redlinegate 0.0.1

package/dist/sync/render.js

@@ -0,0 +1,57 @@
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { render } from "../render/standards.js";
+// Which paths a profile's render manages, without needing the target's content.
+// Sync asks this first so it knows what to fetch: fetching the whole repository
+// to find out would be absurd, and rendering into an empty directory to find out
+// is exactly what this does, once, cheaply.
+export function managedPaths(root, profile, vendors) {
+    const scratch = mkdtempSync(join(tmpdir(), 'redline-sync-probe-'));
+    try {
+        return render({ root, profile, out: scratch, vendors, check: true }).managed;
+    }
+    finally {
+        rmSync(scratch, { recursive: true, force: true });
+    }
+}
+// Render a target's artifacts and hand back their content.
+//
+// The renderer writes to a directory and merges into whatever is already there —
+// AGENTS.md keeps everything above the REDLINE:BEGIN marker, which is the
+// repository's own context and the single most valuable thing on the page. So
+// the target's current files are staged into a scratch directory first and the
+// real renderer runs against them. Rendering into an empty directory instead
+// would produce a correct-looking AGENTS.md that silently deletes the team's own
+// section on every sync.
+export function renderForTarget(opts) {
+    const scratch = mkdtempSync(join(tmpdir(), 'redline-sync-'));
+    try {
+        for (const [path, content] of opts.existing) {
+            const full = join(scratch, path);
+            mkdirSync(dirname(full), { recursive: true });
+            writeFileSync(full, content);
+        }
+        const result = render({
+            root: opts.root,
+            profile: opts.profile,
+            out: scratch,
+            vendors: opts.vendors,
+        });
+        const files = [];
+        for (const path of result.written) {
+            const content = readFileSync(join(scratch, path), 'utf8');
+            // Unchanged files are dropped here rather than pushed: the tree API would
+            // accept them, but a diff listing every managed file on every sync makes
+            // the one that actually changed impossible to see.
+            if (opts.existing.get(path) === content)
+                continue;
+            files.push({ path, content });
+        }
+        return { files, removed: result.removed };
+    }
+    finally {
+        rmSync(scratch, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=render.js.map

package/dist/sync/render.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.js","sourceRoot":"","sources":["../../cli/sync/render.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtF,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAqBhD,gFAAgF;AAChF,gFAAgF;AAChF,iFAAiF;AACjF,4CAA4C;AAC5C,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,OAAe,EAAE,OAAiB;IAC3E,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC;IAC/E,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,2DAA2D;AAC3D,EAAE;AACF,iFAAiF;AACjF,0EAA0E;AAC1E,8EAA8E;AAC9E,+EAA+E;AAC/E,6EAA6E;AAC7E,iFAAiF;AACjF,yBAAyB;AACzB,MAAM,UAAU,eAAe,CAAC,IAA4B;IAC1D,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACjC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9C,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/B,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC;YACpB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,GAAG,EAAE,OAAO;YACZ,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;QAEH,MAAM,KAAK,GAAiB,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;YAC1D,0EAA0E;YAC1E,yEAAyE;YACzE,mDAAmD;YACnD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,OAAO;gBAAE,SAAS;YAClD,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAChC,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAC5C,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;AACH,CAAC"}

