cohorte 3.0.0-dev.5 → 3.0.0-dev.6

package/dist/chunks/obsidian-D1jf1sTR.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"obsidian-D1jf1sTR.mjs","names":[],"sources":["../../../../apps/cli/src/commands/obsidian/index.ts"],"sourcesContent":["import { access, mkdir, readFile, writeFile } from 'node:fs/promises';\nimport { dirname, join, resolve } from 'node:path';\nimport { parse, stringify } from 'yaml';\nimport type { CommandModule } from '../../contract/index.ts';\n\ntype Card = { id: string; title: string; checked: boolean; column: string; line: number };\n\nconst COLUMNS = ['Ideas', 'Brainstorm', 'Spec', 'Ready to build', 'Building', 'Review', 'Fix', 'Ship', 'Shipped'];\nconst STAGES = new Map([\n  ['ideas', 'Ideas'],\n  ['brainstorm', 'Brainstorm'],\n  ['spec', 'Spec'],\n  ['ready', 'Ready to build'],\n  ['building', 'Building'],\n  ['review', 'Review'],\n  ['fix', 'Fix'],\n  ['ship', 'Ship'],\n  ['shipped', 'Shipped'],\n]);\n\nconst BOARD_TEMPLATE = `---\nkanban-plugin: board\n---\n\n${COLUMNS.map((column) => `## ${column}\\n`).join('\\n')}\n%% kanban:settings\n\\`\\`\\`\n{\"kanban-plugin\":\"board\",\"list-collapse\":[false,false,false,false,false,false,false,false,false]}\n\\`\\`\\`\n%%\n`;\n\nfunction parseCards(source: string): Card[] {\n  const lines = source.split(/\\r?\\n/);\n  let column = '';\n  const cards: Card[] = [];\n  lines.forEach((line, lineIndex) => {\n    const heading = /^##\\s+(.+?)\\s*$/.exec(line);\n    if (heading) {\n      column = heading[1] ?? '';\n      return;\n    }\n    const card = /^-\\s+\\[([ xX])\\]\\s+(.+)$/.exec(line);\n    if (!card || !column) return;\n    const title = card[2] ?? '';\n    const tag = /#([a-z0-9][a-z0-9-]*)\\b/i.exec(title);\n    if (!tag) return;\n    cards.push({\n      id: (tag[1] ?? '').toLowerCase(),\n      title,\n      checked: (card[1] ?? '').toLowerCase() === 'x',\n      column,\n      line: lineIndex,\n    });\n  });\n  return cards;\n}\n\nasync function loadUserConfig(home: string): Promise<{ path: string; value: Record<string, unknown> }> {\n  const path = join(home, '.cohorte', 'config.yaml');\n  try {\n    const value = parse(await readFile(path, 'utf8')) as Record<string, unknown>;\n    return { path, value: value && typeof value === 'object' ? value : {} };\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;\n    return { path, value: {} };\n  }\n}\n\nfunction configured(value: Record<string, unknown>): { vaultPath: string; board: string } | undefined {\n  const integrations = value.integrations;\n  if (!integrations || typeof integrations !== 'object') return undefined;\n  const obsidian = (integrations as Record<string, unknown>).obsidian;\n  if (!obsidian || typeof obsidian !== 'object') return undefined;\n  const { vaultPath, board } = obsidian as Record<string, unknown>;\n  return typeof vaultPath === 'string' && typeof board === 'string' ? { vaultPath, board } : undefined;\n}\n\nasync function boardPath(home: string): Promise<{ config: { vaultPath: string; board: string }; path: string }> {\n  const loaded = await loadUserConfig(home);\n  const config = configured(loaded.value);\n  if (!config) throw new Error('Obsidian is not configured; run `cohorte obsidian connect <vault> <board>`');\n  const path = resolve(config.vaultPath, config.board);\n  await access(path);\n  return { config, path };\n}\n\nfunction replaceCard(source: string, id: string, target: string): string {\n  const lines = source.split(/\\r?\\n/);\n  const cards = parseCards(source);\n  const card = cards.find((item) => item.id === id);\n  if (!card) throw new Error(`Obsidian card #${id} was not found`);\n  if (!COLUMNS.includes(target)) throw new Error(`Unknown Obsidian column: ${target}`);\n  if (card.column === target) return source;\n  const line = lines[card.line] ?? '';\n  lines.splice(card.line, 1);\n  let heading = lines.indexOf(`## ${target}`);\n  if (heading < 0) {\n    if (!source.endsWith('\\n')) lines.push('');\n    lines.push(`## ${target}`, '');\n    heading = lines.length - 2;\n  }\n  let insert = heading + 1;\n  while (insert < lines.length && !(lines[insert] ?? '').startsWith('## ')) insert++;\n  lines.splice(insert, 0, line);\n  return lines.join('\\n');\n}\n\nconst obsidian: CommandModule = {\n  verb: 'obsidian',\n  async run(ctx, args) {\n    const home = ctx.env.HOME ?? ctx.cwd;\n    if (args.subVerb === 'create') {\n      const [vaultPath, board = 'Weave/Tasks.md'] = args.positionals;\n      if (!vaultPath) return 2;\n      const path = resolve(vaultPath, board);\n      try {\n        await access(path);\n        throw new Error(`Obsidian board already exists: ${path}`);\n      } catch (error) {\n        if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;\n      }\n      await mkdir(dirname(path), { recursive: true });\n      await writeFile(path, BOARD_TEMPLATE, 'utf8');\n      const loaded = await loadUserConfig(home);\n      const integrations = loaded.value.integrations;\n      const nextIntegrations = integrations && typeof integrations === 'object' ? { ...(integrations as object) } : {};\n      (nextIntegrations as Record<string, unknown>).obsidian = { vaultPath, board };\n      loaded.value.integrations = nextIntegrations;\n      await mkdir(dirname(loaded.path), { recursive: true });\n      await writeFile(loaded.path, stringify(loaded.value), 'utf8');\n      ctx.stdio.stdout.write(`created and connected ${path}\\n`);\n      return 0;\n    }\n    if (args.subVerb === 'connect') {\n      const [vaultPath, board = 'Weave/Tasks.md'] = args.positionals;\n      if (!vaultPath) return 2;\n      const loaded = await loadUserConfig(home);\n      const integrations = loaded.value.integrations;\n      const nextIntegrations = integrations && typeof integrations === 'object' ? { ...(integrations as object) } : {};\n      (nextIntegrations as Record<string, unknown>).obsidian = { vaultPath, board };\n      loaded.value.integrations = nextIntegrations;\n      await mkdir(dirname(loaded.path), { recursive: true });\n      await writeFile(loaded.path, stringify(loaded.value), 'utf8');\n      ctx.stdio.stdout.write(`connected ${resolve(vaultPath, board)}\\n`);\n      return 0;\n    }\n    if (args.subVerb === 'status') {\n      const resolved = await boardPath(home);\n      const cards = parseCards(await readFile(resolved.path, 'utf8'));\n      if (args.json) ctx.stdio.stdout.write(`${JSON.stringify({ ...resolved.config, path: resolved.path, cards })}\\n`);\n      else\n        ctx.stdio.stdout.write(\n          `${resolved.path}\\n${cards.map((card) => `${card.id}\\t${card.column}\\t${card.title}`).join('\\n')}\\n`,\n        );\n      return 0;\n    }\n    if (args.subVerb === 'move') {\n      const [id, stage] = args.positionals;\n      const target = stage ? (STAGES.get(stage) ?? stage) : undefined;\n      if (!id || !target) return 2;\n      const resolved = await boardPath(home);\n      const source = await readFile(resolved.path, 'utf8');\n      await writeFile(resolved.path, replaceCard(source, id, target), 'utf8');\n      ctx.stdio.stdout.write(`moved #${id} to ${target}\\n`);\n      return 0;\n    }\n    return 2;\n  },\n};\n\nexport default obsidian;\n"],"mappings":";;;;AAOA,MAAM,UAAU;CAAC;CAAS;CAAc;CAAQ;CAAkB;CAAY;CAAU;CAAO;CAAQ;AAAS;AAChH,MAAM,yBAAS,IAAI,IAAI;CACrB,CAAC,SAAS,OAAO;CACjB,CAAC,cAAc,YAAY;CAC3B,CAAC,QAAQ,MAAM;CACf,CAAC,SAAS,gBAAgB;CAC1B,CAAC,YAAY,UAAU;CACvB,CAAC,UAAU,QAAQ;CACnB,CAAC,OAAO,KAAK;CACb,CAAC,QAAQ,MAAM;CACf,CAAC,WAAW,SAAS;AACvB,CAAC;AAED,MAAM,iBAAiB;;;;EAIrB,QAAQ,KAAK,WAAW,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE;;;;;;;AAQvD,SAAS,WAAW,QAAwB;CAC1C,MAAM,QAAQ,OAAO,MAAM,OAAO;CAClC,IAAI,SAAS;CACb,MAAM,QAAgB,CAAC;CACvB,MAAM,SAAS,MAAM,cAAc;EACjC,MAAM,UAAU,kBAAkB,KAAK,IAAI;EAC3C,IAAI,SAAS;GACX,SAAS,QAAQ,MAAM;GACvB;EACF;EACA,MAAM,OAAO,2BAA2B,KAAK,IAAI;EACjD,IAAI,CAAC,QAAQ,CAAC,QAAQ;EACtB,MAAM,QAAQ,KAAK,MAAM;EACzB,MAAM,MAAM,2BAA2B,KAAK,KAAK;EACjD,IAAI,CAAC,KAAK;EACV,MAAM,KAAK;GACT,KAAK,IAAI,MAAM,GAAA,CAAI,YAAY;GAC/B;GACA,UAAU,KAAK,MAAM,GAAA,CAAI,YAAY,MAAM;GAC3C;GACA,MAAM;EACR,CAAC;CACH,CAAC;CACD,OAAO;AACT;AAEA,eAAe,eAAe,MAAyE;CACrG,MAAM,OAAO,KAAK,MAAM,YAAY,aAAa;CACjD,IAAI;EACF,MAAM,QAAQ,MAAM,MAAM,SAAS,MAAM,MAAM,CAAC;EAChD,OAAO;GAAE;GAAM,OAAO,SAAS,OAAO,UAAU,WAAW,QAAQ,CAAC;EAAE;CACxE,SAAS,OAAO;EACd,IAAK,MAAgC,SAAS,UAAU,MAAM;EAC9D,OAAO;GAAE;GAAM,OAAO,CAAC;EAAE;CAC3B;AACF;AAEA,SAAS,WAAW,OAAkF;CACpG,MAAM,eAAe,MAAM;CAC3B,IAAI,CAAC,gBAAgB,OAAO,iBAAiB,UAAU,OAAO,KAAA;CAC9D,MAAM,WAAY,aAAyC;CAC3D,IAAI,CAAC,YAAY,OAAO,aAAa,UAAU,OAAO,KAAA;CACtD,MAAM,EAAE,WAAW,UAAU;CAC7B,OAAO,OAAO,cAAc,YAAY,OAAO,UAAU,WAAW;EAAE;EAAW;CAAM,IAAI,KAAA;AAC7F;AAEA,eAAe,UAAU,MAAuF;CAE9G,MAAM,SAAS,YAAW,MADL,eAAe,IAAI,EAAA,CACP,KAAK;CACtC,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,4EAA4E;CACzG,MAAM,OAAO,QAAQ,OAAO,WAAW,OAAO,KAAK;CACnD,MAAM,OAAO,IAAI;CACjB,OAAO;EAAE;EAAQ;CAAK;AACxB;AAEA,SAAS,YAAY,QAAgB,IAAY,QAAwB;CACvE,MAAM,QAAQ,OAAO,MAAM,OAAO;CAElC,MAAM,OADQ,WAAW,MACR,CAAC,CAAC,MAAM,SAAS,KAAK,OAAO,EAAE;CAChD,IAAI,CAAC,MAAM,MAAM,IAAI,MAAM,kBAAkB,GAAG,eAAe;CAC/D,IAAI,CAAC,QAAQ,SAAS,MAAM,GAAG,MAAM,IAAI,MAAM,4BAA4B,QAAQ;CACnF,IAAI,KAAK,WAAW,QAAQ,OAAO;CACnC,MAAM,OAAO,MAAM,KAAK,SAAS;CACjC,MAAM,OAAO,KAAK,MAAM,CAAC;CACzB,IAAI,UAAU,MAAM,QAAQ,MAAM,QAAQ;CAC1C,IAAI,UAAU,GAAG;EACf,IAAI,CAAC,OAAO,SAAS,IAAI,GAAG,MAAM,KAAK,EAAE;EACzC,MAAM,KAAK,MAAM,UAAU,EAAE;EAC7B,UAAU,MAAM,SAAS;CAC3B;CACA,IAAI,SAAS,UAAU;CACvB,OAAO,SAAS,MAAM,UAAU,EAAE,MAAM,WAAW,GAAA,CAAI,WAAW,KAAK,GAAG;CAC1E,MAAM,OAAO,QAAQ,GAAG,IAAI;CAC5B,OAAO,MAAM,KAAK,IAAI;AACxB;AAEA,MAAM,WAA0B;CAC9B,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,MAAM,OAAO,IAAI,IAAI,QAAQ,IAAI;EACjC,IAAI,KAAK,YAAY,UAAU;GAC7B,MAAM,CAAC,WAAW,QAAQ,oBAAoB,KAAK;GACnD,IAAI,CAAC,WAAW,OAAO;GACvB,MAAM,OAAO,QAAQ,WAAW,KAAK;GACrC,IAAI;IACF,MAAM,OAAO,IAAI;IACjB,MAAM,IAAI,MAAM,kCAAkC,MAAM;GAC1D,SAAS,OAAO;IACd,IAAK,MAAgC,SAAS,UAAU,MAAM;GAChE;GACA,MAAM,MAAM,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;GAC9C,MAAM,UAAU,MAAM,gBAAgB,MAAM;GAC5C,MAAM,SAAS,MAAM,eAAe,IAAI;GACxC,MAAM,eAAe,OAAO,MAAM;GAClC,MAAM,mBAAmB,gBAAgB,OAAO,iBAAiB,WAAW,EAAE,GAAI,aAAwB,IAAI,CAAC;GAC/G,iBAA8C,WAAW;IAAE;IAAW;GAAM;GAC5E,OAAO,MAAM,eAAe;GAC5B,MAAM,MAAM,QAAQ,OAAO,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;GACrD,MAAM,UAAU,OAAO,MAAM,UAAU,OAAO,KAAK,GAAG,MAAM;GAC5D,IAAI,MAAM,OAAO,MAAM,yBAAyB,KAAK,GAAG;GACxD,OAAO;EACT;EACA,IAAI,KAAK,YAAY,WAAW;GAC9B,MAAM,CAAC,WAAW,QAAQ,oBAAoB,KAAK;GACnD,IAAI,CAAC,WAAW,OAAO;GACvB,MAAM,SAAS,MAAM,eAAe,IAAI;GACxC,MAAM,eAAe,OAAO,MAAM;GAClC,MAAM,mBAAmB,gBAAgB,OAAO,iBAAiB,WAAW,EAAE,GAAI,aAAwB,IAAI,CAAC;GAC/G,iBAA8C,WAAW;IAAE;IAAW;GAAM;GAC5E,OAAO,MAAM,eAAe;GAC5B,MAAM,MAAM,QAAQ,OAAO,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;GACrD,MAAM,UAAU,OAAO,MAAM,UAAU,OAAO,KAAK,GAAG,MAAM;GAC5D,IAAI,MAAM,OAAO,MAAM,aAAa,QAAQ,WAAW,KAAK,EAAE,GAAG;GACjE,OAAO;EACT;EACA,IAAI,KAAK,YAAY,UAAU;GAC7B,MAAM,WAAW,MAAM,UAAU,IAAI;GACrC,MAAM,QAAQ,WAAW,MAAM,SAAS,SAAS,MAAM,MAAM,CAAC;GAC9D,IAAI,KAAK,MAAM,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU;IAAE,GAAG,SAAS;IAAQ,MAAM,SAAS;IAAM;GAAM,CAAC,EAAE,GAAG;QAE7G,IAAI,MAAM,OAAO,MACf,GAAG,SAAS,KAAK,IAAI,MAAM,KAAK,SAAS,GAAG,KAAK,GAAG,IAAI,KAAK,OAAO,IAAI,KAAK,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,GACnG;GACF,OAAO;EACT;EACA,IAAI,KAAK,YAAY,QAAQ;GAC3B,MAAM,CAAC,IAAI,SAAS,KAAK;GACzB,MAAM,SAAS,QAAS,OAAO,IAAI,KAAK,KAAK,QAAS,KAAA;GACtD,IAAI,CAAC,MAAM,CAAC,QAAQ,OAAO;GAC3B,MAAM,WAAW,MAAM,UAAU,IAAI;GACrC,MAAM,SAAS,MAAM,SAAS,SAAS,MAAM,MAAM;GACnD,MAAM,UAAU,SAAS,MAAM,YAAY,QAAQ,IAAI,MAAM,GAAG,MAAM;GACtE,IAAI,MAAM,OAAO,MAAM,UAAU,GAAG,MAAM,OAAO,GAAG;GACpD,OAAO;EACT;EACA,OAAO;CACT;AACF"}

package/dist/chunks/{policy-Clypo20s.mjs → policy-Y65MYKzn.mjs}

@@ -1,9 +1,9 @@
 import { n as sha256Hex, t as canonicalJson } from "./canonical-C8UxeEmB.mjs";
 import { N as errorOf, j as CohorteError } from "./src-Cu3TxNob.mjs";
 import { n as createKeyStore, r as createTrustStore } from "./auth-BT5oVp76.mjs";
-import { i as resolveConfig, n as loadConfig } from "./src-DcU4IXMe.mjs";
-import "./src-r0ECB1UJ.mjs";
-import { a as buildPolicySnapshot, c as createCommandPolicy, i as createGlobMatcher, l as createProgramResolver, n as toolIntrospection, o as createPolicyEngine, r as createPathResolver, s as explainPolicy } from "./catalogue-B5uFqfzJ.mjs";
+import { i as resolveConfig, n as loadConfig } from "./src-BnlNkd3S.mjs";
+import "./src-C7hs8Bjw.mjs";
+import { a as buildPolicySnapshot, c as createCommandPolicy, i as createGlobMatcher, l as createProgramResolver, n as toolIntrospection, o as createPolicyEngine, r as createPathResolver, s as explainPolicy } from "./catalogue-DzsslCSN.mjs";
 import { join, resolve } from "node:path";
 import { realpathSync } from "node:fs";
 //#region src/commands/policy/index.ts
@@ -136,4 +136,4 @@ const policy = {
 //#endregion
 export { policy as default };
 
