unknown-knowledge 2.1.0

package/payload/engine/validate-values.js

@@ -0,0 +1,34 @@
+#!/usr/bin/env node
+/**
+ * engine/validate-values.js — the entry shim (UCS-956).
+ *
+ * This file statically imports NOTHING. That is its entire job.
+ *
+ * Node exits 1 on an unhandled ES module load error, and exit 1 means FINDINGS
+ * (PRD §5). A SyntaxError in a lib/ module, or a missing `js-yaml`, must not
+ * tell an agent that the check ran and found problems. So the engine is reached
+ * only through `import()`, where a load failure is an ordinary catchable
+ * rejection rather than a process-level crash.
+ *
+ * Both specifiers are string literals naming the engine's own files. D-014
+ * forbids importing REPO CONTENT — the client's code — and nothing here can
+ * name it: there is no variable to point somewhere else.
+ *
+ * The command lives in commands/validate-values.js. Its invocation path is unchanged.
+ */
+try {
+  const [{ boot }, command] = await Promise.all([
+    import('./lib/boot.js'),
+    import('./commands/validate-values.js'),
+  ]);
+  // exitCode, never process.exit(): exit() drops queued async stdout writes, so
+  // piped --json output would truncate at the pipe buffer — corrupt output
+  // wearing a clean exit code. Node exits on its own once stdout drains.
+  process.exitCode = await boot('validate-values', command);
+} catch (error) {
+  // The engine could not be loaded, so no check ran. Exit 2 — never 1.
+  // Hardcoded, because reading it from lib/exit-codes.js is the very thing
+  // that may have just failed.
+  process.stderr.write(`validate-values: internal failure — the engine could not be loaded\n${error?.stack ?? error}\n`);
+  process.exitCode = 2;
+}

package/payload/engine/validate.js

@@ -0,0 +1,34 @@
+#!/usr/bin/env node
+/**
+ * engine/validate.js — the entry shim (UCS-956).
+ *
+ * This file statically imports NOTHING. That is its entire job.
+ *
+ * Node exits 1 on an unhandled ES module load error, and exit 1 means FINDINGS
+ * (PRD §5). A SyntaxError in a lib/ module, or a missing `js-yaml`, must not
+ * tell an agent that the check ran and found problems. So the engine is reached
+ * only through `import()`, where a load failure is an ordinary catchable
+ * rejection rather than a process-level crash.
+ *
+ * Both specifiers are string literals naming the engine's own files. D-014
+ * forbids importing REPO CONTENT — the client's code — and nothing here can
+ * name it: there is no variable to point somewhere else.
+ *
+ * The command lives in commands/validate.js. Its invocation path is unchanged.
+ */
+try {
+  const [{ boot }, command] = await Promise.all([
+    import('./lib/boot.js'),
+    import('./commands/validate.js'),
+  ]);
+  // exitCode, never process.exit(): exit() drops queued async stdout writes, so
+  // piped --json output would truncate at the pipe buffer — corrupt output
+  // wearing a clean exit code. Node exits on its own once stdout drains.
+  process.exitCode = await boot('validate', command);
+} catch (error) {
+  // The engine could not be loaded, so no check ran. Exit 2 — never 1.
+  // Hardcoded, because reading it from lib/exit-codes.js is the very thing
+  // that may have just failed.
+  process.stderr.write(`validate: internal failure — the engine could not be loaded\n${error?.stack ?? error}\n`);
+  process.exitCode = 2;
+}

package/payload/extractor-fixtures/README.md

@@ -0,0 +1,29 @@
+# extractor-fixtures — the D-009 shipped sample/expected pairs
+
+One directory per stack, one directory per extractor kind, each carrying a
+`sample.<ext>` anchor and the `EXPECTED.yaml` value set the kind must extract
+from it. These are the fixtures `npx unknown-knowledge init` seeds for the
+stacks you select (D-009) — they show, runnably, what each kind's syntactic
+envelope accepts, and they are the shape the §5.2 new-kind pipeline's DRAFT
+step imitates (see `templates/new-kind/`).
+
+Every sample is adversarial-but-extractable on purpose (PRD §5.1): comments
+between members, mixed quote styles, trailing commas, nested values — gnarly
+formatting that stays inside the envelope. Out-of-envelope shapes (spread,
+computed keys, re-exports) are NOT here: those hard-error by design and live
+in the kit's acceptance fixtures.
+
+`EXPECTED.yaml` fields: `kind` + `file` + `values`, plus `symbol`/`emit`/
+`pattern`/`strip` where the kind needs them — the same fields the descriptor
+would carry. Values are strings compared byte-exact, case-sensitive, as sets
+(§3.5): order in the file is presentation only.
+
+Directory kinds (dir-modules) reshape the pair the obvious way: the sample
+is a DIRECTORY (`file` names it, e.g. `sample-modules/`) instead of a single
+file, and the round-trip feeds the kind the deterministic listing
+(`listDirectory` in the engine's extractor-kinds registry) rather than file
+text. Everything else — adversarial-but-extractable contents, EXPECTED.yaml
+as the descriptor's fields — is unchanged.
+
+Kit CI pins every pair against the registered kind (tests/), so a sample and
+its expectation can never rot apart.

