redlinegate 0.0.1

package/dist/platforms/pull-request-templates.js

@@ -0,0 +1,157 @@
+import { readdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { isRedlineError } from "../core/errors.js";
+import { findBlock } from "../render/markers.js";
+// What `redline verify` needs to see about a pull request template, and the
+// only place outside the install adapters that resolves one.
+//
+// CONTRACT with cli/platforms/github/install.ts and
+// cli/platforms/azure/install.ts: the candidate folders, the served filenames
+// and the branch-template layout below must stay the same as the ones those
+// two resolve when they write. A verify that looked at a different file than
+// init writes to would report on a template the host never serves. The two
+// adapters keep their own private copies for the write side; when one changes,
+// change this with it.
+const TEMPLATE_NAMES = {
+    // GitHub documents only `pull_request_template.md`.
+    github: ['pull_request_template.md'],
+    // Azure DevOps documents both extensions, case-insensitively.
+    azure: ['pull_request_template.md', 'pull_request_template.txt'],
+};
+// Exported for cli/platforms/github/install.ts and cli/platforms/azure/
+// install.ts: the folder order is the one thing that must never disagree
+// between what `redline init` writes and what `redline verify` reads back —
+// three private copies of the same order used to exist here, and a copy left
+// behind by an edit to the other two would report a template `init` does not
+// write. The per-host discovery and merge logic stays private to each
+// adapter; only this order is shared.
+export const TEMPLATE_DIRS = {
+    github: ['.github', '', 'docs'],
+    azure: ['.azuredevops', '.vsts', 'docs', ''],
+};
+// Azure serves a branch-specific template in preference to the default, so one
+// added after onboarding replaces everything `redline init` merged. GitHub's
+// `PULL_REQUEST_TEMPLATE/` directory is the opt-in kind, reachable only through
+// a `?template=` link, and is deliberately not observed here.
+const BRANCH_TEMPLATES = { github: false, azure: true };
+const BRANCH_TEMPLATE_EXTENSIONS = ['.md', '.txt'];
+const MAX_BRANCH_DEPTH = 10;
+// CONTRACT with workflows/redline-gate.yml: the `checklist` job fails a pull
+// request whose body has no `## Launch readiness` heading (matched by prefix,
+// so `## Launch readiness checklist` satisfies it), and the `adr` job fails a
+// large diff whose body carries no `docs/adr/` link. A template that answers
+// both is one no pull request can be failed by, whoever wrote it.
+const GATED_SECTIONS = [
+    { heading: '## Launch readiness', satisfied: (body) => /^##[ \t]+Launch readiness/m.test(body) },
+    { heading: '## Architecture decision', satisfied: (body) => body.includes('docs/adr/') },
+];
+// Listed rather than probed with existsSync: both hosts treat these folder
+// names as case-insensitive, and existsSync is case-insensitive on macOS but
+// not on Linux. isDirectory() is also what stops a plain file named `docs`
+// from throwing ENOTDIR.
+function candidateDirs(cwd, dirs) {
+    const entries = readdirSync(cwd, { withFileTypes: true });
+    const found = [];
+    for (const wanted of dirs) {
+        if (wanted === '') {
+            found.push({ abs: cwd, rel: '' });
+            continue;
+        }
+        const dir = entries.find((entry) => entry.isDirectory() && entry.name.toLowerCase() === wanted);
+        if (dir)
+            found.push({ abs: join(cwd, dir.name), rel: dir.name });
+    }
+    return found;
+}
+const under = (candidate, name) => candidate.rel === '' ? name : `${candidate.rel}/${name}`;
+function findDefaultTemplate(cwd, host) {
+    const names = TEMPLATE_NAMES[host];
+    for (const candidate of candidateDirs(cwd, TEMPLATE_DIRS[host])) {
+        const hits = readdirSync(candidate.abs, { withFileTypes: true })
+            .filter((entry) => entry.isFile() && names.includes(entry.name.toLowerCase()))
+            .map((entry) => entry.name);
+        hits.sort((a, b) => {
+            const byName = names.indexOf(a.toLowerCase()) - names.indexOf(b.toLowerCase());
+            if (byName !== 0)
+                return byName;
+            if (a === b.toLowerCase())
+                return -1;
+            if (b === a.toLowerCase())
+                return 1;
+            return a < b ? -1 : 1;
+        });
+        const hit = hits[0];
+        if (hit !== undefined)
+            return under(candidate, hit);
+    }
+    return null;
+}
+function childDir(abs, name) {
+    const entry = readdirSync(abs, { withFileTypes: true }).find((candidate) => candidate.isDirectory() && candidate.name.toLowerCase() === name);
+    return entry ? join(abs, entry.name) : null;
+}
+function collectBranchTemplates(abs, rel, depth, into) {
+    if (depth > MAX_BRANCH_DEPTH)
+        return;
+    for (const entry of readdirSync(abs, { withFileTypes: true })) {
+        const childRel = `${rel}/${entry.name}`;
+        if (entry.isDirectory())
+            collectBranchTemplates(join(abs, entry.name), childRel, depth + 1, into);
+        else if (entry.isFile() &&
+            BRANCH_TEMPLATE_EXTENSIONS.some((ext) => entry.name.toLowerCase().endsWith(ext))) {
+            into.push(childRel);
+        }
+    }
+}
+function findBranchTemplates(cwd, host) {
+    if (!BRANCH_TEMPLATES[host])
+        return [];
+    const found = [];
+    for (const candidate of candidateDirs(cwd, TEMPLATE_DIRS[host])) {
+        const folder = childDir(candidate.abs, 'pull_request_template');
+        const branches = folder === null ? null : childDir(folder, 'branches');
+        if (branches === null)
+            continue;
+        collectBranchTemplates(branches, under(candidate, 'pull_request_template/branches'), 1, found);
+    }
+    return found.sort();
+}
+function classify(cwd, relPath, branch) {
+    const body = readFileSync(join(cwd, relPath), 'utf8');
+    try {
+        if (findBlock(body, relPath) !== null)
+            return { path: relPath, branch, state: 'managed', missing: [] };
+    }
+    catch (error) {
+        // findBlock refuses a half-edited pair with RedlineError('failed'). That
+        // is a finding about this repository, not a reason for `verify` to abort
+        // before it has reported anything else.
+        if (!isRedlineError(error))
+            throw error;
+        return { path: relPath, branch, state: 'mangled', missing: [] };
+    }
+    const missing = GATED_SECTIONS.filter((section) => !section.satisfied(body)).map((s) => s.heading);
+    return {
+        path: relPath,
+        branch,
+        state: missing.length === 0 ? 'satisfied' : 'incomplete',
+        missing,
+    };
+}
+/**
+ * Every pull request template this host would actually serve, in the order it
+ * resolves them: the default first, then Azure's branch-specific ones. Empty
+ * when the host would serve none — for an onboarded repository that means the
+ * template `redline init` wrote is gone.
+ */
+export function observePullRequestTemplates(host, cwd) {
+    const observed = [];
+    const defaultPath = findDefaultTemplate(cwd, host);
+    if (defaultPath !== null)
+        observed.push(classify(cwd, defaultPath, false));
+    for (const branchPath of findBranchTemplates(cwd, host)) {
+        observed.push(classify(cwd, branchPath, true));
+    }
+    return observed;
+}
+//# sourceMappingURL=pull-request-templates.js.map

