ctxr-cli 0.6.0 → 0.7.0

package/templates/skills/ctxr-publish.md

@@ -12,26 +12,19 @@ different font. If a note would do the job, the note is the deliverable.
 
 ## 2. Name the subject, let the selector produce the set
 
-`ctxr publish gather` resolves a subject to its source notes — never a hand-picked list, which is how a
-walled note slips in unnoticed:
+`ctxr publish gather` resolves a subject to its source notes — never a hand-picked list, which is how
+an unintended note slips in unnoticed:
 
 - `--under <prefix>` — a store subtree
 - `--note <path>` — a single note
 - `--entity <name>` — every note linking to a concept, the same enumeration `ctxr rollup gather` uses
-- `--as <context>` — everything a named context can see
 
-## 3. Gate before copying anything out
+## 3. Decide what belongs on the page
 
-`ctxr publish gather --audience <audience>` evaluates every resolved note through the same tri-state
-disclosure verdict `ctxr check` uses, and reports the worst verdict in the set. Run it FIRST, before
-reading a single note for content:
-
-- **DENY** notes contribute nothing — not a title, not a count, not a paraphrase.
-- **ASK** stops the build; name the note to the operator and wait.
-- Only **ALLOW** content may be quoted or summarized into the page.
-
-Never infer a verdict from a note's resolved visibility on your own — an external audience's verdict
-requires an explicit tag or a human answer, not an inference from how widely a note is already visible.
+The store does not decide this for you. Read the resolved set and judge, note by note, whether its
+content belongs in front of this page's intended readers — a page written for an outside party must
+not carry material written about that party, or about anyone else who did not expect to be quoted.
+When you are unsure about a note, leave it out and name it to the operator rather than guessing.
 
 ## 4. Fix the identity once
 
@@ -45,10 +38,23 @@ handed out.
 
 Pick the shape the content actually needs — a status board, a timeline, a side-by-side comparison, an
 explainer with a live demo — not a rendering of the source notes in reading order. Contexture ships no
-renderer of its own: for visual direction, load the `frontend-design` skill this store carries by
-default (or whichever design-focused skill it's configured or installed instead), and follow it for the
-actual HTML, CSS, and visual language. If a sibling page already exists, read its stylesheet and
-inherit its palette and type scale before inventing a new one.
+renderer of its own and no house voice: both halves of the craft are delegated to a skill.
+
+**The form and its visual language.** Load the `frontend-design` skill this store carries by default
+(or whichever design-focused skill it's configured or installed instead) and follow it for the HTML,
+CSS, type, and palette — and for the interface's own words: labels, buttons, empty and error states.
+If a sibling page already exists, read its stylesheet and inherit its palette and type scale before
+inventing a new one.
+
+**The prose that explains the subject.** A page is read by someone who wasn't in the sessions the
+notes came from, so the notes' shorthand does not survive the copy out. Load the `eli5` skill this
+store carries by default (or whichever explanation-focused skill it's configured instead), settle who
+the reader is before writing, and pitch every definition, analogy, and level of detail at them.
+
+Both skills say "audience", and neither means step 3's. There, `--audience` names who the store is
+being asked to disclose to and the answer is a verdict; here it names how much a reader already knows
+and the answer is a register. A comprehension level is never a value you pass to `--audience`, and
+writing plainly never widens what the page may contain — the gate in step 3 already settled that.
 
 ## 6. Verify the output invariants
 
@@ -56,13 +62,12 @@ inherit its palette and type scale before inventing a new one.
 a viewport meta tag, at least one print rule, a provenance line, a sibling README, balanced tags, and
 valid syntax in every embedded script. It exits non-zero naming every failing check; fix all of them
 before reporting the page as ready. It answers only what's derivable from the file itself — the DO-test
-in step 1, the form choice in step 5, and factual accuracy stay judgment calls, not checker output.
+in step 1, the form and reader choices in step 5, and factual accuracy stay judgment calls, not checker output.
 
 ## 7. It's a page, not a note
 
 The published-pages location is excluded from retrieval by default — a page never becomes a source for
-anything else the store retrieves, and it never carries the visibility field (that would falsely signal
-it's indexed). Confirm with `ctxr lint` after landing.
+anything else the store retrieves. Confirm with `ctxr lint` after landing.
 
 ## 8. Provenance and drift
 

package/templates/skills/ctxr-session-capture.md

@@ -58,7 +58,6 @@ calcified, so it never gets retired.
 ```
 ### Store notes
 - A1  path: <layer>/<location>/<Title>.md
-      visibility: <value> — <one-line rationale; `ctxr note resolve` on a sibling shows the default>
       sketch: bullets
 
 ### House conventions
@@ -84,7 +83,6 @@ notes:
   - id: A1
     path: <layer>/<location>/<Title>.md
     mode: create            # or: append
-    visibility: <value>     # optional; omit to take the location default
     body: |
       matching the frontmatter and style of the sibling notes (`ctxr-placement` decides the location)
 ```
@@ -94,8 +92,7 @@ one bad path never blocks the rest. These note commits ride the session pull req
 (`ctxr-session-lifecycle`).
 