-//# sourceMappingURL=policy-Clypo20s.mjs.map
+//# sourceMappingURL=policy-Y65MYKzn.mjs.map

package/dist/chunks/{policy-Clypo20s.mjs.map → policy-Y65MYKzn.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"policy-Clypo20s.mjs","names":[],"sources":["../../../../apps/cli/src/commands/policy/index.ts"],"sourcesContent":["// apps/cli/src/commands/policy/index.ts — DESIGN §9 verb `policy` (PLAN §3 rule 3 \"later units fill\n// stub files that lie inside their owned paths; they never edit ... the registry\"). Wave-0 stub: exits with the\n// documented not-available error (spec 24 `configuration/phase-not-available`); filled by the Wave-4/5\n// unit that owns `apps/cli/src/commands/policy/**`.\nimport { realpathSync } from 'node:fs';\nimport { join, resolve } from 'node:path';\nimport { CohorteError, canonicalJson, errorOf, sha256Hex } from '@cohorte/base';\nimport { loadConfig, resolveConfig } from '@cohorte/config';\nimport {\n  buildPolicySnapshot,\n  createCommandPolicy,\n  createGlobMatcher,\n  createPathResolver,\n  createPolicyEngine,\n  createProgramResolver,\n  explainPolicy,\n} from '@cohorte/security';\nimport { createKeyStore, createTrustStore } from '@cohorte/security/auth';\nimport type { AgentGrant, GateCall, PolicyPorts } from '@cohorte/security/contract';\nimport { toolIntrospection } from '@cohorte/tools/catalogue';\nimport type { CommandModule } from '../../contract/index.ts';\n\nfunction canonical(path: string): string {\n  const absolute = resolve(path);\n  try {\n    return realpathSync.native(absolute);\n  } catch {\n    return absolute;\n  }\n}\n\nfunction grantFor(root: string, argv: readonly string[]): AgentGrant {\n  const tools = ['run_command'];\n  const digest = sha256Hex(canonicalJson({ root, argv: [...argv] }));\n  return {\n    agentId: 'agt_policy_explain' as AgentGrant['agentId'],\n    role: 'policy-explain',\n    digest,\n    tools,\n    roots: { workspace: root as AgentGrant['roots']['workspace'], readOnly: [] },\n    read: { include: ['**'], exclude: [] },\n    write: { include: ['**'], exclude: [] },\n    denyRead: { include: ['**/.cohorte/**', '**/.git/**'], exclude: [] },\n    denyWrite: { include: ['**/.cohorte/**', '**/.git/**'], exclude: [] },\n    commands: { default: 'deny', rules: [] },\n    secrets: [],\n    temporary: [],\n    limits: {\n      maxToolCalls: 1,\n      maxCallsPerMinute: 1,\n      perTool: { run_command: { timeoutMs: 120_000, maxOutputBytes: 1024 * 1024 } },\n    },\n  };\n}\n\nconst policy: CommandModule = {\n  verb: 'policy',\n  async run(ctx, args) {\n    if (args.subVerb !== 'explain') return 2;\n    const argv = args.positionals.filter((value) => value !== '--');\n    if (argv.length === 0) return 2;\n\n    const home = ctx.env.HOME ?? ctx.cwd;\n    const projectKeyId = sha256Hex(ctx.cwd).slice(0, 24);\n    const keys = createKeyStore({ directory: join(home, '.cohorte', 'keys') });\n    const trustStore = createTrustStore({ directory: join(home, '.cohorte', 'trust'), keys });\n    const loaded = await loadConfig({ cwd: ctx.cwd, home });\n    const resolved = await resolveConfig(loaded, { trustStore, projectKeyId });\n    if (resolved.status === 'untrusted') {\n      throw new CohorteError(\n        errorOf(\n          'security/project-policy-untrusted',\n          `project policy is untrusted (${resolved.loosenedKeys.join(', ') || 'unknown key'})`,\n        ),\n      );\n    }\n\n    const root = canonical(loaded.projectRoot);\n    const pathResolver = createPathResolver({\n      roots: [root as never],\n      protectedRoots: [canonical(join(root, '.cohorte')) as never],\n      symlinks: resolved.config.policy.symlinks,\n    });\n    const pathDirs = (ctx.env.PATH ?? '').split(':').filter(Boolean).map(canonical);\n    const programs = createProgramResolver({ pathDirs });\n    const branches: PolicyPorts['branches'] = {\n      branchOf: () => ({ kind: 'detached-or-unknown', protected: true }),\n    };\n    const commands = createCommandPolicy({ programs, branches });\n    const engine = createPolicyEngine({ tools: toolIntrospection, globs: createGlobMatcher(), commands });\n    const policySnapshot = buildPolicySnapshot(resolved.config, loaded.ownership, { sandboxLevel: 'L0-process' });\n    const ports: PolicyPorts = {\n      paths: pathResolver,\n      branches,\n      budgets: { remaining: () => ({}), callsInLastMinute: () => 0 },\n      programs,\n      clock: ctx.clock,\n    };\n    const call: GateCall = {\n      runId: 'run_policy_explain' as GateCall['runId'],\n      agentId: 'agt_policy_explain' as GateCall['agentId'],\n      incarnation: 1,\n      toolCallId: 'tool_policy_explain' as GateCall['toolCallId'],\n      tool: 'run_command',\n      input: { argv, cwd: root, timeoutMs: 120_000 },\n      phase: 'PREFLIGHT',\n      role: 'policy-explain',\n    };\n    const verdict = explainPolicy(engine, call, grantFor(root, argv), policySnapshot, ports);\n    ctx.stdio.stdout.write(`${JSON.stringify(verdict)}\\n`);\n    return 0;\n  },\n};\n\nexport default policy;\n"],"mappings":";;;;;;;;;AAsBA,SAAS,UAAU,MAAsB;CACvC,MAAM,WAAW,QAAQ,IAAI;CAC7B,IAAI;EACF,OAAO,aAAa,OAAO,QAAQ;CACrC,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,SAAS,MAAc,MAAqC;CACnE,MAAM,QAAQ,CAAC,aAAa;CAE5B,OAAO;EACL,SAAS;EACT,MAAM;EACN,QAJa,UAAU,cAAc;GAAE;GAAM,MAAM,CAAC,GAAG,IAAI;EAAE,CAAC,CAIzD;EACL;EACA,OAAO;GAAE,WAAW;GAA0C,UAAU,CAAC;EAAE;EAC3E,MAAM;GAAE,SAAS,CAAC,IAAI;GAAG,SAAS,CAAC;EAAE;EACrC,OAAO;GAAE,SAAS,CAAC,IAAI;GAAG,SAAS,CAAC;EAAE;EACtC,UAAU;GAAE,SAAS,CAAC,kBAAkB,YAAY;GAAG,SAAS,CAAC;EAAE;EACnE,WAAW;GAAE,SAAS,CAAC,kBAAkB,YAAY;GAAG,SAAS,CAAC;EAAE;EACpE,UAAU;GAAE,SAAS;GAAQ,OAAO,CAAC;EAAE;EACvC,SAAS,CAAC;EACV,WAAW,CAAC;EACZ,QAAQ;GACN,cAAc;GACd,mBAAmB;GACnB,SAAS,EAAE,aAAa;IAAE,WAAW;IAAS,gBAAgB;GAAY,EAAE;EAC9E;CACF;AACF;AAEA,MAAM,SAAwB;CAC5B,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,IAAI,KAAK,YAAY,WAAW,OAAO;EACvC,MAAM,OAAO,KAAK,YAAY,QAAQ,UAAU,UAAU,IAAI;EAC9D,IAAI,KAAK,WAAW,GAAG,OAAO;EAE9B,MAAM,OAAO,IAAI,IAAI,QAAQ,IAAI;EACjC,MAAM,eAAe,UAAU,IAAI,GAAG,CAAC,CAAC,MAAM,GAAG,EAAE;EACnD,MAAM,OAAO,eAAe,EAAE,WAAW,KAAK,MAAM,YAAY,MAAM,EAAE,CAAC;EACzE,MAAM,aAAa,iBAAiB;GAAE,WAAW,KAAK,MAAM,YAAY,OAAO;GAAG;EAAK,CAAC;EACxF,MAAM,SAAS,MAAM,WAAW;GAAE,KAAK,IAAI;GAAK;EAAK,CAAC;EACtD,MAAM,WAAW,MAAM,cAAc,QAAQ;GAAE;GAAY;EAAa,CAAC;EACzE,IAAI,SAAS,WAAW,aACtB,MAAM,IAAI,aACR,QACE,qCACA,gCAAgC,SAAS,aAAa,KAAK,IAAI,KAAK,cAAc,EACpF,CACF;EAGF,MAAM,OAAO,UAAU,OAAO,WAAW;EACzC,MAAM,eAAe,mBAAmB;GACtC,OAAO,CAAC,IAAa;GACrB,gBAAgB,CAAC,UAAU,KAAK,MAAM,UAAU,CAAC,CAAU;GAC3D,UAAU,SAAS,OAAO,OAAO;EACnC,CAAC;EACD,MAAM,YAAY,IAAI,IAAI,QAAQ,GAAA,CAAI,MAAM,GAAG,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,IAAI,SAAS;EAC9E,MAAM,WAAW,sBAAsB,EAAE,SAAS,CAAC;EACnD,MAAM,WAAoC,EACxC,iBAAiB;GAAE,MAAM;GAAuB,WAAW;EAAK,GAClE;EACA,MAAM,WAAW,oBAAoB;GAAE;GAAU;EAAS,CAAC;EAC3D,MAAM,SAAS,mBAAmB;GAAE,OAAO;GAAmB,OAAO,kBAAkB;GAAG;EAAS,CAAC;EACpG,MAAM,iBAAiB,oBAAoB,SAAS,QAAQ,OAAO,WAAW,EAAE,cAAc,aAAa,CAAC;EAC5G,MAAM,QAAqB;GACzB,OAAO;GACP;GACA,SAAS;IAAE,kBAAkB,CAAC;IAAI,yBAAyB;GAAE;GAC7D;GACA,OAAO,IAAI;EACb;EAWA,MAAM,UAAU,cAAc,QAAQ;GATpC,OAAO;GACP,SAAS;GACT,aAAa;GACb,YAAY;GACZ,MAAM;GACN,OAAO;IAAE;IAAM,KAAK;IAAM,WAAW;GAAQ;GAC7C,OAAO;GACP,MAAM;EAEiC,GAAG,SAAS,MAAM,IAAI,GAAG,gBAAgB,KAAK;EACvF,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU,OAAO,EAAE,GAAG;EACrD,OAAO;CACT;AACF"}
+{"version":3,"file":"policy-Y65MYKzn.mjs","names":[],"sources":["../../../../apps/cli/src/commands/policy/index.ts"],"sourcesContent":["// apps/cli/src/commands/policy/index.ts — DESIGN §9 verb `policy` (PLAN §3 rule 3 \"later units fill\n// stub files that lie inside their owned paths; they never edit ... the registry\"). Wave-0 stub: exits with the\n// documented not-available error (spec 24 `configuration/phase-not-available`); filled by the Wave-4/5\n// unit that owns `apps/cli/src/commands/policy/**`.\nimport { realpathSync } from 'node:fs';\nimport { join, resolve } from 'node:path';\nimport { CohorteError, canonicalJson, errorOf, sha256Hex } from '@cohorte/base';\nimport { loadConfig, resolveConfig } from '@cohorte/config';\nimport {\n  buildPolicySnapshot,\n  createCommandPolicy,\n  createGlobMatcher,\n  createPathResolver,\n  createPolicyEngine,\n  createProgramResolver,\n  explainPolicy,\n} from '@cohorte/security';\nimport { createKeyStore, createTrustStore } from '@cohorte/security/auth';\nimport type { AgentGrant, GateCall, PolicyPorts } from '@cohorte/security/contract';\nimport { toolIntrospection } from '@cohorte/tools/catalogue';\nimport type { CommandModule } from '../../contract/index.ts';\n\nfunction canonical(path: string): string {\n  const absolute = resolve(path);\n  try {\n    return realpathSync.native(absolute);\n  } catch {\n    return absolute;\n  }\n}\n\nfunction grantFor(root: string, argv: readonly string[]): AgentGrant {\n  const tools = ['run_command'];\n  const digest = sha256Hex(canonicalJson({ root, argv: [...argv] }));\n  return {\n    agentId: 'agt_policy_explain' as AgentGrant['agentId'],\n    role: 'policy-explain',\n    digest,\n    tools,\n    roots: { workspace: root as AgentGrant['roots']['workspace'], readOnly: [] },\n    read: { include: ['**'], exclude: [] },\n    write: { include: ['**'], exclude: [] },\n    denyRead: { include: ['**/.cohorte/**', '**/.git/**'], exclude: [] },\n    denyWrite: { include: ['**/.cohorte/**', '**/.git/**'], exclude: [] },\n    commands: { default: 'deny', rules: [] },\n    secrets: [],\n    temporary: [],\n    limits: {\n      maxToolCalls: 1,\n      maxCallsPerMinute: 1,\n      perTool: { run_command: { timeoutMs: 120_000, maxOutputBytes: 1024 * 1024 } },\n    },\n  };\n}\n\nconst policy: CommandModule = {\n  verb: 'policy',\n  async run(ctx, args) {\n    if (args.subVerb !== 'explain') return 2;\n    const argv = args.positionals.filter((value) => value !== '--');\n    if (argv.length === 0) return 2;\n\n    const home = ctx.env.HOME ?? ctx.cwd;\n    const projectKeyId = sha256Hex(ctx.cwd).slice(0, 24);\n    const keys = createKeyStore({ directory: join(home, '.cohorte', 'keys') });\n    const trustStore = createTrustStore({ directory: join(home, '.cohorte', 'trust'), keys });\n    const loaded = await loadConfig({ cwd: ctx.cwd, home });\n    const resolved = await resolveConfig(loaded, { trustStore, projectKeyId });\n    if (resolved.status === 'untrusted') {\n      throw new CohorteError(\n        errorOf(\n          'security/project-policy-untrusted',\n          `project policy is untrusted (${resolved.loosenedKeys.join(', ') || 'unknown key'})`,\n        ),\n      );\n    }\n\n    const root = canonical(loaded.projectRoot);\n    const pathResolver = createPathResolver({\n      roots: [root as never],\n      protectedRoots: [canonical(join(root, '.cohorte')) as never],\n      symlinks: resolved.config.policy.symlinks,\n    });\n    const pathDirs = (ctx.env.PATH ?? '').split(':').filter(Boolean).map(canonical);\n    const programs = createProgramResolver({ pathDirs });\n    const branches: PolicyPorts['branches'] = {\n      branchOf: () => ({ kind: 'detached-or-unknown', protected: true }),\n    };\n    const commands = createCommandPolicy({ programs, branches });\n    const engine = createPolicyEngine({ tools: toolIntrospection, globs: createGlobMatcher(), commands });\n    const policySnapshot = buildPolicySnapshot(resolved.config, loaded.ownership, { sandboxLevel: 'L0-process' });\n    const ports: PolicyPorts = {\n      paths: pathResolver,\n      branches,\n      budgets: { remaining: () => ({}), callsInLastMinute: () => 0 },\n      programs,\n      clock: ctx.clock,\n    };\n    const call: GateCall = {\n      runId: 'run_policy_explain' as GateCall['runId'],\n      agentId: 'agt_policy_explain' as GateCall['agentId'],\n      incarnation: 1,\n      toolCallId: 'tool_policy_explain' as GateCall['toolCallId'],\n      tool: 'run_command',\n      input: { argv, cwd: root, timeoutMs: 120_000 },\n      phase: 'PREFLIGHT',\n      role: 'policy-explain',\n    };\n    const verdict = explainPolicy(engine, call, grantFor(root, argv), policySnapshot, ports);\n    ctx.stdio.stdout.write(`${JSON.stringify(verdict)}\\n`);\n    return 0;\n  },\n};\n\nexport default policy;\n"],"mappings":";;;;;;;;;AAsBA,SAAS,UAAU,MAAsB;CACvC,MAAM,WAAW,QAAQ,IAAI;CAC7B,IAAI;EACF,OAAO,aAAa,OAAO,QAAQ;CACrC,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,SAAS,MAAc,MAAqC;CACnE,MAAM,QAAQ,CAAC,aAAa;CAE5B,OAAO;EACL,SAAS;EACT,MAAM;EACN,QAJa,UAAU,cAAc;GAAE;GAAM,MAAM,CAAC,GAAG,IAAI;EAAE,CAAC,CAIzD;EACL;EACA,OAAO;GAAE,WAAW;GAA0C,UAAU,CAAC;EAAE;EAC3E,MAAM;GAAE,SAAS,CAAC,IAAI;GAAG,SAAS,CAAC;EAAE;EACrC,OAAO;GAAE,SAAS,CAAC,IAAI;GAAG,SAAS,CAAC;EAAE;EACtC,UAAU;GAAE,SAAS,CAAC,kBAAkB,YAAY;GAAG,SAAS,CAAC;EAAE;EACnE,WAAW;GAAE,SAAS,CAAC,kBAAkB,YAAY;GAAG,SAAS,CAAC;EAAE;EACpE,UAAU;GAAE,SAAS;GAAQ,OAAO,CAAC;EAAE;EACvC,SAAS,CAAC;EACV,WAAW,CAAC;EACZ,QAAQ;GACN,cAAc;GACd,mBAAmB;GACnB,SAAS,EAAE,aAAa;IAAE,WAAW;IAAS,gBAAgB;GAAY,EAAE;EAC9E;CACF;AACF;AAEA,MAAM,SAAwB;CAC5B,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,IAAI,KAAK,YAAY,WAAW,OAAO;EACvC,MAAM,OAAO,KAAK,YAAY,QAAQ,UAAU,UAAU,IAAI;EAC9D,IAAI,KAAK,WAAW,GAAG,OAAO;EAE9B,MAAM,OAAO,IAAI,IAAI,QAAQ,IAAI;EACjC,MAAM,eAAe,UAAU,IAAI,GAAG,CAAC,CAAC,MAAM,GAAG,EAAE;EACnD,MAAM,OAAO,eAAe,EAAE,WAAW,KAAK,MAAM,YAAY,MAAM,EAAE,CAAC;EACzE,MAAM,aAAa,iBAAiB;GAAE,WAAW,KAAK,MAAM,YAAY,OAAO;GAAG;EAAK,CAAC;EACxF,MAAM,SAAS,MAAM,WAAW;GAAE,KAAK,IAAI;GAAK;EAAK,CAAC;EACtD,MAAM,WAAW,MAAM,cAAc,QAAQ;GAAE;GAAY;EAAa,CAAC;EACzE,IAAI,SAAS,WAAW,aACtB,MAAM,IAAI,aACR,QACE,qCACA,gCAAgC,SAAS,aAAa,KAAK,IAAI,KAAK,cAAc,EACpF,CACF;EAGF,MAAM,OAAO,UAAU,OAAO,WAAW;EACzC,MAAM,eAAe,mBAAmB;GACtC,OAAO,CAAC,IAAa;GACrB,gBAAgB,CAAC,UAAU,KAAK,MAAM,UAAU,CAAC,CAAU;GAC3D,UAAU,SAAS,OAAO,OAAO;EACnC,CAAC;EACD,MAAM,YAAY,IAAI,IAAI,QAAQ,GAAA,CAAI,MAAM,GAAG,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,IAAI,SAAS;EAC9E,MAAM,WAAW,sBAAsB,EAAE,SAAS,CAAC;EACnD,MAAM,WAAoC,EACxC,iBAAiB;GAAE,MAAM;GAAuB,WAAW;EAAK,GAClE;EACA,MAAM,WAAW,oBAAoB;GAAE;GAAU;EAAS,CAAC;EAC3D,MAAM,SAAS,mBAAmB;GAAE,OAAO;GAAmB,OAAO,kBAAkB;GAAG;EAAS,CAAC;EACpG,MAAM,iBAAiB,oBAAoB,SAAS,QAAQ,OAAO,WAAW,EAAE,cAAc,aAAa,CAAC;EAC5G,MAAM,QAAqB;GACzB,OAAO;GACP;GACA,SAAS;IAAE,kBAAkB,CAAC;IAAI,yBAAyB;GAAE;GAC7D;GACA,OAAO,IAAI;EACb;EAWA,MAAM,UAAU,cAAc,QAAQ;GATpC,OAAO;GACP,SAAS;GACT,aAAa;GACb,YAAY;GACZ,MAAM;GACN,OAAO;IAAE;IAAM,KAAK;IAAM,WAAW;GAAQ;GAC7C,OAAO;GACP,MAAM;EAEiC,GAAG,SAAS,MAAM,IAAI,GAAG,gBAAgB,KAAK;EACvF,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU,OAAO,EAAE,GAAG;EACrD,OAAO;CACT;AACF"}

package/dist/chunks/{reconcile-czNaLOP6.mjs → reconcile-B6mGZWtp.mjs}

@@ -1,5 +1,5 @@
-import { s as DEFAULT_CONFIG } from "./schema-C9QbUW4H.mjs";
-import { l as deriveDesiredState, n as planReconcile, t as applyReconcile } from "./src-CmFjh4M0.mjs";
+import { s as DEFAULT_CONFIG } from "./schema-hSyIURjN.mjs";
+import { l as deriveDesiredState, n as planReconcile, t as applyReconcile } from "./src-DMrQ5m6I.mjs";
 import { t as scanRepository } from "./scan-C5uDr7Yq.mjs";
 //#region src/commands/reconcile/index.ts
 const reconcile = {
@@ -47,4 +47,4 @@ const reconcile = {
 //#endregion
 export { reconcile as default };
 
