human-to-code 0.0.1 → 0.1.2

package/dist/schemas.js

@@ -0,0 +1,228 @@
+/** JSON Schema representations of every persisted v1 pipeline artifact. */
+const SHA256 = "^[a-f0-9]{64}$";
+const ID = "^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$";
+const WORKSPACE_ID = "^[A-Za-z0-9][A-Za-z0-9._:/@-]{0,511}$";
+const PATH = "^(?!/)(?!.*(?:^|/)\\.\\.(?:/|$))(?![A-Za-z]:).+$";
+const stringArray = (minimum = 0) => ({
+    type: "array",
+    items: { type: "string", minLength: 1 },
+    minItems: minimum,
+    uniqueItems: true,
+});
+const patchOperationSchemas = [
+    {
+        type: "object",
+        additionalProperties: false,
+        required: ["kind", "path", "content"],
+        properties: {
+            kind: { const: "create" },
+            path: { type: "string", pattern: PATH },
+            content: { type: "string", maxLength: 10_000_000 },
+        },
+    },
+    {
+        type: "object",
+        additionalProperties: false,
+        required: ["kind", "path", "baseHash", "oldText", "newText"],
+        properties: {
+            kind: { const: "edit" },
+            path: { type: "string", pattern: PATH },
+            baseHash: { type: "string", pattern: SHA256 },
+            oldText: { type: "string", minLength: 1, maxLength: 10_000_000 },
+            newText: { type: "string", maxLength: 10_000_000 },
+        },
+    },
+    {
+        type: "object",
+        additionalProperties: false,
+        required: ["kind", "path", "baseHash"],
+        properties: {
+            kind: { const: "delete" },
+            path: { type: "string", pattern: PATH },
+            baseHash: { type: "string", pattern: SHA256 },
+        },
+    },
+    {
+        type: "object",
+        additionalProperties: false,
+        required: ["kind", "from", "path", "baseHash"],
+        properties: {
+            kind: { const: "rename" },
+            from: { type: "string", pattern: PATH },
+            path: { type: "string", pattern: PATH },
+            baseHash: { type: "string", pattern: SHA256 },
+        },
+    },
+];
+export const CHANGE_CONTRACT_SCHEMA_V1 = {
+    $schema: "https://json-schema.org/draft/2020-12/schema",
+    $id: "https://human-to-code.dev/schemas/change-contract-v1.json",
+    title: "ChangeContractV1",
+    type: "object",
+    additionalProperties: false,
+    required: [
+        "schemaVersion", "source", "projectFingerprint", "targetWorkspaces",
+        "targetSymbols", "requirements", "acceptanceCriteria", "scope",
+        "prohibitedChanges", "risks", "authorizedRisks", "unresolvedQuestions",
+    ],
+    properties: {
+        schemaVersion: { const: 1 },
+        source: {
+            type: "object", additionalProperties: false, required: ["path", "sha256"],
+            properties: { path: { type: "string", pattern: PATH }, sha256: { type: "string", pattern: SHA256 } },
+        },
+        projectFingerprint: { type: "string", pattern: SHA256 },
+        targetWorkspaces: { ...stringArray(1), items: { type: "string", pattern: WORKSPACE_ID } },
+        targetSymbols: stringArray(),
+        requirements: {
+            type: "array", minItems: 1,
+            items: {
+                type: "object", additionalProperties: false, required: ["id", "description"],
+                properties: { id: { type: "string", pattern: ID }, description: { type: "string", minLength: 1, maxLength: 16_384 } },
+            },
+        },
+        acceptanceCriteria: {
+            type: "object", additionalProperties: false, required: ["automated", "manual"],
+            properties: { automated: stringArray(), manual: stringArray() },
+        },
+        scope: {
+            type: "object", additionalProperties: false, required: ["allowedPaths", "allowedOperations", "prohibitedPaths"],
+            properties: {
+                allowedPaths: { ...stringArray(1), items: { type: "string", pattern: PATH } },
+                allowedOperations: { type: "array", minItems: 1, uniqueItems: true, items: { enum: ["create", "edit", "delete", "rename"] } },
+                prohibitedPaths: { ...stringArray(), items: { type: "string", pattern: PATH } },
+            },
+        },
+        prohibitedChanges: stringArray(),
+        risks: {
+            type: "array",
+            items: {
+                type: "object", additionalProperties: false, required: ["category", "reason"],
+                properties: {
+                    category: { enum: ["dependency_change", "lockfile_change", "database_migration", "public_api_break", "authentication_change", "unsafe_rust", "ffi", "validation_config_change"] },
+                    reason: { type: "string", minLength: 1, maxLength: 4096 },
+                },
+            },
+        },
+        authorizedRisks: { type: "array", uniqueItems: true, items: { enum: ["dependency_change", "lockfile_change", "database_migration", "public_api_break", "authentication_change", "unsafe_rust", "ffi", "validation_config_change"] } },
+        unresolvedQuestions: {
+            type: "array",
+            items: {
+                type: "object", additionalProperties: false, required: ["id", "question", "material"],
+                properties: { id: { type: "string", pattern: ID }, question: { type: "string", minLength: 1, maxLength: 8192 }, material: { type: "boolean" } },
+            },
+        },
+    },
+};
+/** Provider response schema. File modes are intentionally never model-controlled. */
+export const PATCH_SET_SCHEMA_V1 = {
+    $schema: "https://json-schema.org/draft/2020-12/schema",
+    $id: "https://human-to-code.dev/schemas/patch-set-v1.json",
+    title: "PatchSetV1",
+    type: "object",
+    additionalProperties: false,
+    required: ["schemaVersion", "contractHash", "snapshotHash", "operations", "requirementIds", "proposedTests"],
+    properties: {
+        schemaVersion: { const: 1 },
+        contractHash: { type: "string", pattern: SHA256 },
