gateproof 0.1.0 → 0.2.0

package/dist/prd/runner.js

@@ -0,0 +1,221 @@
+import { resolve } from "path";
+import { readFileSync } from "node:fs";
+import { serializeError } from "../report";
+import { validateScope, getDiffStats } from "./scope-check";
+/**
+ * Validates that all story dependencies exist and there are no cycles.
+ */
+function validateDependencies(stories) {
+    const byId = new Map(stories.map((s) => [s.id, s]));
+    for (const story of stories) {
+        const deps = story.dependsOn ?? [];
+        for (const depId of deps) {
+            if (!byId.has(depId)) {
+                throw new Error(`Story "${story.id}" depends on unknown story "${depId}"`);
+            }
+        }
+    }
+}
+/**
+ * Topologically sorts stories by their dependencies.
+ * Throws if there's a cycle or missing dependency.
+ */
+function orderStories(stories) {
+    validateDependencies(stories);
+    const byId = new Map(stories.map((s) => [s.id, s]));
+    const out = [];
+    const remaining = new Set(stories.map((s) => s.id));
+    const visiting = new Set();
+    function visit(id) {
+        if (visiting.has(id)) {
+            throw new Error(`PRD dependency cycle detected involving "${id}"`);
+        }
+        if (!remaining.has(id)) {
+            return;
+        }
+        visiting.add(id);
+        const story = byId.get(id);
+        if (!story) {
+            throw new Error(`Unknown story id: ${id}`);
+        }
+        const deps = story.dependsOn ?? [];
+        for (const depId of deps) {
+            visit(depId);
+        }
+        visiting.delete(id);
+        remaining.delete(id);
+        out.push(story);
+    }
+    while (remaining.size > 0) {
+        const nextId = Array.from(remaining)[0];
+        visit(nextId);
+    }
+    return out;
+}
+/**
+ * Loads default forbidden paths from .gateproof/scope.defaults.json
+ */
+function loadDefaultForbidden(cwd) {
+    try {
+        const defaultsPath = resolve(cwd, ".gateproof/scope.defaults.json");
+        const content = readFileSync(defaultsPath, "utf-8");
+        const parsed = JSON.parse(content);
+        return parsed.forbiddenPaths ?? [];
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Runs a PRD by executing story gates in dependency order.
+ * Stops on first failure.
+ *
+ * @param options.reportPath - If provided, writes a structured JSON report to this path
+ * @param options.checkScope - If true, validates scope constraints against git diff
+ * @param options.baseRef - Git ref to compare against for scope checking (default: "HEAD" for local, "origin/main" for CI)
+ */
+export async function runPrd(prd, cwd = process.cwd(), options = {}) {
+    const ordered = orderStories(prd.stories);
+    const storyResults = [];
+    const startTime = Date.now();
+    const defaultForbidden = loadDefaultForbidden(cwd);
+    const baseRef = options.baseRef ?? (process.env.CI ? "origin/main" : "HEAD");
+    for (const story of ordered) {
+        const storyStartTime = Date.now();
+        let storyError;
+        try {
+            if (options.checkScope && story.scope) {
+                const diffStats = getDiffStats(baseRef);
+                const violations = validateScope(story, diffStats, defaultForbidden);
+                if (violations.length > 0) {
+                    const violation = violations[0];
+                    storyError = {
+                        name: "ScopeViolation",
+                        message: violation.message,
+                        tag: violation.category,
+                    };
+                    storyResults.push({
+                        id: story.id,
+                        title: story.title,
+                        gateFile: story.gateFile,
+                        status: "failed",
+                        durationMs: Date.now() - storyStartTime,
+                        error: storyError,
+                    });
+                    return {
+                        success: false,
+                        failedStory: story,
+                        error: new Error(violation.message),
+                        report: {
+                            version: "1",
+                            success: false,
