wingfoil 0.2.1 → 0.3.0

package/dist/validation/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.matchesIgnoreGlob = exports.loadIgnoreGlobs = exports.isBinaryContent = exports.scanProjectSurface = exports.scanText = exports.DEFAULT_IGNORE_FILE = exports.SCAN_SURFACE_ROOTS = exports.SECRET_PATTERNS = exports.parseYaml = exports.ID_CHAR_CLASS = exports.patternToRegExp = exports.generateId = exports.runValidation = exports.emitUnknownFieldWarning = exports.toValidationError = exports.ValidationError = exports.EXIT_VALIDATION = exports.EXIT_INTEGRITY = exports.E_YAML_PARSE_ERROR = exports.E_VALIDATION = void 0;
+exports.matchesIgnoreGlob = exports.loadIgnoreGlobs = exports.isBinaryContent = exports.scanProjectSurface = exports.scanText = exports.DEFAULT_IGNORE_FILE = exports.SCAN_SURFACE_ROOTS = exports.SECRET_PATTERNS = exports.refuseNewerFormat = exports.newerFormatMessage = exports.newerFormatIssue = exports.isNewerFormatError = exports.formatField = exports.WORKFLOWS_YAML_FORMAT = exports.WORKFLOW_FORMAT = exports.ROLES_YAML_FORMAT = exports.MEMORY_YAML_FORMAT = exports.MEMORY_TEMPLATE_FORMAT = exports.E_INVALID_FORMAT = exports.DNA_YAML_FORMAT = exports.DIRECTIVE_FORMAT = exports.ADAPTER_MANIFEST_FORMAT = exports.isBlankIdentityName = exports.isAttributableIdentity = exports.hasReservedDomain = exports.attributionEmailIssue = exports.isVersionIncrease = exports.parseYaml = exports.ID_CHAR_CLASS = exports.patternToSource = exports.patternToRegExp = exports.patternTokens = exports.isNumericToken = exports.isIdPiece = exports.idPatternIssues = exports.generateId = exports.runValidation = exports.withWarningSink = exports.reportWarning = exports.emitUnknownFieldWarning = exports.toValidationError = exports.formatDiagnostic = exports.DiagnosticsError = exports.ValidationError = exports.EXIT_VALIDATION = exports.EXIT_INTEGRITY = exports.E_YAML_PARSE_ERROR = exports.E_VALIDATION = void 0;
 /**
  * `src/validation` — the shared validation & ID module (spec-009-validation-strategy,
  * task-002-validation-id-engine). Single entry point every schema (spec-001/002/003 and the
@@ -13,18 +13,50 @@ Object.defineProperty(exports, "E_YAML_PARSE_ERROR", { enumerable: true, get: fu
 Object.defineProperty(exports, "EXIT_INTEGRITY", { enumerable: true, get: function () { return errors_1.EXIT_INTEGRITY; } });
 Object.defineProperty(exports, "EXIT_VALIDATION", { enumerable: true, get: function () { return errors_1.EXIT_VALIDATION; } });
 Object.defineProperty(exports, "ValidationError", { enumerable: true, get: function () { return errors_1.ValidationError; } });
+var diagnostic_1 = require("./diagnostic");
+Object.defineProperty(exports, "DiagnosticsError", { enumerable: true, get: function () { return diagnostic_1.DiagnosticsError; } });
+Object.defineProperty(exports, "formatDiagnostic", { enumerable: true, get: function () { return diagnostic_1.formatDiagnostic; } });
 var error_mapper_1 = require("./error-mapper");
 Object.defineProperty(exports, "toValidationError", { enumerable: true, get: function () { return error_mapper_1.toValidationError; } });
 var warning_1 = require("./warning");
 Object.defineProperty(exports, "emitUnknownFieldWarning", { enumerable: true, get: function () { return warning_1.emitUnknownFieldWarning; } });
+Object.defineProperty(exports, "reportWarning", { enumerable: true, get: function () { return warning_1.reportWarning; } });
+Object.defineProperty(exports, "withWarningSink", { enumerable: true, get: function () { return warning_1.withWarningSink; } });
 var two_pass_1 = require("./two-pass");
 Object.defineProperty(exports, "runValidation", { enumerable: true, get: function () { return two_pass_1.runValidation; } });
 var id_1 = require("./id");
 Object.defineProperty(exports, "generateId", { enumerable: true, get: function () { return id_1.generateId; } });
+Object.defineProperty(exports, "idPatternIssues", { enumerable: true, get: function () { return id_1.idPatternIssues; } });
+Object.defineProperty(exports, "isIdPiece", { enumerable: true, get: function () { return id_1.isIdPiece; } });
+Object.defineProperty(exports, "isNumericToken", { enumerable: true, get: function () { return id_1.isNumericToken; } });
+Object.defineProperty(exports, "patternTokens", { enumerable: true, get: function () { return id_1.patternTokens; } });
 Object.defineProperty(exports, "patternToRegExp", { enumerable: true, get: function () { return id_1.patternToRegExp; } });
+Object.defineProperty(exports, "patternToSource", { enumerable: true, get: function () { return id_1.patternToSource; } });
 Object.defineProperty(exports, "ID_CHAR_CLASS", { enumerable: true, get: function () { return id_1.ID_CHAR_CLASS; } });
 var yaml_1 = require("./yaml");
 Object.defineProperty(exports, "parseYaml", { enumerable: true, get: function () { return yaml_1.parseYaml; } });
+var config_version_1 = require("./config-version");
+Object.defineProperty(exports, "isVersionIncrease", { enumerable: true, get: function () { return config_version_1.isVersionIncrease; } });
+var identity_1 = require("./identity");
+Object.defineProperty(exports, "attributionEmailIssue", { enumerable: true, get: function () { return identity_1.attributionEmailIssue; } });
+Object.defineProperty(exports, "hasReservedDomain", { enumerable: true, get: function () { return identity_1.hasReservedDomain; } });
+Object.defineProperty(exports, "isAttributableIdentity", { enumerable: true, get: function () { return identity_1.isAttributableIdentity; } });
+Object.defineProperty(exports, "isBlankIdentityName", { enumerable: true, get: function () { return identity_1.isBlankIdentityName; } });
+var format_1 = require("./format");
+Object.defineProperty(exports, "ADAPTER_MANIFEST_FORMAT", { enumerable: true, get: function () { return format_1.ADAPTER_MANIFEST_FORMAT; } });
+Object.defineProperty(exports, "DIRECTIVE_FORMAT", { enumerable: true, get: function () { return format_1.DIRECTIVE_FORMAT; } });
+Object.defineProperty(exports, "DNA_YAML_FORMAT", { enumerable: true, get: function () { return format_1.DNA_YAML_FORMAT; } });
+Object.defineProperty(exports, "E_INVALID_FORMAT", { enumerable: true, get: function () { return format_1.E_INVALID_FORMAT; } });
+Object.defineProperty(exports, "MEMORY_TEMPLATE_FORMAT", { enumerable: true, get: function () { return format_1.MEMORY_TEMPLATE_FORMAT; } });
+Object.defineProperty(exports, "MEMORY_YAML_FORMAT", { enumerable: true, get: function () { return format_1.MEMORY_YAML_FORMAT; } });
+Object.defineProperty(exports, "ROLES_YAML_FORMAT", { enumerable: true, get: function () { return format_1.ROLES_YAML_FORMAT; } });
+Object.defineProperty(exports, "WORKFLOW_FORMAT", { enumerable: true, get: function () { return format_1.WORKFLOW_FORMAT; } });
+Object.defineProperty(exports, "WORKFLOWS_YAML_FORMAT", { enumerable: true, get: function () { return format_1.WORKFLOWS_YAML_FORMAT; } });
+Object.defineProperty(exports, "formatField", { enumerable: true, get: function () { return format_1.formatField; } });
+Object.defineProperty(exports, "isNewerFormatError", { enumerable: true, get: function () { return format_1.isNewerFormatError; } });
+Object.defineProperty(exports, "newerFormatIssue", { enumerable: true, get: function () { return format_1.newerFormatIssue; } });
+Object.defineProperty(exports, "newerFormatMessage", { enumerable: true, get: function () { return format_1.newerFormatMessage; } });
+Object.defineProperty(exports, "refuseNewerFormat", { enumerable: true, get: function () { return format_1.refuseNewerFormat; } });
 var secret_scan_1 = require("./secret-scan");
 Object.defineProperty(exports, "SECRET_PATTERNS", { enumerable: true, get: function () { return secret_scan_1.SECRET_PATTERNS; } });
 Object.defineProperty(exports, "SCAN_SURFACE_ROOTS", { enumerable: true, get: function () { return secret_scan_1.SCAN_SURFACE_ROOTS; } });

