etymd 0.2.2 → 0.3.1

package/dist/{chunk-ANCCGYSH.js → chunk-NMZ3RHWW.js}

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
-import { ETYMD_DIR } from './chunk-FZSIOCOZ.js';
-import { pathExists, readText, wordCount, approxTokens } from './chunk-LBRNZZZF.js';
-import path2 from 'node:path';
-import { promises } from 'node:fs';
+import { ETYMD_DIR } from './chunk-R74SJ7HS.js';
+import { pathExists, readText } from './chunk-YLNQQZ5F.js';
+import path from 'node:path';
 
-var CONFIG_FILE = path2.join(ETYMD_DIR, "config.json");
+var CONFIG_FILE = path.join(ETYMD_DIR, "config.json");
 var DEFAULT_CONFIG = {
   instructions: { include: [], exclude: [] },
   context: { perFileWords: 4e3, totalWords: 8e3 },
-  state: { staleAfterDays: 30, maxChars: 9500 }
+  state: { staleAfterDays: 30, maxChars: 9500 },
+  gates: { commands: [], failOn: "risk", allowWriting: [] }
 };
 function configPath(root) {
-  return path2.join(root, CONFIG_FILE);
+  return path.join(root, CONFIG_FILE);
 }
 function readGlobList(value, key, problems) {
   if (value === void 0) return void 0;
@@ -53,6 +53,23 @@ async function readConfig(root) {
   const instructions = obj.instructions ?? {};
   const context = obj.context ?? {};
   const state = obj.state ?? {};
+  const gates = obj.gates ?? {};
+  const failOn = (() => {
+    if (gates.failOn === void 0) return void 0;
+    if (typeof gates.failOn !== "string" || !["risk", "gap", "polish"].includes(gates.failOn.toLowerCase())) {
+      problems.push(`${CONFIG_FILE}: \`gates.failOn\` must be risk | gap | polish \u2014 ignored.`);
+      return void 0;
+    }
+    return gates.failOn.toLowerCase();
+  })();
+  const publishGate = (() => {
+    if (gates.publishGate === void 0) return void 0;
+    if (typeof gates.publishGate !== "boolean") {
+      problems.push(`${CONFIG_FILE}: \`gates.publishGate\` must be true or false \u2014 ignored.`);
+      return void 0;
+    }
+    return gates.publishGate;
+  })();
   return {
     present: true,
     problems,
@@ -68,60 +85,15 @@ async function readConfig(root) {
       state: {
         staleAfterDays: readBudget(state.staleAfterDays, "state.staleAfterDays", problems) ?? DEFAULT_CONFIG.state.staleAfterDays,
         maxChars: readBudget(state.maxChars, "state.maxChars", problems) ?? DEFAULT_CONFIG.state.maxChars
+      },
+      gates: {
+        commands: readGlobList(gates.commands, "gates.commands", problems) ?? DEFAULT_CONFIG.gates.commands,
+        failOn: failOn ?? DEFAULT_CONFIG.gates.failOn,
+        publishGate,
+        allowWriting: readGlobList(gates.allowWriting, "gates.allowWriting", problems) ?? DEFAULT_CONFIG.gates.allowWriting
       }
     }
   };
 }
-var ALWAYS_LOADED = [
-  { path: "AGENTS.md", role: "operating contract" },
-  { path: "PROJECT_CONTEXT.md", role: "ground-truth state" },
-  { path: "CLAUDE.md", role: "Claude Code pointer" },
-  { path: "GEMINI.md", role: "Gemini pointer" },
-  { path: ".github/copilot-instructions.md", role: "Copilot instructions" },
-  { path: ".cursorrules", role: "Cursor rules (legacy)" }
-];
-var EXTRACTION_THRESHOLD = DEFAULT_CONFIG.context.perFileWords;
-function isAlwaysAppliedCursorRule(text) {
-  const fm = text.match(/^---\n([\s\S]*?)\n---/);
-  if (!fm) return true;
-  const frontmatter = fm[1] ?? "";
-  return /^\s*alwaysApply\s*:\s*true\s*$/m.test(frontmatter);
-}
-async function measureContext(root, perFileWords = EXTRACTION_THRESHOLD) {
-  const files = [];
-  for (const spec of ALWAYS_LOADED) {
-    const abs = path2.join(root, spec.path);
-    const text = await readText(abs);
-    if (text === null) continue;
-    const words = wordCount(text);
-    files.push({ path: spec.path, role: spec.role, words, approxTokens: approxTokens(words) });
-  }
-  const rulesDir = path2.join(root, ".cursor", "rules");
-  if (await pathExists(rulesDir)) {
-    try {
-      for (const entry of await promises.readdir(rulesDir)) {
-        if (!entry.endsWith(".mdc") && !entry.endsWith(".md")) continue;
-        const text = await readText(path2.join(rulesDir, entry));
-        if (text === null || !isAlwaysAppliedCursorRule(text)) continue;
-        const words = wordCount(text);
-        files.push({
-          path: `.cursor/rules/${entry}`,
-          role: "Cursor rule (always applied)",
-          words,
-          approxTokens: approxTokens(words)
-        });
-      }
-    } catch {
-    }
-  }
-  const totalWords = files.reduce((s, f) => s + f.words, 0);
-  return {
-    files: files.sort((a, b) => b.words - a.words),
-    totalWords,
-    totalApproxTokens: approxTokens(totalWords),
-    perFileWords,
-    extractionCandidates: files.filter((f) => f.words >= perFileWords)
-  };
-}
 
