dsh-research-report 0.2.0 → 0.3.0

package/lib/index.js

@@ -1,8 +1,8 @@
+import { _ as sha256Of, a as renderSarif, c as VERSION, d as extractCitations, f as mapBridgeResults, g as LedgerError, h as EvidenceLedger, i as renderMachineCheckMarkdown, l as combineOutcomes, m as verifyClaimText, n as VERIFIER_TOOL, o as renderVerificationJson, p as normalizeNumber, r as buildVerificationReport, s as verifySealedReport, t as SARIF_SCHEMA, u as contextLabelOf } from "./verify-sealed-CMJp1f_v.js";
 import path from "node:path";
 import z from "@deepseek-ai/schemastery";
-import { appendFile, mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { appendFile, mkdir, readFile, writeFile } from "node:fs/promises";
 import { KNOWN_SESSION_EVENT_TYPES } from "@deepseek-ai/dsh-session";
-import { createHash, randomBytes } from "node:crypto";
 import { Service } from "@deepseek-ai/cordis";
 import { defineTool } from "@deepseek-ai/dsh-tools";
 //#region src/config.ts
@@ -62,302 +62,6 @@ function resolveConfig(config = {}) {
 	};
 }
 //#endregion
-//#region src/ledger.ts
-/**
-* The evidence ledger: a content-addressed snapshot store with JSONL journals.
-*
-* Layout under the configured `ledgerRoot`:
-* - `objects/<sha256>` — one immutable snapshot per content hash (same content
-*   is stored exactly once; an "update" is a new object, history is never
-*   rewritten).
-* - `index.jsonl` — evidence registrations: id → hash, origin, capturedAt,
-*   title, bytes. Append-only.
-* - `claims.jsonl` — claim registrations: id → text, evidenceIds, optional
-*   dataset bridge fields. Append-only.
-* - `verdicts.jsonl` — verification verdicts; the latest line per claim wins.
-*
-* Tamper detection is the point of the design: every content read recomputes
-* the SHA-256 of the object file and compares it against the indexed hash —
-* a mismatch surfaces as `tampered`, a deleted object as `missing`.
-*
-* This module is pure Node (zero DSH imports) so it stays testable in
-* isolation; policy (size caps, fetch) lives in the provider.
-*
-* @module dsh-research-report/ledger
-*/
-/** SHA-256 hex of one UTF-8 string. */
-function sha256Of(content) {
-	return createHash("sha256").update(content, "utf8").digest("hex");
-}
-/** A loud ledger failure (audit state must never degrade silently). */
-var LedgerError = class extends Error {
-	/** The machine-routable failure code. */
-	code;
-	constructor(code, message) {
-		super(message);
-		this.name = "LedgerError";
-		this.code = code;
-	}
-};
-/** Read one JSONL journal; a corrupt line fails loud with file and line number. */
-async function readJournal(file) {
-	let text;
-	try {
-		text = await readFile(file, "utf8");
-	} catch (error) {
-		if (error.code === "ENOENT") return [];
-		throw new LedgerError("IO", `cannot read journal ${file}: ${error.message}`);
-	}
-	const lines = [];
-	const rows = text.split("\n");
-	for (let index = 0; index < rows.length; index++) {
-		const row = rows[index];
-		if (row.trim() === "") continue;
-		try {
-			lines.push(JSON.parse(row));
-		} catch {
-			throw new LedgerError("JOURNAL_CORRUPT", `corrupt JSONL at ${file}:${index + 1}`);
-		}
-	}
-	return lines;
-}
-/**
-* The content-addressed evidence ledger. Writes are serialized through an
-* internal promise queue so concurrent tool calls cannot interleave journals.
-*/
-var EvidenceLedger = class {
-	/** Absolute ledger root directory. */
-	root;
-	/** Write serialization chain (never rejects — each link absorbs the previous error). */
-	queue = Promise.resolve();
-	/**
-	* @param root - absolute ledger root directory.
