glirastes 0.3.2 → 0.5.0

package/dist/codegen/route-fingerprint.js

@@ -0,0 +1,9 @@
+import { createHash } from 'node:crypto';
+export function createRouteSourceFingerprint(source, method, path) {
+    const normalized = source.replace(/\r\n/g, '\n');
+    const hash = createHash('sha256')
+        .update(`${method}\n${path}\n${normalized}`)
+        .digest('base64url');
+    return `sha256:${hash}`;
+}
+//# sourceMappingURL=route-fingerprint.js.map

package/dist/codegen/route-fingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-fingerprint.js","sourceRoot":"","sources":["../../src/codegen/route-fingerprint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,MAAM,UAAU,4BAA4B,CAC1C,MAAc,EACd,MAAsB,EACtB,IAAY;IAEZ,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC;SAC9B,MAAM,CAAC,GAAG,MAAM,KAAK,IAAI,KAAK,UAAU,EAAE,CAAC;SAC3C,MAAM,CAAC,WAAW,CAAC,CAAC;IACvB,OAAO,UAAU,IAAI,EAAE,CAAC;AAC1B,CAAC"}

package/dist/codegen/route-scanner.d.ts

@@ -0,0 +1,57 @@
+import { type DiscoveredFoundationExecution, type FoundationExecutionInventory } from './execution-inventory.js';
+import { type RouteExportFinding } from './route-exports.js';
+import type { EndpointMethod } from '../types.js';
+import type { ToolRiskClass } from '../contracts/index.js';
+export { createRouteSourceFingerprint } from './route-fingerprint.js';
+export interface ScannedQueryParameter {
+    name: string;
+    repeated: boolean;
+}
+export interface ScannedSchemaBinding {
+    symbol: string;
+    module: string;
+}
+export interface ScannedRouteCandidate {
+    sourceFile: string;
+    sourceFingerprint: string;
+    exportName: EndpointMethod;
+    method: EndpointMethod;
+    path: string;
+    pathParams: string[];
+    queryParams: ScannedQueryParameter[];
+    schemaBindings: ScannedSchemaBinding[];
+    authEvidence: string[];
+    externalCallEvidence: string[];
+    riskClass: ToolRiskClass;
+    autoApprovalEligible: false;
+    reviewReasons: string[];
+}
+export interface NextAppRouteScanResult {
+    candidates: ScannedRouteCandidate[];
+    ignored: string[];
+    findings?: Array<RouteExportFinding & {
+        sourceFile: string;
+    }>;
+    executions?: DiscoveredFoundationExecution[];
+    inventoryDigest?: string;
+}
+export interface ScanNextAppRoutesOptions {
+    rootDir: string;
+    apiDir?: string;
+    mode?: 'legacy-route-scan' | 'foundation-inventory' | 'source-discovery';
+    inventory?: FoundationExecutionInventory;
+}
+export interface WriteNextAppRouteScanOptions extends ScanNextAppRoutesOptions {
+    outputPath?: string;
+    now?: () => Date;
+}
+export declare const AUTH_PATTERNS: Array<[string, RegExp]>;
+export declare function toRoutePath(apiDir: string, routeFile: string): {
+    path: string;
+    pathParams: string[];
+};
+export declare function scanNextAppRoutes(options: ScanNextAppRoutesOptions): Promise<NextAppRouteScanResult>;
+export declare function writeNextAppRouteScan(options: WriteNextAppRouteScanOptions): Promise<{
+    outputPath: string;
+    result: NextAppRouteScanResult;
+}>;

package/dist/codegen/route-scanner.js

@@ -0,0 +1,233 @@
+import { mkdir, writeFile, readFile, readdir, realpath, stat } from 'node:fs/promises';
+import { dirname, join, relative, resolve, sep } from 'node:path';
+import { findRouteFiles, isDirAiIgnored, readFileSafe } from './fs-utils.js';
+import { discoverFoundationExecutions, } from './execution-inventory.js';
+import { createRouteSourceFingerprint } from './route-fingerprint.js';
+import { readRouteExports } from './route-exports.js';
+export { createRouteSourceFingerprint } from './route-fingerprint.js';
+export const AUTH_PATTERNS = [
+    ['resolvePrincipal', /\bresolvePrincipal\s*\(/],
+    ['resolveUser', /\bresolveUser\s*\(/],
+    ['getServerSession', /\bgetServerSession\s*\(/],
+    ['getSession', /\bgetSession\s*\(/],
+    ['auth', /\bauth\s*\(/],
+];
+const EXTERNAL_PATTERNS = [
+    ['fetch', /\bfetch\s*\(/],
+    ['dynamic-code', /\b(?:eval|Function)\s*\(/],
+    ['child-process', /\b(?:exec|execFile|spawn)\s*\(/],
+];
+function toSourceFile(rootDir, absolutePath) {
+    return relative(rootDir, absolutePath).split(sep).join('/');
+}