package/dist/sync/run.js

@@ -0,0 +1,118 @@
+import { isRedlineError } from "../core/errors.js";
+import { planSync } from "./plan.js";
+import { managedPaths, renderForTarget } from "./render.js";
+export const SYNC_BRANCH = 'redline/sync';
+export const SYNC_LABEL = 'redline-sync';
+// How long a sync pull request may sit before its own gate starts failing it.
+// A sync pull request nobody merges is drift, and drift that fails nothing is
+// drift nobody sees. Thirty days is long enough for a team to schedule the merge
+// and short enough that "we'll get to it" has to be said out loud again.
+export const SYNC_EXEMPTION_DAYS = 30;
+const body = (target, version, files, now) => {
+    const until = new Date(now.getTime() + SYNC_EXEMPTION_DAYS * 86400000)
+        .toISOString()
+        .slice(0, 10);
+    return [
+        `Redline standards **v${version}** — this repository was on v${target.from}.`,
+        '',
+        'Rendered from the organisation standard. Everything in this diff is generated:',
+        '',
+        ...files.map((f) => `- \`${f}\``),
+        '',
+        'Content above each `<!-- REDLINE:BEGIN -->` marker is yours and is untouched.',
+        '',
+        'Merging keeps this repository current. Not merging is a decision the estate',
+        'dashboard records as drift — it is not a silent one, which is the point.',
+        '',
+        // A generated pull request carries its own exemption rather than being a
+        // special case in the gate. One rule for everyone is worth more than a
+        // convenience for the tool that wrote the rule — and it means this pull
+        // request starts failing its own gate if it is left unmerged, which is
+        // exactly what should happen to standards a repository is quietly refusing.
+        '## Redline exemption',
+        '',
+        `- reason: generated standards sync to v${version}; the launch-readiness checklist does not apply to a diff no human wrote`,
+        `- until: ${until}`,
+        '- scope: checklist, adr',
+    ].join('\n');
+};
+async function syncTarget(host, target, opts) {
+    const entry = target.entry;
+    const ref = {
+        host: entry.host,
+        org: entry.org,
+        repo: entry.repo,
+        defaultBranch: entry.defaultBranch,
+        ...(entry.project ? { project: entry.project } : {}),
+    };
+    // The register records a profile, but vendors and the current selections live
+    // in the repository's own file. Reading it live means sync cannot render the
+    // wrong thing for a repository that changed since the register was derived.
+    const { config } = await host.readRemoteConfig(ref);
+    if (!config)
+        return { kind: 'not-onboarded' };
+    const paths = managedPaths(opts.root, config.profile, config.vendors);
+    const existing = new Map();
+    for (const path of paths) {
+        const file = await host.readRemoteFile(ref, path);
+        if (file)
+            existing.set(path, file.content);
+    }
+    const rendered = renderForTarget({
+        root: opts.root,
+        profile: config.profile,
+        vendors: config.vendors,
+        existing,
+    });
+    // A render that would delete a file is reported and not pushed. Removal is a
+    // vendor being turned off or a stack leaving the profile — a decision the
+    // repository makes by re-running init, not something a scheduled sync should
+    // do to it from the outside. But it must be SAID: a target carrying artifacts
+    // for a stack it no longer has was reported as "current" by both sync and
+    // verify, which is the definition of silent drift.
+    if (rendered.files.length === 0) {
+        return rendered.removed.length > 0
+            ? { kind: 'stale-artifacts', paths: rendered.removed }
+            : { kind: 'current' };
+    }
+    if (opts.dryRun) {
+        return { kind: 'opened', number: 0, url: `(dry run) ${rendered.files.length} file(s)` };
+    }
+    const pushed = await host.pushFiles(ref, {
+        branch: SYNC_BRANCH,
+        message: `chore(redline): standards v${opts.standardsVersion}`,
+        files: rendered.files,
+    });
+    if (pushed.commit === null)
+        return { kind: 'current' };
+    const pr = await host.openPullRequest(ref, {
+        branch: SYNC_BRANCH,
+        title: `Redline: standards v${opts.standardsVersion}`,
+        body: body(target, opts.standardsVersion, rendered.files.map((f) => f.path), opts.now ?? new Date()),
+        labels: [SYNC_LABEL],
+    });
+    return pr.created
+        ? { kind: 'opened', number: pr.number, url: pr.url }
+        : { kind: 'updated', number: pr.number, url: pr.url };
+}
+// Sync the estate. One repository failing never stops the others: an estate-wide
+// distribution that aborts on the first unreachable repository is a distribution
+// that never completes, and the whole point of Phase 0 is that it does.
+export async function runSync(host, registry, opts) {
+    const plan = planSync(registry, opts.standardsVersion, opts);
+    const results = [];
+    let failures = 0;
+    for (const target of plan.targets) {
+        const repo = `${target.entry.org}/${target.entry.repo}`;
+        try {
+            results.push({ repo, outcome: await syncTarget(host, target, opts) });
+        }
+        catch (error) {
+            failures += 1;
+            const detail = isRedlineError(error) ? error.message : String(error);
+            results.push({ repo, outcome: { kind: 'failed', detail } });
+        }
+    }
+    return { plan, results, failures };
+}
+//# sourceMappingURL=run.js.map