-export { CONFIG_FILE, DEFAULT_CONFIG, measureContext, readConfig };
+export { CONFIG_FILE, DEFAULT_CONFIG, configPath, readConfig };

package/dist/{chunk-FZSIOCOZ.js → chunk-R74SJ7HS.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { readJson } from './chunk-LBRNZZZF.js';
+import { readJson } from './chunk-YLNQQZ5F.js';
 import { promises } from 'node:fs';
 import path from 'node:path';
 

package/dist/{chunk-LBRNZZZF.js → chunk-TADKOW6P.js}

@@ -1,104 +1,6 @@
 #!/usr/bin/env node
-import { execFile } from 'node:child_process';
-import { promises } from 'node:fs';
-import { promisify } from 'node:util';
 import pc from 'picocolors';
 
-var pExecFile = promisify(execFile);
-async function pathExists(p) {
-  try {
-    await promises.access(p);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function readJson(p) {
-  try {
-    const raw = await promises.readFile(p, "utf8");
-    return JSON.parse(raw);
-  } catch {
-    return null;
-  }
-}
-async function readText(p) {
-  try {
-    return await promises.readFile(p, "utf8");
-  } catch {
-    return null;
-  }
-}
-async function isDirectory(p) {
-  try {
-    return (await promises.stat(p)).isDirectory();
-  } catch {
-    return false;
-  }
-}
-async function git(root, args) {
-  try {
-    const { stdout } = await pExecFile("git", args, { cwd: root, timeout: 4e3 });
-    return stdout.trim();
-  } catch {
-    return null;
-  }
-}
-function wordCount(text) {
-  const m = text.trim().match(/\S+/g);
-  return m ? m.length : 0;
-}
-function approxTokens(words) {
-  return Math.round(words / 0.75);
-}
-var CI_ENV_VARS = [
-  "CI",
-  "GITHUB_ACTIONS",
-  "GITLAB_CI",
-  "BUILDKITE",
-  "CIRCLECI",
-  "JENKINS_URL",
-  "TF_BUILD"
-];
-function isCiEnvironment() {
-  return CI_ENV_VARS.some((v) => Boolean(process.env[v]));
-}
-function normalizeRelPath(p) {
-  return p.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, "");
-}
-function globToRegExp(glob) {
-  let re = "";
-  for (let i = 0; i < glob.length; i++) {
-    const c = glob[i];
-    if (c === "*") {
-      if (glob[i + 1] === "*") {
-        i += 1;
-        if (glob[i + 1] === "/") {
-          i += 1;
-          re += "(?:.*/)?";
-        } else {
-          re += ".*";
-        }
-      } else {
-        re += "[^/]*";
-      }
-    } else if (c === "?") {
-      re += "[^/]";
-    } else {
-      re += c.replace(/[.+^${}()|[\]\\]/g, "\\$&");
-    }
-  }
-  return new RegExp(`^${re}$`);
-}
-function matchesGlob(p, glob) {
-  const target = normalizeRelPath(p);
-  const pattern = normalizeRelPath(glob);
-  if (!pattern) return false;
-  if (!/[*?]/.test(pattern)) return target === pattern || target.startsWith(pattern + "/");
-  return globToRegExp(pattern).test(target);
-}
-function matchesAnyGlob(p, globs) {
-  return globs.some((g) => matchesGlob(p, g));
-}
 var theme = {
   brand: (s) => pc.magenta(pc.bold(s)),
   heading: (s) => pc.bold(s),
@@ -356,4 +258,4 @@ function renderLedger(ledger) {
   }
 }
 
