kibi-cli 2.1.0 → 2.3.0

package/dist/plugins/maintenance-source-analysis.js

@@ -0,0 +1,191 @@
+import { createHash } from "node:crypto";
+import { readFileSync, realpathSync } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { validateProjectKibiConfig, } from "kibi-plugin-sdk";
+import { SYMBOL_EXTRACTOR_V2_CAPABILITY_ID } from "kibi-plugin-sdk";
+import { fingerprint } from "../traceability/impact-review.js";
+import { APPROVED_SOURCE_ANALYZERS, } from "./approved-source-analyzers.js";
+import { readProjectKibiConfig } from "./project-config.js";
+import { CapabilityRegistry } from "./registry.js";
+import { resolveProjectLocalPackage } from "./resolve-package.js";
+import { createSourceAnalysisService, } from "./source-analysis-service.js";
+function digestFile(root, file) {
+    const candidate = resolve(root, file);
+    const rel = relative(root, candidate);
+    if (!rel || rel.startsWith("..") || isAbsolute(rel))
+        throw new Error(`Invalid approved asset path: ${file}`);
+    const actual = realpathSync(candidate);
+    const actualRel = relative(realpathSync(root), actual);
+    if (actualRel.startsWith("..") || isAbsolute(actualRel))
+        throw new Error(`Approved asset escapes its package: ${file}`);
+    return createHash("sha256").update(readFileSync(actual)).digest("hex");
+}
+function verifyFiles(root, files) {
+    if (Object.keys(files).length === 0)
+        throw new Error("An approved analyzer must pin its executable closure");
+    for (const [file, expected] of Object.entries(files)) {
+        if (digestFile(root, file) !== expected)
+            throw new Error(`Source analyzer integrity mismatch: ${file}`);
+    }
+}
+function dependencyRoot(importer, packageName) {
+    const require = createRequire(join(importer, "package.json"));
+    let current = dirname(require.resolve(packageName));
+    for (;;) {
+        try {
+            const json = JSON.parse(readFileSync(join(current, "package.json"), "utf8"));
+            if (json.name === packageName)
+                return current;
+        }
+        catch {
+            /* Walk through a package's dist directories. */
+        }
+        const parent = dirname(current);
+        if (parent === current)
+            throw new Error(`Cannot locate approved dependency: ${packageName}`);
+        current = parent;
+    }
+}
+/**
+ * Identify the host's first-party builtin analyzer by its published package
+ * identity. Content integrity of an installed release is the package
+ * manager's job; hashing the installed tree made the fingerprint differ
+ * between a workspace checkout, an npm install and a bundled runtime.
+ */
+function builtinRuntimeIdentity() {
+    const manifest = createRequire(import.meta.url)("kibi-plugin-builtin/package.json");
+    if (manifest.name !== "kibi-plugin-builtin" ||
+        typeof manifest.version !== "string")
+        throw new Error("Builtin source analyzer identity is invalid");
+    return { name: manifest.name, version: manifest.version };
+}
+/** Hash the exact trusted source-extractor activation and its host-pinned closure. */
+// implements REQ-impact-policy-stage-e-content-bound-review
+export function fingerprintMaintenanceSourceSet(workspaceRoot, projectConfig) {
+    const sourceEntries = (projectConfig.plugins ?? [])
+        .map((entry) => ({
+        package: entry.package,
+        capability: entry.capabilities[SYMBOL_EXTRACTOR_V2_CAPABILITY_ID] ?? null,
+    }))
+        .filter((entry) => entry.capability !== null)
+        .sort((a, b) => a.package.localeCompare(b.package));
+    const bindings = sourceEntries.map(({ package: packageName, capability }) => {
+        const approval = APPROVED_SOURCE_ANALYZERS.find((item) => item.packageName === packageName);
+        if (!approval)
+            throw new Error(`Source analyzer is not approved for impact review: ${packageName}`);
+        const resolved = resolveProjectLocalPackage(workspaceRoot, packageName);
+        const entryRelative = relative(resolved.packageRoot, resolved.entryPath).replaceAll("\\", "/");
+        if (!approval.files[entryRelative])
+            throw new Error("Source analyzer entrypoint is outside its approved closure");
+        return {
+            packageName,
+            capability,
+            approvalFingerprint: verifyApprovedSourceAnalyzer(resolved.packageRoot, approval),
+        };
+    });
+    return fingerprint({
+        contractVersion: "kibi.maintenance-source-set.v2",
+        builtinRuntime: builtinRuntimeIdentity(),
+        sdkContract: SYMBOL_EXTRACTOR_V2_CAPABILITY_ID,
+        bindings,
+    });
+}
+/** Verify the exact host-approved closure before any plugin entrypoint executes. */
+// implements REQ-capability-plugin-activation-disclosure-v1
+export function verifyApprovedSourceAnalyzer(root, approval) {
+    verifyFiles(root, approval.files);
+    const manifest = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
+    if (manifest.name !== approval.packageName ||
+        manifest.version !== approval.version)
+        throw new Error("Source analyzer package identity does not match host approval");
+    for (const dependency of approval.dependencies) {
+        const depRoot = dependencyRoot(root, dependency.packageName);
+        verifyFiles(depRoot, dependency.files);
+        const metadata = JSON.parse(readFileSync(join(depRoot, "package.json"), "utf8"));
+        if (metadata.version !== dependency.version)
+            throw new Error(`Unapproved source runtime version: ${dependency.packageName}`);
+    }
+    return createHash("sha256").update(JSON.stringify(approval)).digest("hex");
+}
+/** Maintenance resolves source capabilities only; unrelated plugin code is never imported. */
+// implements REQ-capability-plugin-activation-disclosure-v1
+export function createMaintenanceSourceAnalysisService(workspaceRoot, projectConfig) {
+    const config = projectConfig ?? readProjectKibiConfig(workspaceRoot);
+    const fingerprints = {};
+    const sourceEntries = (config.plugins ?? []).filter((entry) => entry.capabilities[SYMBOL_EXTRACTOR_V2_CAPABILITY_ID]);
+    const registry = new CapabilityRegistry({
+        workspaceRoot,
+        projectConfig: {
+            plugins: sourceEntries.flatMap((entry) => {
+                const capability = entry.capabilities[SYMBOL_EXTRACTOR_V2_CAPABILITY_ID];
+                return capability
+                    ? [
+                        {
+                            package: entry.package,
+                            capabilities: {
+                                [SYMBOL_EXTRACTOR_V2_CAPABILITY_ID]: capability,
+                            },
+                        },
+                    ]
+                    : [];
+            }),
+        },
+    });
+    return createSourceAnalysisService({
+        registry,
+        providerFingerprints: fingerprints,
+        resolveExtractorsV2: async () => {
+            for (const entry of sourceEntries) {
+                const approval = APPROVED_SOURCE_ANALYZERS.find((item) => item.packageName === entry.package);
+                if (!approval)
+                    throw new Error(`Source analyzer is not approved for maintenance: ${entry.package}`);
+                const resolved = resolveProjectLocalPackage(workspaceRoot, entry.package);
+                const entryRelative = relative(resolved.packageRoot, resolved.entryPath).replaceAll("\\", "/");
+                if (!approval.files[entryRelative])
+                    throw new Error("Source analyzer entrypoint is outside its approved closure");
+                fingerprints[entry.package] = verifyApprovedSourceAnalyzer(resolved.packageRoot, approval);
+            }
+            return registry.resolveSymbolExtractorsV2();
+        },
+    });
+}
+/** Capture activation with the same source snapshot and retain baseline analyzers for code changes. */
+// implements REQ-source-analysis-v2
+export function readSnapshotSourceConfig(snapshot, trustedTree) {
+    const readConfig = (tree) => {
+        const entry = snapshot
+            .readGit(["ls-tree", tree, "--", "package.json"])
+            .toString("utf8");
+        if (!entry)
+            return {};
+        if (!/^100(?:644|755) blob /.test(entry))
+            throw new Error("Source analyzer configuration must be a regular snapshot file");
+        return validateProjectKibiConfig(JSON.parse(snapshot.readGit(["show", `${tree}:package.json`]).toString("utf8")).kibi);
+    };
+    if (trustedTree !== undefined)
+        return readConfig(trustedTree);
+    const entries = new Map();
+    for (const entry of readConfig(snapshot.headTree).plugins ?? [])
+        entries.set(entry.package, entry);
+    const configurationPaths = new Set([
+        "package.json",
+        "bun.lock",
+        "package-lock.json",
+        "pnpm-lock.yaml",
+        "yarn.lock",
+    ]);
+    if (snapshot.inventory.some((file) => !configurationPaths.has(file.path) && !file.path.startsWith(".kb/"))) {
+        for (const entry of readConfig(snapshot.baseTree).plugins ?? []) {
+            const baseline = entry.capabilities[SYMBOL_EXTRACTOR_V2_CAPABILITY_ID];
+            if (!baseline || baseline.mode === "shadow")
+                continue;
+            const selected = entries.get(entry.package)?.capabilities[SYMBOL_EXTRACTOR_V2_CAPABILITY_ID];
+            if (selected?.mode === "shadow")
+                throw new Error(`Cannot downgrade active source analyzer '${entry.package}' to shadow while changing source; separate the configuration change`);
+            if (!selected)
+                entries.set(entry.package, entry);
+        }
+    }
+    return { plugins: [...entries.values()] };
+}