package/payload/extractor-fixtures/swift/strings-keys/EXPECTED.yaml

@@ -0,0 +1,8 @@
+# Expected extraction for sample.strings — strings-keys emits the KEYS of the
+# `"key" = "value";` entries (facet: key strings); values — including the one
+# carrying '=' and the one with escaped quotes — are skipped, never emitted.
+# Dispatch is by the source file's extension: .strings here (the .xcstrings
+# JSON-catalog side is exercised by the kit's acceptance fixtures).
+kind: strings-keys
+file: sample.strings
+values: [account.title, account.plan, editor.confirm, editor.cancel, editor.retry]

package/payload/extractor-fixtures/swift/strings-keys/sample.strings

@@ -0,0 +1,15 @@
+/* D-009 extractor fixture — strings-keys, .strings side (facet: the keys;
+   the .xcstrings side of the kind dispatches by file extension).
+   Adversarial-but-extractable: block + line comments, an '=' inside a value,
+   escaped quotes inside a value, two entries on one line, and a
+   commented-out pair that must NOT be extracted. Pair: EXPECTED.yaml. */
+
+/* Account */
+"account.title" = "Your account";
+"account.plan" = "Plan = seats x tier"; /* '=' inside the value */
+
+// "account.legacy" = "Old copy"; — commented-out pair, not a key
+
+/* Editor */
+"editor.confirm" = "Tap \"Insert\" to confirm"; // escaped quotes in the value
+"editor.cancel" = "Cancel"; "editor.retry" = "Retry"; // two entries on one line

package/payload/extractor-fixtures/swift/swift-const-array/EXPECTED.yaml

@@ -0,0 +1,7 @@
+# Expected extraction for sample.swift (§3.5: byte-exact, case-sensitive, as
+# a set — order here is presentation only). The commented-out entry and the
+# decoy sibling array never count.
+kind: swift-const-array
+file: sample.swift
+symbol: activeTemplateKinds
+values: [wireframe, moodboard, storyboard, flowchart, persona, brand-sheet]

package/payload/extractor-fixtures/swift/swift-const-array/sample.swift

@@ -0,0 +1,21 @@
+import Foundation
+
+enum TemplateCatalog {
+    /// D-009 extractor fixture — swift-const-array (facet: the element
+    /// strings). Adversarial-but-extractable: multi-line literal, line +
+    /// block comments between members, a commented-out entry, two values on
+    /// one line, a trailing comma, an explicit type annotation, and a decoy
+    /// sibling array. Pair: EXPECTED.yaml.
+    static let activeTemplateKinds: [String] = [
+        "wireframe",
+        "moodboard", // weekly refresh
+        // "sitemap",  — commented-out entry must NOT be extracted
+        "storyboard", /* narrative frames */
+        "flowchart", "persona", // two on one line
+        "brand-sheet",
+    ]
+
+    /// Decoy: an extractor scoped to `activeTemplateKinds` must never bleed
+    /// `retired-template` into its value set.
+    static let retiredTemplateKinds = ["retired-template"]
+}

package/payload/extractor-fixtures/swift/swift-enum/EXPECTED.yaml

@@ -0,0 +1,8 @@
+# Expected extraction for sample.swift — `emit: case-name` pins the facet
+# (§3.5): case names, not the SCREAMING_SNAKE raw values. The comma-joined
+# cases count; the switch arms and the decoy sibling enum never do.
+kind: swift-enum
+file: sample.swift
+symbol: RenderQuality
+emit: case-name
+values: [preview, balanced, high, draft, print]