package/dist/validation/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/validation/index.ts"],"names":[],"mappings":";;;AAAA;;;;;GAKG;AACH,mCAMkB;AALhB,sGAAA,YAAY,OAAA;AACZ,4GAAA,kBAAkB,OAAA;AAClB,wGAAA,cAAc,OAAA;AACd,yGAAA,eAAe,OAAA;AACf,yGAAA,eAAe,OAAA;AAGjB,+CAAmD;AAA1C,iHAAA,iBAAiB,OAAA;AAC1B,qCAAoD;AAA3C,kHAAA,uBAAuB,OAAA;AAEhC,uCAA2C;AAAlC,yGAAA,aAAa,OAAA;AAEtB,2BAAkE;AAAzD,gGAAA,UAAU,OAAA;AAAE,qGAAA,eAAe,OAAA;AAAE,mGAAA,aAAa,OAAA;AACnD,+BAAmC;AAA1B,iGAAA,SAAS,OAAA;AAClB,6CASuB;AARrB,8GAAA,eAAe,OAAA;AACf,iHAAA,kBAAkB,OAAA;AAClB,kHAAA,mBAAmB,OAAA;AACnB,uGAAA,QAAQ,OAAA;AACR,iHAAA,kBAAkB,OAAA;AAClB,8GAAA,eAAe,OAAA;AACf,8GAAA,eAAe,OAAA;AACf,gHAAA,iBAAiB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/validation/index.ts"],"names":[],"mappings":";;;AAAA;;;;;GAKG;AACH,mCAMkB;AALhB,sGAAA,YAAY,OAAA;AACZ,4GAAA,kBAAkB,OAAA;AAClB,wGAAA,cAAc,OAAA;AACd,yGAAA,eAAe,OAAA;AACf,yGAAA,eAAe,OAAA;AAGjB,2CAAkE;AAAzD,8GAAA,gBAAgB,OAAA;AAAE,8GAAA,gBAAgB,OAAA;AAE3C,+CAAmD;AAA1C,iHAAA,iBAAiB,OAAA;AAC1B,qCAAoF;AAA3E,kHAAA,uBAAuB,OAAA;AAAE,wGAAA,aAAa,OAAA;AAAE,0GAAA,eAAe,OAAA;AAEhE,uCAA2C;AAAlC,yGAAA,aAAa,OAAA;AAEtB,2BAA8I;AAArI,gGAAA,UAAU,OAAA;AAAE,qGAAA,eAAe,OAAA;AAAE,+FAAA,SAAS,OAAA;AAAE,oGAAA,cAAc,OAAA;AAAE,mGAAA,aAAa,OAAA;AAAE,qGAAA,eAAe,OAAA;AAAE,qGAAA,eAAe,OAAA;AAAE,mGAAA,aAAa,OAAA;AAC/H,+BAAmC;AAA1B,iGAAA,SAAS,OAAA;AAClB,mDAAqD;AAA5C,mHAAA,iBAAiB,OAAA;AAC1B,uCAAmH;AAA1G,iHAAA,qBAAqB,OAAA;AAAE,6GAAA,iBAAiB,OAAA;AAAE,kHAAA,sBAAsB,OAAA;AAAE,+GAAA,mBAAmB,OAAA;AAE9F,mCAekB;AAdhB,iHAAA,uBAAuB,OAAA;AACvB,0GAAA,gBAAgB,OAAA;AAChB,yGAAA,eAAe,OAAA;AACf,0GAAA,gBAAgB,OAAA;AAChB,gHAAA,sBAAsB,OAAA;AACtB,4GAAA,kBAAkB,OAAA;AAClB,2GAAA,iBAAiB,OAAA;AACjB,yGAAA,eAAe,OAAA;AACf,+GAAA,qBAAqB,OAAA;AACrB,qGAAA,WAAW,OAAA;AACX,4GAAA,kBAAkB,OAAA;AAClB,0GAAA,gBAAgB,OAAA;AAChB,4GAAA,kBAAkB,OAAA;AAClB,2GAAA,iBAAiB,OAAA;AAEnB,6CASuB;AARrB,8GAAA,eAAe,OAAA;AACf,iHAAA,kBAAkB,OAAA;AAClB,kHAAA,mBAAmB,OAAA;AACnB,uGAAA,QAAQ,OAAA;AACR,iHAAA,kBAAkB,OAAA;AAClB,8GAAA,eAAe,OAAA;AACf,8GAAA,eAAe,OAAA;AACf,gHAAA,iBAAiB,OAAA"}

package/dist/validation/secret-scan.d.ts

@@ -74,19 +74,22 @@ export interface ScanTextOptions {
 /**
  * Scan one file's already-decoded text content (spec-007 §4): evaluate {@link SECRET_PATTERNS} in
  * declared order against every line, apply the §3 exclusions, and classify each surviving finding by
- * severity. This is the seam a future commit-time gate or `task-044`'s `init` integrity check calls
- * per file-about-to-be-written/committed (spec-007 §4 step 5).
+ * severity. This is the seam spec-007 §4 step 5's callers use per file about to be written or
+ * committed: `init`'s pre-write pass over the built-in templates calls it (`verifyBuiltinTemplates`,
+ * `src/core/builtin-integrity.ts`, task-135), and a future commit-time gate would.
  */
 export declare function scanText(content: string, filePath: string, options?: ScanTextOptions): ScanResult;
 /** Null-byte sniff on the first 8KB (spec-007 §1) — binary files are out of scan scope. */
 export declare function isBinaryContent(buf: Buffer): boolean;
 /**
- * Default scan-surface roots (spec-007 §1): `.wingfoil/` once `init` exists, plus the current
- * self-hosted analog (`docs/self/.wingfoil/`, `docs/self/docs/04_memory/`) "applied by analogy until
- * the tool-managed root exists". A root with no indexed files contributes nothing, so
- * {@link scanProjectSurface} is safe to call before `init` has ever run.
+ * Default scan-surface roots (spec-007 §1): `.wingfoil/` once `init` exists, plus `docs/04_memory/`,
+ * this repository's own Memory folder — spec-007 §1's self-hosted analog, which followed the
+ * configuration to the repository root in `task-111-configuration-moves-to-the-repository-root`
+ * (before it, the analog named the nested dogfooding copies of both folders). A root with no indexed
+ * files contributes nothing, so {@link scanProjectSurface} is safe to call before `init` has ever run,
+ * and on a project whose Memory lives elsewhere.
  */
-export declare const SCAN_SURFACE_ROOTS: readonly [".wingfoil", "docs/self/.wingfoil", "docs/self/docs/04_memory"];
+export declare const SCAN_SURFACE_ROOTS: readonly [".wingfoil", "docs/04_memory"];
 /** Default path (root-relative) of the `security-ignore` glob list (spec-007 §3). */
 export declare const DEFAULT_IGNORE_FILE = ".wingfoil/security-ignore";
 /**

