critical-gate 2.3.0 → 2.4.0

package/dist/cli/commands.js

@@ -0,0 +1,170 @@
+import { join } from "node:path";
+import { CRITICAL_GATE_CONFIG_FILE, buildApiSurfaceSnapshot, createDefaultPolicyConfig, getApiSnapshotOutputPath, getConfiguredPublicApiEntrypoints, initAgentInstructions, loadCriticalGateConfig, updateCriticalGateConfig } from "../index.js";
+import { parseFlagArgs, parseInitAgentArgs, parseInitPolicyArgs, parseInstallHooksArgs, parseSnapshotApiArgs } from "./args.js";
+import { renderGitHookScript } from "./git-hooks.js";
+import { ExitCode } from "./types.js";
+export function runSnapshotApiCommand(args, io) {
+    const parsed = parseSnapshotApiArgs(args);
+    if (!parsed.ok) {
+        io.stderr(parsed.error);
+        io.stderr("Run critical-gate snapshot-api --help for usage.");
+        return ExitCode.UsageError;
+    }
+    const root = io.readDiff().root;
+    const configResult = loadCriticalGateConfig(root, {
+        exists: io.exists,
+        readFile: io.readFile
+    });
+    const snapshot = buildApiSurfaceSnapshot({
+        root,
+        generatedAt: io.now(),
+        entrypoints: parsed.options.entrypoints,
+        policyEntrypoints: getConfiguredPublicApiEntrypoints(configResult.config),
+        reader: io
+    });
+    const outputPath = getApiSnapshotOutputPath(root, parsed.options.output);
+    io.writeFile(outputPath, `${JSON.stringify(snapshot, null, 2)}\n`);
+    io.stdout(`Wrote public API snapshot to ${outputPath} (${snapshot.exports.length} exports across ${snapshot.entrypoints.length} entrypoints).`);
+    return ExitCode.Pass;
+}
+export function runInstallHooksCommand(args, io) {
+    const parsed = parseInstallHooksArgs(args);
+    if (!parsed.ok) {
+        io.stderr(parsed.error);
+        io.stderr("Run critical-gate install-hooks --help for usage.");
+        return ExitCode.UsageError;
+    }
+    const root = io.readDiff().root;
+    const hooks = parsed.options.hook === "all" ? ["pre-commit", "pre-push"] : [parsed.options.hook];
+    const installed = [];
+    for (const hook of hooks) {
+        const path = join(root, ".git", "hooks", hook);
+        if (io.exists?.(path) === true && parsed.options.force !== true) {
+            io.stderr(`Refusing to overwrite existing ${hook} hook at ${path}. Re-run with --force.`);
+            return ExitCode.UsageError;
+        }
+        io.writeFile(path, renderGitHookScript(hook, parsed.options.cli));
+        io.chmodFile?.(path, 0o755);
+        installed.push(path);
+    }
+    io.stdout(`Installed Critical Gate hook(s): ${installed.join(", ")}`);
+    return ExitCode.Pass;
+}
+export function runInitPolicyCommand(args, io) {
+    const parsed = parseInitPolicyArgs(args);
+    if (!parsed.ok) {
+        io.stderr(parsed.error);
+        io.stderr("Run critical-gate init-policy --help for usage.");
+        return ExitCode.UsageError;
+    }
+    const root = io.readDiff().root;
+    const path = join(root, CRITICAL_GATE_CONFIG_FILE);
+    if (io.exists?.(path) === true && parsed.options.force !== true) {
+        io.stderr(`Refusing to overwrite existing ${CRITICAL_GATE_CONFIG_FILE}. Re-run with --force.`);
+        return ExitCode.UsageError;
+    }
+    io.writeFile(path, `${JSON.stringify(createDefaultPolicyConfig(io.now()), null, 2)}\n`);
+    io.stdout(`Wrote reviewable Critical Gate policy to ${path}.`);
+    return ExitCode.Pass;
+}
+export function runInitAgentCommand(args, io) {
+    const parsed = parseInitAgentArgs(args);
+    if (!parsed.ok) {
+        io.stderr(parsed.error);
+        io.stderr("Run critical-gate init-agent --help for usage.");