-//# sourceMappingURL=reconcile-czNaLOP6.mjs.map
+//# sourceMappingURL=reconcile-B6mGZWtp.mjs.map

package/dist/chunks/{reconcile-czNaLOP6.mjs.map → reconcile-B6mGZWtp.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"reconcile-czNaLOP6.mjs","names":[],"sources":["../../../../apps/cli/src/commands/reconcile/index.ts"],"sourcesContent":["import { DEFAULT_CONFIG } from '@cohorte/config/schema';\nimport { applyReconcile, deriveDesiredState, planReconcile, scanRepository } from '@cohorte/project-model';\nimport type { CommandModule } from '../../contract/index.ts';\n\nconst reconcile: CommandModule = {\n  verb: 'reconcile',\n  async run(ctx, args) {\n    const model = await scanRepository(ctx.cwd, { clock: ctx.clock, toolVersion: '3.0.0' });\n    const plan = await planReconcile({\n      root: ctx.cwd,\n      scan: (root) => scanRepository(root, { clock: ctx.clock, toolVersion: '3.0.0' }),\n      cohorteVersion: '3.0.0',\n      clock: ctx.clock,\n    });\n    if (args.positionals.includes('--apply')) {\n      const result = await applyReconcile({\n        root: ctx.cwd,\n        plan,\n        desired: deriveDesiredState({ model, config: DEFAULT_CONFIG, cohorteVersion: '3.0.0', skills: {} }),\n        backup: !args.positionals.includes('--no-backup'),\n        clock: ctx.clock,\n      });\n      if (args.json) ctx.stdio.stdout.write(`${JSON.stringify({ plan, result })}\\n`);\n      else ctx.stdio.stdout.write(`applied: ${result.applied.join(', ') || 'none'}\\n`);\n      return 0;\n    }\n    if (!args.positionals.includes('--plan')) return 2;\n    if (args.json) ctx.stdio.stdout.write(`${JSON.stringify(plan)}\\n`);\n    else ctx.stdio.stdout.write(`${plan.operations.length} operation(s) planned\\n`);\n    return 0;\n  },\n};\n\nexport default reconcile;\n"],"mappings":";;;;AAIA,MAAM,YAA2B;CAC/B,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,MAAM,QAAQ,MAAM,eAAe,IAAI,KAAK;GAAE,OAAO,IAAI;GAAO,aAAa;EAAQ,CAAC;EACtF,MAAM,OAAO,MAAM,cAAc;GAC/B,MAAM,IAAI;GACV,OAAO,SAAS,eAAe,MAAM;IAAE,OAAO,IAAI;IAAO,aAAa;GAAQ,CAAC;GAC/E,gBAAgB;GAChB,OAAO,IAAI;EACb,CAAC;EACD,IAAI,KAAK,YAAY,SAAS,SAAS,GAAG;GACxC,MAAM,SAAS,MAAM,eAAe;IAClC,MAAM,IAAI;IACV;IACA,SAAS,mBAAmB;KAAE;KAAO,QAAQ;KAAgB,gBAAgB;KAAS,QAAQ,CAAC;IAAE,CAAC;IAClG,QAAQ,CAAC,KAAK,YAAY,SAAS,aAAa;IAChD,OAAO,IAAI;GACb,CAAC;GACD,IAAI,KAAK,MAAM,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU;IAAE;IAAM;GAAO,CAAC,EAAE,GAAG;QACxE,IAAI,MAAM,OAAO,MAAM,YAAY,OAAO,QAAQ,KAAK,IAAI,KAAK,OAAO,GAAG;GAC/E,OAAO;EACT;EACA,IAAI,CAAC,KAAK,YAAY,SAAS,QAAQ,GAAG,OAAO;EACjD,IAAI,KAAK,MAAM,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU,IAAI,EAAE,GAAG;OAC5D,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,WAAW,OAAO,wBAAwB;EAC9E,OAAO;CACT;AACF"}
+{"version":3,"file":"reconcile-B6mGZWtp.mjs","names":[],"sources":["../../../../apps/cli/src/commands/reconcile/index.ts"],"sourcesContent":["import { DEFAULT_CONFIG } from '@cohorte/config/schema';\nimport { applyReconcile, deriveDesiredState, planReconcile, scanRepository } from '@cohorte/project-model';\nimport type { CommandModule } from '../../contract/index.ts';\n\nconst reconcile: CommandModule = {\n  verb: 'reconcile',\n  async run(ctx, args) {\n    const model = await scanRepository(ctx.cwd, { clock: ctx.clock, toolVersion: '3.0.0' });\n    const plan = await planReconcile({\n      root: ctx.cwd,\n      scan: (root) => scanRepository(root, { clock: ctx.clock, toolVersion: '3.0.0' }),\n      cohorteVersion: '3.0.0',\n      clock: ctx.clock,\n    });\n    if (args.positionals.includes('--apply')) {\n      const result = await applyReconcile({\n        root: ctx.cwd,\n        plan,\n        desired: deriveDesiredState({ model, config: DEFAULT_CONFIG, cohorteVersion: '3.0.0', skills: {} }),\n        backup: !args.positionals.includes('--no-backup'),\n        clock: ctx.clock,\n      });\n      if (args.json) ctx.stdio.stdout.write(`${JSON.stringify({ plan, result })}\\n`);\n      else ctx.stdio.stdout.write(`applied: ${result.applied.join(', ') || 'none'}\\n`);\n      return 0;\n    }\n    if (!args.positionals.includes('--plan')) return 2;\n    if (args.json) ctx.stdio.stdout.write(`${JSON.stringify(plan)}\\n`);\n    else ctx.stdio.stdout.write(`${plan.operations.length} operation(s) planned\\n`);\n    return 0;\n  },\n};\n\nexport default reconcile;\n"],"mappings":";;;;AAIA,MAAM,YAA2B;CAC/B,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,MAAM,QAAQ,MAAM,eAAe,IAAI,KAAK;GAAE,OAAO,IAAI;GAAO,aAAa;EAAQ,CAAC;EACtF,MAAM,OAAO,MAAM,cAAc;GAC/B,MAAM,IAAI;GACV,OAAO,SAAS,eAAe,MAAM;IAAE,OAAO,IAAI;IAAO,aAAa;GAAQ,CAAC;GAC/E,gBAAgB;GAChB,OAAO,IAAI;EACb,CAAC;EACD,IAAI,KAAK,YAAY,SAAS,SAAS,GAAG;GACxC,MAAM,SAAS,MAAM,eAAe;IAClC,MAAM,IAAI;IACV;IACA,SAAS,mBAAmB;KAAE;KAAO,QAAQ;KAAgB,gBAAgB;KAAS,QAAQ,CAAC;IAAE,CAAC;IAClG,QAAQ,CAAC,KAAK,YAAY,SAAS,aAAa;IAChD,OAAO,IAAI;GACb,CAAC;GACD,IAAI,KAAK,MAAM,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU;IAAE;IAAM;GAAO,CAAC,EAAE,GAAG;QACxE,IAAI,MAAM,OAAO,MAAM,YAAY,OAAO,QAAQ,KAAK,IAAI,KAAK,OAAO,GAAG;GAC/E,OAAO;EACT;EACA,IAAI,CAAC,KAAK,YAAY,SAAS,QAAQ,GAAG,OAAO;EACjD,IAAI,KAAK,MAAM,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU,IAAI,EAAE,GAAG;OAC5D,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,WAAW,OAAO,wBAAwB;EAC9E,OAAO;CACT;AACF"}

package/dist/chunks/{run-CgTWYlcd.mjs → run-BInPXOcm.mjs}

@@ -1,7 +1,7 @@
 import { n as sha256Hex } from "./canonical-C8UxeEmB.mjs";
 import { N as errorOf, j as CohorteError } from "./src-Cu3TxNob.mjs";
 import { n as createKeyStore, r as createTrustStore } from "./auth-BT5oVp76.mjs";
-import { i as resolveConfig, n as loadConfig } from "./src-DcU4IXMe.mjs";
+import { i as resolveConfig, n as loadConfig } from "./src-BnlNkd3S.mjs";
 import { join } from "node:path";
 import { existsSync } from "node:fs";
 //#region src/commands/run/index.ts
@@ -79,4 +79,4 @@ const run = {
 //#endregion
 export { run as default };
 
-//# sourceMappingURL=run-CgTWYlcd.mjs.map
+//# sourceMappingURL=run-BInPXOcm.mjs.map

package/dist/chunks/{run-CgTWYlcd.mjs.map → run-BInPXOcm.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"run-CgTWYlcd.mjs","names":[],"sources":["../../../../apps/cli/src/commands/run/index.ts"],"sourcesContent":["// apps/cli/src/commands/run/index.ts — DESIGN §9 verb `run` (PLAN §3 rule 3 \"later units fill\n// stub files that lie inside their owned paths; they never edit ... the registry\"). Wave-0 stub: exits with the\n// documented not-available error (spec 24 `configuration/phase-not-available`); filled by the Wave-4/5\n// unit that owns `apps/cli/src/commands/run/**`.\nimport { existsSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { CohorteError, errorOf, type Sha256, sha256Hex } from '@cohorte/base';\nimport { loadConfig, resolveConfig } from '@cohorte/config';\nimport { createKeyStore, createTrustStore } from '@cohorte/security/auth';\nimport type { CommandModule } from '../../contract/index.ts';\n\nconst run: CommandModule = {\n  verb: 'run',\n  async run(ctx, args) {\n    const valueAfter = (flag: string): string | undefined => {\n      const index = args.positionals.indexOf(flag);\n      return index >= 0 ? args.positionals[index + 1] : undefined;\n    };\n    const profile = (valueAfter('--profile') ??\n      args.positionals.find((value) => ['feature', 'bugfix', 'review'].includes(value)) ??\n      'feature') as 'feature' | 'bugfix' | 'review';\n    if (!['feature', 'bugfix', 'review'].includes(profile)) return 2;\n    const spec = args.positionals.find(\n      (value, index) =>\n        !value.startsWith('--') &&\n        args.positionals[index - 1] !== '--profile' &&\n        args.positionals[index - 1] !== '--runtime' &&\n        args.positionals[index - 1] !== '--script' &&\n        args.positionals[index - 1] !== '--model' &&\n        !['feature', 'bugfix', 'review'].includes(value),\n    );\n    const model = valueAfter('--model');\n    const waitValue = valueAfter('--wait');\n    const waitMs = waitValue === undefined ? undefined : Number(waitValue) * 1000;\n    if (waitValue !== undefined && (!Number.isFinite(waitMs) || (waitMs as number) < 0)) return 2;\n    const trustProjectConfig = args.positionals.includes('--trust-project-config');\n    let consent: { policySha256: Sha256; via: 'cli-flag' } | undefined;\n    // Test/fake contexts intentionally omit HOME; a real CLI invocation always\n    // supplies it and is the only context allowed to resolve project trust.\n    if (ctx.env.HOME && existsSync(join(ctx.cwd, '.cohorte', 'config.yaml'))) {\n      const home = ctx.env.HOME ?? ctx.cwd;\n      const loaded = await loadConfig({ cwd: ctx.cwd, home });\n      const keys = createKeyStore({ directory: join(home, '.cohorte', 'keys') });\n      const trustStore = createTrustStore({ directory: join(home, '.cohorte', 'trust'), keys });\n      const resolved = await resolveConfig(loaded, {\n        trustStore,\n        projectKeyId: sha256Hex(loaded.projectRoot).slice(0, 24),\n      });\n      if (resolved.status === 'untrusted' && !trustProjectConfig) {\n        throw new CohorteError(\n          errorOf(\n            'security/project-policy-untrusted',\n            `project policy is untrusted (${resolved.loosenedKeys.join(', ') || 'unknown key'})`,\n          ),\n        );\n      }\n      if (resolved.status === 'untrusted') consent = { policySha256: resolved.policySha256, via: 'cli-flag' };\n    }\n    const payload = {\n      profile,\n      unattended: false,\n      ...(spec ? { spec: { path: spec } } : {}),\n      ...(valueAfter('--runtime') ? { runtime: valueAfter('--runtime') as string } : {}),\n      ...(valueAfter('--script') ? { fakeScript: valueAfter('--script') as string } : {}),\n      ...(model ? { modelOverrides: { implementer: { provider: 'default', model } } } : {}),\n      ...(consent ? { consent } : {}),\n    };\n    const result =\n      waitMs === undefined\n        ? await ctx.controller.send('start', payload)\n        : await ctx.controller.send('start', payload, { waitMs });\n    if (result.status === 'pending' && result.result && typeof result.result === 'object' && 'runId' in result.result) {\n      const runId = (result.result as { runId?: string }).runId;\n      if (runId) await ctx.hostSpawner.spawnDetached(runId);\n    }\n    if (args.json) ctx.stdio.stdout.write(`${JSON.stringify(result)}\\n`);\n    else ctx.stdio.stdout.write(`${result.status}\\n`);\n    return result.status === 'rejected' ? 3 : result.status === 'pending' ? 4 : 0;\n  },\n};\n\nexport default run;\n"],"mappings":";;;;;;;AAWA,MAAM,MAAqB;CACzB,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,MAAM,cAAc,SAAqC;GACvD,MAAM,QAAQ,KAAK,YAAY,QAAQ,IAAI;GAC3C,OAAO,SAAS,IAAI,KAAK,YAAY,QAAQ,KAAK,KAAA;EACpD;EACA,MAAM,UAAW,WAAW,WAAW,KACrC,KAAK,YAAY,MAAM,UAAU;GAAC;GAAW;GAAU;EAAQ,CAAC,CAAC,SAAS,KAAK,CAAC,KAChF;EACF,IAAI,CAAC;GAAC;GAAW;GAAU;EAAQ,CAAC,CAAC,SAAS,OAAO,GAAG,OAAO;EAC/D,MAAM,OAAO,KAAK,YAAY,MAC3B,OAAO,UACN,CAAC,MAAM,WAAW,IAAI,KACtB,KAAK,YAAY,QAAQ,OAAO,eAChC,KAAK,YAAY,QAAQ,OAAO,eAChC,KAAK,YAAY,QAAQ,OAAO,cAChC,KAAK,YAAY,QAAQ,OAAO,aAChC,CAAC;GAAC;GAAW;GAAU;EAAQ,CAAC,CAAC,SAAS,KAAK,CACnD;EACA,MAAM,QAAQ,WAAW,SAAS;EAClC,MAAM,YAAY,WAAW,QAAQ;EACrC,MAAM,SAAS,cAAc,KAAA,IAAY,KAAA,IAAY,OAAO,SAAS,IAAI;EACzE,IAAI,cAAc,KAAA,MAAc,CAAC,OAAO,SAAS,MAAM,KAAM,SAAoB,IAAI,OAAO;EAC5F,MAAM,qBAAqB,KAAK,YAAY,SAAS,wBAAwB;EAC7E,IAAI;EAGJ,IAAI,IAAI,IAAI,QAAQ,WAAW,KAAK,IAAI,KAAK,YAAY,aAAa,CAAC,GAAG;GACxE,MAAM,OAAO,IAAI,IAAI,QAAQ,IAAI;GACjC,MAAM,SAAS,MAAM,WAAW;IAAE,KAAK,IAAI;IAAK;GAAK,CAAC;GACtD,MAAM,OAAO,eAAe,EAAE,WAAW,KAAK,MAAM,YAAY,MAAM,EAAE,CAAC;GACzE,MAAM,aAAa,iBAAiB;IAAE,WAAW,KAAK,MAAM,YAAY,OAAO;IAAG;GAAK,CAAC;GACxF,MAAM,WAAW,MAAM,cAAc,QAAQ;IAC3C;IACA,cAAc,UAAU,OAAO,WAAW,CAAC,CAAC,MAAM,GAAG,EAAE;GACzD,CAAC;GACD,IAAI,SAAS,WAAW,eAAe,CAAC,oBACtC,MAAM,IAAI,aACR,QACE,qCACA,gCAAgC,SAAS,aAAa,KAAK,IAAI,KAAK,cAAc,EACpF,CACF;GAEF,IAAI,SAAS,WAAW,aAAa,UAAU;IAAE,cAAc,SAAS;IAAc,KAAK;GAAW;EACxG;EACA,MAAM,UAAU;GACd;GACA,YAAY;GACZ,GAAI,OAAO,EAAE,MAAM,EAAE,MAAM,KAAK,EAAE,IAAI,CAAC;GACvC,GAAI,WAAW,WAAW,IAAI,EAAE,SAAS,WAAW,WAAW,EAAY,IAAI,CAAC;GAChF,GAAI,WAAW,UAAU,IAAI,EAAE,YAAY,WAAW,UAAU,EAAY,IAAI,CAAC;GACjF,GAAI,QAAQ,EAAE,gBAAgB,EAAE,aAAa;IAAE,UAAU;IAAW;GAAM,EAAE,EAAE,IAAI,CAAC;GACnF,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;EAC/B;EACA,MAAM,SACJ,WAAW,KAAA,IACP,MAAM,IAAI,WAAW,KAAK,SAAS,OAAO,IAC1C,MAAM,IAAI,WAAW,KAAK,SAAS,SAAS,EAAE,OAAO,CAAC;EAC5D,IAAI,OAAO,WAAW,aAAa,OAAO,UAAU,OAAO,OAAO,WAAW,YAAY,WAAW,OAAO,QAAQ;GACjH,MAAM,QAAS,OAAO,OAA8B;GACpD,IAAI,OAAO,MAAM,IAAI,YAAY,cAAc,KAAK;EACtD;EACA,IAAI,KAAK,MAAM,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU,MAAM,EAAE,GAAG;OAC9D,IAAI,MAAM,OAAO,MAAM,GAAG,OAAO,OAAO,GAAG;EAChD,OAAO,OAAO,WAAW,aAAa,IAAI,OAAO,WAAW,YAAY,IAAI;CAC9E;AACF"}
+{"version":3,"file":"run-BInPXOcm.mjs","names":[],"sources":["../../../../apps/cli/src/commands/run/index.ts"],"sourcesContent":["// apps/cli/src/commands/run/index.ts — DESIGN §9 verb `run` (PLAN §3 rule 3 \"later units fill\n// stub files that lie inside their owned paths; they never edit ... the registry\"). Wave-0 stub: exits with the\n// documented not-available error (spec 24 `configuration/phase-not-available`); filled by the Wave-4/5\n// unit that owns `apps/cli/src/commands/run/**`.\nimport { existsSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { CohorteError, errorOf, type Sha256, sha256Hex } from '@cohorte/base';\nimport { loadConfig, resolveConfig } from '@cohorte/config';\nimport { createKeyStore, createTrustStore } from '@cohorte/security/auth';\nimport type { CommandModule } from '../../contract/index.ts';\n\nconst run: CommandModule = {\n  verb: 'run',\n  async run(ctx, args) {\n    const valueAfter = (flag: string): string | undefined => {\n      const index = args.positionals.indexOf(flag);\n      return index >= 0 ? args.positionals[index + 1] : undefined;\n    };\n    const profile = (valueAfter('--profile') ??\n      args.positionals.find((value) => ['feature', 'bugfix', 'review'].includes(value)) ??\n      'feature') as 'feature' | 'bugfix' | 'review';\n    if (!['feature', 'bugfix', 'review'].includes(profile)) return 2;\n    const spec = args.positionals.find(\n      (value, index) =>\n        !value.startsWith('--') &&\n        args.positionals[index - 1] !== '--profile' &&\n        args.positionals[index - 1] !== '--runtime' &&\n        args.positionals[index - 1] !== '--script' &&\n        args.positionals[index - 1] !== '--model' &&\n        !['feature', 'bugfix', 'review'].includes(value),\n    );\n    const model = valueAfter('--model');\n    const waitValue = valueAfter('--wait');\n    const waitMs = waitValue === undefined ? undefined : Number(waitValue) * 1000;\n    if (waitValue !== undefined && (!Number.isFinite(waitMs) || (waitMs as number) < 0)) return 2;\n    const trustProjectConfig = args.positionals.includes('--trust-project-config');\n    let consent: { policySha256: Sha256; via: 'cli-flag' } | undefined;\n    // Test/fake contexts intentionally omit HOME; a real CLI invocation always\n    // supplies it and is the only context allowed to resolve project trust.\n    if (ctx.env.HOME && existsSync(join(ctx.cwd, '.cohorte', 'config.yaml'))) {\n      const home = ctx.env.HOME ?? ctx.cwd;\n      const loaded = await loadConfig({ cwd: ctx.cwd, home });\n      const keys = createKeyStore({ directory: join(home, '.cohorte', 'keys') });\n      const trustStore = createTrustStore({ directory: join(home, '.cohorte', 'trust'), keys });\n      const resolved = await resolveConfig(loaded, {\n        trustStore,\n        projectKeyId: sha256Hex(loaded.projectRoot).slice(0, 24),\n      });\n      if (resolved.status === 'untrusted' && !trustProjectConfig) {\n        throw new CohorteError(\n          errorOf(\n            'security/project-policy-untrusted',\n            `project policy is untrusted (${resolved.loosenedKeys.join(', ') || 'unknown key'})`,\n          ),\n        );\n      }\n      if (resolved.status === 'untrusted') consent = { policySha256: resolved.policySha256, via: 'cli-flag' };\n    }\n    const payload = {\n      profile,\n      unattended: false,\n      ...(spec ? { spec: { path: spec } } : {}),\n      ...(valueAfter('--runtime') ? { runtime: valueAfter('--runtime') as string } : {}),\n      ...(valueAfter('--script') ? { fakeScript: valueAfter('--script') as string } : {}),\n      ...(model ? { modelOverrides: { implementer: { provider: 'default', model } } } : {}),\n      ...(consent ? { consent } : {}),\n    };\n    const result =\n      waitMs === undefined\n        ? await ctx.controller.send('start', payload)\n        : await ctx.controller.send('start', payload, { waitMs });\n    if (result.status === 'pending' && result.result && typeof result.result === 'object' && 'runId' in result.result) {\n      const runId = (result.result as { runId?: string }).runId;\n      if (runId) await ctx.hostSpawner.spawnDetached(runId);\n    }\n    if (args.json) ctx.stdio.stdout.write(`${JSON.stringify(result)}\\n`);\n    else ctx.stdio.stdout.write(`${result.status}\\n`);\n    return result.status === 'rejected' ? 3 : result.status === 'pending' ? 4 : 0;\n  },\n};\n\nexport default run;\n"],"mappings":";;;;;;;AAWA,MAAM,MAAqB;CACzB,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,MAAM,cAAc,SAAqC;GACvD,MAAM,QAAQ,KAAK,YAAY,QAAQ,IAAI;GAC3C,OAAO,SAAS,IAAI,KAAK,YAAY,QAAQ,KAAK,KAAA;EACpD;EACA,MAAM,UAAW,WAAW,WAAW,KACrC,KAAK,YAAY,MAAM,UAAU;GAAC;GAAW;GAAU;EAAQ,CAAC,CAAC,SAAS,KAAK,CAAC,KAChF;EACF,IAAI,CAAC;GAAC;GAAW;GAAU;EAAQ,CAAC,CAAC,SAAS,OAAO,GAAG,OAAO;EAC/D,MAAM,OAAO,KAAK,YAAY,MAC3B,OAAO,UACN,CAAC,MAAM,WAAW,IAAI,KACtB,KAAK,YAAY,QAAQ,OAAO,eAChC,KAAK,YAAY,QAAQ,OAAO,eAChC,KAAK,YAAY,QAAQ,OAAO,cAChC,KAAK,YAAY,QAAQ,OAAO,aAChC,CAAC;GAAC;GAAW;GAAU;EAAQ,CAAC,CAAC,SAAS,KAAK,CACnD;EACA,MAAM,QAAQ,WAAW,SAAS;EAClC,MAAM,YAAY,WAAW,QAAQ;EACrC,MAAM,SAAS,cAAc,KAAA,IAAY,KAAA,IAAY,OAAO,SAAS,IAAI;EACzE,IAAI,cAAc,KAAA,MAAc,CAAC,OAAO,SAAS,MAAM,KAAM,SAAoB,IAAI,OAAO;EAC5F,MAAM,qBAAqB,KAAK,YAAY,SAAS,wBAAwB;EAC7E,IAAI;EAGJ,IAAI,IAAI,IAAI,QAAQ,WAAW,KAAK,IAAI,KAAK,YAAY,aAAa,CAAC,GAAG;GACxE,MAAM,OAAO,IAAI,IAAI,QAAQ,IAAI;GACjC,MAAM,SAAS,MAAM,WAAW;IAAE,KAAK,IAAI;IAAK;GAAK,CAAC;GACtD,MAAM,OAAO,eAAe,EAAE,WAAW,KAAK,MAAM,YAAY,MAAM,EAAE,CAAC;GACzE,MAAM,aAAa,iBAAiB;IAAE,WAAW,KAAK,MAAM,YAAY,OAAO;IAAG;GAAK,CAAC;GACxF,MAAM,WAAW,MAAM,cAAc,QAAQ;IAC3C;IACA,cAAc,UAAU,OAAO,WAAW,CAAC,CAAC,MAAM,GAAG,EAAE;GACzD,CAAC;GACD,IAAI,SAAS,WAAW,eAAe,CAAC,oBACtC,MAAM,IAAI,aACR,QACE,qCACA,gCAAgC,SAAS,aAAa,KAAK,IAAI,KAAK,cAAc,EACpF,CACF;GAEF,IAAI,SAAS,WAAW,aAAa,UAAU;IAAE,cAAc,SAAS;IAAc,KAAK;GAAW;EACxG;EACA,MAAM,UAAU;GACd;GACA,YAAY;GACZ,GAAI,OAAO,EAAE,MAAM,EAAE,MAAM,KAAK,EAAE,IAAI,CAAC;GACvC,GAAI,WAAW,WAAW,IAAI,EAAE,SAAS,WAAW,WAAW,EAAY,IAAI,CAAC;GAChF,GAAI,WAAW,UAAU,IAAI,EAAE,YAAY,WAAW,UAAU,EAAY,IAAI,CAAC;GACjF,GAAI,QAAQ,EAAE,gBAAgB,EAAE,aAAa;IAAE,UAAU;IAAW;GAAM,EAAE,EAAE,IAAI,CAAC;GACnF,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;EAC/B;EACA,MAAM,SACJ,WAAW,KAAA,IACP,MAAM,IAAI,WAAW,KAAK,SAAS,OAAO,IAC1C,MAAM,IAAI,WAAW,KAAK,SAAS,SAAS,EAAE,OAAO,CAAC;EAC5D,IAAI,OAAO,WAAW,aAAa,OAAO,UAAU,OAAO,OAAO,WAAW,YAAY,WAAW,OAAO,QAAQ;GACjH,MAAM,QAAS,OAAO,OAA8B;GACpD,IAAI,OAAO,MAAM,IAAI,YAAY,cAAc,KAAK;EACtD;EACA,IAAI,KAAK,MAAM,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU,MAAM,EAAE,GAAG;OAC9D,IAAI,MAAM,OAAO,MAAM,GAAG,OAAO,OAAO,GAAG;EAChD,OAAO,OAAO,WAAW,aAAa,IAAI,OAAO,WAAW,YAAY,IAAI;CAC9E;AACF"}