package/dist/platforms/pull-request-templates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pull-request-templates.js","sourceRoot":"","sources":["../../cli/platforms/pull-request-templates.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAGjD,4EAA4E;AAC5E,6DAA6D;AAC7D,EAAE;AACF,oDAAoD;AACpD,8EAA8E;AAC9E,4EAA4E;AAC5E,6EAA6E;AAC7E,2EAA2E;AAC3E,+EAA+E;AAC/E,uBAAuB;AACvB,MAAM,cAAc,GAA2B;IAC7C,oDAAoD;IACpD,MAAM,EAAE,CAAC,0BAA0B,CAAC;IACpC,8DAA8D;IAC9D,KAAK,EAAE,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;CACjE,CAAC;AAEF,wEAAwE;AACxE,yEAAyE;AACzE,4EAA4E;AAC5E,6EAA6E;AAC7E,6EAA6E;AAC7E,sEAAsE;AACtE,sCAAsC;AACtC,MAAM,CAAC,MAAM,aAAa,GAA2B;IACnD,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,EAAE,MAAM,CAAC;IAC/B,KAAK,EAAE,CAAC,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC;CAC7C,CAAC;AAEF,+EAA+E;AAC/E,6EAA6E;AAC7E,gFAAgF;AAChF,8DAA8D;AAC9D,MAAM,gBAAgB,GAA0B,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC/E,MAAM,0BAA0B,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AACnD,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAE5B,6EAA6E;AAC7E,8EAA8E;AAC9E,8EAA8E;AAC9E,6EAA6E;AAC7E,kEAAkE;AAClE,MAAM,cAAc,GAAG;IACrB,EAAE,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAAE,CAAC,IAAY,EAAW,EAAE,CAAC,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;IACjH,EAAE,OAAO,EAAE,0BAA0B,EAAE,SAAS,EAAE,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE;CAC1G,CAAC;AAqCF,2EAA2E;AAC3E,6EAA6E;AAC7E,2EAA2E;AAC3E,yBAAyB;AACzB,SAAS,aAAa,CAAC,GAAW,EAAE,IAAc;IAChD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;QAC1B,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;YAClC,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;QAChG,IAAI,GAAG;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,SAAoB,EAAE,IAAY,EAAU,EAAE,CAC3D,SAAS,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;AAE3D,SAAS,mBAAmB,CAAC,GAAW,EAAE,IAAU;IAClD,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACnC,KAAK,MAAM,SAAS,IAAI,aAAa,CAAC,GAAG,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;aAC7D,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;aAC7E,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACjB,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YAC/E,IAAI,MAAM,KAAK,CAAC;gBAAE,OAAO,MAAM,CAAC;YAChC,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;gBAAE,OAAO,CAAC,CAAC,CAAC;YACrC,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;gBAAE,OAAO,CAAC,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW,EAAE,IAAY;IACzC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAC1D,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,CAChF,CAAC;IACF,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAW,EAAE,GAAW,EAAE,KAAa,EAAE,IAAc;IACrF,IAAI,KAAK,GAAG,gBAAgB;QAAE,OAAO;IACrC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,MAAM,QAAQ,GAAG,GAAG,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,KAAK,CAAC,WAAW,EAAE;YAAE,sBAAsB,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;aAC7F,IACH,KAAK,CAAC,MAAM,EAAE;YACd,0BAA0B,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAChF,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW,EAAE,IAAU;IAClD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,SAAS,IAAI,aAAa,CAAC,GAAG,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAChE,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACvE,IAAI,QAAQ,KAAK,IAAI;YAAE,SAAS;QAChC,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,gCAAgC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW,EAAE,OAAe,EAAE,MAAe;IAC7D,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IACtD,IAAI,CAAC;QACH,IAAI,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACzG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yEAAyE;QACzE,yEAAyE;QACzE,wCAAwC;QACxC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QACxC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACnG,OAAO;QACL,IAAI,EAAE,OAAO;QACb,MAAM;QACN,KAAK,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY;QACxD,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAU,EAAE,GAAW;IACjE,MAAM,QAAQ,GAA0B,EAAE,CAAC;IAC3C,MAAM,WAAW,GAAG,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACnD,IAAI,WAAW,KAAK,IAAI;QAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;IAC3E,KAAK,MAAM,UAAU,IAAI,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;QACxD,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/platforms/remote.js

