openpitstop 1.8.1 → 1.10.0

package/demo-repo/PITSTOP_PEN_REPORT.md

@@ -0,0 +1,46 @@
+# OpenPitStop Penetration Test — D:\OpenPitStop cli\demo-repo
+
+_2026-08-20T14:19:19.581Z_ · static: on · dynamic: on
+
+## Summary
+
+| | | | | |
+|---|---|---|---|---|
+| critical | high | medium | low | info |
+| 0 | 1 | 1 | 0 | 0 |
+
+Confidence: **1 proven** · 1 indicated · 0 heuristic
+
+Static findings verified live: **0 proven** · 0 indicated · 0 unproven · 2 not tested — every pattern finding was either confirmed by a live attack or honestly labeled unproven.
+
+Dynamic: aborted — 0 routes, 0, boot 212ms, 0 outbound events.
+> app did not come up within 25s (start: "node src/server.js")
+
+## Drift vs last run (2026-08-20T14:14:56.321Z)
+
+No change — identical to the last sealed run.
+
+## Findings
+
+### HIGH — hardcoded credential committed to source `pen-4434f26c`
+
+- **Confidence**: proven
+- **Where**: `src/config.js:2`
+
+hardcoded credential found in src/config.js:2 (AKIA12345678…). This credential is recoverable from git history and any CI log that runs the repo.
+
+- **Runtime verification**: not tested — no runtime verification: the dynamic phase did not run (app did not come up within 25s (start: "node src/server.js"))
+- **Reproduce**: grep -n "AKIA12345678" "src/config.js"
+- **Fix**: Rotate the credential NOW (it may already be compromised), remove it from source, and move it to an environment variable / secret manager. Add the value to .gitignore'd .env and to a secrets policy so it never returns.
+  Run `pitstop repro pen-4434f26c` to capture it as a regression test, then `pitstop pen` again.
+
+### MEDIUM — no helmet / security headers middleware `pen-bb7aa572`
+
+- **Confidence**: indicated
+- **Where**: `src/server.js:4`
+
+An Express app without helmet() (or manual CSP / X-Frame-Options / X-Content-Type-Options headers). Clickjacking, MIME sniffing and mixed-content protections are all off.
+
+- **Runtime verification**: not tested — no runtime verification: the dynamic phase did not run (app did not come up within 25s (start: "node src/server.js"))
+- **Fix**: Install helmet and `app.use(helmet());` after app creation (deterministic patch generated by `pitstop pen --fix` when helmet is already installed).
+  Run `pitstop repro pen-bb7aa572` to capture it as a regression test, then `pitstop pen` again.

package/dist/agentBudget.d.ts

@@ -0,0 +1,33 @@
+export interface AgentLimits {
+    maxCalls: number;
+    maxSeconds: number;
+    maxPromptChars: number;
+    maxCostUsd?: number;
+}
+export declare const DEFAULT_AGENT_LIMITS: AgentLimits;
+export declare function positiveLimit(value: string | number, name: string, integer?: boolean): number;
+/** Parse quoted argv; never interpret shell syntax or split the substituted prompt. */
+export declare function agentArgv(command: string, prompt: string): string[];
+/** One shared allowance for ALL findings/rounds in a drive session. Reservations
+ * happen before launch, including unsuccessful launches; they are never refunded. */
+export declare class AgentBudget {
+    readonly repo: string;
+    readonly limits: AgentLimits;
+    private now;
+    readonly id: `${string}-${string}-${string}-${string}-${string}`;
+    readonly startedAt: number;
+    calls: number;
+    promptChars: number;
+    allocatedUsd: number;
+    private lock?;
+    constructor(repo: string, limits: AgentLimits, now?: () => number);
+    remainingMs(): number;
+    acquire(): void;
+    release(): void;
+    reserve(command: string, prompt: string): {
+        argv: string[];
+        timeoutMs: number;
+    };
+    private save;
+}
+export declare function runBudgetedAgent(repo: string, command: string, prompt: string, budget: AgentBudget): Promise<number>;

