peaks-loop 4.0.53 → 4.1.0

package/dist/services/test-cache/test-cache-service.js

@@ -51,7 +51,8 @@ export function readTestCache(projectRoot, filePath) {
         const parsed = JSON.parse(raw);
         return parsed;
     }
-    catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
+    catch {
+        // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
         return null;
     }
 }
@@ -100,7 +101,10 @@ export function isCacheable(projectRoot, filePath, testName) {
     if (!record)
         return { hit: false, reason: 'no-cache' };
     if (record.status !== 'passed') {
-        return { hit: false, reason: record.status === 'failed' ? 'previous-failed' : 'previous-skipped' };
+        return {
+            hit: false,
+            reason: record.status === 'failed' ? 'previous-failed' : 'previous-skipped'
+        };
     }
     return { hit: true, cached: record };
 }
@@ -148,7 +152,8 @@ export function detectTestFramework(projectRoot) {
     try {
         pkg = JSON.parse(readFileSync(pkgPath, 'utf8'));
     }
-    catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
+    catch {
+        // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
         return null;
     }
     const all = {

package/dist/services/upgrade/1x-detector-service.js

@@ -50,7 +50,8 @@ export function detect1xProjectState(cwd = process.cwd()) {
                     configPath = globalConfig;
             }
         }
-        catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
+        catch {
+            // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
             // ignore parse error — the 1.x detection is best-effort
         }
     }
@@ -64,7 +65,8 @@ export function detect1xProjectState(cwd = process.cwd()) {
                     signals.push(`${devPref} references "peaks progress" (1.x CLI surface, removed in slice #014)`);
                 }
             }
-            catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
+            catch {
+                // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
                 // ignore
             }
         }
@@ -89,6 +91,6 @@ export function detect1xProjectState(cwd = process.cwd()) {
         isOneX: signals.length > 0,
         signals,
         projectRoot,
-        configPath,
+        configPath
     };
 }

package/dist/services/upgrade/gitignore-migrate-service.js

@@ -55,7 +55,7 @@ export const CANONICAL_2_0_PEAKS_BLOCK = [
     '.peaks/system/',
     '.peaks/runtime/',
     '.peaks/preferences.json',
-    '.peaks/memory/upgrade-2.0-*.md',
+    '.peaks/memory/upgrade-2.0-*.md'
 ].join('\n');
 /**
  * Returns true when `line` is a wholesale ignore of the entire
@@ -132,7 +132,7 @@ export function migrateGitignoreFile(input) {
             changed: false,
             appliedWrite: false,
             backupPath: null,
-            removedRules: [],
+            removedRules: []
         };
     }
     const before = readFileSync(path, 'utf8');
@@ -143,7 +143,7 @@ export function migrateGitignoreFile(input) {
             changed: false,
             appliedWrite: false,
             backupPath: null,
-            removedRules: [],
+            removedRules: []
         };
     }
     if (input.apply !== true) {
@@ -152,7 +152,7 @@ export function migrateGitignoreFile(input) {
             changed: true,
             appliedWrite: false,
             backupPath: null,
-            removedRules: result.removedRules,
+            removedRules: result.removedRules
         };
     }
     // Apply: write backup first, then atomic-overwrite the original.
@@ -165,6 +165,6 @@ export function migrateGitignoreFile(input) {
         changed: true,
         appliedWrite: true,
         backupPath,
-        removedRules: result.removedRules,
+        removedRules: result.removedRules
     };
 }