package/dist/sync/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../cli/sync/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGnD,OAAO,EAAE,QAAQ,EAAoD,MAAM,WAAW,CAAC;AACvF,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AA+C5D,MAAM,CAAC,MAAM,WAAW,GAAG,cAAc,CAAC;AAC1C,MAAM,CAAC,MAAM,UAAU,GAAG,cAAc,CAAC;AAEzC,8EAA8E;AAC9E,8EAA8E;AAC9E,iFAAiF;AACjF,yEAAyE;AACzE,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAEtC,MAAM,IAAI,GAAG,CAAC,MAAkB,EAAE,OAAe,EAAE,KAAe,EAAE,GAAS,EAAU,EAAE;IACvF,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,mBAAmB,GAAG,QAAQ,CAAC;SACnE,WAAW,EAAE;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,OAAO;QACL,wBAAwB,OAAO,gCAAgC,MAAM,CAAC,IAAI,GAAG;QAC7E,EAAE;QACF,gFAAgF;QAChF,EAAE;QACF,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACjC,EAAE;QACF,+EAA+E;QAC/E,EAAE;QACF,6EAA6E;QAC7E,0EAA0E;QAC1E,EAAE;QACF,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,uEAAuE;QACvE,4EAA4E;QAC5E,sBAAsB;QACtB,EAAE;QACF,0CAA0C,OAAO,0EAA0E;QAC3H,YAAY,KAAK,EAAE;QACnB,yBAAyB;KAC1B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC,CAAC;AAEF,KAAK,UAAU,UAAU,CACvB,IAAc,EACd,MAAkB,EAClB,IAAoB;IAEpB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,MAAM,GAAG,GAAY;QACnB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,CAAC;IAEF,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IAE9C,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClD,IAAI,IAAI;YAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC;QAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ;KACT,CAAC,CAAC;IAEH,6EAA6E;IAC7E,0EAA0E;IAC1E,6EAA6E;IAC7E,8EAA8E;IAC9E,0EAA0E;IAC1E,mDAAmD;IACnD,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YAChC,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,QAAQ,CAAC,OAAO,EAAE;YACtD,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC1B,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,aAAa,QAAQ,CAAC,KAAK,CAAC,MAAM,UAAU,EAAE,CAAC;IAC1F,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;QACvC,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,8BAA8B,IAAI,CAAC,gBAAgB,EAAE;QAC9D,KAAK,EAAE,QAAQ,CAAC,KAAK;KACtB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAEvD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE;QACzC,MAAM,EAAE,WAAW;QACnB,KAAK,EAAE,uBAAuB,IAAI,CAAC,gBAAgB,EAAE;QACrD,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;QACpG,MAAM,EAAE,CAAC,UAAU,CAAC;KACrB,CAAC,CAAC;IAEH,OAAO,EAAE,CAAC,OAAO;QACf,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE;QACpD,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC;AAC1D,CAAC;AAED,iFAAiF;AACjF,iFAAiF;AACjF,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,IAAc,EACd,QAAkB,EAClB,IAAoB;IAEpB,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;IAC7D,MAAM,OAAO,GAA0B,EAAE,CAAC;IAC1C,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACxD,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,IAAI,CAAC,CAAC;YACd,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACrE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AACrC,CAAC"}

package/dist/verify/host.js

@@ -0,0 +1,52 @@
+import { RedlineError } from "../core/errors.js";
+import { createGitHubClient } from "../platforms/github/client.js";
+import { createGitHubVerify, machineryFromBody } from "../platforms/github/verify.js";
+import { readRemoteConfig, readRemoteFile } from "../platforms/github/remote.js";
+// One client per host, for the same reason sync needs one: a remote verify runs
+// across an estate that spans both, where every other command acts on a single
+// repository and therefore a single host.
+export function createRemoteVerifyHost(clients = {}) {
+    const github = clients.github ?? createGitHubClient();
+    const githubVerify = createGitHubVerify(github);
+    const unsupported = (host) => {
+        throw new RedlineError('host', `remote verify does not support ${host} yet`, 'Azure DevOps remote verification is outstanding — see the roadmap Phase 0');
+    };
+    const only = (ref) => {
+        if (ref.host !== 'github')
+            unsupported(ref.host);
+    };
+    return {
+        resolveRef: (repo) => resolveRemoteRef(github, repo),
+        readRemoteConfig: (ref) => (only(ref), readRemoteConfig(github, ref)),
+        readRemoteFile: (ref, path) => (only(ref), readRemoteFile(github, ref, path)),
+        machineryFromBody,
+        readPolicy: (ref) => (only(ref), githubVerify.readPolicy(ref)),
+        readSecurityState: (ref) => (only(ref), githubVerify.readSecurityState(ref)),
+        latestPullRequestNumber: (ref) => (only(ref), githubVerify.latestPullRequestNumber(ref)),
+        readReportedCheckNames: (ref, pr) => (only(ref), githubVerify.readReportedCheckNames(ref, pr)),
+    };
+}
+// owner/name into a RepoRef. The default branch is not known until the host is
+// asked, and every call below needs it, so it is resolved once here rather than
+// guessed as "main" — a repository on `master` or `develop` would otherwise be
+// reported as entirely broken.
+export async function resolveRemoteRef(client, repo) {
+    const [org, name] = repo.split('/');
+    if (!org || !name || repo.split('/').length !== 2) {
+        throw new RedlineError('usage', `--repo must be owner/name, not "${repo}"`);
+    }
+    const response = await client.rest('GET', `/repos/${org}/${name}`);
+    if (response.status === 404) {
+        throw new RedlineError('host', `${repo} not found, or this token cannot see it`);
+    }
+    if (response.status >= 400) {
+        throw new RedlineError('host', `reading ${repo} returned ${response.status}`);
+    }
+    return {
+        host: 'github',
+        org,
+        repo: name,
+        defaultBranch: response.body?.default_branch ?? 'main',
+    };
+}
+//# sourceMappingURL=host.js.map