+                            stories: storyResults,
+                            failedStory: {
+                                id: story.id,
+                                title: story.title,
+                                gateFile: story.gateFile,
+                            },
+                            totalDurationMs: Date.now() - startTime,
+                        },
+                    };
+                }
+            }
+            const gatePath = resolve(cwd, story.gateFile);
+            const mod = await import(`file://${gatePath}`);
+            const run = mod.run;
+            if (typeof run !== "function") {
+                throw new Error(`Gate file must export "run" function: ${story.gateFile}`);
+            }
+            console.log(`\n--- ${story.id}: ${story.title}`);
+            const result = (await run());
+            const durationMs = Date.now() - storyStartTime;
+            if (result.status !== "success") {
+                storyError = result.error ? serializeError(result.error) : {
+                    name: "GateFailed",
+                    message: `Gate failed with status: ${result.status}`,
+                };
+                storyResults.push({
+                    id: story.id,
+                    title: story.title,
+                    gateFile: story.gateFile,
+                    status: result.status,
+                    durationMs,
+                    error: storyError,
+                });
+                const report = {
+                    version: "1",
+                    success: false,
+                    stories: storyResults,
+                    failedStory: {
+                        id: story.id,
+                        title: story.title,
+                        gateFile: story.gateFile,
+                    },
+                    totalDurationMs: Date.now() - startTime,
+                };
+                if (options.reportPath) {
+                    const { writeFileSync } = await import("node:fs");
+                    writeFileSync(options.reportPath, JSON.stringify(report, null, 2));
+                }
+                return {
+                    success: false,
+                    failedStory: story,
+                    error: new Error(`Gate failed with status: ${result.status}`),
+                    report,
+                };
+            }
+            storyResults.push({
+                id: story.id,
+                title: story.title,
+                gateFile: story.gateFile,
+                status: "success",
+                durationMs,
+            });
+        }
+        catch (error) {
+            const durationMs = Date.now() - storyStartTime;
+            storyError = serializeError(error);
+            storyResults.push({
+                id: story.id,
+                title: story.title,
+                gateFile: story.gateFile,
+                status: "failed",
+                durationMs,
+                error: storyError,
+            });
+            const report = {
+                version: "1",
+                success: false,
+                stories: storyResults,
+                failedStory: {
+                    id: story.id,
+                    title: story.title,
+                    gateFile: story.gateFile,
+                },
+                totalDurationMs: Date.now() - startTime,
+            };
+            if (options.reportPath) {
+                const { writeFileSync } = await import("node:fs");
+                writeFileSync(options.reportPath, JSON.stringify(report, null, 2));
+            }
+            return {
+                success: false,
+                failedStory: story,
+                error: error instanceof Error ? error : new Error(String(error)),
+                report,
+            };
+        }
+    }
+    const report = {
+        version: "1",
+        success: true,
+        stories: storyResults,
+        totalDurationMs: Date.now() - startTime,
+    };
+    if (options.reportPath) {
+        const { writeFileSync } = await import("node:fs");
+        writeFileSync(options.reportPath, JSON.stringify(report, null, 2));
+    }
+    return { success: true, report };
+}
+//# sourceMappingURL=runner.js.map