-export { TIER_BADGE, approxTokens, git, glyph, isCiEnvironment, isDirectory, matchesAnyGlob, normalizeRelPath, pathExists, print, readJson, readText, renderBaselineDrift, renderContext, renderFacts, renderFindings, renderFleetNotes, renderFleetRows, renderLedger, renderLedgerDiff, renderLensCoverage, renderPlan, section, theme, wordCount };
+export { TIER_BADGE, glyph, print, renderBaselineDrift, renderContext, renderFacts, renderFindings, renderFleetNotes, renderFleetRows, renderLedger, renderLedgerDiff, renderLensCoverage, renderPlan, section, theme };

package/dist/{chunk-KMAJIQHC.js → chunk-V6NZEIHF.js}

@@ -1,9 +1,11 @@
 #!/usr/bin/env node
-import { readLedger, reconcileLedger, writeLedger, visibleFindings } from './chunk-KBF3SW3N.js';
-import { DEFAULT_CONFIG, readConfig, CONFIG_FILE, measureContext } from './chunk-ANCCGYSH.js';
-import { scanProject, PACK_VERSION, expandFileGlobs } from './chunk-BH37LELV.js';
-import { ETYMD_DIR, writeCachedFacts, readBaseline, deriveProfile, baselineCarriesMachinePath, BASELINE_FILE } from './chunk-FZSIOCOZ.js';
-import { pathExists, readJson, git, readText, isDirectory, matchesAnyGlob, isCiEnvironment, normalizeRelPath } from './chunk-LBRNZZZF.js';
+import { measureContext } from './chunk-LT67FU2Y.js';
+import { readLedger, reconcileLedger, writeLedger, visibleFindings } from './chunk-WWBF4Y7K.js';
+import { DEFAULT_CONFIG, readConfig, CONFIG_FILE } from './chunk-NMZ3RHWW.js';
+import { scanProject, expandFileGlobs } from './chunk-HOLFW5QY.js';
+import { ETYMD_DIR, writeCachedFacts, readBaseline, deriveProfile, baselineCarriesMachinePath, BASELINE_FILE } from './chunk-R74SJ7HS.js';
+import { PACK_VERSION } from './chunk-CRJHIXJH.js';
+import { pathExists, readJson, git, readText, isDirectory, matchesAnyGlob, isCiEnvironment, normalizeRelPath } from './chunk-YLNQQZ5F.js';
 import path from 'node:path';
 import YAML from 'yaml';
 import { promises } from 'node:fs';

package/dist/{chunk-MWIK6ML3.js → chunk-VFUYQLW7.js}

@@ -1,26 +1,9 @@
 #!/usr/bin/env node
-import { PACK_VERSION } from './chunk-BH37LELV.js';
-import { pathExists, readText } from './chunk-LBRNZZZF.js';
-import { promises } from 'node:fs';
+import { DEFAULT_CONFIG } from './chunk-NMZ3RHWW.js';
+import { PACK_VERSION } from './chunk-CRJHIXJH.js';
+import { readText, pathExists } from './chunk-YLNQQZ5F.js';
 import path from 'node:path';
 