package/dist/agentBudget.js

@@ -0,0 +1,165 @@
+import fs from "node:fs";
+import path from "node:path";
+import { randomUUID } from "node:crypto";
+import { execa } from "execa";
+export const DEFAULT_AGENT_LIMITS = { maxCalls: 3, maxSeconds: 600, maxPromptChars: 48000 };
+export function positiveLimit(value, name, integer = true) {
+    const n = Number(value);
+    if (!Number.isFinite(n) || n <= 0 || (integer && !Number.isSafeInteger(n)))
+        throw new Error(`${name} must be a positive ${integer ? "integer" : "number"}`);
+    return n;
+}
+/** Parse quoted argv; never interpret shell syntax or split the substituted prompt. */
+export function agentArgv(command, prompt) {
+    const args = [];
+    let token = "", quote = "", started = false;
+    for (const ch of command) {
+        if (quote) {
+            if (ch === quote)
+                quote = "";
+            else
+                token += ch;
+            started = true;
+        }
+        else if (ch === '"' || ch === "'") {
+            quote = ch;
+            started = true;
+        }
+        else if (/\s/.test(ch)) {
+            if (started) {
+                args.push(token);
+                token = "";
+                started = false;
+            }
+        }
+        else {
+            token += ch;
+            started = true;
+        }
+    }
+    if (quote)
+        throw new Error("agent command contains an unclosed quote");
+    if (started)
+        args.push(token);
+    if (!args[0] || args[0].includes("{prompt}") || args.filter(a => a.includes("{prompt}")).length !== 1)
+        throw new Error("agent command must contain exactly one {prompt} argument");
+    return args.map(a => a.replace("{prompt}", prompt));
+}
+/** One shared allowance for ALL findings/rounds in a drive session. Reservations
+ * happen before launch, including unsuccessful launches; they are never refunded. */
+export class AgentBudget {
+    repo;
+    limits;
+    now;
+    id = randomUUID();
+    startedAt;
+    calls = 0;
+    promptChars = 0;
+    allocatedUsd = 0;
+    lock;
+    constructor(repo, limits, now = Date.now) {
+        this.repo = repo;
+        this.limits = limits;
+        this.now = now;
+        for (const [name, value] of Object.entries(limits))
+            if (value !== undefined)
+                positiveLimit(value, name, name !== "maxCostUsd");
+        this.startedAt = now();
+    }
+    remainingMs() { return Math.max(0, this.limits.maxSeconds * 1000 - (this.now() - this.startedAt)); }
+    acquire() {
+        if (process.env.PITSTOP_DRIVE_ACTIVE)
+            throw new Error("nested drive is refused: the parent agent already has a shared budget");
+        fs.mkdirSync(path.join(this.repo, ".pitstop"), { recursive: true });
+        try {
+            this.lock = fs.openSync(path.join(this.repo, ".pitstop", "drive.lock"), "wx");
+        }
+        catch {
+            throw new Error("another drive session holds .pitstop/drive.lock; inspect it before removing a stale lock");
+        }
+        fs.writeFileSync(this.lock, JSON.stringify({ id: this.id, pid: process.pid, startedAt: this.startedAt }));
+        this.save();
+    }
+    release() {
+        if (this.lock === undefined)
+            return;
+        this.save();
+        fs.closeSync(this.lock);
+        this.lock = undefined;
+        fs.unlinkSync(path.join(this.repo, ".pitstop", "drive.lock"));
+    }
+    reserve(command, prompt) {
+        const argv = agentArgv(command, prompt);
+        if (this.calls >= this.limits.maxCalls)
+            throw new Error("global agent call limit reached");
+        const timeoutMs = this.remainingMs();
+        if (!timeoutMs)
+            throw new Error("global agent time limit reached");
+        if (this.promptChars + prompt.length > this.limits.maxPromptChars)
+            throw new Error("global agent prompt allowance exhausted");
+        if (this.limits.maxCostUsd !== undefined) {
+            const bin = path.basename(argv[0]).replace(/\.(exe|cmd)$/i, "").toLowerCase();
+            if (bin !== "claude" || !argv.some(a => a === "-p" || a === "--print"))
+                throw new Error("a dollar ceiling currently requires Claude CLI print mode; this provider cannot enforce it, so no agent was started");
+            if (argv.some(a => a.startsWith("--max-budget-usd")))
+                throw new Error("set the dollar ceiling with Pitstop --max-cost-usd, not duplicate agent flags");
+            const allocation = Math.floor(this.limits.maxCostUsd * 1e6 / this.limits.maxCalls) / 1e6;
+            if (allocation <= 0)
+                throw new Error("dollar ceiling is too small for this call allowance");
+            argv.splice(1, 0, "--max-budget-usd", String(allocation));
+            this.allocatedUsd += allocation;
+        }
+        this.calls++;
+        this.promptChars += prompt.length;
+        this.save();
+        return { argv, timeoutMs };
+    }
+    save() {
+        if (this.lock === undefined)
+            return;
+        const usage = { id: this.id, startedAt: new Date(this.startedAt).toISOString(), limits: this.limits,
+            calls: this.calls, promptChars: this.promptChars, elapsedMs: this.now() - this.startedAt,
+            allocatedUsd: this.allocatedUsd, actualCostUsd: null, actualTokens: null };
+        const dir = path.join(this.repo, ".pitstop");
+        const tmp = path.join(dir, `agent-budget-${this.id}.tmp`);
+        fs.writeFileSync(tmp, JSON.stringify(usage, null, 2));
+        fs.renameSync(tmp, path.join(dir, "agent-budget-latest.json"));
+    }
+}
+export async function runBudgetedAgent(repo, command, prompt, budget) {
+    const { argv: [bin, ...args], timeoutMs } = budget.reserve(command, prompt);
+    if (budget.limits.maxCostUsd !== undefined) {
+        const version = await execa(bin, ["--version"], { timeout: Math.min(timeoutMs, 5000), windowsHide: true });
+        const match = version.stdout.match(/\b(\d+)\.(\d+)\.(\d+)\b/);
+        const parts = match?.slice(1).map(Number);
+        if (!parts || !(parts[0] > 2 || (parts[0] === 2 && (parts[1] > 1 || (parts[1] === 1 && parts[2] >= 217)))))
+            throw new Error("dollar ceilings require Claude CLI 2.1.217 or later for subagent budget enforcement");
+    }
+    if (!budget.remainingMs())
+        throw new Error("global agent time limit reached");
+    const child = execa(bin, args, { cwd: repo, stdio: "inherit", reject: false, windowsHide: true,
+        detached: process.platform !== "win32", env: { PITSTOP_DRIVE_ACTIVE: budget.id } });
+    let timedOut = false;
+    const kill = async () => {
+        if (!child.pid)
+            return;
+        if (process.platform === "win32")
+            await execa("taskkill", ["/pid", String(child.pid), "/T", "/F"], { reject: false, windowsHide: true }).catch(() => { });
+        else {
+            try {
+                process.kill(-child.pid, "SIGKILL");
+            }
+            catch { }
+        }
+    };
+    const timer = setTimeout(() => { timedOut = true; void kill(); }, Math.min(timeoutMs, budget.remainingMs()));
+    try {
+        const result = await child;
+        return timedOut ? -1 : result.exitCode ?? -1;
+    }
+    finally {
+        clearTimeout(timer);
+        await kill();
+    }
+}
+//# sourceMappingURL=agentBudget.js.map