package/dist/prd/runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.js","sourceRoot":"","sources":["../../src/prd/runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAGvC,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,YAAY,EAAuB,MAAM,eAAe,CAAC;AASjF;;GAEG;AACH,SAAS,oBAAoB,CAC3B,OAA8B;IAE9B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAEpD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;QACnC,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CACb,UAAU,KAAK,CAAC,EAAE,+BAA+B,KAAK,GAAG,CAC1D,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CACnB,OAA8B;IAE9B,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAE9B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAO,CAAC;IAEhC,SAAS,KAAK,CAAC,EAAO;QACpB,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,4CAA4C,EAAE,GAAG,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QAED,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;QACnC,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,KAAK,CAAC,KAAK,CAAC,CAAC;QACf,CAAC;QAED,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpB,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,SAAS,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChB,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,GAAW;IACvC,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAkC,CAAC;QACpE,OAAO,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,GAAa,EACb,MAAc,OAAO,CAAC,GAAG,EAAE,EAC3B,UAII,EAAE;IAEN,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,YAAY,GAAoB,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAE7E,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAClC,IAAI,UAAyC,CAAC;QAE9C,IAAI,CAAC;YACH,IAAI,OAAO,CAAC,UAAU,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;gBACtC,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;gBACxC,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC;gBACrE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC1B,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;oBAChC,UAAU,GAAG;wBACX,IAAI,EAAE,gBAAgB;wBACtB,OAAO,EAAE,SAAS,CAAC,OAAO;wBAC1B,GAAG,EAAE,SAAS,CAAC,QAAQ;qBACxB,CAAC;oBACF,YAAY,CAAC,IAAI,CAAC;wBAChB,EAAE,EAAE,KAAK,CAAC,EAAE;wBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;wBAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;wBACxB,MAAM,EAAE,QAAQ;wBAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc;wBACvC,KAAK,EAAE,UAAU;qBAClB,CAAC,CAAC;oBACH,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,WAAW,EAAE,KAAK;wBAClB,KAAK,EAAE,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC;wBACnC,MAAM,EAAE;4BACN,OAAO,EAAE,GAAG;4BACZ,OAAO,EAAE,KAAK;4BACd,OAAO,EAAE,YAAY;4BACrB,WAAW,EAAE;gCACX,EAAE,EAAE,KAAK,CAAC,EAAE;gCACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gCAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;6BACzB;4BACD,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;yBACxC;qBACF,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC9C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,QAAQ,EAAE,CAAC,CAAC;YAC/C,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;YAEpB,IAAI,OAAO,GAAG,KAAK,UAAU,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,yCAAyC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC7E,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,EAAE,CAAe,CAAC;YAE3C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC;YAE/C,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBACzD,IAAI,EAAE,YAAY;oBAClB,OAAO,EAAE,4BAA4B,MAAM,CAAC,MAAM,EAAE;iBACrD,CAAC;gBACF,YAAY,CAAC,IAAI,CAAC;oBAChB,EAAE,EAAE,KAAK,CAAC,EAAE;oBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,UAAU;oBACV,KAAK,EAAE,UAAU;iBAClB,CAAC,CAAC;gBACH,MAAM,MAAM,GAAgB;oBAC1B,OAAO,EAAE,GAAG;oBACZ,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE,YAAY;oBACrB,WAAW,EAAE;wBACX,EAAE,EAAE,KAAK,CAAC,EAAE;wBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;wBAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;qBACzB;oBACD,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACxC,CAAC;gBACF,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;oBACvB,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;oBAClD,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBACrE,CAAC;gBACD,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,WAAW,EAAE,KAAK;oBAClB,KAAK,EAAE,IAAI,KAAK,CAAC,4BAA4B,MAAM,CAAC,MAAM,EAAE,CAAC;oBAC7D,MAAM;iBACP,CAAC;YACJ,CAAC;YAED,YAAY,CAAC,IAAI,CAAC;gBAChB,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,MAAM,EAAE,SAAS;gBACjB,UAAU;aACX,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC;YAC/C,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YACnC,YAAY,CAAC,IAAI,CAAC;gBAChB,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,MAAM,EAAE,QAAQ;gBAChB,UAAU;gBACV,KAAK,EAAE,UAAU;aAClB,CAAC,CAAC;YACH,MAAM,MAAM,GAAgB;gBAC1B,OAAO,EAAE,GAAG;gBACZ,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,YAAY;gBACrB,WAAW,EAAE;oBACX,EAAE,EAAE,KAAK,CAAC,EAAE;oBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;iBACzB;gBACD,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACxC,CAAC;YACF,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;gBACvB,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;gBAClD,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACrE,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,WAAW,EAAE,KAAK;gBAClB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChE,MAAM;aACP,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAgB;QAC1B,OAAO,EAAE,GAAG;QACZ,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,YAAY;QACrB,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;KACxC,CAAC;IAEF,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QAClD,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACnC,CAAC"}