+        return ExitCode.UsageError;
+    }
+    const root = io.readDiff().root;
+    const result = initAgentInstructions({
+        root,
+        cliCommand: parsed.options.cli,
+        io
+    });
+    if (result.updated) {
+        io.stdout(`${result.created ? "Created" : "Updated"} ${result.path} with Critical Gate agent instructions.`);
+    }
+    else {
+        io.stdout(`${result.path} already contains the current Critical Gate agent instructions.`);
+    }
+    return ExitCode.Pass;
+}
+export function runAcceptCommand(args, io) {
+    const parsed = parseFlagArgs(args, ["--finding", "--reason"]);
+    if (!parsed.ok) {
+        io.stderr(parsed.error);
+        io.stderr("Run critical-gate accept --help for usage.");
+        return ExitCode.UsageError;
+    }
+    const finding = parsed.values["--finding"];
+    const reason = parsed.values["--reason"];
+    if (finding === undefined || reason === undefined) {
+        io.stderr("Missing required --finding or --reason value.");
+        io.stderr("Run critical-gate accept --help for usage.");
+        return ExitCode.UsageError;
+    }
+    const root = io.readDiff().root;
+    const updated = updateCriticalGateConfig(root, (config) => ({
+        ...config,
+        learning: {
+            ...config.learning,
+            acceptedFindings: upsertById(config.learning?.acceptedFindings ?? [], {
+                id: finding,
+                reason,
+                createdAt: io.now().toISOString()
+            })
+        }
+    }), {
+        exists: io.exists,
+        readFile: io.readFile,
+        writeFile: io.writeFile
+    });
+    io.stdout(`Accepted finding ${finding} in ${CRITICAL_GATE_CONFIG_FILE} (${updated.learning?.acceptedFindings?.length ?? 0} accepted finding rules).`);
+    return ExitCode.Pass;
+}
+export function runTeachCommand(args, io) {
+    const parsed = parseFlagArgs(args, ["--id", "--when-changed", "--allow", "--reason"]);
+    if (!parsed.ok) {
+        io.stderr(parsed.error);
+        io.stderr("Run critical-gate teach --help for usage.");
+        return ExitCode.UsageError;
+    }
+    const id = parsed.values["--id"];
+    const whenChanged = parsed.values["--when-changed"];
+    const allow = parsed.values["--allow"]
+        ?.split(",")
+        .map((entry) => entry.trim())
+        .filter(Boolean);
+    const reason = parsed.values["--reason"];
+    if (id === undefined ||
+        whenChanged === undefined ||
+        allow === undefined ||
+        reason === undefined) {
+        io.stderr("Missing required --id, --when-changed, --allow, or --reason value.");
+        io.stderr("Run critical-gate teach --help for usage.");
+        return ExitCode.UsageError;
+    }
+    const root = io.readDiff().root;
+    const updated = updateCriticalGateConfig(root, (config) => ({
+        ...config,
+        learning: {
+            ...config.learning,
+            expectedSupportFiles: upsertById(config.learning?.expectedSupportFiles ?? [], {
+                id,
+                whenChanged,
+                allow,
+                reason,
+                createdAt: io.now().toISOString()
+            })
+        }
+    }), {
+        exists: io.exists,
+        readFile: io.readFile,
+        writeFile: io.writeFile
+    });
+    io.stdout(`Taught expected support rule ${id} in ${CRITICAL_GATE_CONFIG_FILE} (${updated.learning?.expectedSupportFiles?.length ?? 0} support rules).`);
+    return ExitCode.Pass;
+}
+function upsertById(entries, next) {
+    return [...entries.filter((entry) => entry.id !== next.id), next];
+}
+//# sourceMappingURL=commands.js.map