package/dist/validation/secret-scan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-scan.d.ts","sourceRoot":"","sources":["../../src/validation/secret-scan.ts"],"names":[],"mappings":"AAmBA,2FAA2F;AAC3F,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,MAAM,CAAC;AAE9C,6FAA6F;AAC7F,MAAM,WAAW,aAAa;IAC5B,uFAAuF;IACvF,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,sFAAsF;IACtF,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,oGAAoG;IACpG,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,aAAa,EA8EnD,CAAC;AAEF,oGAAoG;AACpG,MAAM,MAAM,YAAY,GAAG,gBAAgB,GAAG,mBAAmB,GAAG,aAAa,CAAC;AAElF,8FAA8F;AAC9F,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,6FAA6F;IAC7F,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2BAA2B;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,yCAAyC;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6BAA6B;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,0GAA0G;AAC1G,MAAM,WAAW,aAAc,SAAQ,aAAa;IAClD,kDAAkD;IAClD,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;CACrC;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;IAC5C,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;IAC5C,0FAA0F;IAC1F,QAAQ,CAAC,IAAI,EAAE,SAAS,aAAa,EAAE,CAAC;IACxC;;;;;;;;;OASG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,oCAAoC;AACpC,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAChC;AAwDD;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,UAAU,CA2CrG;AAYD,2FAA2F;AAC3F,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAGpD;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,2EAA4E,CAAC;AAE5G,qFAAqF;AACrF,eAAO,MAAM,mBAAmB,8BAA8B,CAAC;AAoE/D;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAMhE;AA8BD,0GAA0G;AAC1G,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAErF;AAED,8CAA8C;AAC9C,MAAM,WAAW,kBAAkB;IACjC,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,mGAAmG;IACnG,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GAAG,UAAU,CAY7F"}
+{"version":3,"file":"secret-scan.d.ts","sourceRoot":"","sources":["../../src/validation/secret-scan.ts"],"names":[],"mappings":"AAqBA,2FAA2F;AAC3F,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,MAAM,CAAC;AAE9C,6FAA6F;AAC7F,MAAM,WAAW,aAAa;IAC5B,uFAAuF;IACvF,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,sFAAsF;IACtF,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,oGAAoG;IACpG,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAWD;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,aAAa,EA2FnD,CAAC;AAEF,oGAAoG;AACpG,MAAM,MAAM,YAAY,GAAG,gBAAgB,GAAG,mBAAmB,GAAG,aAAa,CAAC;AAElF,8FAA8F;AAC9F,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,6FAA6F;IAC7F,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2BAA2B;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,yCAAyC;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6BAA6B;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,0GAA0G;AAC1G,MAAM,WAAW,aAAc,SAAQ,aAAa;IAClD,kDAAkD;IAClD,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;CACrC;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;IAC5C,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;IAC5C,0FAA0F;IAC1F,QAAQ,CAAC,IAAI,EAAE,SAAS,aAAa,EAAE,CAAC;IACxC;;;;;;;;;OASG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,oCAAoC;AACpC,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAChC;AAwDD;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,UAAU,CA2CrG;AAYD,2FAA2F;AAC3F,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAGpD;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,0CAA2C,CAAC;AAE3E,qFAAqF;AACrF,eAAO,MAAM,mBAAmB,8BAA8B,CAAC;AAoE/D;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAMhE;AA8BD,0GAA0G;AAC1G,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAErF;AAED,8CAA8C;AAC9C,MAAM,WAAW,kBAAkB;IACjC,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,mGAAmG;IACnG,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GAAG,UAAU,CAY7F"}

package/dist/validation/secret-scan.js

@@ -13,10 +13,12 @@ exports.scanProjectSurface = scanProjectSurface;
  * `wingfoil audit`) re-implements its own regex list and lets the patterns drift.
  *
  * `SECRET_PATTERNS` reproduces spec-007 §2's ten named rules; each JS `RegExp` below carries a
- * comment quoting the exact spec-007 YAML `regex:` string it implements. Two of spec-007's patterns
+ * comment quoting the exact spec-007 YAML `regex:` string it implements. Four of spec-007's patterns
  * use the PCRE inline mode-modifier syntax `(?i)`/`(?im)` in their YAML text — JS `RegExp` has no
- * such inline syntax (`new RegExp('(?i)...')` throws `SyntaxError`) — so that flag is moved to the
- * equivalent JS `i` flag instead. This is a mechanical syntax translation, not a semantic rewrite:
+ * such inline syntax on Node 22 (`new RegExp('(?i)...')` throws `SyntaxError`) — so that flag is
+ * moved to the equivalent JS `i` flag instead, except on `generic-api-key-assignment`, whose YAML
+ * also holds a case-sensitive `(?-i:…)` group: there the key words are case-folded letter by letter
+ * (`caseless`) and no flag is set. This is a mechanical syntax translation, not a semantic rewrite:
  * the matched shape is unchanged, so it satisfies spec-007's Consequences-section instruction to
  * "reproduce the pattern table in §2 verbatim (or import it as data)" rather than hand-roll
  * alternative regexes.
@@ -24,6 +26,14 @@ exports.scanProjectSurface = scanProjectSurface;
 const child_process_1 = require("child_process");
 const fs_1 = require("fs");
 const path_1 = require("path");
+/**
+ * Case-fold the letters of a regex source fragment (`token` → `[Tt][Oo][Kk][Ee][Nn]`), leaving every
+ * other character as written. It stands in for spec-007's PCRE `(?i)` on a pattern that also needs a
+ * case-sensitive part, which a JS `i` flag cannot express (bug-228).
+ */
+function caseless(source) {
+    return source.replace(/[a-z]/gi, (ch) => `[${ch.toUpperCase()}${ch.toLowerCase()}]`);
+}
 /**
  * The canonical secret-hygiene pattern set (spec-007 §2), in the fixed declaration order every scan
  * must evaluate patterns in (determinism, REQ-SYS-07, spec-007 §4 step 3). Adding, removing, or
@@ -41,9 +51,15 @@ exports.SECRET_PATTERNS = [
         id: 'generic-api-key-assignment',
         description: 'Variable assignment that looks like an API key/secret/token',
         severity: 'block',
-        // spec-007 §2 (case-insensitive per its `(?i)` marker):
-        // '(api[_-]?key|secret|token|passwd|password)\s*[:=]\s*["\']?[A-Za-z0-9_\-\/+=]{16,}["\']?'
-        regex: /(api[_-]?key|secret|token|passwd|password)\s*[:=]\s*["']?[A-Za-z0-9_\-/+=]{16,}["']?/i,
+        // spec-007 §2 (case-insensitive key words per its `(?i)` marker; the `(?-i:…)` group is
+        // case-SENSITIVE, bug-228):
+        // '(?i)(api[_-]?key|secret|token|passwd|password)\s*[:=]\s*["\']?(?-i:(?![a-z]+(?:-[a-z]+)+(?![A-Za-z0-9_\-\/+=])))[A-Za-z0-9_\-\/+=]{16,}["\']?'
+        // The lookahead refuses a value made only of lower-case words joined by hyphens — prose such as
+        // a hyphenated name after a colon, not a key. JS has no `(?-i:…)` group on Node 22, so instead of
+        // the `i` flag the key words are case-folded one letter at a time (`caseless`): the matched
+        // shape is the spec's, and only the lookahead stays case-sensitive.
+        regex: new RegExp(`(${['api[_-]?key', 'secret', 'token', 'passwd', 'password'].map(caseless).join('|')})` +
+            `\\s*[:=]\\s*["']?(?![a-z]+(?:-[a-z]+)+(?![A-Za-z0-9_\\-/+=]))[A-Za-z0-9_\\-/+=]{16,}["']?`),
     },
     {
         id: 'aws-access-key-id',
@@ -103,9 +119,13 @@ exports.SECRET_PATTERNS = [
         // promoted warn → block by dl-036-secret-scan-warn-severity-vs-req-sec-08 (spec-007 §2 amended)
         severity: 'block',
         // spec-007 §2 (case-insensitive per its `(?im)` marker; the `m` is a no-op here because the
-        // scan procedure already evaluates one line at a time, so `^`/`$` anchor to that line either way):
-        // '^[A-Z0-9_]*(SECRET|TOKEN|PASSWORD|API_KEY|PRIVATE_KEY)[A-Z0-9_]*\s*=\s*\S+'
-        regex: /^[A-Z0-9_]*(SECRET|TOKEN|PASSWORD|API_KEY|PRIVATE_KEY)[A-Z0-9_]*\s*=\s*\S+/i,
+        // scan procedure already evaluates one line at a time, so `^`/`$` anchor to that line either way).
+        // The optional prefix — indentation, an `export` keyword, a `-`/`*` list marker — is
+        // bug-037's amendment (task-135): a column-0 anchor let those lines through. bug-190's (task-182)
+        // adds a `#` comment, a list marker before the keyword, `readonly` and `declare` (with flags such
+        // as `-x`), and PowerShell's `$env:` scope.
+        // '^\s*(?:#+\s*)?(?:[-*]\s+)?(?:(?:export|readonly|declare)(?:\s+-[A-Za-z]+)*\s+)?(?:\$env:)?[A-Z0-9_]*(SECRET|TOKEN|PASSWORD|API_KEY|PRIVATE_KEY)[A-Z0-9_]*\s*=\s*\S+'
+        regex: /^\s*(?:#+\s*)?(?:[-*]\s+)?(?:(?:export|readonly|declare)(?:\s+-[A-Za-z]+)*\s+)?(?:\$env:)?[A-Z0-9_]*(SECRET|TOKEN|PASSWORD|API_KEY|PRIVATE_KEY)[A-Z0-9_]*\s*=\s*\S+/i,
     },
 ];
 const FENCE_DELIMITER_RE = /^`{3,}/;
@@ -158,8 +178,9 @@ function matchLine(line, pattern, lineNumber, filePath) {
 /**
  * Scan one file's already-decoded text content (spec-007 §4): evaluate {@link SECRET_PATTERNS} in
  * declared order against every line, apply the §3 exclusions, and classify each surviving finding by
- * severity. This is the seam a future commit-time gate or `task-044`'s `init` integrity check calls
- * per file-about-to-be-written/committed (spec-007 §4 step 5).
+ * severity. This is the seam spec-007 §4 step 5's callers use per file about to be written or
+ * committed: `init`'s pre-write pass over the built-in templates calls it (`verifyBuiltinTemplates`,
+ * `src/core/builtin-integrity.ts`, task-135), and a future commit-time gate would.
  */
 function scanText(content, filePath, options = {}) {
     const lines = content.split(/\r\n|\r|\n/);
@@ -219,12 +240,14 @@ function isBinaryContent(buf) {
     return head.includes(0);
 }
 /**
- * Default scan-surface roots (spec-007 §1): `.wingfoil/` once `init` exists, plus the current
- * self-hosted analog (`docs/self/.wingfoil/`, `docs/self/docs/04_memory/`) "applied by analogy until
- * the tool-managed root exists". A root with no indexed files contributes nothing, so
- * {@link scanProjectSurface} is safe to call before `init` has ever run.
+ * Default scan-surface roots (spec-007 §1): `.wingfoil/` once `init` exists, plus `docs/04_memory/`,
+ * this repository's own Memory folder — spec-007 §1's self-hosted analog, which followed the
+ * configuration to the repository root in `task-111-configuration-moves-to-the-repository-root`
+ * (before it, the analog named the nested dogfooding copies of both folders). A root with no indexed
+ * files contributes nothing, so {@link scanProjectSurface} is safe to call before `init` has ever run,
+ * and on a project whose Memory lives elsewhere.
  */
-exports.SCAN_SURFACE_ROOTS = ['.wingfoil', 'docs/self/.wingfoil', 'docs/self/docs/04_memory'];
+exports.SCAN_SURFACE_ROOTS = ['.wingfoil', 'docs/04_memory'];
 /** Default path (root-relative) of the `security-ignore` glob list (spec-007 §3). */
 exports.DEFAULT_IGNORE_FILE = '.wingfoil/security-ignore';
 /** `git ls-files -s` mode of a gitlink (submodule commit) — not a blob, nothing to read. */