@@ -0,0 +1,21 @@
+import { RedlineError } from "../core/errors.js";
+import { parseConfig } from "../config/redline-json.js";
+// Shared by both hosts: the file is external input from a repository this
+// process does not control, so a malformed one is a reported failure naming the
+// repository, never a crash that costs a whole estate walk.
+export function parseRemoteConfig(raw, where) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (error) {
+        throw new RedlineError('failed', `${where}: .redline.json is not valid JSON (${error instanceof Error ? error.message : String(error)})`);
+    }
+    try {
+        return parseConfig(parsed);
+    }
+    catch (error) {
+        throw new RedlineError('failed', `${where}: .redline.json is invalid — ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+//# sourceMappingURL=remote.js.map

package/dist/platforms/remote.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote.js","sourceRoot":"","sources":["../../cli/platforms/remote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAsB,MAAM,2BAA2B,CAAC;AAuB5E,0EAA0E;AAC1E,gFAAgF;AAChF,4DAA4D;AAC5D,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,KAAa;IAC1D,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,YAAY,CACpB,QAAQ,EACR,GAAG,KAAK,sCAAsC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CACxG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,YAAY,CACpB,QAAQ,EACR,GAAG,KAAK,gCAAgC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACjG,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/platforms/resolve.js

@@ -0,0 +1,69 @@
+import { createGit } from "../core/git.js";
+import { RedlineError } from "../core/errors.js";
+import { parseRemote } from "./detect.js";
+import { createGitHubClient } from "./github/client.js";
+import { createGitHubPlatform } from "./github/index.js";
+import { createAzureClient } from "./azure/client.js";
+import { createAzurePlatform } from "./azure/index.js";
+// One construction per process, success or failure. Memoising the failure
+// matters as much as memoising the success: `createGitHubClient()` shells out
+// to `gh auth token`, so a client that failed to build would otherwise
+// re-spawn it on every single request.
+function once(make) {
+    let result = null;
+    return () => {
+        if (result === null) {
+            try {
+                result = { ok: true, value: make() };
+            }
+            catch (error) {
+                result = { ok: false, error };
+            }
+        }
+        if (!result.ok)
+            throw result.error;
+        return result.value;
+    };
+}
+// Deliberately written out per client rather than proxied: `rest`/`request` are
+// generic, and a generic proxy cannot forward a type parameter without an
+// escape hatch.
+function lazyGitHubClient(make) {
+    const client = once(make);
+    return {
+        rest(method, path, body) {
+            return client().rest(method, path, body);
+        },
+        graphql(query, variables) {
+            return client().graphql(query, variables);
+        },
+    };
+}
+function lazyAzureClient(make) {
+    const client = once(make);
+    return {
+        request(method, path, body, opts) {
+            return client().request(method, path, body, opts);
+        },
+    };
+}
+// The one place that turns a working tree into a Platform. Every command
+// resolves a platform through this function — no command constructs a
+// GitHubClient/AzureClient or a *Platform directly.
+export async function resolvePlatform(cwd, deps = {}) {
+    const gitFor = deps.gitFor ?? ((dir) => createGit(dir));
+    const git = gitFor(cwd);
+    if (!git.isRepo()) {
+        throw new RedlineError('usage', `${cwd} is not a git repository`, 'run redline from inside your repo');
+    }
+    const identity = parseRemote(git.remoteUrl());
+    const lazy = deps.lazyCredentials === true;
+    if (identity.host === 'github') {
+        const make = deps.makeGitHubClient ?? (() => createGitHubClient());
+        return createGitHubPlatform({ client: lazy ? lazyGitHubClient(make) : make(), gitFor });
+    }
+    const makeAzure = deps.makeAzureClient ?? ((org) => createAzureClient(org));
+    const make = () => makeAzure(identity.org);
+    return createAzurePlatform({ client: lazy ? lazyAzureClient(make) : make(), gitFor });
+}
+//# sourceMappingURL=resolve.js.map

