prismatica 0.2.0

package/dist/guide.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guide.js","sourceRoot":"","sources":["../src/guide.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,MAAM,CAAC,MAAM,YAAY,GAAiB;IACxC;QACE,EAAE,EAAE,gBAAgB;QACpB,KAAK,EAAE,iBAAiB;QACxB,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4EAqDkE;KACzE;IACD;QACE,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,wCAAwC;QAC/C,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBAkHe;KACtB;IACD;QACE,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,yDAAyD;QAChE,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;+BA0FqB;KAC5B;IACD;QACE,EAAE,EAAE,eAAe;QACnB,KAAK,EAAE,+CAA+C;QACtD,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8CAsCoC;KAC3C;IACD;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,mDAAmD;QAC1D,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6CA6BmC;KAC1C;IACD;QACE,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,kDAAkD;QACzD,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0DAoCgD;KACvD;IACD;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,sDAAsD;QAC7D,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAiCsB;KAC7B;IACD;QACE,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,8DAA8D;QACrE,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAsCuB;KAC9B;IACD;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,0DAA0D;QACjE,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4EAsDkE;KACzE;IACD;QACE,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,sDAAsD;QAC7D,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;+BA0CqB;KAC5B;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,0DAA0D;QACjE,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uEAiG6D;KACpE;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,KAAK,EAAE,gEAAgE;QACvE,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sCA6B4B;KACnC;IACD;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,2DAA2D;QAClE,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wEAqD8D;KACrE;IACD;QACE,EAAE,EAAE,cAAc;QAClB,KAAK,EAAE,8CAA8C;QACrD,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iEA6CuD;KAC9D;IACD;QACE,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,mDAAmD;QAC1D,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gEA4HsD;KAC7D;IACD;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,wEAAwE;QAC/E,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BA8NiB;KACxB;IACD;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,sDAAsD;QAC7D,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qEAuC2D;KAClE;IACD;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,0CAA0C;QACjD,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aAyDG;KACV;IACD;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,kDAAkD;QACzD,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;+CA0GqC;KAC5C;IACD;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,uCAAuC;QAC9C,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qEA8D2D;KAClE;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,iDAAiD;QACxD,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;0DAwBgD;KACvD;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,4CAA4C;QACnD,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BA0CoB;KAC3B;IACD;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,kCAAkC;QACzC,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAwEuB;KAC9B;IACD;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,0BAA0B;QACjC,IAAI,EAAE;;;;;;;;;;;;;;;;;;OAkBH;KACJ;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,8CAA8C;QACrD,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;+DA8JqD;KAC5D;IACD;QACE,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,4DAA4D;QACnE,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA4DQ;KACf;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,KAAK,EAAE,yEAAyE;QAChF,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gEA6BsD;KAC7D;IACD;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,mCAAmC;QAC1C,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8EAwCoE;KAC3E;IACD;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,iDAAiD;QACxD,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2CA6BiC;KACxC;CACF,CAAC;AAEF,MAAM,UAAU,aAAa;IAC3B,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,EAAU;IACzC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,KAAK,CAAC,KAAK,OAAO,KAAK,CAAC,IAAI,IAAI,CAAC;AAChD,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,UAAU;IACV,eAAe;IACf,YAAY;IACZ,SAAS;IACT,gBAAgB;IAChB,YAAY;IACZ,cAAc;IACd,SAAS;IACT,OAAO;IACP,OAAO;IACP,WAAW;IACX,aAAa;IACb,SAAS;IACT,aAAa;CACL,CAAC;AAEX,SAAS,OAAO,CAAC,KAAiB;IAChC,OAAO,KAAK,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,sBAAsB,KAAK,CAAC,EAAE,EAAE,CAAC;AACxF,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAC7C,kBAAwC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAC7D,CAAC;IACF,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CACnC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAE,kBAAwC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CACzE,CAAC;IACF,OAAO;;;;;;;EAOP,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;;;EAIjC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;EAEjC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,KAAK,CAAC,KAAK,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;CAC/E,CAAC;AACF,CAAC"}