package/dist/plugins/registry.d.ts

@@ -1,4 +1,4 @@
-import { type CapabilityId, type KibiPluginV1, type OntologyPackV1, type PluginMode, type PluginPermissions, type PluginProviderStamp, type ProjectKibiConfig, type SemanticClassifierV1, type SymbolExtractorV1 } from "kibi-plugin-sdk";
+import { type CapabilityId, type KibiPluginV1, type OntologyPackV1, type PluginMode, type PluginPermissions, type PluginProviderStamp, type ProjectKibiConfig, type SemanticClassifierV1, type SymbolExtractorV1, type SymbolExtractorV2, type VocabularyAlignmentV1 } from "kibi-plugin-sdk";
 import { type LoadPluginOptions, loadPluginPackage } from "./load-plugin.js";
 export type BuiltinPluginFactory = () => KibiPluginV1 | Promise<KibiPluginV1>;
 export type CapabilityProviderBinding<T> = Readonly<{
@@ -59,6 +59,8 @@ export declare class CapabilityRegistry {
     resolveSemanticClassifiers(): Promise<CapabilityModeResolution<SemanticClassifierV1>>;
     resolveOntologyPacks(): Promise<CapabilityModeResolution<OntologyPackV1>>;
     resolveSymbolExtractors(): Promise<CapabilityModeResolution<SymbolExtractorV1>>;
+    resolveSymbolExtractorsV2(): Promise<CapabilityModeResolution<SymbolExtractorV2>>;
+    resolveVocabularyAlignment(): Promise<CapabilityModeResolution<VocabularyAlignmentV1>>;
     resolveCapability(capabilityId: CapabilityId): Promise<CapabilityModeResolution<unknown>>;
     /**
      * Canonical providers only (builtin + optional replace + augment).