package/dist/platforms/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../cli/platforms/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAY,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAqB,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAA8C,MAAM,mBAAmB,CAAC;AAClG,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AA2BvD,0EAA0E;AAC1E,8EAA8E;AAC9E,uEAAuE;AACvE,uCAAuC;AACvC,SAAS,IAAI,CAAI,IAAa;IAC5B,IAAI,MAAM,GAAkE,IAAI,CAAC;IACjF,OAAO,GAAM,EAAE;QACb,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;YACvC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;YAChC,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,MAAM,CAAC,KAAK,CAAC;QACnC,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,0EAA0E;AAC1E,gBAAgB;AAChB,SAAS,gBAAgB,CAAC,IAAwB;IAChD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,OAAO;QACL,IAAI,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;YAClD,OAAO,MAAM,EAAE,CAAC,IAAI,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,CAAI,KAAa,EAAE,SAAkC;YAC1D,OAAO,MAAM,EAAE,CAAC,OAAO,CAAI,KAAK,EAAE,SAAS,CAAC,CAAC;QAC/C,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAuB;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,OAAO;QACL,OAAO,CACL,MAAc,EACd,IAAY,EACZ,IAAc,EACd,IAA0B;YAE1B,OAAO,MAAM,EAAE,CAAC,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACvD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,sEAAsE;AACtE,oDAAoD;AACpD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,OAAoB,EAAE;IACvE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACxB,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,YAAY,CAAC,OAAO,EAAE,GAAG,GAAG,0BAA0B,EAAE,mCAAmC,CAAC,CAAC;IACzG,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC;IAC3C,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,IAAI,CAAC,GAAiB,EAAE,CAAC,kBAAkB,EAAE,CAAC,CAAC;QACjF,OAAO,oBAAoB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC,GAAW,EAAe,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;IACjG,MAAM,IAAI,GAAG,GAAgB,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACxD,OAAO,mBAAmB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AACxF,CAAC"}

package/dist/platforms/shape.js

@@ -0,0 +1,19 @@
+import { RedlineError } from "../core/errors.js";
+// Host response bodies are untrusted external input: the transport
+// (http.ts) only guarantees valid JSON, never a particular shape. Every
+// body is typed `unknown` and narrowed by an explicit parse function, in
+// the house style of cli/render/manifest.ts — never a bare `as` onto a
+// concrete host type. A host error body is a truthy object (e.g.
+// `{ message: "Forbidden" }`), not an array, so `isNonNullObject` rejects
+// arrays too — a host-supplied array must never be mistaken for the keyed
+// object callers go on to index.
+export function isNonNullObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+export function isSuccess(status) {
+    return status >= 200 && status < 300;
+}
+export function createHostShapeError(host) {
+    return (what) => new RedlineError('host', `${host} returned an unexpected shape for ${what}`);
+}
+//# sourceMappingURL=shape.js.map

package/dist/platforms/shape.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shape.js","sourceRoot":"","sources":["../../cli/platforms/shape.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,mEAAmE;AACnE,wEAAwE;AACxE,yEAAyE;AACzE,uEAAuE;AACvE,iEAAiE;AACjE,0EAA0E;AAC1E,0EAA0E;AAC1E,iCAAiC;AACjC,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,OAAO,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,YAAY,CAAC,MAAM,EAAE,GAAG,IAAI,qCAAqC,IAAI,EAAE,CAAC,CAAC;AACxG,CAAC"}

package/dist/platforms/types.js

@@ -0,0 +1,24 @@
+export const HOSTS = ['github', 'azure'];
+export const ADMIN_CAPABILITIES = [
+    'secret-scanning',
+    'push-protection',
+    'dependency-alerts',
+    'merge-policy',
+    'repo-property',
+    'labels',
+    'review-ownership',
+    // The machinery that runs the merge gate on the host. GitHub needs none (a
+    // workflow file's pr trigger fires natively); Azure Repos ignores YAML
+    // `pr:` triggers, so there it is a registered pipeline definition plus a
+    // Build Validation branch policy.
+    'gate',
+];
+// Exactly `denied`. `unknown` must behave like `unsupported` here: neither
+// ever reaches pendingAdmin, because an indeterminate read has told nobody
+// anything they can act on. Nothing clears an entry already recorded there
+// either — no read revises pendingAdmin in either direction, so only
+// `redline init --repair` retries the write that recorded it.
+export function isPending(outcome) {
+    return outcome.status === 'denied';
+}
+//# sourceMappingURL=types.js.map