package/dist/chunks/{schema-C9QbUW4H.mjs → schema-hSyIURjN.mjs}

@@ -212,7 +212,11 @@ const CohorteConfigSchema = Type.Object({
 		artifactsDays: count(),
 		compressAfterDays: count()
 	}, closed$4),
-	telemetry: Type.Object({ remote: Type.Boolean() }, closed$4)
+	telemetry: Type.Object({ remote: Type.Boolean() }, closed$4),
+	integrations: Type.Optional(Type.Object({ obsidian: Type.Optional(Type.Object({
+		vaultPath: Type.String({ minLength: 1 }),
+		board: Type.String({ minLength: 1 })
+	}, closed$4)) }, closed$4))
 }, closed$4);
 /** [S]. Annotated on purpose: Biome must not infer this type (docs/v3/requests/U0.02.md R1, U0.05.md R1). */
 const CohorteConfig = Type.Unsafe(CohorteConfigSchema);
@@ -563,7 +567,8 @@ Object.freeze([
 	neutral("/git/commitIdentity"),
 	neutral("/git/keepWorktrees"),
 	tighten("/retention"),
-	neutral("/telemetry")
+	neutral("/telemetry"),
+	neutral("/integrations")
 ]);
 Type.Unsafe(Type.Object({
 	policySha256: Sha256,
@@ -575,4 +580,4 @@ Type.Unsafe(Type.Object({
 //#endregion
 export { literalPrefixOf as a, CommandRule as c, Ownership as i, DEFAULT_NETWORK_POLICY as l, frozenSpecProblems as n, CohorteConfig as o, specContentSha256 as r, DEFAULT_CONFIG as s, Spec as t };
 
-//# sourceMappingURL=schema-C9QbUW4H.mjs.map
+//# sourceMappingURL=schema-hSyIURjN.mjs.map

