kibi-cli 2.1.0 → 2.3.0

package/dist/performance-trace.js

@@ -0,0 +1,134 @@
+import { constants } from "node:fs";
+import { closeSync, existsSync, lstatSync, openSync, realpathSync, statSync, writeSync, } from "node:fs";
+import path from "node:path";
+export const KIBI_PERF_TRACE_DIR_ENV = "KIBI_PERF_TRACE_DIR";
+export const KIBI_PERF_TIMINGS_ENV = "KIBI_PERF_TIMINGS";
+export const KIBI_PERF_TRACE_MAX_EVENTS = 5_000;
+export const KIBI_PERF_TRACE_MAX_BYTES = 512 * 1024;
+const states = new Map();
+const MAX_DURATION_MS = 60_000;
+const TRACE_LIMIT_RESERVE_BYTES = 96;
+function isWithin(parent, candidate) {
+    const relative = path.relative(parent, candidate);
+    return (relative === "" ||
+        (relative !== ".." &&
+            !relative.startsWith(`..${path.sep}`) &&
+            !path.isAbsolute(relative)));
+}
+function privateTraceFile() {
+    if (process.env[KIBI_PERF_TIMINGS_ENV] !== "1")
+        return null;
+    const configuredDirectory = process.env[KIBI_PERF_TRACE_DIR_ENV];
+    if (!configuredDirectory || !path.isAbsolute(configuredDirectory))
+        return null;
+    try {
+        const directoryInfo = lstatSync(configuredDirectory);
+        if (!directoryInfo.isDirectory() || directoryInfo.isSymbolicLink()) {
+            return null;
+        }
+        const directory = realpathSync(configuredDirectory);
+        if (path.resolve(configuredDirectory) !== directory)
+            return null;
+        const directoryStats = statSync(directory);
+        if (typeof process.getuid !== "function" ||
+            directoryStats.uid !== process.getuid()) {
+            return null;
+        }
+        if ((directoryStats.mode & 0o077) !== 0) {
+            return null;
+        }
+        const currentDirectory = realpathSync(process.cwd());
+        if (isWithin(currentDirectory, directory))
+            return null;
+        const file = path.join(directory, `kibi-performance-${process.pid}.jsonl`);
+        let state = states.get(file);
+        if (!state) {
+            if (existsSync(file))
+                return null;
+            state = { bytes: 0, events: 0, disabled: false };
+            states.set(file, state);
+        }
+        if (state.disabled)
+            return null;
+        return { file, state };
+    }
+    catch {
+        return null;
+    }
+}
+function writeAll(fd, bytes) {
+    let offset = 0;
+    while (offset < bytes.length) {
+        const written = writeSync(fd, bytes, offset, bytes.length - offset);
+        if (written <= 0)
+            throw new Error("Performance trace write made no progress");
+        offset += written;
+    }
+}
+function appendLine(file, state, line, exclusive) {
+    const fileInfo = existsSync(file) ? lstatSync(file) : null;
+    if ((exclusive && fileInfo !== null) ||
+        (!exclusive &&
+            (!fileInfo?.isFile() ||
+                fileInfo.isSymbolicLink() ||
+                fileInfo.size !== state.bytes))) {
+        throw new Error("Performance trace file changed unexpectedly");
+    }
+    const flags = constants.O_WRONLY |
+        constants.O_CREAT |
+        constants.O_APPEND |
+        (constants.O_NOFOLLOW ?? 0) |
+        (exclusive ? constants.O_EXCL : 0);
+    const fd = openSync(file, flags, 0o600);
+    try {
+        const bytes = Buffer.from(line, "utf8");
+        writeAll(fd, bytes);
+        state.bytes += bytes.length;
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+function appendLimitMarker(file, state, limit) {
+    const marker = `${JSON.stringify({ kind: "trace-limit", pid: process.pid, limit })}\n`;
+    const byteLength = Buffer.byteLength(marker, "utf8");
+    if (state.bytes + byteLength <= KIBI_PERF_TRACE_MAX_BYTES) {
+        appendLine(file, state, marker, state.events === 0);
+    }
+    state.disabled = true;
+}
+/**
+ * Append one bounded, payload-free timing observation to the explicitly
+ * supplied private host trace directory. Trace I/O is best-effort and never
+ * changes the operation result.
+ */
+export function writePerformanceTraceEvent(event) {
+    if (!Number.isFinite(event.durationMs) ||
+        event.durationMs < 0 ||
+        event.durationMs > MAX_DURATION_MS) {
+        return;
+    }
+    const trace = privateTraceFile();
+    if (!trace)
+        return;
+    const durationMs = Math.round(event.durationMs * 1000) / 1000;
+    const line = `${JSON.stringify({
+        kind: event.kind,
+        durationMs,
+        pid: process.pid,
+    })}\n`;
+    const byteLength = Buffer.byteLength(line, "utf8");
+    try {
+        if (trace.state.events >= KIBI_PERF_TRACE_MAX_EVENTS ||
+            trace.state.bytes + byteLength >
+                KIBI_PERF_TRACE_MAX_BYTES - TRACE_LIMIT_RESERVE_BYTES) {
+            appendLimitMarker(trace.file, trace.state, trace.state.events >= KIBI_PERF_TRACE_MAX_EVENTS ? "events" : "bytes");
+            return;
+        }
+        appendLine(trace.file, trace.state, line, trace.state.events === 0);
+        trace.state.events += 1;
+    }
+    catch {
+        trace.state.disabled = true;
+    }
+}

package/dist/plugins/approved-source-analyzers.d.ts

@@ -0,0 +1,13 @@
+/** Release-qualified executable and asset closure. Updated only after qualification. */
+export interface ApprovedSourceAnalyzer {
+    packageName: string;
+    version: string;
+    files: Readonly<Record<string, string>>;
+    dependencies: readonly {
+        packageName: string;
+        version: string;
+        files: Readonly<Record<string, string>>;
+    }[];
+}
+export declare const APPROVED_SOURCE_ANALYZERS: readonly ApprovedSourceAnalyzer[];
+//# sourceMappingURL=approved-source-analyzers.d.ts.map

package/dist/plugins/approved-source-analyzers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approved-source-analyzers.d.ts","sourceRoot":"","sources":["../../src/plugins/approved-source-analyzers.ts"],"names":[],"mappings":"AAEA,wFAAwF;AAExF,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACxC,YAAY,EAAE,SAAS;QACrB,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;KACzC,EAAE,CAAC;CACL;AAGD,eAAO,MAAM,yBAAyB,EAAE,SAAS,sBAAsB,EAC7C,CAAC"}