package/dist/platforms/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../cli/platforms/types.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAU,CAAC;AAGlD,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,iBAAiB;IACjB,iBAAiB;IACjB,mBAAmB;IACnB,cAAc;IACd,eAAe;IACf,QAAQ;IACR,kBAAkB;IAClB,2EAA2E;IAC3E,uEAAuE;IACvE,yEAAyE;IACzE,kCAAkC;IAClC,MAAM;CACE,CAAC;AA4BX,2EAA2E;AAC3E,2EAA2E;AAC3E,2EAA2E;AAC3E,qEAAqE;AACrE,8DAA8D;AAC9D,MAAM,UAAU,SAAS,CAAC,OAA0B;IAClD,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC;AACrC,CAAC"}

package/dist/policy/checks.js

@@ -0,0 +1,91 @@
+// A ticket reference: ABC-123, #123, or a URL to an issue tracker. Deliberately
+// broad — the rule asks for a reference, not for a particular tracker, and a
+// narrow pattern would fail a team whose tickets do not look like ours.
+const TICKET = /([A-Z][A-Z0-9]+-\d+|#\d+|https?:\/\/\S*(issue|ticket|jira|linear|browse)\S*)/i;
+const JS_LIKE = /\.(js|jsx|mjs|cjs|ts|tsx|mts|cts)$/;
+const finding = (line, ruleId, severity, problem) => ({ ruleId, severity, file: line.file, line: line.line, problem });
+// `core/untracked-todo` — a TODO or FIXME with no ticket reference.
+//
+// Decidable in full: the rule asks whether a reference is present on the line,
+// which is a fact about the text. The model is not asked about it at all.
+const untrackedTodo = ({ added }) => added
+    .filter((l) => /\b(TODO|FIXME|HACK|XXX)\b/.test(l.text) && !TICKET.test(l.text))
+    .map((l) => finding(l, 'core/untracked-todo', 'HIGH', 'this TODO carries no ticket reference, so nothing will bring anyone back to it. ' +
+    'Add the ticket id on the same line, or do the work now.'));
+// `core/type-checker-suppression` — a suppression with no comment AND no ticket.
+//
+// The rule requires both. A suppression with an explanation but no ticket is
+// still a violation, and this decides that without a model: the presence of a
+// ticket reference on the line is a fact.
+const SUPPRESSIONS = [
+    '@ts-ignore',
+    '@ts-expect-error',
+    '# type: ignore',
+    '@SuppressWarnings',
+    'eslint-disable',
+    '// nolint',
+    '# noqa',
+];
+const typeCheckerSuppression = ({ added }) => added
+    .filter((l) => SUPPRESSIONS.some((s) => l.text.includes(s)) && !TICKET.test(l.text))
+    .map((l) => finding(l, 'core/type-checker-suppression', 'BLOCKER', 'a type-checker suppression needs an inline explanation AND a ticket reference on the ' +
+    'same line. Without one, nobody knows what it hides or when it can go.'));
+// `javascript/var-in-new-code` — `var` on a line this change added.
+//
+// Added lines only. Flagging `var` in a legacy file the author merely moved is
+// exactly the noise the standard's "what NOT to flag" section forbids.
+// A line whose content begins a comment. Not a parser — a checker that reported
+// "use const" on the sentence "avoid var declarations here" is worse than one
+// that misses a `var` on the same line as a trailing comment, and this is the
+// cheap way to avoid the embarrassing half.
+const COMMENT_LINE = /^\s*(\/\/|\/\*|\*|#)/;
+const varInNewCode = ({ added }) => added
+    .filter((l) => JS_LIKE.test(l.file) &&
+    !COMMENT_LINE.test(l.text) &&
+    /(^|[^.\w])var\s+[A-Za-z_$]/.test(l.text))
+    .map((l) => finding(l, 'javascript/var-in-new-code', 'HIGH', '`var` is function-scoped and hoisted. Use `const`, or `let` where the binding is reassigned.'));
+// `javascript/unsafe-numeric-coercion` — `parseInt` with no radix.
+//
+// Only the radix half. The rest of the rule ("Number() coercion of user input
+// without Number.isFinite") needs to know what is user input, which is judgement,
+// and the model still sees the whole rule.
+// Nested parentheses in the argument — `parseInt(String(x), 10)` — hid the comma
+// from a `[^,)]*` scan, so a correctly-written call was reported as missing its
+// radix. This checker flagged its own source, which is the clearest possible
+// signal that the pattern was wrong.
+const PARSE_INT_NO_RADIX = /\bparseInt\s*\((?:[^(),]|\([^()]*\))*\)/;
+const parseIntWithoutRadix = ({ added }) => added
+    .filter((l) => JS_LIKE.test(l.file) && PARSE_INT_NO_RADIX.test(l.text))
+    .map((l) => finding(l, 'javascript/unsafe-numeric-coercion', 'HIGH', '`parseInt` without a radix. Pass 10 explicitly: an input like "08" or "0x10" is otherwise ' +
+    'parsed by a rule most readers do not have in mind.'));
+// `core/hardcoded-secrets` — deliberately NOT here. A regex over added lines is
+// how a secret scanner earns a reputation for false positives, and the gate
+// already runs a real one against verified secrets only. The model keeps the rule
+// for the cases a scanner misses, like a credential in a comment.
+export const CHECKS = {
+    'core/untracked-todo': untrackedTodo,
+    'core/type-checker-suppression': typeCheckerSuppression,
+    'javascript/var-in-new-code': varInNewCode,
+    'javascript/unsafe-numeric-coercion': parseIntWithoutRadix,
+};
+export function runChecks(ctx, only) {
+    const ids = only ?? Object.keys(CHECKS);
+    const findings = [];
+    const evaluated = [];
+    for (const id of ids) {
+        const check = CHECKS[id];
+        if (!check)
+            continue;
+        evaluated.push(id);
+        findings.push(...check(ctx));
+    }
+    // Stable order: a gate whose output reorders between runs on the same diff
+    // makes every re-run look like a change.
+    findings.sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line || a.ruleId.localeCompare(b.ruleId));
+    return { findings, evaluated };
+}
+/** The output contract, rendered by code — never free-typed. */
+export function formatFinding(finding) {
+    return `Redline/${finding.severity} [${finding.ruleId}]: ${finding.problem}`;
+}
+//# sourceMappingURL=checks.js.map