-	*/
-	constructor(root) {
-		this.root = root;
-	}
-	get objectsDir() {
-		return path.join(this.root, "objects");
-	}
-	get indexFile() {
-		return path.join(this.root, "index.jsonl");
-	}
-	get claimsFile() {
-		return path.join(this.root, "claims.jsonl");
-	}
-	get verdictsFile() {
-		return path.join(this.root, "verdicts.jsonl");
-	}
-	get disproofsFile() {
-		return path.join(this.root, "disproofs.jsonl");
-	}
-	/** Run `work` after all previously queued writes settle. */
-	enqueue(work) {
-		const run = this.queue.then(work);
-		this.queue = run.then(() => void 0, () => void 0);
-		return run;
-	}
-	/** Ensure the directory layout exists. */
-	async ensureLayout() {
-		await mkdir(this.objectsDir, { recursive: true });
-	}
-	/** Write one snapshot object atomically (tmp + rename); no-op when present. */
-	async writeObject(hash, content) {
-		const target = path.join(this.objectsDir, hash);
-		try {
-			await readFile(target);
-			return;
-		} catch (error) {
-			if (error.code !== "ENOENT") throw new LedgerError("IO", `cannot stat object ${hash}: ${error.message}`);
-		}
-		const temporary = path.join(this.objectsDir, `.${hash}.tmp-${process.pid}-${randomBytes(4).toString("hex")}`);
-		await writeFile(temporary, content, "utf8");
-		try {
-			await rename(temporary, target);
-		} catch (error) {
-			try {
-				await readFile(target);
-			} catch {
-				throw new LedgerError("IO", `cannot commit object ${hash}: ${error.message}`);
-			}
-		}
-	}
-	/**
-	* Register one evidence snapshot. Same content dedupes to the stored object;
-	* a caller-chosen id that already exists with DIFFERENT content is refused
-	* loudly (history is never rewritten).
-	* @param input - id (optional), title, origin, content, capturedAt.
-	* @returns the record plus whether this call created it.
-	*/
-	async putEvidence(input) {
-		return this.enqueue(async () => {
-			await this.ensureLayout();
-			const hash = sha256Of(input.content);
-			const id = input.id ?? `ev-${hash.slice(0, 12)}`;
-			const existing = (await readJournal(this.indexFile)).find((line) => line.id === id);
-			if (existing !== void 0) {
-				if (existing.hash !== hash) throw new LedgerError("ID_CONFLICT", `evidence id "${id}" is already registered with different content (indexed ${existing.hash}, new ${hash}); choose a new id — snapshots are immutable`);
-				return {
-					record: existing,
-					created: false
-				};
-			}
-			await this.writeObject(hash, input.content);
-			const record = {
-				id,
-				hash,
-				title: input.title,
-				origin: input.origin,
-				capturedAt: input.capturedAt,
-				bytes: Buffer.byteLength(input.content, "utf8"),
-				...input.journal === void 0 ? {} : { journal: input.journal },
-				...input.year === void 0 ? {} : { year: input.year },
-				...input.sessionRef === void 0 ? {} : { sessionRef: input.sessionRef }
-			};
-			await appendFile(this.indexFile, `${JSON.stringify(record)}\n`, "utf8");
-			return {
-				record,
-				created: true
-			};
-		});
-	}
-	/**
-	* Register claims (id → text, evidenceIds). Re-registering a claim id with
-	* a different text or different bindings is refused loudly.
-	* @param claims - the registrations to append.
-	* @param registeredAt - ISO-8601 registration time.
-	* @returns the durable claim lines (existing lines for idempotent repeats).
-	*/
-	async registerClaims(claims, registeredAt) {
-		return this.enqueue(async () => {
-			await this.ensureLayout();
-			const journal = await readJournal(this.claimsFile);
-			const out = [];
-			for (const claim of claims) {
-				const existing = journal.find((line) => line.id === claim.id);
-				if (existing !== void 0) {
-					if (!(existing.text === claim.text && JSON.stringify(existing.evidenceIds) === JSON.stringify(claim.evidenceIds) && existing.dataset === claim.dataset)) throw new LedgerError("ID_CONFLICT", `claim id "${claim.id}" is already registered with different text or bindings; choose a new claim id — registrations are immutable`);
-					out.push(existing);
-					continue;
-				}
-				const line = {
-					...claim,
-					registeredAt
-				};
-				await appendFile(this.claimsFile, `${JSON.stringify(line)}\n`, "utf8");
-				journal.push(line);
-				out.push(line);
-			}
-			return out;
-		});
-	}
-	/**
-	* Append one verdict (latest per claim wins on read).