+        snapshotHash: { type: "string", pattern: SHA256 },
+        operations: { type: "array", minItems: 1, maxItems: 200, items: { anyOf: patchOperationSchemas } },
+        requirementIds: { ...stringArray(1), items: { type: "string", pattern: ID } },
+        proposedTests: stringArray(),
+    },
+};
+const validationCommandSchema = {
+    type: "object",
+    additionalProperties: false,
+    required: ["id", "argv", "cwd", "timeoutMs", "required", "category"],
+    properties: {
+        id: { type: "string", pattern: ID },
+        argv: { type: "array", minItems: 1, items: { type: "string", minLength: 1 } },
+        cwd: { type: "string" },
+        timeoutMs: { type: "integer", minimum: 1000, maximum: 1_800_000 },
+        required: { type: "boolean" },
+        category: { enum: ["format", "lint", "typecheck", "test", "build", "integration", "security"] },
+    },
+};
+export const VALIDATION_PLAN_SCHEMA_V1 = {
+    $schema: "https://json-schema.org/draft/2020-12/schema",
+    $id: "https://human-to-code.dev/schemas/validation-plan-v1.json",
+    title: "ValidationPlanV1",
+    type: "object",
+    additionalProperties: false,
+    required: ["schemaVersion", "profileFingerprint", "commands", "manualChecks"],
+    properties: {
+        schemaVersion: { const: 1 },
+        profileFingerprint: { type: "string", pattern: SHA256 },
+        commands: { type: "array", minItems: 1, items: validationCommandSchema },
+        manualChecks: stringArray(),
+    },
+};
+const commandResultSchema = {
+    type: "object", additionalProperties: false,
+    required: ["id", "status", "exitCode", "signal", "durationMs", "stdout", "stderr", "timedOut", "flaky", "outputTruncated", "startedAt", "finishedAt"],
+    properties: {
+        id: { type: "string", pattern: ID }, status: { enum: ["passed", "failed", "skipped", "error"] },
+        exitCode: { type: ["integer", "null"] }, signal: { type: ["string", "null"] }, durationMs: { type: "integer", minimum: 0 },
+        stdout: { type: "string" }, stderr: { type: "string" }, timedOut: { type: "boolean" }, flaky: { type: "boolean" }, outputTruncated: { type: "boolean" },
+        startedAt: { type: "string", format: "date-time" }, finishedAt: { type: "string", format: "date-time" },
+    },
+};
+export const VALIDATION_REPORT_SCHEMA_V1 = {
+    $schema: "https://json-schema.org/draft/2020-12/schema",
+    $id: "https://human-to-code.dev/schemas/validation-report-v1.json",
+    title: "ValidationReportV1",
+    type: "object", additionalProperties: false,
+    required: ["schemaVersion", "status", "sandbox", "baseline", "candidate", "repairs", "manualChecks", "diagnostics", "startedAt", "finishedAt"],
+    properties: {
+        schemaVersion: { const: 1 }, status: { enum: ["validated", "non_regression_only", "unvalidated", "failed"] }, sandbox: { enum: ["strong", "degraded", "none"] },
+        baseline: { type: "array", items: commandResultSchema }, candidate: { type: "array", items: commandResultSchema },
+        repairs: { type: "array", items: { type: "object" } }, manualChecks: { type: "array", items: { type: "object" } }, diagnostics: stringArray(),
+        startedAt: { type: "string", format: "date-time" }, finishedAt: { type: "string", format: "date-time" },
+    },
+};
+export const CONTEXT_MANIFEST_SCHEMA_V1 = {
+    $schema: "https://json-schema.org/draft/2020-12/schema",
+    $id: "https://human-to-code.dev/schemas/context-manifest-v1.json",
+    title: "ContextManifestV1",
+    type: "object", additionalProperties: false,
+    required: ["schemaVersion", "projectFingerprint", "offline", "evidence", "exclusions", "budget", "redactionCount"],
+    properties: {
+        schemaVersion: { const: 1 }, projectFingerprint: { type: "string", pattern: SHA256 }, offline: { type: "boolean" },
+        evidence: { type: "array", items: { type: "object" } }, exclusions: { type: "array", items: { type: "object" } }, budget: { type: "object" },
+        redactionCount: { type: "integer", minimum: 0 },
+    },
+};
+export const RUN_RECORD_SCHEMA_V1 = {
+    $schema: "https://json-schema.org/draft/2020-12/schema",
+    $id: "https://human-to-code.dev/schemas/run-record-v1.json",
+    title: "RunRecordV1",
+    type: "object", additionalProperties: false,
+    required: ["runId", "schemaVersion", "createdAt", "updatedAt", "root", "status", "diagnostics"],
+    properties: {
+        runId: { type: "string", pattern: ID }, schemaVersion: { const: 1 }, createdAt: { type: "string", format: "date-time" }, updatedAt: { type: "string", format: "date-time" },
+        root: { type: "string" }, status: { enum: ["VERIFIED", "NEEDS_INPUT", "UNSUPPORTED", "INCONCLUSIVE", "FAILED", "SECURITY_BLOCKED"] },
+        contractHash: { type: "string", pattern: SHA256 }, contextManifestHash: { type: "string", pattern: SHA256 }, patchHash: { type: "string", pattern: SHA256 }, validationReportHash: { type: "string", pattern: SHA256 },
+        provider: { type: "object" },
+        usage: {
+            type: "object",
+            additionalProperties: false,
+            required: ["inputTokens", "outputTokens", "totalTokens", "requests"],
+            properties: {
+                inputTokens: { type: "integer", minimum: 0 }, outputTokens: { type: "integer", minimum: 0 },
+                totalTokens: { type: "integer", minimum: 0 }, requests: { type: "integer", minimum: 0 },
+                repairs: { type: "integer", minimum: 0, maximum: 2 }, costUsd: { type: "number", minimum: 0 },
+            },
+        },
+        diagnostics: stringArray(),
+    },
+};
+export const ARTIFACT_SCHEMAS_V1 = Object.freeze({
+    ChangeContractV1: CHANGE_CONTRACT_SCHEMA_V1,
+    ContextManifestV1: CONTEXT_MANIFEST_SCHEMA_V1,
+    PatchSetV1: PATCH_SET_SCHEMA_V1,
+    ValidationPlanV1: VALIDATION_PLAN_SCHEMA_V1,
+    ValidationReportV1: VALIDATION_REPORT_SCHEMA_V1,
+    RunRecordV1: RUN_RECORD_SCHEMA_V1,
+});
+//# sourceMappingURL=schemas.js.map

