codictator 0.0.0-stage → 0.1.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (835) hide show
  1. package/LICENSE +9 -0
  2. package/README.md +4 -2
  3. package/dist/builtin-packs/core/fixtures/agent-assets-present/passing/basic/case.json +10 -0
  4. package/dist/builtin-packs/core/fixtures/agent-assets-present/violating/basic/case.json +10 -0
  5. package/dist/builtin-packs/core/fixtures/arch-boundaries/passing/basic/case.json +10 -0
  6. package/dist/builtin-packs/core/fixtures/arch-boundaries/violating/basic/case.json +10 -0
  7. package/dist/builtin-packs/core/fixtures/arch-module-mapped/passing/basic/case.json +10 -0
  8. package/dist/builtin-packs/core/fixtures/arch-module-mapped/violating/basic/case.json +10 -0
  9. package/dist/builtin-packs/core/fixtures/arch-module-size/passing/basic/case.json +10 -0
  10. package/dist/builtin-packs/core/fixtures/arch-module-size/violating/basic/case.json +10 -0
  11. package/dist/builtin-packs/core/fixtures/arch-no-cycles/passing/basic/case.json +10 -0
  12. package/dist/builtin-packs/core/fixtures/arch-no-cycles/violating/basic/case.json +10 -0
  13. package/dist/builtin-packs/core/fixtures/arch-profile-declared/passing/basic/case.json +10 -0
  14. package/dist/builtin-packs/core/fixtures/arch-profile-declared/violating/basic/case.json +10 -0
  15. package/dist/builtin-packs/core/fixtures/arch-public-entry/passing/basic/case.json +10 -0
  16. package/dist/builtin-packs/core/fixtures/arch-public-entry/violating/basic/case.json +10 -0
  17. package/dist/builtin-packs/core/fixtures/branch-protection/passing/basic/case.json +10 -0
  18. package/dist/builtin-packs/core/fixtures/branch-protection/violating/basic/case.json +10 -0
  19. package/dist/builtin-packs/core/fixtures/bug-registry/passing/basic/case.json +10 -0
  20. package/dist/builtin-packs/core/fixtures/bug-registry/violating/basic/case.json +10 -0
  21. package/dist/builtin-packs/core/fixtures/bug-rows-immutable/passing/basic/case.json +10 -0
  22. package/dist/builtin-packs/core/fixtures/bug-rows-immutable/violating/basic/case.json +10 -0
  23. package/dist/builtin-packs/core/fixtures/ci-actions-pinned/passing/basic/case.json +10 -0
  24. package/dist/builtin-packs/core/fixtures/ci-actions-pinned/violating/basic/case.json +10 -0
  25. package/dist/builtin-packs/core/fixtures/ci-present/passing/basic/case.json +10 -0
  26. package/dist/builtin-packs/core/fixtures/ci-present/violating/basic/case.json +10 -0
  27. package/dist/builtin-packs/core/fixtures/ci-required-check/passing/basic/case.json +10 -0
  28. package/dist/builtin-packs/core/fixtures/ci-required-check/violating/basic/case.json +10 -0
  29. package/dist/builtin-packs/core/fixtures/compiler-strict/passing/basic/case.json +10 -0
  30. package/dist/builtin-packs/core/fixtures/compiler-strict/violating/basic/case.json +10 -0
  31. package/dist/builtin-packs/core/fixtures/complexity/passing/basic/case.json +10 -0
  32. package/dist/builtin-packs/core/fixtures/complexity/violating/basic/case.json +10 -0
  33. package/dist/builtin-packs/core/fixtures/context-hard-band/passing/basic/case.json +10 -0
  34. package/dist/builtin-packs/core/fixtures/context-hard-band/violating/basic/case.json +10 -0
  35. package/dist/builtin-packs/core/fixtures/context-soft-band/passing/basic/case.json +10 -0
  36. package/dist/builtin-packs/core/fixtures/context-soft-band/violating/basic/case.json +10 -0
  37. package/dist/builtin-packs/core/fixtures/conventional-commit/passing/basic/case.json +10 -0
  38. package/dist/builtin-packs/core/fixtures/conventional-commit/violating/basic/case.json +10 -0
  39. package/dist/builtin-packs/core/fixtures/coverage-floor/passing/basic/case.json +10 -0
  40. package/dist/builtin-packs/core/fixtures/coverage-floor/violating/basic/case.json +10 -0
  41. package/dist/builtin-packs/core/fixtures/custom-pack-selftest/passing/basic/case.json +10 -0
  42. package/dist/builtin-packs/core/fixtures/custom-pack-selftest/violating/basic/case.json +10 -0
  43. package/dist/builtin-packs/core/fixtures/dangerous-shell/passing/basic/case.json +10 -0
  44. package/dist/builtin-packs/core/fixtures/dangerous-shell/violating/basic/case.json +10 -0
  45. package/dist/builtin-packs/core/fixtures/dead-code/passing/basic/case.json +10 -0
  46. package/dist/builtin-packs/core/fixtures/dead-code/violating/basic/case.json +10 -0
  47. package/dist/builtin-packs/core/fixtures/dep-exact-pin/passing/basic/case.json +10 -0
  48. package/dist/builtin-packs/core/fixtures/dep-exact-pin/violating/basic/case.json +10 -0
  49. package/dist/builtin-packs/core/fixtures/dep-latest-stable/passing/basic/case.json +10 -0
  50. package/dist/builtin-packs/core/fixtures/dep-latest-stable/violating/basic/case.json +10 -0
  51. package/dist/builtin-packs/core/fixtures/dep-license/passing/basic/case.json +10 -0
  52. package/dist/builtin-packs/core/fixtures/dep-license/violating/basic/case.json +10 -0
  53. package/dist/builtin-packs/core/fixtures/dep-lockfile/passing/basic/case.json +10 -0
  54. package/dist/builtin-packs/core/fixtures/dep-lockfile/violating/basic/case.json +10 -0
  55. package/dist/builtin-packs/core/fixtures/dep-new-needs-reason/passing/basic/case.json +10 -0
  56. package/dist/builtin-packs/core/fixtures/dep-new-needs-reason/violating/basic/case.json +10 -0
  57. package/dist/builtin-packs/core/fixtures/dep-no-deprecated/passing/basic/case.json +10 -0
  58. package/dist/builtin-packs/core/fixtures/dep-no-deprecated/violating/basic/case.json +10 -0
  59. package/dist/builtin-packs/core/fixtures/dep-no-vulnerable/passing/basic/case.json +10 -0
  60. package/dist/builtin-packs/core/fixtures/dep-no-vulnerable/violating/basic/case.json +10 -0
  61. package/dist/builtin-packs/core/fixtures/dep-one-per-capability/passing/basic/case.json +10 -0
  62. package/dist/builtin-packs/core/fixtures/dep-one-per-capability/violating/basic/case.json +10 -0
  63. package/dist/builtin-packs/core/fixtures/diagnose-before-fix/passing/basic/case.json +10 -0
  64. package/dist/builtin-packs/core/fixtures/diagnose-before-fix/violating/basic/case.json +10 -0
  65. package/dist/builtin-packs/core/fixtures/doc-breadth/passing/basic/case.json +10 -0
  66. package/dist/builtin-packs/core/fixtures/doc-breadth/violating/basic/case.json +10 -0
  67. package/dist/builtin-packs/core/fixtures/doc-density/passing/basic/case.json +10 -0
  68. package/dist/builtin-packs/core/fixtures/doc-density/violating/basic/case.json +10 -0
  69. package/dist/builtin-packs/core/fixtures/doc-links-valid/passing/basic/case.json +10 -0
  70. package/dist/builtin-packs/core/fixtures/doc-links-valid/violating/basic/case.json +10 -0
  71. package/dist/builtin-packs/core/fixtures/doc-no-corpus-counts/passing/basic/case.json +10 -0
  72. package/dist/builtin-packs/core/fixtures/doc-no-corpus-counts/violating/basic/case.json +10 -0
  73. package/dist/builtin-packs/core/fixtures/doc-no-inline-changelog/passing/basic/case.json +10 -0
  74. package/dist/builtin-packs/core/fixtures/doc-no-inline-changelog/violating/basic/case.json +10 -0
  75. package/dist/builtin-packs/core/fixtures/doc-one-level/passing/basic/case.json +10 -0
  76. package/dist/builtin-packs/core/fixtures/doc-one-level/violating/basic/case.json +10 -0
  77. package/dist/builtin-packs/core/fixtures/doc-placement/passing/basic/case.json +10 -0
  78. package/dist/builtin-packs/core/fixtures/doc-placement/violating/basic/case.json +10 -0
  79. package/dist/builtin-packs/core/fixtures/doc-router-leaf/passing/basic/case.json +10 -0
  80. package/dist/builtin-packs/core/fixtures/doc-router-leaf/violating/basic/case.json +10 -0
  81. package/dist/builtin-packs/core/fixtures/doc-single-owner/passing/basic/case.json +10 -0
  82. package/dist/builtin-packs/core/fixtures/doc-single-owner/violating/basic/case.json +10 -0
  83. package/dist/builtin-packs/core/fixtures/doc-size/passing/basic/case.json +10 -0
  84. package/dist/builtin-packs/core/fixtures/doc-size/violating/basic/case.json +10 -0
  85. package/dist/builtin-packs/core/fixtures/duplication/passing/basic/case.json +10 -0
  86. package/dist/builtin-packs/core/fixtures/duplication/violating/basic/case.json +10 -0
  87. package/dist/builtin-packs/core/fixtures/engine-version-match/passing/basic/case.json +10 -0
  88. package/dist/builtin-packs/core/fixtures/engine-version-match/violating/basic/case.json +10 -0
  89. package/dist/builtin-packs/core/fixtures/file-naming/passing/basic/case.json +10 -0
  90. package/dist/builtin-packs/core/fixtures/file-naming/violating/basic/case.json +10 -0
  91. package/dist/builtin-packs/core/fixtures/file-size/passing/basic/case.json +10 -0
  92. package/dist/builtin-packs/core/fixtures/file-size/violating/basic/case.json +10 -0
  93. package/dist/builtin-packs/core/fixtures/function-size/passing/basic/case.json +10 -0
  94. package/dist/builtin-packs/core/fixtures/function-size/violating/basic/case.json +10 -0
  95. package/dist/builtin-packs/core/fixtures/graph-before-scan/passing/basic/case.json +10 -0
  96. package/dist/builtin-packs/core/fixtures/graph-before-scan/violating/basic/case.json +10 -0
  97. package/dist/builtin-packs/core/fixtures/guardrail-manifest/passing/basic/case.json +10 -0
  98. package/dist/builtin-packs/core/fixtures/guardrail-manifest/violating/basic/case.json +10 -0
  99. package/dist/builtin-packs/core/fixtures/history-append-only/passing/basic/case.json +10 -0
  100. package/dist/builtin-packs/core/fixtures/history-append-only/violating/basic/case.json +10 -0
  101. package/dist/builtin-packs/core/fixtures/history-entry/passing/basic/case.json +10 -0
  102. package/dist/builtin-packs/core/fixtures/history-entry/violating/basic/case.json +10 -0
  103. package/dist/builtin-packs/core/fixtures/history-entry-complete/passing/basic/case.json +10 -0