package/dist/verify/host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.js","sourceRoot":"","sources":["../../cli/verify/host.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,OAAO,EAAE,kBAAkB,EAAqB,MAAM,+BAA+B,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACtF,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAGjF,gFAAgF;AAChF,+EAA+E;AAC/E,0CAA0C;AAC1C,MAAM,UAAU,sBAAsB,CAAC,UAAqC,EAAE;IAC5E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,kBAAkB,EAAE,CAAC;IACtD,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAEhD,MAAM,WAAW,GAAG,CAAC,IAAU,EAAS,EAAE;QACxC,MAAM,IAAI,YAAY,CACpB,MAAM,EACN,kCAAkC,IAAI,MAAM,EAC5C,2EAA2E,CAC5E,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,GAAY,EAAQ,EAAE;QAClC,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;YAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC,CAAC;IAEF,OAAO;QACL,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC;QACpD,gBAAgB,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACrE,cAAc,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7E,iBAAiB;QACjB,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC9D,iBAAiB,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC5E,uBAAuB,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;QACxF,sBAAsB,EAAE,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC,sBAAsB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;KAC/F,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,+BAA+B;AAC/B,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAkC,EAClC,IAAY;IAEZ,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,YAAY,CAAC,OAAO,EAAE,mCAAmC,IAAI,GAAG,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAA8B,KAAK,EAAE,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC;IAChG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,YAAY,CAAC,MAAM,EAAE,GAAG,IAAI,yCAAyC,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC3B,MAAM,IAAI,YAAY,CAAC,MAAM,EAAE,WAAW,IAAI,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,GAAG;QACH,IAAI,EAAE,IAAI;QACV,aAAa,EAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,IAAI,MAAM;KACvD,CAAC;AACJ,CAAC"}