+export function toRoutePath(apiDir, routeFile) {
+    const routeDirectory = relative(apiDir, dirname(routeFile));
+    const pathParams = [];
+    const segments = routeDirectory
+        .split(sep)
+        .filter((segment) => segment && !/^\(.+\)$/.test(segment))
+        .map((segment) => {
+        const optionalCatchAll = segment.match(/^\[\[\.\.\.(.+)\]\]$/);
+        if (optionalCatchAll) {
+            pathParams.push(optionalCatchAll[1]);
+            return `*${optionalCatchAll[1]}`;
+        }
+        const catchAll = segment.match(/^\[\.\.\.(.+)\]$/);
+        if (catchAll) {
+            pathParams.push(catchAll[1]);
+            return `*${catchAll[1]}`;
+        }
+        const dynamic = segment.match(/^\[(.+)\]$/);
+        if (dynamic) {
+            pathParams.push(dynamic[1]);
+            return `:${dynamic[1]}`;
+        }
+        return segment;
+    });
+    return {
+        path: `/api${segments.length ? `/${segments.join('/')}` : ''}`,
+        pathParams,
+    };
+}
+function extractQueryParams(body) {
+    const params = new Map();
+    for (const match of body.matchAll(/\bsearchParams\.(getAll|get)\(\s*['"`]([^'"`]+)['"`]\s*\)/g)) {
+        const name = match[2];
+        const repeated = match[1] === 'getAll';
+        params.set(name, repeated || (params.get(name) ?? false));
+    }
+    return [...params]
+        .map(([name, repeated]) => ({ name, repeated }))
+        .sort((left, right) => left.name.localeCompare(right.name));
+}
+function importBindings(source) {
+    const imports = new Map();
+    for (const match of source.matchAll(/import\s*\{([^}]+)\}\s*from\s*['"`]([^'"`]+)['"`]/g)) {
+        for (const item of match[1].split(',')) {
+            const [imported, local = imported] = item.trim().split(/\s+as\s+/);
+            if (local)
+                imports.set(local.trim(), match[2]);
+        }
+    }
+    return imports;
+}
+function extractSchemaBindings(body, imports) {
+    const bindings = new Map();
+    for (const match of body.matchAll(/\b([A-Za-z_$][\w$]*)\.safeParse\s*\(/g)) {
+        const symbol = match[1];
+        const module = imports.get(symbol);
+        if (module)
+            bindings.set(symbol, module);
+    }
+    return [...bindings]
+        .map(([symbol, module]) => ({ symbol, module }))
+        .sort((left, right) => left.symbol.localeCompare(right.symbol));
+}
+function evidence(source, patterns) {
+    return patterns
+        .filter(([, pattern]) => pattern.test(source))
+        .map(([name]) => name);
+}
+function reviewReasons(options) {
+    const reasons = [];
+    if (options.authEvidence.length === 0) {
+        reasons.push('auth-boundary-unverified');
+    }
+    if (options.externalCallEvidence.length > 0) {
+        reasons.push('external-call-detected');
+    }
+    if (options.method === 'GET' || options.method === 'HEAD') {
+        reasons.push('data-classification-unverified');
+    }
+    else if (options.method === 'DELETE') {
+        reasons.push('delete-operation');
+    }
+    else {
+        reasons.push('write-operation');
+    }
+    return reasons;
+}
+async function scanRouteCandidates(options, respectLegacyIgnores, strictSources) {
+    const apiDir = join(options.rootDir, options.apiDir ?? 'src/app/api');
+    const candidates = [];
+    const ignored = [];
+    const findings = [];
+    for (const routeFile of strictSources ? [...strictSources.keys()].sort() : await findRouteFiles(apiDir)) {
+        const source = strictSources ? strictSources.get(routeFile) : await readFileSafe(routeFile);
+        const sourceFile = toSourceFile(options.rootDir, routeFile);
+        if (respectLegacyIgnores
+            && (source.includes('@ai-ignore')
+                || await isDirAiIgnored(dirname(routeFile)))) {
+            ignored.push(sourceFile);
+            continue;
+        }
+        const imports = importBindings(source);
+        const route = toRoutePath(apiDir, routeFile);
+        const parsed = readRouteExports(source, sourceFile);
+        // HEAD is a tool only for the tools generator (source discovery); the
+        // legacy scan upload keeps its five-method contract with the Platform.