package/dist/services/upgrade/upgrade-service.js

@@ -47,13 +47,13 @@ export const defaultSubstepExecutor = (command, args, timeoutMs) => {
             encoding: 'utf8',
             stdio: ['ignore', 'pipe', 'pipe'],
             timeout: timeoutMs,
-            windowsHide: true,
+            windowsHide: true
         });
         return {
             status: result.status,
             stdout: result.stdout ?? '',
             stderr: result.stderr ?? '',
-            durationMs: Date.now() - start,
+            durationMs: Date.now() - start
         };
     }
     catch (err) {
@@ -62,13 +62,27 @@ export const defaultSubstepExecutor = (command, args, timeoutMs) => {
             status: null,
             stdout: '',
             stderr: message,
-            durationMs: Date.now() - start,
+            durationMs: Date.now() - start
         };
     }
 };
 const STEPS = [
-    { name: 'config-migrate', args: (p) => ['config', 'migrate', '--project', p, '--apply', '--json'] },
-    { name: 'standards-migrate', args: (p) => ['standards', 'migrate', '--from-claude-rules', '--project', p, '--apply', '--json'] },
+    {
+        name: 'config-migrate',
+        args: (p) => ['config', 'migrate', '--project', p, '--apply', '--json']
+    },
+    {
+        name: 'standards-migrate',
+        args: (p) => [
+            'standards',
+            'migrate',
+            '--from-claude-rules',
+            '--project',
+            p,
+            '--apply',
+            '--json'
+        ]
+    },
     // memory extract is special: its --artifact takes literal file
     // paths (memory-service rejects glob patterns via realpathSync).
     // The umbrella expands the three documented patterns
@@ -79,7 +93,7 @@ const STEPS = [
     { name: 'memory-extract', args: (p) => ['memory', 'extract', '--project', p, '--json'] },
     { name: 'hooks-install', args: (p) => ['hooks', 'install', '--project', p, '--json'] },
     { name: 'skill-sync', args: (p) => ['skill', 'sync', '--all', '--project', p, '--json'] },
-    { name: 'audit-verify', args: (p) => ['audit', 'red-lines', '--project', p, '--json'] },
+    { name: 'audit-verify', args: (p) => ['audit', 'red-lines', '--project', p, '--json'] }
 ];
 /**
  * Walk `<root>` recursively and collect every file whose basename
@@ -173,7 +187,8 @@ function read1xVersion(cwd) {
         if (typeof raw.version === 'string')
             return raw.version;
     }
-    catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
+    catch {
+        // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
         // ignore
     }
     return null;
@@ -210,7 +225,7 @@ function runStep(peaksBin, name, args, timeoutMs = 60_000, executor = defaultSub
         exitCode: result.status,
         stdout: result.stdout,
         stderr: result.stderr,
-        durationMs: result.durationMs,
+        durationMs: result.durationMs
     };
 }
 function writeUpgradeRecord(projectRoot, result) {
@@ -275,8 +290,7 @@ export function runUpgrade(input) {
     // The compiled service lives at dist/services/upgrade/upgrade-service.js
     // (rootDir=src in tsconfig.build.json trims the "src" segment); bin/peaks.js
     // is at the peaks-loop root, 3 dirs up.
-    const peaksBin = input.peaksBin ??
-        resolve(here, '..', '..', '..', 'bin', 'peaks.js');
+    const peaksBin = input.peaksBin ?? resolve(here, '..', '..', '..', 'bin', 'peaks.js');
     const fallbackPeaks = 'peaks';
     const resolvedPeaksBin = existsSync(peaksBin) ? peaksBin : fallbackPeaks;
     // Resolve the executor once at the top of runUpgrade so every
@@ -344,11 +358,20 @@ export function runUpgrade(input) {
                     exitCode: null,
                     stdout: '',
                     stderr: 'no skills/, CLAUDE.md, or .claude/rules/ artifacts found in the project',
-                    durationMs: 0,
+                    durationMs: 0
                 });
                 continue;
             }
-            const args = ['memory', 'extract', '--project', input.projectRoot, '--artifact', ...artifacts, '--apply', '--json'];
+            const args = [
+                'memory',
+                'extract',
+                '--project',
+                input.projectRoot,
+                '--artifact',
+                ...artifacts,
+                '--apply',
+                '--json'
+            ];
             const r = runStep(resolvedPeaksBin, 'memory-extract', args, 60_000, executor);
             steps.push(r);
             if (r.status === 'fail') {
@@ -398,7 +421,7 @@ export function runUpgrade(input) {
         auditAfter,
         upgradeRecordPath: null,
         nextActions,
-        warnings,
+        warnings
     };
     const upgradeRecordPath = writeUpgradeRecord(input.projectRoot, partial);
     return { ...partial, upgradeRecordPath };