 Approved conventions are a direct edit to `__HOUSE_CONVENTIONS_PATH__`, never the YAML above: `ctxr
-session capture` writes NOTES — it takes a path, a visibility, and a body, and stamps the visibility
-field — and a guidance file is not a note and carries no visibility. Edit it under the matching
+session capture` writes NOTES — it takes a path and a body — and a guidance file is not a note. Edit it under the matching
 section, then run `ctxr update` so AGENTS.md re-inlines it, and stage BOTH in the same commit: a staged
 guidance change without a matching staged AGENTS.md regeneration fails `doctor --staged` and the
 pre-commit hook refuses it. If the file does not exist yet (a store migrated in from before it was

package/templates/vendor/eli5/LICENSE.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/templates/vendor/eli5/SKILL.md

@@ -0,0 +1,116 @@
+---
+name: eli5
+description: "Explain any topic, code, concept, or error tailored to a specific audience's level of understanding. Use this skill whenever the user says 'explain like I am', 'ELI5', 'explain this to my', 'break this down for', 'dumb it down', 'simplify this for', or asks you to explain something to a specific person or audience type (e.g., 'explain this to a manager', 'how would I explain this to my mom', 'make this understandable for a 5th grader'). Also trigger when the user mentions wanting to understand something at a particular level, or asks for an explanation targeting a non-technical audience. Even partial matches like 'explain to my wife' or 'tell my boss' should trigger this skill."
+---
+
+# Explain Like I Am... (ELI5)
+
+You are an expert at taking complex topics and making them accessible to any audience. Your job is to explain the given topic in a way that perfectly matches the audience's background, vocabulary, and interests.
+
+## Step 1: Identify the Audience
+
+Parse the user's request to determine who the explanation is for. The audience falls into one of these categories:
+
+### Ages
+| Audience | Style |
+|----------|-------|
+| Age 5 | Super simple words. Use fun analogies with toys, animals, candy, playground. Short sentences. "Imagine you have a box of crayons..." |
+| Age 10 | Elementary school level. Can handle basic cause-and-effect. Use school, sports, video game analogies. |
+| Age 15 | Teenager. Can handle some abstraction. Use social media, phone, gaming references. Be slightly casual. |
+| Age 20-30 | Young adult. Clear and direct. Real-world analogies from daily life, work, money. |
+| Age 40+ | Mature adult. Respectful tone. Analogies from home ownership, career, family management. |
+
+### Grade / Education Levels
+| Audience | Style |
+|----------|-------|
+| 5th grade | Simple vocabulary, concrete examples, avoid jargon entirely. "Think of it like..." |
+| Middle school | Can introduce basic terminology with definitions. Step-by-step logic. |
+| Senior High | Can handle moderate complexity. Introduce proper terms but explain them. SAT-level vocabulary OK. |
+| College Student | Academic framing. Can use technical terms with brief context. Theory + practical application. |
+| Graduate school | Assume strong foundational knowledge. Focus on nuance, trade-offs, edge cases, and deeper implications. Be precise. |
+
+### Job Roles
+| Audience | They care about... | Frame explanations around... |
+|----------|-------------------|------------------------------|
+| Manager | Impact, timeline, risk, cost | Business outcomes, team implications, what decisions need to be made |
+| Engineer | How it works, architecture, trade-offs | Technical details, implementation, performance, maintainability |
+| Designer | User experience, visual impact, flow | How it affects the user, interaction patterns, accessibility |
+| Director | Strategy, ROI, competitive advantage | Big picture, market position, resource allocation |
+| Colleague | Practical context, shared work | How it affects their work, what they need to know to collaborate |
+| Product Manager | User value, priorities, scope | Feature impact, user stories, what to build vs. skip |
+
+### Relationships
+| Audience | Tone | Analogy style |
+|----------|------|---------------|
+| Wife / Husband / Partner | Warm, conversational, patient | Household tasks, shared experiences, daily routines |
+| Father / Mother / Parents | Respectful, clear, no condescension | Familiar technology they use, home analogies, generational bridges |
+| Kids / Children | Playful, encouraging, short | Games, cartoons, school, animals |
+| Friend | Casual, maybe humorous | Pop culture, shared interests, "you know how..." |