package/dist/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAI3E,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAChC,MAAM,EAAE,GAAG,qCAAqC,CAAC;AACjD,MAAM,YAAY,GAAG,uCAAuC,CAAC;AAC7D,MAAM,IAAI,GAAG,kDAAkD,CAAC;AAEhE,MAAM,WAAW,GAAG,CAAC,OAAO,GAAG,CAAC,EAA2B,EAAE,CAAC,CAAC;IAC7D,IAAI,EAAE,OAAO;IACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;IACvC,QAAQ,EAAE,OAAO;IACjB,WAAW,EAAE,IAAI;CAClB,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG;IAC5B;QACE,IAAI,EAAE,QAAQ;QACd,oBAAoB,EAAE,KAAK;QAC3B,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC;QACrC,UAAU,EAAE;YACV,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;YACzB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE;YACvC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE;SACnD;KACF;IACD;QACE,IAAI,EAAE,QAAQ;QACd,oBAAoB,EAAE,KAAK;QAC3B,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC;QAC5D,UAAU,EAAE;YACV,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;YACvB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE;YACvC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE;YAC7C,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE;YAChE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE;SACnD;KACF;IACD;QACE,IAAI,EAAE,QAAQ;QACd,oBAAoB,EAAE,KAAK;QAC3B,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC;QACtC,UAAU,EAAE;YACV,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;YACzB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE;YACvC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE;SAC9C;KACF;IACD;QACE,IAAI,EAAE,QAAQ;QACd,oBAAoB,EAAE,KAAK;QAC3B,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC;QAC9C,UAAU,EAAE;YACV,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;YACzB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE;YACvC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE;YACvC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE;SAC9C;KACF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,OAAO,EAAE,8CAA8C;IACvD,GAAG,EAAE,2DAA2D;IAChE,KAAK,EAAE,kBAAkB;IACzB,IAAI,EAAE,QAAQ;IACd,oBAAoB,EAAE,KAAK;IAC3B,QAAQ,EAAE;QACR,eAAe,EAAE,QAAQ,EAAE,oBAAoB,EAAE,kBAAkB;QACnE,eAAe,EAAE,cAAc,EAAE,oBAAoB,EAAE,OAAO;QAC9D,mBAAmB,EAAE,OAAO,EAAE,iBAAiB,EAAE,qBAAqB;KACvE;IACD,UAAU,EAAE;QACV,aAAa,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE;QAC3B,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;YACzE,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;SACrG;QACD,kBAAkB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE;QACvD,gBAAgB,EAAE,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE;QACzF,aAAa,EAAE,WAAW,EAAE;QAC5B,YAAY,EAAE;YACZ,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;YAC1B,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,aAAa,CAAC;gBAC5E,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE;aACtH;SACF;QACD,kBAAkB,EAAE;YAClB,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAC;YAC9E,UAAU,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE;SAChE;QACD,KAAK,EAAE;YACL,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,cAAc,EAAE,mBAAmB,EAAE,iBAAiB,CAAC;YAC/G,UAAU,EAAE;gBACV,YAAY,EAAE,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;gBAC7E,iBAAiB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE;gBAC7H,eAAe,EAAE,EAAE,GAAG,WAAW,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;aAChF;SACF;QACD,iBAAiB,EAAE,WAAW,EAAE;QAChC,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC;gBAC7E,UAAU,EAAE;oBACV,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,mBAAmB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,aAAa,EAAE,KAAK,EAAE,0BAA0B,CAAC,EAAE;oBACjL,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE;iBAC1D;aACF;SACF;QACD,eAAe,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,mBAAmB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,aAAa,EAAE,KAAK,EAAE,0BAA0B,CAAC,EAAE,EAAE;QACrO,mBAAmB,EAAE;YACnB,IAAI,EAAE,OAAO;YACb,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,CAAC;gBACrF,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;aAChJ;SACF;KACF;CACyB,CAAC;AAE7B,qFAAqF;AACrF,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,OAAO,EAAE,8CAA8C;IACvD,GAAG,EAAE,qDAAqD;IAC1D,KAAK,EAAE,YAAY;IACnB,IAAI,EAAE,QAAQ;IACd,oBAAoB,EAAE,KAAK;IAC3B,QAAQ,EAAE,CAAC,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,gBAAgB,EAAE,eAAe,CAAC;IAC5G,UAAU,EAAE;QACV,aAAa,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE;QAC3B,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE;QACjD,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE;QACjD,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE;QAClG,cAAc,EAAE,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE;QAC7E,aAAa,EAAE,WAAW,EAAE;KAC7B;CACyB,CAAC;AAE7B,MAAM,uBAAuB,GAAG;IAC9B,IAAI,EAAE,QAAQ;IACd,oBAAoB,EAAE,KAAK;IAC3B,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,CAAC;IACpE,UAAU,EAAE;QACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE;QACnC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE;QAC7E,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACvB,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE;QACjE,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC7B,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,UAAU,CAAC,EAAE;KAChG;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,OAAO,EAAE,8CAA8C;IACvD,GAAG,EAAE,2DAA2D;IAChE,KAAK,EAAE,kBAAkB;IACzB,IAAI,EAAE,QAAQ;IACd,oBAAoB,EAAE,KAAK;IAC3B,QAAQ,EAAE,CAAC,eAAe,EAAE,oBAAoB,EAAE,UAAU,EAAE,cAAc,CAAC;IAC7E,UAAU,EAAE;QACV,aAAa,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE;QAC3B,kBAAkB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE;QACvD,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE;QACxE,YAAY,EAAE,WAAW,EAAE;KAC5B;CACyB,CAAC;AAE7B,MAAM,mBAAmB,GAAG;IAC1B,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,KAAK;IAC3C,QAAQ,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,YAAY,CAAC;IACrJ,UAAU,EAAE;QACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE;QAC/F,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE;QAC1H,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QACvJ,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE;KACxG;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,OAAO,EAAE,8CAA8C;IACvD,GAAG,EAAE,6DAA6D;IAClE,KAAK,EAAE,oBAAoB;IAC3B,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,KAAK;IAC3C,QAAQ,EAAE,CAAC,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,CAAC;IAC9I,UAAU,EAAE;QACV,aAAa,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,qBAAqB,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE;QAC/J,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE;QACjH,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE;QAC7I,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE;KACxG;CACyB,CAAC;AAE7B,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,OAAO,EAAE,8CAA8C;IACvD,GAAG,EAAE,4DAA4D;IACjE,KAAK,EAAE,mBAAmB;IAC1B,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,KAAK;IAC3C,QAAQ,EAAE,CAAC,eAAe,EAAE,oBAAoB,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,gBAAgB,CAAC;IAClH,UAAU,EAAE;QACV,aAAa,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAClH,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC5I,cAAc,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE;KAChD;CACyB,CAAC;AAE7B,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,OAAO,EAAE,8CAA8C;IACvD,GAAG,EAAE,sDAAsD;IAC3D,KAAK,EAAE,aAAa;IACpB,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,KAAK;IAC3C,QAAQ,EAAE,CAAC,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC;IAC/F,UAAU,EAAE;QACV,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE;QAC3K,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,EAAE;QACpI,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,mBAAmB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,oBAAoB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE;QACtN,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC5B,KAAK,EAAE;YACL,IAAI,EAAE,QAAQ;YACd,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,CAAC,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,CAAC;YACpE,UAAU,EAAE;gBACV,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE;gBAC3F,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE;gBACvF,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE;aAC9F;SACF;QACD,WAAW,EAAE,WAAW,EAAE;KAC3B;CACyB,CAAC;AAE7B,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/C,gBAAgB,EAAE,yBAAyB;IAC3C,iBAAiB,EAAE,0BAA0B;IAC7C,UAAU,EAAE,mBAAmB;IAC/B,gBAAgB,EAAE,yBAAyB;IAC3C,kBAAkB,EAAE,2BAA2B;IAC/C,WAAW,EAAE,oBAAoB;CAClC,CAAC,CAAC"}

