glirastes 0.4.0 → 0.5.1

package/dist/cli/commands/tools/verify.d.ts

@@ -0,0 +1,13 @@
+import type { ToolsIo } from './format.js';
+export declare const VERIFY_ARGS: {
+    readonly flags: readonly ["--all"];
+    readonly values: readonly ["--root"];
+    readonly positionals: 500;
+};
+/**
+ * `glirastes tools verify <tool|--all>` (spec 4.2): the developer confirms
+ * agent-written contracts and descriptions after review. They become human
+ * entries pinned by digest; a later agent edit is rejected until the next
+ * review. Only entries the generator accepts can be verified.
+ */
+export declare function runToolsVerify(argv: ReadonlyArray<string>, io: ToolsIo): Promise<number>;

package/dist/cli/commands/tools/verify.js

@@ -0,0 +1,168 @@
+import { readFile } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import { lockDigest } from '../../../codegen/tools/agentic.js';
+import { TOOLS_PATHS } from '../../../codegen/tools/config.js';
+import { ResolutionEntrySchema, resolutionLockDigest } from '../../../codegen/tools/resolutions.js';
+import { isAgenticSemantics, SEMANTICS_FIELDS, SemanticsEntrySchema } from '../../../codegen/tools/semantics.js';
+import { writeArtifactSetAtomically } from '../atomic-artifact-write.js';
+import { parseToolArgs, ToolsUsageError } from './args.js';
+export const VERIFY_ARGS = { flags: ['--all'], values: ['--root'], positionals: 500 };
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+async function readJson(root, path) {
+    try {
+        const value = JSON.parse(await readFile(resolve(root, path), 'utf8'));
+        return isRecord(value) ? value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function render(value) {
+    return `${JSON.stringify(value, null, 2)}\n`;
+}
+function rejectedIn(tool, file) {
+    return tool.findings.some((finding) => finding.code === 'resolution-rejected' && finding.message.includes(file));
+}
+/** The generator ignores these files wholesale when they do not parse: none of their entries is accepted. */
+const IGNORED_FILE_FINDINGS = [
+    { code: 'resolution-rejected', file: TOOLS_PATHS.resolutions },
+    { code: 'tool-semantics-invalid', file: TOOLS_PATHS.semantics },
+];
+/** An early return of verify: the findings, then why nothing was verified; exit 2. */
+function refuse(io, findings, why) {
+    for (const finding of findings) {
+        io.error(`${finding.subjectRef}  ${finding.code}: ${finding.message}`);
+        io.error(`  Next: ${finding.nextAction}`);
+    }
+    io.error(`Nothing was verified: ${why}`);
+    return 2;
+}
+/** The entry is current when the generator reads the tool's interface and the entry was written for exactly that one. */
+function writtenForCurrentInterface(tool, digest) {
+    return tool.interfaceDigest !== null && digest === tool.interfaceDigest;
+}
+/** Pins a reviewed agent resolution: origin human, `locked` = digest of the entry. */
+function verifyResolution(raw) {
+    const parsed = ResolutionEntrySchema.safeParse(raw);
+    if (!parsed.success || parsed.data.origin !== 'agent')
+        return undefined;
+    const reviewed = { ...parsed.data, origin: 'human' };
+    return {
+        entry: { ...raw, origin: 'human', locked: resolutionLockDigest(reviewed) },
+        interfaceDigest: parsed.data.interfaceDigest,
+    };
+}
+/** Turns every agent field of a semantics entry into a reviewed, locked human field. */
+function verifySemantics(entry) {
+    const parsed = SemanticsEntrySchema.safeParse(entry);
+    if (!parsed.success || !isAgenticSemantics(entry))
+        return undefined;
+    const origin = { ...(isRecord(entry.origin) ? entry.origin : {}) };
+    const locked = { ...(isRecord(entry.locked) ? entry.locked : {}) };
+    for (const field of SEMANTICS_FIELDS) {
+        if (origin[field] !== 'agent')
+            continue;
+        origin[field] = 'human';
+        // The generator compares the parsed value, so the digest is taken from it.