package/dist/plugins/approved-source-analyzers.generated.d.ts

@@ -0,0 +1,71 @@
+export declare const qualifiedSourceAnalyzers: readonly [{
+    readonly packageName: "kibi-plugin-treesitter";
+    readonly version: "1.0.0";
+    readonly files: {
+        readonly "SBOM.spdx.json": "92cf77d240ffc1e95116edd4742363e34ead66b455dbf940f24321a19e7f9571";
+        readonly "THIRD_PARTY_NOTICES.md": "0b1ede96cb261dab73fd1ec8c51d7bb5b2492eed0502f6c10ed071736daa263c";
+        readonly "assets/queries/bash.scm": "6ca535e8fe652b51203ac272831881dab001f7ac508e50551bc2cdc4a15d7b6c";
+        readonly "assets/queries/c.scm": "774ca67cfe23b0e0d1d3a4f01788049a822beb1311feee72b20a595a37be1e28";
+        readonly "assets/queries/cpp-extra.scm": "7cf486901eaf7e9196bc2c5dfe83785eed70d367136f8008af37eb4f1c12a68a";
+        readonly "assets/queries/cpp.scm": "029731ca946e32f919491d9f76c85a50e5deb5ad1934e37fd6849312c0d4a705";
+        readonly "assets/queries/csharp-extra.scm": "d3a55c3c67cb236921da5785d08d146ba53f70d9e2af83a365f59954f8878a57";
+        readonly "assets/queries/csharp.scm": "4ed08da0162ecd48206ac34bebe7ea9757a8c7b617f6ad8f70c168d685d514fe";
+        readonly "assets/queries/go.scm": "d1a9b1f678fe0278b85054e2dc56a28ef26aa478b8c88fb2b0dd83cdcdb9db35";
+        readonly "assets/queries/hcl.scm": "cad52e3fd81bc5584ea181c920bdb8fa4be007f05f8c5e08f95e9ccb40aee93a";
+        readonly "assets/queries/java-extra.scm": "5ce7857f2b52c10b3672bc09f39f287cff2eaa7caa0b75dafccbaa5fec58431d";
+        readonly "assets/queries/java.scm": "bcb22147b8582d92743fc973864cefb894a4c12b3957f16f3d472b2ec7cd4c49";
+        readonly "assets/queries/php.scm": "4ac5e30f99f3abe5417dcb42219e0790c66f9b4bb3be071bc60160dd012f3cd8";
+        readonly "assets/queries/python.scm": "d0f3e577878167bfabc30e526e497bce58d1699b9bcabf8ab3a50698efb5ca3e";
+        readonly "assets/queries/ruby.scm": "ed1e7dc07a95b87aef267e7f9715c6717a70f09efbd7b6f48bbd51c7b7510cf3";
+        readonly "assets/queries/rust-extra.scm": "511a492200e813f15b7ebec324eae69a245986a9d6813ddabe776075fd65976c";
+        readonly "assets/queries/rust.scm": "f22867fdebde5cb091861c08d34690dc2540f4318068bf81be9f6b0d348ab8c1";
+        readonly "assets/queries/terraform.scm": "8a6974a8eb48e13b5b8cd64e7c81262a825b4251df01ab383aee5cdda8151e7e";
+        readonly "assets/tree-sitter-bash.wasm": "8292919c88a0f7d3fb31d0cd0253ca5a9531bc1ede82b0537f2c63dd8abe6a7a";
+        readonly "assets/tree-sitter-c.wasm": "c852c2a85ebf2beb636aa3b0ef7f7e70458684d74f6741b20dcb296885bed9f9";
+        readonly "assets/tree-sitter-c_sharp.wasm": "6f69e1cae44e1c32c1eccc170dc5a9778fb94ff716f71113fe1f8c4299aa2f40";
+        readonly "assets/tree-sitter-cpp.wasm": "174eb0deb75b2ec7881bcacda9f995648d8e683956e5c2267e69ab6dc503fcbf";
+        readonly "assets/tree-sitter-go.wasm": "9504573f352b20be7f2f1911754d710622aedc15afff16d5ed8fb5645681aee7";
+        readonly "assets/tree-sitter-hcl.release.wasm": "2f9acf63e7c263215f283e2cf0f4ebbb9bfa77f58e18fa42b91094be201372a7";
+        readonly "assets/tree-sitter-java.wasm": "4fdeac4ca6ca089f06c6f7e562abcac1733cd465728cc7031ebb73c2019122c4";
+        readonly "assets/tree-sitter-php.wasm": "d4df6a6ff08c87c3ec4f9cbb785fe09998a0cb570e03f57d7b19b3acfb146aa7";
+        readonly "assets/tree-sitter-python.wasm": "16108b50df4ee9a30168794252ab55e7c93bfc5765d7fa0aa3e335752c515f47";
+        readonly "assets/tree-sitter-ruby.wasm": "09a96427d7c72f0613ed470cd9812223fc4a91d6a9c025c0235cc6bd59ff96f4";
+        readonly "assets/tree-sitter-rust.wasm": "f65f354215611fd94ad34134b3427eb3d58cbb745df7b6509ba722184db73d57";