+        const included = (method) => Boolean(strictSources) || method !== 'HEAD';
+        findings.push(...parsed.findings
+            .filter((finding) => included(finding.exportName))
+            .map((finding) => ({ sourceFile, ...finding })));
+        for (const { method, body } of parsed.exports.filter((entry) => included(entry.method))) {
+            const authEvidence = evidence(body, AUTH_PATTERNS);
+            const externalCallEvidence = evidence(body, EXTERNAL_PATTERNS);
+            candidates.push({
+                sourceFile,
+                sourceFingerprint: createRouteSourceFingerprint(source, method, route.path),
+                exportName: method,
+                method,
+                path: route.path,
+                pathParams: route.pathParams,
+                queryParams: extractQueryParams(body),
+                schemaBindings: extractSchemaBindings(body, imports),
+                authEvidence,
+                externalCallEvidence,
+                riskClass: method === 'DELETE'
+                    ? 'delete'
+                    : method === 'GET' || method === 'HEAD'
+                        ? 'unknown'
+                        : 'write',
+                autoApprovalEligible: false,
+                reviewReasons: reviewReasons({
+                    method,
+                    authEvidence,
+                    externalCallEvidence,
+                }),
+            });
+        }
+    }
+    return { candidates, ignored, ...(findings.length ? { findings } : {}) };
+}
+export async function scanNextAppRoutes(options) {
+    if (options.mode === 'source-discovery') {
+        const inputRoot = resolve(options.rootDir);
+        const rootDir = await realpath(options.rootDir);
+        const relativeApi = relative(inputRoot, resolve(inputRoot, options.apiDir ?? 'src/app/api'));
+        if (relativeApi.startsWith(`..${sep}`) || relativeApi === '..')
+            throw new Error('Source directory must remain inside the app');
+        const apiDir = resolve(rootDir, relativeApi);
+        const sources = new Map();
+        let visited = 0;
+        const walk = async (directory) => {
+            if (++visited > 10_000 || await realpath(directory) !== directory)
+                throw new Error('Source discovery is incomplete');
+            for (const entry of await readdir(directory, { withFileTypes: true })) {
+                if (entry.name === 'node_modules' || entry.name === '.git')
+                    continue;
+                if (entry.isDirectory() && entry.name.startsWith('_'))
+                    continue;
+                const path = join(directory, entry.name);
+                if (entry.isSymbolicLink())
+                    throw new Error('Source discovery is incomplete');
+                if (entry.isDirectory()) {
+                    await walk(path);
+                    continue;
+                }
+                if (!entry.isFile() || !/^route\.(ts|tsx|js|jsx)$/.test(entry.name))
+                    continue;
+                if (sources.size >= 5_000 || await realpath(path) !== path || (await stat(path)).size > 2_000_000) {
+                    throw new Error('Source discovery is incomplete');
+                }
+                sources.set(path, await readFile(path, 'utf8'));
+            }
+        };
+        await walk(apiDir);
+        return scanRouteCandidates({ ...options, rootDir, apiDir: relativeApi }, false, sources);
+    }
+    if ((options.mode ?? 'legacy-route-scan') === 'legacy-route-scan') {
+        return scanRouteCandidates(options, true);
+    }
+    if (!options.inventory) {
+        throw new Error('Foundation inventory mode requires an execution inventory');
+    }
+    const discovery = await discoverFoundationExecutions({
+        rootDir: options.rootDir,
+        inventory: options.inventory,
+    });
+    const scanned = await scanRouteCandidates(options, false);
+    const endpointKeys = new Set(discovery.executions
+        .filter((execution) => execution.executionKind === 'endpoint')
+        .map((execution) => execution.stableKey));
+    return {
+        candidates: scanned.candidates.filter((candidate) => (endpointKeys.has(`${candidate.method} ${candidate.path}`))),
+        ignored: [],
+        executions: discovery.executions,
+        inventoryDigest: discovery.inventoryDigest,
+        ...(scanned.findings ? { findings: scanned.findings } : {}),
+    };
+}
+export async function writeNextAppRouteScan(options) {
+    const result = await scanNextAppRoutes(options);
+    const outputPath = resolve(options.rootDir, options.outputPath ?? '.glirastes/route-scan.json');
+    const artifact = {
+        schemaVersion: 1,
+        generatedAt: (options.now?.() ?? new Date()).toISOString(),
+        ...result,
+    };
+    await mkdir(dirname(outputPath), { recursive: true });
+    await writeFile(outputPath, `${JSON.stringify(artifact, null, 2)}\n`, 'utf8');
+    return { outputPath, result };