package/payload/extractor-fixtures/swift/swift-enum/sample.swift

@@ -0,0 +1,30 @@
+import Foundation
+
+/// D-009 extractor fixture — swift-enum (facet pinned by `emit:` — this
+/// pair's EXPECTED.yaml pins `case-name`). Adversarial-but-extractable:
+/// an interior comment containing the word `case`, aligned `=` padding, a
+/// trailing comment with a stray " quote, a comma-joined case list, a
+/// computed property whose `switch` arms look like case declarations, and a
+/// decoy sibling enum. Pair: EXPECTED.yaml.
+enum RenderQuality: String, CaseIterable {
+    case preview  = "PREVIEW"
+    // The word case inside a comment — case in point — is not a declaration.
+    case balanced = "BALANCED" /* aligned '=' padding above */
+    case high     = "HIGH" // trailing comment with a stray " quote
+    case draft, print // comma-joined list; implicit raw values
+
+    var label: String {
+        switch self {
+        case .preview: return "Preview"
+        case .balanced: return "Balanced"
+        case .high: return "High"
+        case .draft: return "Draft"
+        case .print: return "Print"
+        }
+    }
+}
+
+/// Decoy: an extractor scoped to `RenderQuality` must never bleed `metal` in.
+enum RenderEngine: String {
+    case metal = "METAL"
+}

package/payload/extractor-fixtures/swift/yaml-keys/EXPECTED.yaml

@@ -0,0 +1,6 @@
+# Expected extraction for sample.yaml — yaml-keys emits the TOP-LEVEL keys
+# (facet: key strings). Nested keys, sequence members, and merge-key aliases
+# never leak in; "on" stays the string "on" (quoted here too, §3.5).
+kind: yaml-keys
+file: sample.yaml
+values: [service, defaults, limits, fallback, "on"]

package/payload/extractor-fixtures/swift/yaml-keys/sample.yaml

@@ -0,0 +1,23 @@
+# D-009 extractor fixture — yaml-keys (facet: the TOP-LEVEL keys).
+# Adversarial-but-extractable: comments between keys, an anchor/alias pair
+# with a merge key, nested maps and sequences whose child keys must NOT bleed
+# into the top-level set, and a quoted "on" key — YAML 1.2 loads it as the
+# string "on" (the 1.1 boolean coercion this kind coerce-refuses never
+# fires here). Pair: EXPECTED.yaml.
+service: renderer
+
+# Nested block: `region` / `retries` are NOT top-level keys.
+defaults: &renderer-defaults
+  region: us-east
+  retries: 3
+
+limits:
+  - daily
+  - weekly
+
+fallback:
+  <<: *renderer-defaults
+  retries: 5
+
+"on":
+  export: notify

package/payload/extractor-fixtures/swift/yaml-map-keys/EXPECTED.yaml

@@ -0,0 +1,7 @@
+# Expected extraction for sample.yaml — yaml-map-keys emits the keys of the
+# mapping at the dotted path (facet: key strings). The sibling flags.canvas
+# block never leaks in; the digit-leading key stays a byte-exact string.
+kind: yaml-map-keys
+file: sample.yaml
+symbol: flags.sharing
+values: [link-sharing, public-profiles, 2fa-required]

package/payload/extractor-fixtures/swift/yaml-map-keys/sample.yaml

@@ -0,0 +1,15 @@
+# D-009 extractor fixture — yaml-map-keys (facet: the keys of the mapping at
+# the descriptor's dotted `symbol:` path — here `flags.sharing`).
+# Adversarial-but-extractable: a sibling map whose keys must NOT bleed in, a
+# quoted digit-leading key ("2fa-required" — unquoted-lookalike, provably a
+# string), and boolean VALUES that must never be mistaken for the emitted
+# key set. Pair: EXPECTED.yaml.
+schema: 2
+flags:
+  sharing:
+    link-sharing: true
+    public-profiles: false # rollout paused
+    "2fa-required": true
+  canvas:
+    vector-networks: true
+    auto-layout: false

