codictator 0.0.0-stage → 0.1.2

package/dist/features/packs/enforcers/workflow-guards.js

@@ -0,0 +1,117 @@
+import { ok } from "../../../kernel/index.js";
+import { bindRule, findingFor, selectFiles } from "./binding.js";
+import { baseEnforcer, limitOf, loadScopeText, parseMarkerInt, parseMarkers, } from "./health-measures.js";
+// A skipped mandatory gate flags. The marker is a report line (`skipped:`
+// at the line start, as the fixture measure report carries it), never a
+// substring: status strings like "corrupt lines skipped: 2" and the
+// guard's own source are not skipped gates.
+export function resolveWorkflowGates(decl, rule, ports) {
+    const binding = bindRule(rule);
+    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
+        const findings = [];
+        for (const file of selectFiles(ctx.scope.files, binding.scopeGlobs)) {
+            const text = await loadScopeText(ports, binding, file, findings);
+            if (text === undefined || !/^[ \t]*skipped:/m.test(text)) {
+                continue;
+            }
+            findings.push(findingFor(binding, {
+                path: file,
+                message: `mandatory gate skipped in ${file}`,
+                vars: { path: file },
+            }));
+        }
+        return findings;
+    }));
+}
+// SPEC §5.9 core/writes-within-plan: a write no plan allows flags.
+export function resolveWritesWithinPlan(decl, rule, ports) {
+    const binding = bindRule(rule);
+    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
+        const findings = [];
+        for (const file of selectFiles(ctx.scope.files, binding.scopeGlobs)) {
+            const text = await loadScopeText(ports, binding, file, findings);
+            if (text === undefined) {
+                continue;
+            }
+            if ((parseMarkers(text).get("planned") ?? "") === "false") {
+                findings.push(findingFor(binding, {
+                    path: file,
+                    message: `write outside the plan in ${file}`,
+                    vars: { path: file },
+                }));
+            }
+        }
+        return findings;
+    }));
+}
+// SPEC §5.9 core/loop-breaker: repeats past the tunable cap flag.
+export function resolveLoopBreaker(decl, rule, ports) {
+    const binding = bindRule(rule);
+    const maxRepeats = limitOf(binding, "maxRepeats", 3);
+    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
+        const findings = [];
+        for (const file of selectFiles(ctx.scope.files, binding.scopeGlobs)) {
+            const text = await loadScopeText(ports, binding, file, findings);
+            if (text === undefined) {
+                continue;
+            }
+            const markers = parseMarkers(text);
+            const repeats = parseMarkerInt(markers, "repeats");
+            const cap = parseMarkerInt(markers, "limit") ?? maxRepeats;
+            if (repeats !== undefined && repeats > cap) {
+                findings.push(findingFor(binding, {
+                    path: file,
+                    message: `loop past ${String(cap)} repeats in ${file}`,
+                    vars: { path: file, limit: String(cap) },
+                }));
+            }
+        }
+        return findings;
+    }));
+}
+// SPEC §5.9 core/review-gate: landing with no review flags.
+export function resolveReviewGate(decl, rule, ports) {
+    const binding = bindRule(rule);
+    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
+        const findings = [];
+        for (const file of selectFiles(ctx.scope.files, binding.scopeGlobs)) {
+            const text = await loadScopeText(ports, binding, file, findings);
+            if (text === undefined) {
+                continue;
+            }
+            if ((parseMarkers(text).get("review") ?? "") === "none") {
+                findings.push(findingFor(binding, {
+                    path: file,
+                    message: `landing with no review in ${file}`,
+                    vars: { path: file },
+                }));
+            }
+        }
+        return findings;
+    }));
+}
+// SPEC §5.9 core/review-round-cap: rounds past the tunable cap flag.
+export function resolveReviewRoundCap(decl, rule, ports) {
+    const binding = bindRule(rule);
+    const maxRounds = limitOf(binding, "maxRounds", 3);
+    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
+        const findings = [];
+        for (const file of selectFiles(ctx.scope.files, binding.scopeGlobs)) {
+            const text = await loadScopeText(ports, binding, file, findings);
+            if (text === undefined) {
+                continue;
+            }
+            const markers = parseMarkers(text);
+            const rounds = parseMarkerInt(markers, "rounds");
+            const cap = parseMarkerInt(markers, "cap") ?? maxRounds;
+            if (rounds !== undefined && rounds > cap) {
+                findings.push(findingFor(binding, {
+                    path: file,
+                    message: `review past ${String(cap)} rounds in ${file}`,
+                    vars: { path: file, limit: String(cap) },
+                }));
+            }
+        }
+        return findings;
+    }));
+}