package/dist/services/verdict/envelope-parsers.d.ts

@@ -0,0 +1,84 @@
+/**
+ * peaks-loop v2.13.3 — Envelope parsers (split from `envelopes.ts`).
+ *
+ * `envelopes.ts` exceeded the 300-raw-line file-size cap, so the
+ * finding-free parser mass — the `AnyEnvelope` discriminated-union
+ * projection, the security / perf / karpathy markdown parsers, the
+ * `AnyEnvelope → AggregatorInput` adapter, and the two markdown
+ * section / bullet readers — moved here verbatim. The finding-carrying
+ * helpers (`parseAuditMarkdown`, `parseKarpathyViolations`, `matchEnum`,
+ * `parseFindingBullet`) stay in `envelopes.ts`, which re-exports every
+ * name below so `./envelopes.js` stays the public import path.
+ *
+ * Cycle note: `envelopes.ts` and this file import each other. That is
+ * safe under `module: NodeNext` + `"type": "module"` because every
+ * cross-boundary reference is a hoisted function declaration (resolved
+ * at call time) or an erased `type` — neither module reads a value from
+ * the other at evaluation time.
+ */
+import { type PerfAuditEnvelope, type SecurityAuditEnvelope } from '../audit-independent/index.js';
+import { type KarpathyEnvelope, type MutEnvelope, type QaEnvelope, type AggregatorInput } from './verdict-aggregator.js';
+/**
+ * `kind` is the discriminator. The on-disk file format is unchanged;
+ * this field exists only in the TS type projection. The aggregator
+ * accepts both the legacy `{security, perf, ...}` shape and the new
+ * union via a thin adapter (`aggregateFromEnvelopes`).
+ */
+export type AnyEnvelope = {
+    kind: 'security';
+    envelope: SecurityAuditEnvelope;
+} | {
+    kind: 'perf';
+    envelope: PerfAuditEnvelope;
+} | {
+    kind: 'karpathy';
+    envelope: KarpathyEnvelope;
+} | {
+    kind: 'mut';
+    envelope: MutEnvelope;
+} | {
+    kind: 'qa';
+    envelope: QaEnvelope;
+};
+/**
+ * v2.13.3 AC-1 — parse real v2.12.0 audit markdown.
+ *
+ * Strategy (per PRD AC-1 mitigation):
+ *   1. Try JSON.parse first (back-compat with prior unit tests + any
+ *      consumer that passes a JSON string explicitly).
+ *   2. Fall back to markdown parse: extract `verdict:` from YAML
+ *      frontmatter, parse `## Findings` bullets in the body, return
+ *      a SecurityAuditEnvelope.
+ *   3. Return null when neither path yields a valid envelope.
+ */
+export declare function parseSecurityEnvelope(md: string): SecurityAuditEnvelope | null;
+export declare function parsePerfEnvelope(md: string): PerfAuditEnvelope | null;
+/**
+ * Karpathy review is stored as markdown (`.peaks/_runtime/<sid>/rd/karpathy-review.md`).
+ * We parse the 3 state lines that drive the aggregator:
+ *   - `gateAction: pass | warn | block`
+ *   - `verdict: pass | warn | block`  (alias for gateAction)
+ *   - `passed: true | false`
+ * Plus the violations list under a `## Violations` heading, where each
+ * bullet begins with `[SEVERITY] file:line — hint` and declares a
+ * guideline tag like `(simplicity-first)`.
+ */
+export declare function parseKarpathyEnvelope(md: string): KarpathyEnvelope | null;
+/**
+ * Convert a partial list of `AnyEnvelope` values to the legacy
+ * `AggregatorInput` shape. `null` envelopes are skipped (a missing
+ * envelope is treated as "audit not run" — same semantics as
+ * `AggregatorInput` without that key).
+ */
+export declare function envelopesToAggregatorInput(list: ReadonlyArray<AnyEnvelope | null>): AggregatorInput;
+/** Extract the body of a `## Heading` section (text up to the next
+ *  `## ` heading or EOF). Returns null when the heading is absent. */
+export declare function extractSection(body: string, heading: string): string | null;
+/** Parse `## Findings` bullets. Accepts the 3 real v2.12.0 shapes. */
+export declare function parseFindingBullets(body: string): Array<{
+    dimension: string;
+    severity: 'CRITICAL' | 'HIGH' | 'MED' | 'LOW';
+    file: string;
+    line: number;
+    hint: string;
+}>;