package/dist/ids.js

@@ -0,0 +1,60 @@
+import { randomBytes } from 'node:crypto';
+/**
+ * The shape every Flow, Rule and Delta id must have. Ids become FILENAMES
+ * under `.prismatica/`, so an id is a path component and nothing else: no
+ * separators, no `..`, no leading dot, no absolute prefix, no null byte.
+ *
+ * This is deliberately the same lowercase-kebab shape `slugify` already
+ * produces, so every id Prismatica itself mints passes, and every id already
+ * on disk parses unchanged. It is enforced on UNTRUSTED AGENT OUTPUT only
+ * (see `planning/schema.ts`) — never added to the signed record schemas in
+ * `records/types.ts`, where a new constraint would break existing records.
+ */
+export const RECORD_ID_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
+/** Longest acceptable id — a filename, not a paragraph. */
+const MAX_RECORD_ID_LENGTH = 100;
+/**
+ * Why `id` is not usable as a record filename, or null when it is fine.
+ * Returns a reason rather than a boolean so callers can tell the owner
+ * exactly what was wrong with what the agent proposed.
+ */
+export function validateRecordId(id) {
+    if (id === '') {
+        return 'is empty';
+    }
+    if (id.length > MAX_RECORD_ID_LENGTH) {
+        return `is longer than ${MAX_RECORD_ID_LENGTH} characters`;
+    }
+    if (!RECORD_ID_PATTERN.test(id)) {
+        return `is not a plain lowercase id ("${id}") — ids may contain only a-z, 0-9 and hyphens, and become filenames, so path separators and ".." are refused`;
+    }
+    return null;
+}
+/** A URL/file-safe slug from arbitrary text. */
+export function slugify(text) {
+    return text
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, 40);
+}
+/** YYYYMMDD in UTC — stable, sortable, human-readable. */
+export function dateStamp(now = new Date()) {
+    return now.toISOString().slice(0, 10).replace(/-/g, '');
+}
+/**
+ * A contract id: date + title slug + short random suffix so two changes framed
+ * the same day with the same title never collide.
+ */
+export function makeContractId(title, now = new Date()) {
+    const slug = slugify(title) || 'change';
+    const suffix = randomBytes(2).toString('hex');
+    return `${dateStamp(now)}-${slug}-${suffix}`;
+}
+/** A delta id: same shape as a contract id — date + a slug of "instead" + a short suffix. */
+export function makeDeltaId(instead, now = new Date()) {
+    const slug = slugify(instead) || 'delta';
+    const suffix = randomBytes(2).toString('hex');
+    return `${dateStamp(now)}-${slug}-${suffix}`;
+}
+//# sourceMappingURL=ids.js.map

package/dist/ids.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ids.js","sourceRoot":"","sources":["../src/ids.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,sBAAsB,CAAC;AAExD,2DAA2D;AAC3D,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAEjC;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAU;IACzC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACd,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,EAAE,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;QACrC,OAAO,kBAAkB,oBAAoB,aAAa,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAChC,OAAO,iCAAiC,EAAE,+GAA+G,CAAC;IAC5J,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,OAAO,IAAI;SACR,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,SAAS,CAAC,MAAY,IAAI,IAAI,EAAE;IAC9C,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,MAAY,IAAI,IAAI,EAAE;IAClE,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC;IACxC,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;AAC/C,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,MAAY,IAAI,IAAI,EAAE;IACjE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC;IACzC,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;AAC/C,CAAC"}