+
+If the audience isn't explicitly stated, default to "Age 5" (classic ELI5).
+
+## Step 2: Read the Source Material
+
+Before explaining, make sure you fully understand what needs to be explained. This could be:
+- **Code**: Read the relevant code files. Understand what the code does at a high level before translating.
+- **A concept**: Break it into its core components.
+- **An error message**: Understand the root cause, not just the surface text.
+- **A technical document**: Extract the key points that matter.
+- **Anything else**: Identify the essential "what" and "why."
+
+## Step 3: Craft the Explanation
+
+Follow these principles, scaled to the audience:
+
+### Structure
+1. **Start with the "what"** — one sentence that captures the essence
+2. **Use an analogy** — connect to something the audience already knows
+3. **Fill in details** — add layers only as appropriate for the audience level
+4. **End with the "so what"** — why does this matter to them specifically?
+
+### Language Calibration
+
+For **simple audiences** (young ages, non-technical roles, family):
+- No jargon. Zero. If a technical term is essential, define it immediately.
+- One idea per sentence.
+- Concrete over abstract. "The server is like a waiter at a restaurant" beats "the server handles client-server communication."
+- Use "you" and "your" — make it personal.
+
+For **technical audiences** (engineers, grad students):
+- Use proper terminology — they'll feel patronized without it.
+- Focus on the *interesting* parts: trade-offs, edge cases, design decisions.
+- Compare to things they already know: "It's like a hash map but with X difference."
+- Be concise — respect their existing knowledge.
+
+For **business audiences** (managers, directors):
+- Lead with impact and outcomes.
+- Quantify where possible.
+- Skip implementation details unless asked.
+- Frame in terms of decisions: "This means we should..."
+
+### Tone Matching
+- Ages 5-10: Enthusiastic, like a favorite teacher. "Oh, this is a cool one!"
+- Teenagers: Slightly casual but not cringey. No "fellow kids" energy.
+- Professionals: Confident and clear. Respect their intelligence while bridging knowledge gaps.
+- Family: Patient, warm, conversational. Like explaining over dinner.
+
+## Examples
+
+**User says**: "ELI5 what a database index is"
+**Audience**: Age 5 (default)
+**Response style**: "Imagine you have a huuuge book with thousands of pages. Now, if I asked you to find the page about dinosaurs, you could flip through every single page... or you could look at the table of contents at the front! A database index is like that table of contents. It helps the computer find things really fast without looking through everything."
+
+**User says**: "Explain this API rate limiting to my manager"
+**Audience**: Manager
+**Response style**: "The API has a speed limit — we can only make 100 requests per minute. Right now we're hitting that limit during peak hours, which means some user requests are failing. We have two options: optimize our code to make fewer calls (1-2 days of work), or pay for a higher tier ($X/month). I'd recommend..."
+
+**User says**: "Break down this React useEffect hook for a college student"
+**Audience**: College Student
+**Response style**: "useEffect is React's way of handling side effects — things that happen outside the normal render cycle, like API calls, subscriptions, or DOM manipulation. Think of it as a lifecycle hook (if you've seen class components) that combines componentDidMount, componentDidUpdate, and componentWillUnmount. The dependency array controls when it re-runs..."
+
+## Important Reminders
+
+- Never talk down to anyone. A 5-year-old explanation should feel delightful, not dumbing-down. A manager explanation should feel empowering, not dismissive of their intelligence.
+- When explaining code, always explain the *purpose* first, then the mechanism. Nobody cares about syntax until they know why it exists.
+- If the topic is genuinely complex and the audience is very non-technical, it's OK to simplify ruthlessly. Getting the core idea across at 80% accuracy is better than a 100% accurate explanation that loses the audience.
+- Match the length to the audience: short and sweet for young kids, more detailed for technical audiences who want depth.

package/templates/vendor/eli5/provenance.json

@@ -0,0 +1,8 @@
+{
+  "source": "DreambigOu/ELI5",
+  "subpath": "skills/eli5",
+  "ref": "a766623b062331fdde53467001379b4ddf3acc2f",
+  "license": "MIT",
+  "licensePath": "LICENSE",
+  "sha256": "a671efd44a818aee7dbe4ea2ec634079401c3f578c08cb634c2b6181ced2dbe9"
+}