package/dist/validation/secret-scan.js.map

@@ -1 +1 @@
-{"version":3,"file":"secret-scan.js","sourceRoot":"","sources":["../../src/validation/secret-scan.ts"],"names":[],"mappings":";;;AA8OA,4BA2CC;AAaD,0CAGC;AAoFD,0CAMC;AA+BD,8CAEC;AA+BD,gDAYC;AA/cD;;;;;;;;;;;;;;GAcG;AACH,iDAA6C;AAC7C,2BAA8C;AAC9C,+BAA4B;AAiB5B;;;;GAIG;AACU,QAAA,eAAe,GAA6B;IACvD;QACE,EAAE,EAAE,iBAAiB;QACrB,WAAW,EAAE,gCAAgC;QAC7C,QAAQ,EAAE,OAAO;QACjB,2EAA2E;QAC3E,KAAK,EAAE,2DAA2D;KACnE;IACD;QACE,EAAE,EAAE,4BAA4B;QAChC,WAAW,EAAE,6DAA6D;QAC1E,QAAQ,EAAE,OAAO;QACjB,wDAAwD;QACxD,4FAA4F;QAC5F,KAAK,EAAE,uFAAuF;KAC/F;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,WAAW,EAAE,yBAAyB;QACtC,QAAQ,EAAE,OAAO;QACjB,gFAAgF;QAChF,KAAK,EAAE,gEAAgE;KACxE;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,WAAW,EAAE,+EAA+E;QAC5F,QAAQ,EAAE,OAAO;QACjB,wDAAwD;QACxD,uEAAuE;QACvE,KAAK,EAAE,kEAAkE;KAC1E;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,WAAW,EAAE,uCAAuC;QACpD,QAAQ,EAAE,OAAO;QACjB,sFAAsF;QACtF,KAAK,EAAE,sEAAsE;KAC9E;IACD;QACE,EAAE,EAAE,cAAc;QAClB,WAAW,EAAE,mDAAmD;QAChE,QAAQ,EAAE,OAAO;QACjB,wEAAwE;QACxE,KAAK,EAAE,wDAAwD;KAChE;IACD;QACE,EAAE,EAAE,aAAa;QACjB,WAAW,EAAE,0BAA0B;QACvC,QAAQ,EAAE,OAAO;QACjB,kDAAkD;QAClD,KAAK,EAAE,kCAAkC;KAC1C;IACD;QACE,EAAE,EAAE,UAAU;QACd,WAAW,EAAE,qEAAqE;QAClF,gGAAgG;QAChG,QAAQ,EAAE,OAAO;QACjB,gFAAgF;QAChF,KAAK,EAAE,gEAAgE;KACxE;IACD;QACE,EAAE,EAAE,6BAA6B;QACjC,WAAW,EAAE,6EAA6E;QAC1F,QAAQ,EAAE,MAAM;QAChB,wDAAwD;QACxD,0EAA0E;QAC1E,KAAK,EAAE,qEAAqE;KAC7E;IACD;QACE,EAAE,EAAE,0BAA0B;QAC9B,WAAW,EAAE,wDAAwD;QACrE,gGAAgG;QAChG,QAAQ,EAAE,OAAO;QACjB,4FAA4F;QAC5F,mGAAmG;QACnG,+EAA+E;QAC/E,KAAK,EAAE,6EAA6E;KACrF;CACF,CAAC;AA6DF,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AACpC,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAEnF,qGAAqG;AACrG,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAEjG,sGAAsG;AACtG,SAAS,kBAAkB,CAAC,KAAa;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,qBAAqB,CAAC,SAAiB;IAC9C,MAAM,UAAU,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtE,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,6FAA6F;AAC7F,SAAS,SAAS,CAChB,IAAY,EACZ,OAAsB,EACtB,UAAkB,EAClB,QAAgB;IAEhB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC;IAClG,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,IAAI,KAA6B,CAAC;IAClC,OAAO,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC5C,QAAQ,CAAC,IAAI,CAAC;YACZ,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC;YACvB,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;SAClB,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,4CAA4C;IAChG,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,QAAQ,CAAC,OAAe,EAAE,QAAgB,EAAE,UAA2B,EAAE;IACvF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,IAAI,GAAoB,EAAE,CAAC;IAEjC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,WAAW,GAAG,KAAK,CAAC;IAExB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACzC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxE,WAAW,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACjD,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG,KAAK,CAAC;gBAChB,WAAW,GAAG,KAAK,CAAC;YACtB,CAAC;YACD,SAAS;QACX,CAAC;QAED,KAAK,MAAM,OAAO,IAAI,uBAAe,EAAE,CAAC;YACtC,KAAK,MAAM,OAAO,IAAI,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAChE,MAAM,WAAW,GAAG,kBAAkB,CAAC,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC/E,IAAI,WAAW,IAAI,WAAW,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;oBACtD,MAAM,YAAY,GAAiB,WAAW;wBAC5C,CAAC,CAAC,gBAAgB;wBAClB,CAAC,CAAC,WAAW;4BACX,CAAC,CAAC,mBAAmB;4BACrB,CAAC,CAAC,aAAa,CAAC;oBACpB,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;gBAC1C,CAAC;qBAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;oBACxC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACzB,CAAC;qBAAM,CAAC;oBACN,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,mGAAmG;AACnG,SAAS,gBAAgB,CAAC,OAA8B;IACtD,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC5C,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC5C,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACpC,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;KACtE,CAAC;AACJ,CAAC;AAED,2FAA2F;AAC3F,SAAgB,eAAe,CAAC,GAAW;IACzC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACU,QAAA,kBAAkB,GAAG,CAAC,WAAW,EAAE,qBAAqB,EAAE,0BAA0B,CAAU,CAAC;AAE5G,qFAAqF;AACxE,QAAA,mBAAmB,GAAG,2BAA2B,CAAC;AAQ/D,4FAA4F;AAC5F,MAAM,YAAY,GAAG,QAAQ,CAAC;AAE9B,4FAA4F;AAC5F,MAAM,eAAe,GAAG,mCAAmC,CAAC;AAE5D;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,IAAY,EAAE,YAA+B;IACrE,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACzC,MAAM,GAAG,GAAG,IAAA,4BAAY,EAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,YAAY,CAAC,EAAE;QAC3F,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IACH,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,mGAAmG;QACnG,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,YAAY;YAAE,SAAS;QAC1D,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAW,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAW,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CACvB,IAAY,EACZ,OAA+B;IAE/B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,IAAA,4BAAY,EAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE;QACnE,KAAK,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QAC3D,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,SAAS,EAAE,MAAM,CAAC,iBAAiB;KACpC,CAAC,CAAC;IACH,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE;QACpC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjE,MAAM,KAAK,GAAG,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,mDAAmD,IAAI,MAAM,MAAM,GAAG,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,KAAK,GAAG,SAAS,GAAG,CAAC,CAAC;QAC5B,MAAM,GAAG,GAAG,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,oDAAoD;QACtE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAAC,cAAsB;IACpD,IAAI,CAAC,IAAA,eAAU,EAAC,cAAc,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3C,OAAO,IAAA,iBAAY,EAAC,cAAc,EAAE,OAAO,CAAC;SACzC,KAAK,CAAC,YAAY,CAAC;SACnB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,gGAAgG;AAChG,SAAS,iBAAiB,CAAC,EAAU;IACnC,OAAO,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,iHAAiH;AACjH,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,MAAM,GAAG,GAAG,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACxB,MAAM,IAAI,IAAI,CAAC;gBACf,CAAC,IAAI,CAAC,CAAC;gBACP,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG;oBAAE,CAAC,IAAI,CAAC,CAAC,CAAC,8CAA8C;YACjF,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,OAAO,CAAC;YACpB,CAAC;QACH,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,MAAM,IAAI,MAAM,CAAC;QACnB,CAAC;aAAM,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,iBAAiB,CAAC,EAAE,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,CAAC;IACd,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,0GAA0G;AAC1G,SAAgB,iBAAiB,CAAC,QAAgB,EAAE,KAAwB;IAC1E,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AACjE,CAAC;AAUD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAgB,kBAAkB,CAAC,IAAY,EAAE,UAA8B,EAAE;IAC/E,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,0BAAkB,CAAC;IAChE,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,2BAAmB,CAAC;IACrE,MAAM,WAAW,GAAG,eAAe,CAAC,IAAA,WAAI,EAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;IAEhE,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;QAC7F,IAAI,eAAe,CAAC,OAAO,CAAC;YAAE,SAAS;QACvC,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC;AACnC,CAAC"}