package/dist/prd/scope-check.d.ts

@@ -0,0 +1,28 @@
+import type { Story } from "./types";
+export interface ScopeViolation {
+    category: "scope_violation";
+    message: string;
+    details: {
+        storyId: string;
+        violation: "forbidden_path" | "max_files_exceeded" | "max_lines_exceeded" | "default_forbidden";
+        path?: string;
+        actualFiles?: number;
+        maxFiles?: number;
+        actualLines?: number;
+        maxLines?: number;
+    };
+}
+export interface DiffStats {
+    changedFiles: string[];
+    totalLines: number;
+}
+/**
+ * Gets git diff stats against a base ref.
+ * For CI PRs, use origin/main. For local, use HEAD or a passed ref.
+ */
+export declare function getDiffStats(baseRef?: string): DiffStats;
+/**
+ * Validates that changed files match the story's scope constraints.
+ */
+export declare function validateScope(story: Story, diffStats: DiffStats, defaultForbidden?: string[]): ScopeViolation[];
+//# sourceMappingURL=scope-check.d.ts.map

package/dist/prd/scope-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-check.d.ts","sourceRoot":"","sources":["../../src/prd/scope-check.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAc,MAAM,SAAS,CAAC;AAEjD,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE;QACP,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,gBAAgB,GAAG,oBAAoB,GAAG,oBAAoB,GAAG,mBAAmB,CAAC;QAChG,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AAED,MAAM,WAAW,SAAS;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,OAAO,GAAE,MAAe,GAAG,SAAS,CA8BhE;AAiBD;;GAEG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,KAAK,EACZ,SAAS,EAAE,SAAS,EACpB,gBAAgB,GAAE,MAAM,EAAO,GAC9B,cAAc,EAAE,CAyFlB"}

package/dist/prd/scope-check.js

@@ -0,0 +1,135 @@
+import { execSync } from "node:child_process";
+import { resolve } from "node:path";
+/**
+ * Gets git diff stats against a base ref.
+ * For CI PRs, use origin/main. For local, use HEAD or a passed ref.
+ */
+export function getDiffStats(baseRef = "HEAD") {
+    try {
+        const changedFiles = execSync(`git diff --name-only ${baseRef}`, {
+            encoding: "utf-8",
+            cwd: process.cwd(),
+        })
+            .trim()
+            .split("\n")
+            .filter((f) => f.length > 0);
+        let totalLines = 0;
+        if (changedFiles.length > 0) {
+            const diffStat = execSync(`git diff --shortstat ${baseRef}`, {
+                encoding: "utf-8",
+                cwd: process.cwd(),
+            }).trim();
+            const match = diffStat.match(/(\d+)\s+files? changed/);
+            if (match) {
+                const linesMatch = diffStat.match(/(\d+)\s+insertions?/);
+                const deletionsMatch = diffStat.match(/(\d+)\s+deletions?/);
+                const insertions = linesMatch ? parseInt(linesMatch[1], 10) : 0;
+                const deletions = deletionsMatch ? parseInt(deletionsMatch[1], 10) : 0;
+                totalLines = insertions + deletions;
+            }
+        }
+        return { changedFiles, totalLines };
+    }
+    catch (error) {
+        throw new Error(`Failed to get git diff stats: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+/**
+ * Checks if a path matches any of the glob patterns.
+ * Simple prefix/suffix matching for now (not full glob).
+ */
+function matchesPattern(path, pattern) {
+    if (pattern.includes("**")) {
+        const prefix = pattern.replace(/\*\*/g, "");
+        return path.startsWith(prefix);
+    }
+    if (pattern.endsWith("*")) {
