sneakoscope 4.0.13 → 4.0.14

package/dist/scripts/release-check-dynamic-execute.js

@@ -1,259 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-// release:check:dynamic:execute (1.20.2 Area 2).
-//
-// Change-aware gate RUNNER (the plan-only release-check-dynamic.mjs stays as-is).
-// Default = EXECUTE: selects gates whose affected_by globs match changed files
-// (plus always-on), runs each hermetic one via `npm run <id>`, caches successful
-// results, and serves cache hits to skip re-runs on an unchanged tree. Real/heavy
-// gates are deferred to release:real-check. --plan-only prints the plan without
-// running. --publish selects every required_for_publish gate.
-//
-// This script is STANDALONE — it must never be added to the release:check chain,
-// the DAG, or the gate manifest (it would recursively invoke the gate set).
-import fs from 'node:fs';
-import path from 'node:path';
-import crypto from 'node:crypto';
-import { spawnSync } from 'node:child_process';
-import { emitGate, importDist, root } from './sks-1-18-gate-lib.js';
-const { buildGateManifest, selectGates, FORBIDDEN_RECURSIVE_GATES } = await importDist('core/release/gate-manifest.js');
-const { gateCacheKey, readGateCache, writeGateCache, recordGateResult, lookupGateResult } = await importDist('core/release/gate-cache.js');
-let TRACKED = null;
-const args = process.argv.slice(2);
-const planOnly = args.includes('--plan-only');
-const publish = args.includes('--publish');
-const baseArg = readArg(args, '--base');
-const envMode = process.env.SKS_ENV_MODE || (publish ? 'publish' : 'incremental');
-const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
-const manifest = loadManifest();
-const changedFiles = detectChangedFiles(baseArg);
-const plan = selectGates(manifest.gates, changedFiles, { publish });
-// Hermetic invariant proofs preserved from the planner (self-prove narrowing).
-const docsOnly = selectGates(manifest.gates, ['docs/zellij-ui-design.md'], { publish: false });
-const realOnDocs = docsOnly.selected.filter((g) => g.cost === 'real' || g.cost === 'heavy');
-const publishPlan = selectGates(manifest.gates, [], { publish: true });
-const requiredIds = manifest.gates.filter((g) => g.required_for_publish).map((g) => g.id);
-const selectedPublish = new Set(publishPlan.selected.map((g) => g.id));
-const invariants = {
-    docs_only_skips_heavy: realOnDocs.length === 0,
-    publish_keeps_required: requiredIds.every((id) => selectedPublish.has(id))
-};
-const distHash = distHashValue();
-const gitCommit = gitHead();
-const manifestHash = fileHash(fs.existsSync(path.join(root, 'release-gates.v2.json')) ? 'release-gates.v2.json' : 'release-gates.json');
-const packageScriptsHash = sha256(JSON.stringify(pkg.scripts || {}));
-const nodeVersion = process.version;
-const npmVersion = npmVersionValue();
-const cache = await readGateCache(root);
-const executed = [];
-const cacheHits = [];
-const skipped = [...plan.skipped];
-const failures = [];
-for (const gate of plan.selected) {
-    if (FORBIDDEN_RECURSIVE_GATES.has(gate.id)) {
-        skipped.push({ id: gate.id, reason: 'forbidden_recursive_gate' });
-        continue;
-    }
-    // Real/heavy gates are never run incrementally or cached — defer to release:real-check.