  104. package/dist/builtin-packs/core/fixtures/history-entry-complete/violating/basic/case.json +10 -0
  105. package/dist/builtin-packs/core/fixtures/hooks-active/passing/basic/case.json +10 -0
  106. package/dist/builtin-packs/core/fixtures/hooks-active/violating/basic/case.json +10 -0
  107. package/dist/builtin-packs/core/fixtures/loop-breaker/passing/basic/case.json +10 -0
  108. package/dist/builtin-packs/core/fixtures/loop-breaker/violating/basic/case.json +10 -0
  109. package/dist/builtin-packs/core/fixtures/max-file-bytes/passing/basic/case.json +10 -0
  110. package/dist/builtin-packs/core/fixtures/max-file-bytes/violating/basic/case.json +10 -0
  111. package/dist/builtin-packs/core/fixtures/mcp-declared/passing/basic/case.json +10 -0
  112. package/dist/builtin-packs/core/fixtures/mcp-declared/violating/basic/case.json +10 -0
  113. package/dist/builtin-packs/core/fixtures/no-assertion-loss/passing/basic/case.json +10 -0
  114. package/dist/builtin-packs/core/fixtures/no-assertion-loss/violating/basic/case.json +10 -0
  115. package/dist/builtin-packs/core/fixtures/no-baseline-raise/passing/basic/case.json +10 -0
  116. package/dist/builtin-packs/core/fixtures/no-baseline-raise/violating/basic/case.json +10 -0
  117. package/dist/builtin-packs/core/fixtures/no-bypass/passing/basic/case.json +10 -0
  118. package/dist/builtin-packs/core/fixtures/no-bypass/violating/basic/case.json +10 -0
  119. package/dist/builtin-packs/core/fixtures/no-fixture-shrink/passing/basic/case.json +10 -0
  120. package/dist/builtin-packs/core/fixtures/no-fixture-shrink/violating/basic/case.json +10 -0
  121. package/dist/builtin-packs/core/fixtures/no-guard-removal/passing/basic/case.json +10 -0
  122. package/dist/builtin-packs/core/fixtures/no-guard-removal/violating/basic/case.json +10 -0
  123. package/dist/builtin-packs/core/fixtures/no-new-suppressions/passing/basic/case.json +10 -0
  124. package/dist/builtin-packs/core/fixtures/no-new-suppressions/violating/basic/case.json +10 -0
  125. package/dist/builtin-packs/core/fixtures/no-secret-reads/passing/basic/case.json +10 -0
  126. package/dist/builtin-packs/core/fixtures/no-secret-reads/violating/basic/case.json +10 -0
  127. package/dist/builtin-packs/core/fixtures/no-secrets/passing/basic/case.json +10 -0
  128. package/dist/builtin-packs/core/fixtures/no-secrets/violating/basic/case.json +10 -0
  129. package/dist/builtin-packs/core/fixtures/no-skipped-tests/passing/basic/case.json +10 -0
  130. package/dist/builtin-packs/core/fixtures/no-skipped-tests/violating/basic/case.json +10 -0
  131. package/dist/builtin-packs/core/fixtures/no-speculative-abstraction/passing/basic/case.json +10 -0
  132. package/dist/builtin-packs/core/fixtures/no-speculative-abstraction/violating/basic/case.json +10 -0
  133. package/dist/builtin-packs/core/fixtures/no-threshold-lowering/passing/basic/case.json +10 -0
  134. package/dist/builtin-packs/core/fixtures/no-threshold-lowering/violating/basic/case.json +10 -0
  135. package/dist/builtin-packs/core/fixtures/perf-budgets/passing/basic/case.json +10 -0
  136. package/dist/builtin-packs/core/fixtures/perf-budgets/violating/basic/case.json +10 -0
  137. package/dist/builtin-packs/core/fixtures/ratchet-touched-improves/passing/basic/case.json +10 -0
  138. package/dist/builtin-packs/core/fixtures/ratchet-touched-improves/violating/basic/case.json +10 -0
  139. package/dist/builtin-packs/core/fixtures/read-dedupe/passing/basic/case.json +10 -0
  140. package/dist/builtin-packs/core/fixtures/read-dedupe/violating/basic/case.json +10 -0
  141. package/dist/builtin-packs/core/fixtures/red-before-green/passing/basic/case.json +10 -0
  142. package/dist/builtin-packs/core/fixtures/red-before-green/violating/basic/case.json +10 -0
  143. package/dist/builtin-packs/core/fixtures/regression-test-for-fix/passing/basic/case.json +10 -0
  144. package/dist/builtin-packs/core/fixtures/regression-test-for-fix/violating/basic/case.json +10 -0
  145. package/dist/builtin-packs/core/fixtures/remediation-step-size/passing/basic/case.json +10 -0
  146. package/dist/builtin-packs/core/fixtures/remediation-step-size/violating/basic/case.json +10 -0
  147. package/dist/builtin-packs/core/fixtures/repo-hygiene/passing/basic/case.json +10 -0
  148. package/dist/builtin-packs/core/fixtures/repo-hygiene/violating/basic/case.json +10 -0
  149. package/dist/builtin-packs/core/fixtures/review-gate/passing/basic/case.json +10 -0
  150. package/dist/builtin-packs/core/fixtures/review-gate/violating/basic/case.json +10 -0
  151. package/dist/builtin-packs/core/fixtures/review-round-cap/passing/basic/case.json +10 -0
  152. package/dist/builtin-packs/core/fixtures/review-round-cap/violating/basic/case.json +10 -0
  153. package/dist/builtin-packs/core/fixtures/session-tool-call-limit/passing/basic/case.json +10 -0
  154. package/dist/builtin-packs/core/fixtures/session-tool-call-limit/violating/basic/case.json +10 -0
  155. package/dist/builtin-packs/core/fixtures/spec-trace/passing/basic/case.json +10 -0
  156. package/dist/builtin-packs/core/fixtures/spec-trace/violating/basic/case.json +10 -0
  157. package/dist/builtin-packs/core/fixtures/test-command-intact/passing/basic/case.json +10 -0
  158. package/dist/builtin-packs/core/fixtures/test-command-intact/violating/basic/case.json +10 -0
  159. package/dist/builtin-packs/core/fixtures/test-kinds-by-scenario/passing/basic/case.json +10 -0
  160. package/dist/builtin-packs/core/fixtures/test-kinds-by-scenario/violating/basic/case.json +10 -0
  161. package/dist/builtin-packs/core/fixtures/waivers-valid/passing/basic/case.json +10 -0
  162. package/dist/builtin-packs/core/fixtures/waivers-valid/violating/basic/case.json +10 -0
  163. package/dist/builtin-packs/core/fixtures/workflow-gates/passing/basic/case.json +10 -0
  164. package/dist/builtin-packs/core/fixtures/workflow-gates/violating/basic/case.json +10 -0
  165. package/dist/builtin-packs/core/fixtures/write-confinement/passing/basic/case.json +10 -0
  166. package/dist/builtin-packs/core/fixtures/write-confinement/violating/basic/case.json +10 -0
  167. package/dist/builtin-packs/core/fixtures/writes-within-plan/passing/basic/case.json +10 -0
  168. package/dist/builtin-packs/core/fixtures/writes-within-plan/violating/basic/case.json +10 -0
  169. package/dist/builtin-packs/core/index.ts +8 -0
  170. package/dist/builtin-packs/core/pack.json +2057 -0
  171. package/dist/builtin-packs/dotnet/index.ts +47 -0
  172. package/dist/builtin-packs/python/extract.ts +245 -0
  173. package/dist/builtin-packs/python/fixtures/lint/passing/basic/case.json +10 -0
  174. package/dist/builtin-packs/python/fixtures/lint/violating/basic/case.json +10 -0
  175. package/dist/builtin-packs/python/fixtures/no-phantom-import/passing/basic/case.json +12 -0
  176. package/dist/builtin-packs/python/fixtures/no-phantom-import/violating/basic/case.json +11 -0
  177. package/dist/builtin-packs/python/fixtures/security-patterns/passing/basic/case.json +10 -0
  178. package/dist/builtin-packs/python/fixtures/security-patterns/violating/basic/case.json +10 -0
  179. package/dist/builtin-packs/python/fixtures/typecheck/passing/basic/case.json +10 -0
  180. package/dist/builtin-packs/python/fixtures/typecheck/violating/basic/case.json +10 -0
  181. package/dist/builtin-packs/python/index.ts +57 -0
  182. package/dist/builtin-packs/python/pack.json +116 -0
  183. package/dist/builtin-packs/typescript/extract-clauses.ts +153 -0
  184. package/dist/builtin-packs/typescript/extract-literals.ts +111 -0
  185. package/dist/builtin-packs/typescript/extract-words.ts +79 -0
  186. package/dist/builtin-packs/typescript/extract.ts +77 -0
  187. package/dist/builtin-packs/typescript/fixtures/lint/passing/basic/case.json +10 -0
  188. package/dist/builtin-packs/typescript/fixtures/lint/violating/basic/case.json +10 -0
  189. package/dist/builtin-packs/typescript/fixtures/no-phantom-import/passing/basic/case.json +10 -0
  190. package/dist/builtin-packs/typescript/fixtures/no-phantom-import/passing/host-provided/case.json +10 -0
  191. package/dist/builtin-packs/typescript/fixtures/no-phantom-import/violating/basic/case.json +10 -0
  192. package/dist/builtin-packs/typescript/fixtures/no-phantom-import/violating/host-provided/case.json +10 -0
  193. package/dist/builtin-packs/typescript/fixtures/security-patterns/passing/basic/case.json +10 -0
  194. package/dist/builtin-packs/typescript/fixtures/security-patterns/violating/basic/case.json +10 -0
  195. package/dist/builtin-packs/typescript/fixtures/typecheck/passing/basic/case.json +10 -0
  196. package/dist/builtin-packs/typescript/fixtures/typecheck/violating/basic/case.json +10 -0
  197. package/dist/builtin-packs/typescript/index.ts +85 -0
  198. package/dist/builtin-packs/typescript/lex.ts +199 -0
  199. package/dist/builtin-packs/typescript/measures-exports.ts +173 -0
  200. package/dist/builtin-packs/typescript/measures-functions.ts +138 -0
  201. package/dist/builtin-packs/typescript/measures.ts +10 -0
  202. package/dist/builtin-packs/typescript/naming.ts +47 -0
  203. package/dist/builtin-packs/typescript/pack.json +169 -0
  204. package/dist/builtin-packs/typescript/patterns.ts +93 -0
  205. package/dist/builtin-packs/typescript/resolve.ts +224 -0
  206. package/dist/builtin-packs/typescript/strict.ts +177 -0
  207. package/dist/builtin-packs/typescript/titles.ts +184 -0
  208. package/dist/cli/baseline.d.ts +3 -0
  209. package/dist/cli/baseline.js +67 -0
  210. package/dist/cli/ci-bot-change.d.ts +3 -0
  211. package/dist/cli/ci-bot-change.js +54 -0
  212. package/dist/cli/ci-range.d.ts +18 -0
  213. package/dist/cli/ci-range.js +228 -0
  214. package/dist/cli/ci-summary.d.ts +3 -0
  215. package/dist/cli/ci-summary.js +45 -0