package/dist/verify/remote.js

@@ -0,0 +1,146 @@
+import { isRedlineError } from "../core/errors.js";
+import { renderForTarget, managedPaths } from "../sync/render.js";
+export const CALLER_WORKFLOW = '.github/workflows/redline.yml';
+// Verify a repository without a checkout.
+//
+// Every check that can be sourced from the host is, and every check that cannot
+// is reported `unknown` with the reason rather than passing. That distinction is
+// the reason this is safe to run across an estate on a schedule: a check
+// reported as passing when it never executed produces a false all-clear on every
+// repository at once, which is materially worse than not checking.
+export async function verifyRemote(host, ref, opts) {
+    const findings = [];
+    const add = (check, ok, detail, unknown = false) => {
+        findings.push({ check, ok, detail, ...(unknown ? { unknown: true } : {}) });
+    };
+    const repo = `${ref.org}/${ref.repo}`;
+    let config;
+    try {
+        ({ config } = await host.readRemoteConfig(ref));
+    }
+    catch (error) {
+        // A malformed .redline.json in the estate is that repository's finding, not
+        // a failure of the run that found it — otherwise one hand-edited file stops
+        // the weekly sweep for everybody.
+        add('onboarded', false, isRedlineError(error) ? error.message : String(error));
+        return { findings, ok: false };
+    }
+    if (!config) {
+        add('onboarded', false, `${repo} carries no .redline.json — it is not onboarded`);
+        return { findings, ok: false };
+    }
+    add('onboarded', true, `profile ${config.profile}, standards v${config.standardsVersion}`);
+    // --- rendered artifacts ----------------------------------------------------
+    // Staleness is decidable remotely and is worth deciding: it is the check that
+    // tells an ignored sync pull request from a merged one.
+    try {
+        const existing = new Map();
+        for (const path of managedPaths(opts.root, config.profile, config.vendors)) {
+            const file = await host.readRemoteFile(ref, path);
+            if (file)
+                existing.set(path, file.content);
+        }
+        const rendered = renderForTarget({
+            root: opts.root,
+            profile: config.profile,
+            vendors: config.vendors,
+            existing,
+        });
+        add('artifacts', rendered.files.length === 0, rendered.files.length === 0
+            ? `current against standards v${opts.standardsVersion}`
+            : `stale against standards v${opts.standardsVersion}: ${rendered.files
+                .map((f) => f.path)
+                .join(', ')} — a sync pull request is open or was closed unmerged`);
+    }
+    catch (error) {
+        add('artifacts', true, `could not render for comparison: ${isRedlineError(error) ? error.message : String(error)}`, true);
+    }
+    // --- gate machinery --------------------------------------------------------
+    const callerFile = await host.readRemoteFile(ref, CALLER_WORKFLOW);
+    const machinery = host.machineryFromBody(callerFile?.content ?? null);
+    const gateOwned = config.capabilities.gate;
+    add('gate-machinery', !gateOwned || (machinery.present && machinery.publishes === machinery.expected), !gateOwned
+        ? machinery.present
+            ? `off by choice, and ${machinery.path} is still present and still publishing ${machinery.publishes ?? 'nothing'}`
+            : 'off by choice — this repository publishes the gate its own way'
+        : !machinery.present
+            ? `${machinery.path} is missing — nothing here can publish ${machinery.expected}`
+            : machinery.publishes === null
+                ? `${machinery.path} is present but no longer publishes a check name — its job id or pull_request trigger was edited`
+                : machinery.publishes !== machinery.expected
+                    ? `${machinery.path} publishes ${machinery.publishes}, but the policy requires ${machinery.expected}`
+                    : `publishes ${machinery.publishes}`);
+    // --- merge policy ----------------------------------------------------------
+    const policy = await host.readPolicy(ref);
+    if (!config.capabilities.mergePolicy) {
+        add('merge-policy', true, 'off by choice — this repository maintains its own');
+    }
+    else if (policy === null) {
+        add('merge-policy', false, 'no merge policy found on the host — one was applied at onboarding');
+    }
+    else {
+        const weakened = [];
+        if (policy.requiredApprovals < 1) {
+            weakened.push('human approval is no longer required — automated review never approves');
+        }
+        if (policy.notEnforcedReason) {
+            // The cheapest loosening on GitHub: a ruleset switched out of active
+            // enforcement keeps every field readable while none of its rules apply.
+            weakened.push(`the policy exists but is not in force (${policy.notEnforcedReason})`);
+        }
+        if (policy.blocking && !machinery.present) {
+            weakened.push(`blocking on ${machinery.expected}, which nothing in this repository publishes — ` +
+                'every pull request here is blocked until the gate is restored or the policy relaxed');
+        }
+        add('merge-policy', weakened.length === 0, weakened.length === 0
+            ? `${policy.blocking ? 'blocking' : 'advisory'}, ${policy.requiredApprovals} approval(s) required`
+            : weakened.join('; '));
+    }
+    // --- security floor --------------------------------------------------------
+    const security = await host.readSecurityState(ref);
+    // An indeterminate read is not an answer. A 403 the host cannot tell from a
+    // genuine refusal must not be reported as a security floor that is off — that
+    // files false work against an administrator — nor as one that is on.
+    const unreadable = security.outcomes.filter((o) => o.status === 'unknown');
+    const off = security.outcomes.filter((o) => o.status === 'denied');
+    if (off.length > 0) {
+        add('security-floor', false, `not enabled: ${off.map((o) => o.capability).join(', ')}`);
+    }
+    else if (unreadable.length > 0 && unreadable.length === security.outcomes.length) {
+        add('security-floor', true, `this token cannot read: ${unreadable.map((o) => o.capability).join(', ')}`, true);
+    }
+    else if (unreadable.length > 0) {
+        // Partly unreadable is still an indeterminate answer about the part that
+        // could not be read. Reporting it plainly `ok` meant a repository with
+        // secret scanning genuinely off, plus a token unable to see it, verified as
+        // healthy — the one combination this check exists to catch.
+        add('security-floor', true, `enabled, except ${unreadable.map((o) => o.capability).join(', ')} which this token cannot read`, true);
+    }
+    else {
+        add('security-floor', true, 'the security floor is enabled');
+    }
+    // --- the check actually reporting ------------------------------------------
+    const pr = await host.latestPullRequestNumber(ref);
+    if (pr === null) {
+        add('check-name-reported', true, 'no pull request yet — open one to confirm the check reports');
+    }
+    else {
+        const reported = await host.readReportedCheckNames(ref, pr);
+        const found = reported.includes(machinery.expected);
+        add('check-name-reported', !gateOwned || found, !gateOwned
+            ? 'off by choice — Redline does not require a check name here'
+            : found
+                ? `${machinery.expected} reported on PR #${pr}`
+                : `${machinery.expected} was not reported on PR #${pr} — reported: ${reported.join(', ') || 'nothing'}`);
+    }
+    // --- pending admin ---------------------------------------------------------
+    add('pending-admin', config.pendingAdmin.length === 0, config.pendingAdmin.length === 0
+        ? 'nothing waiting on an administrator'
+        : `an administrator must still enable: ${config.pendingAdmin.join(', ')}`);
+    // An unknown never fails the report. It is not evidence of drift — it is the
+    // absence of evidence, and failing on it would train an operator to ignore
+    // the weekly issue, which costs more than the check is worth.
+    const ok = findings.every((f) => f.ok || f.unknown === true);
+    return { findings, ok };
+}
+//# sourceMappingURL=remote.js.map