package/dist/keys.js

@@ -0,0 +1,58 @@
+/**
+ * The owner's Ed25519 signing keypair. The private key lives in the per-user
+ * Prismatica home and is NEVER written into any repo; only the public key is
+ * committed (in config.json) so CI can verify signed decisions offline.
+ */
+import { createPrivateKey, createPublicKey, generateKeyPairSync, sign as cryptoSign, verify as cryptoVerify, } from 'node:crypto';
+import fs from 'node:fs';
+import { UserError } from './errors.js';
+import { globalHome, ownerPrivateKeyPath } from './paths.js';
+export function ensureOwnerKeyPair() {
+    const keyPath = ownerPrivateKeyPath();
+    if (fs.existsSync(keyPath)) {
+        // createPublicKey derives the public half straight from the private PEM.
+        const publicKeyPem = createPublicKey(fs.readFileSync(keyPath, 'utf8'))
+            .export({ type: 'spki', format: 'pem' })
+            .toString();
+        return { publicKeyPem, created: false };
+    }
+    fs.mkdirSync(globalHome(), { recursive: true });
+    const { publicKey, privateKey } = generateKeyPairSync('ed25519');
+    fs.writeFileSync(keyPath, privateKey.export({ type: 'pkcs8', format: 'pem' }).toString(), {
+        mode: 0o600,
+    });
+    return {
+        publicKeyPem: publicKey.export({ type: 'spki', format: 'pem' }).toString(),
+        created: true,
+    };
+}
+/** The message an owner decision signs over: contract id, patch id, decision. */
+export function decisionMessage(contractId, patchId, decision) {
+    return `${contractId}\n${patchId}\n${decision}`;
+}
+/** Sign a message with the owner's private key (Ed25519). */
+export function signMessage(message) {
+    const keyPath = ownerPrivateKeyPath();
+    if (!fs.existsSync(keyPath)) {
+        throw new UserError('No owner signing key found — set one up before signing decisions.', {
+            command: 'prismatica init',
+            why: 'init creates the Ed25519 owner key in ~/.config/prismatica/',
+        });
+    }
+    const privatePem = fs.readFileSync(keyPath, 'utf8');
+    const privateKey = createPrivateKey(privatePem);
+    const signature = cryptoSign(null, Buffer.from(message), privateKey).toString('base64');
+    const publicKey = createPublicKey(privatePem).export({ type: 'spki', format: 'pem' }).toString();
+    return { signature, publicKey };
+}
+/** Verify a signature offline with the committed public key. */
+export function verifySignature(message, signature, publicKeyPem) {
+    try {
+        const publicKey = createPublicKey(publicKeyPem);
+        return cryptoVerify(null, Buffer.from(message), publicKey, Buffer.from(signature, 'base64'));
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=keys.js.map

package/dist/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,IAAI,IAAI,UAAU,EAClB,MAAM,IAAI,YAAY,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAO7D,MAAM,UAAU,kBAAkB;IAChC,MAAM,OAAO,GAAG,mBAAmB,EAAE,CAAC;IACtC,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,yEAAyE;QACzE,MAAM,YAAY,GAAG,eAAe,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;aACnE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;aACvC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC1C,CAAC;IACD,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACjE,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE;QACxF,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,OAAO;QACL,YAAY,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC1E,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,eAAe,CAAC,UAAkB,EAAE,OAAe,EAAE,QAAgB;IACnF,OAAO,GAAG,UAAU,KAAK,OAAO,KAAK,QAAQ,EAAE,CAAC;AAClD,CAAC;AAOD,6DAA6D;AAC7D,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,MAAM,OAAO,GAAG,mBAAmB,EAAE,CAAC;IACtC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,SAAS,CAAC,mEAAmE,EAAE;YACvF,OAAO,EAAE,iBAAiB;YAC1B,GAAG,EAAE,6DAA6D;SACnE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxF,MAAM,SAAS,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjG,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAClC,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,SAAiB,EAAE,YAAoB;IACtF,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;QAChD,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/ledger.js