package/dist/cli/commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../src/cli/commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,yBAAyB,EACzB,wBAAwB,EACxB,iCAAiC,EACjC,qBAAqB,EACrB,sBAAsB,EACtB,wBAAwB,EACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAc,MAAM,YAAY,CAAC;AAElD,MAAM,UAAU,qBAAqB,CAAC,IAAc,EAAE,EAAS;IAC7D,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAE1C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,EAAE,CAAC,MAAM,CAAC,kDAAkD,CAAC,CAAC;QAC9D,OAAO,QAAQ,CAAC,UAAU,CAAC;IAC7B,CAAC;IAED,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC;IAChC,MAAM,YAAY,GAAG,sBAAsB,CAAC,IAAI,EAAE;QAChD,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,QAAQ,EAAE,EAAE,CAAC,QAAQ;KACtB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,uBAAuB,CAAC;QACvC,IAAI;QACJ,WAAW,EAAE,EAAE,CAAC,GAAG,EAAE;QACrB,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW;QACvC,iBAAiB,EAAE,iCAAiC,CAAC,YAAY,CAAC,MAAM,CAAC;QACzE,MAAM,EAAE,EAAE;KACX,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAEzE,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACnE,EAAE,CAAC,MAAM,CACP,gCAAgC,UAAU,KAAK,QAAQ,CAAC,OAAO,CAAC,MAAM,mBAAmB,QAAQ,CAAC,WAAW,CAAC,MAAM,gBAAgB,CACrI,CAAC;IAEF,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAc,EAAE,EAAS;IAC9D,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAE3C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,EAAE,CAAC,MAAM,CAAC,mDAAmD,CAAC,CAAC;QAC/D,OAAO,QAAQ,CAAC,UAAU,CAAC;IAC7B,CAAC;IAED,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC;IAChC,MAAM,KAAK,GACT,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrF,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAE/C,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YAChE,EAAE,CAAC,MAAM,CAAC,kCAAkC,IAAI,YAAY,IAAI,wBAAwB,CAAC,CAAC;YAC1F,OAAO,QAAQ,CAAC,UAAU,CAAC;QAC7B,CAAC;QAED,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAClE,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC5B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED,EAAE,CAAC,MAAM,CAAC,oCAAoC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEtE,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAc,EAAE,EAAS;IAC5D,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAEzC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,EAAE,CAAC,MAAM,CAAC,iDAAiD,CAAC,CAAC;QAC7D,OAAO,QAAQ,CAAC,UAAU,CAAC;IAC7B,CAAC;IAED,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC;IAEnD,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QAChE,EAAE,CAAC,MAAM,CAAC,kCAAkC,yBAAyB,wBAAwB,CAAC,CAAC;QAC/F,OAAO,QAAQ,CAAC,UAAU,CAAC;IAC7B,CAAC;IAED,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,yBAAyB,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACxF,EAAE,CAAC,MAAM,CAAC,4CAA4C,IAAI,GAAG,CAAC,CAAC;IAE/D,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAc,EAAE,EAAS;IAC3D,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAExC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,EAAE,CAAC,MAAM,CAAC,gDAAgD,CAAC,CAAC;QAC5D,OAAO,QAAQ,CAAC,UAAU,CAAC;IAC7B,CAAC;IAED,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC;IAChC,MAAM,MAAM,GAAG,qBAAqB,CAAC;QACnC,IAAI;QACJ,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG;QAC9B,EAAE;KACH,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,EAAE,CAAC,MAAM,CACP,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,yCAAyC,CAClG,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,iEAAiE,CAAC,CAAC;IAC7F,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAc,EAAE,EAAS;IACxD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;IAE9D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,EAAE,CAAC,MAAM,CAAC,4CAA4C,CAAC,CAAC;QACxD,OAAO,QAAQ,CAAC,UAAU,CAAC;IAC7B,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAEzC,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAClD,EAAE,CAAC,MAAM,CAAC,+CAA+C,CAAC,CAAC;QAC3D,EAAE,CAAC,MAAM,CAAC,4CAA4C,CAAC,CAAC;QACxD,OAAO,QAAQ,CAAC,UAAU,CAAC;IAC7B,CAAC;IAED,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC;IAChC,MAAM,OAAO,GAAG,wBAAwB,CACtC,IAAI,EACJ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACX,GAAG,MAAM;QACT,QAAQ,EAAE;YACR,GAAG,MAAM,CAAC,QAAQ;YAClB,gBAAgB,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,IAAI,EAAE,EAAE;gBACpE,EAAE,EAAE,OAAO;gBACX,MAAM;gBACN,SAAS,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;aAClC,CAAC;SACH;KACF,CAAC,EACF;QACE,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,QAAQ,EAAE,EAAE,CAAC,QAAQ;QACrB,SAAS,EAAE,EAAE,CAAC,SAAS;KACxB,CACF,CAAC;IAEF,EAAE,CAAC,MAAM,CACP,oBAAoB,OAAO,OAAO,yBAAyB,KAAK,OAAO,CAAC,QAAQ,EAAE,gBAAgB,EAAE,MAAM,IAAI,CAAC,2BAA2B,CAC3I,CAAC;IAEF,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAc,EAAE,EAAS;IACvD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;IAEtF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,EAAE,CAAC,MAAM,CAAC,2CAA2C,CAAC,CAAC;QACvD,OAAO,QAAQ,CAAC,UAAU,CAAC;IAC7B,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;QACpC,EAAE,KAAK,CAAC,GAAG,CAAC;SACX,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAEzC,IACE,EAAE,KAAK,SAAS;QAChB,WAAW,KAAK,SAAS;QACzB,KAAK,KAAK,SAAS;QACnB,MAAM,KAAK,SAAS,EACpB,CAAC;QACD,EAAE,CAAC,MAAM,CAAC,oEAAoE,CAAC,CAAC;QAChF,EAAE,CAAC,MAAM,CAAC,2CAA2C,CAAC,CAAC;QACvD,OAAO,QAAQ,CAAC,UAAU,CAAC;IAC7B,CAAC;IAED,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC;IAChC,MAAM,OAAO,GAAG,wBAAwB,CACtC,IAAI,EACJ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACX,GAAG,MAAM;QACT,QAAQ,EAAE;YACR,GAAG,MAAM,CAAC,QAAQ;YAClB,oBAAoB,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,oBAAoB,IAAI,EAAE,EAAE;gBAC5E,EAAE;gBACF,WAAW;gBACX,KAAK;gBACL,MAAM;gBACN,SAAS,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;aAClC,CAAC;SACH;KACF,CAAC,EACF;QACE,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,QAAQ,EAAE,EAAE,CAAC,QAAQ;QACrB,SAAS,EAAE,EAAE,CAAC,SAAS;KACxB,CACF,CAAC;IAEF,EAAE,CAAC,MAAM,CACP,gCAAgC,EAAE,OAAO,yBAAyB,KAAK,OAAO,CAAC,QAAQ,EAAE,oBAAoB,EAAE,MAAM,IAAI,CAAC,kBAAkB,CAC7I,CAAC;IAEF,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,SAAS,UAAU,CAA2B,OAAY,EAAE,IAAO;IACjE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;AACpE,CAAC"}