+{"version":3,"file":"secret-scan.js","sourceRoot":"","sources":["../../src/validation/secret-scan.ts"],"names":[],"mappings":";;;AAuQA,4BA2CC;AAaD,0CAGC;AAsFD,0CAMC;AA+BD,8CAEC;AA+BD,gDAYC;AA1eD;;;;;;;;;;;;;;;;GAgBG;AACH,iDAA6C;AAC7C,2BAA8C;AAC9C,+BAA4B;AAiB5B;;;;GAIG;AACH,SAAS,QAAQ,CAAC,MAAc;IAC9B,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;AACvF,CAAC;AAED;;;;GAIG;AACU,QAAA,eAAe,GAA6B;IACvD;QACE,EAAE,EAAE,iBAAiB;QACrB,WAAW,EAAE,gCAAgC;QAC7C,QAAQ,EAAE,OAAO;QACjB,2EAA2E;QAC3E,KAAK,EAAE,2DAA2D;KACnE;IACD;QACE,EAAE,EAAE,4BAA4B;QAChC,WAAW,EAAE,6DAA6D;QAC1E,QAAQ,EAAE,OAAO;QACjB,wFAAwF;QACxF,4BAA4B;QAC5B,kJAAkJ;QAClJ,gGAAgG;QAChG,kGAAkG;QAClG,4FAA4F;QAC5F,oEAAoE;QACpE,KAAK,EAAE,IAAI,MAAM,CACf,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG;YACrF,2FAA2F,CAC9F;KACF;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,WAAW,EAAE,yBAAyB;QACtC,QAAQ,EAAE,OAAO;QACjB,gFAAgF;QAChF,KAAK,EAAE,gEAAgE;KACxE;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,WAAW,EAAE,+EAA+E;QAC5F,QAAQ,EAAE,OAAO;QACjB,wDAAwD;QACxD,uEAAuE;QACvE,KAAK,EAAE,kEAAkE;KAC1E;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,WAAW,EAAE,uCAAuC;QACpD,QAAQ,EAAE,OAAO;QACjB,sFAAsF;QACtF,KAAK,EAAE,sEAAsE;KAC9E;IACD;QACE,EAAE,EAAE,cAAc;QAClB,WAAW,EAAE,mDAAmD;QAChE,QAAQ,EAAE,OAAO;QACjB,wEAAwE;QACxE,KAAK,EAAE,wDAAwD;KAChE;IACD;QACE,EAAE,EAAE,aAAa;QACjB,WAAW,EAAE,0BAA0B;QACvC,QAAQ,EAAE,OAAO;QACjB,kDAAkD;QAClD,KAAK,EAAE,kCAAkC;KAC1C;IACD;QACE,EAAE,EAAE,UAAU;QACd,WAAW,EAAE,qEAAqE;QAClF,gGAAgG;QAChG,QAAQ,EAAE,OAAO;QACjB,gFAAgF;QAChF,KAAK,EAAE,gEAAgE;KACxE;IACD;QACE,EAAE,EAAE,6BAA6B;QACjC,WAAW,EAAE,6EAA6E;QAC1F,QAAQ,EAAE,MAAM;QAChB,wDAAwD;QACxD,0EAA0E;QAC1E,KAAK,EAAE,qEAAqE;KAC7E;IACD;QACE,EAAE,EAAE,0BAA0B;QAC9B,WAAW,EAAE,wDAAwD;QACrE,gGAAgG;QAChG,QAAQ,EAAE,OAAO;QACjB,4FAA4F;QAC5F,mGAAmG;QACnG,qFAAqF;QACrF,kGAAkG;QAClG,kGAAkG;QAClG,4CAA4C;QAC5C,wKAAwK;QACxK,KAAK,EACH,sKAAsK;KACzK;CACF,CAAC;AA6DF,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AACpC,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAEnF,qGAAqG;AACrG,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAEjG,sGAAsG;AACtG,SAAS,kBAAkB,CAAC,KAAa;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,qBAAqB,CAAC,SAAiB;IAC9C,MAAM,UAAU,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtE,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,6FAA6F;AAC7F,SAAS,SAAS,CAChB,IAAY,EACZ,OAAsB,EACtB,UAAkB,EAClB,QAAgB;IAEhB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC;IAClG,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,IAAI,KAA6B,CAAC;IAClC,OAAO,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC5C,QAAQ,CAAC,IAAI,CAAC;YACZ,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC;YACvB,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;SAClB,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,4CAA4C;IAChG,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,QAAQ,CAAC,OAAe,EAAE,QAAgB,EAAE,UAA2B,EAAE;IACvF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,IAAI,GAAoB,EAAE,CAAC;IAEjC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,WAAW,GAAG,KAAK,CAAC;IAExB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACzC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxE,WAAW,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACjD,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG,KAAK,CAAC;gBAChB,WAAW,GAAG,KAAK,CAAC;YACtB,CAAC;YACD,SAAS;QACX,CAAC;QAED,KAAK,MAAM,OAAO,IAAI,uBAAe,EAAE,CAAC;YACtC,KAAK,MAAM,OAAO,IAAI,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAChE,MAAM,WAAW,GAAG,kBAAkB,CAAC,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC/E,IAAI,WAAW,IAAI,WAAW,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;oBACtD,MAAM,YAAY,GAAiB,WAAW;wBAC5C,CAAC,CAAC,gBAAgB;wBAClB,CAAC,CAAC,WAAW;4BACX,CAAC,CAAC,mBAAmB;4BACrB,CAAC,CAAC,aAAa,CAAC;oBACpB,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;gBAC1C,CAAC;qBAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;oBACxC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACzB,CAAC;qBAAM,CAAC;oBACN,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,mGAAmG;AACnG,SAAS,gBAAgB,CAAC,OAA8B;IACtD,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC5C,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC5C,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACpC,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;KACtE,CAAC;AACJ,CAAC;AAED,2FAA2F;AAC3F,SAAgB,eAAe,CAAC,GAAW;IACzC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;GAOG;AACU,QAAA,kBAAkB,GAAG,CAAC,WAAW,EAAE,gBAAgB,CAAU,CAAC;AAE3E,qFAAqF;AACxE,QAAA,mBAAmB,GAAG,2BAA2B,CAAC;AAQ/D,4FAA4F;AAC5F,MAAM,YAAY,GAAG,QAAQ,CAAC;AAE9B,4FAA4F;AAC5F,MAAM,eAAe,GAAG,mCAAmC,CAAC;AAE5D;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,IAAY,EAAE,YAA+B;IACrE,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACzC,MAAM,GAAG,GAAG,IAAA,4BAAY,EAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,YAAY,CAAC,EAAE;QAC3F,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IACH,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,mGAAmG;QACnG,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,YAAY;YAAE,SAAS;QAC1D,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAW,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAW,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CACvB,IAAY,EACZ,OAA+B;IAE/B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,IAAA,4BAAY,EAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE;QACnE,KAAK,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QAC3D,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,SAAS,EAAE,MAAM,CAAC,iBAAiB;KACpC,CAAC,CAAC;IACH,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE;QACpC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjE,MAAM,KAAK,GAAG,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,mDAAmD,IAAI,MAAM,MAAM,GAAG,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,KAAK,GAAG,SAAS,GAAG,CAAC,CAAC;QAC5B,MAAM,GAAG,GAAG,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,oDAAoD;QACtE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAAC,cAAsB;IACpD,IAAI,CAAC,IAAA,eAAU,EAAC,cAAc,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3C,OAAO,IAAA,iBAAY,EAAC,cAAc,EAAE,OAAO,CAAC;SACzC,KAAK,CAAC,YAAY,CAAC;SACnB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,gGAAgG;AAChG,SAAS,iBAAiB,CAAC,EAAU;IACnC,OAAO,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,iHAAiH;AACjH,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,MAAM,GAAG,GAAG,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACxB,MAAM,IAAI,IAAI,CAAC;gBACf,CAAC,IAAI,CAAC,CAAC;gBACP,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG;oBAAE,CAAC,IAAI,CAAC,CAAC,CAAC,8CAA8C;YACjF,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,OAAO,CAAC;YACpB,CAAC;QACH,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,MAAM,IAAI,MAAM,CAAC;QACnB,CAAC;aAAM,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,iBAAiB,CAAC,EAAE,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,CAAC;IACd,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,0GAA0G;AAC1G,SAAgB,iBAAiB,CAAC,QAAgB,EAAE,KAAwB;IAC1E,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AACjE,CAAC;AAUD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAgB,kBAAkB,CAAC,IAAY,EAAE,UAA8B,EAAE;IAC/E,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,0BAAkB,CAAC;IAChE,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,2BAAmB,CAAC;IACrE,MAAM,WAAW,GAAG,eAAe,CAAC,IAAA,WAAI,EAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;IAEhE,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;QAC7F,IAAI,eAAe,CAAC,OAAO,CAAC;YAAE,SAAS;QACvC,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC;AACnC,CAAC"}

