psyclaw 0.25.2 → 0.26.0

package/dist/src/style/artifact.d.ts

@@ -0,0 +1,6 @@
+import type { ArtifactIdentity, ReproducibilityCheck, StyleCheckResult } from "./contracts.js";
+export declare function artifactFilename(identity: ArtifactIdentity): string;
+export declare function parseArtifactFilename(path: string): ArtifactIdentity | undefined;
+export declare function verifyReproducibility(check: ReproducibilityCheck): Promise<StyleCheckResult>;
+export declare function checkDefaultStyle(identity: ArtifactIdentity, profileId?: string): StyleCheckResult;
+export declare function artifactExtension(path: string): string;

package/dist/src/style/artifact.js

@@ -0,0 +1,61 @@
+import { basename, extname } from "node:path";
+import { sha256File } from "../core/hash.js";
+import { STYLE_CONTRACT_VERSION } from "./contracts.js";
+const SHA = /^[a-f0-9]{64}$/i;
+const SLUG = /^[a-z0-9][a-z0-9-]*$/;
+export function artifactFilename(identity) {
+    if (!SLUG.test(identity.slug))
+        throw new Error("artifact slug must use lowercase letters, numbers, and hyphens");
+    if (!/^v[1-9][0-9]*$/.test(identity.version))
+        throw new Error("artifact version must be like v1");
+    const extension = identity.extension.replace(/^\./, "").toLowerCase();
+    if (!/^[a-z0-9]+$/.test(extension))
+        throw new Error("artifact extension is invalid");
+    return `${identity.kind}-${identity.slug}-${identity.version}.${extension}`;
+}
+export function parseArtifactFilename(path) {
+    const match = /^(figure|table|manuscript)-([a-z0-9][a-z0-9-]*)-(v[1-9][0-9]*)\.([a-z0-9]+)$/i.exec(basename(path));
+    return match ? { kind: match[1].toLowerCase(), slug: match[2].toLowerCase(), version: match[3].toLowerCase(), extension: match[4].toLowerCase() } : undefined;
+}
+export async function verifyReproducibility(check) {
+    const findings = [];
+    if (!check.scriptPath?.trim() || !check.scriptSha256 || !SHA.test(check.scriptSha256))
+        findings.push({ rule: "script-hash-required", severity: "block", message: "script path and SHA-256 are required" });
+    if (check.scriptPath && check.scriptSha256 && SHA.test(check.scriptSha256)) {
+        try {
+            if ((await sha256File(check.scriptPath)).toLowerCase() !== check.scriptSha256.toLowerCase())
+                findings.push({ rule: "script-hash-mismatch", severity: "block", message: "script hash does not match the file" });
+        }
+        catch {
+            findings.push({ rule: "script-unavailable", severity: "block", message: "reproducibility script is unavailable" });
+        }
+    }
+    for (const [path, hash] of Object.entries(check.inputHashes ?? {})) {
+        if (!SHA.test(hash)) {
+            findings.push({ rule: "input-hash-invalid", severity: "block", message: `invalid input hash: ${path}` });
+            continue;
+        }
+        try {
+            if ((await sha256File(path)).toLowerCase() !== hash.toLowerCase())
+                findings.push({ rule: "input-hash-mismatch", severity: "block", message: `input hash does not match: ${path}` });
+        }
+        catch {
+            findings.push({ rule: "input-unavailable", severity: "block", message: `input is unavailable: ${path}` });
+        }
+    }
+    return { schemaVersion: STYLE_CONTRACT_VERSION, ok: !findings.some((f) => f.severity === "block"), findings };
+}
+export function checkDefaultStyle(identity, profileId = "generic") {
+    const findings = [];
+    try {
+        artifactFilename(identity);
+    }
+    catch (error) {
+        findings.push({ rule: "artifact-name-invalid", severity: "block", message: String(error instanceof Error ? error.message : error) });
+    }
+    if (!profileId.trim())
+        findings.push({ rule: "profile-required", severity: "block", message: "style profile id is required" });
+    return { schemaVersion: STYLE_CONTRACT_VERSION, ok: !findings.some((f) => f.severity === "block"), findings };
+}
+export function artifactExtension(path) { return extname(path).replace(/^\./, "").toLowerCase(); }
+//# sourceMappingURL=artifact.js.map