  216. package/dist/cli/ci.d.ts +4 -0
  217. package/dist/cli/ci.js +195 -0
  218. package/dist/cli/commands.d.ts +5 -0
  219. package/dist/cli/commands.js +39 -0
  220. package/dist/cli/deps.d.ts +3 -0
  221. package/dist/cli/deps.js +115 -0
  222. package/dist/cli/drift.d.ts +11 -0
  223. package/dist/cli/drift.js +91 -0
  224. package/dist/cli/evaluate.d.ts +20 -0
  225. package/dist/cli/evaluate.js +213 -0
  226. package/dist/cli/gate-scope.d.ts +10 -0
  227. package/dist/cli/gate-scope.js +82 -0
  228. package/dist/cli/git-hook.d.ts +3 -0
  229. package/dist/cli/git-hook.js +179 -0
  230. package/dist/cli/guardrail.d.ts +5 -0
  231. package/dist/cli/guardrail.js +190 -0
  232. package/dist/cli/index.d.ts +12 -0
  233. package/dist/cli/index.js +198 -0
  234. package/dist/cli/init-plan.d.ts +23 -0
  235. package/dist/cli/init-plan.js +135 -0
  236. package/dist/cli/init.d.ts +3 -0
  237. package/dist/cli/init.js +122 -0
  238. package/dist/cli/inspect-status.d.ts +8 -0
  239. package/dist/cli/inspect-status.js +164 -0
  240. package/dist/cli/inspect.d.ts +5 -0
  241. package/dist/cli/inspect.js +98 -0
  242. package/dist/cli/main.d.ts +2 -0
  243. package/dist/cli/main.js +60 -0
  244. package/dist/cli/pack-adapters.d.ts +3 -0
  245. package/dist/cli/pack-adapters.js +81 -0
  246. package/dist/cli/packs.d.ts +6 -0
  247. package/dist/cli/packs.js +131 -0
  248. package/dist/cli/plan-launcher.d.ts +1 -0
  249. package/dist/cli/plan-launcher.js +222 -0
  250. package/dist/cli/plan.d.ts +25 -0
  251. package/dist/cli/plan.js +121 -0
  252. package/dist/cli/proofs-test.d.ts +3 -0
  253. package/dist/cli/proofs-test.js +77 -0
  254. package/dist/cli/proofs.d.ts +3 -0
  255. package/dist/cli/proofs.js +168 -0
  256. package/dist/cli/remediation.d.ts +3 -0
  257. package/dist/cli/remediation.js +107 -0
  258. package/dist/cli/report.d.ts +4 -0
  259. package/dist/cli/report.js +93 -0
  260. package/dist/cli/serve-eval.d.ts +2 -0
  261. package/dist/cli/serve-eval.js +165 -0
  262. package/dist/cli/serve-log.d.ts +2 -0
  263. package/dist/cli/serve-log.js +150 -0
  264. package/dist/cli/serve-methods.d.ts +2 -0
  265. package/dist/cli/serve-methods.js +181 -0
  266. package/dist/cli/serve-protocol.d.ts +35 -0
  267. package/dist/cli/serve-protocol.js +97 -0
  268. package/dist/cli/serve-run.d.ts +9 -0
  269. package/dist/cli/serve-run.js +135 -0
  270. package/dist/cli/serve-server.d.ts +5 -0
  271. package/dist/cli/serve-server.js +120 -0
  272. package/dist/cli/serve-shared.d.ts +34 -0
  273. package/dist/cli/serve-shared.js +20 -0
  274. package/dist/cli/serve-status.d.ts +2 -0
  275. package/dist/cli/serve-status.js +130 -0
  276. package/dist/cli/serve-transport.d.ts +2 -0
  277. package/dist/cli/serve-transport.js +114 -0
  278. package/dist/cli/shared.d.ts +35 -0
  279. package/dist/cli/shared.js +181 -0
  280. package/dist/cli/task-advance.d.ts +3 -0
  281. package/dist/cli/task-advance.js +144 -0
  282. package/dist/cli/task-phases.d.ts +3 -0
  283. package/dist/cli/task-phases.js +77 -0
  284. package/dist/cli/tasks.d.ts +12 -0
  285. package/dist/cli/tasks.js +176 -0
  286. package/dist/cli/transparency.d.ts +4 -0
  287. package/dist/cli/transparency.js +197 -0
  288. package/dist/cli/waivers.d.ts +3 -0
  289. package/dist/cli/waivers.js +195 -0
  290. package/dist/features/adapters/claude-code.d.ts +8 -0
  291. package/dist/features/adapters/claude-code.js +198 -0
  292. package/dist/features/adapters/claude-shaped.d.ts +3 -0
  293. package/dist/features/adapters/claude-shaped.js +176 -0
  294. package/dist/features/adapters/codex-cli.d.ts +8 -0
  295. package/dist/features/adapters/codex-cli.js +180 -0
  296. package/dist/features/adapters/contract.d.ts +104 -0
  297. package/dist/features/adapters/contract.js +17 -0
  298. package/dist/features/adapters/copilot-capabilities.d.ts +2 -0
  299. package/dist/features/adapters/copilot-capabilities.js +46 -0
  300. package/dist/features/adapters/copilot.d.ts +8 -0
  301. package/dist/features/adapters/copilot.js +207 -0
  302. package/dist/features/adapters/cursor.d.ts +8 -0
  303. package/dist/features/adapters/cursor.js +245 -0
  304. package/dist/features/adapters/custom-event.d.ts +3 -0
  305. package/dist/features/adapters/custom-event.js +180 -0
  306. package/dist/features/adapters/custom-load.d.ts +3 -0
  307. package/dist/features/adapters/custom-load.js +185 -0
  308. package/dist/features/adapters/custom-shape.d.ts +21 -0
  309. package/dist/features/adapters/custom-shape.js +87 -0
  310. package/dist/features/adapters/custom.d.ts +9 -0
  311. package/dist/features/adapters/custom.js +130 -0
  312. package/dist/features/adapters/effective-cache.d.ts +5 -0
  313. package/dist/features/adapters/effective-cache.js +45 -0
  314. package/dist/features/adapters/gemini-cli.d.ts +6 -0
  315. package/dist/features/adapters/gemini-cli.js +160 -0
  316. package/dist/features/adapters/gemini-tables.d.ts +7 -0
  317. package/dist/features/adapters/gemini-tables.js +104 -0
  318. package/dist/features/adapters/hook-dispatch.d.ts +7 -0
  319. package/dist/features/adapters/hook-dispatch.js +97 -0
  320. package/dist/features/adapters/hook-injection.d.ts +12 -0
  321. package/dist/features/adapters/hook-injection.js +75 -0
  322. package/dist/features/adapters/hook-load.d.ts +15 -0
  323. package/dist/features/adapters/hook-load.js +152 -0
  324. package/dist/features/adapters/hook-scope.d.ts +3 -0
  325. package/dist/features/adapters/hook-scope.js +54 -0
  326. package/dist/features/adapters/index.d.ts +22 -0
  327. package/dist/features/adapters/index.js +86 -0
  328. package/dist/features/adapters/muse-code.d.ts +8 -0
  329. package/dist/features/adapters/muse-code.js +223 -0
  330. package/dist/features/adapters/opencode-bridge.d.ts +1 -0
  331. package/dist/features/adapters/opencode-bridge.js +230 -0
  332. package/dist/features/adapters/opencode-capabilities.d.ts +2 -0
  333. package/dist/features/adapters/opencode-capabilities.js +47 -0
  334. package/dist/features/adapters/opencode-parse.d.ts +3 -0
  335. package/dist/features/adapters/opencode-parse.js +137 -0
  336. package/dist/features/adapters/opencode-tables.d.ts +5 -0
  337. package/dist/features/adapters/opencode-tables.js +63 -0
  338. package/dist/features/adapters/opencode.d.ts +10 -0
  339. package/dist/features/adapters/opencode.js +97 -0
  340. package/dist/features/adapters/runtime.d.ts +25 -0
  341. package/dist/features/adapters/runtime.js +148 -0
  342. package/dist/features/adapters/universal.d.ts +7 -0
  343. package/dist/features/adapters/universal.js +89 -0
  344. package/dist/features/arch/arch-profiles.d.ts +3 -0
  345. package/dist/features/arch/arch-profiles.js +5 -0
  346. package/dist/features/arch/checks.d.ts +25 -0
  347. package/dist/features/arch/checks.js +173 -0
  348. package/dist/features/arch/codictator-modules.d.ts +4 -0
  349. package/dist/features/arch/codictator-modules.js +180 -0
  350. package/dist/features/arch/cycle-walk.d.ts +1 -0
  351. package/dist/features/arch/cycle-walk.js +36 -0
  352. package/dist/features/arch/edge-checks.d.ts +13 -0
  353. package/dist/features/arch/edge-checks.js +186 -0
  354. package/dist/features/arch/graph.d.ts +32 -0
  355. package/dist/features/arch/graph.js +202 -0
  356. package/dist/features/arch/index.d.ts +29 -0
  357. package/dist/features/arch/index.js +16 -0
  358. package/dist/features/arch/layer-rules.d.ts +3 -0
  359. package/dist/features/arch/layer-rules.js +38 -0
  360. package/dist/features/arch/module-map-validation.d.ts +3 -0
  361. package/dist/features/arch/module-map-validation.js +30 -0
  362. package/dist/features/arch/module-mapping.d.ts +15 -0
  363. package/dist/features/arch/module-mapping.js +184 -0
  364. package/dist/features/arch/profiles.d.ts +4 -0
  365. package/dist/features/arch/profiles.js +8 -0
  366. package/dist/features/audit/append.d.ts +26 -0
  367. package/dist/features/audit/append.js +205 -0
  368. package/dist/features/audit/explain-table-tail.d.ts +2 -0
  369. package/dist/features/audit/explain-table-tail.js +29 -0
  370. package/dist/features/audit/explain-table.d.ts +8 -0
  371. package/dist/features/audit/explain-table.js +48 -0
  372. package/dist/features/audit/explain.d.ts +7 -0
  373. package/dist/features/audit/explain.js +87 -0
  374. package/dist/features/audit/index.d.ts +37 -0
  375. package/dist/features/audit/index.js +17 -0
  376. package/dist/features/audit/injection-event.d.ts +11 -0
  377. package/dist/features/audit/injection-event.js +17 -0
  378. package/dist/features/audit/read.d.ts +8 -0
  379. package/dist/features/audit/read.js +62 -0
  380. package/dist/features/audit/summarize.d.ts +1 -0
  381. package/dist/features/audit/summarize.js +41 -0
  382. package/dist/features/audit/surfaces.d.ts +47 -0
  383. package/dist/features/audit/surfaces.js +165 -0
  384. package/dist/features/audit/token-saver-evidence.d.ts +14 -0
  385. package/dist/features/audit/token-saver-evidence.js +85 -0
  386. package/dist/features/ci/changes.d.ts +28 -0
  387. package/dist/features/ci/changes.js +88 -0
  388. package/dist/features/ci/index.d.ts +22 -0
  389. package/dist/features/ci/index.js +75 -0
  390. package/dist/features/ci/protection-read.d.ts +3 -0
  391. package/dist/features/ci/protection-read.js +264 -0
  392. package/dist/features/ci/protection.d.ts +25 -0
  393. package/dist/features/ci/protection.js +77 -0
  394. package/dist/features/ci/workflow.d.ts +23 -0
  395. package/dist/features/ci/workflow.js +261 -0
  396. package/dist/features/config/human.d.ts +4 -0
  397. package/dist/features/config/human.js +31 -0
  398. package/dist/features/config/index.d.ts +37 -0
  399. package/dist/features/config/index.js +129 -0
  400. package/dist/features/config/pack-data.d.ts +18 -0