-	* @param verdict - claimId, status, optional note.
-	* @param at - ISO-8601 write time.
-	*/
-	async recordVerdict(verdict, at) {
-		await this.enqueue(async () => {
-			await this.ensureLayout();
-			const line = {
-				...verdict,
-				at
-			};
-			await appendFile(this.verdictsFile, `${JSON.stringify(line)}\n`, "utf8");
-		});
-	}
-	/**
-	* Read the evidence index.
-	* @returns every registration in append order.
-	*/
-	async listEvidence() {
-		return readJournal(this.indexFile);
-	}
-	/**
-	* Read one evidence registration.
-	* @param id - the ledger id.
-	* @returns the record, or undefined when unknown.
-	*/
-	async getEvidence(id) {
-		return (await this.listEvidence()).find((line) => line.id === id);
-	}
-	/**
-	* Read every claim registration.
-	* @returns every claim in append order.
-	*/
-	async listClaims() {
-		return readJournal(this.claimsFile);
-	}
-	/**
-	* Read one claim registration.
-	* @param id - the claim id.
-	* @returns the claim line, or undefined when unknown.
-	*/
-	async getClaim(id) {
-		return (await this.listClaims()).find((line) => line.id === id);
-	}
-	/**
-	* Fold the verdict journal to the latest verdict per claim.
-	* @returns claimId → latest stored verdict.
-	*/
-	async latestVerdicts() {
-		const journal = await readJournal(this.verdictsFile);
-		const latest = /* @__PURE__ */ new Map();
-		for (const line of journal) latest.set(line.claimId, line);
-		return latest;
-	}
-	/**
-	* Append one negative-knowledge (disproven) record, keyed by claim content
-	* hash so the same text cannot be re-reported under a different claim id.
-	* @param disproof - claimHash, claimId, text, evidenceHashes, note.
-	* @param at - ISO-8601 write time.
-	*/
-	async recordDisproof(disproof, at) {
-		await this.enqueue(async () => {
-			await this.ensureLayout();
-			const line = {
-				...disproof,
-				at
-			};
-			await appendFile(this.disproofsFile, `${JSON.stringify(line)}\n`, "utf8");
-		});
-	}
-	/**
-	* Fold the disproof journal to the latest disproof per claim content hash.
-	* @returns claimHash → latest stored disproof.
-	*/
-	async latestDisproofs() {
-		const journal = await readJournal(this.disproofsFile);
-		const latest = /* @__PURE__ */ new Map();
-		for (const line of journal) latest.set(line.claimHash, line);
-		return latest;
-	}
-	/**
-	* Read one snapshot and recompute its hash — the tamper-detection path.
-	* @param id - the ledger id.
-	* @returns content plus integrity (`ok` | `tampered` | `missing`), or
-	*   undefined when the id is unknown.
-	*/
-	async readContent(id) {
-		const record = await this.getEvidence(id);
-		if (record === void 0) return void 0;
-		let content;
-		try {
-			content = await readFile(path.join(this.objectsDir, record.hash), "utf8");
-		} catch (error) {
-			if (error.code === "ENOENT") return {
-				content: "",
-				integrity: "missing"
-			};
-			throw new LedgerError("IO", `cannot read object ${record.hash}: ${error.message}`);
-		}
-		return {
-			content,
-			integrity: sha256Of(content) === record.hash ? "ok" : "tampered"
-		};
-	}
-};
-//#endregion
 //#region src/assemble.ts
 /**
 * Report assembly and sealing — pure functions. The provider owns the ledger
@@ -416,10 +120,11 @@ function versionIdOf(at) {
 * @returns 16 hex characters of the knobs' SHA-256.