package/dist/secret-scan.d.ts

@@ -0,0 +1,30 @@
+/** Fail-closed repository-wide credential scan performed before provider access. */
+import { type SecretKind } from "./context.ts";
+export interface ProjectSecretFindingV1 {
+    path: string;
+    kind: SecretKind;
+    line: number;
+}
+export interface ProjectSecretScanOptions {
+    maxFiles?: number;
+    maxBytes?: number;
+    maxFindings?: number;
+}
+export interface ProjectSecretScanResultV1 {
+    filesScanned: number;
+    bytesScanned: number;
+    symlinksSkipped: number;
+    findings: ProjectSecretFindingV1[];
+}
+export declare class ProjectSecretScanError extends Error {
+    readonly code: "INVALID_ROOT" | "PARTIAL_SCAN" | "SECRET_DETECTED";
+    readonly findings: readonly ProjectSecretFindingV1[];
+    constructor(code: ProjectSecretScanError["code"], message: string, findings?: readonly ProjectSecretFindingV1[]);
+}
+/**
+ * Scan first-party regular files, including ignored/untracked fixtures and
+ * logs. Dependency stores and VCS/tool internals are excluded because they are
+ * neither provider context nor first-party source.
+ */
+export declare function scanProjectForSecrets(rootInput: string, options?: ProjectSecretScanOptions): Promise<ProjectSecretScanResultV1>;
+//# sourceMappingURL=secret-scan.d.ts.map

package/dist/secret-scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-scan.d.ts","sourceRoot":"","sources":["../src/secret-scan.ts"],"names":[],"mappings":"AAAA,oFAAoF;AAKpF,OAAO,EAAe,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAI5D,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,sBAAsB,EAAE,CAAC;CACpC;AAED,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,IAAI,EAAE,cAAc,GAAG,cAAc,GAAG,iBAAiB,CAAC;IACnE,QAAQ,CAAC,QAAQ,EAAE,SAAS,sBAAsB,EAAE,CAAC;gBAEzC,IAAI,EAAE,sBAAsB,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,GAAE,SAAS,sBAAsB,EAAO;CAMpH;AAMD;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,yBAAyB,CAAC,CAwFpC"}