@@ -0,0 +1,197 @@
+import fs from 'node:fs';
+import { ledgerPath, readyLogPath } from './paths.js';
+import { LedgerEntrySchema, LedgerRecordSchema, ReadyLedgerEventSchema, } from './records/types.js';
+export function isAssuranceLedgerEntry(record) {
+    return record.event === 'check_run' || record.event === 'gate_run';
+}
+/**
+ * Append one validated CHECK or GATE row as a single JSONL line.
+ *
+ * `LedgerEntrySchema`, not `LedgerRecordSchema`: the assurance ledger holds
+ * check/gate rows and nothing else, so that a reader built against that schema
+ * alone — every Prismatica before Get Change Ready existed, and every consumer
+ * that decides proof — reads the whole file without a malformed line.
+ * Lifecycle events go to `appendReadyEvent` and the file beside it.
+ */
+export function appendLedgerEntry(repoRoot, entry) {
+    const validated = LedgerEntrySchema.parse(entry);
+    fs.appendFileSync(ledgerPath(repoRoot), JSON.stringify(validated) + '\n');
+}
+/**
+ * Append one validated Get Change Ready lifecycle event to the ready log.
+ *
+ * Same append-only discipline as the ledger and the same principle 4 timing —
+ * the event is written after the step it records. It is bookkeeping, never
+ * evidence: nothing in the proof path reads this file, which is why it is a
+ * partition of the existing plain-file record store rather than a second store.
+ */
+export function appendReadyEvent(repoRoot, event) {
+    const validated = ReadyLedgerEventSchema.parse(event);
+    fs.appendFileSync(readyLogPath(repoRoot), JSON.stringify(validated) + '\n');
+}
+/** The most recent run recorded for a change, optionally filtered by event. */
+export function latestRunFor(repoRoot, contractId, event) {
+    return readLedger(repoRoot)
+        .entries.filter((entry) => entry.contractId === contractId && (event === undefined || entry.event === event))
+        .at(-1);
+}
+export function readLedger(repoRoot) {
+    const result = { entries: [], malformed: [] };
+    for (const line of readLedgerLines(repoRoot)) {
+        if (line.record) {
+            if (isAssuranceLedgerEntry(line.record)) {
+                result.entries.push(line.record);
+            }
+        }
+        else {
+            result.malformed.push({ lineNumber: line.lineNumber, error: line.error });
+        }
+    }
+    return result;
+}
+/**
+ * Every Get Change Ready event for this repo, oldest first.
+ *
+ * The union of two sources while any repository still holds the pre-partition
+ * shape: LEGACY events still sitting in `ledger.jsonl`, which by construction
+ * precede everything already partitioned, followed by the ready log's own
+ * lines. Reading is deliberately non-destructive — `migrateReadyEvents` does
+ * the physical move, and only the Ready WRITE paths call it, so a repository
+ * upgrading mid-run keeps its budget enforcement without a read command
+ * rewriting records underneath it.
+ *
+ * `malformed` covers this file only. An unreadable ledger line is the ledger
+ * reader's to report; `ready.ts` blocks on both.
+ */
+export function readReadyLog(repoRoot) {
+    const result = { events: [], malformed: [] };
+    for (const line of readLedgerLines(repoRoot)) {
+        if (line.record && !isAssuranceLedgerEntry(line.record)) {
+            result.events.push(line.record);
+        }
+    }
+    for (const line of readLogLines(readyLogPath(repoRoot), ReadyLedgerEventSchema)) {
+        if (line.record) {
+            result.events.push(line.record);
+        }
+        else {
+            result.malformed.push({ lineNumber: line.lineNumber, error: line.error });
+        }
+    }
+    return result;
+}
+/**
+ * Move any legacy Ready rows out of `ledger.jsonl` and into `ready.jsonl`,
+ * returning how many moved. A no-op — and no write at all — once done.
+ *
+ * The lines are moved as their original BYTES, in their original order, so the
+ * events a repository already recorded survive the partition unchanged
+ * (principle 5: this is a move, never a rewrite). They are APPENDED to the
+ * ready log rather than merged into it: appending is the only shape that file
+ * accepts, and legacy rows precede everything already there by construction.