 */
 function configFingerprint(knobs) {
-	return sha256Of(JSON.stringify({
+	const stable = JSON.stringify({
 		maxEvidenceBytes: knobs.maxEvidenceBytes,
 		maxEvidencePerReport: knobs.maxEvidencePerReport
-	})).slice(0, 16);
+	});
+	return sha256Of(stable).slice(0, 16);
 }
 /**
 * Validate one assemble request; every violation throws (a loud rejection —
@@ -872,299 +577,6 @@ var ResearchReportService = class extends Service {
 	}
 };
 //#endregion
-//#region src/verify.ts
-/** Number literal: optional sign, grouped digits, decimals, trailing %. */
-const NUMBER_PATTERN = /-?\d[\d,]*(?:\.\d+)?%?/gu;
-/** Quoted spans: ASCII double quotes, CJK corner brackets, full-width quotes. */
-const QUOTE_PATTERNS = [
-	/"([^"\n]{4,200})"/gu,
-	/「([^」\n]{2,200})」/gu,
-	/“([^“”\n]{4,200})”/gu
-];
-/** The tail run of label characters (letters / CJK) ending a context window. */
-const LABEL_PATTERN = /[\p{L}\p{N}_（）()%$-]{2,24}$/u;
-/**
-* Extract the trailing context label of a number citation: up to 24 characters
-* before the number, trimmed to its trailing label run. Too-short labels are
-* dropped (a weak label would false-positive the contradiction check).
-* @param text - the full claim text.
-* @param index - offset of the number in the text.
-* @returns the label, or undefined when there is no usable one.
-*/
-function contextLabelOf(text, index) {
-	const window = text.slice(Math.max(0, index - 24), index).trimEnd();
-	const label = LABEL_PATTERN.exec(window)?.[0].trim();
-	if (label === void 0 || label.length < 2) return void 0;
-	return label;
-}
-/**
-* Extract every checkable citation from one claim text: number literals (with
-* their left-context labels) and quoted spans.
-* @param claimText - the claim to analyze.
-* @returns citations in first-seen order (duplicates kept once).
-*/
-function extractCitations(claimText) {
-	const citations = [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const match of claimText.matchAll(NUMBER_PATTERN)) {
-		const text = match[0];
-		if (seen.has(`number:${text}`)) continue;
-		seen.add(`number:${text}`);
-		const context = contextLabelOf(claimText, match.index);
-		citations.push(context === void 0 ? {
-			kind: "number",
-			text
-		} : {
-			kind: "number",
-			text,
-			context
-		});
-	}
-	for (const pattern of QUOTE_PATTERNS) for (const match of claimText.matchAll(pattern)) {
-		const text = match[1];
-		if (seen.has(`quote:${text}`)) continue;
-		seen.add(`quote:${text}`);
-		citations.push({
-			kind: "quote",
-			text
-		});
-	}
-	return citations;
-}
-/** The number token scan window after a context label (bytes of text). */
-const CONTEXT_SCAN_WINDOW = 24;
-/** Normalize a number literal for comparison (drop grouping commas and %). */
-function normalizeNumber(text) {
-	return text.replace(/[,%]/gu, "");
-}
-/** The first number literal found in `text` from `from` (fresh regex — no shared lastIndex). */
-function numberAfter(text, from) {
-	const window = text.slice(from, from + CONTEXT_SCAN_WINDOW);
-	return /-?\d[\d,]*(?:\.\d+)?%?/u.exec(window)?.[0];
-}
-/** Cap how many problem citations one note enumerates. */
-const NOTE_LIST_CAP = 5;
-/**
-* Run the byte-level check of one claim against its bound evidence snapshots.
-* @param claimText - the claim text.
-* @param evidenceContents - the verbatim snapshot contents of the bound evidence.
-* @returns the outcome (never throws).