package/dist/cli/entrypoint.d.ts

@@ -0,0 +1,2 @@
+export declare function isCliEntrypoint(importMetaUrl: string, argvPath?: string): boolean;
+//# sourceMappingURL=entrypoint.d.ts.map

package/dist/cli/entrypoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entrypoint.d.ts","sourceRoot":"","sources":["../../src/cli/entrypoint.ts"],"names":[],"mappings":"AAIA,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,SAAkB,GAAG,OAAO,CAK1F"}

package/dist/cli/entrypoint.js

@@ -0,0 +1,18 @@
+import { realpathSync } from "node:fs";
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+export function isCliEntrypoint(importMetaUrl, argvPath = process.argv[1]) {
+    return (argvPath !== undefined &&
+        normalizeExecutablePath(fileURLToPath(importMetaUrl)) === normalizeExecutablePath(argvPath));
+}
+function normalizeExecutablePath(path) {
+    let normalized = resolve(path);
+    try {
+        normalized = realpathSync.native(normalized);
+    }
+    catch {
+        // Fall back to the resolved path when the target is virtual or has already been removed.
+    }
+    return process.platform === "win32" ? normalized.toLowerCase() : normalized;
+}
+//# sourceMappingURL=entrypoint.js.map

package/dist/cli/entrypoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entrypoint.js","sourceRoot":"","sources":["../../src/cli/entrypoint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,UAAU,eAAe,CAAC,aAAqB,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/E,OAAO,CACL,QAAQ,KAAK,SAAS;QACtB,uBAAuB,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,KAAK,uBAAuB,CAAC,QAAQ,CAAC,CAC5F,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAY;IAC3C,IAAI,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/B,IAAI,CAAC;QACH,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,yFAAyF;IAC3F,CAAC;IAED,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;AAC9E,CAAC"}

package/dist/cli/git-hooks.d.ts

@@ -0,0 +1,2 @@
+export declare function renderGitHookScript(hook: "pre-commit" | "pre-push", cliCommand: string): string;
+//# sourceMappingURL=git-hooks.d.ts.map

package/dist/cli/git-hooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-hooks.d.ts","sourceRoot":"","sources":["../../src/cli/git-hooks.ts"],"names":[],"mappings":"AAAA,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,YAAY,GAAG,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAyB/F"}

package/dist/cli/git-hooks.js

@@ -0,0 +1,31 @@
+export function renderGitHookScript(hook, cliCommand) {
+    const quotedCli = shellQuote(cliCommand);
+    if (hook === "pre-commit") {
+        return [
+            "#!/bin/sh",
+            "# Critical Gate pre-commit hook.",
+            "# Generated by `critical-gate install-hooks`; review before trusting.",
+            "set -eu",
+            'TASK="${CRITICAL_GATE_TASK:-Pre-commit staged change}"',
+            `${quotedCli} check --staged --task "$TASK" --format repair --fail-on blocker`,
+            ""
+        ].join("\n");
+    }
+    return [
+        "#!/bin/sh",
+        "# Critical Gate pre-push hook.",
+        "# Generated by `critical-gate install-hooks`; review before trusting.",
+        "set -eu",
+        'TASK="${CRITICAL_GATE_TASK:-Pre-push branch change}"',
+        'BASE="${CRITICAL_GATE_BASE:-origin/main}"',
+        `${quotedCli} check --base "$BASE" --task "$TASK" --format repair --fail-on high`,
+        ""
+    ].join("\n");
+}
+function shellQuote(value) {
+    if (/^[A-Za-z0-9_./:-]+$/.test(value)) {
+        return value;
+    }
+    return `'${value.replaceAll("'", "'\\''")}'`;
+}
+//# sourceMappingURL=git-hooks.js.map