package/dist/secret-scan.js

@@ -0,0 +1,122 @@
+/** Fail-closed repository-wide credential scan performed before provider access. */
+import { constants as fsConstants } from "node:fs";
+import { lstat, open, readdir, realpath } from "node:fs/promises";
+import { relative, resolve, sep } from "node:path";
+import { scanSecrets } from "./context.js";
+const SKIP_DIRECTORIES = new Set(["node_modules", ".venv", "venv", "target", ".git", ".hg", ".svn", ".human-to-code"]);
+export class ProjectSecretScanError extends Error {
+    code;
+    findings;
+    constructor(code, message, findings = []) {
+        super(message);
+        this.name = "ProjectSecretScanError";
+        this.code = code;
+        this.findings = findings;
+    }
+}
+function toPosix(value) {
+    return value.split(sep).join("/");
+}
+/**
+ * Scan first-party regular files, including ignored/untracked fixtures and
+ * logs. Dependency stores and VCS/tool internals are excluded because they are
+ * neither provider context nor first-party source.
+ */
+export async function scanProjectForSecrets(rootInput, options = {}) {
+    const root = resolve(rootInput);
+    const maximumFiles = options.maxFiles ?? 100_000;
+    const maximumBytes = options.maxBytes ?? 2 * 1024 * 1024 * 1024;
+    const maximumFindings = options.maxFindings ?? 100;
+    if (!Number.isSafeInteger(maximumFiles) || maximumFiles < 1 || !Number.isSafeInteger(maximumBytes) || maximumBytes < 1 || !Number.isSafeInteger(maximumFindings) || maximumFindings < 1) {
+        throw new RangeError("Secret scan budgets must be positive safe integers.");
+    }
+    const rootMetadata = await lstat(root).catch((cause) => {
+        throw new ProjectSecretScanError("INVALID_ROOT", `Cannot inspect secret-scan root: ${String(cause)}`);
+    });
+    if (!rootMetadata.isDirectory() || rootMetadata.isSymbolicLink())
+        throw new ProjectSecretScanError("INVALID_ROOT", "Secret-scan root must be a real directory.");
+    const canonicalRoot = await realpath(root);
+    const result = { filesScanned: 0, bytesScanned: 0, symlinksSkipped: 0, findings: [] };
+    const scanFile = async (absolute, path) => {
+        const before = await lstat(absolute).catch((cause) => {
+            throw new ProjectSecretScanError("PARTIAL_SCAN", `Cannot inspect ${path}: ${String(cause)}`);
+        });
+        if (before.isSymbolicLink()) {
+            result.symlinksSkipped += 1;
+            return;
+        }
+        if (!before.isFile() || before.nlink > 1)
+            throw new ProjectSecretScanError("PARTIAL_SCAN", `Secret scan encountered a non-regular or hard-linked file: ${path}.`);
+        if (result.filesScanned + 1 > maximumFiles || result.bytesScanned + before.size > maximumBytes)
+            throw new ProjectSecretScanError("PARTIAL_SCAN", "Repository exceeds the configured secret-scan budget.");
+        const handle = await open(absolute, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW).catch((cause) => {
+            throw new ProjectSecretScanError("PARTIAL_SCAN", `Cannot securely open ${path}: ${String(cause)}`);
+        });
+        try {
+            const opened = await handle.stat();
+            if (!opened.isFile() || opened.dev !== before.dev || opened.ino !== before.ino || opened.size !== before.size)
+                throw new ProjectSecretScanError("PARTIAL_SCAN", `File changed during secret scan: ${path}.`);
+            result.filesScanned += 1;
+            result.bytesScanned += opened.size;
+            let tail = "";
+            let priorLines = 0;
+            const stream = handle.createReadStream({ autoClose: false, highWaterMark: 256 * 1024 });
+            for await (const raw of stream) {
+                const chunk = Buffer.isBuffer(raw) ? raw : Buffer.from(raw);
+                const decoded = chunk.toString("utf8");
+                const searchable = `${tail}${decoded}`;
+                const tailLines = tail.match(/\n/gu)?.length ?? 0;
+                const findings = scanSecrets(searchable);
+                if (/-----BEGIN (?:[A-Z0-9 ]+ )?PRIVATE KEY-----/u.test(searchable) && !findings.some((item) => item.kind === "private_key")) {
+                    findings.push({ kind: "private_key", line: 1, start: 0, end: 0 });
+                }
+                for (const finding of findings) {
+                    result.findings.push({ path, kind: finding.kind, line: Math.max(1, priorLines - tailLines + finding.line) });
+                    if (result.findings.length >= maximumFindings)
+                        break;
+                }
+                if (result.findings.length >= maximumFindings)
+                    break;
+                priorLines += decoded.match(/\n/gu)?.length ?? 0;
+                tail = searchable.slice(-4096);
+            }
+        }
+        finally {
+            await handle.close().catch(() => undefined);
+        }
+    };
+    const walk = async (directory) => {
+        const entries = await readdir(directory, { withFileTypes: true }).catch((cause) => {
+            const path = toPosix(relative(canonicalRoot, directory)) || ".";
+            throw new ProjectSecretScanError("PARTIAL_SCAN", `Cannot read ${path}: ${String(cause)}`);
+        });
+        entries.sort((left, right) => left.name.localeCompare(right.name));
+        for (const entry of entries) {
+            if (result.findings.length >= maximumFindings)
+                return;
+            const absolute = resolve(directory, entry.name);
+            const path = toPosix(relative(canonicalRoot, absolute));
+            if (entry.isSymbolicLink()) {
+                result.symlinksSkipped += 1;
+                continue;
+            }
+            if (entry.isDirectory()) {
+                if (!SKIP_DIRECTORIES.has(entry.name))
+                    await walk(absolute);
+            }
+            else if (entry.isFile()) {
+                await scanFile(absolute, path);
+            }
+            else {
+                throw new ProjectSecretScanError("PARTIAL_SCAN", `Secret scan encountered a special file: ${path}.`);
+            }
+        }
+    };
+    await walk(canonicalRoot);
+    if (result.findings.length > 0) {
+        const locations = result.findings.slice(0, 10).map((finding) => `${finding.path}:${finding.line} (${finding.kind})`).join(", ");
+        throw new ProjectSecretScanError("SECRET_DETECTED", `Credential-like content was found before provider/cache/report writes: ${locations}.`, result.findings);
+    }
+    return result;
+}
+//# sourceMappingURL=secret-scan.js.map

