codictator 0.0.0-stage → 0.1.2

package/dist/features/llm/wire.js

@@ -0,0 +1,163 @@
+// SPEC §4.17.2: the two wire formats. Builders turn a narrowed config plus a
+// completion request into a Net port request; readers pull the text (and the
+// provider's stop signal) back out of a 200 body. Pure over caller-supplied
+// strings, so the retry loop in index.ts stays small.
+import { parseJson } from "../../kernel/index.js";
+import { isRecord } from "./presets.js";
+export const ANTHROPIC_VERSION = "2023-06-01";
+// Bracket access through a variable keeps
+// noPropertyAccessFromIndexSignature satisfied without tripping
+// useLiteralKeys (kernel narrows the same way).
+function field(value, name) {
+    return value[name];
+}
+function isMetaHost(baseUrl) {
+    return new URL(baseUrl).hostname.toLowerCase() === "api.meta.ai";
+}
+function bearerHeaders(key) {
+    const headers = {
+        "content-type": "application/json",
+    };
+    if (key !== undefined) {
+        const authorizationKey = "authorization";
+        headers[authorizationKey] = `Bearer ${key}`;
+    }
+    return headers;
+}
+// SPEC §4.17.2: openai-chat posts to {baseUrl}/chat/completions with a
+// developer message, temperature 0 and (when supported) a json_object
+// response_format. reasoning_effort rides along when set, but never "none"
+// for Muse Spark, which rejects it.
+export function buildOpenaiChatRequest(config, model, prompt, maxTokens, key, withResponseFormat) {
+    const body = {
+        model,
+        messages: [{ role: "developer", content: prompt }],
+        temperature: 0,
+        max_tokens: maxTokens,
+    };
+    if (withResponseFormat) {
+        const formatKey = "response_format";
+        body[formatKey] = { type: "json_object" };
+    }
+    const effort = config.reasoningEffort;
+    const isSpark = model.startsWith("muse-spark");
+    if (effort !== undefined && !(isSpark && effort === "none")) {
+        const effortKey = "reasoning_effort";
+        body[effortKey] = effort;
+    }
+    return {
+        method: "POST",
+        url: `${config.baseUrl}/chat/completions`,
+        headers: bearerHeaders(key),
+        body: JSON.stringify(body),
+    };
+}
+// SPEC §4.17.2: anthropic-messages posts to {baseUrl}/messages with a system
+// prompt, a user message, max_tokens, the anthropic-version header and the
+// key as x-api-key (Bearer for Meta).
+export function buildAnthropicRequest(config, model, prompt, maxTokens, key) {
+    const headers = {
+        "content-type": "application/json",
+        "anthropic-version": ANTHROPIC_VERSION,
+    };
+    if (key !== undefined) {
+        if (isMetaHost(config.baseUrl)) {
+            const authorizationKey = "authorization";
+            headers[authorizationKey] = `Bearer ${key}`;
+        }
+        else {
+            headers["x-api-key"] = key;
+        }
+    }
+    return {
+        method: "POST",
+        url: `${config.baseUrl}/messages`,
+        headers,
+        body: JSON.stringify({
+            model,
+            system: prompt,
+            messages: [{ role: "user", content: prompt }],
+            max_tokens: maxTokens,
+            temperature: 0,
+        }),
+    };
+}
+function readOpenaiText(parsed) {
+    if (!isRecord(parsed)) {
+        return undefined;
+    }
+    const choices = field(parsed, "choices");
+    if (!Array.isArray(choices)) {
+        return undefined;
+    }
+    const first = choices[0];
+    if (!isRecord(first)) {
+        return undefined;
+    }
+    const message = field(first, "message");
+    if (!isRecord(message)) {
+        return undefined;
+    }
+    const content = field(message, "content");
+    if (typeof content !== "string") {
+        return undefined;
+    }
+    const reason = field(first, "finish_reason");
+    const finishReason = typeof reason === "string" ? reason : "stop";
+    return {
+        text: content,
+        stopReason: finishReason,
+        truncated: finishReason === "length",
+    };
+}
+function readAnthropicText(parsed) {
+    if (!isRecord(parsed)) {
+        return undefined;
+    }
+    const content = field(parsed, "content");
+    if (!Array.isArray(content)) {
+        return undefined;
+    }
+    const parts = [];
+    for (const block of content) {
+        if (!isRecord(block)) {
+            continue;
+        }
+        if (field(block, "type") !== "text") {
+            continue;
+        }
+        const text = field(block, "text");
+        if (typeof text !== "string") {
+            continue;
+        }
+        parts.push(text);
+    }
+    if (parts.length === 0) {
+        return undefined;
+    }
+    const reason = field(parsed, "stop_reason");
+    const stopReason = typeof reason === "string" ? reason : "end_turn";
+    return {
+        text: parts.join(""),
+        stopReason,
+        truncated: stopReason === "max_tokens",
+    };
+}
+// SPEC §4.17.2: pick the wire format from the narrowed config.
+export function buildWireRequest(config, model, prompt, maxTokens, key, withResponseFormat) {
+    return config.format === "openai-chat"
+        ? buildOpenaiChatRequest(config, model, prompt, maxTokens, key, withResponseFormat)
+        : buildAnthropicRequest(config, model, prompt, maxTokens, key);
+}
+// Read a 200 body per the configured format. Undefined means the provider
+// answered something the format cannot carry, which the client reports as
+// invalid JSON for the generator repair round (EC-7).
+export function readWireText(format, body) {
+    const parsed = parseJson(body);
+    if (!parsed.ok) {
+        return undefined;
+    }
+    return format === "openai-chat"
+        ? readOpenaiText(parsed.value)
+        : readAnthropicText(parsed.value);
+}