package/dist/validation/warning.d.ts

@@ -1,18 +1,32 @@
+/** Where a raised warning goes: one operator-facing sentence, no prefix. */
+export type WarningSink = (text: string) => void;
 /**
- * Unknown-field warning policy for `.passthrough()` schemas (spec-009-validation-strategy §2).
- *
- * Unknown-ness is decided against the schema's own declared key set (`schema.shape`), NOT against
- * the passthrough-parsed output. Under `.passthrough()` the parsed object retains every unknown
- * key, so a `raw` vs `parsed` diff is always empty — the "known-defective mechanism" spec-009 §2
- * explicitly warns against. Diffing raw keys against `schema.shape` is the correct mechanism.
- *
- * The same diff is applied recursively at every nesting level that is itself a `.passthrough()`
- * object schema (spec-009 §2: "the same diff is applied recursively at each nesting level that
- * itself has a `.passthrough()` schema, so unknown fields inside nested config blocks are reported
- * too, not only at the document root"). This matters because the files this module guards —
- * `memory.yaml`, `dna.yaml`, `workflows.yaml` — all carry deeply nested config blocks (per-type
- * state machines, phase objects, etc.), where an unknown field would otherwise go undetected.
+ * Run `run` with `sink` receiving every warning {@link reportWarning} raises inside it, its awaited
+ * continuations included. Returns what `run` returns.
  */
+export declare function withWarningSink<T>(sink: WarningSink, run: () => T): T;
+/**
+ * Raise one warning: to the sink {@link withWarningSink} installed around the running operation, or,
+ * with none installed, to stderr as `Warning: <text>`.
+ */
+export declare function reportWarning(text: string): void;
+/**
+ * Run `run` with each distinct warning raised inside it passed on once (task-228, the B3 handover: a
+ * pipeline that loads one file twice raises its warning twice), after `rewrite` (identity by default).
+ * The warnings go to the sink installed around the call, or to stderr outside any.
+ */
+export declare function withDistinctWarnings<T>(run: () => T, rewrite?: (text: string) => string): T;
+/**
+ * A **notice**: an informational line an operation prints while it runs, neither a warning nor an error
+ * — `agent execute`'s launch banner (`spec-016` §3.3 step 13, task-228). It travels like a warning, to
+ * the sink the surface installs ({@link withNoticeSink}); the CLI renders it in the active `--format`
+ * on stderr. Outside any sink it is written to stderr as is.
+ */
+export type NoticeSink = (text: string) => void;
+/** Run `run` with `sink` receiving every notice {@link reportNotice} raises inside it. */
+export declare function withNoticeSink<T>(sink: NoticeSink, run: () => T): T;
+/** Raise one notice: to the installed sink, or, with none, to stderr as a bare line. */
+export declare function reportNotice(text: string): void;
 /**
  * Minimal structural view of a Zod object schema: only its declared top-level `shape` is needed.
  * Typed structurally rather than as `AnyZodObject` (spec-009 §2's listing) because Zod 4 — the
@@ -23,9 +37,9 @@ export interface HasShape {
     readonly shape: Record<string, unknown>;
 }
 /**
- * Emit one stderr warning (spec-009 §2) listing every raw key not declared in `schema`'s shape,
- * recursively through nested passthrough object/array-of-object schemas. Writes nothing when there
- * are no unknown fields.
+ * Raise one warning (spec-009 §2) listing every raw key not declared in `schema`'s shape, recursively
+ * through nested passthrough object/array-of-object schemas, through {@link reportWarning} (`bug-202`):
+ * `<file>: unknown field(s) ignored: <paths>`. Raises nothing when there are no unknown fields.
  */
 export declare function emitUnknownFieldWarning(raw: Record<string, unknown>, schema: HasShape, filePath: string): void;
 //# sourceMappingURL=warning.d.ts.map