package/dist/features/packs/enforcers/write-confine.d.ts

@@ -0,0 +1,13 @@
+import { type Ports } from "../../../kernel/index.ts";
+import type { CheckContext, Finding } from "../../engine/index.ts";
+import type { PackRule } from "../index.ts";
+import type { EnforcerDecl } from "../manifest.ts";
+export declare function resolveWriteConfinement(decl: EnforcerDecl, rule: PackRule, ports: Ports): {
+    ok: true;
+    value: {
+        id: string;
+        kinds: readonly ("compact" | "post-tool" | "pre-tool" | "prompt" | "review" | "scheduled" | "startup")[];
+        budgetMs: number;
+        check: (ctx: CheckContext) => Promise<Array<Finding>>;
+    };
+};

package/dist/features/packs/enforcers/write-confine.js

@@ -0,0 +1,131 @@
+// SPEC §4.7.3 core/write-confinement: tool.pre.write targets and shell
+// redirection targets resolve, through symlinks, to inside the repo root
+// or the OS temp dir; otherwise they block. Writes into .git/ are blocked
+// except through git itself. Targets arrive as `write:` lines and shell
+// sources of the scanned files; the Fs port resolves symlinks, so the
+// fixture symlink case blocks with a real root and escapes block lexically.
+import { analyseShell, isGitDirPath, toRepoPath, } from "../../../kernel/index.js";
+import { bindRule, findingFor, readErrorFinding, readLossyText, selectFiles, } from "./binding.js";
+import { extractShellSources } from "./shell-analyse.js";
+function writeLineTarget(line) {
+    const trimmed = line.trimStart();
+    if (!trimmed.toLowerCase().startsWith("write:")) {
+        return undefined;
+    }
+    const target = trimmed.slice("write:".length).trim();
+    return target === "" ? undefined : target;
+}
+function escapeFinding(binding, file, target) {
+    return findingFor(binding, {
+        path: file,
+        code: "CDX-E701",
+        message: `write target escapes the repo root: ${target}`,
+        vars: { path: file },
+    });
+}
+// A `write:` line inside code is object syntax (`write: "write",` in an
+// adapter capability table, `write: (chunk) => ...` in a fake), not a
+// tool target. Real targets are paths, so anything carrying code
+// characters is not a target at all and judges nothing; failing closed
+// stays for real targets that cannot resolve.
+const CODE_CHARS = /[-"'(){}[\];,=><|&$`]/;
+function isPathLike(target) {
+    return !CODE_CHARS.test(target);
+}
+async function checkTarget(ports, binding, file, target, findings) {
+    if (!isPathLike(target)) {
+        return;
+    }
+    const rel = toRepoPath(target);
+    if (!rel.ok) {
+        findings.push(escapeFinding(binding, file, target));
+        return;
+    }
+    if (isGitDirPath(rel.value)) {
+        findings.push(findingFor(binding, {
+            path: file,
+            message: `write target inside .git/ is only allowed through git: ${target}`,
+            vars: { path: file },
+        }));
+        return;
+    }
+    const real = await ports.fs.realpath(target);
+    if (!real.ok) {
+        if (real.error.code === "CDX-E701") {
+            findings.push(escapeFinding(binding, file, target));
+            return;
+        }
+        findings.push(readErrorFinding(binding, target, real.error, "resolve"));
+        return;
+    }
+}
+// SPEC §4.7.3 L1: the hook scope carries lexical write targets (the
+// tool file path and shell redirection targets), never disk files.