package/dist/src/style/artifact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact.js","sourceRoot":"","sources":["../../../src/style/artifact.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAExD,MAAM,GAAG,GAAG,iBAAiB,CAAC;AAC9B,MAAM,IAAI,GAAG,sBAAsB,CAAC;AAEpC,MAAM,UAAU,gBAAgB,CAAC,QAA0B;IACzD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACjH,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAClG,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACtE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACrF,OAAO,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,MAAM,KAAK,GAAG,+EAA+E,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACnH,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,WAAW,EAAkB,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACpL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAA2B;IACrE,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC,CAAC;IAC3M,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,YAAY,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3E,IAAI,CAAC;YAAC,IAAI,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE;gBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,CAAC;QAAC,CAAC;QACxN,MAAM,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAC;QAAC,CAAC;IAC/H,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,uBAAuB,IAAI,EAAE,EAAE,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAC5I,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE;gBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,8BAA8B,IAAI,EAAE,EAAE,CAAC,CAAC;QACtL,CAAC;QAAC,MAAM,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,yBAAyB,IAAI,EAAE,EAAE,CAAC,CAAC;QAAC,CAAC;IACxH,CAAC;IACD,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC;AAChH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAA0B,EAAE,SAAS,GAAG,SAAS;IACjF,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,IAAI,CAAC;QAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;IAC3L,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;IAC/H,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC;AAChH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY,IAAY,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC"}

package/dist/src/style/cli-ui.d.ts

@@ -0,0 +1,41 @@
+/**
+ * High-end, lightweight CLI UI styling and ANSI utilities for psyclaw.
+ * Zero external runtime dependencies, fast and cross-platform.
+ */
+export declare const c: {
+    reset: string;
+    bold: (t: string) => string;
+    dim: (t: string) => string;
+    italic: (t: string) => string;
+    underline: (t: string) => string;
+    teal: (t: string) => string;
+    cyan: (t: string) => string;
+    blue: (t: string) => string;
+    green: (t: string) => string;
+    yellow: (t: string) => string;
+    red: (t: string) => string;
+    gray: (t: string) => string;
+    darkGray: (t: string) => string;
+    white: (t: string) => string;
+    bgTeal: (t: string) => string;
+    badge: (label: string, tone?: "teal" | "green" | "yellow" | "blue") => string;
+};
+/**
+ * Render the branded psyclaw CLI header banner.
+ */
+export declare function renderCliBanner(): string;
+/**
+ * Render structured, color-coded CLI usage documentation.
+ */
+export declare function formatCliUsage(): string;
+/**
+ * Render a styled info card box.
+ */
+export declare function renderCard(title: string, fields: Array<{
+    label: string;
+    value: string;
+}>): string;
+/**
+ * Render a styled success card for command results.
+ */
+export declare function renderSuccessCard(title: string, details?: Record<string, string>): string;

