                 "-A", "--after", "-B", "--before", "-C", "--context", "--heading",
@@ -157,33 +162,33 @@ const ARG_POLICIES = new Map([
         },
     ],
 ]);
-/** Read-only git subcommands an anchor may run (no checkout/reset/clean/push/…). */
-export const GIT_READONLY_SUBCOMMANDS = new Set([
-    "grep",
-    "log",
-    "diff",
-    "show",
-    "ls-files",
-    "cat-file",
-    "blame",
-    "rev-parse",
-    "status",
-]);
+const nonempty = value => value.length > 0 && !value.startsWith("-");
+const count = value => /^\d+$/.test(value);
+const anyPositionals = () => true;
+const gitFlags = (zero, values = []) => new Map([...zero.map(flag => [flag, null]), ...values]);
+const diffFlags = ["--stat", "--numstat", "--shortstat", "--name-only", "--name-status", "--patch", "-p", "--no-patch", "-s", "--raw", "--check", "--no-renames", "--no-ext-diff", "--no-textconv", "--exit-code", "--quiet", "-w", "--ignore-all-space", "--ignore-space-change", "--no-color"];
+const logValues = [["-n", count], ["--max-count", count], ["--skip", count], ["--since", nonempty], ["--until", nonempty], ["--author", nonempty], ["--grep", nonempty]];
 /**
- * git flags that write a file or otherwise escape read-only inspection, refused
- * even on a read-only subcommand. `-o`/`--output` write to a file; `-c`,
- * `--exec-path`, `--config-env` reconfigure git arbitrarily (incl. running
- * pagers/externals). Anything in this set, anywhere in the argv, refuses.
+ * Small per-subcommand grammar, not Git's complete CLI. Exact flag names only;
+ * null means zero operands, a predicate means one required operand. Required
+ * short operands may be attached; long operands may use '='. Short clusters,
+ * abbreviations and arbitrary pretty formats are omitted. Optional-value Git
+ * flags require an explicit '=' value when included (equalsOnly).
+ * '--' ends option parsing only for commands with path positionals.
  */
-const GIT_REFUSED_OPTIONS = new Set([
-    "-o",
-    "--output",
-    "-c",
-    "--exec-path",
-    "--config-env",
-    "--upload-pack",
-    "--receive-pack",
+const GIT_POLICIES = new Map([
+    ["grep", { flags: gitFlags(["-n", "--line-number", "-i", "--ignore-case", "-I", "-l", "--files-with-matches", "-c", "--count", "-w", "--word-regexp", "-v", "--invert-match", "-E", "--extended-regexp", "-F", "--fixed-strings", "--cached", "--no-index", "--full-name", "--no-textconv"], [["-e", nonempty], ["-A", count], ["-B", count], ["-C", count]]), paths: true, positionals: (values, flags) => flags.has("-e") || values.length > 0 }],
+    ["log", { flags: gitFlags([...diffFlags, "--oneline", "--decorate", "--no-decorate", "--all", "--reverse", "--first-parent", "--no-merges", "--merges", "--follow"], [...logValues, ["-U", count]]), paths: true, positionals: anyPositionals }],
+    ["diff", { flags: gitFlags(diffFlags, [["-U", count], ["--unified", count]]), paths: true, positionals: anyPositionals }],
+    ["show", { flags: gitFlags([...diffFlags, "--oneline"], [["-U", count], ["--unified", count]]), paths: true, positionals: anyPositionals }],
+    ["ls-files", { flags: gitFlags(["-z", "--cached", "-c", "--deleted", "-d", "--modified", "-m", "--others", "-o", "--ignored", "-i", "--exclude-standard", "--stage", "-s", "--unmerged", "-u", "--full-name"]), paths: true, positionals: anyPositionals }],
+    ["cat-file", { flags: gitFlags(["-p", "-t", "-s", "-e"]), paths: false, positionals: (values, flags) => values.length === 1 && flags.size === 1 }],
+    ["blame", { flags: gitFlags(["--porcelain", "--line-porcelain", "--incremental", "-w", "--show-email", "-e", "--root", "--no-textconv"], [["-L", value => /^\d+(?:,\d+)?$/.test(value)]]), paths: true, positionals: values => values.length >= 1 && values.length <= 2 }],
+    ["rev-parse", { flags: gitFlags(["--verify", "--short", "--abbrev-ref", "--symbolic-full-name", "--is-inside-work-tree", "--show-toplevel", "--show-prefix", "--git-dir", "--is-bare-repository"]), paths: false, positionals: values => values.length <= 1 }],
+    ["status", { flags: gitFlags(["--short", "-s", "--branch", "-b", "--porcelain", "-z", "--no-renames"], [["--untracked-files", value => ["no", "normal", "all"].includes(value)]]), equalsOnly: new Set(["--untracked-files"]), paths: true, positionals: anyPositionals }],
 ]);
+/** Read-only Git subcommands, derived from the grammar used for admission. */
+export const GIT_READONLY_SUBCOMMANDS = new Set(GIT_POLICIES.keys());
 /**
  * The set of executables the runner will auto-run, for callers that want to
  * display the allowlist. Derived from the per-executable policies plus git.