package/dist/verify/remote.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote.js","sourceRoot":"","sources":["../../cli/verify/remote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAInD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAyBlE,MAAM,CAAC,MAAM,eAAe,GAAG,+BAA+B,CAAC;AAE/D,0CAA0C;AAC1C,EAAE;AACF,gFAAgF;AAChF,iFAAiF;AACjF,yEAAyE;AACzE,iFAAiF;AACjF,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAsB,EACtB,GAAY,EACZ,IAAyB;IAEzB,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,EAAW,EAAE,MAAc,EAAE,OAAO,GAAG,KAAK,EAAQ,EAAE;QAChF,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;IAEtC,IAAI,MAA4B,CAAC;IACjC,IAAI,CAAC;QACH,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,4EAA4E;QAC5E,4EAA4E;QAC5E,kCAAkC;QAClC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/E,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,IAAI,iDAAiD,CAAC,CAAC;QAClF,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACjC,CAAC;IACD,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,WAAW,MAAM,CAAC,OAAO,gBAAgB,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE3F,8EAA8E;IAC9E,8EAA8E;IAC9E,wDAAwD;IACxD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC3C,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAClD,IAAI,IAAI;gBAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,QAAQ,GAAG,eAAe,CAAC;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,QAAQ;SACT,CAAC,CAAC;QACH,GAAG,CACD,WAAW,EACX,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAC3B,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YACzB,CAAC,CAAC,8BAA8B,IAAI,CAAC,gBAAgB,EAAE;YACvD,CAAC,CAAC,4BAA4B,IAAI,CAAC,gBAAgB,KAAK,QAAQ,CAAC,KAAK;iBACjE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;iBAClB,IAAI,CAAC,IAAI,CAAC,uDAAuD,CACzE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CACD,WAAW,EACX,IAAI,EACJ,oCAAoC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC3F,IAAI,CACL,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC;IAC3C,GAAG,CACD,gBAAgB,EAChB,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC,QAAQ,CAAC,EAC/E,CAAC,SAAS;QACR,CAAC,CAAC,SAAS,CAAC,OAAO;YACjB,CAAC,CAAC,sBAAsB,SAAS,CAAC,IAAI,0CAA0C,SAAS,CAAC,SAAS,IAAI,SAAS,EAAE;YAClH,CAAC,CAAC,gEAAgE;QACpE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO;YAClB,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,0CAA0C,SAAS,CAAC,QAAQ,EAAE;YACjF,CAAC,CAAC,SAAS,CAAC,SAAS,KAAK,IAAI;gBAC5B,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,kGAAkG;gBACrH,CAAC,CAAC,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC,QAAQ;oBAC1C,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,cAAc,SAAS,CAAC,SAAS,6BAA6B,SAAS,CAAC,QAAQ,EAAE;oBACrG,CAAC,CAAC,aAAa,SAAS,CAAC,SAAS,EAAE,CAC7C,CAAC;IAEF,8EAA8E;IAC9E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;QACrC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,mDAAmD,CAAC,CAAC;IACjF,CAAC;SAAM,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAC3B,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,mEAAmE,CAAC,CAAC;IAClG,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,MAAM,CAAC,iBAAiB,GAAG,CAAC,EAAE,CAAC;YACjC,QAAQ,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC7B,qEAAqE;YACrE,wEAAwE;YACxE,QAAQ,CAAC,IAAI,CAAC,0CAA0C,MAAM,CAAC,iBAAiB,GAAG,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CACX,eAAe,SAAS,CAAC,QAAQ,iDAAiD;gBAChF,qFAAqF,CACxF,CAAC;QACJ,CAAC;QACD,GAAG,CACD,cAAc,EACd,QAAQ,CAAC,MAAM,KAAK,CAAC,EACrB,QAAQ,CAAC,MAAM,KAAK,CAAC;YACnB,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,KAAK,MAAM,CAAC,iBAAiB,uBAAuB;YAClG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CACxB,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACnD,4EAA4E;IAC5E,8EAA8E;IAC9E,qEAAqE;IACrE,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IACnE,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnB,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;SAAM,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACnF,GAAG,CACD,gBAAgB,EAChB,IAAI,EACJ,2BAA2B,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC3E,IAAI,CACL,CAAC;IACJ,CAAC;SAAM,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,yEAAyE;QACzE,uEAAuE;QACvE,4EAA4E;QAC5E,4DAA4D;QAC5D,GAAG,CACD,gBAAgB,EAChB,IAAI,EACJ,mBAAmB,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,EAChG,IAAI,CACL,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,+BAA+B,CAAC,CAAC;IAC/D,CAAC;IAED,8EAA8E;IAC9E,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAChB,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,6DAA6D,CAAC,CAAC;IAClG,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACpD,GAAG,CACD,qBAAqB,EACrB,CAAC,SAAS,IAAI,KAAK,EACnB,CAAC,SAAS;YACR,CAAC,CAAC,4DAA4D;YAC9D,CAAC,CAAC,KAAK;gBACL,CAAC,CAAC,GAAG,SAAS,CAAC,QAAQ,oBAAoB,EAAE,EAAE;gBAC/C,CAAC,CAAC,GAAG,SAAS,CAAC,QAAQ,4BAA4B,EAAE,gBAAgB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,EAAE,CAC5G,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,GAAG,CACD,eAAe,EACf,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAChC,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;QAC9B,CAAC,CAAC,qCAAqC;QACvC,CAAC,CAAC,uCAAuC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5E,CAAC;IAEF,6EAA6E;IAC7E,2EAA2E;IAC3E,8DAA8D;IAC9D,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;IAC7D,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAC1B,CAAC"}