+// They judge without a single disk read: realpath on a not-yet-existing
+// file would fail benign writes closed, so only the lexical escape
+// (EC-1/EC-2 shape) and the .git guard apply. Anything needing the
+// filesystem (symlink escapes, EC-9) stays a disk-scope concern.
+function checkProposedTarget(binding, target, findings) {
+    if (!isPathLike(target)) {
+        return;
+    }
+    const rel = toRepoPath(target);
+    if (!rel.ok) {
+        findings.push(escapeFinding(binding, "tool input", target));
+        return;
+    }
+    if (isGitDirPath(rel.value)) {
+        findings.push(findingFor(binding, {
+            path: "tool input",
+            message: `write target inside .git/ is only allowed through git: ${target}`,
+            vars: { path: "tool input" },
+        }));
+    }
+}
+export function resolveWriteConfinement(decl, rule, ports) {
+    const binding = bindRule(rule);
+    return {
+        ok: true,
+        value: {
+            id: rule.id,
+            kinds: binding.triggers,
+            budgetMs: decl.budgetMs,
+            check: async (ctx) => {
+                const findings = [];
+                for (const file of selectFiles(ctx.scope.files, binding.scopeGlobs)) {
+                    const targets = new Set([file]);
+                    const loaded = await readLossyText(ports.fs, file);
+                    if (!loaded.ok) {
+                        findings.push(readErrorFinding(binding, file, loaded.error, "read"));
+                        continue;
+                    }
+                    for (const line of loaded.value.text.split("\n")) {
+                        const target = writeLineTarget(line);
+                        if (target !== undefined) {
+                            targets.add(target);
+                        }
+                    }
+                    for (const source of extractShellSources(loaded.value.text, file)) {
+                        const parsed = analyseShell(source);
+                        if (!parsed.ok) {
+                            continue;
+                        }
+                        for (const target of parsed.value.writeTargets) {
+                            targets.add(target);
+                        }
+                    }
+                    for (const target of [...targets].sort()) {
+                        await checkTarget(ports, binding, file, target, findings);
+                    }
+                }
+                // L1 hook targets are lexical only: no disk read, so benign
+                // writes to not-yet-existing files stay allowed while lexical
+                // escapes (EC-8 shape) still block.
+                for (const target of [...(ctx.scope.proposedPaths ?? [])].sort()) {
+                    checkProposedTarget(binding, target, findings);
+                }
+                return findings;
+            },
+        },
+    };
+}

package/dist/features/packs/hashes.d.ts

@@ -0,0 +1,6 @@
+import type { Fs, Result } from "../../kernel/index.ts";
+import type { PackManifest } from "./index.ts";
+export declare const ACCEPTED_NAME = "accepted.json";
+export declare function packHashFor(fs: Fs, dir: string): Promise<Result<string>>;
+export declare function selfTestHashFor(manifest: PackManifest): string;
+export declare function verifyAcceptance(fs: Fs, dir: string, manifest: PackManifest, acceptedSchemaText: string): Promise<Result<void>>;