package/dist/features/packs/accept.d.ts

@@ -0,0 +1,7 @@
+import type { Ports, Result } from "../../kernel/index.ts";
+import type { PackAccepted } from "./index.ts";
+export interface AcceptPackOptions {
+    readonly isTty: boolean;
+    readonly agentMarkers?: ReadonlyArray<string>;
+}
+export declare function acceptPack(packDir: string, ports: Ports, options: AcceptPackOptions): Promise<Result<PackAccepted>>;

package/dist/features/packs/accept.js

@@ -0,0 +1,73 @@
+// SPEC §4.4.7: acceptance of custom packs. `codictator pack accept` is
+// human-only, runs the self-test, then writes accepted.json (§7.4); any
+// later byte change invalidates it and the loader holds the pack inert.
+import path from "node:path";
+import { err, makeError, ok, stableStringify } from "../../kernel/index.js";
+import { requireHuman } from "../config/index.js";
+import { ACCEPTED_NAME, packHashFor, selfTestHashFor } from "./hashes.js";
+import { loadPack } from "./loader.js";
+import { selfTest } from "./selftest.js";
+function refused(error) {
+    if (typeof error === "object" &&
+        error !== null &&
+        "code" in error &&
+        typeof error.code === "string" &&
+        "message" in error &&
+        typeof error.message === "string" &&
+        "remediation" in error &&
+        typeof error.remediation === "string") {
+        const coded = {
+            code: error.code,
+            message: error.message,
+            remediation: error.remediation,
+        };
+        return err(coded);
+    }
+    return err(makeError("CDX-E901", "pack accept refused without a coded error", "Retry in an interactive terminal, then re-run codictator pack accept."));
+}
+function toPosix(value) {
+    return value.split(path.sep).join("/");
+}
+// SPEC §4.4.7: human-only acceptance after a green self-test. Paths read
+// through the caller's ports in caller form; the CLI passes repo-relative
+// pack dirs with repo-rooted ports.
+export async function acceptPack(packDir, ports, options) {
+    try {
+        requireHuman(ports.env, options.isTty, options.agentMarkers ?? []);
+    }
+    catch (error) {
+        return refused(error);
+    }
+    const dirForm = toPosix(packDir);
+    const loaded = await loadPack(packDir, { ports, skipAcceptance: true });
+    if (!loaded.ok) {
+        return err(loaded.error);
+    }
+    const tested = await selfTest(loaded.value);
+    if (!tested.ok) {
+        return err(tested.error);
+    }
+    const hashed = await packHashFor(ports.fs, dirForm);
+    if (!hashed.ok) {
+        return err(hashed.error);
+    }
+    const email = await ports.git.config("user.email");
+    if (!email.ok) {
+        return err(email.error);
+    }
+    if (email.value.trim().length === 0) {
+        return err(makeError("CDX-E903", "git user.email is not set; pack acceptance needs an author", "Set git user.email, then re-run codictator pack accept."));
+    }
+    const accepted = {
+        version: 1,
+        packHash: hashed.value,
+        selfTestHash: selfTestHashFor(loaded.value.manifest),
+        acceptedAt: ports.clock.now(),
+        acceptedBy: email.value.trim(),
+    };
+    const written = await ports.fs.write(`${dirForm}/${ACCEPTED_NAME}`, new TextEncoder().encode(stableStringify(accepted)));
+    if (!written.ok) {
+        return err(written.error);
+    }
+    return ok(accepted);
+}