package/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "redlinegate",
+  "version": "0.0.1",
+  "description": "Engineering control plane for AI-assisted development: standards, merge gates and evidence across GitHub and Azure DevOps",
+  "type": "module",
+  "license": "MIT",
+  "homepage": "https://redline-gate.vercel.app",
+  "keywords": [
+    "code-review",
+    "ai-code-review",
+    "engineering-standards",
+    "code-quality",
+    "merge-gate",
+    "governance",
+    "sarif",
+    "static-analysis",
+    "github-actions",
+    "azure-devops",
+    "copilot",
+    "claude"
+  ],
+  "private": false,
+  "engines": {
+    "node": ">=22"
+  },
+  "bin": {
+    "redline": "dist/bin/redline.js",
+    "redlinegate": "dist/bin/redline.js"
+  },
+  "files": [
+    "LICENSE",
+    "dist/",
+    "scripts/",
+    "standards/",
+    "commands/",
+    "templates/",
+    "platforms/",
+    "workflows/",
+    "rulesets/"
+  ],
+  "scripts": {
+    "build": "rm -rf dist && tsc -p tsconfig.build.json",
+    "prepack": "npm run build",
+    "test": "node --test 'cli/**/__tests__/*.test.ts' 'scripts/**/__tests__/*.test.mjs'",
+    "typecheck": "tsc --noEmit"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.0",
+    "semantic-release": "25.0.9",
+    "typescript": "^5.7.0"
+  }
+}