package/dist/agentBudget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentBudget.js","sourceRoot":"","sources":["../src/agentBudget.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAG9B,MAAM,CAAC,MAAM,oBAAoB,GAAgB,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AAEzG,MAAM,UAAU,aAAa,CAAC,KAAsB,EAAE,IAAY,EAAE,OAAO,GAAG,IAAI;IAChF,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACxB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uBAAuB,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5J,OAAO,CAAC,CAAC;AACX,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,SAAS,CAAC,OAAe,EAAE,MAAc;IACvD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,KAAK,GAAG,EAAE,EAAE,KAAK,GAAG,EAAE,EAAE,OAAO,GAAG,KAAK,CAAC;IAC5C,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,KAAK,EAAE,CAAC;YAAC,IAAI,EAAE,KAAK,KAAK;gBAAE,KAAK,GAAG,EAAE,CAAC;;gBAAM,KAAK,IAAI,EAAE,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;QAAC,CAAC;aACzE,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAAC,KAAK,GAAG,EAAE,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;QAAC,CAAC;aAC7D,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAAC,IAAI,OAAO,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAAC,KAAK,GAAG,EAAE,CAAC;gBAAC,OAAO,GAAG,KAAK,CAAC;YAAC,CAAC;QAAC,CAAC;aACtF,CAAC;YAAC,KAAK,IAAI,EAAE,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;QAAC,CAAC;IACvC,CAAC;IACD,IAAI,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACvE,IAAI,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;QACnG,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;AACtD,CAAC;AAED;qFACqF;AACrF,MAAM,OAAO,WAAW;IAOD;IAAuB;IAA6B;IANhE,EAAE,GAAG,UAAU,EAAE,CAAC;IAClB,SAAS,CAAS;IAC3B,KAAK,GAAG,CAAC,CAAC;IACV,WAAW,GAAG,CAAC,CAAC;IAChB,YAAY,GAAG,CAAC,CAAC;IACT,IAAI,CAAU;IACtB,YAAqB,IAAY,EAAW,MAAmB,EAAU,MAAM,IAAI,CAAC,GAAG;QAAlE,SAAI,GAAJ,IAAI,CAAQ;QAAW,WAAM,GAAN,MAAM,CAAa;QAAU,QAAG,GAAH,GAAG,CAAW;QACrF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,IAAI,KAAK,KAAK,SAAS;gBAAE,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,KAAK,YAAY,CAAC,CAAC;QAC/H,IAAI,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;IACzB,CAAC;IACD,WAAW,KAAa,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5G,OAAO;QACL,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB;YAAE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QAC/H,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC;YAAC,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,CAAC;QAAC,CAAC;QACtF,MAAM,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,0FAA0F,CAAC,CAAC;QAAC,CAAC;QACtH,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QAC1G,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IACD,OAAO;QACL,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO;QACpC,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;QACtB,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,CAAC,OAAe,EAAE,MAAc;QACrC,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxC,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC3F,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACnE,IAAI,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC9H,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAC9E,IAAI,GAAG,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS,CAAC;gBACpE,MAAM,IAAI,KAAK,CAAC,qHAAqH,CAAC,CAAC;YACzI,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;YACvJ,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC;YACzF,IAAI,UAAU,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YAC5F,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,kBAAkB,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;YAC1D,IAAI,CAAC,YAAY,IAAI,UAAU,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC;QAClC,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IACO,IAAI;QACV,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO;QACpC,MAAM,KAAK,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM;YACjG,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS;YACxF,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QAC7E,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QAC1D,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACtD,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC,CAAC;IACjE,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,OAAe,EAAE,MAAc,EAAE,MAAmB;IACvG,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC5E,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3G,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;YACxG,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;IAC3G,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI;QAC5F,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,GAAG,EAAE,EAAE,oBAAoB,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACtF,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;QACtB,IAAI,CAAC,KAAK,CAAC,GAAG;YAAE,OAAO;QACvB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;aACpJ,CAAC;YAAC,IAAI,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QAAC,CAAC;IAChE,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,QAAQ,GAAG,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC7G,IAAI,CAAC;QAAC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC;QAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC;IAAC,CAAC;YACzE,CAAC;QAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,IAAI,EAAE,CAAC;IAAC,CAAC;AAChD,CAAC"}

package/dist/analyzers/ledger/index.d.ts

@@ -8,7 +8,8 @@ import type { LedgerResult } from "../types.js";
  * it can leave the process; the request/response pairs the "gateway" receives
  * are recorded so evidence of a double-charge is real, not simulated.
  */
-export declare function runLedgerAnalyzer(repo: string): Promise<LedgerResult>;
+export declare function runLedgerLocal(repo: string): Promise<LedgerResult>;
 export { discover } from "./discover.js";
 export { runAttacks } from "./attacks.js";
 export { analyzeEvidence } from "./evidence.js";
+export declare function runLedgerAnalyzer(repo: string): Promise<LedgerResult>;