package/dist/src/style/cli-ui.js

@@ -0,0 +1,119 @@
+/**
+ * High-end, lightweight CLI UI styling and ANSI utilities for psyclaw.
+ * Zero external runtime dependencies, fast and cross-platform.
+ */
+import { PSYCLAW_VERSION } from "../branding.js";
+const isColorSupported = !process.env.NO_COLOR && (process.stdout.isTTY || process.env.FORCE_COLOR === "1");
+function wrap(code, text) {
+    return isColorSupported ? `${code}${text}\x1b[0m` : text;
+}
+export const c = {
+    reset: isColorSupported ? "\x1b[0m" : "",
+    bold: (t) => wrap("\x1b[1m", t),
+    dim: (t) => wrap("\x1b[2m", t),
+    italic: (t) => wrap("\x1b[3m", t),
+    underline: (t) => wrap("\x1b[4m", t),
+    // 24-bit Truecolor & ANSI colors
+    teal: (t) => wrap("\x1b[38;2;46;196;182m", t),
+    cyan: (t) => wrap("\x1b[38;2;56;189;248m", t),
+    blue: (t) => wrap("\x1b[38;2;99;102;241m", t),
+    green: (t) => wrap("\x1b[38;2;34;197;94m", t),
+    yellow: (t) => wrap("\x1b[38;2;245;158;11m", t),
+    red: (t) => wrap("\x1b[38;2;244;63;94m", t),
+    gray: (t) => wrap("\x1b[38;2;142;155;178m", t),
+    darkGray: (t) => wrap("\x1b[38;2;86;99;122m", t),
+    white: (t) => wrap("\x1b[38;2;240;244;252m", t),
+    bgTeal: (t) => wrap("\x1b[48;2;46;196;182;30m", t),
+    badge: (label, tone = "teal") => {
+        const tones = {
+            teal: "\x1b[38;2;5;20;27;48;2;46;196;182m",
+            green: "\x1b[38;2;5;20;10;48;2;34;197;94m",
+            yellow: "\x1b[38;2;30;20;5;48;2;245;158;11m",
+            blue: "\x1b[38;2;10;15;35;48;2;99;102;241m",
+        };
+        return isColorSupported ? `${tones[tone]} ${label} \x1b[0m` : `[${label}]`;
+    },
+};
+/**
+ * Render the branded psyclaw CLI header banner.
+ */
+export function renderCliBanner() {
+    const line = c.darkGray("─".repeat(58));
+    return [
+        "",
+        `  ${c.teal(c.bold("ψ PsyClaw"))} ${c.badge(`v${PSYCLAW_VERSION}`, "teal")} ${c.gray("· 社会科学科研智能体工作台")}`,
+        `  ${c.darkGray("Evidence-Grounded Social Science Research Agent")}`,
+        `  ${line}`,
+    ].join("\n");
+}
+/**
+ * Render structured, color-coded CLI usage documentation.
+ */
+export function formatCliUsage() {
+    const banner = renderCliBanner();
+    const sep = c.darkGray("│");
+    const cmd = (name, args, desc) => `  ${c.teal(name.padEnd(14))} ${c.gray(args.padEnd(30))} ${desc}`;
+    return [
+        banner,
+        "",
+        `  ${c.bold(c.white("使用方式 (Usage):"))}`,
+        `  ${c.cyan("$")} psyclaw ${c.gray("<command> [options...]")}`,
+        "",
+        `  ${c.bold(c.cyan("🚀 核心交互 (Interactive & Chat)"))}`,
+        cmd("psyclaw [chat]", "[pi args...]", c.white("启动交互研究智能体 (默认入口)")),
+        cmd("psyclaw wizard", "", c.white("首次使用提供商配置向导")),
+        cmd("psyclaw setup", "[--provider deepseek|...]", c.white("配置模型提供商与 API Key")),
+        "",
+        `  ${c.bold(c.cyan("🎯 课题生命周期 (Project Lifecycle)"))}`,
+        cmd("psyclaw init", "<goal> [--paradigm <id>]", c.white("创建社科研究课题项目")),
+        cmd("psyclaw hitl init", "", c.white("初始化人工裁决 (HITL) 检查点模板")),
+        cmd("psyclaw handoff", "", c.white("生成 HANDOFF 研究移交备忘录")),
+        "",
+        `  ${c.bold(c.cyan("🔬 科研工作流 (Research Workflows)"))}`,
+        cmd("psyclaw brief", "", c.white("生成离线证据简报 (Offline Brief)")),
+        "",
+        `  ${c.bold(c.cyan("📁 证据与沙盒 (Evidence & Ledger)"))}`,
+        cmd("psyclaw evidence add", "<path> [--level fulltext|...]", c.white("登记只读文献与证据文件指纹")),
+        "",
+        `  ${c.bold(c.cyan("📊 看板与 TUI (Observability & UI)"))}`,
+        cmd("psyclaw shell", "", c.white("启动终端 TUI 智能体管理界面")),
+        cmd("/panel (对话内)", "", c.white("在 psyclaw 对话中输入 /panel 打开科研工作台")),
+        "",
+        `  ${c.bold(c.cyan("🧩 生态与更新 (Ecosystem & Updates)"))}`,
+        cmd("psyclaw agents", "", c.white("扫描已安装的外部领域智能体")),
+        cmd("psyclaw install", "<agent-id> [--yes]", c.white("安装受信任扩展与技能")),
+        cmd("psyclaw import", "<agent-id> [--yes]", c.white("导入外部智能体技能")),
+        cmd("psyclaw check-updates", "", c.white("检查运行时与生态更新报告")),
+        cmd("psyclaw update", "[--yes] [--force]", c.white("升级底层 Pi 运行时")),
+        "",
+        `  ${c.darkGray("──────────────────────────────────────────────────────────")}`,
+        `  ${c.gray("文档与源码:")} ${c.cyan(c.underline("https://github.com/Exekiel179/psyclaw"))}`,
+        "",
+    ].join("\n");
+}
+/**
+ * Render a styled info card box.
+ */
+export function renderCard(title, fields) {
+    const width = 56;
+    const top = c.teal(`┌─ ${c.bold(title)} `.padEnd(width + 10, "─") + "┐");
+    const bottom = c.teal("└" + "─".repeat(width - 2) + "┘");
+    const rows = fields.map((f) => {
+        const line = `  ${c.gray(f.label.padEnd(12))} ${c.white(f.value)}`;
+        return c.teal("│") + line.padEnd(width - 2) + c.teal("│");
+    });
+    return ["", top, ...rows, bottom, ""].join("\n");
+}
+/**
+ * Render a styled success card for command results.
+ */
+export function renderSuccessCard(title, details) {
+    const lines = [`  ${c.green("✔")} ${c.bold(title)}`];
+    if (details) {
+        for (const [k, v] of Object.entries(details)) {
+            lines.push(`    ${c.darkGray("•")} ${c.gray(k + ":")} ${c.white(v)}`);
+        }
+    }
+    return lines.join("\n") + "\n";
+}
+//# sourceMappingURL=cli-ui.js.map