+        readonly "assets/tree-sitter-terraform.release.wasm": "59dbcbb0f08eb78b78f37510834559a48ce5c9d4866c978d62c6390796461cb5";
+        readonly "catalog.json": "4075d988391b8c893f47722fb85f93d626d700af9b2a1b4909fd20ef0ec989b4";
+        readonly "dist/analysis-worker.js": "75a1e646f636c1d1ace9ae22a9141a51e94bddc70203bed08de7bd13dae1764e";
+        readonly "dist/catalog.js": "460243c48cb6a03b8c7971273729d8a1134955186978b6c0d04182c71960ebff";
+        readonly "dist/extractor.js": "1d8cd819e7ec8fcc291a44e5ffe4ccfe77099301677913fcfe0d92e7ce971f33";
+        readonly "dist/index.js": "adc03d77d94c0133b3188950b35f79db19e447cf7bfa1f7e1cf1f5c97a582a44";
+        readonly "dist/performance-timing.js": "56cce530f627c8fd079e8ec070322f84378ae50c40a6765d88b418850692940b";
+        readonly "integrity.json": "4f1530009fdf5f087ab0b7adcae062ca141f76aa6e5acdb20c695fee963dec38";
+        readonly "licenses/tree-sitter-bash-MIT.txt": "49bf33cf78ef5897e4e161ce1517df7de1ae5042a65b6bcfd44401e0fc606559";
+        readonly "licenses/tree-sitter-c-MIT.txt": "2e0110e07abef7c2548b26ec9d6969775617ca539a0dc8dbeeb14d6452c711d1";
+        readonly "licenses/tree-sitter-c-sharp-MIT.txt": "778fb7d63b8c1844da315648c02f325c4713a6f4a5d19644fd413421422776d3";
+        readonly "licenses/tree-sitter-cpp-MIT.txt": "2e0110e07abef7c2548b26ec9d6969775617ca539a0dc8dbeeb14d6452c711d1";
+        readonly "licenses/tree-sitter-go-MIT.txt": "2e0110e07abef7c2548b26ec9d6969775617ca539a0dc8dbeeb14d6452c711d1";
+        readonly "licenses/tree-sitter-hcl-Apache-2.0.txt": "c71d239df91726fc519c6eb72d318ec65820627232b2f796219e87dcf35d0ab4";
+        readonly "licenses/tree-sitter-java-MIT.txt": "52ed137b039cd9c46409bc22e89938af911c95b157feae2d040b51e6084369a7";
+        readonly "licenses/tree-sitter-php-MIT.txt": "664764fabf40c0b318e06324a5a12379092a2df25b8cbf2415f71bc0bb352346";
+        readonly "licenses/tree-sitter-python-MIT.txt": "d724405ce238a22c0d35769c5a36b386ad5958192efe8bbb304fb2896254575f";
+        readonly "licenses/tree-sitter-ruby-MIT.txt": "9c99b99e93d3c6461bef9f6bac45d17b8bf014172625c24f76319bbd235a7b80";
+        readonly "licenses/tree-sitter-rust-MIT.txt": "31d5b6f4243d5c7c6e1c4ebbbb9f6407bd1457a08bcc4f706521710341acba36";
+        readonly "licenses/web-tree-sitter-MIT.txt": "c5cfb43042b6b72045f4ba997834d0a7786d2793d91680868b5815b39f14fc78";
+        readonly "package.json": "433313c71ef7951eb8cb58d855089f08ccab583405ab85d6a417d9309782356c";
+    };
+    readonly dependencies: readonly [{
+        readonly packageName: "web-tree-sitter";
+        readonly version: "0.27.0";
+        readonly files: {
+            readonly LICENSE: "c5cfb43042b6b72045f4ba997834d0a7786d2793d91680868b5815b39f14fc78";
+            readonly "debug/web-tree-sitter.cjs": "3faca4a6e5a006ec8e95a8e1918923ee9a385a02f64154fb2a893d5a27200f24";
+            readonly "debug/web-tree-sitter.js": "4cd02f4b5510044807279f7064e6bcceab391af3c245fc9b6da2de7b1116ff84";
+            readonly "debug/web-tree-sitter.wasm": "91a157f507fabb836588e6537a1af1bae45d3d4b9278d06d003678460b011d8e";
+            readonly "package.json": "707dd14277ba63ca8dcaad6b6df8051e23df78c878b5cbdc27885b3cfd72bfac";
+            readonly "web-tree-sitter.cjs": "743de33347202f863b6714fc7218c455d93f751943d43500500f6c5c65654dce";
+            readonly "web-tree-sitter.js": "7c49e3c1d87e24e0bb4c2def909d17154dfde281f5f8280225450090bb4b8110";
+            readonly "web-tree-sitter.wasm": "c03bccdc3b448a32848f5ae327e209c982bbb0840d43eec8bc2d5759544a1ed3";
+        };
+    }];
+}];
+//# sourceMappingURL=approved-source-analyzers.generated.d.ts.map