package/dist/features/packs/hashes.js

@@ -0,0 +1,84 @@
+import { err, makeError, ok, parseJson, sha256Hex, sha256Text, stableStringify, validateSchema, } from "../../kernel/index.js";
+import { field, isRecord } from "./manifest.js";
+export const ACCEPTED_NAME = "accepted.json";
+// SPEC §7.4: packHash covers every file in the pack except this one, sorted
+// by path. Directories are skipped by stat; a stat or read failure fails
+// closed instead of silently dropping the file.
+export async function packHashFor(fs, dir) {
+    const listed = await fs.glob("**", dir);
+    if (!listed.ok) {
+        return err(listed.error);
+    }
+    const base = dir === "" ? "" : `${dir}/`;
+    const rels = [];
+    for (const full of listed.value) {
+        if (!full.startsWith(base)) {
+            continue;
+        }
+        const rel = full.slice(base.length);
+        if (rel === ACCEPTED_NAME) {
+            continue;
+        }
+        const st = await fs.stat(full);
+        if (!st.ok) {
+            return err(st.error);
+        }
+        if (st.value.isFile) {
+            rels.push(rel);
+        }
+    }
+    rels.sort();
+    const entries = [];
+    for (const rel of rels) {
+        const content = await fs.read(`${base}${rel}`);
+        if (!content.ok) {
+            return err(content.error);
+        }
+        entries.push({ path: rel, hash: sha256Hex(content.value) });
+    }
+    return ok(sha256Text(stableStringify(entries)));
+}
+// The self-test record: the pack identity plus the sorted rules the
+// self-test ran, so any rule, fixture or param change invalidates it.
+export function selfTestHashFor(manifest) {
+    const rules = [...manifest.rules].sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
+    return sha256Text(stableStringify({ pack: manifest.id, rules, version: manifest.version }));
+}
+// SPEC §4.4.4 and §4.4.7: a pack carrying accepted.json loads only while
+// its content hash still matches. A pack never accepted loads without a
+// gate; acceptance happens after `pack test` through acceptPack.
+export async function verifyAcceptance(fs, dir, manifest, acceptedSchemaText) {
+    const acceptedPath = dir === "" ? ACCEPTED_NAME : `${dir}/${ACCEPTED_NAME}`;
+    const seen = await fs.exists(acceptedPath);
+    if (!seen.ok) {
+        return err(seen.error);
+    }
+    if (!seen.value) {
+        return ok(undefined);
+    }
+    const text = await fs.readText(acceptedPath);
+    if (!text.ok) {
+        return err(text.error);
+    }
+    const parsed = parseJson(text.value);
+    if (!parsed.ok) {
+        return err(parsed.error);
+    }
+    const checked = validateSchema(acceptedSchemaText, parsed.value);
+    if (!checked.ok) {
+        return err(checked.error);
+    }
+    const record = parsed.value;
+    const packHash = isRecord(record) ? field(record, "packHash") : undefined;
+    if (typeof packHash !== "string") {
+        return err(makeError("CDX-E203", `pack "${manifest.id}" accepted.json carries no packHash string`, "Re-run codictator pack test, then codictator pack accept, to rewrite accepted.json."));
+    }
+    const hashed = await packHashFor(fs, dir);
+    if (!hashed.ok) {
+        return err(hashed.error);
+    }
+    if (hashed.value !== packHash) {
+        return err(makeError("CDX-E203", `pack "${manifest.id}" changed after acceptance and is inert until re-accepted`, "Run codictator pack test, then codictator pack accept, to re-accept the pack."));
+    }
+    return ok(undefined);
+}

package/dist/features/packs/index.d.ts

@@ -0,0 +1,22 @@
+export type { Pack, PackManifest, PackRule, PackRuleParam, } from "../../kernel/index.ts";
+export interface PackAccepted {
+    readonly version: 1;
+    readonly packHash: string;
+    readonly selfTestHash: string;
+    readonly acceptedAt: string;
+    readonly acceptedBy: string;
+}
+export type { AcceptPackOptions } from "./accept.ts";
+export { acceptPack } from "./accept.ts";
+export { resolveCodeEnforcer } from "./enforcers/code.ts";
+export { type ExternalArgs, type ExternalInput, type ExternalOptions, isExternalInput, type ToolDecl, type ToolEvent, type ToolVersion, } from "./enforcers/external.ts";
+export { narrowExternalArgs, narrowToolDecl, } from "./enforcers/external-bind.ts";
+export { resolveExternal } from "./enforcers/external-check.ts";
+export { digestArgv, planRuns, safePath } from "./enforcers/external-runs.ts";
+export { isParametricKind, resolveParametric } from "./enforcers/parametric.ts";
+export { packHashFor, selfTestHashFor } from "./hashes.ts";
+export type { LoadPackOptions } from "./loader.ts";
+export { composePacks, loadBuiltinPack, loadPack } from "./loader.ts";
+export { isBuiltinPackId } from "./manifest.ts";
+export { resolveManifestEnforcers, resolvePackEnforcers } from "./registry.ts";
+export { selfTest } from "./selftest.ts";