-    if (gate.cost === 'real' || gate.cost === 'heavy') {
-        skipped.push({ id: gate.id, reason: 'deferred_to_real_check' });
-        continue;
-    }
-    const command = `npm run ${gate.id}`;
-    if (FORBIDDEN_RECURSIVE_GATES.has(gate.id) || /npm\s+run\s+(release:check|release:real-check|release:publish|publish:npm|publish:dry|prepublishOnly)\b/.test(command)) {
-        failures.push({ id: gate.id, exit_code: null, stdout_tail: '', stderr_tail: 'forbidden_recursive_gate_spawn' });
-        continue;
-    }
-    const key = gateCacheKey({
-        gateId: gate.id,
-        command,
-        packageVersion: pkg.version,
-        gitCommit,
-        inputHashes: hashAffectedFiles(gate.affected_by),
-        envMode,
-        distHash,
-        manifestHash,
-        packageScriptsHash,
-        gateImplementationHash: gateImplementationHash(gate.id),
-        nodeVersion,
-        npmVersion
-    });
-    const hit = lookupGateResult(cache, key);
-    if (hit && hit.ok) {
-        cacheHits.push({ id: gate.id, key, duration_ms: hit.duration_ms, recorded_at: hit.recorded_at });
-        continue;
-    }
-    if (planOnly) {
-        executed.push({ id: gate.id, planned: true });
-        continue;
-    }
-    const started = Date.now();
-    const childEnv = { ...process.env, SKS_RELEASE_DYNAMIC: '1', SKS_ENV_MODE: envMode };
-    const res = spawnSync('npm', ['run', gate.id, '--silent'], { cwd: root, env: childEnv, encoding: 'utf8', maxBuffer: 50 * 1024 * 1024 });
-    const durationMs = Date.now() - started;
-    const ok = res.status === 0;
-    executed.push({ id: gate.id, ok, exit_code: res.status, duration_ms: durationMs });
-    if (ok) {
-        // Only successful gates are cached; failures always re-run.
-        recordGateResult(cache, key, gate.id, true, durationMs);
-    }
-    else {
-        failures.push({ id: gate.id, exit_code: res.status, stdout_tail: tail(res.stdout), stderr_tail: tail(res.stderr) });
-    }
-}
-if (!planOnly)
-    await writeGateCache(root, cache);
-const ok = failures.length === 0 && invariants.docs_only_skips_heavy && invariants.publish_keeps_required;
-const report = {
-    schema: 'sks.release-check-dynamic.v2',
-    ok,
-    mode: planOnly ? 'plan-only' : publish ? 'publish' : 'incremental',
-    base: baseArg || null,
-    changed_files: changedFiles,
-    selected: plan.selected.map((g) => g.id),
-    skipped,
-    executed,
-    cache_hits: cacheHits,
-    failures,
-    invariants
-};
-const reportDir = path.join(root, '.sneakoscope', 'reports');
-fs.mkdirSync(reportDir, { recursive: true });
-fs.writeFileSync(path.join(reportDir, 'release-check-dynamic-execute.json'), `${JSON.stringify(report, null, 2)}\n`);
-if (!ok) {
-    console.log(JSON.stringify({ schema: 'sks.release-check-dynamic.v2', ok: false, mode: report.mode, failures, invariants }, null, 2));
-    process.exit(1);
-}
-emitGate('release:check:dynamic:execute', {
-    mode: report.mode,
-    selected: report.selected.length,
-    executed: executed.length,
-    cache_hits: cacheHits.length,
-    skipped: skipped.length,
-    failures: failures.length
-});
-// ---- helpers ----------------------------------------------------------------
-function loadManifest() {
-    const v2Path = path.join(root, 'release-gates.v2.json');
-    if (fs.existsSync(v2Path)) {
-        const parsed = JSON.parse(fs.readFileSync(v2Path, 'utf8'));
-        const releaseNodes = (Array.isArray(parsed.gates) ? parsed.gates : []).filter((gate) => Array.isArray(gate.preset) && gate.preset.includes('release'));
-        const byId = new Map(releaseNodes.map((gate) => [gate.id, gate]));
-        const dynamic = buildGateManifest(releaseNodes.map((gate) => gate.id));
-        return {
-            schema: 'sks.release-gate-manifest.v1.from-v2',
-            gates: dynamic.gates.map((entry) => {
-                const node = byId.get(entry.id);
-                const resource = Array.isArray(node?.resource) ? node.resource.join(',') : '';
-                return {
-                    ...entry,
-                    affected_by: usefulCacheInputs(node?.cache?.inputs, entry.affected_by),
-                    cost: node?.side_effect === 'real-env' || resource.includes('real') ? 'real' : entry.cost
-                };
-            })
-        };
-    }
-    const p = path.join(root, 'release-gates.json');
-    if (fs.existsSync(p))
-        return JSON.parse(fs.readFileSync(p, 'utf8'));