package/dist/src/style/cli-ui.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-ui.js","sourceRoot":"","sources":["../../../src/style/cli-ui.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD,MAAM,gBAAgB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC;AAE5G,SAAS,IAAI,CAAC,IAAY,EAAE,IAAY;IACtC,OAAO,gBAAgB,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,MAAM,CAAC,GAAG;IACf,KAAK,EAAE,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;IACxC,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACvC,GAAG,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACtC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACzC,SAAS,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAE5C,iCAAiC;IACjC,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,uBAAuB,EAAE,CAAC,CAAC;IACrD,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,uBAAuB,EAAE,CAAC,CAAC;IACrD,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,uBAAuB,EAAE,CAAC,CAAC;IACrD,KAAK,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;IACrD,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,uBAAuB,EAAE,CAAC,CAAC;IACvD,GAAG,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;IACnD,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC,CAAC;IACtD,QAAQ,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;IACxD,KAAK,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC,CAAC;IAEvD,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,0BAA0B,EAAE,CAAC,CAAC;IAC1D,KAAK,EAAE,CAAC,KAAa,EAAE,OAA6C,MAAM,EAAE,EAAE;QAC5E,MAAM,KAAK,GAAG;YACZ,IAAI,EAAE,oCAAoC;YAC1C,KAAK,EAAE,mCAAmC;YAC1C,MAAM,EAAE,oCAAoC;YAC5C,IAAI,EAAE,qCAAqC;SAC5C,CAAC;QACF,OAAO,gBAAgB,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC;IAC7E,CAAC;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACxC,OAAO;QACL,EAAE;QACF,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,eAAe,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE;QACxG,KAAK,CAAC,CAAC,QAAQ,CAAC,iDAAiD,CAAC,EAAE;QACpE,KAAK,IAAI,EAAE;KACZ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAE5B,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,IAAY,EAAE,EAAE,CACvD,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAEpE,OAAO;QACL,MAAM;QACN,EAAE;QACF,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,EAAE;QACvC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,EAAE;QAC9D,EAAE;QACF,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,EAAE;QACrD,GAAG,CAAC,gBAAgB,EAAE,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAClE,GAAG,CAAC,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACjD,GAAG,CAAC,eAAe,EAAE,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAC9E,EAAE;QACF,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,EAAE;QACtD,GAAG,CAAC,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACtE,GAAG,CAAC,mBAAmB,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC7D,GAAG,CAAC,iBAAiB,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACzD,EAAE;QACF,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,EAAE;QACtD,GAAG,CAAC,eAAe,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC7D,EAAE;QACF,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,EAAE;QACrD,GAAG,CAAC,sBAAsB,EAAE,+BAA+B,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACtF,EAAE;QACF,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,EAAE;QACxD,GAAG,CAAC,eAAe,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACrD,GAAG,CAAC,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAClE,EAAE;QACF,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC,EAAE;QACvD,GAAG,CAAC,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACnD,GAAG,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACnE,GAAG,CAAC,gBAAgB,EAAE,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACjE,GAAG,CAAC,uBAAuB,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACzD,GAAG,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAClE,EAAE;QACF,KAAK,CAAC,CAAC,QAAQ,CAAC,4DAA4D,CAAC,EAAE;QAC/E,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC,EAAE;QACvF,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,MAA+C;IACvF,MAAM,KAAK,GAAG,EAAE,CAAC;IACjB,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,EAAE,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;IAEzD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACnE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,OAAgC;IAC/E,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACrD,IAAI,OAAO,EAAE,CAAC;QACZ,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC"}