package/dist/cli/git-hooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-hooks.js","sourceRoot":"","sources":["../../src/cli/git-hooks.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,mBAAmB,CAAC,IAA+B,EAAE,UAAkB;IACrF,MAAM,SAAS,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IAEzC,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,OAAO;YACL,WAAW;YACX,kCAAkC;YAClC,uEAAuE;YACvE,SAAS;YACT,wDAAwD;YACxD,GAAG,SAAS,kEAAkE;YAC9E,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IAED,OAAO;QACL,WAAW;QACX,gCAAgC;QAChC,uEAAuE;QACvE,SAAS;QACT,sDAAsD;QACtD,2CAA2C;QAC3C,GAAG,SAAS,qEAAqE;QACjF,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC;AAC/C,CAAC"}

package/dist/cli/help.d.ts

@@ -0,0 +1,4 @@
+export type CommandName = "check" | "hook" | "accept" | "teach" | "snapshot-api" | "install-hooks" | "init-policy" | "init-agent";
+export declare function getHelpText(): string;
+export declare function getCommandHelpText(command: CommandName): string;
+//# sourceMappingURL=help.d.ts.map

package/dist/cli/help.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"help.d.ts","sourceRoot":"","sources":["../../src/cli/help.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,WAAW,GACnB,OAAO,GACP,MAAM,GACN,QAAQ,GACR,OAAO,GACP,cAAc,GACd,eAAe,GACf,aAAa,GACb,YAAY,CAAC;AAEjB,wBAAgB,WAAW,IAAI,MAAM,CAiBpC;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CA8B/D"}

package/dist/cli/help.js

@@ -0,0 +1,151 @@
+import { CRITICAL_GATE_CONFIG_FILE } from "../config/index.js";
+export function getHelpText() {
+    return [
+        "critical-gate",
+        "",
+        "Usage:",
+        "  critical-gate check --task <text> [--base <ref>] [--format json|markdown|sarif|repair|pr-comment] [--strict] [--output <path>]",
+        "  critical-gate hook [--task <text>] [--base <ref>] [--output <path>]",
+        "  critical-gate accept --finding <id> --reason <text>",
+        "  critical-gate teach --id <id> --when-changed <glob> --allow <glob[,glob]> --reason <text>",
+        "  critical-gate snapshot-api [--entrypoint <path>] [--output <path>]",
+        "  critical-gate install-hooks [--hook pre-commit|pre-push|all] [--cli <command>] [--force]",
+        "  critical-gate init-policy [--force]",
+        "  critical-gate init-agent [--cli <command>]",
+        "  critical-gate --version",
+        "  critical-gate --help",
+        ""
+    ].join("\n");
+}
+export function getCommandHelpText(command) {
+    if (command === "hook") {
+        return getHookHelpText();
+    }
+    if (command === "accept") {
+        return getAcceptHelpText();
+    }
+    if (command === "teach") {
+        return getTeachHelpText();
+    }
+    if (command === "snapshot-api") {
+        return getSnapshotApiHelpText();
+    }
+    if (command === "install-hooks") {
+        return getInstallHooksHelpText();
+    }
+    if (command === "init-policy") {
+        return getInitPolicyHelpText();
+    }
+    if (command === "init-agent") {
+        return getInitAgentHelpText();
+    }
+    return getCheckHelpText();
+}
+function getCheckHelpText() {
+    return [
+        "critical-gate check",
+        "",
+        "Required:",
+        "  --task <text>       Task intent, issue summary, or prompt",
+        "",
+        "Options:",
+        "  --base <ref>        Git baseline reference",
+        "  --format <format>   json, markdown, sarif, repair, or pr-comment",
+        "  --fail-on <level>   blocker, high, or medium; defaults to high",
+        "  --staged            Analyze staged changes with git diff --cached",
+        "  --strict            Fail on strict-mode findings once detectors exist",
+        "  --output <path>     Write report to a file instead of stdout",
+        ""
+    ].join("\n");
+}
+function getHookHelpText() {
+    return [
+        "critical-gate hook",
+        "",
+        "Options:",
+        "  --task <text>       Optional task intent; defaults to Codex completed feature implementation",
+        "  --base <ref>        Git baseline reference",
+        "  --output <path>     Write compact repair report to a file instead of stdout",
+        ""
+    ].join("\n");
+}
+function getAcceptHelpText() {
+    return [
+        "critical-gate accept",
+        "",
+        "Records an explicit accepted finding in .critical-gate.json.",
+        "",
+        "Required:",
+        "  --finding <id>     Exact finding id to accept",
+        "  --reason <text>    Reviewable reason for accepting the finding",
+        ""
+    ].join("\n");
+}
+function getTeachHelpText() {
+    return [
+        "critical-gate teach",
+        "",
+        "Records a repository-specific expected support-file rule in .critical-gate.json.",
+        "",
+        "Required:",
+        "  --id <id>                 Stable rule id",
+        "  --when-changed <glob>     Changed file glob that activates the rule",
+        "  --allow <glob[,glob]>     Support-file glob or comma-separated globs to allow",
+        "  --reason <text>           Reviewable reason for the rule",
+        ""
+    ].join("\n");
+}
+function getSnapshotApiHelpText() {
+    return [
+        "critical-gate snapshot-api",
+        "",
+        "Generates a reviewable public API surface snapshot.",
+        "",
+        "Options:",
+        "  --entrypoint <path>  Public entrypoint to snapshot; may be passed more than once",
+        "  --output <path>      Snapshot path; defaults to .critical-gate/api-surface.json",
+        ""
+    ].join("\n");
+}
+function getInstallHooksHelpText() {
+    return [
+        "critical-gate install-hooks",
+        "",
+        "Installs reviewable local git hooks.",
+        "",
+        "Options:",
+        "  --hook <hook>       pre-commit, pre-push, or all; defaults to all",
+        "  --cli <command>     Critical Gate command/path used by the hook; defaults to critical-gate",
+        "  --force             Overwrite an existing generated or custom hook",
+        "",
+        "Defaults:",
+        "  pre-commit runs staged changes with --fail-on blocker.",
+        "  pre-push runs branch changes against ${CRITICAL_GATE_BASE:-origin/main} with --fail-on high.",
+        ""
+    ].join("\n");
+}
+function getInitPolicyHelpText() {
+    return [
+        "critical-gate init-policy",
+        "",
+        `Writes a starter ${CRITICAL_GATE_CONFIG_FILE} policy file.`,
+        "",
+        "Options:",
+        "  --force             Overwrite an existing policy file",
+        ""
+    ].join("\n");
+}
+function getInitAgentHelpText() {
+    return [
+        "critical-gate init-agent",
+        "",
+        "Creates or updates the managed Critical Gate section in AGENTS.md.",
+        "",
+        "Options:",
+        "  --cli <command>     Critical Gate command/path agents should run; defaults to npx critical-gate",
+        "",
+        "The command preserves existing AGENTS.md content and replaces only the managed Critical Gate block.",
+        ""
+    ].join("\n");
+}
+//# sourceMappingURL=help.js.map