-    const dagSource = fs.readFileSync(path.join(root, 'src/scripts/release-parallel-check.ts'), 'utf8');
-    const dagIds = [...dagSource.matchAll(/task\('([^']+)'/g)].map((m) => m[1]);
-    const releaseCheckIds = [...String(pkg.scripts?.['release:check'] || '').matchAll(/npm run ([^\s&]+)/g)].map((m) => m[1]);
-    const ids = [...new Set([...dagIds, ...releaseCheckIds])].filter((id) => id && id !== 'build' && id !== 'release:check:parallel');
-    return buildGateManifest(ids);
-}
-function usefulCacheInputs(inputs, fallback) {
-    if (!Array.isArray(inputs) || !inputs.length)
-        return fallback;
-    if (inputs.some((input) => ['src/**', 'package.json', 'release-gates.v2.json', 'schemas/**'].includes(input)))
-        return fallback;
-    return inputs;
-}
-function hashAffectedFiles(globs) {
-    const regexes = (globs || []).map(globToRegExp);
-    const hashes = [];
-    for (const file of listTrackedFiles()) {
-        if (!regexes.some((re) => re.test(file)))
-            continue;
-        try {
-            const buf = fs.readFileSync(path.join(root, file));
-            hashes.push(`${file}:${crypto.createHash('sha256').update(buf).digest('hex').slice(0, 16)}`);
-        }
-        catch { }
-    }
-    return hashes;
-}
-function sha256(value) {
-    return crypto.createHash('sha256').update(String(value)).digest('hex');
-}
-function fileHash(rel) {
-    try {
-        return crypto.createHash('sha256').update(fs.readFileSync(path.join(root, rel))).digest('hex');
-    }
-    catch {
-        return 'missing';
-    }
-}
-function gateImplementationHash(id) {
-    const script = String(pkg.scripts?.[id] || '');
-    const match = script.match(/node\s+\.\/([^ ]+\.mjs)/);
-    if (match)
-        return fileHash(match[1]);
-    return sha256(script);
-}
-function npmVersionValue() {
-    const res = spawnSync('npm', ['--version'], { cwd: root, encoding: 'utf8' });
-    return res.status === 0 ? res.stdout.trim() : 'npm-unavailable';
-}
-function listTrackedFiles() {
-    if (TRACKED)
-        return TRACKED;
-    const res = spawnSync('git', ['ls-files'], { cwd: root, encoding: 'utf8' });
-    TRACKED = res.status === 0 ? res.stdout.split('\n').map((s) => s.trim()).filter(Boolean) : [];
-    return TRACKED;
-}
-function globToRegExp(glob) {
-    return new RegExp('^' + glob.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*\*/g, ' ').replace(/\*/g, '[^/]*').replace(/ /g, '.*') + '$');
-}
-function distHashValue() {
-    try {
-        const m = JSON.parse(fs.readFileSync(path.join(root, 'dist', 'build-manifest.json'), 'utf8'));
-        return String(m.source_digest || m.source_files_hash || m.version || 'no-dist');
-    }
-    catch {
-        return 'no-dist';
-    }
-}
-function gitHead() {
-    const res = spawnSync('git', ['rev-parse', 'HEAD'], { cwd: root, encoding: 'utf8' });
-    return res.status === 0 ? res.stdout.trim() : 'no-git';
-}
-function detectChangedFiles(base) {
-    try {
-        let ref = base;
-        if (!ref) {
-            const mb = spawnSync('git', ['merge-base', 'HEAD', 'origin/main'], { cwd: root, encoding: 'utf8' });
-            ref = mb.status === 0 ? mb.stdout.trim() : 'HEAD~1';
-        }
-        const diff = spawnSync('git', ['diff', '--name-only', `${ref}...HEAD`], { cwd: root, encoding: 'utf8' });
-        const status = spawnSync('git', ['status', '--porcelain'], { cwd: root, encoding: 'utf8' });
-        const files = new Set();
-        if (diff.status === 0)
-            diff.stdout.split('\n').map((s) => s.trim()).filter(Boolean).forEach((f) => files.add(f));
-        if (status.status === 0)
-            status.stdout.split('\n').map((s) => s.slice(3).trim()).filter(Boolean).forEach((f) => files.add(f));
-        return [...files];
-    }
-    catch {
-        return [];
-    }
-}
-function readArg(list, name) {
-    const i = list.indexOf(name);
-    return i >= 0 ? list[i + 1] || null : null;
-}
-function tail(value, limit = 4000) {
-    const text = String(value || '');
-    return text.length <= limit ? text : text.slice(-limit);
-}
-//# sourceMappingURL=release-check-dynamic-execute.js.map

package/dist/scripts/release-check-dynamic.js

@@ -1,107 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-// release:check:dynamic — change-aware gate planner. Runs only P0 always-on gates
-// plus gates whose affected_by globs match the changed files. Real/heavy gates are
-// deferred to release:real-check. Publish mode never skips required_for_publish gates.