package/dist/analyzers/ledger/index.js

@@ -1,3 +1,4 @@
+import { runIsolated } from "../../sandbox/container.js";
 import { discover } from "./discover.js";
 import { startHarness, newEvidencePath, readAbortReason, } from "./harness.js";
 import { runAttacks } from "./attacks.js";
@@ -11,7 +12,7 @@ import { analyzeEvidence, writeEvidenceFile, } from "./evidence.js";
  * it can leave the process; the request/response pairs the "gateway" receives
  * are recorded so evidence of a double-charge is real, not simulated.
  */
-export async function runLedgerAnalyzer(repo) {
+export async function runLedgerLocal(repo) {
     const ts = new Date().toISOString().replace(/[:.]/g, "-");
     let discovery;
     try {
@@ -113,4 +114,12 @@ export async function runLedgerAnalyzer(repo) {
 export { discover } from "./discover.js";
 export { runAttacks } from "./attacks.js";
 export { analyzeEvidence } from "./evidence.js";
+export async function runLedgerAnalyzer(repo) {
+    try {
+        return await runIsolated(repo, "ledger");
+    }
+    catch (error) {
+        return { status: "aborted", note: String(error), endpoints: [], evidence: [] };
+    }
+}
 //# sourceMappingURL=index.js.map

package/dist/analyzers/ledger/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/analyzers/ledger/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EACL,YAAY,EACZ,eAAe,EACf,eAAe,GAChB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACL,eAAe,EACf,iBAAiB,GAElB,MAAM,eAAe,CAAC;AAEvB;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAClD,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAE1D,IAAI,SAAS,CAAC;IACd,IAAI,CAAC;QACH,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,8BAA+B,CAAW,CAAC,OAAO,EAAE;YAC1D,SAAS,EAAE,EAAE;YACb,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,IAAI,EACF,+EAA+E;gBAC/E,mEAAmE;YACrE,SAAS,EAAE,EAAE;YACb,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC;IACvE,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;QAC3B,OAAO;YACL,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;YACnD,IAAI,EAAE,aAAa,CAAC,WAAW,IAAI,kCAAkC;YACrE,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC;IAEtC,IAAI,WAAW,GAA0B,IAAI,CAAC;IAC9C,IAAI,aAAa,GAAkB,IAAI,CAAC;IACxC,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC;YAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,SAAS,EAAE,SAAS,CAAC,SAAS;SAC/B,CAAC,CAAC;QACH,WAAW,GAAG,eAAe,CAAC;YAC5B,IAAI;YACJ,SAAS;YACT,OAAO;YACP,cAAc,EAAE,OAAO,CAAC,cAAc;SACvC,CAAC,CAAC;QACH,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,QAAQ,GAAI,CAAW,CAAC,OAAO,CAAC;IAClC,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO;YACL,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,iCAAiC,QAAQ,EAAE;YACjD,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IAED,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,IAAI,EAAE,aAAa;YACnB,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO;YACL,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,sBAAsB;YAC5B,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC/C,iBAAiB,CAAC,YAAY,EAAE,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9E,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,QAAQ;QAAE,CAAC,CAAC,YAAY,GAAG,YAAY,CAAC;IAEpE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,WAAW,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CACR,+EAA+E;YAC7E,oCAAoC,CACvC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;QAClD,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,YAAY;KACb,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/analyzers/ledger/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAGzD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EACL,YAAY,EACZ,eAAe,EACf,eAAe,GAChB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACL,eAAe,EACf,iBAAiB,GAElB,MAAM,eAAe,CAAC;AAEvB;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY;IAC/C,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAE1D,IAAI,SAAS,CAAC;IACd,IAAI,CAAC;QACH,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,8BAA+B,CAAW,CAAC,OAAO,EAAE;YAC1D,SAAS,EAAE,EAAE;YACb,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,IAAI,EACF,+EAA+E;gBAC/E,mEAAmE;YACrE,SAAS,EAAE,EAAE;YACb,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC;IACvE,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;QAC3B,OAAO;YACL,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;YACnD,IAAI,EAAE,aAAa,CAAC,WAAW,IAAI,kCAAkC;YACrE,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC;IAEtC,IAAI,WAAW,GAA0B,IAAI,CAAC;IAC9C,IAAI,aAAa,GAAkB,IAAI,CAAC;IACxC,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC;YAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,SAAS,EAAE,SAAS,CAAC,SAAS;SAC/B,CAAC,CAAC;QACH,WAAW,GAAG,eAAe,CAAC;YAC5B,IAAI;YACJ,SAAS;YACT,OAAO;YACP,cAAc,EAAE,OAAO,CAAC,cAAc;SACvC,CAAC,CAAC;QACH,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,QAAQ,GAAI,CAAW,CAAC,OAAO,CAAC;IAClC,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO;YACL,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,iCAAiC,QAAQ,EAAE;YACjD,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IAED,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,IAAI,EAAE,aAAa;YACnB,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO;YACL,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,sBAAsB;YAC5B,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC/C,iBAAiB,CAAC,YAAY,EAAE,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9E,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,QAAQ;QAAE,CAAC,CAAC,YAAY,GAAG,YAAY,CAAC;IAEpE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,WAAW,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CACR,+EAA+E;YAC7E,oCAAoC,CACvC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;QAClD,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,YAAY;KACb,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAClD,IAAI,CAAC;QAAC,OAAO,MAAM,WAAW,CAAe,IAAI,EAAE,QAAQ,CAAC,CAAC;IAAC,CAAC;IAC/D,OAAO,KAAK,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAAC,CAAC;AACnG,CAAC"}

package/dist/analyzers/types.d.ts

@@ -188,6 +188,8 @@ export interface Cluster {
     size: number;
 }
 export interface ScanResult {
+    /** Content-bound reuse metadata, present only for a stable full scan. */
+    cache?: import("../scanCache.js").ScanCache;
     timestamp: string;
     repo: string;
     /** `try` was produced by the quick `pitstop try` pass (tests/perf/reliability intentionally skipped). */