  401. package/dist/features/config/pack-data.js +116 -0
  402. package/dist/features/config/validate-sections.d.ts +6 -0
  403. package/dist/features/config/validate-sections.js +198 -0
  404. package/dist/features/config/validate-shared.d.ts +8 -0
  405. package/dist/features/config/validate-shared.js +69 -0
  406. package/dist/features/config/validate-tunables.d.ts +1 -0
  407. package/dist/features/config/validate-tunables.js +89 -0
  408. package/dist/features/config/validate.d.ts +2 -0
  409. package/dist/features/config/validate.js +57 -0
  410. package/dist/features/deps/bots.d.ts +5 -0
  411. package/dist/features/deps/bots.js +39 -0
  412. package/dist/features/deps/capabilities.d.ts +3 -0
  413. package/dist/features/deps/capabilities.js +91 -0
  414. package/dist/features/deps/check.d.ts +18 -0
  415. package/dist/features/deps/check.js +70 -0
  416. package/dist/features/deps/dependabot.d.ts +10 -0
  417. package/dist/features/deps/dependabot.js +154 -0
  418. package/dist/features/deps/eval.d.ts +41 -0
  419. package/dist/features/deps/eval.js +24 -0
  420. package/dist/features/deps/fields.d.ts +4 -0
  421. package/dist/features/deps/fields.js +18 -0
  422. package/dist/features/deps/index.d.ts +67 -0
  423. package/dist/features/deps/index.js +27 -0
  424. package/dist/features/deps/lockfile.d.ts +8 -0
  425. package/dist/features/deps/lockfile.js +87 -0
  426. package/dist/features/deps/npm.d.ts +22 -0
  427. package/dist/features/deps/npm.js +172 -0
  428. package/dist/features/deps/npmrc.d.ts +12 -0
  429. package/dist/features/deps/npmrc.js +50 -0
  430. package/dist/features/deps/nuget.d.ts +25 -0
  431. package/dist/features/deps/nuget.js +112 -0
  432. package/dist/features/deps/osv-ranges.d.ts +12 -0
  433. package/dist/features/deps/osv-ranges.js +83 -0
  434. package/dist/features/deps/osv.d.ts +16 -0
  435. package/dist/features/deps/osv.js +144 -0
  436. package/dist/features/deps/pypi-pyproject.d.ts +7 -0
  437. package/dist/features/deps/pypi-pyproject.js +118 -0
  438. package/dist/features/deps/pypi.d.ts +29 -0
  439. package/dist/features/deps/pypi.js +137 -0
  440. package/dist/features/deps/registry.d.ts +29 -0
  441. package/dist/features/deps/registry.js +147 -0
  442. package/dist/features/deps/renovate.d.ts +15 -0
  443. package/dist/features/deps/renovate.js +98 -0
  444. package/dist/features/deps/selection.d.ts +20 -0
  445. package/dist/features/deps/selection.js +150 -0
  446. package/dist/features/deps/snapshot-verdicts.d.ts +16 -0
  447. package/dist/features/deps/snapshot-verdicts.js +184 -0
  448. package/dist/features/deps/stable.d.ts +19 -0
  449. package/dist/features/deps/stable.js +106 -0
  450. package/dist/features/deps/step-size.d.ts +7 -0
  451. package/dist/features/deps/step-size.js +24 -0
  452. package/dist/features/deps/upgrade.d.ts +35 -0
  453. package/dist/features/deps/upgrade.js +114 -0
  454. package/dist/features/deps/verdicts.d.ts +21 -0
  455. package/dist/features/deps/verdicts.js +219 -0
  456. package/dist/features/engine/evaluate.d.ts +12 -0
  457. package/dist/features/engine/evaluate.js +165 -0
  458. package/dist/features/engine/index.d.ts +21 -0
  459. package/dist/features/engine/index.js +24 -0
  460. package/dist/features/engine/message.d.ts +3 -0
  461. package/dist/features/engine/message.js +69 -0
  462. package/dist/features/engine/ratchet.d.ts +1 -0
  463. package/dist/features/engine/ratchet.js +63 -0
  464. package/dist/features/engine/run-enforcer.d.ts +4 -0
  465. package/dist/features/engine/run-enforcer.js +82 -0
  466. package/dist/features/engine/waivers.d.ts +23 -0
  467. package/dist/features/engine/waivers.js +169 -0
  468. package/dist/features/generator/draft.d.ts +7 -0
  469. package/dist/features/generator/draft.js +148 -0
  470. package/dist/features/generator/index.d.ts +22 -0
  471. package/dist/features/generator/index.js +8 -0
  472. package/dist/features/generator/llm-draft.d.ts +3 -0
  473. package/dist/features/generator/llm-draft.js +93 -0
  474. package/dist/features/generator/prompt.d.ts +25 -0
  475. package/dist/features/generator/prompt.js +105 -0
  476. package/dist/features/generator/self-test.d.ts +12 -0
  477. package/dist/features/generator/self-test.js +65 -0
  478. package/dist/features/generator/templates.d.ts +26 -0
  479. package/dist/features/generator/templates.js +177 -0
  480. package/dist/features/integrity/drift.d.ts +19 -0
  481. package/dist/features/integrity/drift.js +168 -0
  482. package/dist/features/integrity/hooks.d.ts +19 -0
  483. package/dist/features/integrity/hooks.js +54 -0
  484. package/dist/features/integrity/index.d.ts +10 -0
  485. package/dist/features/integrity/index.js +14 -0
  486. package/dist/features/integrity/manifest.d.ts +15 -0
  487. package/dist/features/integrity/manifest.js +26 -0
  488. package/dist/features/integrity/self-protection.d.ts +12 -0
  489. package/dist/features/integrity/self-protection.js +144 -0
  490. package/dist/features/llm/attempt.d.ts +17 -0
  491. package/dist/features/llm/attempt.js +99 -0
  492. package/dist/features/llm/errors.d.ts +5 -0
  493. package/dist/features/llm/errors.js +18 -0
  494. package/dist/features/llm/index.d.ts +23 -0
  495. package/dist/features/llm/index.js +46 -0
  496. package/dist/features/llm/presets.d.ts +25 -0
  497. package/dist/features/llm/presets.js +159 -0
  498. package/dist/features/llm/wire.d.ts +17 -0
  499. package/dist/features/llm/wire.js +163 -0
  500. package/dist/features/packs/accept.d.ts +7 -0
  501. package/dist/features/packs/accept.js +73 -0
  502. package/dist/features/packs/enforcers/arch-guards.d.ts +12 -0
  503. package/dist/features/packs/enforcers/arch-guards.js +193 -0
  504. package/dist/features/packs/enforcers/binding.d.ts +31 -0
  505. package/dist/features/packs/enforcers/binding.js +157 -0
  506. package/dist/features/packs/enforcers/ci-guards.d.ts +10 -0
  507. package/dist/features/packs/enforcers/ci-guards.js +128 -0
  508. package/dist/features/packs/enforcers/code-health.d.ts +9 -0
  509. package/dist/features/packs/enforcers/code-health.js +180 -0
  510. package/dist/features/packs/enforcers/code.d.ts +5 -0
  511. package/dist/features/packs/enforcers/code.js +128 -0
  512. package/dist/features/packs/enforcers/command-forbid.d.ts +8 -0
  513. package/dist/features/packs/enforcers/command-forbid.js +61 -0
  514. package/dist/features/packs/enforcers/deps-guards.d.ts +15 -0
  515. package/dist/features/packs/enforcers/deps-guards.js +235 -0
  516. package/dist/features/packs/enforcers/deps-policy-guards.d.ts +9 -0
  517. package/dist/features/packs/enforcers/deps-policy-guards.js +135 -0
  518. package/dist/features/packs/enforcers/docs-guards-measures.d.ts +9 -0
  519. package/dist/features/packs/enforcers/docs-guards-measures.js +117 -0
  520. package/dist/features/packs/enforcers/docs-guards.d.ts +11 -0
  521. package/dist/features/packs/enforcers/docs-guards.js +180 -0
  522. package/dist/features/packs/enforcers/external-attribute.d.ts +18 -0
  523. package/dist/features/packs/enforcers/external-attribute.js +122 -0
  524. package/dist/features/packs/enforcers/external-bind.d.ts +4 -0
  525. package/dist/features/packs/enforcers/external-bind.js +172 -0
  526. package/dist/features/packs/enforcers/external-check.d.ts +7 -0
  527. package/dist/features/packs/enforcers/external-check.js +131 -0
  528. package/dist/features/packs/enforcers/external-output.d.ts +30 -0
  529. package/dist/features/packs/enforcers/external-output.js +144 -0
  530. package/dist/features/packs/enforcers/external-probe.d.ts +4 -0
  531. package/dist/features/packs/enforcers/external-probe.js +65 -0
  532. package/dist/features/packs/enforcers/external-runs.d.ts +33 -0
  533. package/dist/features/packs/enforcers/external-runs.js +162 -0
  534. package/dist/features/packs/enforcers/external-sarif.d.ts +3 -0
  535. package/dist/features/packs/enforcers/external-sarif.js +103 -0
  536. package/dist/features/packs/enforcers/external.d.ts +39 -0
  537. package/dist/features/packs/enforcers/external.js +11 -0
  538. package/dist/features/packs/enforcers/gate-guards.d.ts +12 -0
  539. package/dist/features/packs/enforcers/gate-guards.js +170 -0
  540. package/dist/features/packs/enforcers/health-abstraction.d.ts +5 -0
  541. package/dist/features/packs/enforcers/health-abstraction.js +126 -0
  542. package/dist/features/packs/enforcers/health-duplication.d.ts +5 -0
  543. package/dist/features/packs/enforcers/health-duplication.js +197 -0
  544. package/dist/features/packs/enforcers/health-lex-imports.d.ts +5 -0
  545. package/dist/features/packs/enforcers/health-lex-imports.js +225 -0
  546. package/dist/features/packs/enforcers/health-lex-template.d.ts +10 -0
  547. package/dist/features/packs/enforcers/health-lex-template.js +67 -0
  548. package/dist/features/packs/enforcers/health-lex.d.ts +8 -0
  549. package/dist/features/packs/enforcers/health-lex.js +227 -0
  550. package/dist/features/packs/enforcers/health-markers.d.ts +3 -0
  551. package/dist/features/packs/enforcers/health-markers.js +31 -0
  552. package/dist/features/packs/enforcers/health-measures.d.ts +24 -0
  553. package/dist/features/packs/enforcers/health-measures.js +214 -0
  554. package/dist/features/packs/enforcers/health-refs.d.ts +6 -0
  555. package/dist/features/packs/enforcers/health-refs.js +61 -0
  556. package/dist/features/packs/enforcers/integrity-guards-repo.d.ts +6 -0
  557. package/dist/features/packs/enforcers/integrity-guards-repo.js +189 -0
  558. package/dist/features/packs/enforcers/integrity-guards.d.ts +12 -0
  559. package/dist/features/packs/enforcers/integrity-guards.js +202 -0
  560. package/dist/features/packs/enforcers/jsonkey.d.ts +13 -0
  561. package/dist/features/packs/enforcers/jsonkey.js +95 -0