@@ -246,32 +251,64 @@ function isAllowedNonGitCommand(args, policy) {
     }
     return true;
 }
-/**
- * Validate a git command: the first positional must be a read-only subcommand,
- * and no token (before OR after the subcommand) may be a write/reconfigure
- * option from {@link GIT_REFUSED_OPTIONS}. A `-c key=val` style reconfiguration
- * before the subcommand is refused, as is an `--output=file` on `git log`.
- */
+const GIT_GLOBAL_FLAGS = new Set(["--no-pager", "--no-optional-locks", "--literal-pathspecs"]);
+function gitSubcommandIndex(args) {
+    let index = 0;
+    while (GIT_GLOBAL_FLAGS.has(args[index]))
+        index++;
+    return index;
+}
+/** Default-deny Git grammar; positionals after '--' are never reparsed. */
 function isAllowedGitCommand(args) {
-    let subcommand;
-    for (const arg of args) {
-        if (typeof arg !== "string")
+    const sub = gitSubcommandIndex(args);
+    const policy = GIT_POLICIES.get(args[sub]);
+    if (!policy)
+        return false;
+    const positionals = [];
+    const flags = new Set();
+    let pathsOnly = false;
+    for (let index = sub + 1; index < args.length; index++) {
+        const arg = args[index];
+        if (pathsOnly || !arg.startsWith("-")) {
+            positionals.push(arg);
+            continue;
+        }
+        if (arg === "--") {
+            if (!policy.paths)
+                return false;
+            pathsOnly = true;
+            continue;
+        }
+        const equals = arg.startsWith("--") ? arg.indexOf("=") : -1;
+        let name = equals < 0 ? arg : arg.slice(0, equals);
+        let value = equals < 0 ? undefined : arg.slice(equals + 1);
+        if (!policy.flags.has(name) && /^-[^-].+/.test(arg)) {
+            name = arg.slice(0, 2);
+            value = arg.slice(2);
+        }
+        if (!policy.flags.has(name))
             return false;
-        if (GIT_REFUSED_OPTIONS.has(flagName(arg)))
+        if (policy.equalsOnly?.has(name) && equals < 0)
             return false;
-        if (subcommand === undefined && !arg.startsWith("-")) {
-            subcommand = arg.trim().toLowerCase();
+        const validate = policy.flags.get(name);
+        if (validate === null) {
+            if (value !== undefined)
+                return false;
         }
+        else {
+            value ??= args[++index];
+            if (value === undefined || !validate(value))
+                return false;
+        }
+        flags.add(name);
     }
-    if (subcommand === undefined)
-        return false;
-    return GIT_READONLY_SUBCOMMANDS.has(subcommand);
+    return policy.positionals(positionals, flags);
 }
 /**
  * The single authority for what the tool will auto-run on the model's behalf:
  * `command[0]` must be an allowlisted inspection-only executable, AND every
  * argument must satisfy that executable's default-deny argument policy (git:
- * read-only subcommand + no write/reconfigure option). Anything else → false.
+ * subcommand-specific grammar). Anything else → false.