-import fs from 'node:fs';
-import path from 'node:path';
-import { spawnSync } from 'node:child_process';
-import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
-const { buildGateManifest, selectGates } = await importDist('core/release/gate-manifest.js');
-const args = process.argv.slice(2);
-const publish = args.includes('--publish');
-const baseArg = readArg(args, '--base');
-const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
-// Prefer the checked-in v2 DAG manifest and normalize it for the legacy dynamic selector.
-const manifest = loadDynamicManifest();
-const changedFiles = detectChangedFiles(baseArg);
-const plan = selectGates(manifest.gates, changedFiles, { publish });
-// --- Hermetic invariant proofs (independent of the current git state) ---
-// 1) A docs-only change must NOT select any real/heavy gate.
-const docsOnly = selectGates(manifest.gates, ['docs/zellij-ui-design.md'], { publish: false });
-const realSelectedOnDocs = docsOnly.selected.filter((g) => g.cost === 'real' || g.cost === 'heavy');
-assertGate(realSelectedOnDocs.length === 0, 'docs-only change must not select real/heavy gates', { offenders: realSelectedOnDocs.map((g) => g.id) });
-// At least one heavy/real gate must be skipped on a docs-only change (proves narrowing).
-const skippedHeavy = docsOnly.skipped.length;
-assertGate(skippedHeavy > 0, 'docs-only change must skip at least one unrelated gate', { skipped: skippedHeavy });
-// 2) Publish mode must select every required_for_publish gate.
-const publishPlan = selectGates(manifest.gates, [], { publish: true });
-const requiredIds = manifest.gates.filter((g) => g.required_for_publish).map((g) => g.id);
-const selectedPublish = new Set(publishPlan.selected.map((g) => g.id));
-const missingRequired = requiredIds.filter((id) => !selectedPublish.has(id));
-assertGate(missingRequired.length === 0, 'publish mode must never skip required_for_publish gates', { missingRequired });
-const report = {
-    schema: 'sks.release-check-dynamic.v1',
-    ok: true,
-    mode: publish ? 'publish' : 'incremental',
-    base: baseArg || null,
-    changed_files: changedFiles,
-    selected: plan.selected.map((g) => g.id),
-    skipped: plan.skipped,
-    invariants: { docs_only_skips_heavy: true, publish_keeps_required: true }
-};
-const reportDir = path.join(root, '.sneakoscope', 'reports');
-fs.mkdirSync(reportDir, { recursive: true });
-fs.writeFileSync(path.join(reportDir, 'release-check-dynamic.json'), `${JSON.stringify(report, null, 2)}\n`);
-emitGate('release:check:dynamic', { selected: report.selected.length, skipped: report.skipped.length, changed_files: changedFiles.length, mode: report.mode });
-function readArg(list, name) {
-    const i = list.indexOf(name);
-    return i >= 0 ? list[i + 1] || null : null;
-}
-function loadDynamicManifest() {
-    const v2Path = path.join(root, 'release-gates.v2.json');
-    if (fs.existsSync(v2Path)) {
-        const parsed = JSON.parse(fs.readFileSync(v2Path, 'utf8'));
-        const releaseNodes = (Array.isArray(parsed.gates) ? parsed.gates : []).filter((gate) => Array.isArray(gate.preset) && gate.preset.includes('release'));
-        const byId = new Map(releaseNodes.map((gate) => [gate.id, gate]));
-        const dynamic = buildGateManifest(releaseNodes.map((gate) => gate.id));
-        return {
-            schema: 'sks.release-gate-manifest.v1.from-v2',
-            gates: dynamic.gates.map((entry) => {
-                const node = byId.get(entry.id);
-                const resource = Array.isArray(node?.resource) ? node.resource.join(',') : '';
-                return {
-                    ...entry,