package/dist/plugins/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/plugins/registry.ts"],"names":[],"mappings":"AAkBA,OAAO,EACL,KAAK,YAAY,EAEjB,KAAK,YAAY,EAEjB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EAItB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EAGvB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,KAAK,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAK7E,MAAM,MAAM,oBAAoB,GAAG,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;AAG9E,MAAM,MAAM,yBAAyB,CAAC,CAAC,IAAI,QAAQ,CAAC;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,EAAE,UAAU,GAAG,SAAS,CAAC;IAC7B,WAAW,EAAE,iBAAiB,CAAC;IAC/B,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,CAAC,CAAC;IACd,KAAK,EAAE,mBAAmB,CAAC;CAC5B,CAAC,CAAC;AAGH,MAAM,MAAM,wBAAwB,CAAC,CAAC,IAAI,QAAQ,CAAC;IACjD,OAAO,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC;IACtC,wDAAwD;IACxD,OAAO,EAAE,yBAAyB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAC7C,0DAA0D;IAC1D,OAAO,EAAE,SAAS,yBAAyB,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,+DAA+D;IAC/D,MAAM,EAAE,SAAS,yBAAyB,CAAC,CAAC,CAAC,EAAE,CAAC;CACjD,CAAC,CAAC;AAGH,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC;IAC/C,aAAa,EAAE,MAAM,CAAC;IACtB,yDAAyD;IACzD,cAAc,CAAC,EAAE,oBAAoB,CAAC;IACtC,sEAAsE;IACtE,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC,kDAAkD;IAClD,UAAU,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,iBAAiB,CAAC;IAC1D,0CAA0C;IAC1C,UAAU,CAAC,EAAE,CACX,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,iBAAiB,KACxB,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAC5D,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CACvC,CAAC,CAAC;AAUH;;;GAGG;AAEH,wBAAgB,uBAAuB,IAAI,YAAY,CAuCtD;AAqGD;;;;GAIG;AAEH,qBAAa,kBAAkB;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAuB;IACtD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+C;IAC1E,OAAO,CAAC,QAAQ,CAAC,UAAU,CAEzB;IACF,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAgC;IAClE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAgC;IAE/D,OAAO,CAAC,oBAAoB,CAAoC;IAChE,OAAO,CAAC,aAAa,CAAyC;IAC9D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAG3B;IACJ,OAAO,CAAC,QAAQ,CAAC,eAAe,CAG5B;gBAEQ,OAAO,EAAE,yBAAyB;IASxC,gBAAgB,IAAI,OAAO,CAAC,YAAY,CAAC;IAOzC,gBAAgB,IAAI,OAAO,CAAC,iBAAiB,CAAC;IAQ9C,0BAA0B,IAAI,OAAO,CACzC,wBAAwB,CAAC,oBAAoB,CAAC,CAC/C;IAMK,oBAAoB,IAAI,OAAO,CACnC,wBAAwB,CAAC,cAAc,CAAC,CACzC;IAMK,uBAAuB,IAAI,OAAO,CACtC,wBAAwB,CAAC,iBAAiB,CAAC,CAC5C;IAMK,iBAAiB,CACrB,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAc7C;;;OAGG;IACH,kBAAkB,CAAC,CAAC,EAClB,UAAU,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACtC,SAAS,yBAAyB,CAAC,CAAC,CAAC,EAAE;YAO5B,yBAAyB;YAyFzB,mBAAmB;CAsBlC;AAED;;GAEG;AAEH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAyC;IAEpE,GAAG,CAAC,aAAa,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAI1D,WAAW,CACT,aAAa,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE,IAAI,CAAC,yBAAyB,EAAE,eAAe,CAAC,GACzD,kBAAkB;IAWrB,GAAG,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,GAAG,IAAI;IAI9D,KAAK,IAAI,IAAI;CAGd;AAGD,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,yBAAyB,GACjC,kBAAkB,CAEpB;AAGD,wBAAgB,6BAA6B,IAAI,uBAAuB,CAEvE;AAGD,MAAM,MAAM,+BAA+B,GAAG,yBAAyB,GAAG;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,uBAAuB,CAAC;CAC1C,CAAC;AAEF;;;GAGG;AAEH,wBAAgB,wBAAwB,CACtC,sBAAsB,EAAE,MAAM,GAAG,+BAA+B,EAChE,OAAO,CAAC,EAAE,IAAI,CAAC,yBAAyB,EAAE,eAAe,CAAC,GAAG;IAC3D,QAAQ,CAAC,KAAK,CAAC,EAAE,uBAAuB,CAAC;CAC1C,GACA,kBAAkB,CAoBpB"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/plugins