package/dist/plugins/approved-source-analyzers.generated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approved-source-analyzers.generated.d.ts","sourceRoot":"","sources":["../../src/plugins/approved-source-analyzers.generated.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmI3B,CAAC"}

package/dist/plugins/approved-source-analyzers.generated.js

@@ -0,0 +1,77 @@
+// Generated by scripts/qualify-source-analyzers.mjs after release qualification.
+// Do not approve changed bytes without reviewing the executable and asset closure.
+// implements REQ-source-analysis-v2
+export const qualifiedSourceAnalyzers = [
+    {
+        packageName: "kibi-plugin-treesitter",
+        version: "1.0.0",
+        files: {
+            "SBOM.spdx.json": "92cf77d240ffc1e95116edd4742363e34ead66b455dbf940f24321a19e7f9571",
+            "THIRD_PARTY_NOTICES.md": "0b1ede96cb261dab73fd1ec8c51d7bb5b2492eed0502f6c10ed071736daa263c",
+            "assets/queries/bash.scm": "6ca535e8fe652b51203ac272831881dab001f7ac508e50551bc2cdc4a15d7b6c",
+            "assets/queries/c.scm": "774ca67cfe23b0e0d1d3a4f01788049a822beb1311feee72b20a595a37be1e28",
+            "assets/queries/cpp-extra.scm": "7cf486901eaf7e9196bc2c5dfe83785eed70d367136f8008af37eb4f1c12a68a",
+            "assets/queries/cpp.scm": "029731ca946e32f919491d9f76c85a50e5deb5ad1934e37fd6849312c0d4a705",
+            "assets/queries/csharp-extra.scm": "d3a55c3c67cb236921da5785d08d146ba53f70d9e2af83a365f59954f8878a57",
+            "assets/queries/csharp.scm": "4ed08da0162ecd48206ac34bebe7ea9757a8c7b617f6ad8f70c168d685d514fe",
+            "assets/queries/go.scm": "d1a9b1f678fe0278b85054e2dc56a28ef26aa478b8c88fb2b0dd83cdcdb9db35",
+            "assets/queries/hcl.scm": "cad52e3fd81bc5584ea181c920bdb8fa4be007f05f8c5e08f95e9ccb40aee93a",
+            "assets/queries/java-extra.scm": "5ce7857f2b52c10b3672bc09f39f287cff2eaa7caa0b75dafccbaa5fec58431d",
+            "assets/queries/java.scm": "bcb22147b8582d92743fc973864cefb894a4c12b3957f16f3d472b2ec7cd4c49",
+            "assets/queries/php.scm": "4ac5e30f99f3abe5417dcb42219e0790c66f9b4bb3be071bc60160dd012f3cd8",
+            "assets/queries/python.scm": "d0f3e577878167bfabc30e526e497bce58d1699b9bcabf8ab3a50698efb5ca3e",
+            "assets/queries/ruby.scm": "ed1e7dc07a95b87aef267e7f9715c6717a70f09efbd7b6f48bbd51c7b7510cf3",
+            "assets/queries/rust-extra.scm": "511a492200e813f15b7ebec324eae69a245986a9d6813ddabe776075fd65976c",
+            "assets/queries/rust.scm": "f22867fdebde5cb091861c08d34690dc2540f4318068bf81be9f6b0d348ab8c1",
+            "assets/queries/terraform.scm": "8a6974a8eb48e13b5b8cd64e7c81262a825b4251df01ab383aee5cdda8151e7e",
+            "assets/tree-sitter-bash.wasm": "8292919c88a0f7d3fb31d0cd0253ca5a9531bc1ede82b0537f2c63dd8abe6a7a",
+            "assets/tree-sitter-c.wasm": "c852c2a85ebf2beb636aa3b0ef7f7e70458684d74f6741b20dcb296885bed9f9",
+            "assets/tree-sitter-c_sharp.wasm": "6f69e1cae44e1c32c1eccc170dc5a9778fb94ff716f71113fe1f8c4299aa2f40",
+            "assets/tree-sitter-cpp.wasm": "174eb0deb75b2ec7881bcacda9f995648d8e683956e5c2267e69ab6dc503fcbf",
+            "assets/tree-sitter-go.wasm": "9504573f352b20be7f2f1911754d710622aedc15afff16d5ed8fb5645681aee7",
+            "assets/tree-sitter-hcl.release.wasm": "2f9acf63e7c263215f283e2cf0f4ebbb9bfa77f58e18fa42b91094be201372a7",
+            "assets/tree-sitter-java.wasm": "4fdeac4ca6ca089f06c6f7e562abcac1733cd465728cc7031ebb73c2019122c4",
+            "assets/tree-sitter-php.wasm": "d4df6a6ff08c87c3ec4f9cbb785fe09998a0cb570e03f57d7b19b3acfb146aa7",
+            "assets/tree-sitter-python.wasm": "16108b50df4ee9a30168794252ab55e7c93bfc5765d7fa0aa3e335752c515f47",
+            "assets/tree-sitter-ruby.wasm": "09a96427d7c72f0613ed470cd9812223fc4a91d6a9c025c0235cc6bd59ff96f4",
+            "assets/tree-sitter-rust.wasm": "f65f354215611fd94ad34134b3427eb3d58cbb745df7b6509ba722184db73d57",
+            "assets/tree-sitter-terraform.release.wasm": "59dbcbb0f08eb78b78f37510834559a48ce5c9d4866c978d62c6390796461cb5",
+            "catalog.json": "4075d988391b8c893f47722fb85f93d626d700af9b2a1b4909fd20ef0ec989b4",
+            "dist/analysis-worker.js": "75a1e646f636c1d1ace9ae22a9141a51e94bddc70203bed08de7bd13dae1764e",
+            "dist/catalog.js": "460243c48cb6a03b8c7971273729d8a1134955186978b6c0d04182c71960ebff",
+            "dist/extractor.js": "1d8cd819e7ec8fcc291a44e5ffe4ccfe77099301677913fcfe0d92e7ce971f33",
+            "dist/index.js": "adc03d77d94c0133b3188950b35f79db19e447cf7bfa1f7e1cf1f5c97a582a44",
+            "dist/performance-timing.js": "56cce530f627c8fd079e8ec070322f84378ae50c40a6765d88b418850692940b",
+            "integrity.json": "4f1530009fdf5f087ab0b7adcae062ca141f76aa6e5acdb20c695fee963dec38",
+            "licenses/tree-sitter-bash-MIT.txt": "49bf33cf78ef5897e4e161ce1517df7de1ae5042a65b6bcfd44401e0fc606559",
+            "licenses/tree-sitter-c-MIT.txt": "2e0110e07abef7c2548b26ec9d6969775617ca539a0dc8dbeeb14d6452c711d1",
+            "licenses/tree-sitter-c-sharp-MIT.txt": "778fb7d63b8c1844da315648c02f325c4713a6f4a5d19644fd413421422776d3",
+            "licenses/tree-sitter-cpp-MIT.txt": "2e0110e07abef7c2548b26ec9d6969775617ca539a0dc8dbeeb14d6452c711d1",
+            "licenses/tree-sitter-go-MIT.txt": "2e0110e07abef7c2548b26ec9d6969775617ca539a0dc8dbeeb14d6452c711d1",
+            "licenses/tree-sitter-hcl-Apache-2.0.txt": "c71d239df91726fc519c6eb72d318ec65820627232b2f796219e87dcf35d0ab4",
+            "licenses/tree-sitter-java-MIT.txt": "52ed137b039cd9c46409bc22e89938af911c95b157feae2d040b51e6084369a7",
+            "licenses/tree-sitter-php-MIT.txt": "664764fabf40c0b318e06324a5a12379092a2df25b8cbf2415f71bc0bb352346",
+            "licenses/tree-sitter-python-MIT.txt": "d724405ce238a22c0d35769c5a36b386ad5958192efe8bbb304fb2896254575f",
+            "licenses/tree-sitter-ruby-MIT.txt": "9c99b99e93d3c6461bef9f6bac45d17b8bf014172625c24f76319bbd235a7b80",
+            "licenses/tree-sitter-rust-MIT.txt": "31d5b6f4243d5c7c6e1c4ebbbb9f6407bd1457a08bcc4f706521710341acba36",
+            "licenses/web-tree-sitter-MIT.txt": "c5cfb43042b6b72045f4ba997834d0a7786d2793d91680868b5815b39f14fc78",
+            "package.json": "433313c71ef7951eb8cb58d855089f08ccab583405ab85d6a417d9309782356c",
+        },
+        dependencies: [
+            {
+                packageName: "web-tree-sitter",
+                version: "0.27.0",
+                files: {
+                    LICENSE: "c5cfb43042b6b72045f4ba997834d0a7786d2793d91680868b5815b39f14fc78",
+                    "debug/web-tree-sitter.cjs": "3faca4a6e5a006ec8e95a8e1918923ee9a385a02f64154fb2a893d5a27200f24",
+                    "debug/web-tree-sitter.js": "4cd02f4b5510044807279f7064e6bcceab391af3c245fc9b6da2de7b1116ff84",
+                    "debug/web-tree-sitter.wasm": "91a157f507fabb836588e6537a1af1bae45d3d4b9278d06d003678460b011d8e",
+                    "package.json": "707dd14277ba63ca8dcaad6b6df8051e23df78c878b5cbdc27885b3cfd72bfac",
+                    "web-tree-sitter.cjs": "743de33347202f863b6714fc7218c455d93f751943d43500500f6c5c65654dce",
+                    "web-tree-sitter.js": "7c49e3c1d87e24e0bb4c2def909d17154dfde281f5f8280225450090bb4b8110",
+                    "web-tree-sitter.wasm": "c03bccdc3b448a32848f5ae327e209c982bbb0840d43eec8bc2d5759544a1ed3",
+                },
+            },
+        ],
+    },
+];