-*/
-function verifyClaimText(claimText, evidenceContents) {
-	if (evidenceContents.length === 0) return {
-		status: "unverified",
-		note: "claim binds no evidence snapshot",
-		missing: [],
-		contradictions: []
-	};
-	const haystack = evidenceContents.join("\n");
-	const citations = extractCitations(claimText);
-	if (citations.length === 0) return {
-		status: "unverified",
-		note: "claim carries no checkable citation (number or quoted span); byte-level verification needs a literal to locate",
-		missing: [],
-		contradictions: []
-	};
-	const missing = [];
-	const contradictions = [];
-	for (const citation of citations) {
-		if (citation.kind === "quote") {
-			if (!haystack.includes(citation.text)) missing.push(`"${citation.text}"`);
-			continue;
-		}
-		if (haystack.includes(citation.text)) continue;
-		if (citation.context !== void 0) {
-			let searchFrom = 0;
-			let different;
-			for (;;) {
-				const at = haystack.indexOf(citation.context, searchFrom);
-				if (at === -1) break;
-				const found = numberAfter(haystack, at + citation.context.length);
-				if (found !== void 0 && normalizeNumber(found) !== normalizeNumber(citation.text)) {
-					different = found;
-					break;
-				}
-				searchFrom = at + citation.context.length;
-			}
-			if (different !== void 0) {
-				contradictions.push(`${citation.context}: claim says ${citation.text}, snapshot says ${different}`);
-				continue;
-			}
-		}
-		missing.push(citation.text);
-	}
-	if (contradictions.length > 0) return {
-		status: "disproven",
-		note: `disproves the claim: ${contradictions.slice(0, NOTE_LIST_CAP).join("; ")}`,
-		missing,
-		contradictions
-	};
-	if (missing.length > 0) return {
-		status: "insufficient",
-		note: `insufficient evidence: citation(s) not found in bound evidence: ${missing.slice(0, NOTE_LIST_CAP).join(", ")}`,
-		missing,
-		contradictions
-	};
-	return {
-		status: "verified",
-		note: `${citations.length} citation(s) located verbatim in the bound snapshot(s)`,
-		missing,
-		contradictions
-	};
-}
-/**
-* Map one bridge result set onto the verdict vocabulary. `mismatch` maps to
-* `disproven` (the dataset content explicitly falsifies the citation);
-* `not-found`/`unverifiable` map to `unverified`.
-* @param result - the dataQuality outcome.
-* @returns the mapped status plus a human-readable note.
-*/
-function mapBridgeResults(result) {
-	const mismatch = result.results.filter((entry) => entry.status === "mismatch");
-	if (mismatch.length > 0) return {
-		status: "disproven",
-		note: `dataset cross-check disproves: ${mismatch.slice(0, NOTE_LIST_CAP).map((entry) => `${entry.id}: dataset has ${String(entry.actual ?? "?")}${entry.note === void 0 ? "" : ` (${entry.note})`}`).join("; ")}`
-	};
-	const unresolved = result.results.filter((entry) => entry.status === "not-found" || entry.status === "unverifiable");
-	if (unresolved.length > 0) return {
-		status: "unverified",
-		note: `dataset cross-check unresolved: ${unresolved.slice(0, NOTE_LIST_CAP).map((entry) => `${entry.id}: ${entry.status}${entry.note === void 0 ? "" : ` (${entry.note})`}`).join("; ")}`
-	};
-	return {
-		status: "verified",
-		note: `${result.results.length} dataset citation(s) verified via ctx.dataQuality`
-	};
-}
-/**
-* Combine the byte-level and bridge outcomes: `disproven` wins, then
-* `contradicted`, then `unverified`, then `insufficient`, then `verified`.
-* @param byte - the byte-level outcome.
-* @param bridge - the bridge outcome, when the numeric bridge ran.
-* @returns the combined status and a merged note.
-*/
-function combineOutcomes(byte, bridge) {
-	if (bridge === void 0) return {
-		status: byte.status,
-		note: byte.note
-	};
-	const rank = {
-		verified: 0,
-		insufficient: 1,
-		unverified: 2,
-		contradicted: 3,
-		disproven: 4
-	};
-	return {
-		status: rank[bridge.status] > rank[byte.status] ? bridge.status : byte.status,
-		note: `${byte.note} | ${bridge.note}`
-	};
-}
-//#endregion
-//#region src/verify-sealed.ts
-/**
-* Read-only sealed-report verification: a deterministic, zero-network,
-* zero-model fallback that recomputes the seal and audit hashes and re-runs the
-* byte-level + integrity claim check. The optional model verifier (spawned over
-* `ctx.jobs`) is an enhancement over this machine check, never a replacement.