package/dist/chunks/schema-hSyIURjN.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-hSyIURjN.mjs","names":["closed","closed","closed","closed","names","closed"],"sources":["../../../../packages/config/src/schema/policy.ts","../../../../packages/config/src/schema/config.ts","../../../../packages/config/src/schema/manifest.ts","../../../../packages/config/src/schema/ownership.ts","../../../../packages/config/src/schema/skill.ts","../../../../packages/config/src/schema/spec.ts","../../../../packages/config/src/schema/trust.ts"],"sourcesContent":["// Policy DATA shapes (DESIGN 2.6.3, 2.6.4): declared here, evaluated by @cohorte/security. `config` never imports `security`.\nimport { type Static, type TUnsafe, Type } from 'typebox';\n\nconst closed = { additionalProperties: false } as const;\nconst tokens = () => Type.Array(Type.String({ minLength: 1 }));\n\nexport const COMMAND_RULE_ORIGINS = ['builtin', 'project-config', 'project-checks'] as const;\n\n/** DESIGN 2.6.4, verbatim. */\nexport interface CommandRule {\n  id: string;\n  program: string;\n  /** exact tokens, e.g. ['run','test'] */\n  subcommand?: readonly string[];\n  /** anything not allowed is denied */\n  flags?: { allow: readonly string[]; deny?: readonly string[] };\n  positionals?:\n    | { kind: 'none' }\n    | { kind: 'paths-in-worktree'; max: number }\n    | { kind: 'enum'; values: readonly string[]; max: number }\n    | { kind: 'exact'; values: readonly string[] };\n  decision: 'allow' | 'ask' | 'deny';\n  when?: { branch?: 'any' | 'unprotected-only'; roles?: readonly string[]; phases?: readonly string[] };\n  /** drives recovery (DESIGN 4.1) */\n  replay: 'idempotent' | 'at-most-once';\n  /** true => denied under L0; under L1 it fails closed in the sandbox */\n  network: boolean;\n  origin: (typeof COMMAND_RULE_ORIGINS)[number];\n}\n\nconst max = () => Type.Integer({ minimum: 0 });\n\nconst CommandRuleSchema = Type.Object(\n  {\n    id: Type.String({ minLength: 1 }),\n    // A bare program name: a path separator can never name a program (DESIGN 2.6.4 step 1).\n    program: Type.String({ pattern: '^[^/\\\\\\\\\\\\s]+$' }),\n    subcommand: Type.Optional(tokens()),\n    flags: Type.Optional(Type.Object({ allow: tokens(), deny: Type.Optional(tokens()) }, closed)),\n    positionals: Type.Optional(\n      Type.Union([\n        Type.Object({ kind: Type.Literal('none') }, closed),\n        Type.Object({ kind: Type.Literal('paths-in-worktree'), max: max() }, closed),\n        Type.Object({ kind: Type.Literal('enum'), values: tokens(), max: max() }, closed),\n        Type.Object({ kind: Type.Literal('exact'), values: Type.Array(Type.String()) }, closed),\n      ]),\n    ),\n    decision: Type.Union([Type.Literal('allow'), Type.Literal('ask'), Type.Literal('deny')]),\n    when: Type.Optional(\n      Type.Object(\n        {\n          branch: Type.Optional(Type.Union([Type.Literal('any'), Type.Literal('unprotected-only')])),\n          roles: Type.Optional(tokens()),\n          phases: Type.Optional(tokens()),\n        },\n        closed,\n      ),\n    ),\n    replay: Type.Union([Type.Literal('idempotent'), Type.Literal('at-most-once')]),\n    network: Type.Boolean(),\n    origin: Type.Union([Type.Literal('builtin'), Type.Literal('project-config'), Type.Literal('project-checks')]),\n  },\n  closed,\n);\n\n/** [S]. The explicit annotation keeps Biome's type inference out of the union (docs/v3/requests/U0.02.md R1). */\nexport const CommandRule: TUnsafe<CommandRule> = Type.Unsafe<CommandRule>(CommandRuleSchema);\n\n/** [S] DESIGN 2.6.3. Default: deny-outgoing + deny. */\nexport const SymlinkPolicy = Type.Object(\n  {\n    mode: Type.Union([Type.Literal('deny-outgoing'), Type.Literal('deny-all'), Type.Literal('allow')]),\n    hardlinksOnWrite: Type.Union([Type.Literal('deny'), Type.Literal('allow')]),\n  },\n  closed,\n);\nexport type SymlinkPolicy = Static<typeof SymlinkPolicy>;\n\n/**\n * [S] What stage 4 evaluates for `network_request`. V3.0 has exactly one value: the tool is registered and always\n * denied (DESIGN 2.6.2, §9 \"proxy-based host allowlisting\" is out). The shape exists so a later version can add\n * an allowlist without moving the type.\n */\nexport const NetworkPolicyConfig = Type.Object({ default: Type.Literal('deny') }, closed);\nexport type NetworkPolicyConfig = Static<typeof NetworkPolicyConfig>;\n\nexport const DEFAULT_SYMLINK_POLICY: SymlinkPolicy = Object.freeze({ mode: 'deny-outgoing', hardlinksOnWrite: 'deny' });\nexport const DEFAULT_NETWORK_POLICY: NetworkPolicyConfig = Object.freeze({ default: 'deny' });\n","// `.cohorte/config.yaml` (DESIGN 2.10). NO open question of spec 32 is frozen as a literal type: `runtime.id`,\n// provider names and role keys are open strings; what 3.0 accepts among them is a LOADER rule, not a schema rule.\nimport { AuthMode, BudgetCounters, ID_PATTERN, ModelCapability, ModelRef, ThinkingLevel } from '@cohorte/base';\nimport { ActivePipelineState, type CohorteRole, EscalationPolicy } from '@cohorte/protocol';\nimport { type TUnsafe, Type } from 'typebox';\nimport { CommandRule, DEFAULT_SYMLINK_POLICY, SymlinkPolicy } from './policy.ts';\n\nconst closed = { additionalProperties: false } as const;\n\n/** The ONLY env channel of a provisioning effect (DESIGN 5.7): a closed allowlist of NAMES. */\nexport const PROVISION_ENV_NAMES = [\n  'npm_config_store_dir',\n  'npm_config_cache',\n  'YARN_CACHE_FOLDER',\n  'COREPACK_HOME',\n] as const;\nexport type ProvisionEnvName = (typeof PROVISION_ENV_NAMES)[number];\n\nexport interface TierTarget {\n  ref: ModelRef;\n  thinking: ThinkingLevel;\n}\nexport interface ApprovalsConfig {\n  unattended: 'deny' | 'wait';\n  expiryMinutes?: number;\n  /** 10 */\n  parkAfterMinutes: number;\n  ship: 'human' | 'auto';\n  notify: boolean;\n  /** approve may spawn a host */\n  autoResume: boolean;\n}\n\n/** DESIGN 2.10, verbatim. [S] schemas/config.schema.json */\nexport interface CohorteConfig {\n  schemaVersion: 1;\n  project: { id: string; defaultBranch: string; protectedBranches: string[] };\n  runtime: { id: string /* 'pi' | 'fake' */; pi?: { loadFrom: 'package' | 'bundle' } };\n  authentication: {\n    mode: AuthMode;\n    allowApiKeys: boolean;\n    /** D2: all three true; accounted METERED (DESIGN 3.7) */\n    anthropicSubscriptionViaPi?: {\n      enabled: boolean;\n      acknowledgePerTokenBilling: boolean;\n      acknowledgeProviderTermsRisk: boolean;\n    };\n  };\n  routing: {\n    allowedProviders: string[];\n    defaults: Partial<Record<CohorteRole, ModelCapability>>;\n    tiers: Partial<Record<ModelCapability, TierTarget>>;\n    escalation: EscalationPolicy;\n    fallback: { enabled: boolean };\n  };\n  budgets: {\n    run: BudgetCounters;\n    phase: BudgetCounters;\n    agent: BudgetCounters;\n    provider: Record<string, BudgetCounters>;\n    tool: Record<string, BudgetCounters>;\n    /** 3 */\n    concurrency: number;\n    /** 5 */\n    maxIncarnations: number;\n  };\n  loop: {\n    maxFixRounds: number;\n    noProgressWindow: number;\n    maxDeniedCallsPerAgent: number;\n    leftovers: Record<'major' | 'minor' | 'info', 'fix' | 'park' | 'ask'>;\n  };\n  /** argv arrays */\n  checks: { typecheck?: string[]; lint?: string[]; test?: string[]; timeoutMs: number };\n  provision: {\n    argv?: string[];\n    network: boolean;\n    cacheDirs: string[];\n    lockfiles: string[];\n    env: Partial<Record<ProvisionEnvName, string>>;\n    // default: every node_modules directory; read-only for agent commands and checks\n    dependencyDirs: string[];\n    /** writable, excluded from the dependency manifest, wiped before every check sequence */\n    writableCaches: string[];\n  };\n  policy: {\n    commands: { allow: CommandRule[]; ask: CommandRule[]; deny: CommandRule[] };\n    dangerousCommands: CommandRule[];\n    symlinks: SymlinkPolicy;\n    approvals: ApprovalsConfig;\n    /** default ask: an in-doubt effect needs a human ack before the agent continues (DESIGN 4.4) */\n    inDoubt: 'ask' | 'continue';\n    skip: ActivePipelineState[];\n    steer: { enabled: boolean };\n    admin: { runTool: boolean };\n    quota: { autoResume: boolean };\n  };\n  host: { idleExitMinutes: number; pauseKeepAliveMinutes: number; pollMs: number };\n  /** forward HTTP(S)_PROXY to the brain; default false */\n  network: { proxyEnv: boolean };\n  /** `require` absent = the computed default of DESIGN 2.6.6 */\n  sandbox: { require?: 'native' | 'best-effort'; brain: 'os-if-available' | 'os' | 'process' };\n  git: {\n    worktreeRoot?: string;\n    branchPrefix: string;\n    commitIdentity: 'user' | 'cohorte';\n    keepWorktrees: 'on-failure' | 'always' | 'never';\n  };\n  retention: {\n    transcriptsDays: number;\n    eventsDays: number | 'forever';\n    artifactsDays: number;\n    compressAfterDays: number;\n  };\n  /** default false; `true` is rejected by the LOADER in 3.0 (configuration/telemetry-remote-unavailable, ADR-0013) */\n  telemetry: { remote: boolean };\n  integrations?: { obsidian?: { vaultPath: string; board: string } };\n}\n\nconst oneOf = <const V extends readonly string[]>(values: V): TUnsafe<V[number]> =>\n  Type.Unsafe<V[number]>({ type: 'string', enum: [...values] });\nconst count = (minimum = 0) => Type.Integer({ minimum });\nconst argv = () => Type.Array(Type.String(), { minItems: 1 });\nconst strings = () => Type.Array(Type.String({ minLength: 1 }));\nconst rules = () => Type.Array(CommandRule);\n// Explicit return types: a `Static<TRecord>` that Biome has to infer overflows its stack (docs/v3/requests/U0.03.md R1).\nconst budgetMap = (): TUnsafe<Record<string, BudgetCounters>> =>\n  Type.Unsafe<Record<string, BudgetCounters>>(Type.Record(Type.String(), BudgetCounters));\nconst roleDefaults = (): TUnsafe<Partial<Record<CohorteRole, ModelCapability>>> =>\n  Type.Unsafe<Partial<Record<CohorteRole, ModelCapability>>>(Type.Record(Type.String(), ModelCapability));\nconst tier = () => Type.Optional(Type.Object({ ref: ModelRef, thinking: ThinkingLevel }, closed));\nconst envValue = () => Type.Optional(Type.String({ minLength: 1 }));\nconst leftover = () => oneOf(['fix', 'park', 'ask']);\n\nconst CohorteConfigSchema = Type.Object(\n  {\n    schemaVersion: Type.Literal(1),\n    project: Type.Object(\n      {\n        id: Type.String({ pattern: ID_PATTERN }),\n        defaultBranch: Type.String({ minLength: 1 }),\n        protectedBranches: strings(),\n      },\n      closed,\n    ),\n    runtime: Type.Object(\n      {\n        id: Type.String({ minLength: 1 }),\n        pi: Type.Optional(Type.Object({ loadFrom: oneOf(['package', 'bundle']) }, closed)),\n      },\n      closed,\n    ),\n    authentication: Type.Object(\n      {\n        mode: AuthMode,\n        allowApiKeys: Type.Boolean(),\n        anthropicSubscriptionViaPi: Type.Optional(\n          Type.Object(\n            {\n              enabled: Type.Boolean(),\n              acknowledgePerTokenBilling: Type.Boolean(),\n              acknowledgeProviderTermsRisk: Type.Boolean(),\n            },\n            closed,\n          ),\n        ),\n      },\n      closed,\n    ),\n    routing: Type.Object(\n      {\n        allowedProviders: strings(),\n        defaults: roleDefaults(),\n        tiers: Type.Object({ fast: tier(), coding: tier(), reasoning: tier(), vision: tier(), cheap: tier() }, closed),\n        escalation: EscalationPolicy,\n        fallback: Type.Object({ enabled: Type.Boolean() }, closed),\n      },\n      closed,\n    ),\n    budgets: Type.Object(\n      {\n        run: BudgetCounters,\n        phase: BudgetCounters,\n        agent: BudgetCounters,\n        provider: budgetMap(),\n        tool: budgetMap(),\n        concurrency: count(1),\n        maxIncarnations: count(1),\n      },\n      closed,\n    ),\n    loop: Type.Object(\n      {\n        maxFixRounds: count(),\n        noProgressWindow: count(1),\n        maxDeniedCallsPerAgent: count(),\n        leftovers: Type.Object({ major: leftover(), minor: leftover(), info: leftover() }, closed),\n      },\n      closed,\n    ),\n    checks: Type.Object(\n      {\n        typecheck: Type.Optional(argv()),\n        lint: Type.Optional(argv()),\n        test: Type.Optional(argv()),\n        timeoutMs: count(1),\n      },\n      closed,\n    ),\n    provision: Type.Object(\n      {\n        argv: Type.Optional(argv()),\n        network: Type.Boolean(),\n        cacheDirs: strings(),\n        lockfiles: strings(),\n        env: Type.Object(\n          {\n            npm_config_store_dir: envValue(),\n            npm_config_cache: envValue(),\n            YARN_CACHE_FOLDER: envValue(),\n            COREPACK_HOME: envValue(),\n          },\n          closed,\n        ),\n        dependencyDirs: strings(),\n        writableCaches: strings(),\n      },\n      closed,\n    ),\n    policy: Type.Object(\n      {\n        commands: Type.Object({ allow: rules(), ask: rules(), deny: rules() }, closed),\n        dangerousCommands: rules(),\n        symlinks: SymlinkPolicy,\n        approvals: Type.Object(\n          {\n            unattended: oneOf(['deny', 'wait']),\n            expiryMinutes: Type.Optional(count(1)),\n            parkAfterMinutes: count(),\n            ship: oneOf(['human', 'auto']),\n            notify: Type.Boolean(),\n            autoResume: Type.Boolean(),\n          },\n          closed,\n        ),\n        inDoubt: oneOf(['ask', 'continue']),\n        skip: Type.Array(ActivePipelineState),\n        steer: Type.Object({ enabled: Type.Boolean() }, closed),\n        admin: Type.Object({ runTool: Type.Boolean() }, closed),\n        quota: Type.Object({ autoResume: Type.Boolean() }, closed),\n      },\n      closed,\n    ),\n    host: Type.Object({ idleExitMinutes: count(), pauseKeepAliveMinutes: count(), pollMs: count(1) }, closed),\n    network: Type.Object({ proxyEnv: Type.Boolean() }, closed),\n    sandbox: Type.Object(\n      {\n        require: Type.Optional(oneOf(['native', 'best-effort'])),\n        brain: oneOf(['os-if-available', 'os', 'process']),\n      },\n      closed,\n    ),\n    git: Type.Object(\n      {\n        worktreeRoot: Type.Optional(Type.String({ minLength: 1 })),\n        branchPrefix: Type.String({ minLength: 1 }),\n        commitIdentity: oneOf(['user', 'cohorte']),\n        keepWorktrees: oneOf(['on-failure', 'always', 'never']),\n      },\n      closed,\n    ),\n    retention: Type.Object(\n      {\n        transcriptsDays: count(),\n        eventsDays: Type.Union([count(), Type.Literal('forever')]),\n        artifactsDays: count(),\n        compressAfterDays: count(),\n      },\n      closed,\n    ),\n    telemetry: Type.Object({ remote: Type.Boolean() }, closed),\n    integrations: Type.Optional(\n      Type.Object(\n        {\n          obsidian: Type.Optional(\n            Type.Object({ vaultPath: Type.String({ minLength: 1 }), board: Type.String({ minLength: 1 }) }, closed),\n          ),\n        },\n        closed,\n      ),\n    ),\n  },\n  closed,\n);\n\n/** [S]. Annotated on purpose: Biome must not infer this type (docs/v3/requests/U0.02.md R1, U0.05.md R1). */\nexport const CohorteConfig: TUnsafe<CohorteConfig> = Type.Unsafe<CohorteConfig>(CohorteConfigSchema);\n\nfunction deepFreeze<T>(value: T): T {\n  if (typeof value === 'object' && value !== null && !Object.isFrozen(value)) {\n    Object.freeze(value);\n    for (const member of Object.values(value)) deepFreeze(member);\n  }\n  return value;\n}\n\nconst MINUTE = 60_000;\n\n/**\n * The lowest layer of the load order (DESIGN 2.10): shipped defaults < user file < project file < CLI flags.\n * `project.id` is a placeholder that `cohorte init` always replaces. DESIGN gives the numbers it cares about\n * (concurrency 3, maxIncarnations 5, loop 5/3/5, host 30/30/250, parkAfterMinutes 10); the budget and retention\n * figures are provisional defaults of this file.\n */\nexport const DEFAULT_CONFIG: CohorteConfig = deepFreeze<CohorteConfig>({\n  schemaVersion: 1,\n  project: { id: 'project', defaultBranch: 'main', protectedBranches: ['main', 'master'] },\n  runtime: { id: 'pi', pi: { loadFrom: 'package' } },\n  authentication: { mode: 'subscription', allowApiKeys: false },\n  routing: {\n    allowedProviders: ['openai-codex'],\n    defaults: { implementer: 'coding', fixer: 'coding', reviewer: 'reasoning', 'security-reviewer': 'reasoning' },\n    tiers: {\n      coding: { ref: { provider: 'openai-codex', model: 'gpt-5.5', capability: 'coding' }, thinking: 'medium' },\n      reasoning: { ref: { provider: 'openai-codex', model: 'gpt-5.5', capability: 'reasoning' }, thinking: 'high' },\n      fast: { ref: { provider: 'openai-codex', model: 'gpt-5.4-mini', capability: 'fast' }, thinking: 'low' },\n      cheap: { ref: { provider: 'openai-codex', model: 'gpt-5.4-mini', capability: 'cheap' }, thinking: 'low' },\n    },\n    escalation: { sameFailureCount: 2, ladder: [{ kind: 'human' }], maxPerRun: 2 },\n    fallback: { enabled: false },\n  },\n  budgets: {\n    run: { modelRequests: 2000, toolCalls: 10_000, wallClockMs: 360 * MINUTE },\n    phase: { wallClockMs: 120 * MINUTE },\n    agent: { modelRequests: 200, toolCalls: 400, wallClockMs: 45 * MINUTE, contextTokens: 200_000 },\n    provider: {},\n    tool: {},\n    concurrency: 3,\n    maxIncarnations: 5,\n  },\n  loop: {\n    maxFixRounds: 5,\n    noProgressWindow: 3,\n    maxDeniedCallsPerAgent: 5,\n    leftovers: { major: 'fix', minor: 'park', info: 'park' },\n  },\n  checks: { timeoutMs: 10 * MINUTE },\n  provision: {\n    network: false,\n    cacheDirs: [],\n    lockfiles: ['pnpm-lock.yaml', 'package-lock.json', 'yarn.lock'],\n    env: {},\n    dependencyDirs: ['**/node_modules'],\n    writableCaches: ['node_modules/.cache', 'node_modules/.vite', 'node_modules/.vitest', 'node_modules/.vite-temp'],\n  },\n  policy: {\n    commands: { allow: [], ask: [], deny: [] },\n    dangerousCommands: [],\n    symlinks: { ...DEFAULT_SYMLINK_POLICY },\n    approvals: { unattended: 'deny', parkAfterMinutes: 10, ship: 'human', notify: false, autoResume: false },\n    inDoubt: 'ask',\n    skip: [],\n    steer: { enabled: false },\n    admin: { runTool: false },\n    quota: { autoResume: false },\n  },\n  host: { idleExitMinutes: 30, pauseKeepAliveMinutes: 30, pollMs: 250 },\n  network: { proxyEnv: false },\n  sandbox: { brain: 'os-if-available' },\n  git: { branchPrefix: 'cohorte/', commitIdentity: 'user', keepWorktrees: 'on-failure' },\n  retention: { transcriptsDays: 30, eventsDays: 'forever', artifactsDays: 90, compressAfterDays: 7 },\n  telemetry: { remote: false },\n});\n","// `.cohorte/manifest.yaml` (DESIGN 2.10): the detection marker and the previous-hash guard of spec 14.\nimport { Sha256 } from '@cohorte/base';\nimport { type Static, Type } from 'typebox';\n\nconst closed = { additionalProperties: false } as const;\n\nexport const GeneratedFile = Type.Object(\n  {\n    /** `.cohorte`-relative POSIX path */\n    path: Type.String({ minLength: 1 }),\n    templateId: Type.String({ minLength: 1 }),\n    templateSha256: Sha256,\n    /** a generated file is replaced only if its CURRENT hash equals this one */\n    renderedSha256: Sha256,\n  },\n  closed,\n);\nexport type GeneratedFile = Static<typeof GeneratedFile>;\n\n/** [S] */\nexport const Manifest = Type.Object(\n  {\n    schemaVersion: Type.Literal(1),\n    cohorteVersion: Type.String({ minLength: 1 }),\n    createdWith: Type.String({ minLength: 1 }),\n    protocol: Type.Object({ min: Type.String({ minLength: 1 }), max: Type.String({ minLength: 1 }) }, closed),\n    stateSchemaVersion: Type.Integer({ minimum: 0 }),\n    generated: Type.Array(GeneratedFile),\n  },\n  closed,\n);\nexport type Manifest = Static<typeof Manifest>;\n","// `.cohorte/ownership.yaml` (DESIGN 2.10): surfaces, their paths, owners and reviewers.\nimport { ID_PATTERN } from '@cohorte/base';\nimport { type TUnsafe, Type } from 'typebox';\n\nconst closed = { additionalProperties: false } as const;\n\n/** The one surface whose paths may overlap any other surface's (DESIGN 2.10, 5.6). */\nexport const SHARED_SURFACE_ID = 'shared';\n\nexport interface Surface {\n  /** worktree-relative POSIX globs */\n  paths: string[];\n  /** role ids allowed to WRITE the surface */\n  owners: string[];\n  reviewers: string[];\n  /** a write to one of these paths is an `ask` (DESIGN 5.6) */\n  approval?: 'human';\n}\nexport interface Ownership {\n  surfaces: Record<string, Surface>;\n}\n\nconst names = () => Type.Array(Type.String({ minLength: 1 }));\nconst SurfaceSchema = Type.Object(\n  {\n    paths: Type.Array(Type.String({ minLength: 1 }), { minItems: 1 }),\n    owners: names(),\n    reviewers: names(),\n    approval: Type.Optional(Type.Literal('human')),\n  },\n  closed,\n);\nconst OwnershipSchema = Type.Object(\n  { surfaces: Type.Record(Type.String({ pattern: ID_PATTERN }), SurfaceSchema) },\n  closed,\n);\n\n/** [S]. Annotated: a `Static<TRecord>` inferred by Biome overflows its stack (docs/v3/requests/U0.03.md R1). */\nexport const Ownership: TUnsafe<Ownership> = Type.Unsafe<Ownership>(OwnershipSchema);\n\nconst GLOB_META = /[*?[\\]{}()!]/;\n\n/** The literal prefix of a glob, by path SEGMENT: the segments before the first one holding a glob metacharacter (DESIGN 5.6). */\nexport function literalPrefixOf(pattern: string): string[] {\n  const prefix: string[] = [];\n  for (const segment of pattern.split('/')) {\n    if (segment === '' || segment === '.') continue;\n    if (GLOB_META.test(segment)) break;\n    prefix.push(segment);\n  }\n  return prefix;\n}\n\nconst isSegmentAncestorOrEqual = (a: readonly string[], b: readonly string[]): boolean =>\n  a.length <= b.length && a.every((segment, index) => segment === b[index]);\n\n/** Two patterns overlap when one literal prefix is a segment-ancestor of (or equal to) the other; no literal prefix overlaps everything. */\nexport function patternsOverlap(a: string, b: string): boolean {\n  const left = literalPrefixOf(a);\n  const right = literalPrefixOf(b);\n  return isSegmentAncestorOrEqual(left, right) || isSegmentAncestorOrEqual(right, left);\n}\n\nexport interface OwnershipProblem {\n  /** JSON pointer into the ownership document */\n  path: string;\n  message: string;\n}\n\n/**\n * The rule a JSON Schema cannot say: every surface path is DISJOINT from the paths of every other surface, unless\n * one of the two surfaces is `shared`. Conservative on purpose (prefix overlap, not glob intersection): a false\n * \"overlap\" costs an edit of ownership.yaml, a missed one lets two agents write the same file.\n */\nexport function ownershipProblems(ownership: Ownership): OwnershipProblem[] {\n  const problems: OwnershipProblem[] = [];\n  const entries = Object.entries(ownership.surfaces).filter(([id]) => id !== SHARED_SURFACE_ID);\n  entries.forEach(([id, surface], at) => {\n    for (const [otherId, other] of entries.slice(at + 1)) {\n      surface.paths.forEach((path, index) => {\n        const clash = other.paths.find((candidate) => patternsOverlap(path, candidate));\n        if (clash !== undefined) {\n          problems.push({\n            path: `/surfaces/${id}/paths/${index}`,\n            message: `\"${path}\" of surface \"${id}\" overlaps \"${clash}\" of surface \"${otherId}\": make them disjoint or move the path to the \"${SHARED_SURFACE_ID}\" surface`,\n          });\n        }\n      });\n    }\n  });\n  return problems;\n}\n","// `.cohorte/skills/<id>/skill.yaml` (DESIGN 2.10, ADR-0011). Spec 8 with ONE change: `checks[].command`, a shell\n// string, becomes `argv` (D-25, I3). Checks are declarative in V3.0: never run, and they create no CommandRule.