package/dist/plugins/approved-source-analyzers.js

@@ -0,0 +1,3 @@
+import { qualifiedSourceAnalyzers } from "./approved-source-analyzers.generated.js";
+// implements REQ-capability-plugin-activation-disclosure-v1
+export const APPROVED_SOURCE_ANALYZERS = qualifiedSourceAnalyzers;

package/dist/plugins/compose-semantic-classifier.d.ts

@@ -1,5 +1,5 @@
 import { type PluginMode, type PluginProviderStamp, type SemanticClassificationDecision, type SemanticClassifierInput, type SemanticClassifierV1 } from "kibi-plugin-sdk";
-import type { CapabilityModeResolution } from "./registry.js";
+import type { CapabilityModeResolution, CapabilityProviderBinding } from "./registry.js";
 export type SemanticClassifierDiagnostic = Readonly<{
     pluginId: string;
     packageName: string | null;
@@ -30,6 +30,11 @@ export declare function publicCapabilityStamp(stamp: PluginProviderStamp): {
     fallbackUsed?: boolean;
     model?: string;
 };
+export declare function withFallback(stamp: PluginProviderStamp, fallbackUsed: boolean): PluginProviderStamp;
+/** Bound and redact provider error text before it reaches diagnostics. */
+export declare function redactClassifierMessage(message: string): string;
+/** Typed, redacted diagnostic for a failed provider call of any capability. */
+export declare function diagnosticFromError(binding: CapabilityProviderBinding<unknown>, error: unknown): SemanticClassifierDiagnostic;
 /**
  * Compose semantic classifiers according to replace / augment / shadow modes.
  *

package/dist/plugins/compose-semantic-classifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compose-semantic-classifier.d.ts","sourceRoot":"","sources":["../../src/plugins/compose-semantic-classifier.ts"],"names":[],"mappings":"AAkBA,OAAO,EACL,KAAK,UAAU,EACf,KAAK,mBAAmB,EAExB,KAAK,8BAA8B,EACnC,KAAK,uBAAuB,EAE5B,KAAK,oBAAoB,EAE1B,MAAM,iBAAiB,CAAC;AAGzB,OAAO,KAAK,EACV,wBAAwB,EAEzB,MAAM,eAAe,CAAC;AAGvB,MAAM,MAAM,4BAA4B,GAAG,QAAQ,CAAC;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,EAAE,UAAU,GAAG,SAAS,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CAAC;AAGH,MAAM,MAAM,gCAAgC,GAAG,QAAQ,CAAC;IACtD,SAAS,EAAE,SAAS,8BAA8B,EAAE,CAAC;IACrD,MAAM,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACvC,iBAAiB,EAAE,SAAS;QAC1B,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;QACpC,QAAQ,CAAC,SAAS,EAAE,SAAS,8BAA8B,EAAE,CAAC;KAC/D,EAAE,CAAC;IACJ,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,EAAE,SAAS,4BAA4B,EAAE,CAAC;CACtD,CAAC,CAAC;AAMH,yEAAyE;AAEzE,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,mBAAmB,GAAG;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAYA;AAyGD;;;;;GAKG;AAEH,wBAAsB,6BAA6B,CACjD,UAAU,EAAE,wBAAwB,CAAC,oBAAoB,CAAC,EAC1D,KAAK,EAAE,uBAAuB,EAC9B,OAAO,EAAE,QAAQ,CAAC;IAAE,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,GAC3C,OAAO,CAAC,gCAAgC,CAAC,CA0G3C"}
+{"version":3,"file":"compose-semantic-classifier.d.ts","sourceRoot":"","sources":["../../src/plugins/compose-semantic-classifier.ts"],"names":[],"mappings":"AAkBA,OAAO,EACL,KAAK,UAAU,EACf,KAAK,mBAAmB,EAExB,KAAK,8BAA8B,EACnC,KAAK,uBAAuB,EAE5B,KAAK,oBAAoB,EAE1B,MAAM,iBAAiB,CAAC;AAGzB,OAAO,KAAK,EACV,wBAAwB,EACxB,yBAAyB,EAC1B,MAAM,eAAe,CAAC;AAGvB,MAAM,MAAM,4BAA4B,GAAG,QAAQ,CAAC;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,EAAE,UAAU,GAAG,SAAS,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CAAC;AAGH,MAAM,MAAM,gCAAgC,GAAG,QAAQ,CAAC;IACtD,SAAS,EAAE,SAAS,8BAA8B,EAAE,CAAC;IACrD,MAAM,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACvC,iBAAiB,EAAE,SAAS;QAC1B,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;QACpC,QAAQ,CAAC,SAAS,EAAE,SAAS,8BAA8B,EAAE,CAAC;KAC/D,EAAE,CAAC;IACJ,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,EAAE,SAAS,4BAA4B,EAAE,CAAC;CACtD,CAAC,CAAC;AAMH,yEAAyE;AAEzE,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,mBAAmB,GAAG;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAYA;AAGD,wBAAgB,YAAY,CAC1B,KAAK,EAAE,mBAAmB,EAC1B,YAAY,EAAE,OAAO,GACpB,mBAAmB,CAErB;AAWD,0EAA0E;AAE1E,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAK/D;AAED,+EAA+E;AAE/E,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,yBAAyB,CAAC,OAAO,CAAC,EAC3C,KAAK,EAAE,OAAO,GACb,4BAA4B,CAgC9B;AA6CD;;;;;GAKG;AAEH,wBAAsB,6BAA6B,CACjD,UAAU,EAAE,wBAAwB,CAAC,oBAAoB,CAAC,EAC1D,KAAK,EAAE,uBAAuB,EAC9B,OAAO,EAAE,QAAQ,CAAC;IAAE,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,GAC3C,OAAO,CAAC,gCAAgC,CAAC,CA0G3C"}

package/dist/plugins/compose-semantic-classifier.js

@@ -32,7 +32,8 @@ export function publicCapabilityStamp(stamp) {
         ...(stamp.model !== undefined ? { model: stamp.model } : {}),
     };
 }
-function withFallback(stamp, fallbackUsed) {
+// implements REQ-capability-plugin-activation-disclosure-v1
+export function withFallback(stamp, fallbackUsed) {
     return fallbackUsed ? { ...stamp, fallbackUsed: true } : stamp;
 }
 function isUnresolved(decision) {
@@ -44,13 +45,17 @@ function isUnresolved(decision) {
         return true;
     return false;
 }
-function redactClassifierMessage(message) {
+/** Bound and redact provider error text before it reaches diagnostics. */
+// implements REQ-capability-plugin-activation-disclosure-v1
+export function redactClassifierMessage(message) {
     return message
         .replace(/sk-[A-Za-z0-9_-]+/g, "[redacted]")
         .replace(/(api[_-]?key\s*[:=]\s*)\S+/gi, "$1[redacted]")
         .slice(0, 300);
 }
-function diagnosticFromError(binding, error) {
+/** Typed, redacted diagnostic for a failed provider call of any capability. */
+// implements REQ-capability-plugin-activation-disclosure-v1
+export function diagnosticFromError(binding, error) {
     const message = redactClassifierMessage(error instanceof Error ? error.message : String(error));
     let code = "unknown";
     let model;