-async function applyFiles(root, files, overwrite = /* @__PURE__ */ new Set()) {
-  const written = [];
-  const skipped = [];
-  for (const file of files) {
-    if (file.exists && !overwrite.has(file.path)) {
-      skipped.push(file.path);
-      continue;
-    }
-    const abs = path.join(root, file.path);
-    await promises.mkdir(path.dirname(abs), { recursive: true });
-    await promises.writeFile(abs, file.contents, "utf8");
-    if (file.executable) await promises.chmod(abs, 493);
-    written.push(file.path);
-  }
-  return { written, skipped };
-}
-
 // src/pack/templates.ts
 function runPrefix(pm) {
   switch (pm) {
@@ -128,26 +111,133 @@ ${[
 <!-- etymd pack v${PACK_VERSION} -->
 `;
 }
+var CONTENT_GATE_RESOLUTION = `GATE="\${CONTENT_GATE:-$(command -v etymd || true)}"`;
+function localHookCall(hook) {
+  return `# Repo-owned checks. This file is generated and will be overwritten; \`.githooks/${hook}.local\`
+# is yours \u2014 etymd never reads, writes, or regenerates it. Put project-specific guards there.
+LOCAL="$(dirname "$0")/${hook}.local"
+if [ -x "$LOCAL" ]; then
+  "$LOCAL" "$@" || exit 1
+fi`;
+}
 function generatePreCommitHook() {
   return `#!/usr/bin/env sh
 # etymd: process gate. Cheap, locally-knowable checks belong here (fast, blocks the commit).
+
+${localHookCall("pre-commit")}
+
+# Content screen \u2014 staged file bytes. Refuses to commit environment, employer or identity
+# detail into a repo whose history is (or could become) public. The checker and its patterns
+# are machine-local by design, so this is a NO-OP wherever no checker is installed: safe to
+# commit anywhere, active only where you opted in.
+#
+# Bypass, with a reason: git commit --no-verify
+${CONTENT_GATE_RESOLUTION}
+if [ -x "$GATE" ]; then
+  "$GATE" screen --staged || exit 1
+fi
+
 exit 0
 `;
 }
-function generatePrePushHook(facts) {
+function generateCommitMsgHook() {
+  return `#!/usr/bin/env sh
+# etymd: content screen \u2014 the commit message itself.
+#
+# The staged-content gate reads file bytes and never sees the message, yet a message is as
+# permanently published as any file. No-op where no checker is installed.
+#
+# Bypass, with a reason: git commit --no-verify
+GATE="\${COMMIT_MSG_GATE:-$(command -v etymd || true)}"
+if [ -x "$GATE" ]; then
+  "$GATE" screen --message "$1" || exit 1
+fi
+
+${localHookCall("commit-msg")}
+
+exit 0
+`;
+}
+function generatePrePushHook(facts, gates) {
   const run = runPrefix(facts.packageManager);
   const c = facts.commands;
-  const candidates = [c.formatCheck, c.typecheck, c.lint];
-  const steps = candidates.filter((key) => Boolean(key) && isSafeGateCommand(c.raw[key])).map((key) => `${run} ${key}`);
+  const candidates = gates?.commands?.length ? gates.commands : [c.formatCheck, c.typecheck, c.lint];
+  const allowed = new Set(gates?.allowWriting ?? []);
+  const steps = candidates.filter(
+    (key) => Boolean(key) && (allowed.has(key) || isSafeGateCommand(c.raw[key]))
+  ).map((key) => `${run} ${key}`);
   const body = steps.length ? steps.map((s) => `echo "\u203A ${s}"
 ${s} || exit 1`).join("\n") : 'echo "etymd: no correctness commands detected \u2014 add format:check / typecheck / lint"';
+  const failOn = gates?.failOn ?? "risk";
+  const auditStep = `
+if command -v etymd >/dev/null 2>&1; then
+  echo "\u203A etymd audit --fail-on ${failOn}"
+  etymd audit --no-ledger --fail-on ${failOn} || exit 1
+else
+  echo "\u203A etymd audit skipped (not on PATH)"
+fi`;
   return `#!/usr/bin/env sh
 # etymd: correctness gate. Mirrors CI cheapest-first; blocks the push on any failure.
+
+${localHookCall("pre-push")}
 ${body}
+${auditStep}
+
+# Content screen, second pass \u2014 the WHOLE TREE rather than one diff. Catches anything committed
+# with --no-verify and anything a rebase or merge brought in from elsewhere. Advisory here (it
+# never blocks the push): the blocking decision belongs at commit time, where the fix is cheap.
+${CONTENT_GATE_RESOLUTION}
+if [ -x "$GATE" ] && [ "\${CONTENT_GATE_PREPUSH:-1}" = "1" ]; then
+  "$GATE" screen --tree --advisory || true
+fi
+
+exit 0
+`;
+}
+function generateArtifactCheckScript() {
+  return `#!/usr/bin/env sh
+# etymd: content screen \u2014 the published ARTIFACT, not the repository.
+#
+# Wire it into the irreversible moment:
+#   package.json \u2192 "prepublishOnly": "./scripts/artifact-check.sh"
+#
+# No-op where no checker is installed. Bypass is deliberate and loud: ARTIFACT_CHECK_SKIP=1.
+set -eu
+
+if [ "\${ARTIFACT_CHECK_SKIP:-0}" = "1" ]; then
+  echo "\u203A artifact-check: SKIPPED by ARTIFACT_CHECK_SKIP=1"
+  exit 0
+fi
+
+${CONTENT_GATE_RESOLUTION}
+[ -x "$GATE" ] || { echo "\u203A artifact-check: no checker installed \u2014 skipping."; exit 0; }
+
+WORK=$(mktemp -d)
+trap 'rm -rf "$WORK"' EXIT INT TERM
+
+# Pack exactly what would ship, then screen the unpacked bytes.
+if [ -f package.json ]; then
+  npm pack --pack-destination "$WORK" >/dev/null 2>&1 || {
+    echo "\u203A artifact-check: npm pack failed \u2014 cannot verify what would ship" >&2; exit 1; }
+  tar -xzf "$WORK"/*.tgz -C "$WORK" 2>/dev/null || true
+fi
+
+"$GATE" screen --dir "$WORK" || exit 1
+exit 0
 `;
 }
 