+        locked[field] = lockDigest(parsed.data[field] ?? null);
+    }
+    const { agent: _agent, ...rest } = entry;
+    return { entry: { ...rest, origin, locked }, interfaceDigest: parsed.data.agent?.interfaceDigest };
+}
+/**
+ * `glirastes tools verify <tool|--all>` (spec 4.2): the developer confirms
+ * agent-written contracts and descriptions after review. They become human
+ * entries pinned by digest; a later agent edit is rejected until the next
+ * review. Only entries the generator accepts can be verified.
+ */
+export async function runToolsVerify(argv, io) {
+    const args = parseToolArgs(argv, VERIFY_ARGS);
+    if (args.flags.has('--all') === (args.positionals.length > 0)) {
+        throw new ToolsUsageError('Name the tools to verify, or use --all for every tool an agent described.');
+    }
+    const root = resolve(io.cwd, args.values.get('--root') ?? '.');
+    const result = await io.runPipeline({ root, mode: 'frozen', keepGoing: true });
+    const tools = result.tools ?? [];
+    // Drift of the committed outputs is expected while an agent edits the entries; it does not stop the tool list.
+    const errors = result.findings.filter((finding) => finding.severity === 'error' && finding.code !== 'tool-outputs-drift');
+    if (tools.length === 0 && errors.length > 0) {
+        return refuse(io, errors, 'the generator stopped before it listed the tools. Fix the errors above and run glirastes tools check.');
+    }
+    const ignored = result.findings.filter((finding) => IGNORED_FILE_FINDINGS
+        .some((entry) => entry.code === finding.code && entry.file === finding.subjectRef));
+    if (ignored.length > 0) {
+        return refuse(io, ignored, 'the generator ignores the file named above, so none of its entries is accepted. Fix the file and run glirastes tools check.');
+    }
+    const resolutions = await readJson(root, TOOLS_PATHS.resolutions);
+    const semantics = await readJson(root, TOOLS_PATHS.semantics);
+    const resolutionTools = isRecord(resolutions?.tools) ? { ...resolutions.tools } : {};
+    const semanticsTools = Array.isArray(semantics?.tools) ? [...semantics.tools] : [];
+    // The generator keys the last parsable entry by its parsed (trimmed)
+    // stableKey, then by its name (loadToolSemantics); verify must lock that
+    // entry, never one it shadows.
+    const lastEntryIndex = (matches) => {
+        for (let index = semanticsTools.length - 1; index >= 0; index -= 1) {
+            const parsed = SemanticsEntrySchema.safeParse(semanticsTools[index]);
+            if (parsed.success && matches(parsed.data))
+                return index;
+        }
+        return -1;
+    };
+    const semanticsIndex = (tool) => {
+        const byKey = lastEntryIndex((entry) => entry.stableKey === tool.stableKey);
+        return byKey >= 0 ? byKey : lastEntryIndex((entry) => entry.name === tool.definitionId);
+    };
+    const selected = args.flags.has('--all')
+        ? tools.filter((tool) => verifyResolution(resolutionTools[tool.stableKey]) !== undefined
+            || (semanticsIndex(tool) >= 0 && isAgenticSemantics(semanticsTools[semanticsIndex(tool)])))
+        : args.positionals.map((name) => {
+            const tool = tools.find((candidate) => candidate.definitionId === name || candidate.stableKey === name);
+            if (!tool)
+                throw new ToolsUsageError(`Unknown tool ${name}; glirastes tools status lists the names.`);
+            return tool;
+        });
+    const verified = [];
+    for (const tool of selected) {
+        const parts = [];
+        // A tool whose handler the generator cannot read has no interface to compare an entry with.