+        return path.startsWith(pattern.slice(0, -1));
+    }
+    return path === pattern;
+}
+/**
+ * Validates that changed files match the story's scope constraints.
+ */
+export function validateScope(story, diffStats, defaultForbidden = []) {
+    const violations = [];
+    const scope = story.scope;
+    if (!scope) {
+        return violations;
+    }
+    const { changedFiles, totalLines } = diffStats;
+    for (const file of changedFiles) {
+        const filePath = resolve(process.cwd(), file);
+        if (scope.forbiddenPaths) {
+            for (const forbidden of scope.forbiddenPaths) {
+                if (matchesPattern(file, forbidden)) {
+                    violations.push({
+                        category: "scope_violation",
+                        message: `Story "${story.id}" changed forbidden path: ${file}`,
+                        details: {
+                            storyId: story.id,
+                            violation: "forbidden_path",
+                            path: file,
+                        },
+                    });
+                }
+            }
+        }
+        for (const forbidden of defaultForbidden) {
+            if (matchesPattern(file, forbidden)) {
+                const isAllowed = scope.allowedPaths?.some((allowed) => matchesPattern(file, allowed));
+                if (!isAllowed) {
+                    violations.push({
+                        category: "scope_violation",
+                        message: `Story "${story.id}" changed default-forbidden path: ${file}`,
+                        details: {
+                            storyId: story.id,
+                            violation: "default_forbidden",
+                            path: file,
+                        },
+                    });
+                }
+            }
+        }
+        if (scope.allowedPaths && scope.allowedPaths.length > 0) {
+            const isAllowed = scope.allowedPaths.some((allowed) => matchesPattern(file, allowed));
+            if (!isAllowed) {
+                violations.push({
+                    category: "scope_violation",
+                    message: `Story "${story.id}" changed path outside allowed scope: ${file}`,
+                    details: {
+                        storyId: story.id,
+                        violation: "forbidden_path",
+                        path: file,
+                    },
+                });
+            }
+        }
+    }
+    if (scope.maxChangedFiles !== undefined && changedFiles.length > scope.maxChangedFiles) {
+        violations.push({
+            category: "scope_violation",
+            message: `Story "${story.id}" changed ${changedFiles.length} files, max allowed: ${scope.maxChangedFiles}`,
+            details: {
+                storyId: story.id,
+                violation: "max_files_exceeded",
+                actualFiles: changedFiles.length,
+                maxFiles: scope.maxChangedFiles,
+            },
+        });
+    }
+    if (scope.maxChangedLines !== undefined && totalLines > scope.maxChangedLines) {
+        violations.push({
+            category: "scope_violation",
+            message: `Story "${story.id}" changed ${totalLines} lines, max allowed: ${scope.maxChangedLines}`,
+            details: {
+                storyId: story.id,
+                violation: "max_lines_exceeded",
+                actualLines: totalLines,
+                maxLines: scope.maxChangedLines,
+            },
+        });
+    }
+    return violations;
+}
+//# sourceMappingURL=scope-check.js.map