-                    affected_by: usefulCacheInputs(node?.cache?.inputs, entry.affected_by),
-                    cost: node?.side_effect === 'real-env' || resource.includes('real') ? 'real' : entry.cost
-                };
-            })
-        };
-    }
-    const manifestPath = path.join(root, 'release-gates.json');
-    if (fs.existsSync(manifestPath))
-        return JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
-    const legacySource = fs.readFileSync(path.join(root, 'src/scripts/release-parallel-check.ts'), 'utf8');
-    const legacyIds = [...legacySource.matchAll(/task\('([^']+)'/g)].map((m) => m[1]);
-    const releaseCheckIds = [...String(pkg.scripts?.['release:check'] || '').matchAll(/npm run ([^\s&]+)/g)].map((m) => m[1]);
-    const ids = [...new Set([...legacyIds, ...releaseCheckIds])].filter((id) => id && id !== 'build' && id !== 'release:check:parallel');
-    return buildGateManifest(ids);
-}
-function usefulCacheInputs(inputs, fallback) {
-    if (!Array.isArray(inputs) || !inputs.length)
-        return fallback;
-    if (inputs.some((input) => ['src/**', 'package.json', 'release-gates.v2.json', 'schemas/**'].includes(input)))
-        return fallback;
-    return inputs;
-}
-function detectChangedFiles(base) {
-    try {
-        let ref = base;
-        if (!ref) {
-            const mb = spawnSync('git', ['merge-base', 'HEAD', 'origin/main'], { cwd: root, encoding: 'utf8' });
-            ref = mb.status === 0 ? mb.stdout.trim() : 'HEAD~1';
-        }
-        const diff = spawnSync('git', ['diff', '--name-only', `${ref}...HEAD`], { cwd: root, encoding: 'utf8' });
-        const status = spawnSync('git', ['status', '--porcelain'], { cwd: root, encoding: 'utf8' });
-        const files = new Set();
-        if (diff.status === 0)
-            diff.stdout.split('\n').map((s) => s.trim()).filter(Boolean).forEach((f) => files.add(f));
-        if (status.status === 0)
-            status.stdout.split('\n').map((s) => s.slice(3).trim()).filter(Boolean).forEach((f) => files.add(f));
-        return [...files];
-    }
-    catch {
-        return [];
-    }
-}
-//# sourceMappingURL=release-check-dynamic.js.map

package/dist/scripts/release-check-stamp.js

@@ -1,261 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { spawnSync } from 'node:child_process';
-import crypto from 'node:crypto';
-import fs from 'node:fs';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
-const stampPath = process.env.SKS_RELEASE_STAMP_PATH || path.join(root, '.sneakoscope', 'reports', 'release-check-stamp.json');
-const command = process.argv[2] || 'verify';
-const npmCmd = process.platform === 'win32' ? 'npm.cmd' : 'npm';
-function fail(message, detail = '') {
-    console.error(`Release check stamp failed: ${message}`);
-    if (detail)
-        console.error(detail.trim());
-    process.exit(2);
-}
-function readJson(rel) {
-    return JSON.parse(fs.readFileSync(path.join(root, rel), 'utf8'));
-}
-function sha256(value) {
-    return crypto.createHash('sha256').update(value).digest('hex');
-}
-function treeDigest(dir) {
-    if (!fs.existsSync(dir))
-        return { digest: null, file_count: 0 };
-    const files = [];
-    collectFiles(dir, files);
-    const hash = crypto.createHash('sha256');
-    for (const file of files.sort()) {
-        const rel = path.relative(dir, file).split(path.sep).join('/');
-        const stat = fs.statSync(file);
-        hash.update(rel);
-        hash.update('\0');
-        hash.update(String(stat.size));
-        hash.update('\0');
-        hash.update(sha256(fs.readFileSync(file)));
-        hash.update('\0');