package/dist/cli/help.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"help.js","sourceRoot":"","sources":["../../src/cli/help.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAY/D,MAAM,UAAU,WAAW;IACzB,OAAO;QACL,eAAe;QACf,EAAE;QACF,QAAQ;QACR,kIAAkI;QAClI,uEAAuE;QACvE,uDAAuD;QACvD,6FAA6F;QAC7F,sEAAsE;QACtE,4FAA4F;QAC5F,uCAAuC;QACvC,8CAA8C;QAC9C,2BAA2B;QAC3B,wBAAwB;QACxB,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAoB;IACrD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,eAAe,EAAE,CAAC;IAC3B,CAAC;IAED,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAO,iBAAiB,EAAE,CAAC;IAC7B,CAAC;IAED,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,gBAAgB,EAAE,CAAC;IAC5B,CAAC;IAED,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;QAC/B,OAAO,sBAAsB,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;QAChC,OAAO,uBAAuB,EAAE,CAAC;IACnC,CAAC;IAED,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;QAC9B,OAAO,qBAAqB,EAAE,CAAC;IACjC,CAAC;IAED,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;QAC7B,OAAO,oBAAoB,EAAE,CAAC;IAChC,CAAC;IAED,OAAO,gBAAgB,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO;QACL,qBAAqB;QACrB,EAAE;QACF,WAAW;QACX,6DAA6D;QAC7D,EAAE;QACF,UAAU;QACV,8CAA8C;QAC9C,oEAAoE;QACpE,kEAAkE;QAClE,qEAAqE;QACrE,yEAAyE;QACzE,gEAAgE;QAChE,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,eAAe;IACtB,OAAO;QACL,oBAAoB;QACpB,EAAE;QACF,UAAU;QACV,gGAAgG;QAChG,8CAA8C;QAC9C,+EAA+E;QAC/E,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO;QACL,sBAAsB;QACtB,EAAE;QACF,8DAA8D;QAC9D,EAAE;QACF,WAAW;QACX,iDAAiD;QACjD,kEAAkE;QAClE,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO;QACL,qBAAqB;QACrB,EAAE;QACF,kFAAkF;QAClF,EAAE;QACF,WAAW;QACX,4CAA4C;QAC5C,uEAAuE;QACvE,iFAAiF;QACjF,4DAA4D;QAC5D,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,sBAAsB;IAC7B,OAAO;QACL,4BAA4B;QAC5B,EAAE;QACF,qDAAqD;QACrD,EAAE;QACF,UAAU;QACV,oFAAoF;QACpF,mFAAmF;QACnF,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO;QACL,6BAA6B;QAC7B,EAAE;QACF,sCAAsC;QACtC,EAAE;QACF,UAAU;QACV,qEAAqE;QACrE,8FAA8F;QAC9F,sEAAsE;QACtE,EAAE;QACF,WAAW;QACX,0DAA0D;QAC1D,gGAAgG;QAChG,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB;IAC5B,OAAO;QACL,2BAA2B;QAC3B,EAAE;QACF,oBAAoB,yBAAyB,eAAe;QAC5D,EAAE;QACF,UAAU;QACV,yDAAyD;QACzD,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB;IAC3B,OAAO;QACL,0BAA0B;QAC1B,EAAE;QACF,oEAAoE;QACpE,EAAE;QACF,UAAU;QACV,mGAAmG;QACnG,EAAE;QACF,qGAAqG;QACrG,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/cli/io.d.ts