package/dist/commands/check.d.ts

@@ -1,30 +0,0 @@
-import type { CommandOutcome, CommandRequires } from '../core/command.js';
-import type { DisclosureRung, DisclosureVerdict } from '../core/disclosure/model.js';
-import { type LeakFinding } from '../core/disclosure/leak-scan.js';
-import type { RunEnv } from '../core/env.js';
-import type { Store } from '../core/store.js';
-export declare const requires: CommandRequires;
-export interface CheckFlags {
-    path: string;
-    audience?: string;
-    scan?: boolean;
-}
-export interface CheckData {
-    path: string;
-    audience?: string;
-    verdict?: DisclosureVerdict;
-    rung?: DisclosureRung;
-    leaks?: LeakFinding[];
-}
-/**
- * disclosure-policy spec: the tri-state ALLOW/DENY/ASK verdict, each with
- * its own documented exit code (cli-contract's reserved 4/5), printing the
- * rung that produced it so a script or a human can see WHY, not just WHAT.
- *
- * store-primitives-from-migration-audit spec (D3): `--scan` is a second,
- * independent mode — the same leak scan `ctxr lint` runs, for one note —
- * and does not require `--audience` (a leak isn't about one requesting
- * audience; it's about every configured marker context at once).
- */
-export declare function execute(env: RunEnv, store: Store, flags: CheckFlags): Promise<CommandOutcome<CheckData>>;
-//# sourceMappingURL=check.d.ts.map

package/dist/commands/check.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../src/commands/check.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAErF,OAAO,EAAoB,KAAK,WAAW,EAAE,MAAM,iCAAiC,CAAC;AACrF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAK7C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,eAAO,MAAM,QAAQ,EAAE,eAAuC,CAAC;AAE/D,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;CACvB;AAOD;;;;;;;;;GASG;AACH,wBAAsB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CA6C9G"}

package/dist/commands/check.js

@@ -1,65 +0,0 @@
-import path from 'node:path';
-import { evaluateDisclosure, VERDICT_EXIT_CODE } from '../core/disclosure/model.js';
-import { scanNoteForLeaks } from '../core/disclosure/leak-scan.js';
-import { CheckAudienceRequiredError, NoteNotFoundError } from '../core/errors.js';
-import { ExitCode } from '../core/exit-codes.js';
-import { parseNote } from '../core/notes/parse.js';
-export const requires = { store: 'required' };
-function toStoreRelativePath(env, store, givenPath) {
-    const absolute = path.isAbsolute(givenPath) ? givenPath : path.resolve(env.cwd, givenPath);
-    return path.relative(store.root, absolute).split(path.sep).join('/');
-}
-/**
- * disclosure-policy spec: the tri-state ALLOW/DENY/ASK verdict, each with
- * its own documented exit code (cli-contract's reserved 4/5), printing the
- * rung that produced it so a script or a human can see WHY, not just WHAT.
- *
- * store-primitives-from-migration-audit spec (D3): `--scan` is a second,
- * independent mode — the same leak scan `ctxr lint` runs, for one note —
- * and does not require `--audience` (a leak isn't about one requesting
- * audience; it's about every configured marker context at once).
- */
-export async function execute(env, store, flags) {
-    const relativePath = toStoreRelativePath(env, store, flags.path);
-    const absolutePath = path.join(store.root, relativePath);
-    let note;
-    try {
-        note = await parseNote(absolutePath, relativePath);
-    }
-    catch (err) {
-        if (err.code === 'ENOENT')
-            throw new NoteNotFoundError(relativePath);
-        throw err;
-    }
-    if (flags.scan) {
-        const leaks = scanNoteForLeaks(store.config, note);
-        const findings = leaks.map((leak) => ({
-            code: 'disclosure.leak',
-            severity: 'warning',
-            message: `"${leak.path}" matches a marker for context "${leak.context}", which cannot see this note: "${leak.matchedText}".`,
-            subject: leak.path,
-            details: { context: leak.context, pattern: leak.pattern, matchedText: leak.matchedText },
-        }));
-        return {
-            exitCode: leaks.length > 0 ? ExitCode.CheckFailed : ExitCode.Ok,
-            data: { path: relativePath, leaks },
-            findings,
-            humanSummary: leaks.length > 0 ? `${relativePath}: ${leaks.length} leak(s) found.` : `${relativePath}: no leaks found.`,
-            storeRoot: store.root,
-            schemaVersion: store.config.schema_version,
-        };
-    }
-    if (!flags.audience) {
-        throw new CheckAudienceRequiredError();
-    }
-    const { verdict, rung } = evaluateDisclosure(store.config, note, flags.audience);
-    return {
-        exitCode: VERDICT_EXIT_CODE[verdict],
-        data: { path: relativePath, audience: flags.audience, verdict, rung },
-        findings: [],
-        humanSummary: `${relativePath} for audience "${flags.audience}": ${verdict.toUpperCase()} (rung: ${rung})`,
-        storeRoot: store.root,
-        schemaVersion: store.config.schema_version,
-    };
-}
-//# sourceMappingURL=check.js.map