package/dist/secret-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-scan.js","sourceRoot":"","sources":["../src/secret-scan.ts"],"names":[],"mappings":"AAAA,oFAAoF;AAEpF,OAAO,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,WAAW,EAAmB,MAAM,cAAc,CAAC;AAE5D,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAqBvH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACtC,IAAI,CAAsD;IAC1D,QAAQ,CAAoC;IAErD,YAAY,IAAoC,EAAE,OAAe,EAAE,WAA8C,EAAE;QACjH,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAiB,EACjB,UAAoC,EAAE;IAEtC,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC;IACjD,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;IAChE,MAAM,eAAe,GAAG,OAAO,CAAC,WAAW,IAAI,GAAG,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;QACxL,MAAM,IAAI,UAAU,CAAC,qDAAqD,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC9D,MAAM,IAAI,sBAAsB,CAAC,cAAc,EAAE,oCAAoC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACxG,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,YAAY,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,sBAAsB,CAAC,cAAc,EAAE,4CAA4C,CAAC,CAAC;IACjK,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,MAAM,GAA8B,EAAE,YAAY,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAEjH,MAAM,QAAQ,GAAG,KAAK,EAAE,QAAgB,EAAE,IAAY,EAAiB,EAAE;QACvE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC5D,MAAM,IAAI,sBAAsB,CAAC,cAAc,EAAE,kBAAkB,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/F,CAAC,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,cAAc,EAAE,EAAE,CAAC;YAC5B,MAAM,CAAC,eAAe,IAAI,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC;YAAE,MAAM,IAAI,sBAAsB,CAAC,cAAc,EAAE,8DAA8D,IAAI,GAAG,CAAC,CAAC;QAClK,IAAI,MAAM,CAAC,YAAY,GAAG,CAAC,GAAG,YAAY,IAAI,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,IAAI,GAAG,YAAY;YAAE,MAAM,IAAI,sBAAsB,CAAC,cAAc,EAAE,uDAAuD,CAAC,CAAC;QAC1M,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC1G,MAAM,IAAI,sBAAsB,CAAC,cAAc,EAAE,wBAAwB,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrG,CAAC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;gBAAE,MAAM,IAAI,sBAAsB,CAAC,cAAc,EAAE,oCAAoC,IAAI,GAAG,CAAC,CAAC;YAC7M,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC;YACzB,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC;YACnC,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,MAAM,MAAM,GAAG,MAAM,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,GAAG,IAAI,EAAE,CAAC,CAAC;YACxF,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;gBAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC5D,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACvC,MAAM,UAAU,GAAG,GAAG,IAAI,GAAG,OAAO,EAAE,CAAC;gBACvC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC;gBAClD,MAAM,QAAQ,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;gBACzC,IAAI,8CAA8C,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,aAAa,CAAC,EAAE,CAAC;oBAC7H,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBACpE,CAAC;gBACD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;oBAC/B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBAC7G,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,eAAe;wBAAE,MAAM;gBACvD,CAAC;gBACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,eAAe;oBAAE,MAAM;gBACrD,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC;gBACjD,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,KAAK,EAAE,SAAiB,EAAiB,EAAE;QACtD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACzF,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,IAAI,GAAG,CAAC;YAChE,MAAM,IAAI,sBAAsB,CAAC,cAAc,EAAE,eAAe,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC5F,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACnE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,eAAe;gBAAE,OAAO;YACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAChD,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC;YACxD,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC3B,MAAM,CAAC,eAAe,IAAI,CAAC,CAAC;gBAC5B,SAAS;YACX,CAAC;YACD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9D,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1B,MAAM,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACjC,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,sBAAsB,CAAC,cAAc,EAAE,2CAA2C,IAAI,GAAG,CAAC,CAAC;YACvG,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1B,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChI,MAAM,IAAI,sBAAsB,CAAC,iBAAiB,EAAE,0EAA0E,SAAS,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/J,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/snapshot.d.ts

@@ -0,0 +1,33 @@
+/** Isolated, content-addressed workspace snapshots used for validation. */
+export interface SnapshotOptions {
+    includeNodeModules?: boolean;
+    maxFiles?: number;
+    maxBytes?: number;
+    excludeNames?: string[];
+}
+export interface SnapshotFile {
+    path: string;
+    sha256: string;
+    size: number;
+    mode: number;
+}
+export interface WorkspaceSnapshot {
+    sourceRoot: string;
+    root: string;
+    files: SnapshotFile[];
+    excluded: string[];
+    snapshotHash: string;
+    totalBytes: number;
+}
+export declare class SnapshotError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+/**
+ * Create a private copy without VCS metadata or credential-bearing files.
+ * Symlinks and special files are rejected instead of copied or dereferenced.
+ */
+export declare function createWorkspaceSnapshot(rootInput: string, options?: SnapshotOptions): Promise<WorkspaceSnapshot>;
+export declare function cloneWorkspaceSnapshot(source: WorkspaceSnapshot, options?: SnapshotOptions): Promise<WorkspaceSnapshot>;
+export declare function disposeWorkspaceSnapshot(snapshot: WorkspaceSnapshot): Promise<void>;
+//# sourceMappingURL=snapshot.d.ts.map