+ * A line the schema cannot read is left in the ledger exactly where it is —
+ * it is not a Ready event as far as anything here can tell, and moving it
+ * would relocate a corruption that `latestCheckStanding` reasons about by
+ * POSITION.
+ */
+export function migrateReadyEvents(repoRoot) {
+    const lines = readLedgerLines(repoRoot);
+    const moving = new Set(lines.filter((line) => line.record && !isAssuranceLedgerEntry(line.record)));
+    if (moving.size === 0) {
+        return 0;
+    }
+    const text = (kept) => kept.map((line) => `${line.text}\n`).join('');
+    const movingText = text([...moving]);
+    const readyFile = readyLogPath(repoRoot);
+    const readyText = fs.existsSync(readyFile) ? fs.readFileSync(readyFile, 'utf8') : '';
+    // The first rename may land before the second one. A retry recognises that
+    // exact suffix and completes the ledger move without appending it twice.
+    if (!readyText.endsWith(movingText)) {
+        replaceFile(readyFile, readyText + movingText);
+    }
+    replaceFile(ledgerPath(repoRoot), text(lines.filter((line) => !moving.has(line))));
+    return moving.size;
+}
+function replaceFile(file, contents) {
+    const temporary = `${file}.tmp`;
+    try {
+        fs.writeFileSync(temporary, contents);
+        fs.renameSync(temporary, file);
+    }
+    finally {
+        if (fs.existsSync(temporary))
+            fs.rmSync(temporary);
+    }
+}
+function readLogLines(file, schema) {
+    if (!fs.existsSync(file)) {
+        return [];
+    }
+    const lines = [];
+    fs.readFileSync(file, 'utf8')
+        .split('\n')
+        .forEach((text, index) => {
+        if (text.trim() === '') {
+            return;
+        }
+        try {
+            lines.push({ lineNumber: index + 1, text, record: schema.parse(JSON.parse(text)) });
+        }
+        catch (error) {
+            lines.push({
+                lineNumber: index + 1,
+                text,
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    });
+    return lines;
+}
+/**
+ * The ledger's own lines, parsed with the UNION schema on purpose.
+ *
+ * `appendLedgerEntry` writes check/gate rows only, but a repository that ran
+ * the pre-partition version has Ready rows on disk — and in a live lane they
+ * sit AFTER the latest check, which is precisely where `latestCheckStanding`
+ * fails closed. Reading them strictly would make every such change permanently
+ * uncheckable, so the reader stays tolerant of what is already written while
+ * the WRITER is strict about what may be added. Tolerance is not a hole: these
+ * records are filtered out of `readLedger` exactly as they always were, and
+ * `migrateReadyEvents` removes them from the file for good.
+ */
+function readLedgerLines(repoRoot) {
+    return readLogLines(ledgerPath(repoRoot), LedgerRecordSchema);
+}
+export function latestCheckStanding(repoRoot, contractId) {
+    const lines = readLedgerLines(repoRoot);
+    const latest = lines
+        .filter((line) => line.record !== undefined &&
+        isAssuranceLedgerEntry(line.record) &&
+        line.record.contractId === contractId &&
+        line.record.event === 'check_run')
+        .at(-1);
+    if (!latest) {
+        return { state: 'none', detail: 'no check has been recorded for this change yet' };
+    }
+    const laterMalformed = lines.find((line) => line.error && line.lineNumber > latest.lineNumber);
+    if (laterMalformed) {
+        return {
+            state: 'malformed',
+            entry: latest.record,
+            detail: `ledger line ${laterMalformed.lineNumber} was written after the latest check and cannot be read (${laterMalformed.error})`,
+        };
+    }
+    const entry = latest.record;
+    if (!entry.pass) {
+        return { state: 'fail', entry, detail: 'the latest check run failed' };
+    }
+    if (!entry.checkedHead) {
+        return {
+            state: 'unbound',
+            entry,
+            detail: 'the latest check predates commit binding, so nothing can tell what it proved',
+        };
+    }
+    return { state: 'pass', entry, detail: `checks passed at ${entry.checkedHead.slice(0, 12)}` };
+}
+//# sourceMappingURL=ledger.js.map