package/dist/candidate.d.ts

@@ -0,0 +1,20 @@
+export interface CandidateBinding {
+    schema: 1;
+    repo: string;
+    digest: string;
+    head: string | null;
+    clean: boolean;
+    engine: string;
+    policy: string;
+}
+/** No source or secret contents are stored in evidence, only content digests. */
+export declare function captureCandidate(repo: string): CandidateBinding | null;
+export declare function activeCandidate(): CandidateBinding | null | undefined;
+/** Capture BEFORE execution, including async work and early-return evidence. */
+export declare function candidateRun<T extends object>(repo: string, run: () => Promise<T>): Promise<T & {
+    candidateBinding: CandidateBinding | null;
+}>;
+export declare function candidateRunSync<T extends object>(repo: string, run: () => T): T & {
+    candidateBinding: CandidateBinding | null;
+};
+export declare function candidateMismatch(repo: string, doc: any, current?: CandidateBinding | null): string | null;

package/dist/candidate.js

@@ -0,0 +1,87 @@
+import fs from "node:fs";
+import path from "node:path";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { fileURLToPath } from "node:url";
+import { hashSuiteFiles } from "./verify/holdout.js";
+import { snapshotRepo } from "./scanCache.js";
+const context = new AsyncLocalStorage();
+const hash = (value) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
+const policies = ["architecture.json", "plan-latest.json", "acceptance-pin.json"];
+function engineIdentity() {
+    const root = path.dirname(fileURLToPath(import.meta.url));
+    const files = [];
+    const walk = (dir) => {
+        for (const entry of fs.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+            const p = path.join(dir, entry.name);
+            if (entry.isDirectory())
+                walk(p);
+            else if (/\.(ts|js|json|cjs)$/.test(entry.name))
+                files.push([path.relative(root, p), hash(fs.readFileSync(p).toString("base64"))]);
+        }
+    };
+    walk(root);
+    walk(path.join(root, "../templates"));
+    return hash([files, fs.readFileSync(path.join(root, "../package.json"), "utf8"), process.version, process.platform]);
+}
+/** No source or secret contents are stored in evidence, only content digests. */
+export function captureCandidate(repo) {
+    try {
+        repo = fs.realpathSync(repo);
+        const snapshot = snapshotRepo(repo);
+        if (!snapshot)
+            return null;
+        const policy = policies.map(name => {
+            const p = path.join(repo, ".pitstop", name);
+            if (!fs.existsSync(p))
+                return [name, null];
+            if (fs.lstatSync(p).isSymbolicLink())
+                throw new Error("policy symlink");
+            return [name, hash(fs.readFileSync(p).toString("base64"))];
+        });
+        let clean = false;
+        if (snapshot.head) {
+            const status = execFileSync("git", ["status", "--porcelain", "--untracked-files=all", "--", ".", ":(exclude).pitstop", ":(exclude)PITSTOP_*.md", ":(exclude)PITSTOP_*.html", ":(exclude)PITSTOP_*.svg"], { cwd: repo, encoding: "utf8", timeout: 5000, windowsHide: true, stdio: ["ignore", "pipe", "ignore"] });
+            clean = !status.trim();
+        }
+        const env = Object.entries(process.env).filter(([k]) => k.startsWith("PITSTOP_") || ["NODE_OPTIONS", "NODE_ENV"].includes(k)).sort();
+        return { schema: 1, repo, digest: snapshot.digest, head: snapshot.head, clean, engine: engineIdentity(), policy: hash([policy, env]) };
+    }
+    catch {
+        return null;
+    }
+}
+export function activeCandidate() { return context.getStore(); }
+/** Capture BEFORE execution, including async work and early-return evidence. */
+export async function candidateRun(repo, run) {
+    const binding = captureCandidate(repo);
+    return context.run(binding, async () => ({ ...await run(), candidateBinding: binding }));
+}
+export function candidateRunSync(repo, run) {
+    const binding = captureCandidate(repo);
+    return context.run(binding, () => ({ ...run(), candidateBinding: binding }));
+}
+export function candidateMismatch(repo, doc, current = captureCandidate(repo)) {
+    const binding = doc?.candidateBinding;
+    if (!binding || binding.schema !== 1)
+        return "evidence has no candidate binding; rerun this check";
+    if (!current)
+        return "current candidate cannot be fingerprinted safely";
+    if (JSON.stringify(binding) !== JSON.stringify(current))
+        return "repository, Git state, policy or verification engine changed; rerun this check";
+    try {
+        if (doc.contract?.path && createHash("sha256").update(fs.readFileSync(doc.contract.path, "utf8")).digest("hex") !== doc.contract.hash)
+            return "acceptance contract changed; rerun acceptance verification";
+        if (doc.suite?.dir && hashSuiteFiles(doc.suite.dir).hash !== doc.suite.hash)
+            return "holdout suite changed; rerun holdout verification";
+    }
+    catch {
+        return "external verification input is unavailable";
+    }
+    const sha = doc?.candidate?.commitSha ?? doc?.candidate?.sha ?? doc?.candidateSha;
+    if (sha && (sha !== current.head || !current.clean))
+        return "check ran on a commit that does not represent the current clean candidate";
+    return null;
+}
+//# sourceMappingURL=candidate.js.map