package/dist/features/packs/enforcers/arch-guards.d.ts

@@ -0,0 +1,12 @@
+import type { Ports } from "../../../kernel/index.ts";
+import { type Result } from "../../../kernel/index.ts";
+import type { Enforcer } from "../../engine/index.ts";
+import type { PackRule } from "../index.ts";
+import { type EnforcerDecl } from "../manifest.ts";
+export declare function resolveArchProfileDeclared(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;
+export declare function resolveArchModuleMapped(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;
+export declare function resolveArchBoundaries(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;
+export declare function resolveArchPublicEntry(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;
+export declare function resolveArchNoCycles(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;
+export declare function resolveArchModuleSize(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;
+export declare function resolveCompilerStrict(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;

package/dist/features/packs/enforcers/arch-guards.js

@@ -0,0 +1,193 @@
+import { ok, parseJson } from "../../../kernel/index.js";
+import { isRecord } from "../manifest.js";
+import { bindRule, findingFor, selectFiles } from "./binding.js";
+import { baseEnforcer, limitOf, loadScopeText, parseMarkerInt, parseMarkers, } from "./health-measures.js";
+// SPEC §5.7 core/arch-profile-declared: a missing architecture profile
+// flags.
+export function resolveArchProfileDeclared(decl, rule, ports) {
+    const binding = bindRule(rule);
+    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
+        const findings = [];
+        for (const file of selectFiles(ctx.scope.files, binding.scopeGlobs)) {
+            const text = await loadScopeText(ports, binding, file, findings);
+            if (text === undefined) {
+                continue;
+            }
+            if ((parseMarkers(text).get("profile") ?? "") === "none") {
+                findings.push(findingFor(binding, {
+                    path: file,
+                    message: `architecture profile missing for ${file}`,
+                    vars: { path: file },
+                }));
+            }
+        }
+        return findings;
+    }));
+}
+// SPEC §5.7 core/arch-module-mapped: a file outside every module flags.
+export function resolveArchModuleMapped(decl, rule, ports) {
+    const binding = bindRule(rule);
+    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
+        const findings = [];
+        for (const file of selectFiles(ctx.scope.files, binding.scopeGlobs)) {
+            const text = await loadScopeText(ports, binding, file, findings);
+            if (text === undefined) {
+                continue;
+            }
+            if ((parseMarkers(text).get("module") ?? "") === "unmapped") {
+                findings.push(findingFor(binding, {
+                    path: file,
+                    message: `file outside every module: ${file}`,
+                    vars: { path: file },
+                }));
+            }
+        }
+        return findings;
+    }));
+}
+// SPEC §5.7 core/arch-boundaries: an import along a denied edge flags.
+export function resolveArchBoundaries(decl, rule, ports) {
+    const binding = bindRule(rule);
+    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
+        const findings = [];
+        for (const file of selectFiles(ctx.scope.files, binding.scopeGlobs)) {
+            const text = await loadScopeText(ports, binding, file, findings);
+            if (text === undefined) {
+                continue;
+            }
+            if ((parseMarkers(text).get("allowed") ?? "") === "false") {
+                findings.push(findingFor(binding, {
+                    path: file,
+                    message: `import along a denied edge in ${file}`,
+                    vars: { path: file },
+                }));
+            }
+        }
+        return findings;
+    }));
+}
+// SPEC §5.7 core/arch-public-entry: a deep import past the module entry
+// flags.
+// SPEC §5.7 core/arch-public-entry: a cross-module import targets the
+// public entry, never the internals. The report is an `import:` marker
+// line (the fixture measure report carries it); mere prose mentioning
+// internals — SPEC EC tables, test titles, the rule reason — is not a
+// deep import.
+export function resolveArchPublicEntry(decl, rule, ports) {
+    const binding = bindRule(rule);