package/payload/extractor-fixtures/ts/dir-modules/EXPECTED.yaml

@@ -0,0 +1,12 @@
+# Expected extraction for sample-modules/ (§3.5: byte-exact, case-sensitive,
+# as a set — order here is presentation only). dir-modules is a DIRECTORY
+# kind: `file` names the sample directory, not a file, and the caller feeds
+# the kind a deterministic listing (see the extractor-fixtures README).
+# `pattern` pins the FILE facet (`*.widget.ts`: widgets.test.ts is excluded,
+# the helpers/ subdirectory is not part of the facet); `strip` removes the
+# `.widget.ts` suffix from every emitted name.
+kind: dir-modules
+file: sample-modules
+pattern: "*.widget.ts"
+strip: .widget.ts
+values: [alpha, beta, gamma]

package/payload/extractor-fixtures/ts/dir-modules/sample-modules/alpha.widget.ts

@@ -0,0 +1 @@
+export const widget = 'alpha';

package/payload/extractor-fixtures/ts/dir-modules/sample-modules/beta.widget.ts

@@ -0,0 +1 @@
+export const widget = 'beta';

package/payload/extractor-fixtures/ts/dir-modules/sample-modules/gamma.widget.ts

@@ -0,0 +1 @@
+export const widget = 'gamma';

package/payload/extractor-fixtures/ts/dir-modules/sample-modules/helpers/format.ts

@@ -0,0 +1,3 @@
+// helpers/ is a SUBDIRECTORY: with a pattern present the facet is matching
+// FILE names, so this folder (and its contents) never joins the value set.
+export const format = (s) => s;

package/payload/extractor-fixtures/ts/dir-modules/sample-modules/widgets.test.ts

@@ -0,0 +1,2 @@
+// Excluded by the `*.widget.ts` pattern — test scenery beside the modules.
+export const isTest = true;

package/payload/extractor-fixtures/ts/json-keys/EXPECTED.yaml

@@ -0,0 +1,7 @@
+# Expected extraction for sample.json — json-keys emits the TOP-LEVEL keys
+# (facet: key strings). Boolean/nested values never coerce into the set; the
+# nested max-variants key must not leak in. (JSON cannot carry comments, so
+# this pair's adversarial content is nesting, not formatting.)
+kind: json-keys
+file: sample.json
+values: [multiplayer-cursors, version-history, component-variants]

package/payload/extractor-fixtures/ts/json-keys/sample.json

@@ -0,0 +1,5 @@
+{
+  "multiplayer-cursors": true,
+  "version-history": false,
+  "component-variants": { "max-variants": 10 }
+}

package/payload/extractor-fixtures/ts/json-map-keys/EXPECTED.yaml

@@ -0,0 +1,7 @@
+# Expected extraction for sample.json — json-map-keys emits the keys of the
+# object at the descriptor's dotted `symbol:` path (facet: key strings).
+# Sibling blocks (scripts) must not leak in.
+kind: json-map-keys
+file: sample.json
+symbol: config.flags
+values: [multiplayer-cursors, version-history, component-variants]

package/payload/extractor-fixtures/ts/json-map-keys/sample.json

@@ -0,0 +1,13 @@
+{
+  "name": "sample-app",
+  "config": {
+    "flags": {
+      "multiplayer-cursors": true,
+      "version-history": true,
+      "component-variants": false
+    }
+  },
+  "scripts": {
+    "dev": "vite"
+  }
+}

package/payload/extractor-fixtures/ts/ts-const-array/EXPECTED.yaml

@@ -0,0 +1,6 @@
+# Expected extraction for sample.ts (§3.5: byte-exact, case-sensitive, as a
+# set — order here is presentation only).
+kind: ts-const-array
+file: sample.ts
+symbol: EXPORT_FORMATS
+values: [png, svg, jpg, webp]

package/payload/extractor-fixtures/ts/ts-const-array/sample.ts

@@ -0,0 +1,13 @@
+// D-009 extractor fixture — ts-const-array (facet: the element strings of an
+// exported const array literal; reads .js the same way — kinds describe
+// declaration shape, not file type). Adversarial-but-extractable: multi-line,
+// trailing comma, line + block comments between members, mixed quote styles,
+// `as const`. Pair: EXPECTED.yaml.
+export const EXPORT_FORMATS = [
+  'png', // raster default
+  "svg",
+  'jpg', /* legacy raster */
+  'webp',
+] as const;
+
+export type ExportFormat = (typeof EXPORT_FORMATS)[number];

package/payload/extractor-fixtures/ts/ts-enum/EXPECTED.yaml

@@ -0,0 +1,7 @@
+# Expected extraction for sample.ts — `emit: names` pins the facet (§3.5):
+# member names, not the lowercase raw values.
+kind: ts-enum
+file: sample.ts
+symbol: ColorSpace
+emit: names
+values: [SRGB, P3, LAB, LCH]