 // src/core/generate.ts
+function derivedCommands(facts, existingHook) {
+  const c = facts.commands;
+  const base = [c.formatCheck, c.typecheck, c.lint].filter(
+    (k) => Boolean(k) && isSafeGateCommand(c.raw[k])
+  );
+  if (c.test && existingHook && new RegExp(`\\b${c.test}\\b`).test(existingHook)) {
+    base.push(c.test);
+  }
+  return base;
+}
 async function planWorkflow(root, facts, opts) {
   const out = [];
   const add = async (rel, contents, label, executable = false) => {
@@ -167,10 +257,36 @@ async function planWorkflow(root, facts, opts) {
     await add("AGENTS.md", generateAgentsMd(facts), "Minimal operating contract (scaffold)");
   }
   if (opts.gates) {
+    const existingPrePush = await readText(path.join(root, ".githooks", "pre-push"));
     await add(".githooks/pre-commit", generatePreCommitHook(), "Process gate (pre-commit)", true);
-    await add(".githooks/pre-push", generatePrePushHook(facts), "Correctness gate (pre-push)", true);
+    await add(
+      ".githooks/commit-msg",
+      generateCommitMsgHook(),
+      "Content screen (commit message)",
+      true
+    );
+    const gateConfig = opts.gateConfig?.commands?.length ? opts.gateConfig : {
+      commands: derivedCommands(facts, existingPrePush ?? void 0),
+      failOn: opts.gateConfig?.failOn ?? DEFAULT_CONFIG.gates.failOn,
+      publishGate: opts.gateConfig?.publishGate,
+      allowWriting: opts.gateConfig?.allowWriting ?? []
+    };
+    await add(
+      ".githooks/pre-push",
+      generatePrePushHook(facts, gateConfig),
+      "Correctness gate (pre-push)",
+      true
+    );
+    if (opts.gateConfig?.publishGate ?? opts.publishGate ?? facts.publishable) {
+      await add(
+        "scripts/artifact-check.sh",
+        generateArtifactCheckScript(),
+        "Content screen (published artifact)",
+        true
+      );
+    }
   }
   return out;
 }
 