  562. package/dist/features/packs/enforcers/parametric.d.ts +7 -0
  563. package/dist/features/packs/enforcers/parametric.js +138 -0
  564. package/dist/features/packs/enforcers/pattern.d.ts +11 -0
  565. package/dist/features/packs/enforcers/pattern.js +88 -0
  566. package/dist/features/packs/enforcers/placement.d.ts +10 -0
  567. package/dist/features/packs/enforcers/placement.js +54 -0
  568. package/dist/features/packs/enforcers/py-checks.d.ts +7 -0
  569. package/dist/features/packs/enforcers/py-checks.js +131 -0
  570. package/dist/features/packs/enforcers/py-lex.d.ts +10 -0
  571. package/dist/features/packs/enforcers/py-lex.js +271 -0
  572. package/dist/features/packs/enforcers/py-phantom.d.ts +6 -0
  573. package/dist/features/packs/enforcers/py-phantom.js +163 -0
  574. package/dist/features/packs/enforcers/py-pins.d.ts +16 -0
  575. package/dist/features/packs/enforcers/py-pins.js +184 -0
  576. package/dist/features/packs/enforcers/py-security-patterns.d.ts +18 -0
  577. package/dist/features/packs/enforcers/py-security-patterns.js +70 -0
  578. package/dist/features/packs/enforcers/records-guards.d.ts +12 -0
  579. package/dist/features/packs/enforcers/records-guards.js +178 -0
  580. package/dist/features/packs/enforcers/remediation-guards.d.ts +6 -0
  581. package/dist/features/packs/enforcers/remediation-guards.js +42 -0
  582. package/dist/features/packs/enforcers/required.d.ts +10 -0
  583. package/dist/features/packs/enforcers/required.js +65 -0
  584. package/dist/features/packs/enforcers/secret-scan.d.ts +22 -0
  585. package/dist/features/packs/enforcers/secret-scan.js +179 -0
  586. package/dist/features/packs/enforcers/shell-analyse.d.ts +14 -0
  587. package/dist/features/packs/enforcers/shell-analyse.js +105 -0
  588. package/dist/features/packs/enforcers/sizes.d.ts +10 -0
  589. package/dist/features/packs/enforcers/sizes.js +82 -0
  590. package/dist/features/packs/enforcers/steering-guards.d.ts +11 -0
  591. package/dist/features/packs/enforcers/steering-guards.js +162 -0
  592. package/dist/features/packs/enforcers/testing-guards.d.ts +10 -0
  593. package/dist/features/packs/enforcers/testing-guards.js +118 -0
  594. package/dist/features/packs/enforcers/ts-checks.d.ts +7 -0
  595. package/dist/features/packs/enforcers/ts-checks.js +101 -0
  596. package/dist/features/packs/enforcers/ts-phantom-host.d.ts +11 -0
  597. package/dist/features/packs/enforcers/ts-phantom-host.js +155 -0
  598. package/dist/features/packs/enforcers/ts-phantom.d.ts +6 -0
  599. package/dist/features/packs/enforcers/ts-phantom.js +117 -0
  600. package/dist/features/packs/enforcers/ts-security-patterns.d.ts +18 -0
  601. package/dist/features/packs/enforcers/ts-security-patterns.js +93 -0
  602. package/dist/features/packs/enforcers/workflow-guards.d.ts +10 -0
  603. package/dist/features/packs/enforcers/workflow-guards.js +117 -0
  604. package/dist/features/packs/enforcers/write-confine.d.ts +13 -0
  605. package/dist/features/packs/enforcers/write-confine.js +131 -0
  606. package/dist/features/packs/hashes.d.ts +6 -0
  607. package/dist/features/packs/hashes.js +84 -0
  608. package/dist/features/packs/index.d.ts +22 -0
  609. package/dist/features/packs/index.js +15 -0
  610. package/dist/features/packs/loader.d.ts +13 -0
  611. package/dist/features/packs/loader.js +205 -0
  612. package/dist/features/packs/manifest.d.ts +17 -0
  613. package/dist/features/packs/manifest.js +180 -0
  614. package/dist/features/packs/params.d.ts +2 -0
  615. package/dist/features/packs/params.js +90 -0
  616. package/dist/features/packs/registry.d.ts +11 -0
  617. package/dist/features/packs/registry.js +136 -0
  618. package/dist/features/packs/selftest.d.ts +3 -0
  619. package/dist/features/packs/selftest.js +127 -0
  620. package/dist/features/records/bug-grammar.d.ts +17 -0
  621. package/dist/features/records/bug-grammar.js +128 -0
  622. package/dist/features/records/bug-registry.d.ts +9 -0
  623. package/dist/features/records/bug-registry.js +67 -0
  624. package/dist/features/records/bug-rows-immutable.d.ts +3 -0
  625. package/dist/features/records/bug-rows-immutable.js +52 -0
  626. package/dist/features/records/bugs.d.ts +2 -0
  627. package/dist/features/records/bugs.js +24 -0
  628. package/dist/features/records/docs-lines.d.ts +16 -0
  629. package/dist/features/records/docs-lines.js +36 -0
  630. package/dist/features/records/docs-prose.d.ts +14 -0
  631. package/dist/features/records/docs-prose.js +252 -0
  632. package/dist/features/records/docs-structure.d.ts +17 -0
  633. package/dist/features/records/docs-structure.js +223 -0
  634. package/dist/features/records/docs.d.ts +9 -0
  635. package/dist/features/records/docs.js +238 -0
  636. package/dist/features/records/history-checks.d.ts +6 -0
  637. package/dist/features/records/history-checks.js +94 -0
  638. package/dist/features/records/history-parse.d.ts +16 -0
  639. package/dist/features/records/history-parse.js +101 -0
  640. package/dist/features/records/history-scope.d.ts +5 -0
  641. package/dist/features/records/history-scope.js +86 -0
  642. package/dist/features/records/history.d.ts +3 -0
  643. package/dist/features/records/history.js +5 -0
  644. package/dist/features/records/index.d.ts +8 -0
  645. package/dist/features/records/index.js +11 -0
  646. package/dist/features/remediation/adoption.d.ts +32 -0
  647. package/dist/features/remediation/adoption.js +131 -0
  648. package/dist/features/remediation/index.d.ts +12 -0
  649. package/dist/features/remediation/index.js +21 -0
  650. package/dist/features/remediation/plan-chains.d.ts +3 -0
  651. package/dist/features/remediation/plan-chains.js +111 -0
  652. package/dist/features/remediation/plan-generate.d.ts +3 -0
  653. package/dist/features/remediation/plan-generate.js +129 -0
  654. package/dist/features/remediation/plan-kinds.d.ts +32 -0
  655. package/dist/features/remediation/plan-kinds.js +42 -0
  656. package/dist/features/remediation/plan-markers.d.ts +2 -0
  657. package/dist/features/remediation/plan-markers.js +155 -0
  658. package/dist/features/remediation/plan-merge.d.ts +6 -0
  659. package/dist/features/remediation/plan-merge.js +33 -0
  660. package/dist/features/remediation/plan.d.ts +4 -0
  661. package/dist/features/remediation/plan.js +7 -0
  662. package/dist/features/remediation/step-floor.d.ts +5 -0
  663. package/dist/features/remediation/step-floor.js +76 -0
  664. package/dist/features/remediation/step-gates.d.ts +18 -0
  665. package/dist/features/remediation/step-gates.js +77 -0
  666. package/dist/features/remediation/step-split.d.ts +12 -0
  667. package/dist/features/remediation/step-split.js +75 -0
  668. package/dist/features/remediation/steps.d.ts +3 -0
  669. package/dist/features/remediation/steps.js +6 -0
  670. package/dist/features/remediation/types.d.ts +37 -0
  671. package/dist/features/remediation/types.js +1 -0
  672. package/dist/features/security/index.d.ts +12 -0
  673. package/dist/features/security/index.js +142 -0
  674. package/dist/features/steering/agent-assets.d.ts +7 -0
  675. package/dist/features/steering/agent-assets.js +75 -0
  676. package/dist/features/steering/budgets.d.ts +20 -0
  677. package/dist/features/steering/budgets.js +86 -0
  678. package/dist/features/steering/checks.d.ts +7 -0
  679. package/dist/features/steering/checks.js +67 -0
  680. package/dist/features/steering/context-file.d.ts +11 -0
  681. package/dist/features/steering/context-file.js +107 -0
  682. package/dist/features/steering/graph-scan.d.ts +7 -0
  683. package/dist/features/steering/graph-scan.js +17 -0
  684. package/dist/features/steering/index.d.ts +30 -0
  685. package/dist/features/steering/index.js +45 -0
  686. package/dist/features/steering/injection.d.ts +23 -0
  687. package/dist/features/steering/injection.js +124 -0
  688. package/dist/features/steering/mcp.d.ts +2 -0
  689. package/dist/features/steering/mcp.js +18 -0
  690. package/dist/features/steering/precedence.d.ts +10 -0
  691. package/dist/features/steering/precedence.js +28 -0
  692. package/dist/features/steering/read-cache.d.ts +13 -0
  693. package/dist/features/steering/read-cache.js +51 -0
  694. package/dist/features/testing/base.d.ts +1 -0
  695. package/dist/features/testing/base.js +8 -0
  696. package/dist/features/testing/covers.d.ts +8 -0
  697. package/dist/features/testing/covers.js +50 -0
  698. package/dist/features/testing/evaluate.d.ts +19 -0
  699. package/dist/features/testing/evaluate.js +47 -0
  700. package/dist/features/testing/index.d.ts +10 -0
  701. package/dist/features/testing/index.js +13 -0
  702. package/dist/features/testing/integrity.d.ts +28 -0
  703. package/dist/features/testing/integrity.js +140 -0
  704. package/dist/features/testing/ledger.d.ts +11 -0
  705. package/dist/features/testing/ledger.js +51 -0
  706. package/dist/features/testing/proofs.d.ts +26 -0
  707. package/dist/features/testing/proofs.js +88 -0
  708. package/dist/features/testing/report.d.ts +6 -0
  709. package/dist/features/testing/report.js +16 -0
  710. package/dist/features/testing/scenarios.d.ts +34 -0
  711. package/dist/features/testing/scenarios.js +90 -0
  712. package/dist/features/testing/tap-parser.d.ts +9 -0
  713. package/dist/features/testing/tap-parser.js +84 -0
  714. package/dist/features/testing/trace.d.ts +23 -0
  715. package/dist/features/testing/trace.js +110 -0
  716. package/dist/features/workflow/index.d.ts +14 -0
  717. package/dist/features/workflow/index.js +19 -0
  718. package/dist/features/workflow/loop.d.ts +5 -0
  719. package/dist/features/workflow/loop.js +36 -0
  720. package/dist/features/workflow/phases.d.ts +10 -0
  721. package/dist/features/workflow/phases.js +181 -0