/registry.ts"],"names":[],"mappings":"AAkBA,OAAO,EACL,KAAK,YAAY,EAEjB,KAAK,YAAY,EAEjB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EAKtB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EAEtB,KAAK,qBAAqB,EAG3B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,KAAK,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAK7E,MAAM,MAAM,oBAAoB,GAAG,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;AAG9E,MAAM,MAAM,yBAAyB,CAAC,CAAC,IAAI,QAAQ,CAAC;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,EAAE,UAAU,GAAG,SAAS,CAAC;IAC7B,WAAW,EAAE,iBAAiB,CAAC;IAC/B,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,CAAC,CAAC;IACd,KAAK,EAAE,mBAAmB,CAAC;CAC5B,CAAC,CAAC;AAGH,MAAM,MAAM,wBAAwB,CAAC,CAAC,IAAI,QAAQ,CAAC;IACjD,OAAO,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC;IACtC,wDAAwD;IACxD,OAAO,EAAE,yBAAyB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAC7C,0DAA0D;IAC1D,OAAO,EAAE,SAAS,yBAAyB,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,+DAA+D;IAC/D,MAAM,EAAE,SAAS,yBAAyB,CAAC,CAAC,CAAC,EAAE,CAAC;CACjD,CAAC,CAAC;AAGH,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC;IAC/C,aAAa,EAAE,MAAM,CAAC;IACtB,yDAAyD;IACzD,cAAc,CAAC,EAAE,oBAAoB,CAAC;IACtC,sEAAsE;IACtE,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC,kDAAkD;IAClD,UAAU,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,iBAAiB,CAAC;IAC1D,0CAA0C;IAC1C,UAAU,CAAC,EAAE,CACX,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,iBAAiB,KACxB,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAC5D,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CACvC,CAAC,CAAC;AAiBH;;;GAGG;AAEH,wBAAgB,uBAAuB,IAAI,YAAY,CAwDtD;AA2GD;;;;GAIG;AAEH,qBAAa,kBAAkB;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAuB;IACtD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+C;IAC1E,OAAO,CAAC,QAAQ,CAAC,UAAU,CAEzB;IACF,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAgC;IAClE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAgC;IAE/D,OAAO,CAAC,oBAAoB,CAAoC;IAChE,OAAO,CAAC,aAAa,CAAyC;IAC9D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAG3B;IACJ,OAAO,CAAC,QAAQ,CAAC,eAAe,CAG5B;gBAEQ,OAAO,EAAE,yBAAyB;IASxC,gBAAgB,IAAI,OAAO,CAAC,YAAY,CAAC;IAOzC,gBAAgB,IAAI,OAAO,CAAC,iBAAiB,CAAC;IAQ9C,0BAA0B,IAAI,OAAO,CACzC,wBAAwB,CAAC,oBAAoB,CAAC,CAC/C;IAMK,oBAAoB,IAAI,OAAO,CACnC,wBAAwB,CAAC,cAAc,CAAC,CACzC;IAMK,uBAAuB,IAAI,OAAO,CACtC,wBAAwB,CAAC,iBAAiB,CAAC,CAC5C;IAOK,yBAAyB,IAAI,OAAO,CACxC,wBAAwB,CAAC,iBAAiB,CAAC,CAC5C;IAMK,0BAA0B,IAAI,OAAO,CACzC,wBAAwB,CAAC,qBAAqB,CAAC,CAChD;IAMK,iBAAiB,CACrB,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAc7C;;;OAGG;IACH,kBAAkB,CAAC,CAAC,EAClB,UAAU,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACtC,SAAS,yBAAyB,CAAC,CAAC,CAAC,EAAE;YAO5B,yBAAyB;YAyFzB,mBAAmB;CAsBlC;AAED;;GAEG;AAEH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAyC;IAEpE,GAAG,CAAC,aAAa,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAI1D,WAAW,CACT,aAAa,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE,IAAI,CAAC,yBAAyB,EAAE,eAAe,CAAC,GACzD,kBAAkB;IAWrB,GAAG,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,GAAG,IAAI;IAI9D,KAAK,IAAI,IAAI;CAGd;AAGD,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,yBAAyB,GACjC,kBAAkB,CAEpB;AAGD,wBAAgB,6BAA6B,IAAI,uBAAuB,CAEvE;AAGD,MAAM,MAAM,+BAA+B,GAAG,yBAAyB,GAAG;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,uBAAuB,CAAC;CAC1C,CAAC;AAEF;;;GAGG;AAEH,wBAAgB,wBAAwB,CACtC,sBAAsB,EAAE,MAAM,GAAG,+BAA+B,EAChE,OAAO,CAAC,EAAE,IAAI,CAAC,yBAAyB,EAAE,eAAe,CAAC,GAAG;IAC3D,QAAQ,CAAC,KAAK,CAAC,EAAE,uBAAuB,CAAC;CAC1C,GACA,kBAAkB,CAoBpB"}