package/dist/commands/check.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"check.js","sourceRoot":"","sources":["../../src/commands/check.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAoB,MAAM,iCAAiC,CAAC;AAErF,OAAO,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAElF,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAGnD,MAAM,CAAC,MAAM,QAAQ,GAAoB,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAgB/D,SAAS,mBAAmB,CAAC,GAAW,EAAE,KAAY,EAAE,SAAiB;IACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC3F,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAW,EAAE,KAAY,EAAE,KAAiB;IACxE,MAAM,YAAY,GAAG,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAEzD,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,iBAAiB,CAAC,YAAY,CAAC,CAAC;QAChG,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAc,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC/C,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,IAAI,IAAI,CAAC,IAAI,mCAAmC,IAAI,CAAC,OAAO,mCAAmC,IAAI,CAAC,WAAW,IAAI;YAC5H,OAAO,EAAE,IAAI,CAAC,IAAI;YAClB,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;SACzF,CAAC,CAAC,CAAC;QACJ,OAAO;YACL,QAAQ,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE;YAC/D,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE;YACnC,QAAQ;YACR,YAAY,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,YAAY,KAAK,KAAK,CAAC,MAAM,iBAAiB,CAAC,CAAC,CAAC,GAAG,YAAY,mBAAmB;YACvH,SAAS,EAAE,KAAK,CAAC,IAAI;YACrB,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;SAC3C,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,IAAI,0BAA0B,EAAE,CAAC;IACzC,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAEjF,OAAO;QACL,QAAQ,EAAE,iBAAiB,CAAC,OAAO,CAAa;QAChD,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE;QACrE,QAAQ,EAAE,EAAE;QACZ,YAAY,EAAE,GAAG,YAAY,kBAAkB,KAAK,CAAC,QAAQ,MAAM,OAAO,CAAC,WAAW,EAAE,WAAW,IAAI,GAAG;QAC1G,SAAS,EAAE,KAAK,CAAC,IAAI;QACrB,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;KAC3C,CAAC;AACJ,CAAC"}

package/dist/commands/note-resolve.d.ts

@@ -1,14 +0,0 @@
-import type { CommandOutcome, CommandRequires } from '../core/command.js';
-import type { RunEnv } from '../core/env.js';
-import type { Store } from '../core/store.js';
-export declare const requires: CommandRequires;
-export interface NoteResolveFlags {
-    path: string;
-}
-export interface NoteResolveData {
-    path: string;
-    visibility: string;
-    reason: string;
-}
-export declare function execute(env: RunEnv, store: Store, flags: NoteResolveFlags): Promise<CommandOutcome<NoteResolveData>>;
-//# sourceMappingURL=note-resolve.d.ts.map

package/dist/commands/note-resolve.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"note-resolve.d.ts","sourceRoot":"","sources":["../../src/commands/note-resolve.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAI7C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,eAAO,MAAM,QAAQ,EAAE,eAAuC,CAAC;AAE/D,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB;AAOD,wBAAsB,OAAO,CAC3B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC,CAc1C"}

package/dist/commands/note-resolve.js

@@ -1,24 +0,0 @@
-import path from 'node:path';
-import { ExitCode } from '../core/exit-codes.js';
-import { parseNote } from '../core/notes/parse.js';
-import { resolveVisibility } from '../core/notes/visibility.js';
-export const requires = { store: 'required' };
-function toStoreRelativePath(env, store, givenPath) {
-    const absolute = path.isAbsolute(givenPath) ? givenPath : path.resolve(env.cwd, givenPath);
-    return path.relative(store.root, absolute).split(path.sep).join('/');
-}
-export async function execute(env, store, flags) {
-    const relativePath = toStoreRelativePath(env, store, flags.path);
-    const absolutePath = path.join(store.root, relativePath);
-    const note = await parseNote(absolutePath, relativePath);
-    const resolution = resolveVisibility(store.config, note);
-    return {
-        exitCode: ExitCode.Ok,
-        data: { path: relativePath, visibility: resolution.value, reason: resolution.reason },
-        findings: [],
-        humanSummary: `${relativePath}: ${resolution.value} (${resolution.reason})`,
-        storeRoot: store.root,
-        schemaVersion: store.config.schema_version,
-    };
-}
-//# sourceMappingURL=note-resolve.js.map

package/dist/commands/note-resolve.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"note-resolve.js","sourceRoot":"","sources":["../../src/commands/note-resolve.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAGhE,MAAM,CAAC,MAAM,QAAQ,GAAoB,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAY/D,SAAS,mBAAmB,CAAC,GAAW,EAAE,KAAY,EAAE,SAAiB;IACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC3F,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAW,EACX,KAAY,EACZ,KAAuB;IAEvB,MAAM,YAAY,GAAG,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAEzD,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,EAAE;QACrB,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE;QACrF,QAAQ,EAAE,EAAE;QACZ,YAAY,EAAE,GAAG,YAAY,KAAK,UAAU,CAAC,KAAK,KAAK,UAAU,CAAC,MAAM,GAAG;QAC3E,SAAS,EAAE,KAAK,CAAC,IAAI;QACrB,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;KAC3C,CAAC;AACJ,CAAC"}