-* @module dsh-research-report/verify-sealed
-*/
-/** Read one optional journal; a missing journal is an empty string. */
-async function readOptional(deps, file) {
-	try {
-		return await deps.readFile(file);
-	} catch {
-		return "";
-	}
-}
-/**
-* Deterministically verify a sealed report directory: recompute the seal hash,
-* the report hash, and the audit-journal hashes, re-run the byte-level +
-* integrity check for every claim, and confirm the gap/disproof sections exist.
-* Zero network, zero model.
-* @param reportDir - the sealed report directory.
-* @param expectedSealHash - the seal hash returned at assemble time.
-* @param deps - file and evidence readers.
-* @returns the verification result.
-*/
-async function verifySealedReport(reportDir, expectedSealHash, deps) {
-	const manifestText = await deps.readFile(path.join(reportDir, "manifest.json"));
-	const reportText = await deps.readFile(path.join(reportDir, "report.md"));
-	const sealHash = sha256Of(manifestText);
-	const manifest = JSON.parse(manifestText);
-	const reportHashMatches = sha256Of(reportText) === manifest.reportSha256;
-	const verificationText = await readOptional(deps, path.join(reportDir, "verification.jsonl"));
-	const disconfirmationText = await readOptional(deps, path.join(reportDir, "disconfirmation.jsonl"));
-	const verificationMatches = manifest.verification === void 0 ? verificationText === "" : sha256Of(verificationText) === manifest.verification.sha256;
-	const disconfirmationMatches = manifest.disconfirmation === void 0 ? disconfirmationText === "" : sha256Of(disconfirmationText) === manifest.disconfirmation.sha256;
-	const journalHashesMatch = verificationMatches && disconfirmationMatches;
-	const claims = Array.isArray(manifest.claims) ? manifest.claims : [];
-	const verdicts = Array.isArray(manifest.verdicts) ? manifest.verdicts : [];
-	const claimChecks = [];
-	for (const claim of claims) {
-		const recorded = verdicts.find((verdict) => verdict.claimId === claim.id)?.status ?? "unverified";
-		const contents = [];
-		let integrityFailed = false;
-		for (const evidenceId of claim.evidenceIds) {
-			const read = await deps.readEvidenceContent(evidenceId);
-			if (read === void 0 || read.integrity !== "ok") {
-				integrityFailed = true;
-				break;
-			}
-			contents.push(read.content);
-		}
-		const recomputed = integrityFailed ? "contradicted" : verifyClaimText(claim.text, contents).status;
-		claimChecks.push({
-			claimId: claim.id,
-			recorded,
-			recomputed,
-			match: recorded === recomputed
-		});
-	}
-	const gapSectionPresent = reportText.includes("## Appendix A: Claim verification");
-	const disproofSectionPresent = reportText.includes("## Appendix D: Disconfirmation log");
-	const sealHashMatches = sealHash === expectedSealHash;
-	return {
-		sealHash,
-		sealHashMatches,
-		reportHashMatches,
-		journalHashesMatch,
-		claimChecks,
-		gapSectionPresent,
-		disproofSectionPresent,
-		ok: sealHashMatches && reportHashMatches && journalHashesMatch && gapSectionPresent && disproofSectionPresent
-	};
-}
-/**
-* Render the machine-check section of `verifier-note.md` (deterministic).
-* @param result - the sealed-report verification result.
-* @returns the machine-check markdown (no trailing newline).