package/dist/plugins/registry.js

@@ -15,7 +15,7 @@
  You should have received a copy of the GNU Affero General Public License
  along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */
-import { KIBI_PLUGIN_API_VERSION, ONTOLOGY_PACK_CAPABILITY_ID, SEMANTIC_CLASSIFIER_CAPABILITY_ID, SYMBOL_EXTRACTOR_CAPABILITY_ID, defineKibiPlugin, validateKibiPlugin, } from "kibi-plugin-sdk";
+import { KIBI_PLUGIN_API_VERSION, ONTOLOGY_PACK_CAPABILITY_ID, SEMANTIC_CLASSIFIER_CAPABILITY_ID, SYMBOL_EXTRACTOR_CAPABILITY_ID, SYMBOL_EXTRACTOR_V2_CAPABILITY_ID, VOCABULARY_ALIGNMENT_CAPABILITY_ID, defineKibiPlugin, validateKibiPlugin, } from "kibi-plugin-sdk";
 import { loadPluginPackage } from "./load-plugin.js";
 import { readProjectKibiConfig } from "./project-config.js";
 import { PluginResolutionError } from "./resolve-package.js";
@@ -23,6 +23,8 @@ const CAPABILITY_SLOT = {
     [SEMANTIC_CLASSIFIER_CAPABILITY_ID]: "semanticClassifier",
     [ONTOLOGY_PACK_CAPABILITY_ID]: "ontologyPack",
     [SYMBOL_EXTRACTOR_CAPABILITY_ID]: "symbolExtractor",
+    [SYMBOL_EXTRACTOR_V2_CAPABILITY_ID]: "symbolExtractorV2",
+    [VOCABULARY_ALIGNMENT_CAPABILITY_ID]: "vocabularyAlignment",
 };
 /**
  * Minimal builtin used when no factory is injected and the builtin package is
@@ -64,6 +66,23 @@ export function createStubBuiltinPlugin() {
                     symbols: [],
                 }),
             },
+            vocabularyAlignment: {
+                id: "kibi-plugin-builtin-stub.vocabulary",
+                rankSubjects: (input) => ({
+                    decisions: input.clauses.map((clause) => ({
+                        claimKey: clause.claimKey,
+                        choice: "new_subject",
+                        confidence: 0,
+                    })),
+                }),
+                compareClaims: (input) => ({
+                    judgments: input.pairs.map((pair) => ({
+                        pairKey: pair.pairKey,
+                        sameObligation: false,
+                        confidence: 0,
+                    })),
+                }),
+            },
         },
     }));
 }
@@ -179,6 +198,13 @@ export class CapabilityRegistry {
     async resolveSymbolExtractors() {
         return this.resolveCapability(SYMBOL_EXTRACTOR_CAPABILITY_ID);
     }
+    // implements REQ-capability-plugin-activation-disclosure-v1
+    async resolveSymbolExtractorsV2() {
+        return this.resolveCapability(SYMBOL_EXTRACTOR_V2_CAPABILITY_ID);
+    }
+    async resolveVocabularyAlignment() {
+        return this.resolveCapability(VOCABULARY_ALIGNMENT_CAPABILITY_ID);
+    }
     async resolveCapability(capabilityId) {
         const cached = this.capabilityCache.get(capabilityId);
         if (cached)

package/dist/plugins/source-analysis-service.d.ts

@@ -1,4 +1,4 @@
-import { type PluginProviderStamp, type SourceAnalysisResult, type SymbolExtractorV1 } from "kibi-plugin-sdk";
+import { type PluginProviderStamp, type SourceAnalysisResult, type SourceAnalysisResultV2, type SymbolExtractorV1, type SymbolExtractorV2 } from "kibi-plugin-sdk";
 import type { CapabilityModeResolution, CapabilityRegistry } from "./registry.js";
 export type HostSourceAnalysisShadowComparison = Readonly<{
     pluginId: string;
@@ -18,9 +18,21 @@ export type HostSourceAnalysisResult = SourceAnalysisResult & Readonly<{
 }>;
 export type SourceAnalysisServiceOptions = Readonly<{
     registry: CapabilityRegistry;
+    /** Explicit v2 resolution; maintenance callers supply only approved providers. */
+    resolveExtractorsV2?: () => Promise<CapabilityModeResolution<SymbolExtractorV2>>;
+    /** Wall-clock deadline for async providers; CPU-bound plugins need their own terminable worker. */
+    analysisTimeoutMs?: number;
+    /** Host-verified package/asset fingerprint, never accepted from result data. */
+    providerFingerprints?: Readonly<Record<string, string>>;
     /** Injectable resolution for tests. */
     resolveExtractors?: () => Promise<CapabilityModeResolution<SymbolExtractorV1>>;
 }>;
+/**
+ * The host owns the analysis deadline. Providers get a slightly smaller budget
+ * so a cooperative provider reports its own timeout diagnostic before the host
+ * abandons the call.
+ */
+export declare function providerBudgetMs(hostTimeoutMs: number): number;
 export declare function createConservativeFallbackAnalysis(filePath: string, fallbackReason: string): HostSourceAnalysisResult;
 /**
  * Host-validated symbol analysis over registry providers with conservative
@@ -32,8 +44,23 @@ export declare function createConservativeFallbackAnalysis(filePath: string, fal
  */
 export declare class SourceAnalysisService {
     private readonly registry;
+    private readonly options;
     private readonly resolveExtractors;
     constructor(options: SourceAnalysisServiceOptions);
+    /**
+     * Analyze supplied snapshot bytes with explicit completeness and host provenance.
+     * An explicit language hint selects an ambiguous extension only when it agrees
+     * with any shebang; conflicting signals return unsupported without dispatch.
+     *
+     * Classify, bound the input, resolve providers, take the first claiming
+     * provider's result as canonical, then record shadow comparisons.
+     */
+    analyzeTextV2(filePath: string, content: string, explicitLanguageHint?: string): Promise<HostSourceAnalysisResultV2>;
+    /**
+     * Run one provider under the host-owned deadline. Returns null when the
+     * provider does not claim the input; a claimed failure is a failed result.
+     */
+    private runV2Extractor;
     analyzeText(filePath: string, content: string): Promise<HostSourceAnalysisResult>;
 }
 /**
@@ -41,4 +68,12 @@ export declare class SourceAnalysisService {
  */
 export declare function analyzeWithResolution(resolution: CapabilityModeResolution<SymbolExtractorV1>, filePath: string, content: string): Promise<HostSourceAnalysisResult>;
 export declare function createSourceAnalysisService(options: SourceAnalysisServiceOptions): SourceAnalysisService;
+/** V2 results preserve failure/completeness; provenance is always assigned by the host. */
+export type HostSourceAnalysisResultV2 = SourceAnalysisResultV2 & Readonly<{
+    providerId: string | null;
+    stamp: PluginProviderStamp | null;
+    inputFingerprint: string;
+    providerFingerprint: string | null;
+    shadowComparisons: readonly HostSourceAnalysisShadowComparison[];
+}>;
 //# sourceMappingURL=source-analysis-service.d.ts.map