  722. package/dist/features/workflow/review.d.ts +25 -0
  723. package/dist/features/workflow/review.js +112 -0
  724. package/dist/features/workflow/tasks.d.ts +73 -0
  725. package/dist/features/workflow/tasks.js +80 -0
  726. package/dist/features/workflow/writes.d.ts +8 -0
  727. package/dist/features/workflow/writes.js +96 -0
  728. package/dist/kernel/clock.d.ts +4 -0
  729. package/dist/kernel/clock.js +5 -0
  730. package/dist/kernel/config-keys.d.ts +2 -0
  731. package/dist/kernel/config-keys.js +5 -0
  732. package/dist/kernel/config-toml-keys.d.ts +2 -0
  733. package/dist/kernel/config-toml-keys.js +237 -0
  734. package/dist/kernel/config-yaml-keys.d.ts +2 -0
  735. package/dist/kernel/config-yaml-keys.js +177 -0
  736. package/dist/kernel/contracts.d.ts +76 -0
  737. package/dist/kernel/contracts.js +9 -0
  738. package/dist/kernel/entry.d.ts +1 -0
  739. package/dist/kernel/entry.js +31 -0
  740. package/dist/kernel/env.d.ts +4 -0
  741. package/dist/kernel/env.js +5 -0
  742. package/dist/kernel/errors.d.ts +7 -0
  743. package/dist/kernel/errors.js +6 -0
  744. package/dist/kernel/fs-confine.d.ts +14 -0
  745. package/dist/kernel/fs-confine.js +129 -0
  746. package/dist/kernel/fs-errors.d.ts +8 -0
  747. package/dist/kernel/fs-errors.js +37 -0
  748. package/dist/kernel/fs.d.ts +28 -0
  749. package/dist/kernel/fs.js +245 -0
  750. package/dist/kernel/git.d.ts +16 -0
  751. package/dist/kernel/git.js +125 -0
  752. package/dist/kernel/glob.d.ts +1 -0
  753. package/dist/kernel/glob.js +178 -0
  754. package/dist/kernel/hash.d.ts +3 -0
  755. package/dist/kernel/hash.js +12 -0
  756. package/dist/kernel/host.d.ts +3 -0
  757. package/dist/kernel/host.js +48 -0
  758. package/dist/kernel/index.d.ts +115 -0
  759. package/dist/kernel/index.js +33 -0
  760. package/dist/kernel/json.d.ts +4 -0
  761. package/dist/kernel/json.js +68 -0
  762. package/dist/kernel/net-allow.d.ts +8 -0
  763. package/dist/kernel/net-allow.js +45 -0
  764. package/dist/kernel/net-fetch.d.ts +5 -0
  765. package/dist/kernel/net-fetch.js +135 -0
  766. package/dist/kernel/net.d.ts +10 -0
  767. package/dist/kernel/net.js +24 -0
  768. package/dist/kernel/path.d.ts +3 -0
  769. package/dist/kernel/path.js +40 -0
  770. package/dist/kernel/pattern.d.ts +2 -0
  771. package/dist/kernel/pattern.js +116 -0
  772. package/dist/kernel/proc.d.ts +6 -0
  773. package/dist/kernel/proc.js +207 -0
  774. package/dist/kernel/read-cache.d.ts +6 -0
  775. package/dist/kernel/read-cache.js +27 -0
  776. package/dist/kernel/redact.d.ts +1 -0
  777. package/dist/kernel/redact.js +206 -0
  778. package/dist/kernel/repo-root.d.ts +3 -0
  779. package/dist/kernel/repo-root.js +29 -0
  780. package/dist/kernel/result.d.ts +10 -0
  781. package/dist/kernel/result.js +6 -0
  782. package/dist/kernel/schema-helpers.d.ts +11 -0
  783. package/dist/kernel/schema-helpers.js +101 -0
  784. package/dist/kernel/schema.d.ts +2 -0
  785. package/dist/kernel/schema.js +203 -0
  786. package/dist/kernel/secret-paths.d.ts +3 -0
  787. package/dist/kernel/secret-paths.js +56 -0
  788. package/dist/kernel/shell-bypass.d.ts +4 -0
  789. package/dist/kernel/shell-bypass.js +151 -0
  790. package/dist/kernel/shell-cmd.d.ts +6 -0
  791. package/dist/kernel/shell-cmd.js +196 -0
  792. package/dist/kernel/shell-deny-cmd.d.ts +7 -0
  793. package/dist/kernel/shell-deny-cmd.js +35 -0
  794. package/dist/kernel/shell-deny-destroy.d.ts +7 -0
  795. package/dist/kernel/shell-deny-destroy.js +71 -0
  796. package/dist/kernel/shell-deny-escalate.d.ts +7 -0
  797. package/dist/kernel/shell-deny-escalate.js +96 -0
  798. package/dist/kernel/shell-deny-target.d.ts +4 -0
  799. package/dist/kernel/shell-deny-target.js +51 -0
  800. package/dist/kernel/shell-deny.d.ts +8 -0
  801. package/dist/kernel/shell-deny.js +171 -0
  802. package/dist/kernel/shell-scan.d.ts +3 -0
  803. package/dist/kernel/shell-scan.js +226 -0
  804. package/dist/kernel/shell-word.d.ts +15 -0
  805. package/dist/kernel/shell-word.js +216 -0
  806. package/dist/kernel/shell.d.ts +22 -0
  807. package/dist/kernel/shell.js +2 -0
  808. package/dist/kernel/stdin.d.ts +2 -0
  809. package/dist/kernel/stdin.js +59 -0
  810. package/dist/kernel/test-report.d.ts +7 -0
  811. package/dist/kernel/test-report.js +112 -0
  812. package/dist/kernel/version.d.ts +2 -0
  813. package/dist/kernel/version.js +46 -0
  814. package/dist/tsconfig.build.tsbuildinfo +1 -0
  815. package/package.json +20 -5
  816. package/schema/accepted.schema.json +20 -0
  817. package/schema/baseline.schema.json +17 -0
  818. package/schema/capability.schema.json +31 -0
  819. package/schema/cli/error.schema.json +15 -0
  820. package/schema/cli/explain.schema.json +19 -0
  821. package/schema/cli/report.schema.json +15 -0
  822. package/schema/cli/status.schema.json +51 -0
  823. package/schema/cli/verify.schema.json +15 -0
  824. package/schema/config.schema.json +43 -0
  825. package/schema/event-log.schema.json +52 -0
  826. package/schema/hook-decision.schema.json +13 -0
  827. package/schema/hook-event.schema.json +50 -0
  828. package/schema/manifest.schema.json +26 -0
  829. package/schema/pack-draft.schema.json +42 -0
  830. package/schema/pack.schema.json +70 -0
  831. package/schema/registry-snapshot.schema.json +41 -0
  832. package/schema/remediation-plan.schema.json +44 -0
  833. package/schema/review-findings.schema.json +25 -0
  834. package/schema/task-record.schema.json +49 -0
  835. package/schema/waivers.schema.json +29 -0
@@ -0,0 +1,144 @@
1
+ // SPEC §4.14.3: self-protection (L1, core/no-bypass). Commands are matched
2
+ // by the kernel shell analyser, so wrappers (bash -c, env assignments,
3
+ // $(…) nesting) do not hide them; a raw token scan backstops unparseable
4
+ // input fail-closed. There is no flag or file that turns Codictator off.
5
+ import { analyseShell, isProtectedPath, matchBypassCommand, parseJson, scanBypassRawText, } from "../../kernel/index.js";
6
+ export { isProtectedPath };
7
+ const NO_BYPASS = "core/no-bypass";
8
+ function noBypass(message, remediation) {
9
+ return { ruleId: NO_BYPASS, message, remediation };
10
+ }
11
+ const TOOL_WRITE_VERBS = new Set([
12
+ "write",
13
+ "edit",
14
+ "create",
15
+ "delete",
16
+ "remove",
17
+ "move",
18
+ "rename",
19
+ "rm",
20
+ "unlink",
21
+ ]);
22
+ const SHELLS = new Set(["bash", "sh", "dash", "zsh", "env", "sudo", "doas"]);
23
+ function candidatesFor(command) {
24
+ const out = [command.join(" ")];
25
+ for (let i = 0; i + 1 < command.length; i += 1) {
26
+ const flag = command[i];
27
+ const next = command[i + 1];
28
+ if ((flag === "-c" || flag === "--command") && next !== undefined) {
29
+ out.push(next);
30
+ }
31
+ }
32
+ if (command.length > 1 &&
33
+ SHELLS.has(command[0] ?? "") &&
34
+ !command.includes("-c")) {
35
+ out.push(command.slice(1).join(" "));
36
+ }
37
+ return out;
38
+ }
39
+ function codictatorDep(text) {
40
+ const parsed = parseJson(text);
41
+ if (!parsed.ok) {
42
+ return undefined;
43
+ }
44
+ const root = parsed.value;
45
+ if (typeof root !== "object" ||
46
+ root === null ||
47
+ !("devDependencies" in root)) {
48
+ return undefined;
49
+ }
50
+ const deps = root.devDependencies;
51
+ if (typeof deps !== "object" || deps === null || !("codictator" in deps)) {
52
+ return undefined;
53
+ }
54
+ const pinned = deps.codictator;
55
+ return typeof pinned === "string" ? pinned : undefined;
56
+ }
57
+ // SPEC §4.14.3 manifests row: a package.json write that removes or changes
58
+ // the codictator dev dependency is self-protection, not drift.
59
+ export function checkPackageManifestEdit(beforeText, afterText) {
60
+ const before = codictatorDep(beforeText);
61
+ const after = codictatorDep(afterText);
62
+ if (before !== undefined && after !== before) {
63
+ return [
64
+ noBypass("package.json removes or changes the codictator dev dependency", "Restore the exact pinned codictator devDependency; upgrades go through the upgrade bot (§4.8.6)."),
65
+ ];
66
+ }
67
+ return [];
68
+ }
69
+ // SPEC §4.14.2 core/no-bypass at L4: a non-merge commit in range needs the
70
+ // Codictator-L3 trailer that commit-msg adds (value: short config hash),
71
+ // unless its author is exempt (bot accounts). Web-editor commits (EC-4) and
72
+ // --no-verify commits (EC-3) lack it and block the PR here.
73
+ export function checkCommitTrailers(commits, trailerExempt) {
74
+ const findings = [];
75
+ for (const commit of commits) {
76
+ if (commit.isMerge || trailerExempt.includes(commit.author)) {
77
+ continue;
78
+ }
79
+ if (!commit.message
80
+ .split("\n")
81
+ .some((line) => line.startsWith("Codictator-L3: "))) {
82
+ findings.push(noBypass(`commit ${commit.sha} lacks the Codictator-L3 trailer`, "Make the change locally so commit-msg adds the trailer; web-editor commits must be redone locally (EC-4)."));
83
+ }
84
+ }
85
+ return findings;
86
+ }
87
+ function toolFormHit(command) {
88
+ const verb = (command[0] ?? "").toLowerCase();
89
+ if (!TOOL_WRITE_VERBS.has(verb)) {
90
+ return undefined;
91
+ }
92
+ const target = command.find((part) => isProtectedPath(part));
93
+ if (target === undefined) {
94
+ return undefined;
95
+ }
96
+ return noBypass(`agent ${verb} of protected guardrail path ${target}`, "All guardrail state changes go through `codictator` commands (§4.14.5); run `codictator regen` instead.");
97
+ }
98
+ function unparseableFinding() {
99
+ return {
100
+ ruleId: "core/dangerous-shell",
101
+ code: "CDX-E306",
102
+ message: "shell command is unparseable; blocking fail-closed",
103
+ remediation: "Rewrite the command with balanced quotes and retry (§4.7.2).",
104
+ };
105
+ }
106
+ // SPEC §4.14.2 + §4.14.3: L1 blocks the bypass; L4 blocks the PR via the
107
+ // missing Codictator-L3 trailer. Every hit names the blocked construct.