package/dist/ledger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger.js","sourceRoot":"","sources":["../src/ledger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,GAIvB,MAAM,oBAAoB,CAAC;AAc5B,MAAM,UAAU,sBAAsB,CAAC,MAAoB;IACzD,OAAO,MAAM,CAAC,KAAK,KAAK,WAAW,IAAI,MAAM,CAAC,KAAK,KAAK,UAAU,CAAC;AACrE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,KAAkB;IACpE,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjD,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,KAAuB;IACxE,MAAM,SAAS,GAAG,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACtD,EAAE,CAAC,cAAc,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;AAC9E,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,YAAY,CAC1B,QAAgB,EAChB,UAAkB,EAClB,KAA4B;IAE5B,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,OAAO,CAAC,MAAM,CACb,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,UAAU,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,CAC7F;SACA,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAAgB;IACzC,MAAM,MAAM,GAAqB,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAChE,KAAK,MAAM,IAAI,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACxC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,KAAM,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,MAAM,MAAM,GAAuB,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACjE,KAAK,MAAM,IAAI,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACxD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,sBAAsB,CAAC,EAAE,CAAC;QAChF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,KAAM,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAC5E,CAAC;IACF,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,IAAkB,EAAU,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3F,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrF,2EAA2E;IAC3E,yEAAyE;IACzE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACpC,WAAW,CAAC,SAAS,EAAE,SAAS,GAAG,UAAU,CAAC,CAAC;IACjD,CAAC;IACD,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,QAAgB;IACjD,MAAM,SAAS,GAAG,GAAG,IAAI,MAAM,CAAC;IAChC,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACtC,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACjC,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAaD,SAAS,YAAY,CAAI,IAAY,EAAE,MAAsC;IAC3E,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;SAC1B,KAAK,CAAC,IAAI,CAAC;SACX,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACvB,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,IAAI,CAAC;gBACT,UAAU,EAAE,KAAK,GAAG,CAAC;gBACrB,IAAI;gBACJ,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACL,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,eAAe,CAAC,QAAgB;IACvC,OAAO,YAAY,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,CAAC;AAChE,CAAC;AA+BD,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,UAAkB;IACtE,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,KAAK;SACjB,MAAM,CACL,CAAC,IAAI,EAAgD,EAAE,CACrD,IAAI,CAAC,MAAM,KAAK,SAAS;QACzB,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,UAAU;QACrC,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,WAAW,CACpC;SACA,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACV,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,gDAAgD,EAAE,CAAC;IACrF,CAAC;IACD,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAC/F,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO;YACL,KAAK,EAAE,WAAW;YAClB,KAAK,EAAE,MAAM,CAAC,MAAM;YACpB,MAAM,EAAE,eAAe,cAAc,CAAC,UAAU,2DAA2D,cAAc,CAAC,KAAK,GAAG;SACnI,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;IAC5B,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAChB,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACvB,OAAO;YACL,KAAK,EAAE,SAAS;YAChB,KAAK;YACL,MAAM,EAAE,8EAA8E;SACvF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;AAChG,CAAC"}