-export { applyFiles, planWorkflow };
+export { derivedCommands, isSafeGateCommand, planWorkflow, runPrefix };

package/dist/{chunk-KBF3SW3N.js → chunk-WWBF4Y7K.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { readJson } from './chunk-LBRNZZZF.js';
+import { readJson } from './chunk-YLNQQZ5F.js';
 import { promises } from 'node:fs';
 import path from 'node:path';
 

package/dist/chunk-YLNQQZ5F.js

@@ -0,0 +1,102 @@
+#!/usr/bin/env node
+import { execFile } from 'node:child_process';
+import { promises } from 'node:fs';
+import { promisify } from 'node:util';
+
+var pExecFile = promisify(execFile);
+async function pathExists(p) {
+  try {
+    await promises.access(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function readJson(p) {
+  try {
+    const raw = await promises.readFile(p, "utf8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+async function readText(p) {
+  try {
+    return await promises.readFile(p, "utf8");
+  } catch {
+    return null;
+  }
+}
+async function isDirectory(p) {
+  try {
+    return (await promises.stat(p)).isDirectory();
+  } catch {
+    return false;
+  }
+}
+async function git(root, args) {
+  try {
+    const { stdout } = await pExecFile("git", args, { cwd: root, timeout: 4e3 });
+    return stdout.trim();
+  } catch {
+    return null;
+  }
+}
+function wordCount(text) {
+  const m = text.trim().match(/\S+/g);
+  return m ? m.length : 0;
+}
+function approxTokens(words) {
+  return Math.round(words / 0.75);
+}
+var CI_ENV_VARS = [
+  "CI",
+  "GITHUB_ACTIONS",
+  "GITLAB_CI",
+  "BUILDKITE",
+  "CIRCLECI",
+  "JENKINS_URL",
+  "TF_BUILD"
+];
+function isCiEnvironment() {
+  return CI_ENV_VARS.some((v) => Boolean(process.env[v]));
+}
+function normalizeRelPath(p) {
+  return p.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, "");
+}
+function globToRegExp(glob) {
+  let re = "";
+  for (let i = 0; i < glob.length; i++) {
+    const c = glob[i];
+    if (c === "*") {
+      if (glob[i + 1] === "*") {
+        i += 1;
+        if (glob[i + 1] === "/") {
+          i += 1;
+          re += "(?:.*/)?";
+        } else {
+          re += ".*";
+        }
+      } else {
+        re += "[^/]*";
+      }
+    } else if (c === "?") {
+      re += "[^/]";
+    } else {
+      re += c.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+    }
+  }
+  return new RegExp(`^${re}$`);
+}
+function matchesGlob(p, glob) {
+  const target = normalizeRelPath(p);
+  const pattern = normalizeRelPath(glob);
+  if (!pattern) return false;
+  if (!/[*?]/.test(pattern)) return target === pattern || target.startsWith(pattern + "/");
+  return globToRegExp(pattern).test(target);
+}
+function matchesAnyGlob(p, globs) {
+  return globs.some((g) => matchesGlob(p, g));
+}
+
+export { approxTokens, git, isCiEnvironment, isDirectory, matchesAnyGlob, normalizeRelPath, pathExists, readJson, readText, wordCount };