package/dist/validation/warning.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"warning.d.ts","sourceRoot":"","sources":["../../src/validation/warning.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;GAKG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzC;AAwED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,MAAM,EAAE,QAAQ,EAChB,QAAQ,EAAE,MAAM,GACf,IAAI,CAKN"}
+{"version":3,"file":"warning.d.ts","sourceRoot":"","sources":["../../src/validation/warning.ts"],"names":[],"mappings":"AA2BA,4EAA4E;AAC5E,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;AAIjD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAErE;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAIhD;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,OAAO,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAuB,GAAG,CAAC,CAU3G;AAED;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;AAIhD,0FAA0F;AAC1F,wBAAgB,cAAc,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAEnE;AAED,wFAAwF;AACxF,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAI/C;AAED;;;;;GAKG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzC;AAwED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,MAAM,EAAE,QAAQ,EAChB,QAAQ,EAAE,MAAM,GACf,IAAI,CAKN"}

package/dist/validation/warning.js

@@ -1,6 +1,14 @@
 "use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.withWarningSink = withWarningSink;
+exports.reportWarning = reportWarning;
+exports.withDistinctWarnings = withDistinctWarnings;
+exports.withNoticeSink = withNoticeSink;
+exports.reportNotice = reportNotice;
+exports.emitUnknownFieldWarning = emitUnknownFieldWarning;
 /**
- * Unknown-field warning policy for `.passthrough()` schemas (spec-009-validation-strategy §2).
+ * Unknown-field warning policy for `.passthrough()` schemas (spec-009-validation-strategy §2), and the
+ * **warning sink** every warning raised while an operation runs goes through (task-218, `bug-202`).
  *
  * Unknown-ness is decided against the schema's own declared key set (`schema.shape`), NOT against
  * the passthrough-parsed output. Under `.passthrough()` the parsed object retains every unknown
@@ -13,9 +21,68 @@
  * too, not only at the document root"). This matters because the files this module guards —
  * `memory.yaml`, `dna.yaml`, `workflows.yaml` — all carry deeply nested config blocks (per-type
  * state machines, phase objects, etc.), where an unknown field would otherwise go undetected.
+ *
+ * **The sink.** A loader deep inside `src/` does not know the surface it serves or its `--format`, so it
+ * never writes a warning itself: it hands it to {@link reportWarning}. The surface that runs the
+ * operation installs a sink around the call ({@link withWarningSink}) — the CLI registrar renders each
+ * warning through `src/cli/warning.ts`, the one renderer, in the active `--format`, at the moment it is
+ * raised, so it precedes whatever the command prints after it (an error, or `agent execute`'s pre-flight
+ * refusal, `spec-016` §3.3 step 8). The mode travels in an `AsyncLocalStorage`, as the dry run's does,
+ * so no loader signature changes. Outside any sink (the MCP server, a library caller) the warning is
+ * written to stderr as `Warning: <text>`, the line these loaders always wrote.
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.emitUnknownFieldWarning = emitUnknownFieldWarning;
+const node_async_hooks_1 = require("node:async_hooks");
+const sinkStore = new node_async_hooks_1.AsyncLocalStorage();
+/**
+ * Run `run` with `sink` receiving every warning {@link reportWarning} raises inside it, its awaited
+ * continuations included. Returns what `run` returns.
+ */
+function withWarningSink(sink, run) {
+    return sinkStore.run(sink, run);
+}
+/**
+ * Raise one warning: to the sink {@link withWarningSink} installed around the running operation, or,
+ * with none installed, to stderr as `Warning: <text>`.
+ */
+function reportWarning(text) {
+    const sink = sinkStore.getStore();
+    if (sink !== undefined)
+        sink(text);
+    else
+        process.stderr.write(`Warning: ${text}\n`);
+}
+/**
+ * Run `run` with each distinct warning raised inside it passed on once (task-228, the B3 handover: a
+ * pipeline that loads one file twice raises its warning twice), after `rewrite` (identity by default).
+ * The warnings go to the sink installed around the call, or to stderr outside any.
+ */
+function withDistinctWarnings(run, rewrite = (text) => text) {
+    const outer = sinkStore.getStore();
+    const seen = new Set();
+    return sinkStore.run((text) => {
+        const shown = rewrite(text);
+        if (seen.has(shown))
+            return;
+        seen.add(shown);
+        if (outer !== undefined)
+            outer(shown);
+        else
+            process.stderr.write(`Warning: ${shown}\n`);
+    }, run);
+}
+const noticeStore = new node_async_hooks_1.AsyncLocalStorage();
+/** Run `run` with `sink` receiving every notice {@link reportNotice} raises inside it. */
+function withNoticeSink(sink, run) {
+    return noticeStore.run(sink, run);
+}
+/** Raise one notice: to the installed sink, or, with none, to stderr as a bare line. */
+function reportNotice(text) {
+    const sink = noticeStore.getStore();
+    if (sink !== undefined)
+        sink(text);
+    else
+        process.stderr.write(`${text}\n`);
+}
 /** True when `v` is a Zod object schema (structurally: exposes a `.shape` record). */
 function isHasShape(v) {
     return (typeof v === 'object' &&
@@ -68,14 +135,14 @@ function collectUnknownFields(raw, schema, prefix) {
     return out;
 }
 /**
- * Emit one stderr warning (spec-009 §2) listing every raw key not declared in `schema`'s shape,
- * recursively through nested passthrough object/array-of-object schemas. Writes nothing when there
- * are no unknown fields.
+ * Raise one warning (spec-009 §2) listing every raw key not declared in `schema`'s shape, recursively
+ * through nested passthrough object/array-of-object schemas, through {@link reportWarning} (`bug-202`):
+ * `<file>: unknown field(s) ignored: <paths>`. Raises nothing when there are no unknown fields.
  */
 function emitUnknownFieldWarning(raw, schema, filePath) {
     const unknown = collectUnknownFields(raw, schema, '');
     if (unknown.length > 0) {
-        process.stderr.write(`Warning: ${filePath}: unknown field(s) ignored: ${unknown.join(', ')}\n`);
+        reportWarning(`${filePath}: unknown field(s) ignored: ${unknown.join(', ')}`);
     }
 }
 //# sourceMappingURL=warning.js.map