package/dist/plugins/source-analysis-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"source-analysis-service.d.ts","sourceRoot":"","sources":["../../src/plugins/source-analysis-service.ts"],"names":[],"mappings":"AAmBA,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EAGvB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,KAAK,EACV,wBAAwB,EACxB,kBAAkB,EACnB,MAAM,eAAe,CAAC;AA4BvB,MAAM,MAAM,kCAAkC,GAAG,QAAQ,CAAC;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,mBAAmB,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CAAC;AAGH,MAAM,MAAM,wBAAwB,GAAG,oBAAoB,GACzD,QAAQ,CAAC;IACP,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAClC,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,oEAAoE;IACpE,iBAAiB,EAAE,SAAS,kCAAkC,EAAE,CAAC;CAClE,CAAC,CAAC;AAGL,MAAM,MAAM,4BAA4B,GAAG,QAAQ,CAAC;IAClD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,uCAAuC;IACvC,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAC/B,wBAAwB,CAAC,iBAAiB,CAAC,CAC5C,CAAC;CACH,CAAC,CAAC;AAgBH,wBAAgB,kCAAkC,CAChD,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,GACrB,wBAAwB,CAkB1B;AAuBD;;;;;;;GAOG;AAEH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAC9C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAEhC;gBAEU,OAAO,EAAE,4BAA4B;IAO3C,WAAW,CACf,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,wBAAwB,CAAC;CAiIrC;AAED;;GAEG;AAEH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,wBAAwB,CAAC,iBAAiB,CAAC,EACvD,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,wBAAwB,CAAC,CAQnC;AAGD,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,4BAA4B,GACpC,qBAAqB,CAEvB"}
+{"version":3,"file":"source-analysis-service.d.ts","sourceRoot":"","sources":["../../src/plugins/source-analysis-service.ts"],"names":[],"mappings":"AAoBA,OAAO,EACL,KAAK,mBAAmB,EAGxB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EAKvB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,KAAK,EACV,wBAAwB,EACxB,kBAAkB,EACnB,MAAM,eAAe,CAAC;AAIvB,MAAM,MAAM,kCAAkC,GAAG,QAAQ,CAAC;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,mBAAmB,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CAAC;AAGH,MAAM,MAAM,wBAAwB,GAAG,oBAAoB,GACzD,QAAQ,CAAC;IACP,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAClC,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,oEAAoE;IACpE,iBAAiB,EAAE,SAAS,kCAAkC,EAAE,CAAC;CAClE,CAAC,CAAC;AAGL,MAAM,MAAM,4BAA4B,GAAG,QAAQ,CAAC;IAClD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,kFAAkF;IAClF,mBAAmB,CAAC,EAAE,MAAM,OAAO,CACjC,wBAAwB,CAAC,iBAAiB,CAAC,CAC5C,CAAC;IACF,mGAAmG;IACnG,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gFAAgF;IAChF,oBAAoB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD,uCAAuC;IACvC,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAC/B,wBAAwB,CAAC,iBAAiB,CAAC,CAC5C,CAAC;CACH,CAAC,CAAC;AA8EH;;;;GAIG;AAEH,wBAAgB,gBAAgB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAG9D;AASD,wBAAgB,kCAAkC,CAChD,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,GACrB,wBAAwB,CAkB1B;AAuBD;;;;;;;GAOG;AAEH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAC9C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA+B;IACvD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAEhC;gBAEU,OAAO,EAAE,4BAA4B;IAQjD;;;;;;;OAOG;IAEG,aAAa,CACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,oBAAoB,CAAC,EAAE,MAAM,GAC5B,OAAO,CAAC,0BAA0B,CAAC;IAwEtC;;;OAGG;YACW,cAAc;IA0DtB,WAAW,CACf,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,wBAAwB,CAAC;CAiIrC;AAED;;GAEG;AAEH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,wBAAwB,CAAC,iBAAiB,CAAC,EACvD,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,wBAAwB,CAAC,CAQnC;AAGD,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,4BAA4B,GACpC,qBAAqB,CAEvB;AAED,2FAA2F;AAE3F,MAAM,MAAM,0BAA0B,GAAG,sBAAsB,GAC7D,QAAQ,CAAC;IACP,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAClC,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,iBAAiB,EAAE,SAAS,kCAAkC,EAAE,CAAC;CAClE,CAAC,CAAC"}