@@ -0,0 +1,3 @@
+import type { CliIo } from "./types.js";
+export declare const defaultIo: CliIo;
+//# sourceMappingURL=io.d.ts.map

package/dist/cli/io.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"io.d.ts","sourceRoot":"","sources":["../../src/cli/io.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAExC,eAAO,MAAM,SAAS,EAAE,KAYvB,CAAC"}

package/dist/cli/io.js

@@ -0,0 +1,16 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { getApiSnapshotOutputDirectory, readGitDiff } from "../index.js";
+export const defaultIo = {
+    stdout: (message) => console.log(message),
+    stderr: (message) => console.error(message),
+    writeFile: (path, content) => {
+        mkdirSync(getApiSnapshotOutputDirectory(path), { recursive: true });
+        writeFileSync(path, content, "utf8");
+    },
+    now: () => new Date(),
+    exists: (path) => existsSync(path),
+    readFile: (path) => readFileSync(path, "utf8"),
+    chmodFile: (path, mode) => chmodSync(path, mode),
+    readDiff: (baseRef, options) => readGitDiff({ baseRef, staged: options?.staged })
+};
+//# sourceMappingURL=io.js.map

package/dist/cli/io.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"io.js","sourceRoot":"","sources":["../../src/cli/io.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAExF,OAAO,EAAE,6BAA6B,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAGzE,MAAM,CAAC,MAAM,SAAS,GAAU;IAC9B,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;IACzC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;IAC3C,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;QAC3B,SAAS,CAAC,6BAA6B,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IACD,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;IACrB,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;IAClC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;IAC9C,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC;IAChD,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;CAClF,CAAC"}

package/dist/cli/main.d.ts

@@ -0,0 +1,4 @@
+import { ExitCode, type CliIo } from "./types.js";
+export declare const CLI_VERSION = "2.4.0";
+export declare function main(argv?: string[], io?: CliIo): ExitCode;
+//# sourceMappingURL=main.d.ts.map

package/dist/cli/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,QAAQ,EAAE,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAElD,eAAO,MAAM,WAAW,UAAwB,CAAC;AAEjD,wBAAgB,IAAI,CAAC,IAAI,WAAwB,EAAE,EAAE,QAAY,GAAG,QAAQ,CAQ3E"}