package/dist/paths.js

@@ -0,0 +1,109 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+export const PRISMATICA_DIR = '.prismatica';
+export const RECORD_SUBDIRS = [
+    'intents',
+    'contracts',
+    'packs',
+    'evidence',
+    'reviews',
+    'decisions',
+    'passports',
+    'reports',
+    // `abandon` writes here, on the change's own retained branch — never main.
+    'abandonments',
+];
+export function prismaticaDir(repoRoot) {
+    return path.join(repoRoot, PRISMATICA_DIR);
+}
+export function configPath(repoRoot) {
+    return path.join(prismaticaDir(repoRoot), 'config.json');
+}
+export function ledgerPath(repoRoot) {
+    return path.join(prismaticaDir(repoRoot), 'ledger.jsonl');
+}
+/**
+ * The Get Change Ready lifecycle log — a SEPARATE append-only file from the
+ * assurance ledger beside it.
+ *
+ * They were one file, and that was the defect. A baseline reader parses every
+ * ledger line with `LedgerEntrySchema` alone, so a Ready event appended after a
+ * Check made the ledger unreadable at exactly the position `latestCheckStanding`
+ * fails closed on — a change proven and then, by its own bookkeeping, unprovable.
+ * Partitioning keeps `ledger.jsonl` baseline-compatible (check/gate rows only)
+ * and gives lifecycle state a home nothing in the proof path reads.
+ */
+export function readyLogPath(repoRoot) {
+    return path.join(prismaticaDir(repoRoot), 'ready.jsonl');
+}
+export function productMapPath(repoRoot) {
+    return path.join(prismaticaDir(repoRoot), 'product-map.md');
+}
+/**
+ * A fresh private directory OUTSIDE the repository for one hand-off file.
+ *
+ * A context export is scaffolding, not a record: it is read once by the agent
+ * the owner is already talking to, and it is meaningless the moment the tree
+ * moves. Writing it into `.prismatica/` would put untracked scaffolding in
+ * front of every `git status` the proof path depends on — and `check` refuses
+ * an uncommitted file it does not recognise, so a repo-local hand-off would
+ * block the very change it was written to plan.
+ *
+ * `mkdtemp`, never a fixed name: two hand-offs must not collide, and the OS
+ * gives the directory owner-only permissions. Nothing here removes it — the OS
+ * reclaims its own temp directory, and an owner who has not imported yet would
+ * not thank us for deleting the file out from under them.
+ */
+export function createHandoffDir() {
+    return fs.mkdtempSync(path.join(os.tmpdir(), 'prismatica-context-'));
+}
+export function flowsDir(repoRoot) {
+    return path.join(prismaticaDir(repoRoot), 'flows');
+}
+export function flowProposalsDir(repoRoot) {
+    return path.join(flowsDir(repoRoot), 'proposals');
+}
+export function rulesPath(repoRoot) {
+    return path.join(prismaticaDir(repoRoot), 'rules.md');
+}
+export function ruleProposalsDir(repoRoot) {
+    return path.join(prismaticaDir(repoRoot), 'rules', 'proposals');
+}
+export function deltasDir(repoRoot) {
+    return path.join(prismaticaDir(repoRoot), 'deltas');
+}
+/**
+ * Glob patterns (relative posix paths, matching flowProposalsDir/ruleProposalsDir
+ * above) for the scope hook's unconditional carve-out: an agent in a lane may
+ * always write Flow/Rule proposals, regardless of the contract's allowedPaths.
+ */
+export const ATLAS_PROPOSAL_GLOBS = [`${PRISMATICA_DIR}/flows/proposals/**`, `${PRISMATICA_DIR}/rules/proposals/**`];
+/**
+ * Glob patterns (matching flowsDir's *.md files and rulesPath above) for the
+ * scope hook's unconditional hard block: canonical Flow/Rule records — truth
+ * plus the approval block — are never editable from a lane, even if the
+ * contract's allowedPaths would otherwise permit it. The only writer is the
+ * approve path on main (`flow approve` / `rules approve`); this also means
+ * mechanics edits go through the same proposal+approve ceremony (supersedes
+ * the earlier "agents edit mechanics freely in the lane" decision — see
+ * DECISIONS.md).
+ */
+export const ATLAS_CANONICAL_GLOBS = [`${PRISMATICA_DIR}/flows/*.md`, `${PRISMATICA_DIR}/rules.md`];
+export function gateWorkflowPath(repoRoot) {
+    return path.join(repoRoot, '.github', 'workflows', 'prismatica-gate.yml');
+}
+/**
+ * Per-user home for Prismatica itself (signing key, repo registry).
+ * Never a source of truth for any repo's records.
+ */
+export function globalHome() {
+    return process.env.PRISMATICA_HOME ?? path.join(os.homedir(), '.config', 'prismatica');
+}
+export function registryPath() {
+    return path.join(globalHome(), 'repos.json');
+}
+export function ownerPrivateKeyPath() {
+    return path.join(globalHome(), 'owner.key');
+}
+//# sourceMappingURL=paths.js.map