+    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
+        const findings = [];
+        for (const file of selectFiles(ctx.scope.files, binding.scopeGlobs)) {
+            const text = await loadScopeText(ports, binding, file, findings);
+            if (text === undefined) {
+                continue;
+            }
+            const deep = [...text.matchAll(/^[ \t]*import:[ \t]*(\S+)/gm)].some((match) => (match[1] ?? "")
+                .split("/")
+                .some((segment) => segment === "internals" || segment.startsWith("internals.")));
+            if (!deep) {
+                continue;
+            }
+            findings.push(findingFor(binding, {
+                path: file,
+                message: `deep import past the public entry in ${file}`,
+                vars: { path: file },
+            }));
+        }
+        return findings;
+    }));
+}
+// SPEC §5.7 core/arch-no-cycles: a module cycle flags.
+export function resolveArchNoCycles(decl, rule, ports) {
+    const binding = bindRule(rule);
+    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
+        const findings = [];
+        for (const file of selectFiles(ctx.scope.files, binding.scopeGlobs)) {
+            const text = await loadScopeText(ports, binding, file, findings);
+            if (text === undefined) {
+                continue;
+            }
+            const edges = parseMarkers(text).get("edges") ?? "";
+            const nodes = edges
+                .split("->")
+                .map((node) => node.trim())
+                .filter((node) => node !== "");
+            if (nodes.length > 1 && new Set(nodes).size < nodes.length) {
+                findings.push(findingFor(binding, {
+                    path: file,
+                    message: `module cycle in ${file}: ${edges}`,
+                    vars: { path: file },
+                }));
+            }
+        }
+        return findings;
+    }));
+}
+// SPEC §5.7 core/arch-module-size: a module over its file or line limit
+// flags.
+export function resolveArchModuleSize(decl, rule, ports) {
+    const binding = bindRule(rule);
+    const maxFiles = limitOf(binding, "maxFiles", 80);
+    const maxLines = limitOf(binding, "maxLines", 8000);
+    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
+        const findings = [];
+        for (const file of selectFiles(ctx.scope.files, binding.scopeGlobs)) {
+            const text = await loadScopeText(ports, binding, file, findings);
+            if (text === undefined) {
+                continue;
+            }
+            const markers = parseMarkers(text);
+            const files = parseMarkerInt(markers, "files");
+            const lines = parseMarkerInt(markers, "lines");
+            if ((files !== undefined && files > maxFiles) ||
+                (lines !== undefined && lines > maxLines)) {
+                findings.push(findingFor(binding, {
+                    path: file,
+                    message: `module over its size limit in ${file}`,
+                    vars: {
+                        path: file,
+                        limit: `${String(maxFiles)}/${String(maxLines)}`,
+                    },
+                }));
+            }
+        }
+        return findings;
+    }));
+}
+function isTsconfigShape(value) {
+    if (!isRecord(value)) {
+        return false;
+    }
+    const { compilerOptions } = value;
+    return compilerOptions === undefined || isRecord(compilerOptions);
+}
+function isStrictTsconfig(text) {
+    const parsed = parseJson(text);
+    if (!parsed.ok || !isTsconfigShape(parsed.value)) {
+        return false;
+    }
+    return parsed.value.compilerOptions?.strict === true;
+}
+export function resolveCompilerStrict(decl, rule, ports) {
+    const binding = bindRule(rule);
+    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
+        const findings = [];
+        for (const file of selectFiles(ctx.scope.files, binding.scopeGlobs)) {
+            if (!file.endsWith("tsconfig.json")) {
+                continue;
+            }
+            const text = await loadScopeText(ports, binding, file, findings);
+            if (text === undefined) {
+                continue;
+            }
+            if (!isStrictTsconfig(text)) {
+                findings.push(findingFor(binding, {
+                    path: file,
+                    message: `strict mode off in ${file}`,
+                    vars: { path: file },
+                }));
+            }
+        }
+        return findings;
+    }));
+}