-*/
-function renderMachineCheckMarkdown(result) {
-	const lines = [
-		`- Seal hash (sha256 of manifest.json): \`${result.sealHash}\` → ${result.sealHashMatches ? "MATCH" : "MISMATCH"}`,
-		`- Report hash (sha256 of report.md): → ${result.reportHashMatches ? "MATCH" : "MISMATCH"}`,
-		`- Audit journal hashes (verification.jsonl + disconfirmation.jsonl): → ${result.journalHashesMatch ? "MATCH" : "MISMATCH"}`,
-		`- Claims re-checked: ${result.claimChecks.filter((check) => check.match).length}/${result.claimChecks.length} status match`,
-		`- Gap section (Appendix A): ${result.gapSectionPresent ? "present" : "MISSING"}`,
-		`- Disproof section (Appendix D): ${result.disproofSectionPresent ? "present" : "MISSING"}`,
-		`- Overall: ${result.ok ? "OK" : "FAILED"}`
-	];
-	const mismatches = result.claimChecks.filter((check) => !check.match);
-	if (mismatches.length > 0) {
-		lines.push("", "Claim re-check mismatches:");
-		for (const check of mismatches) lines.push(`- ${check.claimId}: recorded ${check.recorded}, recomputed ${check.recomputed}`);
-	}
-	return lines.join("\n");
-}
-//#endregion
-//#region src/version.ts
-/**
-* Single source of truth for the plugin version (stamped by scripts/release.mjs).
-* @module dsh-research-report/version
-*/
-/** The published package version. */
-const VERSION = "0.2.0";
-//#endregion
 //#region src/provider-local.ts
 /**
 * The local Provider of the research-report seam: assembles the filesystem
@@ -2806,4 +2218,4 @@ function apply(ctx, config) {
 	});
 }
 //#endregion
-export { CONTRADICTED_MARK, CaptureError, Config, DISPROVEN_MARK, EvidenceLedger, GATHER_DEPTH_RESULTS, INSUFFICIENT_MARK, LedgerError, LocalResearchReportService, MANIFEST_SCHEMA, RequestValidationError, ResearchReportError, ResearchReportService, SealBlockedError, UNVERIFIED_MARK, VERSION, apply, buildManifest, captureFromFile, captureFromWeb, captureSnapshot, combineOutcomes, configFingerprint, contextLabelOf, extractCitations, gatherCandidates, inject, isDoiOrigin, isUrlOrigin, mapBridgeResults, name, normalizeDoi, normalizeNumber, renderMachineCheckMarkdown, renderReportMarkdown, resolveConfig, resolveWorkspacePath, serializeDisconfirmationJournal, serializeManifest, serializeVerificationJournal, sha256Of, slugify, toWorkspaceRelative, validateAssembleRequest, validateDoi, verifyClaimText, verifySealedReport, versionIdOf };
+export { CONTRADICTED_MARK, CaptureError, Config, DISPROVEN_MARK, EvidenceLedger, GATHER_DEPTH_RESULTS, INSUFFICIENT_MARK, LedgerError, LocalResearchReportService, MANIFEST_SCHEMA, RequestValidationError, ResearchReportError, ResearchReportService, SARIF_SCHEMA, SealBlockedError, UNVERIFIED_MARK, VERIFIER_TOOL, VERSION, apply, buildManifest, buildVerificationReport, captureFromFile, captureFromWeb, captureSnapshot, combineOutcomes, configFingerprint, contextLabelOf, extractCitations, gatherCandidates, inject, isDoiOrigin, isUrlOrigin, mapBridgeResults, name, normalizeDoi, normalizeNumber, renderMachineCheckMarkdown, renderReportMarkdown, renderSarif, renderVerificationJson, resolveConfig, resolveWorkspacePath, serializeDisconfirmationJournal, serializeManifest, serializeVerificationJournal, sha256Of, slugify, toWorkspaceRelative, validateAssembleRequest, validateDoi, verifyClaimText, verifySealedReport, versionIdOf };

package/lib/types/cli.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Standalone sealed-report verifier CLI. One command recomputes the seal hash
+ * (SHA-256 of manifest.json), the report hash, and the audit-journal hashes,
+ * re-runs the byte-level + integrity claim check against the evidence ledger,
+ * and prints a SARIF 2.1.0 or JSON report. Zero network, zero model, zero
+ * @deepseek-ai imports — this entry bundles to a self-contained binary.
+ *
+ * Usage:
+ *   dsh-research-verify --report <dir> [--seal <sha256>] [--ledger <dir>] [--format json|sarif]
+ *
+ * @module dsh-research-report/cli
+ */
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/lib/types/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG"}