package/dist/features/packs/index.js

@@ -0,0 +1,15 @@
+// SPEC §4.4: pack loading, composition, self-test, external tools. Owns
+// the §7.3 pack.json and §7.4 accepted.json formats.
+export { acceptPack } from "./accept.js";
+export { resolveCodeEnforcer } from "./enforcers/code.js";
+export { isExternalInput, } from "./enforcers/external.js";
+export { narrowExternalArgs, narrowToolDecl, } from "./enforcers/external-bind.js";
+export { resolveExternal } from "./enforcers/external-check.js";
+export { digestArgv, planRuns, safePath } from "./enforcers/external-runs.js";
+export { isParametricKind, resolveParametric } from "./enforcers/parametric.js";
+export { packHashFor, selfTestHashFor } from "./hashes.js";
+export { composePacks, loadBuiltinPack, loadPack } from "./loader.js";
+export { isBuiltinPackId } from "./manifest.js";
+export { resolveManifestEnforcers, resolvePackEnforcers } from "./registry.js";
+// SPEC §4.4.4: self-test every rule against its fixtures before use.
+export { selfTest } from "./selftest.js";

package/dist/features/packs/loader.d.ts

@@ -0,0 +1,13 @@
+import type { Ports, Result } from "../../kernel/index.ts";
+import type { ExternalOptions } from "./enforcers/external.ts";
+import type { Pack } from "./index.ts";
+export interface LoadPackOptions {
+    readonly ports?: Ports;
+    readonly builtin?: boolean;
+    readonly skipAcceptance?: boolean;
+    readonly tools?: ReadonlyArray<unknown>;
+    readonly onToolEvent?: ExternalOptions["onToolEvent"];
+}
+export declare function loadPack(packPath: string, options?: LoadPackOptions): Promise<Result<Pack>>;
+export declare function loadBuiltinPack(id: string, options?: LoadPackOptions): Promise<Result<Pack>>;
+export declare function composePacks(packs: ReadonlyArray<Pack>): Result<ReadonlyArray<Pack>>;