  *
  * CRIT ARC-a06a3945: argument validation is the point — an allowed executable
  * carrying a code-exec/file-write flag (`rg --pre`, `ast-grep --rewrite`,
@@ -279,8 +316,12 @@ function isAllowedGitCommand(args) {
  */
 export function isAllowedAnchorCommand(command) {
     const exe = command[0];
-    if (typeof exe !== "string" || exe.trim() === "")
+    if (typeof exe !== "string" || !/^[a-zA-Z0-9.-]+$/.test(exe))
         return false;
+    for (const arg of command) {
+        if (typeof arg !== "string" || /[\x00-\x1f\x7f]/.test(arg))
+            return false;
+    }
     const base = executableBaseName(exe);
     const args = command.slice(1);
     if (base === "git")
@@ -290,13 +331,117 @@ export function isAllowedAnchorCommand(command) {
         return false;
     return isAllowedNonGitCommand(args, policy);
 }
+/** Discover the enclosing worktree without executing repository config. */
+function inspectionRoot(cwd) {
+    let path = realpathSync(cwd);
+    const initial = path;
+    let bareRoot;
+    for (;;) {
+        if (existsSync(join(path, ".git")))
+            return path;
+        // Metadata inside a normal worktree also resembles a bare repository.
+        // Keep searching for the enclosing worktree before using this fallback.
+        if (existsSync(join(path, "HEAD")) && existsSync(join(path, "objects")) && existsSync(join(path, "refs")))
+            bareRoot ??= path;
+        const parent = dirname(path);
+        if (parent === path)
+            return bareRoot ?? initial;
+        path = parent;
+    }
+}
+/**
+ * Inspection-specific installation trust: absolute physical PATH directories and
+ * final executable targets outside the inspected worktree and caller cwd only.
+ * The general resolver retains its normal relative/empty PATH semantics.
+ * Windows uses native EXE/COM only, never PATHEXT, CMD/BAT or ComSpec fallback.
+ * Host-managed installations outside those roots are trusted, not sandboxed;
+ * this does not protect against concurrent executable replacement.
+ */
+function inspectionExecutable(base, cwd) {
+    const roots = [inspectionRoot(cwd), realpathSync(process.cwd())];
+    const env = stripAuditToolsControlEnv();
+    const pathKey = Object.keys(env).find(key => process.platform === "win32" ? key.toUpperCase() === "PATH" : key === "PATH");
+    const directories = [];
+    for (let entry of (pathKey ? env[pathKey] ?? "" : "").split(delimiter)) {
+        if (process.platform === "win32" && entry.startsWith('"') && entry.endsWith('"'))
+            entry = entry.slice(1, -1);
+        if (!isAbsolute(entry) || roots.some(root => resolveWithinRoot(root, resolve(entry)) !== null))
+            continue;
+        try {
+            const physical = realpathSync(entry);
+            if (statSync(physical).isDirectory() && !roots.some(root => resolveWithinRoot(root, physical) !== null))
+                directories.push(physical);
+        }
+        catch { /* Missing PATH entries cannot establish trusted identity. */ }
+    }
+    for (const key of Object.keys(env)) {
+        if (key.toUpperCase() === "PATH" || key.toUpperCase() === "PATHEXT")
+            delete env[key];
+    }
+    env.PATH = directories.join(delimiter);
+    if (process.platform === "win32")
+        env.PATHEXT = ".EXE;.COM";
+    const file = resolveExecutableFile(base, {
+        cwd, env,
+        executableFile: candidate => {
+            try {
+                if (!statSync(candidate).isFile())
+                    return null;
+                if (process.platform !== "win32")
+                    accessSync(candidate, constants.X_OK);
+                const physical = realpathSync(candidate);
+                if (process.platform === "win32" && !/\.(exe|com)$/i.test(physical))
+                    return null;
+                return roots.some(root => resolveWithinRoot(root, physical) !== null) ? null : physical;
+            }
+            catch {
+                return null;
+            }
+        },
+    });
+    if (!file)
+        throw new Error("No trusted native inspection executable found for " + base);
+    return { file, env };
+}
+/**
+ * Git >=2.45 is required by the fixed --no-lazy-fetch global flag: older Git
+ * rejects that flag before repository setup/subcommand execution. This also
+ * excludes old Git's interpretation of core.fsmonitor=false as a hook path.