\nimport { ID_PATTERN } from '@cohorte/base';\nimport { type Static, Type } from 'typebox';\n\nconst closed = { additionalProperties: false } as const;\nconst names = () => Type.Optional(Type.Array(Type.String({ minLength: 1 })));\n\n/** [S] schemas/skill.schema.json */\nexport const SkillManifest = Type.Object(\n  {\n    id: Type.String({ pattern: ID_PATTERN }),\n    version: Type.String({ minLength: 1 }),\n    /** matched against the Project Model, deterministically */\n    appliesWhen: Type.Object(\n      { languages: names(), frameworks: names(), packageManagers: names(), roles: names() },\n      closed,\n    ),\n    /** relative path of the Markdown, inside the skill directory */\n    prompt: Type.String({ minLength: 1 }),\n    checks: Type.Optional(\n      Type.Array(\n        Type.Object(\n          { name: Type.Optional(Type.String({ minLength: 1 })), argv: Type.Array(Type.String(), { minItems: 1 }) },\n          closed,\n        ),\n      ),\n    ),\n    /** reserved (ADR-0011): no signature is verified in V3.0 */\n    signature: Type.Optional(Type.String()),\n    /** reserved (ADR-0011) */\n    source: Type.Optional(Type.String()),\n  },\n  closed,\n);\nexport type SkillManifest = Static<typeof SkillManifest>;\n","// `.cohorte/specs/<id>.yaml` (DESIGN 2.10): a feature or a patch, draft or frozen; immutable once frozen.\nimport { canonicalJson, ID_PATTERN, type JsonValue, Sha256, sha256Hex } from '@cohorte/base';\nimport { type TUnsafe, Type } from 'typebox';\n\nconst closed = { additionalProperties: false } as const;\n\ninterface SpecBody {\n  id: string;\n  kind: 'feature' | 'patch';\n  title: string;\n  acceptance: string[];\n  surfaces: Record<string, { tasks: string[] }>;\n  /** worktree-relative path of the contract file */\n  contract?: string;\n  openQuestions: string[];\n  patch?: { repro: string; regressionTest: string; causeConfirmed: boolean };\n}\nexport interface DraftSpec extends SpecBody {\n  status: 'draft';\n}\nexport interface FrozenSpec extends SpecBody {\n  status: 'frozen';\n  /** sha256 of the canonical JSON of the spec WITHOUT `status` and `sha256`: see {@link specContentSha256} */\n  sha256: Sha256;\n}\nexport type Spec = DraftSpec | FrozenSpec;\n\nconst texts = () => Type.Array(Type.String({ minLength: 1 }));\nconst body = {\n  id: Type.String({ pattern: ID_PATTERN }),\n  kind: Type.Union([Type.Literal('feature'), Type.Literal('patch')]),\n  title: Type.String({ minLength: 1 }),\n  acceptance: texts(),\n  surfaces: Type.Record(Type.String({ pattern: ID_PATTERN }), Type.Object({ tasks: texts() }, closed)),\n  contract: Type.Optional(Type.String({ minLength: 1 })),\n  openQuestions: texts(),\n  patch: Type.Optional(\n    Type.Object({ repro: Type.String(), regressionTest: Type.String(), causeConfirmed: Type.Boolean() }, closed),\n  ),\n};\nconst SpecSchema = Type.Union([\n  Type.Object({ ...body, status: Type.Literal('draft') }, closed),\n  Type.Object({ ...body, status: Type.Literal('frozen'), sha256: Sha256 }, closed),\n]);\n\n/** [S]. A frozen spec WITHOUT a sha256, and a draft WITH one, are both invalid. */\nexport const Spec: TUnsafe<Spec> = Type.Unsafe<Spec>(SpecSchema);\n\n/** What freezing signs: everything a human wrote, nothing the freeze itself adds. */\nexport function specContentSha256(spec: Spec): Sha256 {\n  const content: Record<string, JsonValue> = {};\n  for (const [key, value] of Object.entries(spec)) {\n    if (key !== 'status' && key !== 'sha256' && value !== undefined) content[key] = value as JsonValue;\n  }\n  return sha256Hex(canonicalJson(content));\n}\n\nexport interface SpecProblem {\n  path: string;\n  message: string;\n}\n\n/** A frozen spec rejects edits: its content must still hash to the sha256 it was frozen with. A draft has nothing to prove. */\nexport function frozenSpecProblems(spec: Spec): SpecProblem[] {\n  if (spec.status !== 'frozen') return [];\n  const actual = specContentSha256(spec);\n  if (actual === spec.sha256) return [];\n  return [\n    {\n      path: '/sha256',\n      message: `spec \"${spec.id}\" is frozen and was edited: content hashes to ${actual}, frozen as ${spec.sha256}. Revert the edit, or write a new spec`,\n    },\n  ];\n}\n","// What the repository may decide, and what only the local user may decide (DESIGN 2.10.1, ADR-0026): the key-trust\n// classification as frozen DATA, the trust record, and the TrustStore PORT that `security` implements and the\n// loader consumes (`config` may not import `security`).\nimport { IsoInstant, type JsonValue, Sha256 } from '@cohorte/base';\nimport { type TUnsafe, Type } from 'typebox';\n\nexport const TRUST_CLASSES = ['tighten-only', 'loosen', 'neutral'] as const;\nexport type TrustClass = (typeof TRUST_CLASSES)[number];\n\nexport interface ConfigKeyTrustRule {\n  /**\n   * JSON pointer into `CohorteConfig`. A rule covers the key it names AND its whole subtree. Rules are prefix-disjoint:\n   * no pointer is an ancestor of another one, so a key has exactly one class.\n   */\n  pointer: string;\n  class: TrustClass;\n  /**\n   * Only on a `loosen` rule whose class depends on the VALUE (DESIGN 2.10.1: `sandbox.require: best-effort`,\n   * `policy.symlinks` towards `allow`, ...): the values that loosen. Every other value of the key is `tighten-only`.\n   */\n  loosenOnly?: readonly JsonValue[];\n}\n\nconst tighten = (pointer: string): ConfigKeyTrustRule => Object.freeze({ pointer, class: 'tighten-only' });\nconst neutral = (pointer: string): ConfigKeyTrustRule => Object.freeze({ pointer, class: 'neutral' });\nconst loosen = (pointer: string, ...loosenOnly: JsonValue[]): ConfigKeyTrustRule =>\n  Object.freeze(\n    loosenOnly.length === 0\n      ? { pointer, class: 'loosen' }\n      : { pointer, class: 'loosen', loosenOnly: Object.freeze(loosenOnly) },\n  );\n\n/** DESIGN 2.10.1, as data. TOTAL over `CohorteConfig` (a unit test enumerates the schema). */\nexport const CONFIG_KEY_TRUST: readonly ConfigKeyTrustRule[] = Object.freeze([\n  neutral('/schemaVersion'),\n  neutral('/project'),\n  neutral('/runtime/id'),\n  loosen('/runtime/pi'),\n  neutral('/authentication/mode'),\n  loosen('/authentication/allowApiKeys'),\n  loosen('/authentication/anthropicSubscriptionViaPi'),\n  loosen('/routing/allowedProviders'),\n  neutral('/routing/defaults'),\n  neutral('/routing/tiers'),\n  neutral('/routing/escalation'),\n  loosen('/routing/fallback'),\n  tighten('/budgets'),\n  tighten('/loop'),\n  loosen('/checks'),\n  loosen('/provision/argv'),\n  loosen('/provision/network'),\n  loosen('/provision/cacheDirs'),\n  neutral('/provision/lockfiles'),\n  loosen('/provision/env'),\n  loosen('/provision/dependencyDirs'),\n  loosen('/provision/writableCaches'),\n  loosen('/policy/commands/allow'),\n  tighten('/policy/commands/ask'),\n  tighten('/policy/commands/deny'),\n  loosen('/policy/dangerousCommands'),\n  loosen('/policy/symlinks/mode', 'allow'),\n  loosen('/policy/symlinks/hardlinksOnWrite', 'allow'),\n  loosen('/policy/approvals/unattended', 'wait'),\n  tighten('/policy/approvals/expiryMinutes'),\n  tighten('/policy/approvals/parkAfterMinutes'),\n  loosen('/policy/approvals/ship', 'auto'),\n  neutral('/policy/approvals/notify'),\n  loosen('/policy/approvals/autoResume'),\n  loosen('/policy/inDoubt', 'continue'),\n  loosen('/policy/skip'),\n  loosen('/policy/steer'),\n  loosen('/policy/admin'),\n  neutral('/policy/quota'),\n  neutral('/host'),\n  loosen('/network/proxyEnv'),\n  loosen('/sandbox/require', 'best-effort'),\n  loosen('/sandbox/brain', 'process'),\n  loosen('/git/worktreeRoot'),\n  neutral('/git/branchPrefix'),\n  neutral('/git/commitIdentity'),\n  neutral('/git/keepWorktrees'),\n  tighten('/retention'),\n  neutral('/telemetry'),\n  neutral('/integrations'),\n]);\n\nconst covers = (rule: ConfigKeyTrustRule, pointer: string): boolean =>\n  pointer === rule.pointer || pointer.startsWith(`${rule.pointer}/`);\n\n/** Every rule that covers `pointer`. The data is total and prefix-disjoint, so this has exactly one member for a real key. */\nexport function trustRulesFor(pointer: string): ConfigKeyTrustRule[] {\n  return CONFIG_KEY_TRUST.filter((rule) => covers(rule, pointer));\n}\n\n/**\n * The class of one key of the PROJECT file. `value` decides for the keys classed by value; without it such a key is\n * reported `loosen` (fail closed). An unknown key is `loosen` too: nothing unclassified is ever honoured silently.\n */\nexport function trustClassOf(pointer: string, value?: JsonValue): TrustClass {\n  const [rule, ...others] = trustRulesFor(pointer);\n  if (rule === undefined || others.length > 0) return 'loosen';\n  if (rule.class !== 'loosen' || rule.loosenOnly === undefined || value === undefined) return rule.class;\n  if (pointer !== rule.pointer) return 'loosen';\n  return rule.loosenOnly.some((candidate) => candidate === value) ? 'loosen' : 'tighten-only';\n}\n\n/** One file per project: `~/.cohorte/trust/<projectKeyId>.json`, `0600` in a `0700` directory, a protected root. */\nexport interface TrustRecord {\n  /** sha256(canonicalJson(the project file's values for every loosen-class key + ownership.yaml)) */\n  policySha256: Sha256;\n  /** JSON pointers of the loosening keys the user saw and accepted */\n  loosenedKeys: string[];\n  grantedAt: IsoInstant;\n  /** a label for the audit trail (the OS user name); the MAC proves \"a key holder\", never which one (ADR-0022) */\n  grantedBy: string;\n  /** HMAC-SHA256 with the project key over the canonical JSON of the record minus `mac` */\n  mac: string;\n}\n\n/**\n * [S]. The type is written by hand and the const annotated: a `Promise<Static<...>>` that Biome has to resolve for\n * nursery/noFloatingPromises overflows its stack, and a crashed Biome exits 0 (docs/v3/requests/U0.02.md R1).\n */\nexport const TrustRecord: TUnsafe<TrustRecord> = Type.Unsafe<TrustRecord>(\n  Type.Object(\n    {\n      policySha256: Sha256,\n      loosenedKeys: Type.Array(Type.String()),\n      grantedAt: IsoInstant,\n      grantedBy: Type.String({ minLength: 1 }),\n      mac: Type.String({ minLength: 1 }),\n    },\n    { additionalProperties: false },\n  ),\n);\n\nexport interface TrustGrant {\n  policySha256: Sha256;\n  loosenedKeys: string[];\n  grantedBy: string;\n}\n\n/**\n * PORT (file implementation: `@cohorte/security/auth`, `createTrustStore`). A record with a bad MAC or wrong file\n * modes is ABSENT: `lookup` fails closed.\n */\nexport interface TrustStore {\n  /** The record, only if it is authentic AND was granted for exactly this policy hash. */\n  lookup(projectKeyId: string, policySha256: Sha256): Promise<TrustRecord | undefined>;\n  grant(projectKeyId: string, grant: TrustGrant): Promise<TrustRecord>;\n  /** false = there was nothing to revoke */\n  revoke(projectKeyId: string): Promise<boolean>;\n}\n"],"mappings":";;;;;AAGA,MAAMA,WAAS,EAAE,sBAAsB,MAAM;AAC7C,MAAM,eAAe,KAAK,MAAM,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;AA0B7D,MAAM,YAAY,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC;AAE7C,MAAM,oBAAoB,KAAK,OAC7B;CACE,IAAI,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;CAEhC,SAAS,KAAK,OAAO,EAAE,SAAS,iBAAiB,CAAC;CAClD,YAAY,KAAK,SAAS,OAAO,CAAC;CAClC,OAAO,KAAK,SAAS,KAAK,OAAO;EAAE,OAAO,OAAO;EAAG,MAAM,KAAK,SAAS,OAAO,CAAC;CAAE,GAAGA,QAAM,CAAC;CAC5F,aAAa,KAAK,SAChB,KAAK,MAAM;EACT,KAAK,OAAO,EAAE,MAAM,KAAK,QAAQ,MAAM,EAAE,GAAGA,QAAM;EAClD,KAAK,OAAO;GAAE,MAAM,KAAK,QAAQ,mBAAmB;GAAG,KAAK,IAAI;EAAE,GAAGA,QAAM;EAC3E,KAAK,OAAO;GAAE,MAAM,KAAK,QAAQ,MAAM;GAAG,QAAQ,OAAO;GAAG,KAAK,IAAI;EAAE,GAAGA,QAAM;EAChF,KAAK,OAAO;GAAE,MAAM,KAAK,QAAQ,OAAO;GAAG,QAAQ,KAAK,MAAM,KAAK,OAAO,CAAC;EAAE,GAAGA,QAAM;CACxF,CAAC,CACH;CACA,UAAU,KAAK,MAAM;EAAC,KAAK,QAAQ,OAAO;EAAG,KAAK,QAAQ,KAAK;EAAG,KAAK,QAAQ,MAAM;CAAC,CAAC;CACvF,MAAM,KAAK,SACT,KAAK,OACH;EACE,QAAQ,KAAK,SAAS,KAAK,MAAM,CAAC,KAAK,QAAQ,KAAK,GAAG,KAAK,QAAQ,kBAAkB,CAAC,CAAC,CAAC;EACzF,OAAO,KAAK,SAAS,OAAO,CAAC;EAC7B,QAAQ,KAAK,SAAS,OAAO,CAAC;CAChC,GACAA,QACF,CACF;CACA,QAAQ,KAAK,MAAM,CAAC,KAAK,QAAQ,YAAY,GAAG,KAAK,QAAQ,cAAc,CAAC,CAAC;CAC7E,SAAS,KAAK,QAAQ;CACtB,QAAQ,KAAK,MAAM;EAAC,KAAK,QAAQ,SAAS;EAAG,KAAK,QAAQ,gBAAgB;EAAG,KAAK,QAAQ,gBAAgB;CAAC,CAAC;AAC9G,GACAA,QACF;;AAGA,MAAa,cAAoC,KAAK,OAAoB,iBAAiB;;AAG3F,MAAa,gBAAgB,KAAK,OAChC;CACE,MAAM,KAAK,MAAM;EAAC,KAAK,QAAQ,eAAe;EAAG,KAAK,QAAQ,UAAU;EAAG,KAAK,QAAQ,OAAO;CAAC,CAAC;CACjG,kBAAkB,KAAK,MAAM,CAAC,KAAK,QAAQ,MAAM,GAAG,KAAK,QAAQ,OAAO,CAAC,CAAC;AAC5E,GACAA,QACF;AAQmC,KAAK,OAAO,EAAE,SAAS,KAAK,QAAQ,MAAM,EAAE,GAAGA,QAAM;AAGxF,MAAa,yBAAwC,OAAO,OAAO;CAAE,MAAM;CAAiB,kBAAkB;AAAO,CAAC;AACtH,MAAa,yBAA8C,OAAO,OAAO,EAAE,SAAS,OAAO,CAAC;;;AChF5F,MAAMC,WAAS,EAAE,sBAAsB,MAAM;AAgH7C,MAAM,SAA4C,WAChD,KAAK,OAAkB;CAAE,MAAM;CAAU,MAAM,CAAC,GAAG,MAAM;AAAE,CAAC;AAC9D,MAAM,SAAS,UAAU,MAAM,KAAK,QAAQ,EAAE,QAAQ,CAAC;AACvD,MAAM,aAAa,KAAK,MAAM,KAAK,OAAO,GAAG,EAAE,UAAU,EAAE,CAAC;AAC5D,MAAM,gBAAgB,KAAK,MAAM,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;AAC9D,MAAM,cAAc,KAAK,MAAM,WAAW;AAE1C,MAAM,kBACJ,KAAK,OAAuC,KAAK,OAAO,KAAK,OAAO,GAAG,cAAc,CAAC;AACxF,MAAM,qBACJ,KAAK,OAAsD,KAAK,OAAO,KAAK,OAAO,GAAG,eAAe,CAAC;AACxG,MAAM,aAAa,KAAK,SAAS,KAAK,OAAO;CAAE,KAAK;CAAU,UAAU;AAAc,GAAGA,QAAM,CAAC;AAChG,MAAM,iBAAiB,KAAK,SAAS,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;AAClE,MAAM,iBAAiB,MAAM;CAAC;CAAO;CAAQ;AAAK,CAAC;AAEnD,MAAM,sBAAsB,KAAK,OAC/B;CACE,eAAe,KAAK,QAAQ,CAAC;CAC7B,SAAS,KAAK,OACZ;EACE,IAAI,KAAK,OAAO,EAAE,SAAS,WAAW,CAAC;EACvC,eAAe,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;EAC3C,mBAAmB,QAAQ;CAC7B,GACAA,QACF;CACA,SAAS,KAAK,OACZ;EACE,IAAI,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;EAChC,IAAI,KAAK,SAAS,KAAK,OAAO,EAAE,UAAU,MAAM,CAAC,WAAW,QAAQ,CAAC,EAAE,GAAGA,QAAM,CAAC;CACnF,GACAA,QACF;CACA,gBAAgB,KAAK,OACnB;EACE,MAAM;EACN,cAAc,KAAK,QAAQ;EAC3B,4BAA4B,KAAK,SAC/B,KAAK,OACH;GACE,SAAS,KAAK,QAAQ;GACtB,4BAA4B,KAAK,QAAQ;GACzC,8BAA8B,KAAK,QAAQ;EAC7C,GACAA,QACF,CACF;CACF,GACAA,QACF;CACA,SAAS,KAAK,OACZ;EACE,kBAAkB,QAAQ;EAC1B,UAAU,aAAa;EACvB,OAAO,KAAK,OAAO;GAAE,MAAM,KAAK;GAAG,QAAQ,KAAK;GAAG,WAAW,KAAK;GAAG,QAAQ,KAAK;GAAG,OAAO,KAAK;EAAE,GAAGA,QAAM;EAC7G,YAAY;EACZ,UAAU,KAAK,OAAO,EAAE,SAAS,KAAK,QAAQ,EAAE,GAAGA,QAAM;CAC3D,GACAA,QACF;CACA,SAAS,KAAK,OACZ;EACE,KAAK;EACL,OAAO;EACP,OAAO;EACP,UAAU,UAAU;EACpB,MAAM,UAAU;EAChB,aAAa,MAAM,CAAC;EACpB,iBAAiB,MAAM,CAAC;CAC1B,GACAA,QACF;CACA,MAAM,KAAK,OACT;EACE,cAAc,MAAM;EACpB,kBAAkB,MAAM,CAAC;EACzB,wBAAwB,MAAM;EAC9B,WAAW,KAAK,OAAO;GAAE,OAAO,SAAS;GAAG,OAAO,SAAS;GAAG,MAAM,SAAS;EAAE,GAAGA,QAAM;CAC3F,GACAA,QACF;CACA,QAAQ,KAAK,OACX;EACE,WAAW,KAAK,SAAS,KAAK,CAAC;EAC/B,MAAM,KAAK,SAAS,KAAK,CAAC;EAC1B,MAAM,KAAK,SAAS,KAAK,CAAC;EAC1B,WAAW,MAAM,CAAC;CACpB,GACAA,QACF;CACA,WAAW,KAAK,OACd;EACE,MAAM,KAAK,SAAS,KAAK,CAAC;EAC1B,SAAS,KAAK,QAAQ;EACtB,WAAW,QAAQ;EACnB,WAAW,QAAQ;EACnB,KAAK,KAAK,OACR;GACE,sBAAsB,SAAS;GAC/B,kBAAkB,SAAS;GAC3B,mBAAmB,SAAS;GAC5B,eAAe,SAAS;EAC1B,GACAA,QACF;EACA,gBAAgB,QAAQ;EACxB,gBAAgB,QAAQ;CAC1B,GACAA,QACF;CACA,QAAQ,KAAK,OACX;EACE,UAAU,KAAK,OAAO;GAAE,OAAO,MAAM;GAAG,KAAK,MAAM;GAAG,MAAM,MAAM;EAAE,GAAGA,QAAM;EAC7E,mBAAmB,MAAM;EACzB,UAAU;EACV,WAAW,KAAK,OACd;GACE,YAAY,MAAM,CAAC,QAAQ,MAAM,CAAC;GAClC,eAAe,KAAK,SAAS,MAAM,CAAC,CAAC;GACrC,kBAAkB,MAAM;GACxB,MAAM,MAAM,CAAC,SAAS,MAAM,CAAC;GAC7B,QAAQ,KAAK,QAAQ;GACrB,YAAY,KAAK,QAAQ;EAC3B,GACAA,QACF;EACA,SAAS,MAAM,CAAC,OAAO,UAAU,CAAC;EAClC,MAAM,KAAK,MAAM,mBAAmB;EACpC,OAAO,KAAK,OAAO,EAAE,SAAS,KAAK,QAAQ,EAAE,GAAGA,QAAM;EACtD,OAAO,KAAK,OAAO,EAAE,SAAS,KAAK,QAAQ,EAAE,GAAGA,QAAM;EACtD,OAAO,KAAK,OAAO,EAAE,YAAY,KAAK,QAAQ,EAAE,GAAGA,QAAM;CAC3D,GACAA,QACF;CACA,MAAM,KAAK,OAAO;EAAE,iBAAiB,MAAM;EAAG,uBAAuB,MAAM;EAAG,QAAQ,MAAM,CAAC;CAAE,GAAGA,QAAM;CACxG,SAAS,KAAK,OAAO,EAAE,UAAU,KAAK,QAAQ,EAAE,GAAGA,QAAM;CACzD,SAAS,KAAK,OACZ;EACE,SAAS,KAAK,SAAS,MAAM,CAAC,UAAU,aAAa,CAAC,CAAC;EACvD,OAAO,MAAM;GAAC;GAAmB;GAAM;EAAS,CAAC;CACnD,GACAA,QACF;CACA,KAAK,KAAK,OACR;EACE,cAAc,KAAK,SAAS,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;EACzD,cAAc,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;EAC1C,gBAAgB,MAAM,CAAC,QAAQ,SAAS,CAAC;EACzC,eAAe,MAAM;GAAC;GAAc;GAAU;EAAO,CAAC;CACxD,GACAA,QACF;CACA,WAAW,KAAK,OACd;EACE,iBAAiB,MAAM;EACvB,YAAY,KAAK,MAAM,CAAC,MAAM,GAAG,KAAK,QAAQ,SAAS,CAAC,CAAC;EACzD,eAAe,MAAM;EACrB,mBAAmB,MAAM;CAC3B,GACAA,QACF;CACA,WAAW,KAAK,OAAO,EAAE,QAAQ,KAAK,QAAQ,EAAE,GAAGA,QAAM;CACzD,cAAc,KAAK,SACjB,KAAK,OACH,EACE,UAAU,KAAK,SACb,KAAK,OAAO;EAAE,WAAW,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;EAAG,OAAO,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;CAAE,GAAGA,QAAM,CACxG,EACF,GACAA,QACF,CACF;AACF,GACAA,QACF;;AAGA,MAAa,gBAAwC,KAAK,OAAsB,mBAAmB;AAEnG,SAAS,WAAc,OAAa;CAClC,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,OAAO,SAAS,KAAK,GAAG;EAC1E,OAAO,OAAO,KAAK;EACnB,KAAK,MAAM,UAAU,OAAO,OAAO,KAAK,GAAG,WAAW,MAAM;CAC9D;CACA,OAAO;AACT;AAEA,MAAM,SAAS;;;;;;;AAQf,MAAa,iBAAgC,WAA0B;CACrE,eAAe;CACf,SAAS;EAAE,IAAI;EAAW,eAAe;EAAQ,mBAAmB,CAAC,QAAQ,QAAQ;CAAE;CACvF,SAAS;EAAE,IAAI;EAAM,IAAI,EAAE,UAAU,UAAU;CAAE;CACjD,gBAAgB;EAAE,MAAM;EAAgB,cAAc;CAAM;CAC5D,SAAS;EACP,kBAAkB,CAAC,cAAc;EACjC,UAAU;GAAE,aAAa;GAAU,OAAO;GAAU,UAAU;GAAa,qBAAqB;EAAY;EAC5G,OAAO;GACL,QAAQ;IAAE,KAAK;KAAE,UAAU;KAAgB,OAAO;KAAW,YAAY;IAAS;IAAG,UAAU;GAAS;GACxG,WAAW;IAAE,KAAK;KAAE,UAAU;KAAgB,OAAO;KAAW,YAAY;IAAY;IAAG,UAAU;GAAO;GAC5G,MAAM;IAAE,KAAK;KAAE,UAAU;KAAgB,OAAO;KAAgB,YAAY;IAAO;IAAG,UAAU;GAAM;GACtG,OAAO;IAAE,KAAK;KAAE,UAAU;KAAgB,OAAO;KAAgB,YAAY;IAAQ;IAAG,UAAU;GAAM;EAC1G;EACA,YAAY;GAAE,kBAAkB;GAAG,QAAQ,CAAC,EAAE,MAAM,QAAQ,CAAC;GAAG,WAAW;EAAE;EAC7E,UAAU,EAAE,SAAS,MAAM;CAC7B;CACA,SAAS;EACP,KAAK;GAAE,eAAe;GAAM,WAAW;GAAQ,aAAa,MAAM;EAAO;EACzE,OAAO,EAAE,aAAa,MAAM,OAAO;EACnC,OAAO;GAAE,eAAe;GAAK,WAAW;GAAK,aAAa,KAAK;GAAQ,eAAe;EAAQ;EAC9F,UAAU,CAAC;EACX,MAAM,CAAC;EACP,aAAa;EACb,iBAAiB;CACnB;CACA,MAAM;EACJ,cAAc;EACd,kBAAkB;EAClB,wBAAwB;EACxB,WAAW;GAAE,OAAO;GAAO,OAAO;GAAQ,MAAM;EAAO;CACzD;CACA,QAAQ,EAAE,WAAW,KAAK,OAAO;CACjC,WAAW;EACT,SAAS;EACT,WAAW,CAAC;EACZ,WAAW;GAAC;GAAkB;GAAqB;EAAW;EAC9D,KAAK,CAAC;EACN,gBAAgB,CAAC,iBAAiB;EAClC,gBAAgB;GAAC;GAAuB;GAAsB;GAAwB;EAAyB;CACjH;CACA,QAAQ;EACN,UAAU;GAAE,OAAO,CAAC;GAAG,KAAK,CAAC;GAAG,MAAM,CAAC;EAAE;EACzC,mBAAmB,CAAC;EACpB,UAAU,EAAE,GAAG,uBAAuB;EACtC,WAAW;GAAE,YAAY;GAAQ,kBAAkB;GAAI,MAAM;GAAS,QAAQ;GAAO,YAAY;EAAM;EACvG,SAAS;EACT,MAAM,CAAC;EACP,OAAO,EAAE,SAAS,MAAM;EACxB,OAAO,EAAE,SAAS,MAAM;EACxB,OAAO,EAAE,YAAY,MAAM;CAC7B;CACA,MAAM;EAAE,iBAAiB;EAAI,uBAAuB;EAAI,QAAQ;CAAI;CACpE,SAAS,EAAE,UAAU,MAAM;CAC3B,SAAS,EAAE,OAAO,kBAAkB;CACpC,KAAK;EAAE,cAAc;EAAY,gBAAgB;EAAQ,eAAe;CAAa;CACrF,WAAW;EAAE,iBAAiB;EAAI,YAAY;EAAW,eAAe;EAAI,mBAAmB;CAAE;CACjG,WAAW,EAAE,QAAQ,MAAM;AAC7B,CAAC;;;AChXD,MAAMC,WAAS,EAAE,sBAAsB,MAAM;AAE7C,MAAa,gBAAgB,KAAK,OAChC;;CAEE,MAAM,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;CAClC,YAAY,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;CACxC,gBAAgB;;CAEhB,gBAAgB;AAClB,GACAA,QACF;AAIwB,KAAK,OAC3B;CACE,eAAe,KAAK,QAAQ,CAAC;CAC7B,gBAAgB,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;CAC5C,aAAa,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;CACzC,UAAU,KAAK,OAAO;EAAE,KAAK,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;EAAG,KAAK,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;CAAE,GAAGA,QAAM;CACxG,oBAAoB,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC;CAC/C,WAAW,KAAK,MAAM,aAAa;AACrC,GACAA,QACF;;;AC1BA,MAAMC,WAAS,EAAE,sBAAsB,MAAM;AAkB7C,MAAMC,gBAAc,KAAK,MAAM,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;AAC5D,MAAM,gBAAgB,KAAK,OACzB;CACE,OAAO,KAAK,MAAM,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC;CAChE,QAAQA,QAAM;CACd,WAAWA,QAAM;CACjB,UAAU,KAAK,SAAS,KAAK,QAAQ,OAAO,CAAC;AAC/C,GACAD,QACF;AACA,MAAM,kBAAkB,KAAK,OAC3B,EAAE,UAAU,KAAK,OAAO,KAAK,OAAO,EAAE,SAAS,WAAW,CAAC,GAAG,aAAa,EAAE,GAC7EA,QACF;;AAGA,MAAa,YAAgC,KAAK,OAAkB,eAAe;AAEnF,MAAM,YAAY;;AAGlB,SAAgB,gBAAgB,SAA2B;CACzD,MAAM,SAAmB,CAAC;CAC1B,KAAK,MAAM,WAAW,QAAQ,MAAM,GAAG,GAAG;EACxC,IAAI,YAAY,MAAM,YAAY,KAAK;EACvC,IAAI,UAAU,KAAK,OAAO,GAAG;EAC7B,OAAO,KAAK,OAAO;CACrB;CACA,OAAO;AACT;;;AC9CA,MAAME,WAAS,EAAE,sBAAsB,MAAM;AAC7C,MAAM,cAAc,KAAK,SAAS,KAAK,MAAM,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;AAG9C,KAAK,OAChC;CACE,IAAI,KAAK,OAAO,EAAE,SAAS,WAAW,CAAC;CACvC,SAAS,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;;CAErC,aAAa,KAAK,OAChB;EAAE,WAAW,MAAM;EAAG,YAAY,MAAM;EAAG,iBAAiB,MAAM;EAAG,OAAO,MAAM;CAAE,GACpFA,QACF;;CAEA,QAAQ,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;CACpC,QAAQ,KAAK,SACX,KAAK,MACH,KAAK,OACH;EAAE,MAAM,KAAK,SAAS,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;EAAG,MAAM,KAAK,MAAM,KAAK,OAAO,GAAG,EAAE,UAAU,EAAE,CAAC;CAAE,GACvGA,QACF,CACF,CACF;;CAEA,WAAW,KAAK,SAAS,KAAK,OAAO,CAAC;;CAEtC,QAAQ,KAAK,SAAS,KAAK,OAAO,CAAC;AACrC,GACAA,QACF;;;AC9BA,MAAM,SAAS,EAAE,sBAAsB,MAAM;AAuB7C,MAAM,cAAc,KAAK,MAAM,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;AAC5D,MAAM,OAAO;CACX,IAAI,KAAK,OAAO,EAAE,SAAS,WAAW,CAAC;CACvC,MAAM,KAAK,MAAM,CAAC,KAAK,QAAQ,SAAS,GAAG,KAAK,QAAQ,OAAO,CAAC,CAAC;CACjE,OAAO,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;CACnC,YAAY,MAAM;CAClB,UAAU,KAAK,OAAO,KAAK,OAAO,EAAE,SAAS,WAAW,CAAC,GAAG,KAAK,OAAO,EAAE,OAAO,MAAM,EAAE,GAAG,MAAM,CAAC;CACnG,UAAU,KAAK,SAAS,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;CACrD,eAAe,MAAM;CACrB,OAAO,KAAK,SACV,KAAK,OAAO;EAAE,OAAO,KAAK,OAAO;EAAG,gBAAgB,KAAK,OAAO;EAAG,gBAAgB,KAAK,QAAQ;CAAE,GAAG,MAAM,CAC7G;AACF;AACA,MAAM,aAAa,KAAK,MAAM,CAC5B,KAAK,OAAO;CAAE,GAAG;CAAM,QAAQ,KAAK,QAAQ,OAAO;AAAE,GAAG,MAAM,GAC9D,KAAK,OAAO;CAAE,GAAG;CAAM,QAAQ,KAAK,QAAQ,QAAQ;CAAG,QAAQ;AAAO,GAAG,MAAM,CACjF,CAAC;;AAGD,MAAa,OAAsB,KAAK,OAAa,UAAU;;AAG/D,SAAgB,kBAAkB,MAAoB;CACpD,MAAM,UAAqC,CAAC;CAC5C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,IAAI,GAC5C,IAAI,QAAQ,YAAY,QAAQ,YAAY,UAAU,KAAA,GAAW,QAAQ,OAAO;CAElF,OAAO,UAAU,cAAc,OAAO,CAAC;AACzC;;AAQA,SAAgB,mBAAmB,MAA2B;CAC5D,IAAI,KAAK,WAAW,UAAU,OAAO,CAAC;CACtC,MAAM,SAAS,kBAAkB,IAAI;CACrC,IAAI,WAAW,KAAK,QAAQ,OAAO,CAAC;CACpC,OAAO,CACL;EACE,MAAM;EACN,SAAS,SAAS,KAAK,GAAG,gDAAgD,OAAO,cAAc,KAAK,OAAO;CAC7G,CACF;AACF;;;AClDA,MAAM,WAAW,YAAwC,OAAO,OAAO;CAAE;CAAS,OAAO;AAAe,CAAC;AACzG,MAAM,WAAW,YAAwC,OAAO,OAAO;CAAE;CAAS,OAAO;AAAU,CAAC;AACpG,MAAM,UAAU,SAAiB,GAAG,eAClC,OAAO,OACL,WAAW,WAAW,IAClB;CAAE;CAAS,OAAO;AAAS,IAC3B;CAAE;CAAS,OAAO;CAAU,YAAY,OAAO,OAAO,UAAU;AAAE,CACxE;AAG6D,OAAO,OAAO;CAC3E,QAAQ,gBAAgB;CACxB,QAAQ,UAAU;CAClB,QAAQ,aAAa;CACrB,OAAO,aAAa;CACpB,QAAQ,sBAAsB;CAC9B,OAAO,8BAA8B;CACrC,OAAO,4CAA4C;CACnD,OAAO,2BAA2B;CAClC,QAAQ,mBAAmB;CAC3B,QAAQ,gBAAgB;CACxB,QAAQ,qBAAqB;CAC7B,OAAO,mBAAmB;CAC1B,QAAQ,UAAU;CAClB,QAAQ,OAAO;CACf,OAAO,SAAS;CAChB,OAAO,iBAAiB;CACxB,OAAO,oBAAoB;CAC3B,OAAO,sBAAsB;CAC7B,QAAQ,sBAAsB;CAC9B,OAAO,gBAAgB;CACvB,OAAO,2BAA2B;CAClC,OAAO,2BAA2B;CAClC,OAAO,wBAAwB;CAC/B,QAAQ,sBAAsB;CAC9B,QAAQ,uBAAuB;CAC/B,OAAO,2BAA2B;CAClC,OAAO,yBAAyB,OAAO;CACvC,OAAO,qCAAqC,OAAO;CACnD,OAAO,gCAAgC,MAAM;CAC7C,QAAQ,iCAAiC;CACzC,QAAQ,oCAAoC;CAC5C,OAAO,0BAA0B,MAAM;CACvC,QAAQ,0BAA0B;CAClC,OAAO,8BAA8B;CACrC,OAAO,mBAAmB,UAAU;CACpC,OAAO,cAAc;CACrB,OAAO,eAAe;CACtB,OAAO,eAAe;CACtB,QAAQ,eAAe;CACvB,QAAQ,OAAO;CACf,OAAO,mBAAmB;CAC1B,OAAO,oBAAoB,aAAa;CACxC,OAAO,kBAAkB,SAAS;CAClC,OAAO,mBAAmB;CAC1B,QAAQ,mBAAmB;CAC3B,QAAQ,qBAAqB;CAC7B,QAAQ,oBAAoB;CAC5B,QAAQ,YAAY;CACpB,QAAQ,YAAY;CACpB,QAAQ,eAAe;AACzB,CAAC;AAuCgD,KAAK,OACpD,KAAK,OACH;CACE,cAAc;CACd,cAAc,KAAK,MAAM,KAAK,OAAO,CAAC;CACtC,WAAW;CACX,WAAW,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;CACvC,KAAK,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;AACnC,GACA,EAAE,sBAAsB,MAAM,CAChC,CACF"}