package/dist/core/checks/disclosure-checks.d.ts

@@ -1,4 +0,0 @@
-/** disclosure-policy spec (store-primitives-from-migration-audit D3): reported by lint, never failed by doctor — a marker match is a judgment call, not an invariant. */
-export declare const leakCheck: import("./types.js").CheckDefinition;
-export declare const DISCLOSURE_CHECKS: import("./types.js").CheckDefinition[];
-//# sourceMappingURL=disclosure-checks.d.ts.map

package/dist/core/checks/disclosure-checks.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"disclosure-checks.d.ts","sourceRoot":"","sources":["../../../src/core/checks/disclosure-checks.ts"],"names":[],"mappings":"AAIA,yKAAyK;AACzK,eAAO,MAAM,SAAS,sCAkBpB,CAAC;AAEH,eAAO,MAAM,iBAAiB,wCAAc,CAAC"}

package/dist/core/checks/disclosure-checks.js

@@ -1,24 +0,0 @@
-import { scanForLeaks } from '../disclosure/leak-scan.js';
-import { defineCheck } from './types.js';
-/** disclosure-policy spec (store-primitives-from-migration-audit D3): reported by lint, never failed by doctor — a marker match is a judgment call, not an invariant. */
-export const leakCheck = defineCheck({
-    id: 'disclosure.leak',
-    title: "Content matching a context's marker found inside a note that context cannot see",
-    severity: 'observation',
-    capability: 'disclosure-policy',
-    scopes: ['store'],
-    async run(ctx) {
-        const notes = await ctx.notes();
-        const leaks = scanForLeaks(ctx.config, notes);
-        const findings = leaks.map((leak) => ({
-            code: 'disclosure.leak',
-            severity: 'warning',
-            message: `"${leak.path}" matches a marker for context "${leak.context}", which cannot see this note: "${leak.matchedText}".`,
-            subject: leak.path,
-            details: { context: leak.context, pattern: leak.pattern, matchedText: leak.matchedText },
-        }));
-        return { status: findings.length > 0 ? 'fail' : 'pass', findings };
-    },
-});
-export const DISCLOSURE_CHECKS = [leakCheck];
-//# sourceMappingURL=disclosure-checks.js.map

package/dist/core/checks/disclosure-checks.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"disclosure-checks.js","sourceRoot":"","sources":["../../../src/core/checks/disclosure-checks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE1D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,yKAAyK;AACzK,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC;IACnC,EAAE,EAAE,iBAAiB;IACrB,KAAK,EAAE,iFAAiF;IACxF,QAAQ,EAAE,aAAa;IACvB,UAAU,EAAE,mBAAmB;IAC/B,MAAM,EAAE,CAAC,OAAO,CAAC;IACjB,KAAK,CAAC,GAAG,CAAC,GAAG;QACX,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAc,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC/C,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,IAAI,IAAI,CAAC,IAAI,mCAAmC,IAAI,CAAC,OAAO,mCAAmC,IAAI,CAAC,WAAW,IAAI;YAC5H,OAAO,EAAE,IAAI,CAAC,IAAI;YAClB,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;SACzF,CAAC,CAAC,CAAC;QACJ,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;IACrE,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,SAAS,CAAC,CAAC"}

package/dist/core/disclosure/leak-scan.d.ts

@@ -1,19 +0,0 @@
-import type { StoreConfig } from '../../config/schema.js';
-import type { Note } from '../notes/list.js';
-export interface LeakFinding {
-    path: string;
-    context: string;
-    pattern: string;
-    matchedText: string;
-}
-/**
- * disclosure-policy spec (store-primitives-from-migration-audit D3): a leak
- * is content that belongs to context X (per an operator-declared marker
- * pattern) inside a note X cannot see, per the SAME context→visible-values
- * mapping the visibility pre-filter and disclosure's internal-audience rung
- * use — "X cannot see the note" is exactly `!canSee(config, X, resolved)`.
- * Empty markers (the default) make this a no-op for every note.
- */
-export declare function scanNoteForLeaks(config: StoreConfig, note: Note): LeakFinding[];
-export declare function scanForLeaks(config: StoreConfig, notes: readonly Note[]): LeakFinding[];
-//# sourceMappingURL=leak-scan.d.ts.map

package/dist/core/disclosure/leak-scan.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"leak-scan.d.ts","sourceRoot":"","sources":["../../../src/core/disclosure/leak-scan.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAG7C,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,GAAG,WAAW,EAAE,CAgB/E;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,IAAI,EAAE,GAAG,WAAW,EAAE,CAEvF"}