108
+ export function checkSelfProtection(_ctx, command) {
109
+ const toolHit = toolFormHit(command);
110
+ if (toolHit !== undefined) {
111
+ return [toolHit];
112
+ }
113
+ const candidates = candidatesFor(command);
114
+ const seen = new Set();
115
+ for (const candidate of candidates) {
116
+ const parsed = analyseShell(candidate);
117
+ if (!parsed.ok) {
118
+ continue;
119
+ }
120
+ for (const pipeline of parsed.value.pipelines) {
121
+ for (const cmd of pipeline.commands) {
122
+ const hit = matchBypassCommand(cmd);
123
+ if (hit !== undefined && !seen.has(hit)) {
124
+ seen.add(hit);
125
+ return [
126
+ noBypass(hit, "Run the command without the bypass; hooks and required checks cannot be skipped (§4.14.3)."),
127
+ ];
128
+ }
129
+ }
130
+ }
131
+ }
132
+ const raw = scanBypassRawText(candidates[0] ?? "");
133
+ if (raw !== undefined) {
134
+ return [
135
+ noBypass(raw, "Wrappers do not hide bypasses from the shell analyser; run the command without the bypass (§4.14.3)."),
136
+ ];
137
+ }
138
+ const failed = candidates.some((candidate) => !analyseShell(candidate).ok);
139
+ const looksShell = SHELLS.has(command[0] ?? "") || /[;|&$`()]/.test(candidates[0] ?? "");
140
+ if (failed && looksShell) {
141
+ return [unparseableFinding()];
142
+ }
143
+ return [];
144
+ }
@@ -0,0 +1,17 @@
1
+ import { type Env, type Result } from "../../kernel/index.ts";
2
+ import type { CompletionRequest, CompletionResponse, LlmPorts } from "./index.ts";
3
+ import type { LlmConfig } from "./presets.ts";
4
+ export declare const LLM_MAX_ATTEMPTS = 3;
5
+ export declare const LLM_RETRY_DELAYS_MS: ReadonlyArray<number>;
6
+ export declare function isRetryableStatus(status: number): boolean;
7
+ export declare function resolveKey(env: Env, keyName: string | undefined): Result<string | undefined>;
8
+ export type Advance = {
9
+ readonly kind: "return";
10
+ readonly result: Result<CompletionResponse>;
11
+ } | {
12
+ readonly kind: "strip-format";
13
+ } | {
14
+ readonly kind: "backoff";
15
+ readonly delayMs: number;
16
+ };
17
+ export declare function runAttempt(ports: LlmPorts, config: LlmConfig, req: CompletionRequest, key: string | undefined, withResponseFormat: boolean, attempt: number, started: string): Promise<Advance>;
@@ -0,0 +1,99 @@
1
+ // SPEC §4.17.4: one answered attempt and its classification. Kept apart so
2
+ // the factory and the retry loop stay under the size and complexity guards.
3
+ import { err, ok, } from "../../kernel/index.js";
4
+ import { invalidDraftError, keyMissingError, keyRejectedError, unavailableError, } from "./errors.js";
5
+ import { buildWireRequest, readWireText } from "./wire.js";
6
+ export const LLM_MAX_ATTEMPTS = 3;
7
+ // SPEC §4.17.4 EC-3: retry twice with 2 s and 8 s backoff.
8
+ export const LLM_RETRY_DELAYS_MS = [2000, 8000];
9
+ const AUTH_STATUSES = new Set([401, 403]);
10
+ // SPEC §4.17.4 EC-3: 429 and 5xx are retryable; every other status fails at
11
+ // once (401/403 become CDX-E852, the rest CDX-E854).
12
+ export function isRetryableStatus(status) {
13
+ return status === 429 || (status >= 500 && status <= 599);
14
+ }
15
+ // SPEC §4.17.4 EC-6: a 400 that names response_format means the provider
16
+ // rejected the json_object hint, so the one retry goes without it.
17
+ function rejectsResponseFormat(body) {
18
+ return body.toLowerCase().includes("response_format");
19
+ }
20
+ // Read the key at call time; an empty value counts as unset (EC-1).
21
+ export function resolveKey(env, keyName) {
22
+ if (keyName === undefined) {
23
+ return ok(undefined);
24
+ }
25
+ const raw = env.get(keyName);
26
+ const key = raw === undefined || raw === "" ? undefined : raw;
27
+ if (key === undefined) {
28
+ return err(keyMissingError(keyName));
29
+ }
30
+ return ok(key);
31
+ }
32
+ function readBody(config, response) {
33
+ const read = readWireText(config.format, response.body);
34
+ if (read === undefined) {
35
+ return err(invalidDraftError(`provider answer is not ${config.format} JSON`));
36
+ }
37
+ // SPEC §4.17.4 EC-7: a draft cut at maxOutputTokens is invalid JSON for
38
+ // the generator repair round.
39
+ if (read.truncated) {
40
+ return err(invalidDraftError(`response truncated at maxOutputTokens (stop: ${read.stopReason})`));
41
+ }
42
+ return ok({ text: read.text, stopReason: read.stopReason });
43
+ }
44
+ // Classify one answered attempt: finish now, strip the format hint once, or
45
+ // back off and retry.
46
+ function advance(ports, config, response, withResponseFormat, attempt, started) {
47
+ if (AUTH_STATUSES.has(response.status)) {
48
+ return {
49
+ kind: "return",
50
+ result: err(keyRejectedError(response.status, config.apiKeyEnv)),
51
+ };
52
+ }
53
+ if (withResponseFormat &&
54
+ response.status === 400 &&
55
+ rejectsResponseFormat(response.body)) {
56
+ return { kind: "strip-format" };
57
+ }
58
+ if (isRetryableStatus(response.status)) {
59
+ if (attempt + 1 < LLM_MAX_ATTEMPTS) {
60
+ const delays = LLM_RETRY_DELAYS_MS;
61
+ return {
62
+ kind: "backoff",
63
+ delayMs: delays[Math.min(attempt, delays.length - 1)] ?? 8000,
64
+ };
65
+ }
66
+ const elapsed = Date.parse(ports.clock.now()) - Date.parse(started);
67
+ return {
68
+ kind: "return",
69
+ result: err(unavailableError(`status ${String(response.status)} after ${String(LLM_MAX_ATTEMPTS)} attempts over ${String(elapsed)} ms`)),
70
+ };
71
+ }
72
+ if (response.status !== 200) {
73
+ return {
74
+ kind: "return",
75
+ result: err(unavailableError(`status ${String(response.status)}`)),
76
+ };
77
+ }
78
+ return { kind: "return", result: readBody(config, response) };
79
+ }
80
+ // One attempt: send the wire request and classify the answer.
81
+ export async function runAttempt(ports, config, req, key, withResponseFormat, attempt, started) {
82
+ const wire = buildWireRequest(config, req.model, req.prompt, req.maxOutputTokens, key, withResponseFormat);
83
+ const sent = await ports.net.request({
84
+ method: wire.method,
85
+ url: wire.url,
86
+ headers: wire.headers,
87
+ body: wire.body,
88
+ timeoutMs: config.timeoutMs,
89
+ });
90
+ // SPEC §4.17.4 EC-4: a transport failure (including a timeout at the Net
91
+ // port) is CDX-E854 at once, never a retry.
92
+ if (!sent.ok) {
93
+ return {
94
+ kind: "return",
95
+ result: err(unavailableError(`request failed: ${sent.error.message}`)),
96
+ };
97
+ }
98
+ return advance(ports, config, sent.value, withResponseFormat, attempt, started);
99
+ }
@@ -0,0 +1,5 @@
1
+ import { type CdxError } from "../../kernel/index.ts";
2
+ export declare function keyMissingError(name: string): CdxError;
3
+ export declare function keyRejectedError(status: number, keyName: string | undefined): CdxError;
4
+ export declare function unavailableError(detail: string): CdxError;
5
+ export declare function invalidDraftError(detail: string): CdxError;
@@ -0,0 +1,18 @@
1
+ // SPEC §4.17.4: the client-side error constructors. Every failure is a
2
+ // CdxError with a SPEC §8 code; the key itself never appears in a message,
3
+ // a detail or an event (SPEC §4.17.3, §9.2).
4
+ import { makeError } from "../../kernel/index.js";
5
+ export function keyMissingError(name) {
6
+ return makeError("CDX-E852", `LLM API key is not set: environment variable ${name} is unset`, `Export ${name} with the provider key, then retry. The key is read at call time and never stored.`);
7
+ }
8
+ export function keyRejectedError(status, keyName) {
9
+ return makeError("CDX-E852", `LLM provider rejected the API key (status ${String(status)})`, keyName === undefined
10
+ ? "Check the provider key the local runtime expects, then retry."
11
+ : `Check the value of ${keyName} (the value itself is never logged), then retry.`);
12
+ }
13
+ export function unavailableError(detail) {
14
+ return makeError("CDX-E854", `LLM provider is unavailable: ${detail}`, "Retry the request; after repeated failures check the provider status and the generator falls back to --template.", detail);
15
+ }
16
+ export function invalidDraftError(detail) {
17
+ return makeError("CDX-E853", `LLM draft is not valid JSON: ${detail}`, "Retry the request; the generator runs one repair round on invalid drafts.");
18
+ }
@@ -0,0 +1,23 @@
1
+ import { type Clock, type Env, type Net, type Result } from "../../kernel/index.ts";
2
+ export { isRetryableStatus, LLM_MAX_ATTEMPTS, LLM_RETRY_DELAYS_MS, } from "./attempt.ts";
3
+ export type { LlmFormat, LlmPresetId } from "./presets.ts";
4
+ export { DEFAULT_MAX_OUTPUT_TOKENS, DEFAULT_PRESET_ID, DEFAULT_TIMEOUT_MS, LLM_PRESETS, narrowLlmConfig, } from "./presets.ts";
5
+ export interface CompletionRequest {
6
+ readonly model: string;
7
+ readonly prompt: string;
8
+ readonly maxOutputTokens: number;
9
+ }
10
+ export interface CompletionResponse {
11
+ readonly text: string;
12
+ readonly stopReason: string;
13
+ }
14
+ export interface LlmClient {
15
+ readonly complete: (req: CompletionRequest) => Promise<Result<CompletionResponse>>;
16
+ }
17
+ export interface LlmPorts {
18
+ readonly net: Net;
19
+ readonly env: Env;
20
+ readonly clock: Clock;
21
+ readonly sleep?: (ms: number) => Promise<void>;
22
+ }
23
+ export declare function createClient(config: unknown, ports: LlmPorts): LlmClient;
@@ -0,0 +1,46 @@
1
+ // SPEC §4.17: provider-agnostic completion client. Only generator and cli
2
+ // may import this module (§3.3 hard boundary); no enforcement path does.
3
+ import { err, } from "../../kernel/index.js";
4
+ import { resolveKey, runAttempt } from "./attempt.js";
5
+ import { narrowLlmConfig } from "./presets.js";
6
+ export { isRetryableStatus, LLM_MAX_ATTEMPTS, LLM_RETRY_DELAYS_MS, } from "./attempt.js";
7
+ export { DEFAULT_MAX_OUTPUT_TOKENS, DEFAULT_PRESET_ID, DEFAULT_TIMEOUT_MS, LLM_PRESETS, narrowLlmConfig, } from "./presets.js";
8
+ // The retry loop lives outside the factory so neither function trips the
9
+ // size guard; narrowing still happens once at construction.
10
+ async function runComplete(narrowed, ports, req) {
11
+ if (!narrowed.ok) {
12
+ return err(narrowed.error);
13
+ }
14
+ const active = narrowed.value;
15
+ // SPEC §4.17.3: the key is read from the environment at call time,
16
+ // never logged, cached or written.
17
+ const keyed = resolveKey(ports.env, active.apiKeyEnv);
18
+ if (!keyed.ok) {
19
+ return err(keyed.error);
20
+ }
21
+ const started = ports.clock.now();
22
+ let withResponseFormat = active.format === "openai-chat";
23
+ for (let attempt = 0;; attempt += 1) {
24
+ const next = await runAttempt(ports, active, req, keyed.value, withResponseFormat, attempt, started);
25
+ if (next.kind === "return") {
26
+ return next.result;
27
+ }
28
+ if (next.kind === "strip-format") {
29
+ withResponseFormat = false;
30
+ continue;
31
+ }
32
+ if (ports.sleep !== undefined) {
33
+ await ports.sleep(next.delayMs);
34
+ }
35
+ }
36
+ }
37
+ // SPEC §4.17.2: the client returns Result<{ text, usage? }>; it never throws.