+}
+//# sourceMappingURL=route-scanner.js.map

package/dist/codegen/route-scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-scanner.js","sourceRoot":"","sources":["../../src/codegen/route-scanner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACvF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7E,OAAO,EACL,4BAA4B,GAG7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAA2B,MAAM,oBAAoB,CAAC;AAI/E,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AAiDtE,MAAM,CAAC,MAAM,aAAa,GAA4B;IACpD,CAAC,kBAAkB,EAAE,yBAAyB,CAAC;IAC/C,CAAC,aAAa,EAAE,oBAAoB,CAAC;IACrC,CAAC,kBAAkB,EAAE,yBAAyB,CAAC;IAC/C,CAAC,YAAY,EAAE,mBAAmB,CAAC;IACnC,CAAC,MAAM,EAAE,aAAa,CAAC;CACxB,CAAC;AAEF,MAAM,iBAAiB,GAA4B;IACjD,CAAC,OAAO,EAAE,cAAc,CAAC;IACzB,CAAC,cAAc,EAAE,0BAA0B,CAAC;IAC5C,CAAC,eAAe,EAAE,gCAAgC,CAAC;CACpD,CAAC;AAEF,SAAS,YAAY,CAAC,OAAe,EAAE,YAAoB;IACzD,OAAO,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,MAAc,EACd,SAAiB;IAEjB,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAG,cAAc;SAC5B,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;SACzD,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACf,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC/D,IAAI,gBAAgB,EAAE,CAAC;YACrB,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;YACrC,OAAO,IAAI,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACnD,IAAI,QAAQ,EAAE,CAAC;YACb,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7B,OAAO,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,OAAO,EAAE,CAAC;YACZ,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5B,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;IACL,OAAO;QACL,IAAI,EAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;QAC9D,UAAU;KACX,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAC/B,4DAA4D,CAC7D,EAAE,CAAC;QACF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC;QACvC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;SAC/C,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,cAAc,CAAC,MAAc;IACpC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,QAAQ,CACjC,oDAAoD,CACrD,EAAE,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,MAAM,CAAC,QAAQ,EAAE,KAAK,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACnE,IAAI,KAAK;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAAY,EACZ,OAA4B;IAE5B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,uCAAuC,CAAC,EAAE,CAAC;QAC3E,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,MAAM;YAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,CAAC,GAAG,QAAQ,CAAC;SACjB,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;SAC/C,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,QAAQ,CACf,MAAc,EACd,QAAiC;IAEjC,OAAO,QAAQ;SACZ,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;SAC7C,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,aAAa,CAAC,OAItB;IACC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,OAAO,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IACjD,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACnC,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,OAAiC,EACjC,oBAA6B,EAC7B,aAAmC;IAEnC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC,CAAC;IACtE,MAAM,UAAU,GAA4B,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAoD,EAAE,CAAC;IAErE,KAAK,MAAM,SAAS,IAAI,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QACxG,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,SAAS,CAAC,CAAC;QAC7F,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC5D,IACE,oBAAoB;eACjB,CACD,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;mBAC1B,MAAM,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAC5C,EACD,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACzB,SAAS;QACX,CAAC;QAED,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACpD,sEAAsE;QACtE,uEAAuE;QACvE,MAAM,QAAQ,GAAG,CAAC,MAAkC,EAAE,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,MAAM,KAAK,MAAM,CAAC;QACrG,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ;aAC7B,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;aACjD,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QACnD,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACxF,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;YACnD,MAAM,oBAAoB,GAAG,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;YAC/D,UAAU,CAAC,IAAI,CAAC;gBACd,UAAU;gBACV,iBAAiB,EAAE,4BAA4B,CAC7C,MAAM,EACN,MAAM,EACN,KAAK,CAAC,IAAI,CACX;gBACD,UAAU,EAAE,MAAM;gBAClB,MAAM;gBACN,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,WAAW,EAAE,kBAAkB,CAAC,IAAI,CAAC;gBACrC,cAAc,EAAE,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC;gBACpD,YAAY;gBACZ,oBAAoB;gBACpB,SAAS,EACP,MAAM,KAAK,QAAQ;oBACjB,CAAC,CAAC,QAAQ;oBACV,CAAC,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM;wBACrC,CAAC,CAAC,SAAS;wBACX,CAAC,CAAC,OAAO;gBACf,oBAAoB,EAAE,KAAK;gBAC3B,aAAa,EAAE,aAAa,CAAC;oBAC3B,MAAM;oBACN,YAAY;oBACZ,oBAAoB;iBACrB,CAAC;aACH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAiC;IAEjC,IAAI,OAAO,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,WAAW,GAAG,