package/dist/features/packs/enforcers/binding.d.ts

@@ -0,0 +1,31 @@
+import type { CdxError, Fs, Result } from "../../../kernel/index.ts";
+import { type Finding, type Trigger } from "../../engine/index.ts";
+import type { PackRule } from "../index.ts";
+export interface RuleBinding {
+    readonly ruleId: string;
+    readonly triggers: ReadonlyArray<Trigger>;
+    readonly scopeGlobs: ReadonlyArray<string>;
+    readonly remediation: string;
+    readonly tunables: Readonly<Record<string, unknown>>;
+}
+export declare function isTestPath(path: string): boolean;
+export declare function isLockfilePath(path: string): boolean;
+export declare function bindRule(rule: PackRule): RuleBinding;
+export declare function tunableNumber(binding: RuleBinding, name: string): number | undefined;
+export declare function tunableStringList(binding: RuleBinding, name: string): Array<string> | undefined;
+export declare function selectFiles(scopeFiles: ReadonlyArray<string>, scopeGlobs: ReadonlyArray<string>): Array<string>;
+export declare function fillRemediation(template: string, vars: Readonly<Record<string, string>>): string;
+export declare function findingFor(binding: RuleBinding, init: Omit<Finding, "ruleId" | "remediation"> & {
+    readonly vars?: Readonly<Record<string, string>>;
+}): Finding;
+export declare function readErrorFinding(binding: RuleBinding, path: string, error: CdxError, detail: string): Finding;
+export declare function readLossyText(fs: Fs, path: string): Promise<Result<{
+    readonly bytes: number;
+    readonly text: string;
+}>>;
+export declare function bindingError(declId: string, detail: string): Result<never>;
+export declare function isUnboundArgs(args: unknown): boolean;
+export declare function argsRecord(declId: string, args: unknown): Result<Record<string, unknown>>;
+export declare function nonEmptyString(value: unknown): value is string;
+export declare function stringList(value: unknown): Array<string> | undefined;
+export declare function nonNegativeInteger(value: unknown): value is number;