package/dist/policy/checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checks.js","sourceRoot":"","sources":["../../cli/policy/checks.ts"],"names":[],"mappings":"AAwCA,gFAAgF;AAChF,6EAA6E;AAC7E,wEAAwE;AACxE,MAAM,MAAM,GAAG,+EAA+E,CAAC;AAE/F,MAAM,OAAO,GAAG,oCAAoC,CAAC;AAErD,MAAM,OAAO,GAAG,CACd,IAAe,EACf,MAAc,EACd,QAAkB,EAClB,OAAe,EACA,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAEtF,oEAAoE;AACpE,EAAE;AACF,+EAA+E;AAC/E,0EAA0E;AAC1E,MAAM,aAAa,GAAuB,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CACtD,KAAK;KACF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;KAC/E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACT,OAAO,CACL,CAAC,EACD,qBAAqB,EACrB,MAAM,EACN,kFAAkF;IAChF,yDAAyD,CAC5D,CACF,CAAC;AAEN,iFAAiF;AACjF,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,0CAA0C;AAC1C,MAAM,YAAY,GAAG;IACnB,YAAY;IACZ,kBAAkB;IAClB,gBAAgB;IAChB,mBAAmB;IACnB,gBAAgB;IAChB,WAAW;IACX,QAAQ;CACT,CAAC;AAEF,MAAM,sBAAsB,GAAuB,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAC/D,KAAK;KACF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;KACnF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACT,OAAO,CACL,CAAC,EACD,+BAA+B,EAC/B,SAAS,EACT,uFAAuF;IACrF,uEAAuE,CAC1E,CACF,CAAC;AAEN,oEAAoE;AACpE,EAAE;AACF,+EAA+E;AAC/E,uEAAuE;AACvE,gFAAgF;AAChF,8EAA8E;AAC9E,8EAA8E;AAC9E,4CAA4C;AAC5C,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAE5C,MAAM,YAAY,GAAuB,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CACrD,KAAK;KACF,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACpB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1B,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAC5C;KACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACT,OAAO,CACL,CAAC,EACD,4BAA4B,EAC5B,MAAM,EACN,8FAA8F,CAC/F,CACF,CAAC;AAEN,mEAAmE;AACnE,EAAE;AACF,8EAA8E;AAC9E,kFAAkF;AAClF,2CAA2C;AAC3C,iFAAiF;AACjF,gFAAgF;AAChF,6EAA6E;AAC7E,qCAAqC;AACrC,MAAM,kBAAkB,GAAG,yCAAyC,CAAC;AAErE,MAAM,oBAAoB,GAAuB,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAC7D,KAAK;KACF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;KACtE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACT,OAAO,CACL,CAAC,EACD,oCAAoC,EACpC,MAAM,EACN,4FAA4F;IAC1F,oDAAoD,CACvD,CACF,CAAC;AAEN,gFAAgF;AAChF,4EAA4E;AAC5E,kFAAkF;AAClF,kEAAkE;AAElE,MAAM,CAAC,MAAM,MAAM,GAAuC;IACxD,qBAAqB,EAAE,aAAa;IACpC,+BAA+B,EAAE,sBAAsB;IACvD,4BAA4B,EAAE,YAAY;IAC1C,oCAAoC,EAAE,oBAAoB;CAC3D,CAAC;AASF,MAAM,UAAU,SAAS,CAAC,GAAiB,EAAE,IAAe;IAC1D,MAAM,GAAG,GAAG,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;QACzB,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnB,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,CAAC;IAED,2EAA2E;IAC3E,yCAAyC;IACzC,QAAQ,CAAC,IAAI,CACX,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAC9F,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,aAAa,CAAC,OAAsB;IAClD,OAAO,WAAW,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,MAAM,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;AAC/E,CAAC"}