package/dist/features/packs/loader.js

@@ -0,0 +1,205 @@
+// SPEC §4.4.3: loading and composition. Reads pack.json (schema §7.3),
+// applies the manifest checks, verifies custom-pack acceptance (§4.4.7),
+// and resolves declared enforcers as deferred stubs that throw CDX-E901,
+// so nothing silently passes until its owning module lands.
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { err, makeError, NodeFs, ok, parseJson, stableStringify, validateSchema, } from "../../kernel/index.js";
+import { narrowToolDecl } from "./enforcers/external-bind.js";
+import { verifyAcceptance } from "./hashes.js";
+import { checkPack, field, isBuiltinPackId, isRecord, narrowEnforcerDecl, narrowManifest, } from "./manifest.js";
+import { livePorts, resolvePackEnforcers } from "./registry.js";
+// SPEC §4.4.1: the owning pack's directory holds pack.json beside fixtures/.
+function builtinPackDir(id) {
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    return path.resolve(here, "..", "..", "builtin-packs", id);
+}
+function packageSchemaDir() {
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    return path.resolve(here, "..", "..", "..", "schema");
+}
+function toPosix(value) {
+    return value.split(path.sep).join("/");
+}
+function deepFreeze(value) {
+    if (typeof value !== "object" || value === null || Object.isFrozen(value)) {
+        return;
+    }
+    for (const entry of Object.values(value)) {
+        deepFreeze(entry);
+    }
+    Object.freeze(value);
+}
+// The shipped schemas carry `$schema` and `title`, which are metadata
+// with no validation semantics in the kernel subset (§4.1.2). Stripping
+// them keeps schema/ as the single owner of the format without touching
+// the kernel for pack loading.
+function stripSchemaMetadata(value) {
+    if (Array.isArray(value)) {
+        return value.map((entry) => stripSchemaMetadata(entry));
+    }
+    if (isRecord(value)) {
+        const kept = {};
+        for (const key of Object.keys(value)) {
+            if (key === "$schema" || key === "title") {
+                continue;
+            }
+            kept[key] = stripSchemaMetadata(field(value, key));
+        }
+        return kept;
+    }
+    return value;
+}
+async function readSchemaText(name) {
+    const absolute = path.join(packageSchemaDir(), name);
+    const root = path.parse(absolute).root;
+    const made = await NodeFs.create({ root });
+    if (!made.ok) {
+        return err(made.error);
+    }
+    const text = await made.value.readText(toPosix(path.relative(root, absolute)));
+    if (!text.ok) {
+        return err(text.error);
+    }
+    const parsed = parseJson(text.value);
+    if (!parsed.ok) {
+        return err(parsed.error);
+    }
+    return ok(stableStringify(stripSchemaMetadata(parsed.value)));
+}
+// SPEC §4.4.3: load one pack directory (pack.json plus accepted.json).
+export async function loadPack(packPath, options = {}) {
+    const builtin = options.builtin ?? false;
+    const resolved = path.resolve(packPath);
+    // Injected ports read caller-form paths (the CLI passes repo-relative
+    // ones); without ports the loader resolves against the cwd and reads
+    // through a drive-rooted live port. The schema always ships with this
+    // package, so it always reads through a live port.
+    let fs;
+    let at;
+    let dirForm;
+    if (options.ports !== undefined) {
+        fs = options.ports.fs;
+        const base = toPosix(packPath);
+        at = (name) => `${base}/${name}`;
+        dirForm = base;
+    }
+    else {
+        const root = path.parse(resolved).root;
+        const made = await NodeFs.create({ root });
+        if (!made.ok) {
+            return err(made.error);
+        }
+        fs = made.value;
+        at = (name) => toPosix(path.relative(root, path.join(resolved, name)));
+        dirForm = toPosix(path.relative(root, resolved));
+    }
+    const seen = await fs.exists(at("pack.json"));
+    if (!seen.ok) {
+        return err(seen.error);
+    }
+    if (!seen.value) {
+        return err(makeError("CDX-E203", `no pack.json under ${resolved}: not a pack directory`, "Point the pack path at a directory holding pack.json (§4.4.1)."));
+    }
+    const text = await fs.readText(at("pack.json"));
+    if (!text.ok) {
+        return err(text.error);
+    }
+    const schemaText = await readSchemaText("pack.schema.json");
+    if (!schemaText.ok) {
+        return err(schemaText.error);
+    }