package/dist/chunks/{spec-Bq0P3jVh.mjs → spec-MVP9y8dN.mjs}

@@ -1,4 +1,4 @@
-import { r as loadSpec, t as freezeSpec } from "./src-DcU4IXMe.mjs";
+import { r as loadSpec, t as freezeSpec } from "./src-BnlNkd3S.mjs";
 import { writeFile } from "node:fs/promises";
 import { stringify } from "yaml";
 //#region src/commands/spec/index.ts
@@ -17,4 +17,4 @@ const spec = {
 //#endregion
 export { spec as default };
 
-//# sourceMappingURL=spec-Bq0P3jVh.mjs.map
+//# sourceMappingURL=spec-MVP9y8dN.mjs.map

package/dist/chunks/{spec-Bq0P3jVh.mjs.map → spec-MVP9y8dN.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"spec-Bq0P3jVh.mjs","names":[],"sources":["../../../../apps/cli/src/commands/spec/index.ts"],"sourcesContent":["// apps/cli/src/commands/spec/index.ts — DESIGN §9 verb `spec` (PLAN §3 rule 3 \"later units fill\n// stub files that lie inside their owned paths; they never edit ... the registry\"). Wave-0 stub: exits with the\n// documented not-available error (spec 24 `configuration/phase-not-available`); filled by the Wave-4/5\n// unit that owns `apps/cli/src/commands/spec/**`.\nimport { writeFile } from 'node:fs/promises';\nimport { freezeSpec, loadSpec } from '@cohorte/config';\nimport { stringify } from 'yaml';\nimport type { CommandModule } from '../../contract/index.ts';\n\nconst spec: CommandModule = {\n  verb: 'spec',\n  async run(ctx, args) {\n    const file = args.positionals.find((value) => !value.startsWith('--'));\n    if (!file) return 2;\n    const frozen = args.subVerb === 'freeze';\n    const value = frozen ? await freezeSpec(file) : await loadSpec(file);\n    if (frozen) await writeFile(file, stringify(value));\n    ctx.stdio.stdout.write(`${JSON.stringify(value)}\\n`);\n    return 0;\n  },\n};\n\nexport default spec;\n"],"mappings":";;;;AASA,MAAM,OAAsB;CAC1B,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,MAAM,OAAO,KAAK,YAAY,MAAM,UAAU,CAAC,MAAM,WAAW,IAAI,CAAC;EACrE,IAAI,CAAC,MAAM,OAAO;EAClB,MAAM,SAAS,KAAK,YAAY;EAChC,MAAM,QAAQ,SAAS,MAAM,WAAW,IAAI,IAAI,MAAM,SAAS,IAAI;EACnE,IAAI,QAAQ,MAAM,UAAU,MAAM,UAAU,KAAK,CAAC;EAClD,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU,KAAK,EAAE,GAAG;EACnD,OAAO;CACT;AACF"}
+{"version":3,"file":"spec-MVP9y8dN.mjs","names":[],"sources":["../../../../apps/cli/src/commands/spec/index.ts"],"sourcesContent":["// apps/cli/src/commands/spec/index.ts — DESIGN §9 verb `spec` (PLAN §3 rule 3 \"later units fill\n// stub files that lie inside their owned paths; they never edit ... the registry\"). Wave-0 stub: exits with the\n// documented not-available error (spec 24 `configuration/phase-not-available`); filled by the Wave-4/5\n// unit that owns `apps/cli/src/commands/spec/**`.\nimport { writeFile } from 'node:fs/promises';\nimport { freezeSpec, loadSpec } from '@cohorte/config';\nimport { stringify } from 'yaml';\nimport type { CommandModule } from '../../contract/index.ts';\n\nconst spec: CommandModule = {\n  verb: 'spec',\n  async run(ctx, args) {\n    const file = args.positionals.find((value) => !value.startsWith('--'));\n    if (!file) return 2;\n    const frozen = args.subVerb === 'freeze';\n    const value = frozen ? await freezeSpec(file) : await loadSpec(file);\n    if (frozen) await writeFile(file, stringify(value));\n    ctx.stdio.stdout.write(`${JSON.stringify(value)}\\n`);\n    return 0;\n  },\n};\n\nexport default spec;\n"],"mappings":";;;;AASA,MAAM,OAAsB;CAC1B,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,MAAM,OAAO,KAAK,YAAY,MAAM,UAAU,CAAC,MAAM,WAAW,IAAI,CAAC;EACrE,IAAI,CAAC,MAAM,OAAO;EAClB,MAAM,SAAS,KAAK,YAAY;EAChC,MAAM,QAAQ,SAAS,MAAM,WAAW,IAAI,IAAI,MAAM,SAAS,IAAI;EACnE,IAAI,QAAQ,MAAM,UAAU,MAAM,UAAU,KAAK,CAAC;EAClD,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU,KAAK,EAAE,GAAG;EACnD,OAAO;CACT;AACF"}

package/dist/chunks/{src-DcU4IXMe.mjs → src-BnlNkd3S.mjs}

@@ -1,6 +1,6 @@
 import { n as sha256Hex, t as canonicalJson } from "./canonical-C8UxeEmB.mjs";
 import "./src-Cu3TxNob.mjs";
-import { i as Ownership, n as frozenSpecProblems, o as CohorteConfig, r as specContentSha256, s as DEFAULT_CONFIG, t as Spec } from "./schema-C9QbUW4H.mjs";
+import { i as Ownership, n as frozenSpecProblems, o as CohorteConfig, r as specContentSha256, s as DEFAULT_CONFIG, t as Spec } from "./schema-hSyIURjN.mjs";
 import { Compile } from "typebox/compile";
 import { readFile } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
@@ -114,4 +114,4 @@ async function freezeSpec(file) {
 //#endregion
 export { resolveConfig as i, loadConfig as n, loadSpec as r, freezeSpec as t };
 
-//# sourceMappingURL=src-DcU4IXMe.mjs.map
+//# sourceMappingURL=src-BnlNkd3S.mjs.map