package/dist/plugins/compose-vocabulary-alignment.d.ts

@@ -0,0 +1,23 @@
+import { type ClaimComparisonJudgment, type CompareClaimsInput, type PluginProviderStamp, type RankSubjectsInput, type SubjectRankingDecision, type VocabularyAlignmentV1 } from "kibi-plugin-sdk";
+import { type SemanticClassifierDiagnostic } from "./compose-semantic-classifier.js";
+import type { CapabilityModeResolution } from "./registry.js";
+export type VocabularyAlignmentDiagnostic = SemanticClassifierDiagnostic;
+export type ComposedVocabularyResult<T> = Readonly<{
+    results: readonly T[];
+    stamps: readonly PluginProviderStamp[];
+    shadowComparisons: readonly {
+        readonly stamp: PluginProviderStamp;
+        readonly results: readonly T[];
+    }[];
+    fallbackUsed: boolean;
+    diagnostics: readonly VocabularyAlignmentDiagnostic[];
+}>;
+/** Choose an existing subject (or new_subject) for each clause. */
+export declare function composeSubjectRanking(resolution: CapabilityModeResolution<VocabularyAlignmentV1>, input: RankSubjectsInput, options: Readonly<{
+    operationName: string;
+}>): Promise<ComposedVocabularyResult<SubjectRankingDecision>>;
+/** Judge claim pairs; true judgments are review candidates, never verdicts. */
+export declare function composeClaimComparison(resolution: CapabilityModeResolution<VocabularyAlignmentV1>, input: CompareClaimsInput, options: Readonly<{
+    operationName: string;
+}>): Promise<ComposedVocabularyResult<ClaimComparisonJudgment>>;
+//# sourceMappingURL=compose-vocabulary-alignment.d.ts.map

package/dist/plugins/compose-vocabulary-alignment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compose-vocabulary-alignment.d.ts","sourceRoot":"","sources":["../../src/plugins/compose-vocabulary-alignment.ts"],"names":[],"mappings":"AAkBA,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EAEvB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAG3B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,KAAK,4BAA4B,EAGlC,MAAM,kCAAkC,CAAC;AAE1C,OAAO,KAAK,EACV,wBAAwB,EAEzB,MAAM,eAAe,CAAC;AAGvB,MAAM,MAAM,6BAA6B,GAAG,4BAA4B,CAAC;AAGzE,MAAM,MAAM,wBAAwB,CAAC,CAAC,IAAI,QAAQ,CAAC;IACjD,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;IACtB,MAAM,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACvC,iBAAiB,EAAE,SAAS;QAC1B,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;QACpC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;KAChC,EAAE,CAAC;IACJ,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,EAAE,SAAS,6BAA6B,EAAE,CAAC;CACvD,CAAC,CAAC;AA0KH,mEAAmE;AAEnE,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,wBAAwB,CAAC,qBAAqB,CAAC,EAC3D,KAAK,EAAE,iBAAiB,EACxB,OAAO,EAAE,QAAQ,CAAC;IAAE,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,GAC3C,OAAO,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,CAAC,CAE3D;AAED,+EAA+E;AAE/E,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,wBAAwB,CAAC,qBAAqB,CAAC,EAC3D,KAAK,EAAE,kBAAkB,EACzB,OAAO,EAAE,QAAQ,CAAC;IAAE,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,GAC3C,OAAO,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,CAAC,CAE5D"}