package/dist/src/style/contracts.d.ts

@@ -0,0 +1,34 @@
+export declare const STYLE_CONTRACT_VERSION: "psyclaw/style-contract/v1";
+export type ArtifactKind = "figure" | "table" | "manuscript";
+export interface JournalProfile {
+    id: string;
+    name: string;
+    source: string;
+    ref: string;
+    version: string;
+    license: string;
+    /** Profiles are descriptive until their rules have been independently verified. */
+    status?: "verified" | "unverified" | "degraded";
+    rules?: Readonly<Record<string, unknown>>;
+}
+export interface StyleCheckFinding {
+    rule: string;
+    severity: "block" | "warn";
+    message: string;
+}
+export interface StyleCheckResult {
+    schemaVersion: typeof STYLE_CONTRACT_VERSION;
+    ok: boolean;
+    findings: StyleCheckFinding[];
+}
+export interface ArtifactIdentity {
+    kind: ArtifactKind;
+    slug: string;
+    version: string;
+    extension: string;
+}
+export interface ReproducibilityCheck {
+    scriptPath?: string;
+    scriptSha256?: string;
+    inputHashes?: Readonly<Record<string, string>>;
+}

package/dist/src/style/contracts.js

@@ -0,0 +1,2 @@
+export const STYLE_CONTRACT_VERSION = "psyclaw/style-contract/v1";
+//# sourceMappingURL=contracts.js.map

package/dist/src/style/contracts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.js","sourceRoot":"","sources":["../../../src/style/contracts.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,sBAAsB,GAAG,2BAAoC,CAAC"}

package/dist/src/style/registry.d.ts

@@ -0,0 +1,16 @@
+import type { JournalProfile } from "./contracts.js";
+declare const SHA: RegExp;
+/** Descriptor-first registry. Registration never implies that a journal rule is trusted. */
+export declare class JournalProfileRegistry {
+    private readonly profiles;
+    private defaultId;
+    constructor(profiles?: readonly JournalProfile[], defaultId?: string);
+    register(profile: JournalProfile): JournalProfile;
+    get(id: string): JournalProfile | undefined;
+    list(): readonly JournalProfile[];
+    default(): JournalProfile;
+    setDefault(id: string): void;
+}
+export declare const DEFAULT_JOURNAL_PROFILE: JournalProfile;
+export declare function createDefaultJournalProfileRegistry(): JournalProfileRegistry;
+export { SHA };

package/dist/src/style/registry.js

@@ -0,0 +1,50 @@
+const ID = /^[a-z0-9][a-z0-9._-]{0,63}$/;
+const SHA = /^[a-f0-9]{64}$/i;
+function validate(profile) {
+    if (!ID.test(profile.id))
+        throw new Error("journal profile id must be a stable identifier");
+    for (const field of ["name", "source", "ref", "version", "license"]) {
+        if (!profile[field]?.trim())
+            throw new Error(`journal profile ${field} is required`);
+    }
+    if (profile.status === "verified" && profile.source.trim() === "")
+        throw new Error("verified profile requires a source");
+    return Object.freeze({ ...profile, status: profile.status ?? "unverified", rules: profile.rules ?? {} });
+}
+/** Descriptor-first registry. Registration never implies that a journal rule is trusted. */
+export class JournalProfileRegistry {
+    profiles = new Map();
+    defaultId;
+    constructor(profiles = [], defaultId) {
+        for (const profile of profiles)
+            this.register(profile);
+        this.defaultId = defaultId ?? profiles[0]?.id ?? "generic";
+        if (!this.profiles.has(this.defaultId)) {
+            this.register({ id: "generic", name: "Generic manuscript", source: "psyclaw", ref: "builtin", version: "v1", license: "MIT", status: "verified" });
+            this.defaultId = "generic";
+        }
+    }
+    register(profile) {
+        const normalized = validate(profile);
+        if (this.profiles.has(normalized.id))
+            throw new Error(`journal profile already registered: ${normalized.id}`);
+        this.profiles.set(normalized.id, normalized);
+        return normalized;
+    }
+    get(id) { return this.profiles.get(id); }
+    list() { return [...this.profiles.values()]; }
+    default() { return this.profiles.get(this.defaultId); }
+    setDefault(id) {
+        if (!this.profiles.has(id))
+            throw new Error(`journal profile not found: ${id}`);
+        this.defaultId = id;
+    }
+}
+export const DEFAULT_JOURNAL_PROFILE = Object.freeze({
+    id: "generic", name: "Generic manuscript", source: "psyclaw", ref: "builtin", version: "v1", license: "MIT", status: "verified", rules: {},
+});
+export function createDefaultJournalProfileRegistry() {
+    return new JournalProfileRegistry([DEFAULT_JOURNAL_PROFILE], "generic");
+}
+export { SHA };
+//# sourceMappingURL=registry.js.map