package/dist/plugins/source-analysis-service.js

@@ -15,35 +15,73 @@
  You should have received a copy of the GNU Affero General Public License
  along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */
+import { createHash } from "node:crypto";
 import * as path from "node:path";
-import { toSourceAnalysisProvider, validateSourceAnalysisResultForPath, } from "kibi-plugin-sdk";
-const SOURCE_LANGUAGE_EXTENSIONS = {
-    ".c": "c",
-    ".cc": "cpp",
-    ".cjs": "javascript",
-    ".cpp": "cpp",
-    ".cs": "csharp",
-    ".cts": "typescript",
-    ".go": "go",
-    ".h": "c",
-    ".hpp": "cpp",
-    ".java": "java",
-    ".js": "javascript",
-    ".jsx": "javascript",
-    ".kt": "kotlin",
-    ".mjs": "javascript",
-    ".mts": "typescript",
-    ".php": "php",
-    ".py": "python",
-    ".rb": "ruby",
-    ".rs": "rust",
-    ".swift": "swift",
-    ".ts": "typescript",
-    ".tsx": "typescript",
-};
+import { SOURCE_ANALYSIS_V2_MAX_INPUT_CODE_UNITS, SYMBOL_EXTRACTOR_V2_CAPABILITY_ID, toSourceAnalysisProvider, validateSourceAnalysisResultForPath, validateSourceAnalysisResultV2, } from "kibi-plugin-sdk";
+import { classifySource, extensionLanguage } from "./source-classification.js";
 function detectSourceLanguage(filePath) {
-    return (SOURCE_LANGUAGE_EXTENSIONS[path.extname(filePath).toLowerCase()] ??
-        "unknown");
+    return extensionLanguage(filePath);
+}
+/** Classify once and bind every result for this input to one fingerprint. */
+function createV2Request(filePath, content, explicitLanguageHint) {
+    const classification = classifySource(filePath, content, explicitLanguageHint);
+    const language = classification.language;
+    const inputFingerprint = createHash("sha256")
+        .update(filePath)
+        .update("\0")
+        .update(content)
+        .update("\0")
+        .update(classification.kind)
+        .update("\0")
+        .update(classification.language)
+        .update("\0")
+        .update(explicitLanguageHint?.trim().toLowerCase() ?? "")
+        .digest("hex");
+    return {
+        classification,
+        input: {
+            path: filePath,
+            content,
+            ...(classification.kind === "language"
+                ? { language: classification.language }
+                : {}),
+        },
+        inputFingerprint,
+        fallback: (status, code, message) => ({
+            contractVersion: SYMBOL_EXTRACTOR_V2_CAPABILITY_ID,
+            status,
+            sourceFile: filePath,
+            language,
+            module: {
+                title: inferModuleTitle(filePath),
+                language,
+                analysisMode: "fallback",
+                fallbackReason: code,
+            },
+            symbols: [],
+            diagnostics: [{ code, message }],
+            uncoveredRanges: [],
+            providerId: null,
+            stamp: null,
+            inputFingerprint,
+            providerFingerprint: null,
+            shadowComparisons: [],
+        }),
+    };
+}
+function hostDeadlineMs(requested) {
+    const value = requested ?? 10000;
+    return Number.isFinite(value) && value > 0 ? Math.min(value, 60000) : 10000;
+}
+/**
+ * The host owns the analysis deadline. Providers get a slightly smaller budget
+ * so a cooperative provider reports its own timeout diagnostic before the host
+ * abandons the call.
+ */
+// implements REQ-source-analysis-v2
+export function providerBudgetMs(hostTimeoutMs) {
+    const grace = Math.min(1000, Math.floor(hostTimeoutMs / 10));
+    return Math.max(1, hostTimeoutMs - grace);
 }
 function inferModuleTitle(filePath) {
     const extension = path.extname(filePath);
@@ -100,13 +138,132 @@ function dedupeSymbols(symbols) {
 // implements REQ-capability-plugin-activation-disclosure-v1
 export class SourceAnalysisService {
     registry;
+    options;
     resolveExtractors;
     constructor(options) {
         this.registry = options.registry;
+        this.options = options;
         this.resolveExtractors =
             options.resolveExtractors ??
                 (() => this.registry.resolveSymbolExtractors());
     }
+    /**
+     * Analyze supplied snapshot bytes with explicit completeness and host provenance.
+     * An explicit language hint selects an ambiguous extension only when it agrees
+     * with any shebang; conflicting signals return unsupported without dispatch.
+     *
+     * Classify, bound the input, resolve providers, take the first claiming
+     * provider's result as canonical, then record shadow comparisons.
+     */
+    // implements REQ-capability-plugin-activation-disclosure-v1
+    async analyzeTextV2(filePath, content, explicitLanguageHint) {
+        const request = createV2Request(filePath, content, explicitLanguageHint);
+        const { classification } = request;
+        if (content.length > SOURCE_ANALYSIS_V2_MAX_INPUT_CODE_UNITS ||
+            Buffer.byteLength(content, "utf8") > 8 * 1024 * 1024)
+            return request.fallback("failed", "input_limit", `Source input exceeds the ${SOURCE_ANALYSIS_V2_MAX_INPUT_CODE_UNITS} UTF-16 code unit or 8 MiB UTF-8 analysis limit`);
+        let resolution;
+        try {
+            resolution = await (this.options.resolveExtractorsV2?.() ??
+                this.registry.resolveSymbolExtractorsV2());
+        }
+        catch (error) {
+            return request.fallback("failed", "provider_resolution_failed", String(error));
+        }
+        if (classification.kind !== "language" &&
+            classification.kind !== "unknown") {
+            const code = classification.kind === "ambiguous"
+                ? "source_language_ambiguous"
+                : classification.kind === "conflict"
+                    ? "source_classification_conflict"
+                    : classification.kind === "file-level"
+                        ? "source_file_level_only"
+                        : "unsupported_language";
+            return request.fallback("unsupported", code, classification.reason);
+        }
+        const entries = resolution.replace
+            ? [resolution.replace, resolution.builtin, ...resolution.augment]
+            : [resolution.builtin, ...resolution.augment];
+        let canonical = null;
+        for (const entry of entries) {
+            const result = await this.runV2Extractor(entry, request);
+            if (result === null)
+                continue;
+            // A claimed file's incomplete/failed result is authoritative uncertainty.
+            // Never turn a required provider failure into empty symbols or success.
+            canonical = result;
+            break;
+        }
+        canonical ??= request.fallback("unsupported", "unsupported_language", "No configured source analyzer claims this file; file-level review remains required.");
+        const shadowComparisons = [];
+        for (const entry of resolution.shadow) {
+            const result = await this.runV2Extractor(entry, request);
+            if (!result)
+                continue;
+            shadowComparisons.push({
+                pluginId: entry.pluginId,
+                stamp: entry.stamp,
+                symbolCount: result.symbols.length,
+                language: result.language,
+                ok: result.status === "ok",
+                ...(result.status !== "ok"
+                    ? { error: result.diagnostics.map((d) => d.message).join("; ") }
+                    : {}),
+            });
+        }
+        return { ...canonical, shadowComparisons };
+    }
+    /**
+     * Run one provider under the host-owned deadline. Returns null when the
+     * provider does not claim the input; a claimed failure is a failed result.
+     */
+    async runV2Extractor(entry, request) {
+        const { classification, input } = request;
+        try {
+            const supportsInput = classification.kind === "language"
+                ? { path: input.path, language: classification.language }
+                : { path: input.path };
+            if (!entry.capability.supports(supportsInput))
+                return null;
+            const timeout = hostDeadlineMs(this.options.analysisTimeoutMs);
+            let timer;
+            let raw;
+            try {
+                raw = await Promise.race([
+                    entry.capability.analyze({
+                        ...input,
+                        timeoutMs: providerBudgetMs(timeout),
+                    }),
+                    new Promise((_, reject) => {
+                        timer = setTimeout(() => reject(new Error("Source analysis deadline exceeded")), timeout);
+                    }),
+                ]);
+            }
+            finally {
+                if (timer !== undefined)
+                    clearTimeout(timer);
+            }
+            const validated = validateSourceAnalysisResultV2(raw, input);
+            return {
+                ...validated,
+                providerId: entry.capability.id,
+                stamp: entry.stamp,
+                inputFingerprint: request.inputFingerprint,
+                providerFingerprint: this.options.providerFingerprints?.[entry.pluginId] ??
+                    createHash("sha256")
+                        .update(`${entry.pluginId}\0${entry.pluginVersion}\0${entry.stamp.capability}`)
+                        .digest("hex"),
+                shadowComparisons: [],
+            };
+        }
+        catch (error) {
+            return {
+                ...request.fallback("failed", "provider_failed", `Extractor '${entry.capability.id}' failed: ${String(error)}`),
+                providerId: entry.capability.id,
+                stamp: entry.stamp,
+            };
+        }
+    }
     async analyzeText(filePath, content) {
         const resolution = await this.resolveExtractors();
         const diagnostics = [];