+    const parsed = parseJson(text.value);
+    if (!parsed.ok) {
+        return err(parsed.error);
+    }
+    const schemaChecked = validateSchema(schemaText.value, parsed.value);
+    if (!schemaChecked.ok) {
+        return err(schemaChecked.error);
+    }
+    const narrowed = narrowManifest(parsed.value);
+    if (!narrowed.ok) {
+        return err(narrowed.error);
+    }
+    const manifest = narrowed.value;
+    const checked = checkPack(manifest, builtin);
+    if (!checked.ok) {
+        return err(checked.error);
+    }
+    if (!(options.skipAcceptance ?? false)) {
+        const acceptedSchemaText = await readSchemaText("accepted.schema.json");
+        if (!acceptedSchemaText.ok) {
+            return err(acceptedSchemaText.error);
+        }
+        const accepted = await verifyAcceptance(fs, dirForm, manifest, acceptedSchemaText.value);
+        if (!accepted.ok) {
+            return err(accepted.error);
+        }
+    }
+    const decls = [];
+    for (const entry of manifest.enforcers) {
+        const narrowedDecl = narrowEnforcerDecl(entry);
+        if (!narrowedDecl.ok) {
+            return err(narrowedDecl.error);
+        }
+        decls.push(narrowedDecl.value);
+    }
+    decls.sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+    const tools = [];
+    for (const entry of options.tools ?? []) {
+        const narrowedTool = narrowToolDecl(entry);
+        if (!narrowedTool.ok) {
+            return err(narrowedTool.error);
+        }
+        tools.push(narrowedTool.value);
+    }
+    let enforcerPorts;
+    if (options.ports !== undefined) {
+        enforcerPorts = options.ports;
+    }
+    else {
+        const live = await livePorts(path.parse(resolved).root);
+        if (!live.ok) {
+            return err(live.error);
+        }
+        enforcerPorts = live.value;
+    }
+    const externalOptions = options.onToolEvent === undefined
+        ? {}
+        : { onToolEvent: options.onToolEvent };
+    const enforcers = resolvePackEnforcers(manifest, decls, enforcerPorts, tools, externalOptions);
+    if (!enforcers.ok) {
+        return err(enforcers.error);
+    }
+    deepFreeze(manifest);
+    return ok({
+        manifest,
+        enforcers: enforcers.value,
+        drivers: manifest.drivers,
+        assets: manifest.assets,
+    });
+}
+// SPEC §4.4.2: load a built-in pack by id from its own directory.
+export function loadBuiltinPack(id, options = {}) {
+    if (!isBuiltinPackId(id)) {
+        return Promise.resolve(err(makeError("CDX-E203", `unknown built-in pack id "${id}"`, "Load core, typescript, dotnet or python.")));
+    }
+    return loadPack(builtinPackDir(id), { ...options, builtin: true });
+}
+// SPEC §4.4.3 steps 1–2 and 5: packs arrive in load order (core, language
+// packs in config.packs order, custom packs); rule ids must be globally
+// unique across them (CDX-E202). Extractor overlap reporting is status
+// output (SPEC §4.4.8 EC-13) and lands with the CLI.
+export function composePacks(packs) {
+    const owners = new Map();
+    for (const pack of packs) {
+        for (const rule of pack.manifest.rules) {
+            const owner = owners.get(rule.id);
+            if (owner !== undefined) {
+                return err(makeError("CDX-E202", `duplicate rule id "${rule.id}" in packs "${owner}" and "${pack.manifest.id}"`, "Keep rule ids globally unique across composed packs, then reload."));
+            }
+            owners.set(rule.id, pack.manifest.id);
+        }
+    }
+    return ok([...packs]);
+}

package/dist/features/packs/manifest.d.ts

@@ -0,0 +1,17 @@
+import { type Result } from "../../kernel/index.ts";
+import type { PackManifest } from "./index.ts";
+export interface EnforcerDecl {
+    readonly id: string;
+    readonly kind: string;
+    readonly module?: string;
+    readonly budgetMs: number;
+    readonly tool?: string;
+    readonly ruleMap?: Readonly<Record<string, string>>;
+    readonly args?: unknown;
+}
+export declare function isBuiltinPackId(id: string): boolean;
+export declare function isRecord(value: unknown): value is Record<string, unknown>;
+export declare function field(record: Readonly<Record<string, unknown>>, name: string): unknown;
+export declare function narrowEnforcerDecl(entry: unknown): Result<EnforcerDecl>;
+export declare function narrowManifest(value: unknown): Result<PackManifest>;
+export declare function checkPack(manifest: PackManifest, builtin: boolean): Result<void>;