package/dist/src/style/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/style/registry.ts"],"names":[],"mappings":"AAEA,MAAM,EAAE,GAAG,6BAA6B,CAAC;AACzC,MAAM,GAAG,GAAG,iBAAiB,CAAC;AAE9B,SAAS,QAAQ,CAAC,OAAuB;IACvC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAC5F,KAAK,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAU,EAAE,CAAC;QAC7E,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,KAAK,cAAc,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACzH,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,YAAY,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC;AAC3G,CAAC;AAED,4FAA4F;AAC5F,MAAM,OAAO,sBAAsB;IAChB,QAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;IACtD,SAAS,CAAS;IAE1B,YAAY,WAAsC,EAAE,EAAE,SAAkB;QACtE,KAAK,MAAM,OAAO,IAAI,QAAQ;YAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,SAAS,GAAG,SAAS,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,SAAS,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YACnJ,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,OAAuB;QAC9B,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9G,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QAC7C,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,GAAG,CAAC,EAAU,IAAgC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,IAAI,KAAgC,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACzE,OAAO,KAAqB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAE,CAAC,CAAC,CAAC;IACxE,UAAU,CAAC,EAAU;QACnB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,EAAE,EAAE,CAAC,CAAC;QAChF,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC;IACtB,CAAC;CACF;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAmB,MAAM,CAAC,MAAM,CAAC;IACnE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE;CAC3I,CAAC,CAAC;AAEH,MAAM,UAAU,mCAAmC;IACjD,OAAO,IAAI,sBAAsB,CAAC,CAAC,uBAAuB,CAAC,EAAE,SAAS,CAAC,CAAC;AAC1E,CAAC;AAED,OAAO,EAAE,GAAG,EAAE,CAAC"}

package/dist/src/trust/manifest.d.ts

@@ -0,0 +1,42 @@
+import { Type, type Static } from "typebox";
+/**
+ * Versioned admission manifest. Unknown fields are rejected, and every field
+ * that matters for supply-chain trust (source ref, content hash, SPDX license,
+ * dependency pins, SBOM reference) is required or explicitly validated.
+ */
+export declare const ManifestSchema: Type.TObject<{
+    schemaVersion: Type.TLiteral<"psyclaw/manifest/v1">;
+    id: Type.TString;
+    version: Type.TString;
+    source: Type.TObject<{
+        kind: Type.TUnion<[Type.TLiteral<"git">, Type.TLiteral<"workspace">, Type.TLiteral<"file">]>;
+        ref: Type.TString;
+        url: Type.TOptional<Type.TString>;
+    }>;
+    contentSha256: Type.TString;
+    license: Type.TObject<{
+        spdx: Type.TString;
+        evidenceRef: Type.TOptional<Type.TString>;
+    }>;
+    dependencies: Type.TArray<Type.TObject<{
+        name: Type.TString;
+        version: Type.TString;
+        license: Type.TOptional<Type.TString>;
+        sha256: Type.TOptional<Type.TString>;
+    }>>;
+    sbom: Type.TOptional<Type.TObject<{
+        format: Type.TLiteral<"CycloneDX">;
+        specVersion: Type.TLiteral<"1.5">;
+        path: Type.TString;
+        sha256: Type.TString;
+    }>>;
+    capabilities: Type.TArray<Type.TString>;
+    trust: Type.TUnion<[Type.TLiteral<"discover-only">, Type.TLiteral<"approved">, Type.TLiteral<"blocked">]>;
+    contract: Type.TOptional<Type.TObject<{
+        inputSchema: Type.TOptional<Type.TString>;
+        outputSchema: Type.TOptional<Type.TString>;
+        fixtures: Type.TArray<Type.TString>;
+    }>>;
+}>;
+export type ManifestShape = Static<typeof ManifestSchema>;
+export declare function asManifest(value: unknown): ManifestShape;