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC,CAAC,CAAC;QAC7F,IAAI,WAAW,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,WAAW,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC/H,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC1C,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,MAAM,IAAI,GAAG,KAAK,EAAE,SAAiB,EAAiB,EAAE;YACtD,IAAI,EAAE,OAAO,GAAG,MAAM,IAAI,MAAM,QAAQ,CAAC,SAAS,CAAC,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACrH,KAAK,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBACtE,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;oBAAE,SAAS;gBACrE,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAChE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBACzC,IAAI,KAAK,CAAC,cAAc,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;gBAC9E,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;oBAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBACxD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAC9E,IAAI,OAAO,CAAC,IAAI,IAAI,KAAK,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,SAAS,EAAE,CAAC;oBAClG,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;gBACpD,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAClD,CAAC;QACH,CAAC,CAAC;QACF,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,OAAO,mBAAmB,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,mBAAmB,CAAC,KAAK,mBAAmB,EAAE,CAAC;QAClE,OAAO,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,4BAA4B,CAAC;QACnD,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,UAAU;SAC9C,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,aAAa,KAAK,UAAU,CAAC;SAC7D,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IAE5C,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CACnD,YAAY,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,CAC1D,CAAC;QACF,OAAO,EAAE,EAAE;QACX,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,eAAe,EAAE,SAAS,CAAC,eAAe;QAC1C,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAqC;IAKrC,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,OAAO,CACxB,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,UAAU,IAAI,4BAA4B,CACnD,CAAC;IACF,MAAM,QAAQ,GAAG;QACf,aAAa,EAAE,CAAC;QAChB,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;QAC1D,GAAG,MAAM;KACV,CAAC;IACF,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,MAAM,SAAS,CACb,UAAU,EACV,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EACxC,MAAM,CACP,CAAC;IACF,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AAChC,CAAC"}

package/dist/codegen/tools/agentic.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Shared gate for everything a coding agent or the managed job writes into
+ * `tool-resolutions.json` and `tool-semantics.json` (spec 4.6 "Einheitliche
+ * Prüfung"). The generator applies it the same way, whoever wrote the entry.
+ */
+/** Largest JSON Schema one agentic entry may carry. */
+export declare const MAX_AGENTIC_SCHEMA_BYTES: number;
+/** A model slug or coding-agent label: `anthropic/claude-sonnet-5.5`, `codex`, `claude-code`. */
+export declare const AGENT_MODEL_PATTERN: RegExp;
+/**
+ * The first content problem of an agentic value, or undefined. Every value is
+ * checked for secrets, provider keys (any `sk-or-v1`, also short ones) and
+ * control characters; prose (descriptions, hints, synonyms, example sentences)
+ * additionally refuses e-mail addresses and long numbers, which only real
+ * business data would put there. The reason never repeats the content.
+ */
+export declare function agenticContentProblem(value: unknown, options?: {
+    prose?: boolean;
+}): string | undefined;
+/** `$schema` names the dialect only; the generator always compiles JSON Schema 2020-12. */
+export declare function withoutMetaSchema(schema: Record<string, unknown>): Record<string, unknown>;
+/**
+ * Why a JSON Schema an agent wrote is unusable, or undefined: at most 32 KB,
+ * strict JSON Schema 2020-12; an input schema is additionally an object with
+ * `additionalProperties: false` and fixed keys only.
+ */
+export declare function strictSchemaProblem(schema: Record<string, unknown>, role: 'input' | 'output'): string | undefined;
+/** Property names of an object schema, sorted; empty for anything else. */
+export declare function schemaPropertyNames(schema: Record<string, unknown>): string[];
+/** Digest of a reviewed value; `glirastes tools verify` writes it, the generator compares it. */
+export declare function lockDigest(value: unknown): string;

package/dist/codegen/tools/agentic.js

@@ -0,0 +1,110 @@
+import { Ajv2020 } from 'ajv/dist/2020.js';
+import addFormatsModule from 'ajv-formats';
+import { findSensitiveStringPath } from '../../contracts/content-boundary.js';
+import { canonicalJson, sha256Digest } from './canonical.js';
+const addFormats = addFormatsModule;
+/**
+ * Shared gate for everything a coding agent or the managed job writes into
+ * `tool-resolutions.json` and `tool-semantics.json` (spec 4.6 "Einheitliche
+ * Prüfung"). The generator applies it the same way, whoever wrote the entry.