-    }
-    return { digest: hash.digest('hex'), file_count: files.length };
-}
-function fileDigestForPackageFiles(pkg) {
-    const hash = crypto.createHash('sha256');
-    const files = Array.isArray(pkg.files) ? [...pkg.files].sort() : [];
-    for (const entry of files) {
-        const full = path.join(root, entry);
-        hash.update(entry);
-        hash.update('\0');
-        if (!fs.existsSync(full)) {
-            hash.update('missing\0');
-            continue;
-        }
-        const stat = fs.statSync(full);
-        if (stat.isDirectory()) {
-            const digest = treeDigest(full);
-            hash.update(`${digest.digest || 'empty'}:${digest.file_count}`);
-        }
-        else if (stat.isFile()) {
-            hash.update(sha256(fs.readFileSync(full)));
-        }
-        hash.update('\0');
-    }
-    return sha256(hash.digest('hex'));
-}
-function gitCommit() {
-    const result = spawnSync('git', ['rev-parse', 'HEAD'], { cwd: root, encoding: 'utf8' });
-    return result.status === 0 ? result.stdout.trim() : null;
-}
-function runRefreshCommand() {
-    const override = process.env.SKS_RELEASE_CHECK_REFRESH_COMMAND;
-    if (override) {
-        return spawnSync(override, {
-            cwd: root,
-            encoding: 'utf8',
-            env: process.env,
-            shell: true,
-            stdio: 'inherit'
-        });
-    }
-    return spawnSync(npmCmd, ['run', 'release:check:full'], {
-        cwd: root,
-        encoding: 'utf8',
-        env: process.env,
-        stdio: 'inherit'
-    });
-}
-function releaseGateHash(pkg) {
-    const manifests = ['release-gates.v2.json', 'release-gates.json'].map((rel) => {
-        const file = path.join(root, rel);
-        return fs.existsSync(file) ? `${rel}\0${fs.readFileSync(file, 'utf8')}` : `${rel}\0missing`;
-    }).join('\0');
-    return sha256(`${pkg.scripts?.['release:check'] || ''}\0${pkg.scripts?.['prepublishOnly'] || ''}\0${manifests}`);
-}
-function collectFiles(dir, out) {
-    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-        const file = path.join(dir, entry.name);
-        if (entry.isDirectory())
-            collectFiles(file, out);
-        else if (entry.isFile())
-            out.push(file);
-    }
-}
-function gitFiles() {
-    const result = spawnSync('git', ['ls-files', '-z', '--cached', '--others', '--exclude-standard'], {
-        cwd: root,
-        encoding: 'utf8'
-    });
-    if (result.status !== 0)
-        fail('unable to list release-relevant files', result.stderr || result.stdout);
-    return result.stdout.split('\0').filter(Boolean);
-}
-function releaseRelevant(file) {
-    if (!file || file.startsWith('.sneakoscope/') || file.startsWith('.codex/') || file.startsWith('.agents/'))
-        return false;
-    if (file.startsWith('node_modules/') || file.startsWith('dist/') || file.startsWith('coverage/'))
-        return false;
-    if (file.startsWith('crates/sks-core/target/'))
-        return false;
-    if (/\.tgz$|\.log$/i.test(file))
-        return false;
-    if (/^(package|package-lock)\.json$/.test(file))
-        return true;
-    if (/^release-gates(?:\.v2)?\.json$/.test(file))
-        return true;
-    if (/^tsconfig.*\.json$/.test(file))
-        return true;
-    if (/^(README|CHANGELOG|LICENSE)(\.md)?$/i.test(file))
-        return true;
-    return [
-        'bin/',
-        'src/',
-        'scripts/',
-        'test/',
-        'docs/',
-        'crates/sks-core/Cargo.',
-        'crates/sks-core/src/'
-    ].some((prefix) => file.startsWith(prefix));
-}
-function releaseSnapshot() {