package/dist/src/trust/manifest.js

@@ -0,0 +1,53 @@
+import { Type } from "typebox";
+import { Compile } from "typebox/compile";
+/**
+ * Versioned admission manifest. Unknown fields are rejected, and every field
+ * that matters for supply-chain trust (source ref, content hash, SPDX license,
+ * dependency pins, SBOM reference) is required or explicitly validated.
+ */
+export const ManifestSchema = Type.Object({
+    schemaVersion: Type.Literal("psyclaw/manifest/v1"),
+    id: Type.String({ minLength: 1 }),
+    version: Type.String({ minLength: 1 }),
+    source: Type.Object({
+        kind: Type.Union([Type.Literal("git"), Type.Literal("workspace"), Type.Literal("file")]),
+        ref: Type.String({ minLength: 1 }),
+        url: Type.Optional(Type.String({ minLength: 1 })),
+    }, { additionalProperties: false }),
+    contentSha256: Type.String({ pattern: "^[a-f0-9]{64}$" }),
+    license: Type.Object({
+        spdx: Type.String({ minLength: 1 }),
+        evidenceRef: Type.Optional(Type.String({ minLength: 1 })),
+    }, { additionalProperties: false }),
+    dependencies: Type.Array(Type.Object({
+        name: Type.String({ minLength: 1 }),
+        version: Type.String({ minLength: 1 }),
+        license: Type.Optional(Type.String({ minLength: 1 })),
+        sha256: Type.Optional(Type.String({ pattern: "^[a-f0-9]{64}$" })),
+    }, { additionalProperties: false })),
+    sbom: Type.Optional(Type.Object({
+        format: Type.Literal("CycloneDX"),
+        specVersion: Type.Literal("1.5"),
+        path: Type.String({ minLength: 1 }),
+        sha256: Type.String({ pattern: "^[a-f0-9]{64}$" }),
+    }, { additionalProperties: false })),
+    capabilities: Type.Array(Type.String({ minLength: 1 })),
+    trust: Type.Union([Type.Literal("discover-only"), Type.Literal("approved"), Type.Literal("blocked")]),
+    contract: Type.Optional(Type.Object({
+        inputSchema: Type.Optional(Type.String({ minLength: 1 })),
+        outputSchema: Type.Optional(Type.String({ minLength: 1 })),
+        fixtures: Type.Array(Type.String({ minLength: 1 })),
+    }, { additionalProperties: false })),
+}, { additionalProperties: false });
+const compiled = Compile(ManifestSchema);
+export function asManifest(value) {
+    if (!compiled.Check(value)) {
+        const errors = [...compiled.Errors(value)].map((error) => {
+            const path = "path" in error && typeof error.path === "string" ? error.path : "/";
+            return `${path}: ${error.message}`;
+        });
+        throw new Error(`manifest schema invalid: ${errors.join("; ")}`);
+    }
+    return value;
+}
+//# sourceMappingURL=manifest.js.map

package/dist/src/trust/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../../src/trust/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAe,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE1C;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC;IACxC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC;IAClD,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACjC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACtC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;QAClB,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACxF,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QAClC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;KAClD,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;IACnC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IACzD,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QACnC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;KAC1D,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;IACnC,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;QACnC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;QACrD,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;KAClE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,CAAC;IACpC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;QAC9B,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;QACjC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QAChC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QACnC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;KACnD,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,CAAC;IACpC,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;IACvD,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IACrG,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;QAClC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;QACzD,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;QAC1D,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;KACpD,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,CAAC;CACrC,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,CAAC;AAIpC,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;AAEzC,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACvD,MAAM,IAAI,GAAG,MAAM,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;YAClF,OAAO,GAAG,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;QACrC,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,KAAK,CAAC,4BAA4B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,KAAsB,CAAC;AAChC,CAAC"}

package/dist/src/trust/sbom.d.ts

@@ -0,0 +1,54 @@
+export interface SbomComponent {
+    type: "library";
+    name: string;
+    version: string;
+    purl?: string;
+}
+export interface CycloneDxBom {
+    bomFormat: "CycloneDX";
+    specVersion: "1.5";
+    serialNumber: string;
+    version: 1;
+    metadata: {
+        timestamp: string;
+        component: {
+            type: "application";
+            name: string;
+            version: string;
+        };
+    };
+    components: SbomComponent[];
+}
+export interface SbomOptions {
+    name: string;
+    version: string;
+    components: {
+        name: string;
+        version: string;
+    }[];
+    now?: () => string;
+}
+/** Build a minimal, parseable CycloneDX 1.5 JSON SBOM from a component list. */
+export declare function buildSbom(options: SbomOptions): CycloneDxBom;
+/** Stable digest over the sorted component identity list. */
+export declare function sbomSummaryHash(bom: CycloneDxBom): string;
+/** Extract the locked `name@version` entries from a pnpm lockfile. */
+export declare function loadLockedPackages(root: string): Promise<{
+    name: string;
+    version: string;
+}[]>;
+export interface LicenseAudit {
+    total: number;
+    declared: number;
+    unknown: number;
+    summaryHash: string;
+}
+/**
+ * Best-effort license audit over installed packages. A package whose
+ * `package.json` is unreadable or whose `license` is not a non-empty string is
+ * counted as `unknown`, never silently upgraded.
+ */
+export declare function auditLicenses(root: string, components: readonly {
+    name: string;
+    version: string;
+}[]): Promise<LicenseAudit>;