package/payload/extractor-fixtures/ts/ts-enum/sample.ts

@@ -0,0 +1,11 @@
+// D-009 extractor fixture — ts-enum. TWO legitimate facets (member NAMES vs
+// raw string VALUES); the descriptor pins one with `emit:` (§3.5) — this
+// pair pins `emit: names`, so the expected set is the uppercase names, not
+// the lowercase raw values. Adversarial-but-extractable: string initializers,
+// mixed quotes, interleaved comment, trailing comma. Pair: EXPECTED.yaml.
+export enum ColorSpace {
+  SRGB = 'srgb',
+  P3 = "display-p3", // wide gamut
+  LAB = 'lab',
+  LCH = 'lch',
+}

package/payload/extractor-fixtures/ts/ts-object-keys/EXPECTED.yaml

@@ -0,0 +1,6 @@
+# Expected extraction for sample.tsx — top-level keys only: the nested
+# appliesTo array's members and the JSX inline literal must not leak in.
+kind: ts-object-keys
+file: sample.tsx
+symbol: PANELS
+values: [layers-panel, inspector, assets-panel, comments]

package/payload/extractor-fixtures/ts/ts-object-keys/sample.tsx

@@ -0,0 +1,23 @@
+// D-009 extractor fixture — ts-object-keys (facet: the TOP-LEVEL keys of an
+// exported object literal; nested objects/arrays are values, never keys).
+// The .tsx extension is deliberate (§5.1: kinds describe declaration shape,
+// not file type) and the JSX below plants an inline object literal
+// ({{ color: ... }}) OUTSIDE the anchored symbol's span — it must not match.
+// Adversarial-but-extractable: quoted dashed keys, bare keys, nested object
+// and nested array values. Pair: EXPECTED.yaml.
+export const PANELS = {
+  'layers-panel': { defaultWidth: 240 },
+  inspector: { defaultWidth: 280 },
+  "assets-panel": {
+    appliesTo: ['editor', 'whiteboard'], // nested array — not top-level keys
+  },
+  comments: { defaultWidth: 320 },
+};
+
+export function PanelTag({ id }: { id: keyof typeof PANELS }) {
+  return (
+    <span className="panel-tag" style={{ color: '#1db954' }}>
+      {id}
+    </span>
+  );
+}

package/payload/extractor-fixtures/ts/ts-union/EXPECTED.yaml

@@ -0,0 +1,5 @@
+# Expected extraction for sample.ts (§3.5 set equality).
+kind: ts-union
+file: sample.ts
+symbol: ReleaseStatus
+values: [draft, in-review, published, deprecated]

package/payload/extractor-fixtures/ts/ts-union/sample.ts

@@ -0,0 +1,9 @@
+// D-009 extractor fixture — ts-union (facet: the string-literal members of a
+// type union). Adversarial-but-extractable: leading-pipe multi-line union
+// with an interleaved comment. Pair: EXPECTED.yaml.
+export type ReleaseStatus =
+  | 'draft'
+  | 'in-review'
+  // terminal states below
+  | 'published'
+  | 'deprecated';

package/payload/hooks/pre-commit

@@ -0,0 +1,37 @@
+#!/bin/sh
+# unknown-knowledge pre-commit hook — blocking validation (UCS-1157).
+#
+# THIN BY CONSTRUCTION. This wrapper invokes one engine command and exits
+# with its code, unchanged. It computes no verdict, suppresses no finding,
+# and has no mode that makes it pass — there is deliberately no bypass
+# variable to read, because a hook with an off switch enforces nothing.
+# Protocol compliance is a property of the mechanism, not of agent
+# obedience: the same validator CI runs, run before the commit exists.
+#
+# Not a test seam. The tested surface is the wrapped command
+# (`engine/validate.js`, tests/validate.test.js); testing it IS testing
+# this hook, because this file adds nothing to test. Wiring is reviewed
+# the way the per-IDE wrappers are — read it once, confirm it is a
+# pointer, and trust the command it points at.
+#
+# Wire it (the client's own git config — the kit never writes .git/):
+#   ln -s ../../unknown-knowledge/hooks/pre-commit .git/hooks/pre-commit
+# or set core.hooksPath at the seeded directory. Either way the client
+# opts in: seeding a hook is not installing one.
+#
+# Exit codes are the engine's, propagated verbatim (PRD §5):
+#   0 — the store is structurally sound; the commit proceeds.
+#   1 — the check ran and found something; the commit is refused.
+#   2 — the check never ran; the commit is refused. A check that never
+#       ran is a blocking defect, never a silent pass.
+#
+# KIT_DIR names the seeded root when it is not the default; UK_ROOT names
+# the repo root when the hook runs from elsewhere. Both are location
+# arguments, never gate arguments — neither can turn the check off.
+set -u
+
+KIT_DIR="${KIT_DIR:-unknown-knowledge}"
+UK_ROOT="${UK_ROOT:-.}"
+
+node "$UK_ROOT/$KIT_DIR/engine/validate.js" --root "$UK_ROOT"
+exit $?