-    const files = gitFiles().filter(releaseRelevant).sort();
-    const hash = crypto.createHash('sha256');
-    for (const file of files) {
-        const full = path.join(root, file);
-        let stat;
-        try {
-            stat = fs.statSync(full);
-        }
-        catch {
-            continue;
-        }
-        if (!stat.isFile())
-            continue;
-        const contentHash = sha256(fs.readFileSync(full));
-        hash.update(file);
-        hash.update('\0');
-        hash.update(String(stat.size));
-        hash.update('\0');
-        hash.update(contentHash);
-        hash.update('\0');
-    }
-    return {
-        digest: hash.digest('hex'),
-        file_count: files.length
-    };
-}
-function currentStampPayload() {
-    const pkg = readJson('package.json');
-    const snapshot = releaseSnapshot();
-    const dist = treeDigest(path.join(root, 'dist'));
-    return {
-        schema: 'sks.release-check-stamp.v1',
-        package_name: pkg.name,
-        package_version: pkg.version,
-        git_commit: gitCommit(),
-        package_json_sha256: sha256(fs.readFileSync(path.join(root, 'package.json'))),
-        package_files_sha256: fileDigestForPackageFiles(pkg),
-        dist_build_sha256: dist.digest,
-        dist_file_count: dist.file_count,
-        release_gate_sha256: releaseGateHash(pkg),
-        release_check_sha256: sha256(pkg.scripts?.['release:check'] || ''),
-        source_digest: snapshot.digest,
-        source_file_count: snapshot.file_count
-    };
-}
-function writeStamp() {
-    const payload = {
-        ...currentStampPayload(),
-        generated_at: new Date().toISOString()
-    };
-    fs.mkdirSync(path.dirname(stampPath), { recursive: true });
-    fs.writeFileSync(stampPath, `${JSON.stringify(payload, null, 2)}\n`);
-    console.log(`Release check stamp written: ${path.relative(root, stampPath)} (${payload.source_file_count} files)`);
-}
-function inspectStamp() {
-    if (!fs.existsSync(stampPath)) {
-        return {
-            ok: false,
-            message: 'missing release:check stamp',
-            detail: 'Run `npm run release:check:full` once, then rerun the publish command.'
-        };
-    }
-    let stamp;
-    try {
-        stamp = JSON.parse(fs.readFileSync(stampPath, 'utf8'));
-    }
-    catch (err) {
-        return {
-            ok: false,
-            message: 'unable to read release:check stamp',
-            detail: err.message
-        };
-    }
-    const current = currentStampPayload();
-    const mismatches = [];
-    for (const key of ['schema', 'package_name', 'package_version', 'package_json_sha256', 'package_files_sha256', 'dist_build_sha256', 'dist_file_count', 'release_gate_sha256', 'release_check_sha256', 'source_digest', 'source_file_count']) {
-        if (stamp[key] !== current[key])
-            mismatches.push(`${key}: stamp=${stamp[key] || 'missing'} current=${current[key] || 'missing'}`);
-    }
-    if (mismatches.length) {
-        return {
-            ok: false,
-            message: 'release:check stamp is stale',
-            detail: `${mismatches.join('\n')}\nRun \`npm run release:check:full\` again before publishing.`,
-            current
-        };
-    }
-    return { ok: true, current };
-}
-function verifyStamp() {
-    const result = inspectStamp();
-    if (!result.ok)
-        fail(result.message, result.detail);
-    const current = result.current;
-    console.log(`Release check stamp verified: ${path.relative(root, stampPath)} (${current.source_file_count} files)`);
-}
-function ensureStamp() {
-    const first = inspectStamp();
-    if (first.ok) {