package/platforms/azure/gate-template.yml

@@ -0,0 +1,105 @@
+# Managed by Redline; regenerate with `redline init` rather than editing here.
+# Redline merge gate for Azure DevOps.
+#
+# CONTRACT: the final step publishes a pull-request status with genre `redline`
+# and name `gate`. The Status branch policy installed by `redline init` requires exactly
+# that status. Renaming either value makes the policy unsatisfiable and every pull
+# request in this repository will sit blocked. `redline verify` checks the live
+# status name against this contract.
+#
+# There is deliberately no `pr:` block here: Azure Repos ignores YAML `pr:`
+# triggers (they only fire for GitHub-hosted repositories). This pipeline is
+# queued on pull requests by the "Redline: gate build" Build Validation branch
+# policy that `redline init` creates against the registered `redline-gate`
+# build definition.
+
+trigger: none
+
+pool:
+  vmImage: ubuntu-latest
+
+variables:
+  ADR_DIFF_THRESHOLD: 300
+  FAIL_ON_DEPENDENCY_SEVERITY: high
+  SOFT_FAIL_LABELS: redline-exempt,redline-sync
+
+steps:
+  - checkout: self
+    fetchDepth: 0
+
+  - task: NodeTool@0
+    displayName: Node 22
+    inputs:
+      versionSpec: '22.x'
+
+  # --package pins npx to the redlinegate package explicitly. `redline` alone
+  # names a different, unrelated package on the public registry — `redline`
+  # is only this package's bin name, never resolve npx against it directly.
+  - script: npx --yes --package=redlinegate@latest redline verify --gate
+    displayName: Redline gate
+    name: gate
+    env:
+      SYSTEM_ACCESSTOKEN: $(System.AccessToken)
+      ADR_DIFF_THRESHOLD: $(ADR_DIFF_THRESHOLD)
+      FAIL_ON_DEPENDENCY_SEVERITY: $(FAIL_ON_DEPENDENCY_SEVERITY)
+      SOFT_FAIL_LABELS: $(SOFT_FAIL_LABELS)
+
+  - script: |
+      set -euo pipefail
+      state="succeeded"
+      description="Redline merge gate"
+      if [ "$AGENT_JOBSTATUS" != "Succeeded" ]; then state="failed"; fi
+
+      # $SYSTEM_TEAMPROJECT is admin-set, not attacker-controlled, but a
+      # display name containing a space or a quote must not be allowed to
+      # break the JSON body or the URL path — encode it, never interpolate
+      # it raw into either.
+      project_enc=$(jq -rn --arg v "$SYSTEM_TEAMPROJECT" '$v | @uri')
+      target_url="${SYSTEM_TEAMFOUNDATIONCOLLECTIONURI}${project_enc}/_build/results?buildId=$BUILD_BUILDID"
+      pr_url="${SYSTEM_TEAMFOUNDATIONCOLLECTIONURI}${project_enc}/_apis/git/repositories/$BUILD_REPOSITORY_ID/pullRequests/$SYSTEM_PULLREQUEST_PULLREQUESTID"
+
+      # The access token must never appear in argv — visible via `ps` or
+      # /proc/<pid>/cmdline to any process on the agent for the call's
+      # duration. It is already an env var; hand it to curl through a
+      # stdin config instead of putting it on the command line with -H.
+      curl_authed() {
+        printf 'header = "Authorization: Bearer %s"\n' "$SYSTEM_ACCESSTOKEN" | curl -K - "$@"
+      }
+
+      # Soft-fail escape hatch, the same one workflows/redline-gate.yml gives
+      # GitHub: a pull request carrying one of SOFT_FAIL_LABELS reports the
+      # gate succeeded-with-warning instead of blocking, so a reviewer can
+      # accept a process failure deliberately. It can only ever turn a
+      # failure into a success, never the reverse.
+      #
+      # NOTE for whoever splits this job up: on GitHub the security jobs
+      # (dependency-review, secrets) are excluded from the exemption. Here the
+      # gate is one `redline verify --gate` run that checks configuration
+      # drift only — no scanning step exists to downgrade. Adding one means
+      # excluding it from this branch, exactly as the GitHub workflow does.
+      if [ "$state" = "failed" ] && [ -n "${SOFT_FAIL_LABELS:-}" ]; then
+        labels=$(curl_authed -sS "$pr_url/labels?api-version=7.1") || labels=''
+        for label in ${SOFT_FAIL_LABELS//,/ }; do
+          if printf '%s' "$labels" \
+            | jq -e --arg l "$label" '[.value[]? | select(.active != false) | .name] | index($l)' >/dev/null 2>&1
+          then
+            state="succeeded"
+            description="Redline gate failed but the \"$label\" label is applied — a reviewer accepted this deliberately"
+            echo "##vso[task.logissue type=warning]$description"
+            break
+          fi
+        done
+      fi
+
+      body=$(jq -n --arg state "$state" --arg url "$target_url" --arg description "$description" \
+        '{state: $state, description: $description, context: {name: "gate", genre: "redline"}, targetUrl: $url}')
+
+      curl_authed -sS --fail-with-body -X POST \
+        -H "Content-Type: application/json" \
+        -d "$body" \
+        "$pr_url/statuses?api-version=7.1"
+    displayName: Publish redline/gate status
+    condition: always()
+    env:
+      SYSTEM_ACCESSTOKEN: $(System.AccessToken)
+      SOFT_FAIL_LABELS: $(SOFT_FAIL_LABELS)

package/rulesets/redline-org-ruleset.json

@@ -0,0 +1,46 @@
+{
+  "name": "Redline (org)",
+  "target": "branch",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["~DEFAULT_BRANCH"],
+      "exclude": []
+    },
+    "repository_property": {
+      "include": [
+        {
+          "name": "redline",
+          "property_values": ["onboarded"],
+          "source": "custom"
+        }
+      ],
+      "exclude": []
+    }
+  },
+  "rules": [
+    { "type": "deletion" },
+    { "type": "non_fast_forward" },
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 1,
+        "dismiss_stale_reviews_on_push": true,
+        "require_code_owner_review": true,
+        "require_last_push_approval": true,
+        "required_review_thread_resolution": true,
+        "automatic_copilot_code_review_enabled": true,
+        "allowed_merge_methods": ["squash", "merge"]
+      }
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": false,
+        "do_not_enforce_on_create": false,
+        "required_status_checks": [{ "context": "redline-gate / gate" }]
+      }
+    }
+  ],
+  "bypass_actors": []
+}