package/dist/snapshot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshot.d.ts","sourceRoot":"","sources":["../src/snapshot.ts"],"names":[],"mappings":"AAAA,2EAA2E;AA+B3E,MAAM,WAAW,eAAe;IAC9B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK1C;AAsBD;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,iBAAiB,CAAC,CA0E5B;AAED,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,iBAAiB,EACzB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,iBAAiB,CAAC,CAK5B;AAED,wBAAsB,wBAAwB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAQzF"}

package/dist/snapshot.js

@@ -0,0 +1,136 @@
+/** Isolated, content-addressed workspace snapshots used for validation. */
+import { chmod, copyFile, lstat, mkdir, mkdtemp, readdir, readFile, rm, } from "node:fs/promises";
+import { basename, join, relative, resolve, sep } from "node:path";
+import { tmpdir } from "node:os";
+import { hashCanonical, sha256Bytes } from "./contracts.js";
+const ALWAYS_EXCLUDE_NAMES = new Set([
+    ".git",
+    ".hg",
+    ".svn",
+    ".human-to-code",
+    "secrets.human",
+]);
+const SECRET_FILE_PATTERNS = [
+    /^\.env(?:\.|$)/i,
+    /^(?:id_rsa|id_dsa|id_ecdsa|id_ed25519)(?:\.|$)/i,
+    /\.(?:pem|p12|pfx|key)$/i,
+    /^(?:credentials|service-account)(?:\.|$)/i,
+];
+export class SnapshotError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = "SnapshotError";
+        this.code = code;
+    }
+}
+function toPosix(value) {
+    return value.split(sep).join("/");
+}
+function isSecretName(name) {
+    return SECRET_FILE_PATTERNS.some((pattern) => pattern.test(name));
+}
+async function assertRealDirectory(path) {
+    let info;
+    try {
+        info = await lstat(path);
+    }
+    catch (error) {
+        throw new SnapshotError("INVALID_ROOT", `Cannot inspect snapshot root: ${String(error)}.`);
+    }
+    if (!info.isDirectory() || info.isSymbolicLink()) {
+        throw new SnapshotError("INVALID_ROOT", "Snapshot root must be a real directory.");
+    }
+}
+/**
+ * Create a private copy without VCS metadata or credential-bearing files.
+ * Symlinks and special files are rejected instead of copied or dereferenced.
+ */
+export async function createWorkspaceSnapshot(rootInput, options = {}) {
+    const sourceRoot = resolve(rootInput);
+    await assertRealDirectory(sourceRoot);
+    const container = await mkdtemp(join(tmpdir(), "human-to-code-snapshot-"));
+    await chmod(container, 0o700);
+    const root = join(container, "workspace");
+    await mkdir(root, { mode: 0o700 });
+    const excluded = [];
+    const files = [];
+    const excludedNames = new Set([...ALWAYS_EXCLUDE_NAMES, ...(options.excludeNames ?? [])]);
+    if (!options.includeNodeModules)
+        excludedNames.add("node_modules");
+    const maxFiles = options.maxFiles ?? 100_000;
+    const maxBytes = options.maxBytes ?? 2 * 1024 * 1024 * 1024;
+    let totalBytes = 0;
+    const walk = async (sourceDirectory, targetDirectory) => {
+        const entries = await readdir(sourceDirectory, { withFileTypes: true }).catch((error) => {
+            throw new SnapshotError("PARTIAL_SCAN", `Cannot read ${sourceDirectory}: ${String(error)}.`);
+        });
+        entries.sort((a, b) => a.name.localeCompare(b.name));
+        for (const entry of entries) {
+            const source = join(sourceDirectory, entry.name);
+            const target = join(targetDirectory, entry.name);
+            const relPath = toPosix(relative(sourceRoot, source));
+            if (excludedNames.has(entry.name) || isSecretName(entry.name)) {
+                excluded.push(relPath);
+                continue;
+            }
+            if (entry.isSymbolicLink()) {
+                throw new SnapshotError("SYMLINK_BLOCKED", `Snapshot contains a symlink: ${relPath}.`);
+            }
+            if (entry.isDirectory()) {
+                await mkdir(target, { mode: 0o700 });
+                await walk(source, target);
+                continue;
+            }
+            if (!entry.isFile()) {
+                throw new SnapshotError("SPECIAL_FILE_BLOCKED", `Snapshot contains a special file: ${relPath}.`);
+            }
+            const info = await lstat(source);
+            if (info.nlink > 1) {
+                throw new SnapshotError("HARDLINK_BLOCKED", `Snapshot contains a hard-linked file: ${relPath}.`);
+            }
+            if (files.length + 1 > maxFiles || totalBytes + info.size > maxBytes) {
+                throw new SnapshotError("SNAPSHOT_TOO_LARGE", "Workspace exceeds the configured snapshot budget.");
+            }
+            await copyFile(source, target);
+            const mode = info.mode & 0o777;
+            await chmod(target, mode);
+            const bytes = await readFile(target);
+            totalBytes += bytes.length;
+            files.push({ path: relPath, sha256: sha256Bytes(bytes), size: bytes.length, mode });
+        }
+    };
+    try {
+        await walk(sourceRoot, root);
+    }
+    catch (error) {
+        await rm(container, { recursive: true, force: true });
+        throw error;
+    }
+    files.sort((a, b) => a.path.localeCompare(b.path));
+    excluded.sort();
+    return {
+        sourceRoot,
+        root,
+        files,
+        excluded,
+        snapshotHash: hashCanonical(files),
+        totalBytes,
+    };
+}
+export async function cloneWorkspaceSnapshot(source, options = {}) {
+    return createWorkspaceSnapshot(source.root, {
+        ...options,
+        includeNodeModules: options.includeNodeModules ?? true,
+    });
+}
+export async function disposeWorkspaceSnapshot(snapshot) {
+    // The public root is always `<private temp>/workspace`; deleting its parent
+    // removes the snapshot atomically from the user's perspective.
+    const parent = resolve(snapshot.root, "..");
+    if (basename(snapshot.root) !== "workspace" || !basename(parent).startsWith("human-to-code-snapshot-")) {
+        throw new SnapshotError("INVALID_SNAPSHOT", "Refusing to remove a directory not owned by the snapshot store.");
+    }
+    await rm(parent, { recursive: true, force: true });
+}
+//# sourceMappingURL=snapshot.js.map