38
+ export function createClient(config, ports) {
39
+ // Narrow once at construction; a shape violation fails closed on every
40
+ // call instead of throwing from the factory.
41
+ const narrowed = narrowLlmConfig(config);
42
+ async function complete(req) {
43
+ return runComplete(narrowed, ports, req);
44
+ }
45
+ return { complete };
46
+ }
@@ -0,0 +1,25 @@
1
+ import { type Result } from "../../kernel/index.ts";
2
+ export type LlmFormat = "openai-chat" | "anthropic-messages";
3
+ export type LlmPresetId = "meta" | "meta-messages" | "openai-compatible" | "anthropic" | "openai";
4
+ export interface LlmPreset {
5
+ readonly baseUrl: string;
6
+ readonly format: LlmFormat;
7
+ readonly model: string;
8
+ readonly apiKeyEnv?: string;
9
+ }
10
+ export declare const LLM_PRESETS: Record<LlmPresetId, LlmPreset>;
11
+ export declare const DEFAULT_PRESET_ID: LlmPresetId;
12
+ export declare const DEFAULT_TIMEOUT_MS = 30000;
13
+ export declare const DEFAULT_MAX_OUTPUT_TOKENS = 1024;
14
+ export interface LlmConfig {
15
+ readonly provider: LlmPresetId;
16
+ readonly baseUrl: string;
17
+ readonly format: LlmFormat;
18
+ readonly model: string;
19
+ readonly apiKeyEnv?: string;
20
+ readonly timeoutMs: number;
21
+ readonly maxOutputTokens: number;
22
+ readonly reasoningEffort?: string;
23
+ }
24
+ export declare function isRecord(value: unknown): value is Record<string, unknown>;
25
+ export declare function narrowLlmConfig(config: unknown): Result<LlmConfig>;
@@ -0,0 +1,159 @@
1
+ // SPEC §4.17.1: the preset table and the §7.2 llm config block narrowing.
2
+ // S24: the meta preset (model muse-spark-1.3) is the default suggestion and
3
+ // no preset selects a -contributor variant.
4
+ import { err, makeError, ok } from "../../kernel/index.js";
5
+ function preset(baseUrl, format, model, apiKeyEnv) {
6
+ return apiKeyEnv === undefined
7
+ ? { baseUrl, format, model }
8
+ : { baseUrl, format, model, apiKeyEnv };
9
+ }
10
+ // SPEC §4.17.1: the preset table. openai-compatible targets a local runtime
11
+ // (127.0.0.1 over http is allowed for it); every other preset needs https.
12
+ export const LLM_PRESETS = {
13
+ meta: preset("https://api.meta.ai/v1", "openai-chat", "muse-spark-1.3", "MODEL_API_KEY"),
14
+ "meta-messages": preset("https://api.meta.ai/v1", "anthropic-messages", "muse-spark-1.3", "MODEL_API_KEY"),
15
+ "openai-compatible": preset("", "openai-chat", ""),
16
+ anthropic: preset("https://api.anthropic.com/v1", "anthropic-messages", "", "ANTHROPIC_API_KEY"),
17
+ openai: preset("https://api.openai.com/v1", "openai-chat", "", "OPENAI_API_KEY"),
18
+ };
19
+ export const DEFAULT_PRESET_ID = "meta";
20
+ export const DEFAULT_TIMEOUT_MS = 30_000;
21
+ export const DEFAULT_MAX_OUTPUT_TOKENS = 1024;
22
+ const PRESET_IDS = [
23
+ "meta",
24
+ "meta-messages",
25
+ "openai-compatible",
26
+ "anthropic",
27
+ "openai",
28
+ ];
29
+ function configError(message) {
30
+ return err(makeError("CDX-E106", message, "Set config.llm to a preset from SPEC §4.17.1 (provider, baseUrl, format, model, apiKeyEnv) with an https baseUrl, or point it at a 127.0.0.1 runtime."));
31
+ }
32
+ export function isRecord(value) {
33
+ return typeof value === "object" && value !== null && !Array.isArray(value);
34
+ }
35
+ // Bracket access through a variable keeps noPropertyAccessFromIndexSignature
36
+ // satisfied without tripping useLiteralKeys (deps/fields narrows the same
37
+ // way over its own records; this module stays dependency-free).
38
+ function configField(config, name) {
39
+ return config[name];
40
+ }
41
+ // One defaulting helper so the narrow functions below spend their branch
42
+ // budget on validation, not on fallback plumbing.
43
+ function fieldOr(config, name, fallback) {
44
+ const value = config[name];
45
+ return value ?? fallback;
46
+ }
47
+ function isPresetId(value) {
48
+ return typeof value === "string" && PRESET_IDS.includes(value);
49
+ }
50
+ function isFormat(value) {
51
+ return value === "openai-chat" || value === "anthropic-messages";
52
+ }
53
+ // SPEC §4.17.1: apiKeyEnv names an environment variable; a literal key is
54
+ // rejected with CDX-E106 instead of being sent anywhere.
55
+ function isEnvName(value) {
56
+ return typeof value === "string" && /^[A-Za-z_][A-Za-z0-9_]*$/.test(value);
57
+ }
58
+ function isLoopbackHost(host) {
59
+ const lowered = host.toLowerCase();
60
+ return (lowered === "localhost" ||
61
+ lowered === "::1" ||
62
+ lowered === "127.0.0.1" ||
63
+ lowered.startsWith("127."));
64
+ }
65
+ // SPEC §4.17.4 EC-5: http is refused on non-loopback hosts (keys over
66
+ // plaintext); a loopback host stays allowed for local runtimes.
67
+ function checkBaseUrl(raw) {
68
+ let parsed;
69
+ try {
70
+ parsed = new URL(raw);
71
+ }
72
+ catch {
73
+ return configError(`llm baseUrl is not an absolute url: ${raw}`);
74
+ }
75
+ if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
76
+ return configError(`llm baseUrl must be https or loopback http: ${raw}`);
77
+ }
78
+ if (parsed.protocol === "http:" && !isLoopbackHost(parsed.hostname)) {
79
+ return configError(`llm baseUrl uses plaintext http on a non-loopback host: ${raw}`);
80
+ }
81
+ return ok(raw);
82
+ }
83
+ function positiveInt(value) {
84
+ return typeof value === "number" && Number.isSafeInteger(value) && value > 0
85
+ ? value
86
+ : undefined;
87
+ }
88
+ function narrowEndpoint(config) {
89
+ const providerRaw = fieldOr(config, "provider", DEFAULT_PRESET_ID);
90
+ if (!isPresetId(providerRaw)) {
91
+ return configError(`unknown llm provider: ${String(fieldOr(config, "provider", ""))}`);
92
+ }
93
+ const defaults = LLM_PRESETS[providerRaw];
94
+ const baseUrlRaw = fieldOr(config, "baseUrl", defaults.baseUrl);
95
+ if (typeof baseUrlRaw !== "string" || baseUrlRaw === "") {
96
+ return configError(`llm provider ${providerRaw} needs a baseUrl`);
97
+ }
98
+ const checked = checkBaseUrl(baseUrlRaw);
99
+ if (!checked.ok) {
100
+ return err(checked.error);
101
+ }
102
+ const formatRaw = fieldOr(config, "format", defaults.format);
103
+ if (!isFormat(formatRaw)) {
104
+ return configError(`unknown llm format: ${String(formatRaw)}`);
105
+ }
106
+ const modelRaw = fieldOr(config, "model", defaults.model);
107
+ if (typeof modelRaw !== "string" || modelRaw === "") {
108
+ return configError(`llm provider ${providerRaw} needs a model`);
109
+ }
110
+ return ok({
111
+ provider: providerRaw,
112
+ baseUrl: baseUrlRaw,
113
+ format: formatRaw,
114
+ model: modelRaw,
115
+ });
116
+ }
117
+ function narrowBudgets(config, endpoint) {
118
+ const fallbackKey = LLM_PRESETS[endpoint.provider].apiKeyEnv;
119
+ const apiKeyEnvRaw = fieldOr(config, "apiKeyEnv", fallbackKey);
120
+ if (apiKeyEnvRaw !== undefined && !isEnvName(apiKeyEnvRaw)) {
121
+ return configError("llm apiKeyEnv must name an environment variable");
122
+ }
123
+ const timeoutRaw = fieldOr(config, "timeoutMs", DEFAULT_TIMEOUT_MS);
124
+ const timeoutMs = positiveInt(timeoutRaw);
125
+ if (timeoutMs === undefined) {
126
+ return configError("llm timeoutMs must be a positive integer");
127
+ }
128
+ const tokensRaw = fieldOr(config, "maxOutputTokens", DEFAULT_MAX_OUTPUT_TOKENS);
129
+ const maxOutputTokens = positiveInt(tokensRaw);
130
+ if (maxOutputTokens === undefined) {
131
+ return configError("llm maxOutputTokens must be a positive integer");
132
+ }
133
+ const reasoningRaw = configField(config, "reasoningEffort");
134
+ if (reasoningRaw !== undefined && typeof reasoningRaw !== "string") {
135
+ return configError("llm reasoningEffort must be a string");
136
+ }
137
+ const narrowed = {
138
+ provider: endpoint.provider,
139
+ baseUrl: endpoint.baseUrl,
140
+ format: endpoint.format,
141
+ model: endpoint.model,
142
+ timeoutMs,
143
+ maxOutputTokens,
144
+ ...(apiKeyEnvRaw === undefined ? {} : { apiKeyEnv: apiKeyEnvRaw }),
145
+ };
146
+ return reasoningRaw === undefined
147
+ ? ok(narrowed)
148
+ : ok({ ...narrowed, reasoningEffort: reasoningRaw });
149
+ }
150
+ export function narrowLlmConfig(config) {
151
+ if (!isRecord(config)) {
152
+ return configError("llm config must be an object");
153
+ }
154
+ const endpoint = narrowEndpoint(config);
155
+ if (!endpoint.ok) {
156
+ return err(endpoint.error);
157
+ }
158
+ return narrowBudgets(config, endpoint.value);
159
+ }
@@ -0,0 +1,17 @@
1
+ import type { LlmConfig } from "./presets.ts";
2
+ export interface WireRequest {
3
+ readonly method: string;
4
+ readonly url: string;
5
+ readonly headers: Readonly<Record<string, string>>;
6
+ readonly body: string;
7
+ }
8
+ export interface WireText {
9
+ readonly text: string;
10
+ readonly stopReason: string;
11
+ readonly truncated: boolean;
12
+ }
13
+ export declare const ANTHROPIC_VERSION = "2023-06-01";
14
+ export declare function buildOpenaiChatRequest(config: LlmConfig, model: string, prompt: string, maxTokens: number, key: string | undefined, withResponseFormat: boolean): WireRequest;
15
+ export declare function buildAnthropicRequest(config: LlmConfig, model: string, prompt: string, maxTokens: number, key: string | undefined): WireRequest;
16
+ export declare function buildWireRequest(config: LlmConfig, model: string, prompt: string, maxTokens: number, key: string | undefined, withResponseFormat: boolean): WireRequest;
17
+ export declare function readWireText(format: LlmConfig["format"], body: string): WireText | undefined;