+ * https://github.com/git/git/blob/v2.45.1/git.c (handle_options)
+ * https://git-scm.com/docs/git-config#Documentation/git-config.txt-corefsmonitor
+ */
+function inspectionGit(args, env) {
+    for (const key of Object.keys(env))
+        if (key.toUpperCase().startsWith("GIT_"))
+            delete env[key];
+    Object.assign(env, {
+        GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_SYSTEM: process.platform === "win32" ? "NUL" : devNull,
+        GIT_CONFIG_GLOBAL: process.platform === "win32" ? "NUL" : devNull,
+        GIT_PAGER: "cat", GIT_TERMINAL_PROMPT: "0", GIT_OPTIONAL_LOCKS: "0", GIT_NO_LAZY_FETCH: "1",
+    });
+    const index = gitSubcommandIndex(args);
+    const sub = args[index];
+    const fixed = ["--no-lazy-fetch", "--no-pager", "--no-optional-locks", "--literal-pathspecs"];
+    for (const config of [
+        "core.fsmonitor=false", "core.pager=cat", "log.showSignature=false",
+        "format.pretty=format:%h %s", "submodule.recurse=false",
+        "diff.submodule=short", "status.submoduleSummary=false",
+    ])
+        fixed.push("-c", config);
+    const protections = ["log", "show", "diff"].includes(sub) ? ["--no-ext-diff", "--no-textconv"] : [];
+    if (["diff", "status"].includes(sub))
+        protections.push("--ignore-submodules=all");
+    if (["grep", "blame"].includes(sub))
+        protections.push("--no-textconv");
+    return [...fixed, sub, ...protections, ...args.slice(index + 1)];
+}
 /**
  * Spawn an allowlisted read-only command argv-only (never a shell), capturing
  * combined stdout+stderr (bounded). Strips the host-signalling env
- * (`stripAuditToolsControlEnv`), resolves the platform-correct argv via the shared
- * `resolveExecArgv`, and kills a command that exceeds `timeoutMs`
- * (SIGTERM→SIGKILL). The single runner both orchestrators use for the grounding
- * anchor pass.
+ * (`stripAuditToolsControlEnv`), resolves a trusted native executable outside
+ * the inspected worktree and caller cwd, and kills commands exceeding `timeoutMs`
+ * with bounded owned-process cleanup. This library entry point is shared by
+ * callers of the exported inspection API.
  *
  * INTERNAL GATE (invariants[2]): enforces {@link isAllowedAnchorCommand} on
  * itself, unconditionally, before ever spawning — `isAllowedAnchorCommand` is
@@ -325,7 +470,20 @@ export const runAllowlistedReadOnlyCommand = (command, cwd, timeoutMs) => {
     return new Promise((resolvePromise) => {
         let owned;
         try {
-            owned = spawnOwnedProcess(resolveExecArgv(command), { cwd, env: stripAuditToolsControlEnv(), deadlineAt: Date.now() + Math.max(1, Number.isFinite(timeoutMs) ? timeoutMs : 1) });
+            const base = executableBaseName(command[0]);
+            const { file, env } = inspectionExecutable(base, cwd);
+            let args = command.slice(1);
+            if (base === "git")
+                args = inspectionGit(args, env);
+            else if (base === "rg" || base === "ripgrep") {
+                // Fixed before pattern/path operands, even if a caller uses '--'.
+                // https://github.com/BurntSushi/ripgrep/blob/master/GUIDE.md#configuration-file
+                for (const key of Object.keys(env))
+                    if (key.toUpperCase() === "RIPGREP_CONFIG_PATH")
+                        delete env[key];
+                args = ["--no-config", ...args];
+            }
+            owned = spawnOwnedProcess([file, ...args], { cwd, env, deadlineAt: Date.now() + Math.max(1, Number.isFinite(timeoutMs) ? timeoutMs : 1) });
         }
         catch (error) {
             resolvePromise({ exit_code: null, timed_out: false, output: "", spawn_error: error instanceof Error ? error.message : String(error) });