+        const unreadable = (file) => new ToolsUsageError(`The ${file} entry of ${tool.definitionId} cannot be checked: the generator cannot read the handler of this tool. `
+            + 'Fix the handler and run glirastes tools refresh before verifying.');
+        const resolution = verifyResolution(resolutionTools[tool.stableKey]);
+        if (resolution) {
+            if (tool.interfaceDigest === null)
+                throw unreadable('tool-resolutions.json');
+            if (rejectedIn(tool, 'tool-resolutions.json') || !writtenForCurrentInterface(tool, resolution.interfaceDigest)) {
+                throw new ToolsUsageError(`The tool-resolutions.json entry of ${tool.definitionId} is rejected or stale; fix it and refresh before verifying.`);
+            }
+            resolutionTools[tool.stableKey] = resolution.entry;
+            parts.push('contract');
+        }
+        const index = semanticsIndex(tool);
+        const description = index >= 0 && isRecord(semanticsTools[index]) ? verifySemantics(semanticsTools[index]) : undefined;
+        if (description) {
+            if (tool.interfaceDigest === null)
+                throw unreadable('tool-semantics.json');
+            if (tool.semantics.rejected || !writtenForCurrentInterface(tool, description.interfaceDigest)) {
+                throw new ToolsUsageError(`The tool-semantics.json entry of ${tool.definitionId} is rejected or stale; fix it and refresh before verifying.`);
+            }
+            semanticsTools[index] = description.entry;
+            parts.push('description');
+        }
+        if (parts.length === 0)
+            throw new ToolsUsageError(`${tool.definitionId} has no agent-written entry to verify.`);
+        verified.push(`${tool.definitionId} (${parts.join(' and ')})`);
+    }
+    const writes = [
+        ...(resolutions ? [{ path: resolve(root, TOOLS_PATHS.resolutions), content: render({ ...resolutions, tools: resolutionTools }) }] : []),
+        ...(semantics ? [{ path: resolve(root, TOOLS_PATHS.semantics), content: render({ ...semantics, tools: semanticsTools }) }] : []),
+    ];
+    if (verified.length > 0)
+        await writeArtifactSetAtomically(writes);
+    io.log(verified.length > 0
+        ? `Verified ${verified.join(', ')}: reviewed and locked. Run glirastes tools refresh.`
+        : 'No agent-written entries to verify.');
+    return 0;
+}
+//# sourceMappingURL=verify.js.map

package/dist/cli/commands/tools/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../../src/cli/commands/tools/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAE/D,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AACpG,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,oBAAoB,EAA2B,MAAM,qCAAqC,CAAC;AAE1I,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAG3D,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,GAAG,EAAW,CAAC;AAI/F,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,IAAY;IAChD,IAAI,CAAC;QACH,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/E,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED,SAAS,UAAU,CAAC,IAAuB,EAAE,IAAY;IACvD,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AACnH,CAAC;AAED,6GAA6G;AAC7G,MAAM,qBAAqB,GAAkD;IAC3E,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,WAAW,CAAC,WAAW,EAAE;IAC9D,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,WAAW,CAAC,SAAS,EAAE;CAChE,CAAC;AAEF,sFAAsF;AACtF,SAAS,MAAM,CAAC,EAAW,EAAE,QAAoC,EAAE,GAAW;IAC5E,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,EAAE,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,EAAE,CAAC,KAAK,CAAC,WAAW,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,EAAE,CAAC,KAAK,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAAC;IACzC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,yHAAyH;AACzH,SAAS,0BAA0B,CAAC,IAAuB,EAAE,MAA0B;IACrF,OAAO,IAAI,CAAC,eAAe,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI,CAAC,eAAe,CAAC;AAC1E,CAAC;AAED,sFAAsF;AACtF,SAAS,gBAAgB,CAAC,GAAY;IACpC,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IACxE,MAAM,QAAQ,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAgB,EAAE,CAAC;IAC9D,OAAO;QACL,KAAK,EAAE,EAAE,GAAI,GAAkB,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EAAE;QAC1F,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe;KAC7C,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,SAAS,eAAe,CAAC,KAAiB;IACxC,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,MAAM,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACnE,MAAM,MAAM,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACnE,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;QACrC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,OAAO;YAAE,SAAS;QACxC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;QACxB,2EAA2E;QAC3E,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IACzC,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,eAAe,EAAE,CAAC;AACrG,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAA2B,EAAE,EAAW;IAC3E,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC9C,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,eAAe,CAAC,2EAA2E,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;IACjC,+GAA+G;IAC/G,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,oBAAoB,CAAC,CAAC;IAC1H,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