package/dist/plugins/compose-vocabulary-alignment.js

@@ -0,0 +1,141 @@
+/*
+ Kibi — repo-local, per-branch, queryable long-term memory for software projects
+ Copyright (C) 2026 Piotr Franczyk
+
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU Affero General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ GNU Affero General Public License for more details.
+
+ You should have received a copy of the GNU Affero General Public License
+ along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+import { NEW_SUBJECT_CHOICE, validateCompareClaimsResult, validateRankSubjectsResult, } from "kibi-plugin-sdk";
+import { diagnosticFromError, withFallback, } from "./compose-semantic-classifier.js";
+import { allowsExternalVocabularyAlignment } from "./external-allowlist.js";
+async function attempt(binding, strategy, input) {
+    try {
+        return { ok: true, results: await strategy.run(binding.capability, input) };
+    }
+    catch (error) {
+        return { ok: false, diagnostic: diagnosticFromError(binding, error) };
+    }
+}
+function mergeByKey(strategy, input, primary, fallback) {
+    const primaryByKey = new Map(primary.map((r) => [strategy.keyOf(r), r]));
+    const fallbackByKey = new Map(fallback.map((r) => [strategy.keyOf(r), r]));
+    return strategy.itemKeys(input).flatMap((key) => {
+        const result = primaryByKey.get(key) ?? fallbackByKey.get(key);
+        return result === undefined ? [] : [result];
+    });
+}
+/**
+ * replace / augment / shadow with the same semantics as the semantic
+ * classifier: a replace provider owns the result and falls back to builtin
+ * (stamped fallbackUsed) on any failure; augment providers only refine items
+ * the builtin left unresolved; shadow providers are recorded for comparison
+ * and never change the result. External providers run only for allowlisted
+ * operations.
+ */
+async function compose(resolution, strategy, input, operationName) {
+    const allowExternal = allowsExternalVocabularyAlignment(operationName);
+    const stamps = [];
+    const diagnostics = [];
+    const shadowComparisons = [];
+    let fallbackUsed = false;
+    let results = [];
+    const builtin = await attempt(resolution.builtin, strategy, input);
+    const builtinResults = builtin.ok ? builtin.results : [];
+    if (allowExternal && resolution.replace) {
+        const replaced = await attempt(resolution.replace, strategy, input);
+        if (replaced.ok) {
+            results = mergeByKey(strategy, input, replaced.results, builtinResults);
+            stamps.push(resolution.replace.stamp);
+        }
+        else {
+            diagnostics.push(replaced.diagnostic);
+            fallbackUsed = true;
+            if (builtin.ok) {
+                results = [...builtinResults];
+                stamps.push(withFallback(resolution.builtin.stamp, true));
+            }
+            else {
+                diagnostics.push(builtin.diagnostic);
+            }
+        }
+    }
+    else {
+        if (builtin.ok) {
+            results = [...builtinResults];
+            stamps.push(resolution.builtin.stamp);
+        }
+        else {
+            diagnostics.push(builtin.diagnostic);
+        }
+        if (allowExternal) {
+            for (const augment of resolution.augment) {
+                const unresolved = new Set(results.filter(strategy.unresolved).map(strategy.keyOf));
+                if (unresolved.size === 0)
+                    break;
+                const augmented = await attempt(augment, strategy, strategy.subset(input, unresolved));
+                if (!augmented.ok) {
+                    diagnostics.push(augmented.diagnostic);
+                    continue;
+                }
+                stamps.push(augment.stamp);
+                const improvements = augmented.results.filter((result) => unresolved.has(strategy.keyOf(result)) && strategy.improves(result));
+                results = mergeByKey(strategy, input, improvements, results);
+            }
+        }
+    }
+    if (allowExternal) {
+        for (const shadow of resolution.shadow) {
+            const shadowed = await attempt(shadow, strategy, input);
+            if (!shadowed.ok) {
+                diagnostics.push(shadowed.diagnostic);
+                continue;
+            }
+            stamps.push(shadow.stamp);
+            shadowComparisons.push({
+                stamp: shadow.stamp,
+                results: shadowed.results,
+            });
+        }
+    }
+    return { results, stamps, shadowComparisons, fallbackUsed, diagnostics };
+}
+const RANK_SUBJECTS = {
+    keyOf: (decision) => decision.claimKey,
+    itemKeys: (input) => input.clauses.map((clause) => clause.claimKey),
+    subset: (input, keys) => ({
+        clauses: input.clauses.filter((clause) => keys.has(clause.claimKey)),
+    }),
+    run: async (provider, input) => validateRankSubjectsResult(await provider.rankSubjects(input), input.clauses).decisions,
+    unresolved: (decision) => decision.choice === NEW_SUBJECT_CHOICE,
+    improves: (decision) => decision.choice !== NEW_SUBJECT_CHOICE,
+};
+const COMPARE_CLAIMS = {
+    keyOf: (judgment) => judgment.pairKey,
+    itemKeys: (input) => input.pairs.map((pair) => pair.pairKey),
+    subset: (input, keys) => ({
+        pairs: input.pairs.filter((pair) => keys.has(pair.pairKey)),
+    }),
+    run: async (provider, input) => validateCompareClaimsResult(await provider.compareClaims(input), input.pairs.map((pair) => pair.pairKey)).judgments,
+    unresolved: (judgment) => !judgment.sameObligation,
+    improves: (judgment) => judgment.sameObligation,
+};
+/** Choose an existing subject (or new_subject) for each clause. */
+// implements REQ-kibi-vocabulary-alignment-capability
+export function composeSubjectRanking(resolution, input, options) {
+    return compose(resolution, RANK_SUBJECTS, input, options.operationName);
+}
+/** Judge claim pairs; true judgments are review candidates, never verdicts. */
+// implements REQ-kibi-vocabulary-alignment-capability
+export function composeClaimComparison(resolution, input, options) {
+    return compose(resolution, COMPARE_CLAIMS, input, options.operationName);
+}

package/dist/plugins/external-allowlist.d.ts

@@ -7,4 +7,11 @@
 export declare const EXTERNAL_SEMANTIC_CLASSIFIER_OPERATIONS: readonly ["kb_semantic_advisor", "kb_compile_intent"];
 export type ExternalSemanticClassifierOperation = (typeof EXTERNAL_SEMANTIC_CLASSIFIER_OPERATIONS)[number];
 export declare function allowsExternalSemanticClassifier(operationName: string): boolean;
+/**
+ * Operations that may call external kibi.vocabulary-alignment.v1 providers.
+ * kb_check and every other operation stay builtin-only: vocabulary alignment is
+ * modeling-time advice and never participates in pass/fail checks.
+ */
+export declare const EXTERNAL_VOCABULARY_ALIGNMENT_OPERATIONS: readonly ["kb_model_requirement"];
+export declare function allowsExternalVocabularyAlignment(operationName: string): boolean;
 //# sourceMappingURL=external-allowlist.d.ts.map

package/dist/plugins/external-allowlist.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"external-allowlist.d.ts","sourceRoot":"","sources":["../../src/plugins/external-allowlist.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,eAAO,MAAM,uCAAuC,uDAG1C,CAAC;AAGX,MAAM,MAAM,mCAAmC,GAC7C,CAAC,OAAO,uCAAuC,CAAC,CAAC,MAAM,CAAC,CAAC;AAK3D,wBAAgB,gCAAgC,CAC9C,aAAa,EAAE,MAAM,GACpB,OAAO,CAET"}
+{"version":3,"file":"external-allowlist.d.ts","sourceRoot":"","sources":["../../src/plugins/external-allowlist.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,eAAO,MAAM,uCAAuC,uDAG1C,CAAC;AAGX,MAAM,MAAM,mCAAmC,GAC7C,CAAC,OAAO,uCAAuC,CAAC,CAAC,MAAM,CAAC,CAAC;AAK3D,wBAAgB,gCAAgC,CAC9C,aAAa,EAAE,MAAM,GACpB,OAAO,CAET;AAED;;;;GAIG;AAEH,eAAO,MAAM,wCAAwC,mCAE3C,CAAC;AAGX,wBAAgB,iCAAiC,CAC/C,aAAa,EAAE,MAAM,GACpB,OAAO,CAIT"}

package/dist/plugins/external-allowlist.js

@@ -14,3 +14,16 @@ const ALLOWED = new Set(EXTERNAL_SEMANTIC_CLASSIFIER_OPERATIONS);
 export function allowsExternalSemanticClassifier(operationName) {
     return ALLOWED.has(operationName);
 }
+/**
+ * Operations that may call external kibi.vocabulary-alignment.v1 providers.
+ * kb_check and every other operation stay builtin-only: vocabulary alignment is
+ * modeling-time advice and never participates in pass/fail checks.
+ */
+// implements REQ-kibi-vocabulary-alignment-capability
+export const EXTERNAL_VOCABULARY_ALIGNMENT_OPERATIONS = [
+    "kb_model_requirement",
+];
+// implements REQ-kibi-vocabulary-alignment-capability
+export function allowsExternalVocabularyAlignment(operationName) {
+    return EXTERNAL_VOCABULARY_ALIGNMENT_OPERATIONS.includes(operationName);
+}