package/dist/services/verdict/envelope-parsers.js

@@ -0,0 +1,146 @@
+/**
+ * peaks-loop v2.13.3 — Envelope parsers (split from `envelopes.ts`).
+ *
+ * `envelopes.ts` exceeded the 300-raw-line file-size cap, so the
+ * finding-free parser mass — the `AnyEnvelope` discriminated-union
+ * projection, the security / perf / karpathy markdown parsers, the
+ * `AnyEnvelope → AggregatorInput` adapter, and the two markdown
+ * section / bullet readers — moved here verbatim. The finding-carrying
+ * helpers (`parseAuditMarkdown`, `parseKarpathyViolations`, `matchEnum`,
+ * `parseFindingBullet`) stay in `envelopes.ts`, which re-exports every
+ * name below so `./envelopes.js` stays the public import path.
+ *
+ * Cycle note: `envelopes.ts` and this file import each other. That is
+ * safe under `module: NodeNext` + `"type": "module"` because every
+ * cross-boundary reference is a hoisted function declaration (resolved
+ * at call time) or an erased `type` — neither module reads a value from
+ * the other at evaluation time.
+ */
+import { isPerfAuditEnvelope, isSecurityAuditEnvelope } from '../audit-independent/index.js';
+import { matchEnum, parseAuditMarkdown, parseFindingBullet, parseKarpathyViolations } from './envelopes.js';
+// ─── 5 parsers (pure, never throw) ─────────────────────────────────────
+/**
+ * v2.13.3 AC-1 — parse real v2.12.0 audit markdown.
+ *
+ * Strategy (per PRD AC-1 mitigation):
+ *   1. Try JSON.parse first (back-compat with prior unit tests + any
+ *      consumer that passes a JSON string explicitly).
+ *   2. Fall back to markdown parse: extract `verdict:` from YAML
+ *      frontmatter, parse `## Findings` bullets in the body, return
+ *      a SecurityAuditEnvelope.
+ *   3. Return null when neither path yields a valid envelope.
+ */
+export function parseSecurityEnvelope(md) {
+    if (typeof md !== 'string' || md.length === 0)
+        return null;
+    // Path 1: JSON (legacy / back-compat)
+    try {
+        const jsonValue = JSON.parse(md);
+        if (isSecurityAuditEnvelope(jsonValue))
+            return jsonValue;
+    }
+    catch {
+        // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
+        // not JSON — fall through to markdown parse
+    }
+    // Path 2: real v2.12.0 markdown (YAML frontmatter + body)
+    return parseAuditMarkdown(md, isSecurityAuditEnvelope);
+}
+export function parsePerfEnvelope(md) {
+    if (typeof md !== 'string' || md.length === 0)
+        return null;
+    // Path 1: JSON (legacy / back-compat)
+    try {
+        const jsonValue = JSON.parse(md);
+        if (isPerfAuditEnvelope(jsonValue))
+            return jsonValue;
+    }
+    catch {
+        // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
+        // not JSON — fall through to markdown parse
+    }
+    // Path 2: real v2.12.0 markdown (YAML frontmatter + body)
+    return parseAuditMarkdown(md, isPerfAuditEnvelope);
+}
+/**
+ * Karpathy review is stored as markdown (`.peaks/_runtime/<sid>/rd/karpathy-review.md`).
+ * We parse the 3 state lines that drive the aggregator:
+ *   - `gateAction: pass | warn | block`
+ *   - `verdict: pass | warn | block`  (alias for gateAction)
+ *   - `passed: true | false`
+ * Plus the violations list under a `## Violations` heading, where each
+ * bullet begins with `[SEVERITY] file:line — hint` and declares a
+ * guideline tag like `(simplicity-first)`.
+ */
+export function parseKarpathyEnvelope(md) {
+    if (typeof md !== 'string' || md.length === 0)
+        return null;
+    const gateAction = matchEnum(md, /^\s*(?:gateAction|verdict)\s*:\s*(pass|warn|block)\s*$/m);
+    const passedMatch = md.match(/^\s*passed\s*:\s*(true|false)\s*$/m);
+    if (gateAction === null || passedMatch === null)
+        return null;
+    const violations = parseKarpathyViolations(md);
+    return {
+        passed: passedMatch[1] === 'true',
+        violations,
+        gateAction
+    };
+}
+// ─── Adapter: union → AggregatorInput (zero call-site churn) ──────────
+/**
+ * Convert a partial list of `AnyEnvelope` values to the legacy
+ * `AggregatorInput` shape. `null` envelopes are skipped (a missing
+ * envelope is treated as "audit not run" — same semantics as
+ * `AggregatorInput` without that key).
+ */
+export function envelopesToAggregatorInput(list) {
+    const out = {};
+    for (const item of list) {
+        if (item === null)
+            continue;
+        if (item.kind === 'security')
+            out.security = item.envelope;
+        else if (item.kind === 'perf')
+            out.perf = item.envelope;
+        else if (item.kind === 'karpathy')
+            out.karpathy = item.envelope;
+        else if (item.kind === 'mut')
+            out.mut = item.envelope;
+        else if (item.kind === 'qa')
+            out.qa = item.envelope;
+    }
+    return out;
+}
+/** Extract the body of a `## Heading` section (text up to the next
+ *  `## ` heading or EOF). Returns null when the heading is absent. */
+export function extractSection(body, heading) {
+    const re = new RegExp(`^##\\s+${heading}\\s*$`, 'm');
+    const sectionStart = body.search(re);
+    if (sectionStart === -1)
+        return null;
+    const afterHeading = body.slice(sectionStart).split('\n');
+    // skip the heading line
+    afterHeading.shift();
+    // collect lines until next `## ` heading
+    const lines = [];
+    for (const line of afterHeading) {
+        if (/^##\s+/.test(line))
+            break;
+        lines.push(line);
+    }
+    return lines.join('\n').trim();
+}
+/** Parse `## Findings` bullets. Accepts the 3 real v2.12.0 shapes. */
+export function parseFindingBullets(body) {
+    const section = body.split(/^##\s+Findings\s*$/m)[1];
+    if (section === undefined)
+        return [];
+    const lines = section.split('\n').filter((l) => l.trim().startsWith('- '));
+    const out = [];
+    for (const line of lines) {
+        const v = parseFindingBullet(line);
+        if (v !== null)
+            out.push(v);
+    }
+    return out;
+}