package/dist/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,CAAC,MAAM,cAAc,GAAG,aAAa,CAAC;AAE5C,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS;IACT,WAAW;IACX,OAAO;IACP,UAAU;IACV,SAAS;IACT,WAAW;IACX,WAAW;IACX,SAAS;IACT,2EAA2E;IAC3E,cAAc;CACN,CAAC;AAEX,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAAgB;IACzC,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAAgB;IACzC,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,QAAgB;IACvC,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,QAAgB;IACxC,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,QAAgB;IACxC,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAG,cAAc,qBAAqB,EAAE,GAAG,cAAc,qBAAqB,CAAC,CAAC;AAErH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,cAAc,aAAa,EAAE,GAAG,cAAc,WAAW,CAAC,CAAC;AAEpG,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,qBAAqB,CAAC,CAAC;AAC5E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU;IACxB,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,YAAY,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,WAAW,CAAC,CAAC;AAC9C,CAAC"}

package/dist/planning/context.js

@@ -0,0 +1,94 @@
+/**
+ * The context envelope — the export half of the skill-first seam.
+ *
+ * Prismatica used to run the Planner itself: detect an installed CLI's flags,
+ * spawn it read-only, translate a JSON Schema into that provider's dialect,
+ * decode the answer back. Every part of that was a transport, and a transport
+ * is exactly the thing a governance tool should not own — it made "which agent
+ * do you have installed" a question Prismatica had an opinion about, and it put
+ * a provider's structured-output quirks inside the trust path.
+ *
+ * What replaced it is a document. `context start` / `context discover` export
+ * everything an agent needs — the snapshot, the request, provider-neutral
+ * instructions, and the JSON Schema for the answer — and the agent the OWNER is
+ * already talking to reads it. The answer comes back through `--import`, which
+ * revalidates it locally against a FRESH snapshot. No spawn, no dialect, no
+ * capability probe, and one validation path instead of two.
+ *
+ * The envelope is READ-ONLY by construction: building one writes nothing into
+ * the repository (the file lands in a private OS temp directory) and reads
+ * nothing an ordinary `flow list` could not. That is why `context` is one of
+ * the few commands an agent may run for itself.
+ */
+import fs from 'node:fs';
+import { UserError } from '../errors.js';
+import { DISCOVER_FORMAT, PROPOSE_FORMAT, START_FORMAT, proposalsAnswerJsonSchema, startAnswerJsonSchema, } from './schema.js';
+import { proposalsInstructions, startInstructions } from './pack.js';
+export const CONTEXT_KINDS = ['start', 'discover'];
+export function isContextKind(value) {
+    return CONTEXT_KINDS.includes(value);
+}
+export function buildContextEnvelope(input) {
+    const { snapshot } = input;
+    const common = {
+        generatedAt: input.now.toISOString(),
+        app: snapshot.appName,
+        repoRoot: snapshot.repoRoot,
+        snapshot,
+    };
+    if (input.kind === 'start') {
+        return {
+            ...common,
+            format: START_FORMAT,
+            contextKind: 'start',
+            answerFormats: [START_FORMAT],
+            instructions: startInstructions({ snapshot }),
+            answerSchema: startAnswerJsonSchema(),
+            // No request on the command line. The owner describes what they need in
+            // the conversation, the agent clarifies it there, and the wording they
+            // settle on comes back in the plan's own `request` field — one agreed
+            // description of the change instead of two that can disagree.
+            importCommands: ['prismatica start --import <answer.json>'],
+        };
+    }
+    return {
+        ...common,
+        format: DISCOVER_FORMAT,
+        contextKind: 'discover',
+        answerFormats: [DISCOVER_FORMAT, PROPOSE_FORMAT],
+        instructions: proposalsInstructions({ snapshot }),
+        answerSchema: proposalsAnswerJsonSchema(),
+        // Two destinations for one reading of the app, spelled out rather than
+        // inferred: the map of the app lives on main, and a proposal made while
+        // building a change rides that change's own pull request. The command fixes
+        // the destination; the answer's `format` states which command it is for, so
+        // a mis-paste is refused instead of landing on the wrong branch.
+        importCommands: [
+            `prismatica discover --import <answer.json>   # format ${DISCOVER_FORMAT} → main`,
+            `prismatica propose --import <answer.json>    # format ${PROPOSE_FORMAT} → this change lane`,
+        ],
+    };
+}
+// ── The import half ──────────────────────────────────────────────────────────
+/**
+ * Read one answer file as untrusted JSON. Every import command shares this, so
+ * "no such file", "empty", and "that is prose, not JSON" read identically
+ * wherever they happen. It parses and nothing more: what the document MEANS is
+ * decided by a strict zod schema against a fresh snapshot, at the call site.
+ */
+export function readAnswerFile(file, fix) {
+    if (!fs.existsSync(file)) {
+        throw new UserError(`No such file: ${file}`, fix);
+    }
+    const text = fs.readFileSync(file, 'utf8').trim();
+    if (text === '') {
+        throw new UserError(`${file} is empty — there is nothing to import.`, fix);
+    }
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new UserError(`${file} is not valid JSON — import only the agent's JSON document.`, fix);
+    }
+}
+//# sourceMappingURL=context.js.map

package/dist/planning/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/planning/context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EACL,eAAe,EACf,cAAc,EACd,YAAY,EACZ,yBAAyB,EACzB,qBAAqB,GAEtB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAGrE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,UAAU,CAAU,CAAC;AAG5D,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAQ,aAAmC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAsCD,MAAM,UAAU,oBAAoB,CAAC,KAAwB;IAC3D,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC3B,MAAM,MAAM,GAAG;QACb,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE;QACpC,GAAG,EAAE,QAAQ,CAAC,OAAO;QACrB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,QAAQ;KACT,CAAC;IAEF,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO;YACL,GAAG,MAAM;YACT,MAAM,EAAE,YAAY;YACpB,WAAW,EAAE,OAAO;YACpB,aAAa,EAAE,CAAC,YAAY,CAAC;YAC7B,YAAY,EAAE,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC;YAC7C,YAAY,EAAE,qBAAqB,EAAE;YACrC,wEAAwE;YACxE,uEAAuE;YACvE,sEAAsE;YACtE,8DAA8D;YAC9D,cAAc,EAAE,CAAC,yCAAyC,CAAC;SAC5D,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,MAAM;QACT,MAAM,EAAE,eAAe;QACvB,WAAW,EAAE,UAAU;QACvB,aAAa,EAAE,CAAC,eAAe,EAAE,cAAc,CAAC;QAChD,YAAY,EAAE,qBAAqB,CAAC,EAAE,QAAQ,EAAE,CAAC;QACjD,YAAY,EAAE,yBAAyB,EAAE;QACzC,uEAAuE;QACvE,wEAAwE;QACxE,4EAA4E;QAC5E,4EAA4E;QAC5E,iEAAiE;QACjE,cAAc,EAAE;YACd,yDAAyD,eAAe,SAAS;YACjF,yDAAyD,cAAc,qBAAqB;SAC7F;KACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,GAAqC;IAChF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,SAAS,CAAC,iBAAiB,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAChB,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,yCAAyC,EAAE,GAAG,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,6DAA6D,EAAE,GAAG,CAAC,CAAC;IACjG,CAAC;AACH,CAAC"}