+ */
+/** Largest JSON Schema one agentic entry may carry. */
+export const MAX_AGENTIC_SCHEMA_BYTES = 32 * 1024;
+/** A model slug or coding-agent label: `anthropic/claude-sonnet-5.5`, `codex`, `claude-code`. */
+export const AGENT_MODEL_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:/@+-]{0,199}$/;
+const PROVIDER_KEY_PREFIX = /sk-or-v1/i;
+const EMAIL = /[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)*\.[A-Za-z]{2,}/;
+/** Nine or more digits in a row (optionally grouped): phone, IBAN or account numbers. */
+const LONG_NUMBER = /\d(?:[ .\-/]?\d){8,}/;
+// eslint-disable-next-line no-control-regex
+const CONTROL = /[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F]/;
+/** Keywords that admit object keys the evidence check never sees. */
+const OPEN_KEY_KEYWORDS = ['patternProperties', 'propertyNames'];
+function strings(value, found = []) {
+    if (typeof value === 'string') {
+        found.push(value);
+    }
+    else if (Array.isArray(value)) {
+        for (const item of value)
+            strings(item, found);
+    }
+    else if (value !== null && typeof value === 'object') {
+        for (const [key, child] of Object.entries(value)) {
+            found.push(key);
+            strings(child, found);
+        }
+    }
+    return found;
+}
+/**
+ * The first content problem of an agentic value, or undefined. Every value is
+ * checked for secrets, provider keys (any `sk-or-v1`, also short ones) and
+ * control characters; prose (descriptions, hints, synonyms, example sentences)
+ * additionally refuses e-mail addresses and long numbers, which only real
+ * business data would put there. The reason never repeats the content.
+ */
+export function agenticContentProblem(value, options = {}) {
+    if (findSensitiveStringPath(value))
+        return 'secret-looking content';
+    const texts = strings(value);
+    if (texts.some((text) => PROVIDER_KEY_PREFIX.test(text)))
+        return 'a provider key prefix (sk-or-v1)';
+    if (texts.some((text) => CONTROL.test(text)))
+        return 'control characters';
+    if (options.prose && texts.some((text) => EMAIL.test(text) || LONG_NUMBER.test(text))) {
+        return 'what looks like business data (an e-mail address or a long number)';
+    }
+    return undefined;
+}
+/** `$schema` names the dialect only; the generator always compiles JSON Schema 2020-12. */
+export function withoutMetaSchema(schema) {
+    const { $schema: _metaSchema, ...rest } = schema;
+    return rest;
+}
+function compileProblem(schema) {
+    // Zod v4 emits 2020-12 schemas, tuples as `prefixItems` without minItems.
+    const ajv = new Ajv2020({ strict: true, strictTuples: false, allErrors: false, logger: false });
+    addFormats(ajv);
+    try {
+        ajv.compile(schema);
+        return undefined;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : 'invalid schema';
+        return message.length <= 200 ? message : `${message.slice(0, 199)}…`;
+    }
+}
+/**
+ * Why a JSON Schema an agent wrote is unusable, or undefined: at most 32 KB,
+ * strict JSON Schema 2020-12; an input schema is additionally an object with
+ * `additionalProperties: false` and fixed keys only.