package/dist/plugins/index.d.ts

@@ -6,4 +6,6 @@ export { composeSemanticClassification, publicCapabilityStamp, type ComposedSema
 export { composeOntologyCatalog, composeOntologyMatches, type ComposedOntologyCatalog, type StampedOntologyCandidate, } from "./compose-ontology-packs.js";
 export { SourceAnalysisService, analyzeWithResolution, createConservativeFallbackAnalysis, createSourceAnalysisService, type HostSourceAnalysisResult, type SourceAnalysisServiceOptions, } from "./source-analysis-service.js";
 export { EXTERNAL_SEMANTIC_CLASSIFIER_OPERATIONS, allowsExternalSemanticClassifier, type ExternalSemanticClassifierOperation, } from "./external-allowlist.js";
+export { composeClaimComparison, composeSubjectRanking, type ComposedVocabularyResult, type VocabularyAlignmentDiagnostic, } from "./compose-vocabulary-alignment.js";
+export { EXTERNAL_VOCABULARY_ALIGNMENT_OPERATIONS, allowsExternalVocabularyAlignment, } from "./external-allowlist.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/plugins/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/plugins/index.ts"],"names":[],"mappings":"AAmBA,OAAO,EACL,mCAAmC,EACnC,qBAAqB,EACrB,sBAAsB,EACtB,KAAK,oCAAoC,EACzC,KAAK,sBAAsB,GAC5B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,EACrB,oCAAoC,EACpC,0BAA0B,EAC1B,4BAA4B,EAC5B,iBAAiB,EACjB,sBAAsB,EACtB,0BAA0B,EAC1B,0BAA0B,EAC1B,KAAK,sBAAsB,GAC5B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,iBAAiB,EACjB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GAClB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,wBAAwB,EACxB,6BAA6B,EAC7B,uBAAuB,EACvB,wBAAwB,EACxB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,+BAA+B,GACrC,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,KAAK,gCAAgC,EACrC,KAAK,4BAA4B,GAClC,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,GAC9B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,kCAAkC,EAClC,2BAA2B,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,4BAA4B,GAClC,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,uCAAuC,EACvC,gCAAgC,EAChC,KAAK,mCAAmC,GACzC,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/plugins/index.ts"],"names":[],"mappings":"AAmBA,OAAO,EACL,mCAAmC,EACnC,qBAAqB,EACrB,sBAAsB,EACtB,KAAK,oCAAoC,EACzC,KAAK,sBAAsB,GAC5B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,EACrB,oCAAoC,EACpC,0BAA0B,EAC1B,4BAA4B,EAC5B,iBAAiB,EACjB,sBAAsB,EACtB,0BAA0B,EAC1B,0BAA0B,EAC1B,KAAK,sBAAsB,GAC5B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,iBAAiB,EACjB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GAClB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,wBAAwB,EACxB,6BAA6B,EAC7B,uBAAuB,EACvB,wBAAwB,EACxB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,+BAA+B,GACrC,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,KAAK,gCAAgC,EACrC,KAAK,4BAA4B,GAClC,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,GAC9B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,kCAAkC,EAClC,2BAA2B,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,4BAA4B,GAClC,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,uCAAuC,EACvC,gCAAgC,EAChC,KAAK,mCAAmC,GACzC,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,GACnC,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,wCAAwC,EACxC,iCAAiC,GAClC,MAAM,yBAAyB,CAAC"}

package/dist/plugins/index.js

@@ -31,3 +31,7 @@ export { composeOntologyCatalog, composeOntologyMatches, } from "./compose-ontol
 export { SourceAnalysisService, analyzeWithResolution, createConservativeFallbackAnalysis, createSourceAnalysisService, } from "./source-analysis-service.js";
 // implements REQ-capability-plugin-activation-disclosure-v1
 export { EXTERNAL_SEMANTIC_CLASSIFIER_OPERATIONS, allowsExternalSemanticClassifier, } from "./external-allowlist.js";
+// implements REQ-kibi-vocabulary-alignment-capability
+export { composeClaimComparison, composeSubjectRanking, } from "./compose-vocabulary-alignment.js";
+// implements REQ-kibi-vocabulary-alignment-capability
+export { EXTERNAL_VOCABULARY_ALIGNMENT_OPERATIONS, allowsExternalVocabularyAlignment, } from "./external-allowlist.js";

package/dist/plugins/maintenance-source-analysis.d.ts

@@ -0,0 +1,14 @@
+import type { ProjectKibiConfig } from "kibi-plugin-sdk";
+import type { GitChangeSnapshot } from "../traceability/git-change-snapshot.js";
+import type { Fingerprint } from "../traceability/impact-review.js";
+import { type ApprovedSourceAnalyzer } from "./approved-source-analyzers.js";
+import { type SourceAnalysisService } from "./source-analysis-service.js";
+/** Hash the exact trusted source-extractor activation and its host-pinned closure. */
+export declare function fingerprintMaintenanceSourceSet(workspaceRoot: string, projectConfig: ProjectKibiConfig): Fingerprint;
+/** Verify the exact host-approved closure before any plugin entrypoint executes. */
+export declare function verifyApprovedSourceAnalyzer(root: string, approval: ApprovedSourceAnalyzer): string;
+/** Maintenance resolves source capabilities only; unrelated plugin code is never imported. */
+export declare function createMaintenanceSourceAnalysisService(workspaceRoot: string, projectConfig?: ProjectKibiConfig): SourceAnalysisService;
+/** Capture activation with the same source snapshot and retain baseline analyzers for code changes. */
+export declare function readSnapshotSourceConfig(snapshot: GitChangeSnapshot, trustedTree?: string): ProjectKibiConfig;
+//# sourceMappingURL=maintenance-source-analysis.d.ts.map

package/dist/plugins/maintenance-source-analysis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"maintenance-source-analysis.d.ts","sourceRoot":"","sources":["../../src/plugins/maintenance-source-analysis.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAEpE,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,gCAAgC,CAAC;AAIxC,OAAO,EACL,KAAK,qBAAqB,EAE3B,MAAM,8BAA8B,CAAC;AA+DtC,sFAAsF;AAEtF,wBAAgB,+BAA+B,CAC7C,aAAa,EAAE,MAAM,EACrB,aAAa,EAAE,iBAAiB,GAC/B,WAAW,CAwCb;AAED,oFAAoF;AAEpF,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,sBAAsB,GAC/B,MAAM,CAwBR;AAED,8FAA8F;AAE9F,wBAAgB,sCAAsC,CACpD,aAAa,EAAE,MAAM,EACrB,aAAa,CAAC,EAAE,iBAAiB,GAChC,qBAAqB,CAyDvB;AAED,uGAAuG;AAEvG,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,CAAC,EAAE,MAAM,GACnB,iBAAiB,CA+CnB"}