package/dist/prd/scope-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-check.js","sourceRoot":"","sources":["../../src/prd/scope-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAsBpC;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,UAAkB,MAAM;IACnD,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,QAAQ,CAAC,wBAAwB,OAAO,EAAE,EAAE;YAC/D,QAAQ,EAAE,OAAO;YACjB,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;SACnB,CAAC;aACC,IAAI,EAAE;aACN,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAE/B,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,QAAQ,CAAC,wBAAwB,OAAO,EAAE,EAAE;gBAC3D,QAAQ,EAAE,OAAO;gBACjB,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;aACnB,CAAC,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;YACvD,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;gBACzD,MAAM,cAAc,GAAG,QAAQ,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;gBAC5D,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAChE,MAAM,SAAS,GAAG,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACvE,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;YACtC,CAAC;QACH,CAAC;QAED,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7G,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,IAAY,EAAE,OAAe;IACnD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,IAAI,KAAK,OAAO,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAY,EACZ,SAAoB,EACpB,mBAA6B,EAAE;IAE/B,MAAM,UAAU,GAAqB,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAE1B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,SAAS,CAAC;IAE/C,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAE9C,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;YACzB,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;gBAC7C,IAAI,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;oBACpC,UAAU,CAAC,IAAI,CAAC;wBACd,QAAQ,EAAE,iBAAiB;wBAC3B,OAAO,EAAE,UAAU,KAAK,CAAC,EAAE,6BAA6B,IAAI,EAAE;wBAC9D,OAAO,EAAE;4BACP,OAAO,EAAE,KAAK,CAAC,EAAE;4BACjB,SAAS,EAAE,gBAAgB;4BAC3B,IAAI,EAAE,IAAI;yBACX;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,KAAK,MAAM,SAAS,IAAI,gBAAgB,EAAE,CAAC;YACzC,IAAI,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;gBACpC,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;gBACvF,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,UAAU,CAAC,IAAI,CAAC;wBACd,QAAQ,EAAE,iBAAiB;wBAC3B,OAAO,EAAE,UAAU,KAAK,CAAC,EAAE,qCAAqC,IAAI,EAAE;wBACtE,OAAO,EAAE;4BACP,OAAO,EAAE,KAAK,CAAC,EAAE;4BACjB,SAAS,EAAE,mBAAmB;4BAC9B,IAAI,EAAE,IAAI;yBACX;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxD,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;YACtF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,UAAU,CAAC,IAAI,CAAC;oBACd,QAAQ,EAAE,iBAAiB;oBAC3B,OAAO,EAAE,UAAU,KAAK,CAAC,EAAE,yCAAyC,IAAI,EAAE;oBAC1E,OAAO,EAAE;wBACP,OAAO,EAAE,KAAK,CAAC,EAAE;wBACjB,SAAS,EAAE,gBAAgB;wBAC3B,IAAI,EAAE,IAAI;qBACX;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,IAAI,YAAY,CAAC,MAAM,GAAG,KAAK,CAAC,eAAe,EAAE,CAAC;QACvF,UAAU,CAAC,IAAI,CAAC;YACd,QAAQ,EAAE,iBAAiB;YAC3B,OAAO,EAAE,UAAU,KAAK,CAAC,EAAE,aAAa,YAAY,CAAC,MAAM,wBAAwB,KAAK,CAAC,eAAe,EAAE;YAC1G,OAAO,EAAE;gBACP,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,SAAS,EAAE,oBAAoB;gBAC/B,WAAW,EAAE,YAAY,CAAC,MAAM;gBAChC,QAAQ,EAAE,KAAK,CAAC,eAAe;aAChC;SACF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,IAAI,UAAU,GAAG,KAAK,CAAC,eAAe,EAAE,CAAC;QAC9E,UAAU,CAAC,IAAI,CAAC;YACd,QAAQ,EAAE,iBAAiB;YAC3B,OAAO,EAAE,UAAU,KAAK,CAAC,EAAE,aAAa,UAAU,wBAAwB,KAAK,CAAC,eAAe,EAAE;YACjG,OAAO,EAAE;gBACP,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,SAAS,EAAE,oBAAoB;gBAC/B,WAAW,EAAE,UAAU;gBACvB,QAAQ,EAAE,KAAK,CAAC,eAAe;aAChC;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/prd/types.d.ts