+ */
+export function strictSchemaProblem(schema, role) {
+    if (Buffer.byteLength(JSON.stringify(schema), 'utf8') > MAX_AGENTIC_SCHEMA_BYTES) {
+        return `the ${role} schema exceeds 32 KB`;
+    }
+    const compiled = compileProblem(schema);
+    if (compiled)
+        return `the ${role} schema is not valid strict JSON Schema (${compiled})`;
+    if (role === 'output')
+        return undefined;
+    if (schema.type !== 'object' || schema.additionalProperties !== false) {
+        return 'the input schema must be an object with additionalProperties false';
+    }
+    const open = OPEN_KEY_KEYWORDS.find((keyword) => schema[keyword] !== undefined);
+    if (open)
+        return `input schemas may not use ${open}`;
+    return undefined;
+}
+/** Property names of an object schema, sorted; empty for anything else. */
+export function schemaPropertyNames(schema) {
+    const properties = schema.properties;
+    return properties && typeof properties === 'object' && !Array.isArray(properties)
+        ? Object.keys(properties).sort()
+        : [];
+}
+/** Digest of a reviewed value; `glirastes tools verify` writes it, the generator compares it. */
+export function lockDigest(value) {
+    return sha256Digest(canonicalJson(value));
+}
+//# sourceMappingURL=agentic.js.map

package/dist/codegen/tools/agentic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentic.js","sourceRoot":"","sources":["../../../src/codegen/tools/agentic.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,gBAAgB,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE7D,MAAM,UAAU,GAAG,gBAAwD,CAAC;AAE5E;;;;GAIG;AAEH,uDAAuD;AACvD,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,CAAC;AAElD,iGAAiG;AACjG,MAAM,CAAC,MAAM,mBAAmB,GAAG,wCAAwC,CAAC;AAE5E,MAAM,mBAAmB,GAAG,WAAW,CAAC;AACxC,MAAM,KAAK,GAAG,mEAAmE,CAAC;AAClF,yFAAyF;AACzF,MAAM,WAAW,GAAG,sBAAsB,CAAC;AAC3C,4CAA4C;AAC5C,MAAM,OAAO,GAAG,gDAAgD,CAAC;AAEjE,qEAAqE;AACrE,MAAM,iBAAiB,GAAG,CAAC,mBAAmB,EAAE,eAAe,CAAU,CAAC;AAE1E,SAAS,OAAO,CAAC,KAAc,EAAE,QAAkB,EAAE;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;SAAM,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAc,EAAE,UAA+B,EAAE;IACrF,IAAI,uBAAuB,CAAC,KAAK,CAAC;QAAE,OAAO,wBAAwB,CAAC;IACpE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,kCAAkC,CAAC;IACpG,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,oBAAoB,CAAC;IAC1E,IAAI,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACtF,OAAO,oEAAoE,CAAC;IAC9E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,iBAAiB,CAAC,MAA+B;IAC/D,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;IACjD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,MAA+B;IACrD,0EAA0E;IAC1E,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAChG,UAAU,CAAC,GAAG,CAAC,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACpB,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAC1E,OAAO,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC;IACvE,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAA+B,EAC/B,IAAwB;IAExB,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,GAAG,wBAAwB,EAAE,CAAC;QACjF,OAAO,OAAO,IAAI,uBAAuB,CAAC;IAC5C,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,QAAQ;QAAE,OAAO,OAAO,IAAI,4CAA4C,QAAQ,GAAG,CAAC;IACxF,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,oBAAoB,KAAK,KAAK,EAAE,CAAC;QACtE,OAAO,oEAAoE,CAAC;IAC9E,CAAC;IACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC;IAChF,IAAI,IAAI;QAAE,OAAO,6BAA6B,IAAI,EAAE,CAAC;IACrD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,mBAAmB,CAAC,MAA+B;IACjE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACrC,OAAO,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;QAC/E,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE;QAChC,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,OAAO,YAAY,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5C,CAAC"}

package/dist/codegen/tools/artifact.d.ts

@@ -0,0 +1,139 @@
+import { z } from 'zod';
+import { type AppSetupArtifact, type AppSetupExclusion, type AppSetupOperationGroup, type AppSetupToolProvenance, type ToolRiskClass } from '../../contracts/index.js';
+import { type EffectiveToolPolicy } from '../../contracts/tool-policy.js';
+import type { LocalPromptBundle } from '../../cli/commands/validate-build.js';
+import type { FoundationExecutionInventory } from '../execution-inventory.js';
+import type { DescriptionOrigin, ToolProse } from './prose.js';
+import type { ContractSource, ExcludedTool, ToolContract, ToolContractsEntry, ToolFinding } from './types.js';
+export declare const EPOCH = "1970-01-01T00:00:00.000Z";
+type InventoryExecution = FoundationExecutionInventory['executions'][number];
+export interface ArtifactToolInput {
+    execution: InventoryExecution;
+    prose: ToolProse;
+    effective: EffectiveToolPolicy;
+    operationGroup: AppSetupOperationGroup;
+    /** Content-free capability-report provenance (P08b shared contract item 5). */
+    provenance?: AppSetupToolProvenance;
+}
+export interface PreviousArtifact {
+    artifact?: AppSetupArtifact;
+    planner?: AppSetupArtifact['planner'];
+}
+export interface BuildSetupArtifactInput {
+    appId: string;
+    targetAppKey: string;
+    discoveryDigest: string;
+    tools: ReadonlyArray<ArtifactToolInput>;
+    promptBundle: Pick<LocalPromptBundle, 'artifactRef' | 'sections'>;
+    warnings: ReadonlyArray<{
+        code: string;
+        subjectRef: string;
+    }>;
+    previous?: PreviousArtifact;
+    now: (() => Date) | null;
+    /** Reported as the artifact's `exclusions`, clipped to the Platform caps. */
+    exclusions?: ReadonlyArray<ExcludedTool>;
+}
+/**
+ * The Platform accepts at most 5,000 exclusions with stable keys of at most
+ * 512 characters (P08b Task 9). One oversized entry would reject the whole
+ * capability report, so longer keys are left out and the list is cut in
+ * code-unit order. `tool-report.json` keeps the complete list.