,uGAAuG,CAAC,CAAC;IACrI,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,qBAAqB;SACtE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IACtF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,6HAA6H,CAAC,CAAC;IAC5J,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;IAC9D,MAAM,eAAe,GAAG,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrF,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnF,qEAAqE;IACrE,yEAAyE;IACzE,+BAA+B;IAC/B,MAAM,cAAc,GAAG,CAAC,OAA+C,EAAE,EAAE;QACzE,KAAK,IAAI,KAAK,GAAG,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACnE,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;YACrE,IAAI,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC;QAC3D,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;IACZ,CAAC,CAAC;IACF,MAAM,cAAc,GAAG,CAAC,IAAuB,EAAE,EAAE;QACjD,MAAM,KAAK,GAAG,cAAc,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5E,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1F,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;QACtC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,SAAS;eACnF,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,cAAc,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7F,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,YAAY,KAAK,IAAI,IAAI,SAAS,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;YACxG,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,eAAe,CAAC,gBAAgB,IAAI,2CAA2C,CAAC,CAAC;YACtG,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,4FAA4F;QAC5F,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,eAAe,CACtD,OAAO,IAAI,aAAa,IAAI,CAAC,YAAY,0EAA0E;cACjH,mEAAmE,CACtE,CAAC;QACF,MAAM,UAAU,GAAG,gBAAgB,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QACrE,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,eAAe,KAAK,IAAI;gBAAE,MAAM,UAAU,CAAC,uBAAuB,CAAC,CAAC;YAC7E,IAAI,UAAU,CAAC,IAAI,EAAE,uBAAuB,CAAC,IAAI,CAAC,0BAA0B,CAAC,IAAI,EAAE,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC/G,MAAM,IAAI,eAAe,CAAC,sCAAsC,IAAI,CAAC,YAAY,6DAA6D,CAAC,CAAC;YAClJ,CAAC;YACD,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC;YACnD,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,WAAW,GAAG,KAAK,IAAI,CAAC,IAAI,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,cAAc,CAAC,KAAK,CAAe,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrI,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,IAAI,CAAC,eAAe,KAAK,IAAI;gBAAE,MAAM,UAAU,CAAC,qBAAqB,CAAC,CAAC;YAC3E,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,IAAI,CAAC,0BAA0B,CAAC,IAAI,EAAE,WAAW,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC9F,MAAM,IAAI,eAAe,CAAC,oCAAoC,IAAI,CAAC,YAAY,6DAA6D,CAAC,CAAC;YAChJ,CAAC;YACD,cAAc,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC;YAC1C,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,GAAG,IAAI,CAAC,YAAY,wCAAwC,CAAC,CAAC;QAChH,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,KAAK,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,GAAG,WAAW,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACjI,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,0BAA0B,CAAC,MAAM,CAAC,CAAC;IAClE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QACxB,CAAC,CAAC,YAAY,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,qDAAqD;QACtF,CAAC,CAAC,qCAAqC,CAAC,CAAC;IAC3C,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/cli/commands/tools/watch.d.ts

@@ -0,0 +1,27 @@
+export interface ToolsWatcher {
+    close(): void;
+}
+/**
+ * Reports every changed path below the app root, app-relative, and a fault of
+ * the watcher itself (`onError`, e.g. ENOSPC); it may also throw while starting.
+ */
+export type ToolsWatchFactory = (root: string, onChange: (path: string) => void, onError: (error: Error) => void) => ToolsWatcher;
+/** Whether a change at this app-relative path can change the tools; generated files never retrigger. */
+export declare function isWatchedPath(path: string, generatedModule: string): boolean;
+export declare const defaultToolsWatch: ToolsWatchFactory;
+/**
+ * `tools refresh --watch` (spec 4.2, 4.8): refresh once, then again after
+ * each burst of relevant changes. Runs never overlap; a change during a run
+ * schedules exactly one more. A run that throws is handed to `onError` and the
+ * watch goes on. Resolves when the signal aborts; rejects with E-TOOLS-030 when
+ * the watcher cannot start or fails, after it is closed and nothing more runs.
+ */
+export declare function watchToolsRefresh(options: {
+    root: string;
+    generatedModule: string;
+    run: () => Promise<void>;
+    onError: (error: unknown) => void;
+    signal: AbortSignal;
+    watch?: ToolsWatchFactory;
+    debounceMs?: number;
+}): Promise<void>;

package/dist/cli/commands/tools/watch.js

@@ -0,0 +1,148 @@
+import { watch as watchFiles } from 'node:fs';
+import { posix } from 'node:path';
+import { TOOLS_PATHS } from '../../../codegen/tools/config.js';
+import { FoundationDiagnosticError } from '../../../diagnostics/index.js';
+/** Folders whose changes never change a tool, at any depth. */
+const IGNORED_FOLDERS = new Set([
+    'node_modules', '.git', '.next', '.turbo', '.vercel', '.tool-fixtures',
+]);
+/**
+ * Build output, directly in the app or its `src` folder only: a feature
+ * folder of that name deeper down is app code the generator scans (Task 6).