@@ -0,0 +1,21 @@
+export interface StoryScope {
+    allowedPaths?: string[];
+    forbiddenPaths?: string[];
+    maxChangedFiles?: number;
+    maxChangedLines?: number;
+}
+export type Story<TId extends string = string> = {
+    id: TId;
+    title: string;
+    gateFile: string;
+    dependsOn?: TId[];
+    scope?: StoryScope;
+};
+export type Prd<TId extends string = string> = {
+    stories: readonly Story<TId>[];
+};
+export type GateResult = {
+    status: "success" | "failed" | "timeout";
+    [key: string]: unknown;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/prd/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/prd/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,UAAU;IACzB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,KAAK,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM,IAAI;IAC/C,EAAE,EAAE,GAAG,CAAC;IACR,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,GAAG,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM,IAAI;IAC7C,OAAO,EAAE,SAAS,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;IACzC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC"}

package/dist/prd/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/prd/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/prd/types.ts"],"names":[],"mappings":""}

package/dist/report.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Stable, versioned report schemas for machine-readable gate outputs.
+ * All types are fully JSON-serializable (no Error objects, no functions).
+ */
+export interface SerializableError {
+    tag?: string;
+    name: string;
+    message: string;
+    stack?: string;
+}
+export interface GateResultV1 {
+    version: "1";
+    status: "success" | "failed" | "timeout";
+    durationMs: number;
+    logs: unknown[];
+    evidence: {
+        requestIds: string[];
+        stagesSeen: string[];
+        actionsSeen: string[];
+        errorTags: string[];
+    };
+    error?: SerializableError;
+}
+export interface StoryResultV1 {
+    id: string;
+    title: string;
+    gateFile: string;
+    status: "success" | "failed" | "timeout";
+    durationMs: number;
+    error?: SerializableError;
+}
+export interface PrdReportV1 {
+    version: "1";
+    success: boolean;
+    stories: StoryResultV1[];
+    failedStory?: {
+        id: string;
+        title: string;
+        gateFile: string;
+    };
+    totalDurationMs: number;
+}
+/**
+ * Converts an Error (or Error-like object) into a SerializableError.
+ * Preserves Effect-tagged errors (_tag) when present.
+ */
+export declare function serializeError(error: unknown): SerializableError;
+/**
+ * Sorts arrays deterministically (alphabetically) for stable output.
+ */
+export declare function sortDeterministic<T>(arr: T[]): T[];
+/**
+ * Converts a GateResult to a fully serializable GateResultV1.
+ */
+export declare function toGateResultV1(result: {
+    status: "success" | "failed" | "timeout";
+    durationMs: number;
+    logs: unknown[];
+    evidence: {
+        requestIds: string[];
+        stagesSeen: string[];
+        actionsSeen: string[];
+        errorTags: string[];
+    };
+    error?: Error | unknown;
+}): GateResultV1;
+//# sourceMappingURL=report.d.ts.map

package/dist/report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,GAAG,CAAC;IACb,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,OAAO,EAAE,CAAC;IAChB,QAAQ,EAAE;QACR,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,SAAS,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;IACF,KAAK,CAAC,EAAE,iBAAiB,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,iBAAiB,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,GAAG,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,WAAW,CAAC,EAAE;QACZ,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB,CAwBhE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAElD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE;IACrC,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,OAAO,EAAE,CAAC;IAChB,QAAQ,EAAE;QACR,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,SAAS,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;IACF,KAAK,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC;CACzB,GAAG,YAAY,CASf"}

package/dist/report.js

@@ -0,0 +1,51 @@
+/**
+ * Stable, versioned report schemas for machine-readable gate outputs.
+ * All types are fully JSON-serializable (no Error objects, no functions).
+ */
+/**
+ * Converts an Error (or Error-like object) into a SerializableError.
+ * Preserves Effect-tagged errors (_tag) when present.
+ */
+export function serializeError(error) {
+    if (error instanceof Error) {
+        const errorWithTag = error;
+        return {
+            tag: errorWithTag._tag,
+            name: error.name || "Error",
+            message: error.message || String(error),
+            stack: error.stack,
+        };
+    }
+    if (error && typeof error === "object" && "_tag" in error) {
+        const tagged = error;
+        return {
+            tag: tagged._tag,
+            name: tagged._tag,
+            message: tagged.message || String(error),
+        };
+    }
+    return {
+        name: "Error",
+        message: String(error),
+    };
+}
+/**
+ * Sorts arrays deterministically (alphabetically) for stable output.
+ */
+export function sortDeterministic(arr) {
+    return [...arr].sort();
+}
+/**
+ * Converts a GateResult to a fully serializable GateResultV1.
+ */
+export function toGateResultV1(result) {
+    return {
+        version: "1",
+        status: result.status,
+        durationMs: result.durationMs,
+        logs: result.logs,
+        evidence: result.evidence,
+        error: result.error ? serializeError(result.error) : undefined,
+    };
+}
+//# sourceMappingURL=report.js.map

package/dist/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA4CH;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,MAAM,YAAY,GAAG,KAAkC,CAAC;QACxD,OAAO;YACL,GAAG,EAAE,YAAY,CAAC,IAAI;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,OAAO;YAC3B,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC;YACvC,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,KAAiE,CAAC;QACjF,OAAO;YACL,GAAG,EAAE,MAAM,CAAC,IAAI;YAChB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC;SACzC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC;KACvB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAI,GAAQ;IAC3C,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,MAW9B;IACC,OAAO;QACL,OAAO,EAAE,GAAG;QACZ,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;KAC/D,CAAC;AACJ,CAAC"}

package/dist/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAQ,KAAK,QAAQ,EAAE,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAyB,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AAEhE;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,OAAO,CAS5C;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,wCAEzC;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,QAAQ,EACd,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,UAAU,CAAC,CAarB"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAQ,KAAK,QAAQ,EAAE,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAyB,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AAGhE;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,OAAO,CAU5C;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,wCAEzC;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,QAAQ,EACd,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,UAAU,CAAC,CAcrB"}