package/dist/policy/diff.js

@@ -0,0 +1,50 @@
+// A unified diff, reduced to the only thing a deterministic check may look at:
+// the lines this change ADDED, with their file and line number.
+//
+// Added lines only, and that is a rule not an optimisation. `core/unrelated-change`
+// and the "what NOT to flag" section both say the same thing — existing patterns a
+// pull request merely touches are not this pull request's problem. A checker that
+// read whole files would flag every `var` in a legacy file the author renamed, and
+// the author would be right to ignore it, and then to ignore the next one too.
+// `b/` OR `/dev/null`: the prefixed form is a real destination path, the second
+// is a deletion. Matching only the prefixed form left `+++ /dev/null` falling
+// through to the added-line branch below, where it became a phantom line of
+// content attributed to the PREVIOUS file — so a deleted file could produce a
+// finding on a file the change never touched.
+const FILE_HEADER = /^\+\+\+ (?:b\/(.+)|(\/dev\/null))$/;
+const HUNK = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/;
+export function parseDiff(diff) {
+    const added = [];
+    let file = null;
+    let line = 0;
+    for (const raw of diff.split('\n')) {
+        const header = FILE_HEADER.exec(raw);
+        if (header) {
+            // A deletion has no destination path, so nothing after it is an addition
+            // until the next file header.
+            file = header[2] ? null : (header[1] ?? null);
+            continue;
+        }
+        const hunk = HUNK.exec(raw);
+        if (hunk) {
+            line = Number.parseInt(hunk[1] ?? '1', 10);
+            continue;
+        }
+        if (file === null)
+            continue;
+        if (raw.startsWith('+')) {
+            added.push({ file, line, text: raw.slice(1) });
+            line += 1;
+        }
+        else if (raw.startsWith('-')) {
+            // A removed line does not advance the new-file counter.
+            continue;
+        }
+        else if (raw.startsWith(' ') || raw === '') {
+            line += 1;
+        }
+        // Everything else — `diff --git`, `index`, `\ No newline` — is metadata.
+    }
+    return added;
+}
+//# sourceMappingURL=diff.js.map

package/dist/policy/diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.js","sourceRoot":"","sources":["../../cli/policy/diff.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,gEAAgE;AAChE,EAAE;AACF,oFAAoF;AACpF,mFAAmF;AACnF,kFAAkF;AAClF,mFAAmF;AACnF,+EAA+E;AAU/E,gFAAgF;AAChF,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;AAC9E,8CAA8C;AAC9C,MAAM,WAAW,GAAG,oCAAoC,CAAC;AACzD,MAAM,IAAI,GAAG,uCAAuC,CAAC;AAErD,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,IAAI,GAAG,CAAC,CAAC;IAEb,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,MAAM,EAAE,CAAC;YACX,yEAAyE;YACzE,8BAA8B;YAC9B,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YAC9C,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;YAC3C,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,IAAI;YAAE,SAAS;QAE5B,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC/C,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,wDAAwD;YACxD,SAAS;QACX,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;YAC7C,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;QACD,yEAAyE;IAC3E,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/registry/discover.js

@@ -0,0 +1,74 @@
+import { parseConfig } from "../config/redline-json.js";
+export const DISCOVERY_QUERY = `
+query($org: String!, $cursor: String) {
+  repositoryOwner(login: $org) {
+    repositories(first: 100, after: $cursor, isArchived: false, ownerAffiliations: OWNER) {
+      nodes {
+        name
+        defaultBranchRef { name }
+        object(expression: "HEAD:.redline.json") { ... on Blob { text } }
+      }
+      pageInfo { hasNextPage endCursor }
+    }
+  }
+}`;
+// A host that reports hasNextPage: true forever must not hang a nightly job.
+// 200 pages of 100 is 20,000 repositories — far past any real estate.
+const MAX_PAGES = 200;
+export async function discoverGitHub(client, org) {
+    const entries = [];
+    const problems = [];
+    let cursor = null;
+    let pages = 0;
+    do {
+        const data = await client.graphql(DISCOVERY_QUERY, { org, cursor });
+        const repos = data.repositoryOwner?.repositories;
+        if (!repos) {
+            problems.push(`${org}: owner not readable with this token`);
+            break;
+        }
+        for (const node of repos.nodes) {
+            // No .redline.json is the discovery signal for "not onboarded", not an
+            // error: it is why nothing has to write a register on the way in.
+            const text = node.object?.text;
+            if (!text)
+                continue;
+            if (!node.defaultBranchRef) {
+                problems.push(`${org}/${node.name}: has .redline.json but no default branch`);
+                continue;
+            }
+            // The estate's own files are external input to this walk, so this is a
+            // real boundary and the guard belongs here. Without it one hand-edited
+            // config would abort the walk and publish a register missing every
+            // repository after it.
+            let config;
+            try {
+                config = parseConfig(JSON.parse(text));
+            }
+            catch (error) {
+                const detail = error instanceof Error ? error.message : String(error);
+                problems.push(`${org}/${node.name}: ${detail}`);
+                continue;
+            }
+            entries.push({
+                host: 'github',
+                org,
+                repo: node.name,
+                defaultBranch: node.defaultBranchRef.name,
+                profile: config.profile,
+                standardsVersion: config.standardsVersion,
+                cliVersion: config.cliVersion,
+                onboardedAt: config.onboardedAt,
+                rung: config.rung,
+            });
+        }
+        cursor = repos.pageInfo.hasNextPage ? repos.pageInfo.endCursor : null;
+        pages += 1;
+        if (cursor !== null && pages >= MAX_PAGES) {
+            problems.push(`${org}: stopped after ${MAX_PAGES} pages — the register may be incomplete`);
+            break;
+        }
+    } while (cursor !== null);
+    return { entries, problems };
+}
+//# sourceMappingURL=discover.js.map