+ */
+const OUTPUT_FOLDERS = new Set(['dist', 'build', 'out', 'coverage']);
+/** Inputs under .glirastes that change tools; every other file there belongs to the generator or the CLI. */
+const WATCHED_INPUTS = new Set([
+    TOOLS_PATHS.config, TOOLS_PATHS.policy, TOOLS_PATHS.resolutions, TOOLS_PATHS.semantics, TOOLS_PATHS.promptBundle,
+    TOOLS_PATHS.mcpToolNames,
+]);
+/**
+ * Names `writeArtifactSetAtomically` gives the staged and backup copy of every
+ * output it replaces (`<output>.glirastes-stage-<id>`, `<output>.glirastes-backup-<id>`).
+ */
+const ATOMIC_WRITE_INFIXES = ['.glirastes-stage-', '.glirastes-backup-'];
+const appRelative = (path) => {
+    const normalized = posix.normalize(path.split('\\').join('/'));
+    return normalized === '.' ? '' : normalized;
+};
+/** Whether a change at this app-relative path can change the tools; generated files never retrigger. */
+export function isWatchedPath(path, generatedModule) {
+    const normalized = appRelative(path);
+    if (normalized === '' || normalized === appRelative(generatedModule))
+        return false;
+    const segments = normalized.split('/');
+    if (segments[0] === '.glirastes')
+        return WATCHED_INPUTS.has(normalized);
+    if (segments.some((segment) => IGNORED_FOLDERS.has(segment)))
+        return false;
+    const top = segments[0] === 'src' ? 1 : 0;
+    if (segments.length > top + 1 && OUTPUT_FOLDERS.has(segments[top]))
+        return false;
+    const name = segments.at(-1);
+    if (ATOMIC_WRITE_INFIXES.some((infix) => name.includes(infix)))
+        return false;
+    return !name.startsWith('.') && !name.endsWith('~');
+}
+export const defaultToolsWatch = (root, onChange, onError) => {
+    const watcher = watchFiles(root, { recursive: true }, (_event, filename) => {
+        if (filename)
+            onChange(filename.toString());
+    });
+    watcher.on('error', onError);
+    return { close: () => { watcher.close(); } };
+};
+/**
+ * `tools refresh --watch` (spec 4.2, 4.8): refresh once, then again after
+ * each burst of relevant changes. Runs never overlap; a change during a run
+ * schedules exactly one more. A run that throws is handed to `onError` and the
+ * watch goes on. Resolves when the signal aborts; rejects with E-TOOLS-030 when
+ * the watcher cannot start or fails, after it is closed and nothing more runs.