package/dist/utils.js

@@ -34,8 +34,9 @@ export async function runGateWithErrorHandling(gate, name) {
     try {
         return await Gate.run(gate);
     }
-    catch (error) {
-        console.error(`   ❌ Error: ${error.message || error}`);
+    catch (unknownError) {
+        const error = unknownError instanceof Error ? unknownError : new Error(String(unknownError));
+        console.error(`   ❌ Error: ${error.message}`);
         return {
             status: "failed",
             durationMs: 0,

package/dist/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,IAAI,EAAkC,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAgB,MAAM,WAAW,CAAC;AAEhE;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO;QACL,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAqB;YAC9C,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC;gBAC3B,OAAO;YACT,CAAC;SACF,CAAC;QACF,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI;KACxB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B;IACxC,OAAO,qBAAqB,CAAC,kBAAkB,EAAE,CAAC,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAc,EACd,IAAY;IAEZ,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,eAAe,KAAK,CAAC,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC;QACvD,OAAO;YACL,MAAM,EAAE,QAAiB;YACzB,UAAU,EAAE,CAAC;YACb,IAAI,EAAE,EAAE;YACR,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;YAC5E,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;SACjE,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,IAAI,EAAkC,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAgB,MAAM,WAAW,CAAC;AAGhE;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO;QACL,KAAK,EAAE,GAAG,EAAE,CACV,MAAM,CAAC,OAAO,CAAqB;YACnC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC;gBAC3B,OAAO;YACT,CAAC;SACF,CAAC;QACF,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI;KACxB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B;IACxC,OAAO,qBAAqB,CAAC,kBAAkB,EAAE,CAAC,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAc,EACd,IAAY;IAEZ,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,YAAY,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,YAAY,YAAY,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;QAC7F,OAAO,CAAC,KAAK,CAAC,eAAe,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9C,OAAO;YACL,MAAM,EAAE,QAAiB;YACzB,UAAU,EAAE,CAAC;YACb,IAAI,EAAE,EAAE;YACR,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;YAC5E,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;SACjE,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../src/validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEpC,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAQjF;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAUzE;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CASjF"}
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../src/validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEpC,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAQjF;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAUzE;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAgBjF"}

package/dist/validation.js

@@ -25,9 +25,13 @@ export function validateCommand(command) {
     if (!command || typeof command !== "string") {
         return Effect.fail(new GateError({ cause: new Error("Command must be a non-empty string") }));
     }
-    const dangerous = /[;&|`$(){}[\]<>]/;
-    if (dangerous.test(command)) {
-        return Effect.fail(new GateError({ cause: new Error("Command contains dangerous characters") }));
+    // Extremely strict shell safety: block common shell metacharacters and expansion patterns
+    const dangerous = /[;&|`$(){}[\]<>\\'"\n\r\t]/;
+    const envExpansion = /\$\w+|\$\{[^}]+\}/;
+    if (dangerous.test(command) || envExpansion.test(command)) {
+        return Effect.fail(new GateError({
+            cause: new Error("Command contains potentially dangerous shell characters")
+        }));
     }
     return Effect.succeed(command);
 }

package/dist/validation.js.map

@@ -1 +1 @@
-{"version":3,"file":"validation.js","sourceRoot":"","sources":["../src/validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEpC,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,wCAAwC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,yCAAyC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,qCAAqC,CAAC,EAAE,CAAC,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,oCAAoC,CAAC,EAAE,CAAC,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,SAAS,GAAG,kBAAkB,CAAC;IACrC,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,uCAAuC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC"}
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../src/validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEpC,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,wCAAwC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,yCAAyC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,qCAAqC,CAAC,EAAE,CAAC,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,oCAAoC,CAAC,EAAE,CAAC,CAAC,CAAC;IAChG,CAAC;IACD,0FAA0F;IAC1F,MAAM,SAAS,GACb,4BAA4B,CAAC;IAC/B,MAAM,YAAY,GAAG,mBAAmB,CAAC;IACzC,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1D,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,SAAS,CAAC;YACZ,KAAK,EAAE,IAAI,KAAK,CAAC,yDAAyD,CAAC;SAC5E,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC"}