package/payload/hooks/reverse-lookup

@@ -0,0 +1,66 @@
+#!/bin/sh
+# unknown-knowledge reverse-lookup hook — automatic attribution (UCS-1157).
+#
+# THIN BY CONSTRUCTION, exactly like the pre-commit hook: it collects the
+# touched paths git already knows about and hands them to one engine
+# command, exiting with that command's code, unchanged. It reads no leaf,
+# joins nothing, and decides nothing — `engine/resolve.js --paths` is what
+# answers "which leaves and concepts govern this file", and the answer is
+# its output, not this script's.
+#
+# This is the AGENTS.md ACT step (attribute before committing) made
+# automatic. An agent can forget to run the reverse lookup; a hook cannot.
+# That is the whole point: the protocol rides along invisibly rather than
+# depending on anyone remembering it.
+#
+# Not a test seam. The tested surface is the wrapped command
+# (`engine/resolve.js --paths`, tests/resolve.test.js and
+# tests/typed-edges.test.js) — this file adds no behavior to test, and the
+# wiring is reviewed like the per-IDE wrappers.
+#
+# Wire it with an EVENT-NAMED symlink — git runs a hook only if its
+# filename is one of the events git fires, and `reverse-lookup` is not one
+# of them. That matters most under `core.hooksPath` pointed at the seeded
+# directory: git looks there for event names only, so this file would sit
+# next to `pre-commit` and never fire. Give it an event:
+#
+#   ln -s ../../unknown-knowledge/hooks/reverse-lookup .git/hooks/prepare-commit-msg
+#
+# (`prepare-commit-msg` runs after the index is staged and before the
+# message editor opens, which is when attribution is still actionable. Git
+# passes it the message file and source as arguments; this script ignores
+# them and reads the staged diff itself.) Under `core.hooksPath` wiring,
+# call it explicitly from your `pre-commit` instead. Either way, wiring it
+# into git is the client's own act — the seeded artifact is the script.
+#
+# Exit codes are the engine's, propagated verbatim (PRD §5):
+#   0 — the lookup ran (including a zero-hit lookup, which is a real
+#       answer: nothing in the store governs these files).
+#   2 — the lookup never ran.
+# `resolve.js` never exits 1: reporting what governs a path is not a
+# finding, and this hook is attribution, never a gate. What it prints is
+# what the ACT step obliges you to act on.
+#
+# With no staged changes there is nothing to attribute, so the hook exits
+# 0 without invoking the engine — `--paths` with an empty list is a usage
+# error (exit 2), and an empty diff is not a failure.
+#
+# git's own status is checked BEFORE the join. In a pipeline the shell
+# reports the LAST command's status, so `git diff | paste` would report
+# paste's success even when git failed — leaving PATHS empty and the hook
+# exiting 0 on a lookup that never ran. That is the silent pass this whole
+# design refuses, so the two steps are separate and git's code is read.
+set -u
+
+KIT_DIR="${KIT_DIR:-unknown-knowledge}"
+UK_ROOT="${UK_ROOT:-.}"
+
+STAGED=$(git diff --cached --name-only --diff-filter=ACMR) || {
+  echo "reverse-lookup: git diff failed — the staged paths could not be read, so the lookup never ran" >&2
+  exit 2
+}
+[ -z "$STAGED" ] && exit 0
+PATHS=$(printf '%s' "$STAGED" | paste -sd, -)
+
+node "$UK_ROOT/$KIT_DIR/engine/resolve.js" --paths "$PATHS" --root "$UK_ROOT"
+exit $?

package/payload/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}