+ */
+export declare function clipExclusions(excluded: ReadonlyArray<ExcludedTool>): AppSetupExclusion[];
+export declare function promptMetadata(bundle: Pick<LocalPromptBundle, 'artifactRef' | 'sections'>): AppSetupArtifact['prompts'];
+export declare function buildSetupArtifact(input: BuildSetupArtifactInput): {
+    artifact: AppSetupArtifact;
+    raw: string;
+};
+export declare function renderToolContracts(appId: string, entries: ReadonlyArray<ToolContractsEntry>): string;
+export type SchemaQuality = 'zod' | 'openapi' | 'json-schema' | 'agent' | 'field-names' | 'none';
+export declare function schemaQualityOf(contract: ToolContract | null | undefined, resolutionOrigin?: 'human' | 'agent'): SchemaQuality;
+export interface ToolReportTool {
+    toolId: string;
+    stableKey: string;
+    definitionId: string;
+    enabled: boolean;
+    riskClass: ToolRiskClass;
+    requiresApproval: boolean;
+    contractSource: ContractSource | null;
+    quality: {
+        description: DescriptionOrigin;
+        schema: SchemaQuality;
+    };
+}
+export declare const ToolReportFileSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    appId: z.ZodUUID;
+    discoveryDigest: z.ZodString;
+    tools: z.ZodArray<z.ZodObject<{
+        toolId: z.ZodUUID;
+        stableKey: z.ZodString;
+        definitionId: z.ZodString;
+        enabled: z.ZodBoolean;
+        riskClass: z.ZodEnum<{
+            unknown: "unknown";
+            "safe-read": "safe-read";
+            "read-sensitive": "read-sensitive";
+            write: "write";
+            delete: "delete";
+            financial: "financial";
+            external: "external";
+        }>;
+        requiresApproval: z.ZodBoolean;
+        contractSource: z.ZodNullable<z.ZodEnum<{
+            openapi: "openapi";
+            native: "native";
+            "contract-module": "contract-module";
+            "legacy-ai-tool": "legacy-ai-tool";
+            resolution: "resolution";
+            derived: "derived";
+            "ui-bridge": "ui-bridge";
+        }>>;
+        quality: z.ZodObject<{
+            description: z.ZodEnum<{
+                code: "code";
+                agent: "agent";
+                human: "human";
+                template: "template";
+            }>;
+            schema: z.ZodEnum<{
+                none: "none";
+                openapi: "openapi";
+                agent: "agent";
+                zod: "zod";
+                "json-schema": "json-schema";
+                "field-names": "field-names";
+            }>;
+        }, z.core.$strict>;
+    }, z.core.$strict>>;
+    findings: z.ZodArray<z.ZodObject<{
+        code: z.ZodString;
+        severity: z.ZodEnum<{
+            error: "error";
+            warning: "warning";
+            needs_attention: "needs_attention";
+        }>;
+        subjectRef: z.ZodString;
+        nextAction: z.ZodString;
+    }, z.core.$strict>>;
+    excluded: z.ZodArray<z.ZodObject<{
+        stableKey: z.ZodString;
+        reason: z.ZodString;
+        origin: z.ZodEnum<{
+            default: "default";
+            code: "code";
+            policy: "policy";
+        }>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type ToolReportFile = z.infer<typeof ToolReportFileSchema>;
+/** Content-free state report: no messages, no change-relative findings. */
+export declare function renderToolReport(input: {
+    appId: string;
+    discoveryDigest: string;
+    tools: ReadonlyArray<ToolReportTool>;
+    findings: ReadonlyArray<ToolFinding>;
+    excluded: ReadonlyArray<ExcludedTool>;
+}): string;
+export {};