package/dist/registry/discover.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discover.js","sourceRoot":"","sources":["../../cli/registry/discover.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AA8BxD,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;EAY7B,CAAC;AAEH,6EAA6E;AAC7E,sEAAsE;AACtE,MAAM,SAAS,GAAG,GAAG,CAAC;AAEtB,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAqC,EACrC,GAAW;IAEX,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,GAAG,CAAC;QACF,MAAM,IAAI,GAAY,MAAM,MAAM,CAAC,OAAO,CAAU,eAAe,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QACtF,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC;QACjD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,sCAAsC,CAAC,CAAC;YAC5D,MAAM;QACR,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/B,uEAAuE;YACvE,kEAAkE;YAClE,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC;YAC/B,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBAC3B,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,2CAA2C,CAAC,CAAC;gBAC9E,SAAS;YACX,CAAC;YACD,uEAAuE;YACvE,uEAAuE;YACvE,mEAAmE;YACnE,uBAAuB;YACvB,IAAI,MAAM,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACtE,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC;gBAChD,SAAS;YACX,CAAC;YACD,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,GAAG;gBACH,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI;gBACzC,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;gBACzC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;QACtE,KAAK,IAAI,CAAC,CAAC;QACX,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,mBAAmB,SAAS,yCAAyC,CAAC,CAAC;YAC3F,MAAM;QACR,CAAC;IACH,CAAC,QAAQ,MAAM,KAAK,IAAI,EAAE;IAE1B,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC"}

package/dist/registry/serialize.js

@@ -0,0 +1,41 @@
+import { RedlineError } from "../core/errors.js";
+const byOrgThenRepo = (a, b) => a.org.localeCompare(b.org) || a.repo.localeCompare(b.repo);
+// The register is committed on a schedule. Unordered entries would rewrite the
+// file on every run and make each diff unreadable, so ordering is part of the
+// format, not a presentation choice.
+export function serializeRegistry(registry) {
+    const ordered = {
+        generatedAt: registry.generatedAt,
+        source: registry.source,
+        entries: [...registry.entries].sort(byOrgThenRepo),
+    };
+    return `${JSON.stringify(ordered, null, 2)}\n`;
+}
+export function parseRegistry(raw) {
+    const bad = (what) => {
+        throw new RedlineError('failed', `registry.json is invalid: ${what}`);
+    };
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return bad('not valid JSON');
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        return bad('expected an object');
+    }
+    const o = parsed;
+    if (typeof o['generatedAt'] !== 'string')
+        return bad('generatedAt must be a string');
+    if (typeof o['source'] !== 'string')
+        return bad('source must be a string');
+    if (!Array.isArray(o['entries']))
+        return bad('entries must be an array');
+    return {
+        generatedAt: o['generatedAt'],
+        source: o['source'],
+        entries: o['entries'],
+    };
+}
+//# sourceMappingURL=serialize.js.map

package/dist/registry/serialize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialize.js","sourceRoot":"","sources":["../../cli/registry/serialize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGjD,MAAM,aAAa,GAAG,CAAC,CAAgB,EAAE,CAAgB,EAAU,EAAE,CACnE,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAE7D,+EAA+E;AAC/E,8EAA8E;AAC9E,qCAAqC;AACrC,MAAM,UAAU,iBAAiB,CAAC,QAAkB;IAClD,MAAM,OAAO,GAAa;QACxB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;KACnD,CAAC;IACF,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAS,EAAE;QAClC,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,6BAA6B,IAAI,EAAE,CAAC,CAAC;IACxE,CAAC,CAAC;IAEF,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,CAAC,GAAG,MAAiC,CAAC;IAC5C,IAAI,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC,8BAA8B,CAAC,CAAC;IACrF,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAC3E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC,0BAA0B,CAAC,CAAC;IAEzE,OAAO;QACL,WAAW,EAAE,CAAC,CAAC,aAAa,CAAC;QAC7B,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC;QACnB,OAAO,EAAE,CAAC,CAAC,SAAS,CAAoB;KACzC,CAAC;AACJ,CAAC"}

package/dist/registry/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/registry/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../cli/registry/types.ts"],"names":[],"mappings":""}