package/dist/candidate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"candidate.js","sourceRoot":"","sources":["../src/candidate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAW9C,MAAM,OAAO,GAAG,IAAI,iBAAiB,EAA2B,CAAC;AACjE,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClG,MAAM,QAAQ,GAAG,CAAC,mBAAmB,EAAE,kBAAkB,EAAE,qBAAqB,CAAC,CAAC;AAElF,SAAS,cAAc;IACrB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAuB,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,EAAE;QAC3B,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC9G,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,KAAK,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,CAAC,CAAC,CAAC;iBAC5B,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACrI,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,CAAC;IACX,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,CAAC;QACH,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;YACjC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;YAC5C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC3C,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACxE,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;QACH,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,uBAAuB,EAAE,IAAI,EAAE,GAAG,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,yBAAyB,CAAC,EACrM,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC1G,KAAK,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACzB,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrI,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;IACzI,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,eAAe,KAA0C,OAAO,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;AAErG,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAmB,IAAY,EAAE,GAAqB;IACtF,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,GAAG,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AAC3F,CAAC;AACD,MAAM,UAAU,gBAAgB,CAAmB,IAAY,EAAE,GAAY;IAC3E,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,GAAQ,EAAE,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC;IACxF,MAAM,OAAO,GAAG,GAAG,EAAE,gBAAgB,CAAC;IACtC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,qDAAqD,CAAC;IACnG,IAAI,CAAC,OAAO;QAAE,OAAO,kDAAkD,CAAC;IACxE,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;QAAE,OAAO,gFAAgF,CAAC;IACjJ,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,QAAQ,EAAE,IAAI,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,QAAQ,CAAC,IAAI;YAAE,OAAO,4DAA4D,CAAC;QAC3M,IAAI,GAAG,CAAC,KAAK,EAAE,GAAG,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,KAAK,CAAC,IAAI;YAAE,OAAO,mDAAmD,CAAC;IAC1I,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,4CAA4C,CAAC;IAAC,CAAC;IAChE,MAAM,GAAG,GAAG,GAAG,EAAE,SAAS,EAAE,SAAS,IAAI,GAAG,EAAE,SAAS,EAAE,GAAG,IAAI,GAAG,EAAE,YAAY,CAAC;IAClF,IAAI,GAAG,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,2EAA2E,CAAC;IACxI,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/cli.js

@@ -29,6 +29,18 @@ import { testCmd } from "./commands/test.js";
 import { nextCmd } from "./commands/next.js";
 import { fix } from "./commands/fix.js";
 import { askCmd } from "./commands/ask.js";
+import { baselineVerify } from "./commands/baselineVerify.js";
+import { stateVerify } from "./commands/stateVerify.js";
+import { verifierCheck } from "./commands/verifierCheck.js";
+import { holdoutVerify } from "./commands/holdoutVerify.js";
+import { acceptanceVerify } from "./commands/acceptanceVerify.js";
+import { regressionCheck } from "./commands/regressionCheck.js";
+import { explain } from "./commands/explain.js";
+import { understand } from "./commands/understand.js";
+import { plan } from "./commands/plan.js";
+import { architectureCheck } from "./commands/architectureCheck.js";
+import { verifyStack } from "./commands/verifyStack.js";
+import { flow } from "./commands/flow.js";
 import { guidedFirstRun } from "./firstRun.js";
 /**
  * Last line of defense: a crash is a bug report, not a stack dump on someone's
@@ -70,7 +82,7 @@ function readVersion() {
 const program = new Command();
 program
     .name("pitstop")
-    .description("OpenPitStop CLI")
+    .description('Repo-aware engineering for coding CLIs. Start with: pitstop ask "understand this repo"')
     .version(readVersion())
     .action(guidedFirstRun);
 program.addCommand(install);
@@ -100,5 +112,17 @@ program.addCommand(testCmd);
 program.addCommand(nextCmd);
 program.addCommand(fix);
 program.addCommand(askCmd);
+program.addCommand(baselineVerify);
+program.addCommand(stateVerify);
+program.addCommand(verifierCheck);
+program.addCommand(holdoutVerify);
+program.addCommand(acceptanceVerify);
+program.addCommand(regressionCheck);
+program.addCommand(explain);
+program.addCommand(understand);
+program.addCommand(plan);
+program.addCommand(architectureCheck);
+program.addCommand(verifyStack);
+program.addCommand(flow);
 program.parseAsync(process.argv);
 //# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C;;;;GAIG;AACH,SAAS,aAAa,CAAC,IAAY,EAAE,GAAY;IAC/C,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,mBAAmB,IAAI,qBAAqB,CAAC,CAAC;QAC5D,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACvE,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CAAC,mCAAmC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC9D,IAAI;YACJ,KAAK,CAAC,GAAG,CACP,qDAAqD;gBACnD,6EAA6E;gBAC7E,uDAAuD;gBACvD,+EAA+E,CAClF,CACJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED,OAAO,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,GAAG,EAAE,EAAE;IACtC,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AACH,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,GAAG,EAAE,EAAE;IACvC,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,SAAS,WAAW;IAClB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CACpB,EAAE,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAC7C,CAAC;QAC1B,OAAO,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,SAAS,CAAC;KACf,WAAW,CAAC,iBAAiB,CAAC;KAC9B,OAAO,CAAC,WAAW,EAAE,CAAC;KACtB,MAAM,CAAC,cAAc,CAAC,CAAC;AAE1B,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AAC5B,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACzB,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC3B,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC3B,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC3B,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACzB,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;AACvB,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC7B,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;AAC9B,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AAC5B,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC3B,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC3B,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC3B,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACzB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACzB,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;AAC1B,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC3B,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AAC5B,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AACxB,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;AAC9B,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;AAC1B,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;AAC1B,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AAC5B,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AAC5B,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AACxB,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAE3B,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C;;;;GAIG;AACH,SAAS,aAAa,CAAC,IAAY,EAAE,GAAY;IAC/C,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,mBAAmB,IAAI,qBAAqB,CAAC,CAAC;QAC5D,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACvE,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CAAC,mCAAmC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC9D,IAAI;YACJ,KAAK,CAAC,GAAG,CACP,qDAAqD;gBACnD,6EAA6E;gBAC7E,uDAAuD;gBACvD,+EAA+E,CAClF,CACJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED,OAAO,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,GAAG,EAAE,EAAE;IACtC,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AACH,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,GAAG,EAAE,EAAE;IACvC,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,SAAS,WAAW;IAClB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CACpB,EAAE,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAC7C,CAAC;QAC1B,OAAO,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,SAAS,CAAC;KACf,WAAW,CAAC,wFAAwF,CAAC;KACrG,OAAO,CAAC,WAAW,EAAE,CAAC;KACtB,MAAM,CAAC,cAAc,CAAC,CAAC;AAE1B,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AAC5B,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACzB,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC3B,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC3B,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC3B,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACzB,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;AACvB,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC7B,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;AAC9B,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AAC5B,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC3B,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC3B,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC3B,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACzB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACzB,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;AAC1B,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC3B,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AAC5B,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AACxB,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;AAC9B,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;AAC1B,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;AAC1B,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AAC5B,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AAC5B,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AACxB,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC3B,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AACnC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AAChC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;AACrC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;AACpC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AAC5B,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AAC/B,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACzB,OAAO,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;AACtC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AAChC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AAEzB,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC"}