+ */
+export async function watchToolsRefresh(options) {
+    const debounceMs = options.debounceMs ?? 300;
+    let timer;
+    let running;
+    let pending = false;
+    let stopped = false;
+    let watcherFault;
+    let resolveStop = () => undefined;
+    const stopping = new Promise((resolve) => { resolveStop = resolve; });
+    const stop = () => {
+        stopped = true;
+        if (timer)
+            clearTimeout(timer);
+        timer = undefined;
+        resolveStop();
+    };
+    const execute = async () => {
+        try {
+            await options.run();
+        }
+        catch (error) {
+            options.onError(error);
+        }
+    };
+    const runNow = () => {
+        if (stopped)
+            return;
+        if (running) {
+            pending = true;
+            return;
+        }
+        running = execute().finally(() => {
+            running = undefined;
+            if (pending) {
+                pending = false;
+                schedule();
+            }
+        });
+    };
+    const schedule = () => {
+        if (stopped)
+            return;
+        if (timer)
+            clearTimeout(timer);
+        timer = setTimeout(() => {
+            timer = undefined;
+            runNow();
+        }, debounceMs);
+    };
+    options.signal.addEventListener('abort', stop, { once: true });
+    try {
+        if (options.signal.aborted)
+            stop();
+        runNow();
+        await running;
+        if (stopped)
+            return;
+        let watcher;
+        try {
+            watcher = (options.watch ?? defaultToolsWatch)(options.root, (path) => { if (isWatchedPath(path, options.generatedModule))
+                schedule(); }, (error) => {
+                if (stopped)
+                    return;
+                watcherFault = error;
+                stop();
+            });
+        }
+        catch (error) {
+            watcherFault = error instanceof Error ? error : new Error(String(error));
+            stop();
+        }
+        await stopping;
+        watcher?.close();
+        await running;
+    }
+    finally {
+        options.signal.removeEventListener('abort', stop);
+    }
+    if (watcherFault) {
+        throw new FoundationDiagnosticError({
+            code: 'E-TOOLS-030',
+            operation: 'tools.refresh.watch',
+            message: `Cannot watch the app for changes (${watcherFault.message}). Run glirastes tools refresh without --watch, or raise the system limit for file watchers.`,
+            remediation: 'run-tools-refresh-without-watch',
+        });
+    }
+}
+//# sourceMappingURL=watch.js.map

package/dist/cli/commands/tools/watch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"watch.js","sourceRoot":"","sources":["../../../../src/cli/commands/tools/watch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,IAAI,UAAU,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAC/D,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAgB1E,+DAA+D;AAC/D,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC;IACnD,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,gBAAgB;CACvE,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;AAE1F,6GAA6G;AAC7G,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IAClD,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,YAAY;IAChH,WAAW,CAAC,YAAY;CACzB,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,oBAAoB,GAA0B,CAAC,mBAAmB,EAAE,oBAAoB,CAAC,CAAC;AAEhG,MAAM,WAAW,GAAG,CAAC,IAAY,EAAU,EAAE;IAC3C,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/D,OAAO,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;AAC9C,CAAC,CAAC;AAEF,wGAAwG;AACxG,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,eAAuB;IACjE,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,UAAU,KAAK,EAAE,IAAI,UAAU,KAAK,WAAW,CAAC,eAAe,CAAC;QAAE,OAAO,KAAK,CAAC;IACnF,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,YAAY;QAAE,OAAO,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACxE,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3E,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAClF,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC;IAC9B,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7E,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAsB,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;IAC9E,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE;QACzE,IAAI,QAAQ;YAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/C,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAQvC;IACC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC;IAC7C,IAAI,KAAgD,CAAC;IACrD,IAAI,OAAkC,CAAC;IACvC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,YAA+B,CAAC;IACpC,IAAI,WAAW,GAAe,GAAG,EAAE,CAAC,SAAS,CAAC;IAC9C,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,GAAG,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,GAAS,EAAE;QACtB,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/B,KAAK,GAAG,SAAS,CAAC;QAClB,WAAW,EAAE,CAAC;IAChB,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