package/dist/snapshot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshot.js","sourceRoot":"","sources":["../src/snapshot.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAE3E,OAAO,EACL,KAAK,EACL,QAAQ,EACR,KAAK,EACL,KAAK,EACL,OAAO,EACP,OAAO,EACP,QAAQ,EACR,EAAE,GACH,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACnE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE5D,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,MAAM;IACN,KAAK;IACL,MAAM;IACN,gBAAgB;IAChB,eAAe;CAChB,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG;IAC3B,iBAAiB;IACjB,iDAAiD;IACjD,yBAAyB;IACzB,2CAA2C;CAC5C,CAAC;AAyBF,MAAM,OAAO,aAAc,SAAQ,KAAK;IAC7B,IAAI,CAAS;IAEtB,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,IAAY;IAC7C,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,iCAAiC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QACjD,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,yCAAyC,CAAC,CAAC;IACrF,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,SAAiB,EACjB,UAA2B,EAAE;IAE7B,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAC3E,MAAM,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC1C,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEnC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,oBAAoB,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1F,IAAI,CAAC,OAAO,CAAC,kBAAkB;QAAE,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;IAC5D,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,MAAM,IAAI,GAAG,KAAK,EAAE,eAAuB,EAAE,eAAuB,EAAiB,EAAE;QACrF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC/F,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,eAAe,eAAe,KAAK,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/F,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACrD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACjD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;YAEtD,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9D,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACvB,SAAS;YACX,CAAC;YACD,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC3B,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,gCAAgC,OAAO,GAAG,CAAC,CAAC;YACzF,CAAC;YACD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBACrC,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAC3B,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBACpB,MAAM,IAAI,aAAa,CAAC,sBAAsB,EAAE,qCAAqC,OAAO,GAAG,CAAC,CAAC;YACnG,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;YACjC,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;gBACnB,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,yCAAyC,OAAO,GAAG,CAAC,CAAC;YACnG,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,QAAQ,IAAI,UAAU,GAAG,IAAI,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;gBACrE,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,mDAAmD,CAAC,CAAC;YACrG,CAAC;YACD,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;YAC/B,MAAM,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC1B,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;YACrC,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChB,OAAO;QACL,UAAU;QACV,IAAI;QACJ,KAAK;QACL,QAAQ;QACR,YAAY,EAAE,aAAa,CAAC,KAAK,CAAC;QAClC,UAAU;KACX,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAyB,EACzB,UAA2B,EAAE;IAE7B,OAAO,uBAAuB,CAAC,MAAM,CAAC,IAAI,EAAE;QAC1C,GAAG,OAAO;QACV,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,IAAI,IAAI;KACvD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,QAA2B;IACxE,4EAA4E;IAC5E,+DAA+D;IAC/D,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5C,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,yBAAyB,CAAC,EAAE,CAAC;QACvG,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,iEAAiE,CAAC,CAAC;IACjH,CAAC;IACD,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACrD,CAAC"}

package/dist/support-matrix.d.ts

@@ -0,0 +1,23 @@
+import type { Ecosystem, SupportDecision, SupportTier } from "./analyzer-types.ts";
+export interface SupportMatrixEntry {
+    key: string;
+    ecosystem: Ecosystem;
+    variant: string;
+    versions: string;
+    tier: SupportTier;
+    capabilities: readonly string[];
+    limitations: readonly string[];
+}
+/**
+ * Versioned support declarations for the first analyzer release.
+ *
+ * Generation remains preview until the model/provider benchmark gate described
+ * by the reliability contract has actually run. Keeping that fact in data (and
+ * not in marketing copy) prevents a newly recognized project from being
+ * accidentally presented as certified.
+ */
+export declare const SUPPORT_MATRIX_VERSION: "1.0.0";
+/** Runtime-immutable: consumers cannot promote preview entries by mutation. */
+export declare const SUPPORT_MATRIX: readonly SupportMatrixEntry[];
+export declare function supportFor(ecosystem: Ecosystem, variant: string, matchedVersion?: string): SupportDecision;
+//# sourceMappingURL=support-matrix.d.ts.map

package/dist/support-matrix.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"support-matrix.d.ts","sourceRoot":"","sources":["../src/support-matrix.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEnF,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,SAAS,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,WAAW,CAAC;IAClB,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAG,OAAgB,CAAC;AA+IvD,+EAA+E;AAC/E,eAAO,MAAM,cAAc,EAAE,SAAS,kBAAkB,EAMvD,CAAC;AAEF,wBAAgB,UAAU,CACxB,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,MAAM,GACtB,eAAe,CAuCjB"}