package/dist/commands/acceptanceVerify.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+export declare const acceptanceVerify: Command;
+export default acceptanceVerify;

package/dist/commands/acceptanceVerify.js

@@ -0,0 +1,89 @@
+import { Command } from "commander";
+import chalk from "chalk";
+import boxen from "boxen";
+import path from "node:path";
+import { verifyAcceptance, sealAcceptanceResult, checkAcceptanceEvidence, } from "../verify/acceptance.js";
+import { addEntry } from "../memory/store.js";
+const MARK = (pass) => pass === null ? chalk.yellow("?") : pass ? chalk.green("✓") : chalk.red("✗");
+export const acceptanceVerify = new Command("acceptance-verify")
+    .description("Requirement / acceptance verification: verify the agent satisfied the ORIGINAL TASK " +
+    "requirements via a structured acceptance contract (deterministic criteria: command, http, " +
+    "fileExists, fileContains) — never the agent's self-report and never an LLM judge. In-repo " +
+    "contracts are hash-pinned; changes are INTEGRITY_FAILURE until re-authorized with --authorize. " +
+    "With --baseline, the contract must discriminate (fail there, pass on the candidate).")
+    .argument("[repo]", "path to the repo", ".")
+    .requiredOption("--contract <dir|file|id>", "acceptance contract: a path to acceptance.json (or a dir containing it) or an id under PITSTOP_ACCEPTANCE_HOME (default ~/.openpitstop/acceptance/<id>)")
+    .option("--candidate <ref>", "candidate commit/ref to verify (default: HEAD)", "HEAD")
+    .option("--baseline <ref>", "baseline commit/ref — criteria passing there do not count as evidence of the agent's work")
+    .option("--authorize", "explicitly re-authorize a changed in-repo contract (pins the new version)")
+    .option("--timeout <ms>", "per-criterion / app-boot timeout in ms")
+    .option("--json", "machine-readable output")
+    .action(async (repoArg, opts) => {
+    const repo = path.resolve(repoArg);
+    let result = await verifyAcceptance({
+        repo,
+        contractSpec: opts.contract,
+        candidateRef: opts.candidate,
+        baselineRef: opts.baseline,
+        authorize: opts.authorize,
+        timeoutMs: opts.timeout ? Number(opts.timeout) : undefined,
+    });
+    result = sealAcceptanceResult(result);
+    if (opts.json) {
+        console.log(JSON.stringify({
+            repo: result.repo,
+            contract: { id: result.contractId, path: result.contractPath, hash: result.contractHash, external: result.contractExternal },
+            candidate: { ref: result.candidateRef, sha: result.candidateSha },
+            baseline: { ref: result.baselineRef, sha: result.baselineSha },
+            requirements: result.requirements,
+            evidence: result.evidence,
+            verdict: result.verdict,
+            reasons: result.reasons,
+            notes: result.notes,
+            discriminative: result.discriminative,
+            totalCriteria: result.totalCriteria,
+            sealedPath: result.sealedPath,
+        }, null, 2));
+    }
+    else {
+        const verified = result.evidence.filter((e) => e.pass === true).length;
+        const lines = [`${chalk.bold("ACCEPTANCE")}`, ""];
+        for (const r of result.requirements) {
+            const mark = MARK(r.satisfied);
+            lines.push(`${mark} ${chalk.bold(r.id)}${r.description ? chalk.dim(` — ${r.description}`) : ""}`);
+            for (const c of result.evidence.filter((e) => e.requirementId === r.id)) {
+                lines.push(`    ${MARK(c.pass)} ${chalk.dim(c.criterionId)} [${c.type}]  ${chalk.dim(c.observed.slice(0, 110))}`);
+            }
+        }
+        lines.push("");
+        lines.push(`${chalk.bold("Evidence:")} ${verified}/${result.totalCriteria} criteria verified` +
+            (result.baselineRef ? chalk.dim(` · ${result.discriminative} discriminate vs baseline ${result.baselineRef}`) : chalk.dim(" · no baseline supplied")));
+        console.log(boxen(lines.join("\n"), {
+            title: ` PITSTOP — ACCEPTANCE ${result.contractId} `,
+            titleAlignment: "center",
+            borderStyle: "round",
+            padding: 1,
+            borderColor: result.verdict === "SATISFIED" ? "green" : result.verdict === "NOT_SATISFIED" ? "red" : "yellow",
+        }));
+        const color = result.verdict === "SATISFIED" ? "green" : result.verdict === "NOT_SATISFIED" ? "red" : "yellow";
+        console.log(boxen(`${chalk.bold(result.verdict)}\n\n` +
+            result.reasons.map((r) => `· ${r}`).join("\n") +
+            (result.notes.length ? "\n\n" + result.notes.map((n) => chalk.dim(`· ${n}`)).join("\n") : "") +
+            `\n\n${chalk.dim("the contract — not the agent — defines success; criteria are deterministic and observable")}`, { title: " VERDICT ", titleAlignment: "center", borderStyle: "double", padding: 1, borderColor: color }));
+        if (result.sealedPath) {
+            console.log(chalk.dim(`\nSealed evidence written to ${result.sealedPath}\n`));
+            const ev = checkAcceptanceEvidence(result.sealedPath);
+            if (ev.status !== "verified")
+                console.log(chalk.red(`Evidence check: ${ev.status} — ${ev.reason}`));
+        }
+    }
+    addEntry(repo, {
+        type: "fix",
+        summary: `acceptance-verify ${result.contractId}: ${result.verdict}`,
+        context: `${result.discriminative}/${result.totalCriteria} criteria discriminate · candidate ${result.candidateRef} · baseline ${result.baselineRef ?? "none"}`,
+    });
+    process.exitCode =
+        result.verdict === "SATISFIED" ? 0 : result.verdict === "NOT_SATISFIED" ? 1 : result.verdict === "UNPROVEN" ? 2 : 3;
+});
+export default acceptanceVerify;
+//# sourceMappingURL=acceptanceVerify.js.map