package/dist/services/verdict/envelopes.d.ts

@@ -15,62 +15,18 @@
  * passed JSON explicitly) and adds a markdown fallback that extracts
  * `verdict:` from the frontmatter and parses `## Findings` bullets.
  *
- * Karpathy §2 (Simplicity First):
- *   - single file, ~210 lines, zero new IO.
- *   - re-uses existing strict-shape guards (isSecurityAuditEnvelope /
- *     isPerfAuditEnvelope) — no duplicate validation logic.
- *   - parsers return `null` on malformed input (mirrors loadMutReport's
- *     "missing → null" contract). Callers can detect "envelope missing"
- *     without throwing.
+ * Wave 5 file-size split: the `AnyEnvelope` projection, the security /
+ * perf / karpathy parsers, the adapter and the section / bullet readers
+ * moved verbatim to `./envelope-parsers.js` (re-exported below so
+ * `./envelopes.js` stays the public path). The finding-carrying
+ * markdown helpers stay here. The parent ↔ sibling cycle is safe under
+ * `module: NodeNext` + `"type": "module"` (hoisted function
+ * declarations + erased types, all resolved at call time).
  */
-import { type PerfAuditEnvelope, type SecurityAuditEnvelope } from '../audit-independent/index.js';
-import { type KarpathyEnvelope, type MutEnvelope, type QaEnvelope, type AggregatorInput } from './verdict-aggregator.js';
-/**
- * `kind` is the discriminator. The on-disk file format is unchanged;
- * this field exists only in the TS type projection. The aggregator
- * accepts both the legacy `{security, perf, ...}` shape and the new
- * union via a thin adapter (`aggregateFromEnvelopes`).
- */
-export type AnyEnvelope = {
-    kind: 'security';
-    envelope: SecurityAuditEnvelope;
-} | {
-    kind: 'perf';
-    envelope: PerfAuditEnvelope;
-} | {
-    kind: 'karpathy';
-    envelope: KarpathyEnvelope;
-} | {
-    kind: 'mut';
-    envelope: MutEnvelope;
-} | {
-    kind: 'qa';
-    envelope: QaEnvelope;
-};
-/**
- * v2.13.3 AC-1 — parse real v2.12.0 audit markdown.
- *
- * Strategy (per PRD AC-1 mitigation):
- *   1. Try JSON.parse first (back-compat with prior unit tests + any
- *      consumer that passes a JSON string explicitly).
- *   2. Fall back to markdown parse: extract `verdict:` from YAML
- *      frontmatter, parse `## Findings` bullets in the body, return
- *      a SecurityAuditEnvelope.
- *   3. Return null when neither path yields a valid envelope.
- */
-export declare function parseSecurityEnvelope(md: string): SecurityAuditEnvelope | null;
-export declare function parsePerfEnvelope(md: string): PerfAuditEnvelope | null;
-/**
- * Karpathy review is stored as markdown (`.peaks/_runtime/<sid>/rd/karpathy-review.md`).
- * We parse the 3 state lines that drive the aggregator:
- *   - `gateAction: pass | warn | block`
- *   - `verdict: pass | warn | block`  (alias for gateAction)
- *   - `passed: true | false`
- * Plus the violations list under a `## Violations` heading, where each