package/dist/cli/main.js

@@ -0,0 +1,76 @@
+import { renderReport } from "../index.js";
+import { CRITICAL_GATE_VERSION } from "../version.js";
+import { parseCheckArgs, isCommandName } from "./args.js";
+import { runAcceptCommand, runInitAgentCommand, runInitPolicyCommand, runInstallHooksCommand, runSnapshotApiCommand, runTeachCommand } from "./commands.js";
+import { getCommandHelpText, getHelpText } from "./help.js";
+import { defaultIo } from "./io.js";
+import { createGateResult } from "./result.js";
+import { ExitCode } from "./types.js";
+export const CLI_VERSION = CRITICAL_GATE_VERSION;
+export function main(argv = process.argv.slice(2), io = defaultIo) {
+    try {
+        return runCli(argv, io);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : "Unknown internal error";
+        io.stderr(`critical-gate: ${message}`);
+        return ExitCode.InternalError;
+    }
+}
+function runCli(argv, io) {
+    if (argv.includes("--version")) {
+        io.stdout(`critical-gate ${CLI_VERSION}`);
+        return ExitCode.Pass;
+    }
+    if (argv[0] === "--help" || argv[0] === "-h") {
+        io.stdout(getHelpText());
+        return ExitCode.Pass;
+    }
+    const [command = "check", ...args] = argv;
+    if (!isCommandName(command)) {
+        io.stderr(`Unknown command: ${command}`);
+        io.stderr("Run critical-gate --help for usage.");
+        return ExitCode.UsageError;
+    }
+    if (args.includes("--help") || args.includes("-h")) {
+        io.stdout(getCommandHelpText(command));
+        return ExitCode.Pass;
+    }
+    if (command === "accept") {
+        return runAcceptCommand(args, io);
+    }
+    if (command === "teach") {
+        return runTeachCommand(args, io);
+    }
+    if (command === "snapshot-api") {
+        return runSnapshotApiCommand(args, io);
+    }
+    if (command === "install-hooks") {
+        return runInstallHooksCommand(args, io);
+    }
+    if (command === "init-policy") {
+        return runInitPolicyCommand(args, io);
+    }
+    if (command === "init-agent") {
+        return runInitAgentCommand(args, io);
+    }
+    const parsed = parseCheckArgs(args, command);
+    if (!parsed.ok) {
+        io.stderr(parsed.error);
+        io.stderr("Run critical-gate check --help for usage.");
+        return ExitCode.UsageError;
+    }
+    const diff = io.readDiff(parsed.options.base, { staged: parsed.options.staged });
+    const result = createGateResult(parsed.options, io.now(), diff, io);
+    const rendered = command === "hook"
+        ? renderReport(result.summary.decision === "pass" ? { ...result, findings: [] } : result, "repair")
+        : renderReport(result, parsed.options.format);
+    if (parsed.options.output !== undefined) {
+        io.writeFile(parsed.options.output, rendered);
+    }
+    else {
+        io.stdout(rendered);
+    }
+    return result.summary.decision === "fail" ? ExitCode.FindingsFailed : ExitCode.Pass;
+}
+//# sourceMappingURL=main.js.map

package/dist/cli/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,EACrB,eAAe,EAChB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAc,MAAM,YAAY,CAAC;AAElD,MAAM,CAAC,MAAM,WAAW,GAAG,qBAAqB,CAAC;AAEjD,MAAM,UAAU,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,SAAS;IAC/D,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC;QAClF,EAAE,CAAC,MAAM,CAAC,kBAAkB,OAAO,EAAE,CAAC,CAAC;QACvC,OAAO,QAAQ,CAAC,aAAa,CAAC;IAChC,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,IAAc,EAAE,EAAS;IACvC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,EAAE,CAAC,MAAM,CAAC,iBAAiB,WAAW,EAAE,CAAC,CAAC;QAC1C,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7C,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QACzB,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,MAAM,CAAC,OAAO,GAAG,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAE1C,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,EAAE,CAAC,MAAM,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;QACzC,EAAE,CAAC,MAAM,CAAC,qCAAqC,CAAC,CAAC;QACjD,OAAO,QAAQ,CAAC,UAAU,CAAC;IAC7B,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;QACvC,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAO,gBAAgB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;QAC/B,OAAO,qBAAqB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;QAChC,OAAO,sBAAsB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;QAC9B,OAAO,oBAAoB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;QAC7B,OAAO,mBAAmB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAE7C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,EAAE,CAAC,MAAM,CAAC,2CAA2C,CAAC,CAAC;QACvD,OAAO,QAAQ,CAAC,UAAU,CAAC;IAC7B,CAAC;IAED,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACjF,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACpE,MAAM,QAAQ,GACZ,OAAO,KAAK,MAAM;QAChB,CAAC,CAAC,YAAY,CACV,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EACzE,QAAQ,CACT;QACH,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAElD,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACxC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAChD,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;AACtF,CAAC"}

package/dist/cli/result.d.ts

@@ -0,0 +1,4 @@
+import { type GateResult, type GitDiffResult } from "../index.js";
+import type { CheckOptions, CliIo } from "./types.js";
+export declare function createGateResult(options: CheckOptions, generatedAt: Date, diffResult: GitDiffResult, io?: Pick<CliIo, "exists" | "readFile">): GateResult;
+//# sourceMappingURL=result.d.ts.map

package/dist/cli/result.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"result.d.ts","sourceRoot":"","sources":["../../src/cli/result.ts"],"names":[],"mappings":"AAEA,OAAO,EAmBL,KAAK,UAAU,EACf,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAGtD,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,YAAY,EACrB,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,aAAa,EACzB,EAAE,GAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,GAAG,UAAU,CAAM,GAC1C,UAAU,CAiGZ"}