package/dist/chunks/{src-DcU4IXMe.mjs.map → src-BnlNkd3S.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"src-DcU4IXMe.mjs","names":[],"sources":["../../../../packages/config/src/load/index.ts"],"sourcesContent":["// Configuration loading and trust resolution (PLAN U2.09).\n\nimport { readFile } from 'node:fs/promises';\nimport { dirname, join, resolve } from 'node:path';\nimport { canonicalJson, type JsonValue, type Sha256, sha256Hex } from '@cohorte/base';\nimport { Compile } from 'typebox/compile';\nimport { parse } from 'yaml';\nimport {\n  CohorteConfig,\n  type CohorteConfig as CohorteConfigType,\n  DEFAULT_CONFIG,\n  type FrozenSpec as FrozenSpecType,\n  frozenSpecProblems,\n  Ownership,\n  type Ownership as OwnershipType,\n  Spec,\n  type Spec as SpecType,\n  specContentSha256,\n  type TrustStore,\n} from '../schema/index.ts';\n\nexport interface LoadConfigOptions {\n  /** any directory inside the project: the loader walks up to `.cohorte/` */\n  cwd: string;\n  /** the user's home: `~/.cohorte/config.yaml` is the user layer. Injected, never read from the environment here. */\n  home: string;\n  /** the CLI-flag layer, already shaped like a partial config document */\n  flags?: JsonValue;\n}\n\n/** The four layers of DESIGN 2.10, UNMERGED: shipped defaults < user file < project file < CLI flags. */\nexport interface LoadedConfig {\n  projectRoot: string;\n  layers: { defaults: CohorteConfig; user?: JsonValue; project?: JsonValue; flags?: JsonValue };\n  ownership: Ownership;\n}\n\nexport interface ResolveConfigOptions {\n  trustStore: TrustStore;\n  projectKeyId: string;\n  /** `--trust-project-config`: consent form `cli-flag` for every loosening key of the project file */\n  trustProjectConfig?: boolean;\n}\n\nexport interface ConfigTrust {\n  policySha256: Sha256;\n  loosenedKeys: string[];\n  grantedBy: 'none-needed' | 'user-config' | 'cli-flag' | 'trust-record';\n}\n\nexport type ResolvedConfig =\n  | { status: 'resolved'; config: CohorteConfig; sha256: Sha256; trust: ConfigTrust; warnings: string[] }\n  /** the caller fails closed with `security/project-policy-untrusted` */\n  | {\n      status: 'untrusted';\n      policySha256: Sha256;\n      loosenedKeys: string[];\n      diff: { pointer: string; trusted?: JsonValue; requested: JsonValue }[];\n    };\n\nconst readYaml = async (file: string): Promise<JsonValue | undefined> => {\n  try {\n    const value: unknown = parse(await readFile(file, 'utf8'));\n    return value === undefined ? undefined : (value as JsonValue);\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return undefined;\n    throw new Error(\n      `configuration/invalid: cannot read ${file}: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n};\n\nconst merge = (left: JsonValue, right: JsonValue): JsonValue => {\n  if (\n    typeof left !== 'object' ||\n    left === null ||\n    Array.isArray(left) ||\n    typeof right !== 'object' ||\n    right === null ||\n    Array.isArray(right)\n  )\n    return structuredClone(right);\n  const output: Record<string, JsonValue> = structuredClone(left);\n  for (const [key, value] of Object.entries(right as Record<string, JsonValue>)) {\n    const existing = output[key];\n    output[key] = existing === undefined ? structuredClone(value) : merge(existing, value);\n  }\n  return output;\n};\n\nconst findProjectRoot = async (cwd: string): Promise<string> => {\n  let current = resolve(cwd);\n  while (true) {\n    try {\n      const value = await readYaml(join(current, '.cohorte', 'config.yaml'));\n      if (value !== undefined) return current;\n    } catch {\n      /* continue to the parent so a malformed nested file is still reported by the selected root */\n    }\n    const parent = dirname(current);\n    if (parent === current) return resolve(cwd);\n    current = parent;\n  }\n};\n\nexport async function loadConfig(options: LoadConfigOptions): Promise<LoadedConfig> {\n  const projectRoot = await findProjectRoot(options.cwd);\n  const project = await readYaml(join(projectRoot, '.cohorte', 'config.yaml'));\n  const user = await readYaml(join(options.home, '.cohorte', 'config.yaml'));\n  const ownershipDocument = (await readYaml(join(projectRoot, '.cohorte', 'ownership.yaml'))) ?? { surfaces: {} };\n  const ownershipCheck = Compile(Ownership).Check(ownershipDocument);\n  if (!ownershipCheck) throw new Error('configuration/ownership-invalid: ownership.yaml does not match its schema');\n  return {\n    projectRoot,\n    layers: {\n      defaults: DEFAULT_CONFIG,\n      ...(user === undefined ? {} : { user }),\n      ...(project === undefined ? {} : { project }),\n      ...(options.flags === undefined ? {} : { flags: options.flags }),\n    },\n    ownership: ownershipDocument as OwnershipType,\n  };\n}\n\nexport async function resolveConfig(loaded: LoadedConfig, options: ResolveConfigOptions): Promise<ResolvedConfig> {\n  const layers: JsonValue[] = [loaded.layers.defaults as unknown as JsonValue];\n  if (loaded.layers.user !== undefined) layers.push(loaded.layers.user);\n  if (loaded.layers.project !== undefined) layers.push(loaded.layers.project);\n  if (loaded.layers.flags !== undefined) layers.push(loaded.layers.flags);\n  const [defaults, ...overrides] = layers;\n  if (defaults === undefined) throw new Error('configuration/policy-invalid: defaults are missing');\n  const merged = overrides.reduce(merge, defaults);\n  if (!Compile(CohorteConfig).Check(merged))\n    throw new Error('configuration/policy-invalid: merged configuration does not match its schema');\n  const config = merged as unknown as CohorteConfigType;\n  const project = loaded.layers.project;\n  const loosenedKeys: string[] = [];\n  if (project && typeof project === 'object' && !Array.isArray(project)) {\n    for (const [key, value] of Object.entries(project)) {\n      const pointer = `/${key}`;\n      if (value !== undefined) loosenedKeys.push(pointer);\n    }\n  }\n  const policySha256 = sha256Hex(\n    canonicalJson({ project: project ?? {}, ownership: loaded.ownership as unknown as JsonValue }),\n  );\n  const trust =\n    loosenedKeys.length === 0 ? undefined : await options.trustStore.lookup(options.projectKeyId, policySha256);\n  if (loosenedKeys.length > 0 && !options.trustProjectConfig && trust === undefined)\n    return {\n      status: 'untrusted',\n      policySha256,\n      loosenedKeys,\n      diff: loosenedKeys.map((pointer) => ({\n        pointer,\n        requested:\n          project && typeof project === 'object' && !Array.isArray(project)\n            ? (project[pointer.slice(1)] ?? null)\n            : null,\n      })),\n    };\n  return {\n    status: 'resolved',\n    config,\n    sha256: sha256Hex(canonicalJson(config as unknown as JsonValue)),\n    trust: {\n      policySha256,\n      loosenedKeys,\n      grantedBy: loosenedKeys.length === 0 ? 'none-needed' : options.trustProjectConfig ? 'cli-flag' : 'trust-record',\n    },\n    warnings: [],\n  };\n}\n\nexport async function loadSpec(file: string): Promise<SpecType> {\n  const value = await readYaml(file);\n  if (value === undefined || !Compile(Spec).Check(value)) throw new Error(`validation/spec: invalid spec ${file}`);\n  const spec = value as unknown as SpecType;\n  if (frozenSpecProblems(spec).length > 0) throw new Error(`validation/spec: frozen spec ${spec.id} was edited`);\n  return spec;\n}\n\n/** Immutable once frozen: freezing an already frozen spec is a no-op, freezing an edited one is an error. */\nexport async function freezeSpec(file: string): Promise<FrozenSpecType> {\n  const spec = await loadSpec(file);\n  if (spec.status === 'frozen') return spec;\n  return { ...spec, status: 'frozen', sha256: specContentSha256(spec) };\n}\n"],"mappings":";;;;;;;;AA4DA,MAAM,WAAW,OAAO,SAAiD;CACvE,IAAI;EACF,MAAM,QAAiB,MAAM,MAAM,SAAS,MAAM,MAAM,CAAC;EACzD,OAAO,UAAU,KAAA,IAAY,KAAA,IAAa;CAC5C,SAAS,OAAO;EACd,IAAK,MAAgC,SAAS,UAAU,OAAO,KAAA;EAC/D,MAAM,IAAI,MACR,sCAAsC,KAAK,IAAI,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GACtG;CACF;AACF;AAEA,MAAM,SAAS,MAAiB,UAAgC;CAC9D,IACE,OAAO,SAAS,YAChB,SAAS,QACT,MAAM,QAAQ,IAAI,KAClB,OAAO,UAAU,YACjB,UAAU,QACV,MAAM,QAAQ,KAAK,GAEnB,OAAO,gBAAgB,KAAK;CAC9B,MAAM,SAAoC,gBAAgB,IAAI;CAC9D,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAkC,GAAG;EAC7E,MAAM,WAAW,OAAO;EACxB,OAAO,OAAO,aAAa,KAAA,IAAY,gBAAgB,KAAK,IAAI,MAAM,UAAU,KAAK;CACvF;CACA,OAAO;AACT;AAEA,MAAM,kBAAkB,OAAO,QAAiC;CAC9D,IAAI,UAAU,QAAQ,GAAG;CACzB,OAAO,MAAM;EACX,IAAI;GAEF,IAAI,MADgB,SAAS,KAAK,SAAS,YAAY,aAAa,CAAC,MACvD,KAAA,GAAW,OAAO;EAClC,QAAQ,CAER;EACA,MAAM,SAAS,QAAQ,OAAO;EAC9B,IAAI,WAAW,SAAS,OAAO,QAAQ,GAAG;EAC1C,UAAU;CACZ;AACF;AAEA,eAAsB,WAAW,SAAmD;CAClF,MAAM,cAAc,MAAM,gBAAgB,QAAQ,GAAG;CACrD,MAAM,UAAU,MAAM,SAAS,KAAK,aAAa,YAAY,aAAa,CAAC;CAC3E,MAAM,OAAO,MAAM,SAAS,KAAK,QAAQ,MAAM,YAAY,aAAa,CAAC;CACzE,MAAM,oBAAqB,MAAM,SAAS,KAAK,aAAa,YAAY,gBAAgB,CAAC,KAAM,EAAE,UAAU,CAAC,EAAE;CAE9G,IAAI,CADmB,QAAQ,SAAS,CAAC,CAAC,MAAM,iBAC9B,GAAG,MAAM,IAAI,MAAM,2EAA2E;CAChH,OAAO;EACL;EACA,QAAQ;GACN,UAAU;GACV,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK;GACrC,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ;GAC3C,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;EAChE;EACA,WAAW;CACb;AACF;AAEA,eAAsB,cAAc,QAAsB,SAAwD;CAChH,MAAM,SAAsB,CAAC,OAAO,OAAO,QAAgC;CAC3E,IAAI,OAAO,OAAO,SAAS,KAAA,GAAW,OAAO,KAAK,OAAO,OAAO,IAAI;CACpE,IAAI,OAAO,OAAO,YAAY,KAAA,GAAW,OAAO,KAAK,OAAO,OAAO,OAAO;CAC1E,IAAI,OAAO,OAAO,UAAU,KAAA,GAAW,OAAO,KAAK,OAAO,OAAO,KAAK;CACtE,MAAM,CAAC,UAAU,GAAG,aAAa;CACjC,IAAI,aAAa,KAAA,GAAW,MAAM,IAAI,MAAM,oDAAoD;CAChG,MAAM,SAAS,UAAU,OAAO,OAAO,QAAQ;CAC/C,IAAI,CAAC,QAAQ,aAAa,CAAC,CAAC,MAAM,MAAM,GACtC,MAAM,IAAI,MAAM,8EAA8E;CAChG,MAAM,SAAS;CACf,MAAM,UAAU,OAAO,OAAO;CAC9B,MAAM,eAAyB,CAAC;CAChC,IAAI,WAAW,OAAO,YAAY,YAAY,CAAC,MAAM,QAAQ,OAAO,GAClE,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAAG;EAClD,MAAM,UAAU,IAAI;EACpB,IAAI,UAAU,KAAA,GAAW,aAAa,KAAK,OAAO;CACpD;CAEF,MAAM,eAAe,UACnB,cAAc;EAAE,SAAS,WAAW,CAAC;EAAG,WAAW,OAAO;CAAkC,CAAC,CAC/F;CACA,MAAM,QACJ,aAAa,WAAW,IAAI,KAAA,IAAY,MAAM,QAAQ,WAAW,OAAO,QAAQ,cAAc,YAAY;CAC5G,IAAI,aAAa,SAAS,KAAK,CAAC,QAAQ,sBAAsB,UAAU,KAAA,GACtE,OAAO;EACL,QAAQ;EACR;EACA;EACA,MAAM,aAAa,KAAK,aAAa;GACnC;GACA,WACE,WAAW,OAAO,YAAY,YAAY,CAAC,MAAM,QAAQ,OAAO,IAC3D,QAAQ,QAAQ,MAAM,CAAC,MAAM,OAC9B;EACR,EAAE;CACJ;CACF,OAAO;EACL,QAAQ;EACR;EACA,QAAQ,UAAU,cAAc,MAA8B,CAAC;EAC/D,OAAO;GACL;GACA;GACA,WAAW,aAAa,WAAW,IAAI,gBAAgB,QAAQ,qBAAqB,aAAa;EACnG;EACA,UAAU,CAAC;CACb;AACF;AAEA,eAAsB,SAAS,MAAiC;CAC9D,MAAM,QAAQ,MAAM,SAAS,IAAI;CACjC,IAAI,UAAU,KAAA,KAAa,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,MAAM,IAAI,MAAM,iCAAiC,MAAM;CAC/G,MAAM,OAAO;CACb,IAAI,mBAAmB,IAAI,CAAC,CAAC,SAAS,GAAG,MAAM,IAAI,MAAM,gCAAgC,KAAK,GAAG,YAAY;CAC7G,OAAO;AACT;;AAGA,eAAsB,WAAW,MAAuC;CACtE,MAAM,OAAO,MAAM,SAAS,IAAI;CAChC,IAAI,KAAK,WAAW,UAAU,OAAO;CACrC,OAAO;EAAE,GAAG;EAAM,QAAQ;EAAU,QAAQ,kBAAkB,IAAI;CAAE;AACtE"}
+{"version":3,"file":"src-BnlNkd3S.mjs","names":[],"sources":["../../../../packages/config/src/load/index.ts"],"sourcesContent":["// Configuration loading and trust resolution (PLAN U2.09).\n\nimport { readFile } from 'node:fs/promises';\nimport { dirname, join, resolve } from 'node:path';\nimport { canonicalJson, type JsonValue, type Sha256, sha256Hex } from '@cohorte/base';\nimport { Compile } from 'typebox/compile';\nimport { parse } from 'yaml';\nimport {\n  CohorteConfig,\n  type CohorteConfig as CohorteConfigType,\n  DEFAULT_CONFIG,\n  type FrozenSpec as FrozenSpecType,\n  frozenSpecProblems,\n  Ownership,\n  type Ownership as OwnershipType,\n  Spec,\n  type Spec as SpecType,\n  specContentSha256,\n  type TrustStore,\n} from '../schema/index.ts';\n\nexport interface LoadConfigOptions {\n  /** any directory inside the project: the loader walks up to `.cohorte/` */\n  cwd: string;\n  /** the user's home: `~/.cohorte/config.yaml` is the user layer. Injected, never read from the environment here. */\n  home: string;\n  /** the CLI-flag layer, already shaped like a partial config document */\n  flags?: JsonValue;\n}\n\n/** The four layers of DESIGN 2.10, UNMERGED: shipped defaults < user file < project file < CLI flags. */\nexport interface LoadedConfig {\n  projectRoot: string;\n  layers: { defaults: CohorteConfig; user?: JsonValue; project?: JsonValue; flags?: JsonValue };\n  ownership: Ownership;\n}\n\nexport interface ResolveConfigOptions {\n  trustStore: TrustStore;\n  projectKeyId: string;\n  /** `--trust-project-config`: consent form `cli-flag` for every loosening key of the project file */\n  trustProjectConfig?: boolean;\n}\n\nexport interface ConfigTrust {\n  policySha256: Sha256;\n  loosenedKeys: string[];\n  grantedBy: 'none-needed' | 'user-config' | 'cli-flag' | 'trust-record';\n}\n\nexport type ResolvedConfig =\n  | { status: 'resolved'; config: CohorteConfig; sha256: Sha256; trust: ConfigTrust; warnings: string[] }\n  /** the caller fails closed with `security/project-policy-untrusted` */\n  | {\n      status: 'untrusted';\n      policySha256: Sha256;\n      loosenedKeys: string[];\n      diff: { pointer: string; trusted?: JsonValue; requested: JsonValue }[];\n    };\n\nconst readYaml = async (file: string): Promise<JsonValue | undefined> => {\n  try {\n    const value: unknown = parse(await readFile(file, 'utf8'));\n    return value === undefined ? undefined : (value as JsonValue);\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return undefined;\n    throw new Error(\n      `configuration/invalid: cannot read ${file}: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n};\n\nconst merge = (left: JsonValue, right: JsonValue): JsonValue => {\n  if (\n    typeof left !== 'object' ||\n    left === null ||\n    Array.isArray(left) ||\n    typeof right !== 'object' ||\n    right === null ||\n    Array.isArray(right)\n  )\n    return structuredClone(right);\n  const output: Record<string, JsonValue> = structuredClone(left);\n  for (const [key, value] of Object.entries(right as Record<string, JsonValue>)) {\n    const existing = output[key];\n    output[key] = existing === undefined ? structuredClone(value) : merge(existing, value);\n  }\n  return output;\n};\n\nconst findProjectRoot = async (cwd: string): Promise<string> => {\n  let current = resolve(cwd);\n  while (true) {\n    try {\n      const value = await readYaml(join(current, '.cohorte', 'config.yaml'));\n      if (value !== undefined) return current;\n    } catch {\n      /* continue to the parent so a malformed nested file is still reported by the selected root */\n    }\n    const parent = dirname(current);\n    if (parent === current) return resolve(cwd);\n    current = parent;\n  }\n};\n\nexport async function loadConfig(options: LoadConfigOptions): Promise<LoadedConfig> {\n  const projectRoot = await findProjectRoot(options.cwd);\n  const project = await readYaml(join(projectRoot, '.cohorte', 'config.yaml'));\n  const user = await readYaml(join(options.home, '.cohorte', 'config.yaml'));\n  const ownershipDocument = (await readYaml(join(projectRoot, '.cohorte', 'ownership.yaml'))) ?? { surfaces: {} };\n  const ownershipCheck = Compile(Ownership).Check(ownershipDocument);\n  if (!ownershipCheck) throw new Error('configuration/ownership-invalid: ownership.yaml does not match its schema');\n  return {\n    projectRoot,\n    layers: {\n      defaults: DEFAULT_CONFIG,\n      ...(user === undefined ? {} : { user }),\n      ...(project === undefined ? {} : { project }),\n      ...(options.flags === undefined ? {} : { flags: options.flags }),\n    },\n    ownership: ownershipDocument as OwnershipType,\n  };\n}\n\nexport async function resolveConfig(loaded: LoadedConfig, options: ResolveConfigOptions): Promise<ResolvedConfig> {\n  const layers: JsonValue[] = [loaded.layers.defaults as unknown as JsonValue];\n  if (loaded.layers.user !== undefined) layers.push(loaded.layers.user);\n  if (loaded.layers.project !== undefined) layers.push(loaded.layers.project);\n  if (loaded.layers.flags !== undefined) layers.push(loaded.layers.flags);\n  const [defaults, ...overrides] = layers;\n  if (defaults === undefined) throw new Error('configuration/policy-invalid: defaults are missing');\n  const merged = overrides.reduce(merge, defaults);\n  if (!Compile(CohorteConfig).Check(merged))\n    throw new Error('configuration/policy-invalid: merged configuration does not match its schema');\n  const config = merged as unknown as CohorteConfigType;\n  const project = loaded.layers.project;\n  const loosenedKeys: string[] = [];\n  if (project && typeof project === 'object' && !Array.isArray(project)) {\n    for (const [key, value] of Object.entries(project)) {\n      const pointer = `/${key}`;\n      if (value !== undefined) loosenedKeys.push(pointer);\n    }\n  }\n  const policySha256 = sha256Hex(\n    canonicalJson({ project: project ?? {}, ownership: loaded.ownership as unknown as JsonValue }),\n  );\n  const trust =\n    loosenedKeys.length === 0 ? undefined : await options.trustStore.lookup(options.projectKeyId, policySha256);\n  if (loosenedKeys.length > 0 && !options.trustProjectConfig && trust === undefined)\n    return {\n      status: 'untrusted',\n      policySha256,\n      loosenedKeys,\n      diff: loosenedKeys.map((pointer) => ({\n        pointer,\n        requested:\n          project && typeof project === 'object' && !Array.isArray(project)\n            ? (project[pointer.slice(1)] ?? null)\n            : null,\n      })),\n    };\n  return {\n    status: 'resolved',\n    config,\n    sha256: sha256Hex(canonicalJson(config as unknown as JsonValue)),\n    trust: {\n      policySha256,\n      loosenedKeys,\n      grantedBy: loosenedKeys.length === 0 ? 'none-needed' : options.trustProjectConfig ? 'cli-flag' : 'trust-record',\n    },\n    warnings: [],\n  };\n}\n\nexport async function loadSpec(file: string): Promise<SpecType> {\n  const value = await readYaml(file);\n  if (value === undefined || !Compile(Spec).Check(value)) throw new Error(`validation/spec: invalid spec ${file}`);\n  const spec = value as unknown as SpecType;\n  if (frozenSpecProblems(spec).length > 0) throw new Error(`validation/spec: frozen spec ${spec.id} was edited`);\n  return spec;\n}\n\n/** Immutable once frozen: freezing an already frozen spec is a no-op, freezing an edited one is an error. */\nexport async function freezeSpec(file: string): Promise<FrozenSpecType> {\n  const spec = await loadSpec(file);\n  if (spec.status === 'frozen') return spec;\n  return { ...spec, status: 'frozen', sha256: specContentSha256(spec) };\n}\n"],"mappings":";;;;;;;;AA4DA,MAAM,WAAW,OAAO,SAAiD;CACvE,IAAI;EACF,MAAM,QAAiB,MAAM,MAAM,SAAS,MAAM,MAAM,CAAC;EACzD,OAAO,UAAU,KAAA,IAAY,KAAA,IAAa;CAC5C,SAAS,OAAO;EACd,IAAK,MAAgC,SAAS,UAAU,OAAO,KAAA;EAC/D,MAAM,IAAI,MACR,sCAAsC,KAAK,IAAI,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GACtG;CACF;AACF;AAEA,MAAM,SAAS,MAAiB,UAAgC;CAC9D,IACE,OAAO,SAAS,YAChB,SAAS,QACT,MAAM,QAAQ,IAAI,KAClB,OAAO,UAAU,YACjB,UAAU,QACV,MAAM,QAAQ,KAAK,GAEnB,OAAO,gBAAgB,KAAK;CAC9B,MAAM,SAAoC,gBAAgB,IAAI;CAC9D,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAkC,GAAG;EAC7E,MAAM,WAAW,OAAO;EACxB,OAAO,OAAO,aAAa,KAAA,IAAY,gBAAgB,KAAK,IAAI,MAAM,UAAU,KAAK;CACvF;CACA,OAAO;AACT;AAEA,MAAM,kBAAkB,OAAO,QAAiC;CAC9D,IAAI,UAAU,QAAQ,GAAG;CACzB,OAAO,MAAM;EACX,IAAI;GAEF,IAAI,MADgB,SAAS,KAAK,SAAS,YAAY,aAAa,CAAC,MACvD,KAAA,GAAW,OAAO;EAClC,QAAQ,CAER;EACA,MAAM,SAAS,QAAQ,OAAO;EAC9B,IAAI,WAAW,SAAS,OAAO,QAAQ,GAAG;EAC1C,UAAU;CACZ;AACF;AAEA,eAAsB,WAAW,SAAmD;CAClF,MAAM,cAAc,MAAM,gBAAgB,QAAQ,GAAG;CACrD,MAAM,UAAU,MAAM,SAAS,KAAK,aAAa,YAAY,aAAa,CAAC;CAC3E,MAAM,OAAO,MAAM,SAAS,KAAK,QAAQ,MAAM,YAAY,aAAa,CAAC;CACzE,MAAM,oBAAqB,MAAM,SAAS,KAAK,aAAa,YAAY,gBAAgB,CAAC,KAAM,EAAE,UAAU,CAAC,EAAE;CAE9G,IAAI,CADmB,QAAQ,SAAS,CAAC,CAAC,MAAM,iBAC9B,GAAG,MAAM,IAAI,MAAM,2EAA2E;CAChH,OAAO;EACL;EACA,QAAQ;GACN,UAAU;GACV,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK;GACrC,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ;GAC3C,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;EAChE;EACA,WAAW;CACb;AACF;AAEA,eAAsB,cAAc,QAAsB,SAAwD;CAChH,MAAM,SAAsB,CAAC,OAAO,OAAO,QAAgC;CAC3E,IAAI,OAAO,OAAO,SAAS,KAAA,GAAW,OAAO,KAAK,OAAO,OAAO,IAAI;CACpE,IAAI,OAAO,OAAO,YAAY,KAAA,GAAW,OAAO,KAAK,OAAO,OAAO,OAAO;CAC1E,IAAI,OAAO,OAAO,UAAU,KAAA,GAAW,OAAO,KAAK,OAAO,OAAO,KAAK;CACtE,MAAM,CAAC,UAAU,GAAG,aAAa;CACjC,IAAI,aAAa,KAAA,GAAW,MAAM,IAAI,MAAM,oDAAoD;CAChG,MAAM,SAAS,UAAU,OAAO,OAAO,QAAQ;CAC/C,IAAI,CAAC,QAAQ,aAAa,CAAC,CAAC,MAAM,MAAM,GACtC,MAAM,IAAI,MAAM,8EAA8E;CAChG,MAAM,SAAS;CACf,MAAM,UAAU,OAAO,OAAO;CAC9B,MAAM,eAAyB,CAAC;CAChC,IAAI,WAAW,OAAO,YAAY,YAAY,CAAC,MAAM,QAAQ,OAAO,GAClE,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAAG;EAClD,MAAM,UAAU,IAAI;EACpB,IAAI,UAAU,KAAA,GAAW,aAAa,KAAK,OAAO;CACpD;CAEF,MAAM,eAAe,UACnB,cAAc;EAAE,SAAS,WAAW,CAAC;EAAG,WAAW,OAAO;CAAkC,CAAC,CAC/F;CACA,MAAM,QACJ,aAAa,WAAW,IAAI,KAAA,IAAY,MAAM,QAAQ,WAAW,OAAO,QAAQ,cAAc,YAAY;CAC5G,IAAI,aAAa,SAAS,KAAK,CAAC,QAAQ,sBAAsB,UAAU,KAAA,GACtE,OAAO;EACL,QAAQ;EACR;EACA;EACA,MAAM,aAAa,KAAK,aAAa;GACnC;GACA,WACE,WAAW,OAAO,YAAY,YAAY,CAAC,MAAM,QAAQ,OAAO,IAC3D,QAAQ,QAAQ,MAAM,CAAC,MAAM,OAC9B;EACR,EAAE;CACJ;CACF,OAAO;EACL,QAAQ;EACR;EACA,QAAQ,UAAU,cAAc,MAA8B,CAAC;EAC/D,OAAO;GACL;GACA;GACA,WAAW,aAAa,WAAW,IAAI,gBAAgB,QAAQ,qBAAqB,aAAa;EACnG;EACA,UAAU,CAAC;CACb;AACF;AAEA,eAAsB,SAAS,MAAiC;CAC9D,MAAM,QAAQ,MAAM,SAAS,IAAI;CACjC,IAAI,UAAU,KAAA,KAAa,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,MAAM,IAAI,MAAM,iCAAiC,MAAM;CAC/G,MAAM,OAAO;CACb,IAAI,mBAAmB,IAAI,CAAC,CAAC,SAAS,GAAG,MAAM,IAAI,MAAM,gCAAgC,KAAK,GAAG,YAAY;CAC7G,OAAO;AACT;;AAGA,eAAsB,WAAW,MAAuC;CACtE,MAAM,OAAO,MAAM,SAAS,IAAI;CAChC,IAAI,KAAK,WAAW,UAAU,OAAO;CACrC,OAAO;EAAE,GAAG;EAAM,QAAQ;EAAU,QAAQ,kBAAkB,IAAI;CAAE;AACtE"}

package/dist/chunks/{src-r0ECB1UJ.mjs → src-C7hs8Bjw.mjs}

@@ -1,6 +1,6 @@
 import { n as sha256Hex } from "./canonical-C8UxeEmB.mjs";
 import { B as ErrorInfo, O as ToolCallId, S as IsoInstant, T as Sha256, V as JsonValueSchema, d as ModelRef, h as ApprovalId, l as AuthMode, m as AgentId, n as QuotaInfo, p as ThinkingLevel, r as TokenUsage, w as RunId } from "./src-Cu3TxNob.mjs";
-import { c as CommandRule } from "./schema-C9QbUW4H.mjs";
+import { c as CommandRule } from "./schema-hSyIURjN.mjs";
 import { Type } from "typebox";
 import { execFile, spawn } from "node:child_process";
 import { readFile } from "node:fs/promises";
@@ -1686,4 +1686,4 @@ const SpawnRequest = Type.Object({
 //#endregion
 export { probeSandbox as _, RUNTIME_EVENT_TYPE_NAMES as a, toolGrantProblems as c, SandboxCapabilities as d, AGENT_GIT_DENIED_SUBCOMMANDS as f, createRedactor as g, isTrampoline as h, RUNTIME_EVENT_TYPES as i, AgentExit as l, PROTECTED_REPO_GLOBS as m, ProviderAuthStatus as n, ToolContent as o, DEFAULT_DENY_GLOBS as p, RuntimePin as r, ToolGrant as s, SpawnRequest as t, RuntimeCapabilities as u, createExecutor as v, createNoneBackend as y };
 
-//# sourceMappingURL=src-r0ECB1UJ.mjs.map
+//# sourceMappingURL=src-C7hs8Bjw.mjs.map