package/dist/core/disclosure/leak-scan.js

@@ -1,31 +0,0 @@
-import { canSee, resolveVisibility } from '../notes/visibility.js';
-/**
- * disclosure-policy spec (store-primitives-from-migration-audit D3): a leak
- * is content that belongs to context X (per an operator-declared marker
- * pattern) inside a note X cannot see, per the SAME context→visible-values
- * mapping the visibility pre-filter and disclosure's internal-audience rung
- * use — "X cannot see the note" is exactly `!canSee(config, X, resolved)`.
- * Empty markers (the default) make this a no-op for every note.
- */
-export function scanNoteForLeaks(config, note) {
-    const markers = config.disclosure.leak_markers;
-    if (Object.keys(markers).length === 0)
-        return [];
-    const resolved = resolveVisibility(config, note).value;
-    const findings = [];
-    for (const [context, patterns] of Object.entries(markers)) {
-        if (canSee(config, context, resolved))
-            continue;
-        for (const pattern of patterns) {
-            const match = new RegExp(pattern).exec(note.body);
-            if (match) {
-                findings.push({ path: note.path, context, pattern, matchedText: match[0] });
-            }
-        }
-    }
-    return findings;
-}
-export function scanForLeaks(config, notes) {
-    return notes.flatMap((note) => scanNoteForLeaks(config, note));
-}
-//# sourceMappingURL=leak-scan.js.map

package/dist/core/disclosure/leak-scan.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"leak-scan.js","sourceRoot":"","sources":["../../../src/core/disclosure/leak-scan.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AASnE;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAmB,EAAE,IAAU;IAC9D,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC;IAC/C,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEjD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC;IACvD,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1D,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;YAAE,SAAS;QAChD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,KAAK,EAAE,CAAC;gBACV,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAmB,EAAE,KAAsB;IACtE,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;AACjE,CAAC"}

package/dist/core/disclosure/model.d.ts

@@ -1,29 +0,0 @@
-import type { StoreConfig } from '../../config/schema.js';
-import { ExitCode } from '../exit-codes.js';
-import type { Note } from '../notes/list.js';
-export type DisclosureVerdict = 'allow' | 'deny' | 'ask';
-/** disclosure-policy spec: each tri-state verdict's own distinct, documented exit code — defined once for every caller (single-note or aggregate). */
-export declare const VERDICT_EXIT_CODE: Record<DisclosureVerdict, ExitCode>;
-export type DisclosureRung = 'hard_wall' | 'explicit_tag' | 'internal_visibility' | 'external_default';
-export interface DisclosureResult {
-    verdict: DisclosureVerdict;
-    rung: DisclosureRung;
-}
-/**
- * disclosure-policy spec: ordered walls-before-allows evaluation, stopping
- * at the first rung that produces a verdict. Rung 3 (internal-audience-
- * from-visibility) only applies when the requested audience is one the
- * operator has declared internal — for any other (external) audience, rung
- * 3 is skipped entirely and evaluation falls straight to rung 4's ASK, so an
- * external verdict is never derived from visibility alone.
- */
-export declare function evaluateDisclosure(config: StoreConfig, note: Note, audience: string): DisclosureResult;
-/**
- * disclosure-policy spec: a set of verdicts aggregates to its most
- * restrictive member — DENY outranks ASK, which outranks ALLOW. An empty
- * set aggregates to ALLOW; callers that need to distinguish "nothing was
- * evaluated" from "everything was evaluated and allowed" report the set's
- * size separately, per the publish spec's empty-set scenario.
- */
-export declare function worstVerdict(verdicts: readonly DisclosureVerdict[]): DisclosureVerdict;
-//# sourceMappingURL=model.d.ts.map

package/dist/core/disclosure/model.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../../src/core/disclosure/model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAkB,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAG7C,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;AAEzD,sJAAsJ;AACtJ,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,QAAQ,CAIjE,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,WAAW,GAAG,cAAc,GAAG,qBAAqB,GAAG,kBAAkB,CAAC;AAEvG,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,iBAAiB,CAAC;IAC3B,IAAI,EAAE,cAAc,CAAC;CACtB;AAoBD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,gBAAgB,CAkBtG;AAKD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,GAAG,iBAAiB,CAMtF"}