package/dist/commands/acceptanceVerify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"acceptanceVerify.js","sourceRoot":"","sources":["../../src/commands/acceptanceVerify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C,MAAM,IAAI,GAAG,CAAC,IAAoB,EAAE,EAAE,CACpC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAE/E,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,OAAO,CAAC,mBAAmB,CAAC;KAC7D,WAAW,CACV,sFAAsF;IACpF,4FAA4F;IAC5F,4FAA4F;IAC5F,iGAAiG;IACjG,sFAAsF,CACzF;KACA,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,EAAE,GAAG,CAAC;KAC3C,cAAc,CACb,0BAA0B,EAC1B,yJAAyJ,CAC1J;KACA,MAAM,CAAC,mBAAmB,EAAE,gDAAgD,EAAE,MAAM,CAAC;KACrF,MAAM,CAAC,kBAAkB,EAAE,2FAA2F,CAAC;KACvH,MAAM,CAAC,aAAa,EAAE,2EAA2E,CAAC;KAClG,MAAM,CAAC,gBAAgB,EAAE,wCAAwC,CAAC;KAClE,MAAM,CAAC,QAAQ,EAAE,yBAAyB,CAAC;KAC3C,MAAM,CAAC,KAAK,EAAE,OAAe,EAAE,IAAS,EAAE,EAAE;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEnC,IAAI,MAAM,GAAG,MAAM,gBAAgB,CAAC;QAClC,IAAI;QACJ,YAAY,EAAE,IAAI,CAAC,QAAQ;QAC3B,YAAY,EAAE,IAAI,CAAC,SAAS;QAC5B,WAAW,EAAE,IAAI,CAAC,QAAQ;QAC1B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;KAC3D,CAAC,CAAC;IACH,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAEtC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,gBAAgB,EAAE;YAC5H,SAAS,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE,MAAM,CAAC,YAAY,EAAE;YACjE,QAAQ,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC,WAAW,EAAE;YAC9D,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACf,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;QACvE,MAAM,KAAK,GAAa,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClG,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;gBACxE,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;YACpH,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,QAAQ,IAAI,MAAM,CAAC,aAAa,oBAAoB;YAC3F,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,MAAM,CAAC,cAAc,6BAA6B,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC;QACzJ,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACtB,KAAK,EAAE,yBAAyB,MAAM,CAAC,UAAU,GAAG;YACpD,cAAc,EAAE,QAAQ;YACxB,WAAW,EAAE,OAAO;YACpB,OAAO,EAAE,CAAC;YACV,WAAW,EAAE,MAAM,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,KAAK,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;SAC9G,CAAC,CACH,CAAC;QACF,MAAM,KAAK,GACT,MAAM,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,KAAK,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;QACnG,OAAO,CAAC,GAAG,CACT,KAAK,CACH,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM;YACjC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC9C,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,OAAO,KAAK,CAAC,GAAG,CAAC,2FAA2F,CAAC,EAAE,EACjH,EAAE,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CACxG,CACF,CAAC;QACF,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gCAAgC,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC;YAC9E,MAAM,EAAE,GAAG,uBAAuB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACtD,IAAI,EAAE,CAAC,MAAM,KAAK,UAAU;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC,MAAM,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACtG,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,IAAI,EAAE;QACb,IAAI,EAAE,KAAK;QACX,OAAO,EAAE,qBAAqB,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,OAAO,EAAE;QACpE,OAAO,EAAE,GAAG,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,aAAa,sCAAsC,MAAM,CAAC,YAAY,eAAe,MAAM,CAAC,WAAW,IAAI,MAAM,EAAE;KAChK,CAAC,CAAC;IAEH,OAAO,CAAC,QAAQ;QACd,MAAM,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,KAAK,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxH,CAAC,CAAC,CAAC;AAEL,eAAe,gBAAgB,CAAC"}

package/dist/commands/architectureCheck.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+export declare const architectureCheck: Command;
+export default architectureCheck;