package/dist/src/trust/sbom.js

@@ -0,0 +1,77 @@
+import { createHash, randomUUID } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { parse as parseYaml } from "yaml";
+/** Build a minimal, parseable CycloneDX 1.5 JSON SBOM from a component list. */
+export function buildSbom(options) {
+    const components = options.components
+        .map(({ name, version }) => ({
+        type: "library",
+        name,
+        version,
+        purl: `pkg:npm/${name}@${version}`,
+    }))
+        .sort((left, right) => left.name.localeCompare(right.name) || left.version.localeCompare(right.version));
+    return {
+        bomFormat: "CycloneDX",
+        specVersion: "1.5",
+        serialNumber: `urn:uuid:${randomUUID()}`,
+        version: 1,
+        metadata: {
+            timestamp: (options.now ?? (() => new Date().toISOString()))(),
+            component: { type: "application", name: options.name, version: options.version },
+        },
+        components,
+    };
+}
+/** Stable digest over the sorted component identity list. */
+export function sbomSummaryHash(bom) {
+    const canonical = JSON.stringify(bom.components.map((component) => [component.name, component.version]));
+    return createHash("sha256").update(canonical, "utf8").digest("hex");
+}
+/** Extract the locked `name@version` entries from a pnpm lockfile. */
+export async function loadLockedPackages(root) {
+    const lockText = await readFile(join(root, "pnpm-lock.yaml"), "utf8");
+    const lock = parseYaml(lockText);
+    const packages = lock.packages ?? {};
+    const result = [];
+    for (const key of Object.keys(packages)) {
+        const at = key.lastIndexOf("@");
+        if (at <= 0)
+            continue;
+        const name = key.slice(0, at);
+        const version = key.slice(at + 1).split("(")[0] ?? "";
+        if (name.length === 0 || version.length === 0)
+            continue;
+        result.push({ name, version });
+    }
+    return result.sort((left, right) => `${left.name}@${left.version}`.localeCompare(`${right.name}@${right.version}`));
+}
+/**
+ * Best-effort license audit over installed packages. A package whose
+ * `package.json` is unreadable or whose `license` is not a non-empty string is
+ * counted as `unknown`, never silently upgraded.
+ */
+export async function auditLicenses(root, components) {
+    let declared = 0;
+    let unknown = 0;
+    for (const component of components) {
+        try {
+            const text = await readFile(join(root, "node_modules", component.name, "package.json"), "utf8");
+            const manifest = JSON.parse(text);
+            if (typeof manifest.license === "string" && manifest.license.trim().length > 0)
+                declared += 1;
+            else
+                unknown += 1;
+        }
+        catch {
+            unknown += 1;
+        }
+    }
+    const total = components.length;
+    const summaryHash = createHash("sha256")
+        .update(`${total}:${declared}:${unknown}`)
+        .digest("hex");
+    return { total, declared, unknown, summaryHash };
+}
+//# sourceMappingURL=sbom.js.map

package/dist/src/trust/sbom.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sbom.js","sourceRoot":"","sources":["../../../src/trust/sbom.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AA4B1C,gFAAgF;AAChF,MAAM,UAAU,SAAS,CAAC,OAAoB;IAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU;SAClC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3B,IAAI,EAAE,SAAkB;QACxB,IAAI;QACJ,OAAO;QACP,IAAI,EAAE,WAAW,IAAI,IAAI,OAAO,EAAE;KACnC,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3G,OAAO;QACL,SAAS,EAAE,WAAW;QACtB,WAAW,EAAE,KAAK;QAClB,YAAY,EAAE,YAAY,UAAU,EAAE,EAAE;QACxC,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE;YACR,SAAS,EAAE,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE;YAC9D,SAAS,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE;SACjF;QACD,UAAU;KACX,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,eAAe,CAAC,GAAiB;IAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACzG,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACtE,CAAC;AAMD,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAY;IACnD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAkB,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IACrC,MAAM,MAAM,GAAwC,EAAE,CAAC;IACvD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,EAAE,IAAI,CAAC;YAAE,SAAS;QACtB,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACxD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AACtH,CAAC;AASD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAY,EACZ,UAAwD;IAExD,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,SAAS,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;YAChG,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA0B,CAAC;YAC3D,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;gBAAE,QAAQ,IAAI,CAAC,CAAC;;gBACzF,OAAO,IAAI,CAAC,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,CAAC;QACf,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC;IAChC,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC;SACrC,MAAM,CAAC,GAAG,KAAK,IAAI,QAAQ,IAAI,OAAO,EAAE,CAAC;SACzC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AACnD,CAAC"}

package/dist/src/tui/app.d.ts

@@ -0,0 +1,3 @@
+export declare function runTui(root: string, options?: {
+    homeDir?: string;
+}): void;