package/dist/core/disclosure/model.js

@@ -1,69 +0,0 @@
-import { ExitCode } from '../exit-codes.js';
-import { canSee, resolveVisibility } from '../notes/visibility.js';
-/** disclosure-policy spec: each tri-state verdict's own distinct, documented exit code — defined once for every caller (single-note or aggregate). */
-export const VERDICT_EXIT_CODE = {
-    allow: ExitCode.Ok,
-    deny: ExitCode.DisclosureDeny,
-    ask: ExitCode.DisclosureAsk,
-};
-/**
- * The frontmatter key a note uses to explicitly declare which audiences may
- * see it disclosed (rung 2). Unlike the visibility field (context-store
- * spec), nothing asks this key to be configurable, so it lives here as the
- * one literal — same discipline as every other single-purpose constant in
- * this codebase, just without a dedicated defaults.ts entry since no other
- * module needs to reference it.
- */
-const AUDIENCE_FIELD_KEY = 'audience';
-function matchesWall(wall, note, audience) {
-    if (wall.audience !== '*' && wall.audience !== audience)
-        return false;
-    if (wall.except?.includes(audience))
-        return false;
-    if (!wall.note_path_prefix)
-        return true;
-    const prefix = wall.note_path_prefix.endsWith('/') ? wall.note_path_prefix : `${wall.note_path_prefix}/`;
-    return note.path === wall.note_path_prefix || note.path.startsWith(prefix);
-}
-/**
- * disclosure-policy spec: ordered walls-before-allows evaluation, stopping
- * at the first rung that produces a verdict. Rung 3 (internal-audience-
- * from-visibility) only applies when the requested audience is one the
- * operator has declared internal — for any other (external) audience, rung
- * 3 is skipped entirely and evaluation falls straight to rung 4's ASK, so an
- * external verdict is never derived from visibility alone.
- */
-export function evaluateDisclosure(config, note, audience) {
-    for (const wall of config.disclosure.hard_walls) {
-        if (matchesWall(wall, note, audience)) {
-            return { verdict: wall.verdict, rung: 'hard_wall' };
-        }
-    }
-    const tags = note.frontmatter?.[AUDIENCE_FIELD_KEY];
-    if (Array.isArray(tags) && tags.includes(audience)) {
-        return { verdict: 'allow', rung: 'explicit_tag' };
-    }
-    if (config.disclosure.internal_audiences.includes(audience)) {
-        const resolved = resolveVisibility(config, note);
-        return { verdict: canSee(config, audience, resolved.value) ? 'allow' : 'deny', rung: 'internal_visibility' };
-    }
-    return { verdict: 'ask', rung: 'external_default' };
-}
-/** disclosure-policy spec: most-restrictive-member ordering, defined once for reuse by any caller batching verdicts across a set of notes. */
-const VERDICT_RESTRICTIVENESS = { deny: 2, ask: 1, allow: 0 };
-/**
- * disclosure-policy spec: a set of verdicts aggregates to its most
- * restrictive member — DENY outranks ASK, which outranks ALLOW. An empty
- * set aggregates to ALLOW; callers that need to distinguish "nothing was
- * evaluated" from "everything was evaluated and allowed" report the set's
- * size separately, per the publish spec's empty-set scenario.
- */
-export function worstVerdict(verdicts) {
-    let worst = 'allow';
-    for (const verdict of verdicts) {
-        if (VERDICT_RESTRICTIVENESS[verdict] > VERDICT_RESTRICTIVENESS[worst])
-            worst = verdict;
-    }
-    return worst;
-}
-//# sourceMappingURL=model.js.map

package/dist/core/disclosure/model.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"model.js","sourceRoot":"","sources":["../../../src/core/disclosure/model.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAInE,sJAAsJ;AACtJ,MAAM,CAAC,MAAM,iBAAiB,GAAwC;IACpE,KAAK,EAAE,QAAQ,CAAC,EAAE;IAClB,IAAI,EAAE,QAAQ,CAAC,cAAc;IAC7B,GAAG,EAAE,QAAQ,CAAC,aAAa;CAC5B,CAAC;AASF;;;;;;;GAOG;AACH,MAAM,kBAAkB,GAAG,UAAU,CAAC;AAEtC,SAAS,WAAW,CAAC,IAAoB,EAAE,IAAU,EAAE,QAAgB;IACrE,IAAI,IAAI,CAAC,QAAQ,KAAK,GAAG,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtE,IAAI,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,CAAC,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,gBAAgB,GAAG,CAAC;IACzG,OAAO,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAmB,EAAE,IAAU,EAAE,QAAgB;IAClF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;QAChD,IAAI,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,kBAAkB,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IACpD,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5D,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACjD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC;IAC/G,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;AACtD,CAAC;AAED,8IAA8I;AAC9I,MAAM,uBAAuB,GAAsC,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAEjG;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,QAAsC;IACjE,IAAI,KAAK,GAAsB,OAAO,CAAC;IACvC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,uBAAuB,CAAC,OAAO,CAAC,GAAG,uBAAuB,CAAC,KAAK,CAAC;YAAE,KAAK,GAAG,OAAO,CAAC;IACzF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}