package/dist/plugins/source-change-analysis.d.ts

@@ -0,0 +1,15 @@
+import { type GateAnalysis } from "../traceability/analysis-gate.js";
+import type { StagedPath } from "../traceability/git-staged.js";
+import type { HostSourceAnalysisResultV2, SourceAnalysisService } from "./source-analysis-service.js";
+export interface SourceChangeAnalysis {
+    path: string;
+    before: HostSourceAnalysisResultV2 | null;
+    after: HostSourceAnalysisResultV2 | null;
+}
+/** Analyze both versions without changing the complete inventory or assigning proof. */
+export declare function analyzeSourceChanges(inventory: readonly StagedPath[], service: SourceAnalysisService): Promise<Map<string, SourceChangeAnalysis>>;
+/** Adapt a host result to the shared analysis gate. */
+export declare function gateAnalysis(result: HostSourceAnalysisResultV2 | null): GateAnalysis<HostSourceAnalysisResultV2["uncoveredRanges"][number]> | null;
+/** Enforce the shared analysis gate when no impact policy accepts reviews. */
+export declare function assertSourceAnalysisGate(inventory: readonly StagedPath[], analyses: ReadonlyMap<string, SourceChangeAnalysis>): void;
+//# sourceMappingURL=source-change-analysis.d.ts.map

package/dist/plugins/source-change-analysis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-change-analysis.d.ts","sourceRoot":"","sources":["../../src/plugins/source-change-analysis.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,YAAY,EAElB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,EACV,0BAA0B,EAC1B,qBAAqB,EACtB,MAAM,8BAA8B,CAAC;AAGtC,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,0BAA0B,GAAG,IAAI,CAAC;IAC1C,KAAK,EAAE,0BAA0B,GAAG,IAAI,CAAC;CAC1C;AAKD,wFAAwF;AAExF,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,SAAS,UAAU,EAAE,EAChC,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAgC5C;AAED,uDAAuD;AAEvD,wBAAgB,YAAY,CAC1B,MAAM,EAAE,0BAA0B,GAAG,IAAI,GACxC,YAAY,CAAC,0BAA0B,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,CAQ5E;AAED,8EAA8E;AAE9E,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,SAAS,UAAU,EAAE,EAChC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,oBAAoB,CAAC,GAClD,IAAI,CAkBN"}