-        console.log(`Release check stamp verified: ${path.relative(root, stampPath)} (${first.current.source_file_count} files)`);
-        return;
-    }
-    console.error('Release check stamp is not current; running full `npm run release:check:full` refresh.');
-    if (first.detail)
-        console.error(first.detail.trim());
-    const refresh = runRefreshCommand();
-    if (refresh.status !== 0)
-        process.exit(refresh.status || 1);
-    const second = inspectStamp();
-    if (!second.ok)
-        fail(second.message, second.detail);
-    console.log(`Release check stamp verified: ${path.relative(root, stampPath)} (${second.current.source_file_count} files)`);
-}
-if (command === 'write')
-    writeStamp();
-else if (command === 'verify')
-    verifyStamp();
-else if (command === 'ensure')
-    ensureStamp();
-else
-    fail(`unknown command ${command}`, 'Usage: node ./dist/scripts/release-check-stamp.js <write|verify|ensure>');
-//# sourceMappingURL=release-check-stamp.js.map

package/dist/scripts/release-gate-dag-runner.js

@@ -1,56 +0,0 @@
-#!/usr/bin/env node
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { runReleaseGateDag } from '../core/release/release-gate-dag.js';
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
-const args = process.argv.slice(2);
-const presetIndex = args.indexOf('--preset');
-const preset = presetIndex >= 0 ? args[presetIndex + 1] : 'release';
-const changedSinceIndex = args.indexOf('--changed-since');
-const changedSince = changedSinceIndex >= 0 ? (args[changedSinceIndex + 1] || null) : null;
-const slaIndex = args.indexOf('--sla');
-const slaMs = slaIndex >= 0 ? parseDurationMs(args[slaIndex + 1] || '') : null;
-const result = await runReleaseGateDag({
-    root,
-    ...(preset === undefined ? {} : { preset }),
-    changedSince,
-    slaMs,
-    full: args.includes('--full'),
-    explain: args.includes('--explain'),
-    noCache: args.includes('--no-cache'),
-    failFast: args.includes('--fail-fast'),
-    useGatePacks: args.includes('--use-gate-packs')
-});
-console.log(`SKS Release DAG
-  gates: ${result.total_gates} total, ${result.selected_gates} selected, ${result.cached} cached
-  affected: ${result.affected_selection?.mode || 'full'} selected=${result.selected_gate_ids.length} skipped=${result.skipped_by_affected.length}
-  concurrency: ${result.budget_summary}
-  peak_running: ${result.peak_running}
-  completed: ${result.completed} pass, ${result.failed} fail
-  wall: ${(result.wall_ms / 1000).toFixed(1)}s
-  parallelism_gain: ${result.parallelism_gain}
-  cpu_time_saved: ${(result.cpu_time_saved_ms / 1000).toFixed(1)}s
-  critical_path: ${(result.critical_path_ms / 1000).toFixed(1)}s
-  certificate: ${result.completion_certificate.confidence} sla=${(result.completion_certificate.sla_ms / 1000).toFixed(0)}s met=${result.completion_certificate.sla_met}
-  report: ${result.report_dir}`);
-if (!result.ok) {
-    for (const failure of result.failures) {
-        console.error(`[fail] ${failure.id} exit=${failure.exit_code}\n${failure.stderr_tail}`);
-    }
-    process.exit(1);
-}
-function parseDurationMs(value) {
-    const match = String(value || '').trim().match(/^(\d+(?:\.\d+)?)(ms|s|m)?$/i);
-    if (!match)
-        return null;
-    const amount = Number(match[1]);
-    const unit = (match[2] || 'ms').toLowerCase();
-    if (!Number.isFinite(amount) || amount <= 0)
-        return null;
-    if (unit === 'm')
-        return Math.floor(amount * 60_000);
-    if (unit === 's')
-        return Math.floor(amount * 1000);
-    return Math.floor(amount);
-}
-//# sourceMappingURL=release-gate-dag-runner.js.map