package/dist/features/packs/enforcers/binding.js

@@ -0,0 +1,157 @@
+import { cachedLossyText, err, globMatch, makeError, ok, } from "../../../kernel/index.js";
+import { TRIGGERS } from "../../engine/index.js";
+import { field, isRecord } from "../manifest.js";
+function isTrigger(value) {
+    for (const trigger of TRIGGERS) {
+        if (trigger === value) {
+            return true;
+        }
+    }
+    return false;
+}
+// SPEC §3.1 + §5.6: the size and placement rules treat test trees as
+// non-production code, so the size enforcers skip them. Lockfiles and
+// fixture data are generated or test vectors, governed by dep-lockfile and
+// the pack self-test instead.
+const TEST_PATH_GLOBS = [
+    "**/tests/**",
+    "**/test/**",
+    "**/__tests__/**",
+    "**/*.test.*",
+];
+const LOCKFILE_BASENAMES = new Set([
+    "package-lock.json",
+    "pnpm-lock.yaml",
+    "yarn.lock",
+    "packages.lock.json",
+    "Cargo.lock",
+    "poetry.lock",
+    "uv.lock",
+    "Gemfile.lock",
+    "composer.lock",
+    "go.sum",
+]);
+export function isTestPath(path) {
+    return TEST_PATH_GLOBS.some((glob) => globMatch(glob, path));
+}
+export function isLockfilePath(path) {
+    const slash = path.replaceAll("\\", "/").lastIndexOf("/");
+    const base = slash < 0 ? path : path.slice(slash + 1);
+    return LOCKFILE_BASENAMES.has(base);
+}
+// SPEC §4.4.3 step 4: the binding keeps the rule's own triggers, scope and
+// tunable defaults; config-layer tightening applies them later (phase 4).
+export function bindRule(rule) {
+    const triggers = [];
+    for (const trigger of rule.triggers ?? []) {
+        if (isTrigger(trigger)) {
+            triggers.push(trigger);
+        }
+    }
+    const tunables = {};
+    for (const [name, param] of Object.entries(rule.params ?? {})) {
+        if (isRecord(param)) {
+            tunables[name] = field(param, "default");
+        }
+    }
+    return {
+        ruleId: rule.id,
+        triggers,
+        scopeGlobs: [...(rule.scope ?? [])],
+        remediation: rule.remediation,
+        tunables,
+    };
+}
+export function tunableNumber(binding, name) {
+    const value = binding.tunables[name];
+    if (typeof value === "number" && Number.isFinite(value)) {
+        return value;
+    }
+    return undefined;
+}
+export function tunableStringList(binding, name) {
+    const value = binding.tunables[name];
+    if (Array.isArray(value) &&
+        value.every((entry) => typeof entry === "string")) {
+        return [...value];
+    }
+    return undefined;
+}
+// SPEC §4.3.3 step 1: an empty rule scope selects every trigger-scoped
+// file; otherwise a file must match at least one rule glob. Sorted, so the
+// enforcer order never depends on the trigger's arrival order (§4.3.6).
+export function selectFiles(scopeFiles, scopeGlobs) {
+    const sorted = [...scopeFiles].sort();
+    if (scopeGlobs.length === 0) {
+        return sorted;
+    }
+    return sorted.filter((file) => scopeGlobs.some((glob) => globMatch(glob, file)));
+}
+// SPEC §7.3: remediation placeholders fill from the finding; a placeholder
+// with no value stays literal rather than inventing text.
+export function fillRemediation(template, vars) {
+    let out = template;
+    for (const key of Object.keys(vars)) {
+        const value = vars[key];
+        if (typeof value !== "string") {
+            continue;
+        }
+        out = out.split(`{${key}}`).join(value);
+    }
+    return out;
+}
+export function findingFor(binding, init) {
+    const { vars, ...rest } = init;
+    return {
+        ...rest,
+        ruleId: binding.ruleId,
+        remediation: fillRemediation(binding.remediation, vars ?? {}),
+    };
+}
+// Fail-closed reads: no file content in the message (§9.2); the engine
+// keeps CDX-E findings unwaived and blocking (§4.3.4, §4.3.8).
+export function readErrorFinding(binding, path, error, detail) {
+    return findingFor(binding, {
+        path,
+        code: error.code,
+        message: `the guard could not ${detail} ${path}; the code was not judged`,
+    });
+}
+// One port read for every parametric kind: bytes for sizes, lossy text for
+// patterns. Lossy decoding never fails on binary input, so only I/O errors
+// fail closed; determinism comes from the port, never the content. The
+// decode is shared per evaluation through the kernel cache (SPEC §4.3.6),
+// so N guards over one file pay one read and one decode, not N of each.
+export async function readLossyText(fs, path) {
+    return cachedLossyText(fs, path);
+}
+// Shared pack-author arg narrowing: every kind takes an args object, and
+// malformed args fail the load (CDX-E203) before any check runs. An absent
+// or empty args object means the pack declares no binding: the resolver
+// defers the decl (fail-closed E901) instead of failing the whole load, so
+// frozen manifests keep loading while unbound enforcers stay inert.
+export function bindingError(declId, detail) {
+    return err(makeError("CDX-E203", `pack enforcer "${declId}" ${detail}`, "Fix the enforcer args so they match SPEC §4.4.6, then reload the pack."));
+}
+export function isUnboundArgs(args) {
+    return (args === undefined || (isRecord(args) && Object.keys(args).length === 0));
+}
+export function argsRecord(declId, args) {
+    if (!isRecord(args)) {
+        return bindingError(declId, "needs an args object for its §4.4.6 kind");
+    }
+    return ok(args);
+}
+export function nonEmptyString(value) {
+    return typeof value === "string" && value.length > 0;
+}
+export function stringList(value) {
+    if (Array.isArray(value) &&
+        value.every((entry) => typeof entry === "string")) {
+        return [...value];
+    }
+    return undefined;
+}
+export function nonNegativeInteger(value) {
+    return typeof value === "number" && Number.isInteger(value) && value >= 0;
+}

package/dist/features/packs/enforcers/ci-guards.d.ts

@@ -0,0 +1,10 @@
+import type { Ports } from "../../../kernel/index.ts";
+import { type Result } from "../../../kernel/index.ts";
+import type { Enforcer } from "../../engine/index.ts";
+import type { PackRule } from "../index.ts";
+import type { EnforcerDecl } from "../manifest.ts";
+export declare function resolveCiPresent(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;
+export declare function resolveCiActionsPinned(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;
+export declare function resolveBranchProtection(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;
+export declare function resolveCiRequiredCheck(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;
+export declare function resolveConventionalCommit(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;