- * bullet begins with `[SEVERITY] file:line — hint` and declares a
- * guideline tag like `(simplicity-first)`.
- */
-export declare function parseKarpathyEnvelope(md: string): KarpathyEnvelope | null;
+import { type KarpathyEnvelope, type MutEnvelope, type QaEnvelope } from './verdict-aggregator.js';
+export { envelopesToAggregatorInput, parseKarpathyEnvelope, parsePerfEnvelope, parseSecurityEnvelope } from './envelope-parsers.js';
+export type { AnyEnvelope } from './envelope-parsers.js';
+export declare function parseKarpathyViolations(md: string): KarpathyEnvelope['violations'];
 /**
  * Mut envelope is JSON. Mirrors `loadMutReport`'s contract: missing
  * fields → null. The strict shape matches `MutReportJson` in
@@ -83,10 +39,44 @@ export declare function parseMutEnvelope(json: unknown): MutEnvelope | null;
  * optionally carries a `reportPath:` line. Anything else → null.
  */
 export declare function parseQaEnvelope(md: string): QaEnvelope | null;
+type AuditEnvelopeGuard<T> = (v: unknown) => v is T;
 /**
- * Convert a partial list of `AnyEnvelope` values to the legacy
- * `AggregatorInput` shape. `null` envelopes are skipped (a missing
- * envelope is treated as "audit not run" — same semantics as
- * `AggregatorInput` without that key).
+ * Parse a v2.12.0 audit markdown file:
+ *   ---
+ *   schemaVersion: 1
+ *   verdict: warn
+ *   violationsCount: 1
+ *   ---
+ *   ## Summary
+ *   Test security envelope for dogfood.
+ *
+ *   ## Findings
+ *   - HIGH: hardcoded password in src/auth.ts:42
+ *
+ *   ## Verdict
+ *   verdict: warn
+ *   CRITICAL: 0
+ *
+ * Strategy:
+ *   1. Strip YAML frontmatter (`---\n...\n---\n`). The frontmatter
+ *      `verdict:` line is the source of truth — the body's `## Verdict`
+ *      block is corroborating.
+ *   2. Pull `verdict` from frontmatter (regex, line-anchored).
+ *   3. Parse `## Findings` bullets — accept 3 real v2.12.0 shapes:
+ *        a. `- [SEV] dim @ file:line — hint` (rendered by renderSecurityAuditArtifact)
+ *        b. `- HIGH: hint in file:line` (real dogfood fixture shape)
+ *        c. `- (none)` — empty
+ *   4. Build a candidate envelope and run through the strict-shape
+ *      guard. Return null if the guard rejects (per the parser
+ *      contract: parsers never throw).
  */
-export declare function envelopesToAggregatorInput(list: ReadonlyArray<AnyEnvelope | null>): AggregatorInput;
+export declare function parseAuditMarkdown<T>(md: string, guard: AuditEnvelopeGuard<T>): T | null;
+/** Parse a single finding bullet. Returns null on malformed input. */
+export declare function parseFindingBullet(line: string): {
+    dimension: string;
+    severity: 'CRITICAL' | 'HIGH' | 'MED' | 'LOW';
+    file: string;
+    line: number;
+    hint: string;
+} | null;
+export declare function matchEnum(md: string, regex: RegExp): string | null;