,KAAK,IAAmB,EAAE;QACxC,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,GAAS,EAAE;QACxB,IAAI,OAAO;YAAE,OAAO;QACpB,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,GAAG,IAAI,CAAC;YACf,OAAO;QACT,CAAC;QACD,OAAO,GAAG,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAC/B,OAAO,GAAG,SAAS,CAAC;YACpB,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,GAAG,KAAK,CAAC;gBAChB,QAAQ,EAAE,CAAC;YACb,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,GAAS,EAAE;QAC1B,IAAI,OAAO;YAAE,OAAO;QACpB,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,KAAK,GAAG,SAAS,CAAC;YAClB,MAAM,EAAE,CAAC;QACX,CAAC,EAAE,UAAU,CAAC,CAAC;IACjB,CAAC,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/D,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;YAAE,IAAI,EAAE,CAAC;QACnC,MAAM,EAAE,CAAC;QACT,MAAM,OAAO,CAAC;QACd,IAAI,OAAO;YAAE,OAAO;QACpB,IAAI,OAAiC,CAAC;QACtC,IAAI,CAAC;YACH,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,iBAAiB,CAAC,CAC5C,OAAO,CAAC,IAAI,EACZ,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,eAAe,CAAC;gBAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAC3E,CAAC,KAAK,EAAE,EAAE;gBACR,IAAI,OAAO;oBAAE,OAAO;gBACpB,YAAY,GAAG,KAAK,CAAC;gBACrB,IAAI,EAAE,CAAC;YACT,CAAC,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACzE,IAAI,EAAE,CAAC;QACT,CAAC;QACD,MAAM,QAAQ,CAAC;QACf,OAAO,EAAE,KAAK,EAAE,CAAC;QACjB,MAAM,OAAO,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,IAAI,yBAAyB,CAAC;YAClC,IAAI,EAAE,aAAa;YACnB,SAAS,EAAE,qBAAqB;YAChC,OAAO,EAAE,qCAAqC,YAAY,CAAC,OAAO,8FAA8F;YAChK,WAAW,EAAE,iCAAiC;SAC/C,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/cli/commands/validate-build.d.ts

@@ -0,0 +1,88 @@
+import { z } from 'zod';
+import { FoundationExecutionInventorySchema, discoverFoundationExecutions } from '../../codegen/execution-inventory.js';
+import { type AppSetupArtifact } from '../../contracts/app-setup.js';
+export declare const LocalPromptBundleSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    appId: z.ZodUUID;
+    artifactRef: z.ZodString;
+    sections: z.ZodObject<{
+        planner: z.ZodString;
+        appBehavior: z.ZodString;
+        responseStyle: z.ZodString;
+        capabilityFragments: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type LocalPromptBundle = z.infer<typeof LocalPromptBundleSchema>;
+export interface ValidatedWorkspace {
+    appId: string;
+    inventory: z.infer<typeof FoundationExecutionInventorySchema>;
+    executions: Awaited<ReturnType<typeof discoverFoundationExecutions>>['executions'];
+    inventoryDigest: string;
+    promptBundle: LocalPromptBundle;
+    setupArtifact?: AppSetupArtifact;
+}
+/**
+ * Local-only validation. It reads the inventory, verifies every execution
+ * against its real source, checks app identity and local artifact references,
+ * and enforces the content boundary. It performs no network access at all.
+ */
+export declare function validateWorkspace(options: {
+    rootDir: string;
+    appId: string;
+    inventoryPath?: string;
+    promptBundlePath?: string;
+    setupArtifactPath?: string;
+}): Promise<ValidatedWorkspace>;
+export interface BuiltManifests {
+    runtimeManifestPath: string;
+    promptManifestPath: string;
+    runtimeDigest: string;
+    promptDigest: string;
+}
+export interface RenderedManifests {
+    runtimeContent: string;
+    promptContent: string;
+    runtimeDigest: string;
+    promptDigest: string;
+}
+export interface RenderManifestOptions {
+    rootDir: string;
+    appId: string;
+    inventoryPath?: string;
+    promptBundlePath?: string;
+    setupArtifactPath?: string;
+}
+/** Digest of the effective, security-relevant policy per tool. */
+export declare function computePolicyDigest(artifact: AppSetupArtifact): string;
+export interface ManifestRenderInput {
+    appId: string;
+    targetAppKey: string;
+    inventoryDigest: string;
+    executions: ReadonlyArray<{
+        toolId: string;
+        stableKey: string;
+        executionKind: 'endpoint' | 'ui';
+        sourceFingerprint: string;
+        inputSchemaDigest: string;
+        outputSchemaDigest: string;
+    }>;
+    promptBundle: LocalPromptBundle;
+    setupArtifact?: AppSetupArtifact;
+}
+/** Pure manifest rendering shared by build, setup, doctor and the tools generator. */
+export declare function renderManifestContents(input: ManifestRenderInput): RenderedManifests;
+/** Render the complete build outputs in memory for an atomic caller. */
+export declare function renderManifests(options: RenderManifestOptions): Promise<RenderedManifests>;
+/**
+ * Emits content-addressed runtime and prompt manifests. Manifests carry
+ * identities and digests only: never prompt text, source, schemas, or secrets.
+ * Building never publishes and never deploys.
+ */
+export declare function buildManifests(options: {
+    rootDir: string;
+    appId: string;
+    outputDir?: string;
+    inventoryPath?: string;
+    promptBundlePath?: string;
+    setupArtifactPath?: string;
+}): Promise<BuiltManifests>;