package/dist/validation/warning.js.map

@@ -1 +1 @@
-{"version":3,"file":"warning.js","sourceRoot":"","sources":["../../src/validation/warning.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;AAuFH,0DASC;AA1ED,sFAAsF;AACtF,SAAS,UAAU,CAAC,CAAU;IAC5B,OAAO,CACL,OAAO,CAAC,KAAK,QAAQ;QACrB,CAAC,KAAK,IAAI;QACV,OAAO,IAAI,CAAC;QACZ,OAAQ,CAAwB,CAAC,KAAK,KAAK,QAAQ;QAClD,CAAwB,CAAC,KAAK,KAAK,IAAI,CACzC,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,SAAS,YAAY,CAAC,CAAU;IAC9B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,SAAS,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED,mFAAmF;AACnF,SAAS,aAAa,CAAC,CAAU;IAC/B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAC3B,GAA4B,EAC5B,MAAgB,EAChB,MAAc;IAEd,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACjD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAC/C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACf,SAAS;QACX,CAAC;QACD,0FAA0F;QAC1F,4FAA4F;QAC5F,yEAAyE;QACzE,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,UAAU,CAAC,WAAW,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;QACjE,CAAC;aAAM,IAAI,YAAY,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChE,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,CAAC;YAC1C,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC9B,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;oBAC/B,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;wBACxB,GAAG,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;oBAC9E,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAgB,uBAAuB,CACrC,GAA4B,EAC5B,MAAgB,EAChB,QAAgB;IAEhB,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACtD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,QAAQ,+BAA+B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClG,CAAC;AACH,CAAC"}
+{"version":3,"file":"warning.js","sourceRoot":"","sources":["../../src/validation/warning.ts"],"names":[],"mappings":";;AAoCA,0CAEC;AAMD,sCAIC;AAOD,oDAUC;AAaD,wCAEC;AAGD,oCAIC;AAuFD,0DASC;AAvLD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,uDAAqD;AAKrD,MAAM,SAAS,GAAG,IAAI,oCAAiB,EAAe,CAAC;AAEvD;;;GAGG;AACH,SAAgB,eAAe,CAAI,IAAiB,EAAE,GAAY;IAChE,OAAO,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,SAAgB,aAAa,CAAC,IAAY;IACxC,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC;IAClC,IAAI,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,CAAC;;QAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,SAAgB,oBAAoB,CAAI,GAAY,EAAE,UAAoC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI;IACtG,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO;QAC5B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,IAAI,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,KAAK,CAAC,CAAC;;YACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC;IACnD,CAAC,EAAE,GAAG,CAAC,CAAC;AACV,CAAC;AAUD,MAAM,WAAW,GAAG,IAAI,oCAAiB,EAAc,CAAC;AAExD,0FAA0F;AAC1F,SAAgB,cAAc,CAAI,IAAgB,EAAE,GAAY;IAC9D,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACpC,CAAC;AAED,wFAAwF;AACxF,SAAgB,YAAY,CAAC,IAAY;IACvC,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,EAAE,CAAC;IACpC,IAAI,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,CAAC;;QAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AACzC,CAAC;AAsBD,sFAAsF;AACtF,SAAS,UAAU,CAAC,CAAU;IAC5B,OAAO,CACL,OAAO,CAAC,KAAK,QAAQ;QACrB,CAAC,KAAK,IAAI;QACV,OAAO,IAAI,CAAC;QACZ,OAAQ,CAAwB,CAAC,KAAK,KAAK,QAAQ;QAClD,CAAwB,CAAC,KAAK,KAAK,IAAI,CACzC,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,SAAS,YAAY,CAAC,CAAU;IAC9B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,SAAS,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED,mFAAmF;AACnF,SAAS,aAAa,CAAC,CAAU;IAC/B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAC3B,GAA4B,EAC5B,MAAgB,EAChB,MAAc;IAEd,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACjD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAC/C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACf,SAAS;QACX,CAAC;QACD,0FAA0F;QAC1F,4FAA4F;QAC5F,yEAAyE;QACzE,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,UAAU,CAAC,WAAW,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;QACjE,CAAC;aAAM,IAAI,YAAY,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChE,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,CAAC;YAC1C,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC9B,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;oBAC/B,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;wBACxB,GAAG,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;oBAC9E,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAgB,uBAAuB,CACrC,GAA4B,EAC5B,MAAgB,EAChB,QAAgB;IAEhB,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACtD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,aAAa,CAAC,GAAG,QAAQ,+BAA+B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC"}

package/dist/workflow/bindings.d.ts

@@ -0,0 +1,152 @@
+/**
+ * Layer 3 — the token-binding file `.wingfoil/workflows/bindings.yaml` (spec-003-workflows-yaml-schema
+ * § "Layer 3", `dl-090` Q1 (a), Q2 (c), Q3 (a), Q4, Q5 (c), Q6), and the **built-in** binding table
+ * (spec-003 § "Action expressions"). Every `actions:` and `checks:` token of a workflow resolves through
+ * one of the two: a token WingFoil implements itself is built in and may not be rebound; every other
+ * token is bound by the project here, or is unbound (`W_WORKFLOW_UNBOUND_TOKEN`, a warning in v0.3).
+ *
+ * Like `./schema.ts`, this module holds the **structural** (Zod) shape plus the pure readings the
+ * loader's checks and later commands share ({@link tokenName}, {@link isBuiltinToken},
+ * {@link resolveToken}, {@link isWholeInterpolation}, {@link runsAgentExecute}). The loader rows
+ * themselves are run by `src/core/loaders.ts` with `src/core/workflow-diagnostics.ts`
+ * (spec-009-validation-strategy §1). Every object node is `.passthrough()` per spec-009 §2, except
+ * where spec-003's shape is strict.
+ *
+ * Nothing here runs a binding: in v0.3 the loader validates and `workflow show` / `workflow next`
+ * display (spec-003 § "What v0.3 does with these fields"); the v1.0 engine executes (P4.10, P4.12).
+ */
+import { z } from 'zod';
+/** The bindings file, relative to `.wingfoil/` — the `file` of its diagnostics (spec-003 Layer 3). */
+export declare const BINDINGS_FILE: "workflows/bindings.yaml";
+/** A check token's binding: a command and a severity (`dl-090` Q4; default `reject`). */
+export declare const CheckBinding: z.ZodObject<{
+    run: z.ZodArray<z.ZodString>;
+    severity: z.ZodDefault<z.ZodEnum<{
+        warn: "warn";
+        reject: "reject";
+    }>>;
+    args: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, z.core.$loose>;
+export type CheckBinding = z.infer<typeof CheckBinding>;
+/** An action token's binding: exactly one of `run` (a command) or `manual: true` (`dl-090` Q2 (c)). */
+export declare const ActionBinding: z.ZodObject<{
+    run: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    manual: z.ZodOptional<z.ZodLiteral<true>>;
+    args: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, z.core.$loose>;
+export type ActionBinding = z.infer<typeof ActionBinding>;
+/** One collection entry: a scalar, or a map keyed by its `id` (else its `name`) field. */
+declare const CollectionEntry: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodRecord<z.ZodString, z.ZodUnknown>]>;
+/** One entry of a collection (spec-003 § "Collections"): a scalar, or a map keyed by its `id` / `name` field. */
+export type CollectionEntry = z.infer<typeof CollectionEntry>;
+/**
+ * The key of one collection entry (spec-003 § "Collections"): the entry itself for a scalar, the
+ * entry's `id` field, else its `name` field, for a map. `null` when a map entry has neither as a
+ * scalar.
+ */
+export declare function collectionEntryKey(entry: CollectionEntry): string | null;
+/** One collection-key problem: the entry's index and the message (`E_BINDING_COLLECTION_KEY`). */
+export interface CollectionKeyIssue {
+    readonly index: number;
+    readonly message: string;
+}
+/**
+ * The key problems of one collection (spec-003 § "Collections"), in entry order: a map entry with no
+ * `id` / `name`, a key outside spec-009's ID characters, a key already used by an earlier entry.
+ */
+export declare function collectionKeyIssues(entries: readonly CollectionEntry[]): CollectionKeyIssue[];
+/**
+ * Layer 3 — `.wingfoil/workflows/bindings.yaml`. Optional: an absent file is no bindings. A `dl-149` file
+ * kind (`dl-153` (A)): `format` is optional (absent = 1), and a newer one is refused by the loader before
+ * this structural pass.
+ */
+export declare const BindingsYaml: z.ZodObject<{
+    version: z.ZodOptional<z.ZodNumber>;
+    format: z.ZodOptional<z.ZodNumber>;
+    checks: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        run: z.ZodArray<z.ZodString>;
+        severity: z.ZodDefault<z.ZodEnum<{
+            warn: "warn";
+            reject: "reject";
+        }>>;
+        args: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$loose>>>;
+    actions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        run: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        manual: z.ZodOptional<z.ZodLiteral<true>>;
+        args: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$loose>>>;
+    collections: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodRecord<z.ZodString, z.ZodUnknown>]>>>>;
+}, z.core.$loose>;
+export type BindingsYaml = z.infer<typeof BindingsYaml>;
+/**
+ * The name of an action or check token: the text before its first `(` or `:`, trimmed
+ * (`memory.add(type: adr)` → `memory.add`; `tests.coverage(min: 80)` → `tests.coverage`;
+ * `frontmatter.required: [title]` → `frontmatter.required`). A prose check keeps its prose, which no
+ * binding key names, so it stays unbound.
+ */
+export declare function tokenName(token: string): string;
+/** The `type:` argument of a `memory.add(...)` token, or `null` (`memory.add(type: tech-spec)` → `tech-spec`). */
+export declare function memoryAddType(token: string): string | null;
+/** The Memory verbs a workflow action may emit (spec-003 § "Action expressions", `dl-079` (A)). */
+export type ActionMemoryVerb = 'add' | 'submit' | 'approve' | 'reject' | 'deprecate' | 'start' | 'finalize' | 'sync' | 'assign';
+/** How a token resolves: the binding kind spec-003's built-in table and Layer 3 name. */
+export type BindingKind = 'wingfoil' | 'manual' | 'agent' | 'run' | 'unbound';
+/** A token's resolved binding — what `workflow show` / `workflow next` report (task-216). */
+export interface TokenBinding {
+    readonly kind: BindingKind;
+    /** `built-in` for spec-003's table, `project` for `bindings.yaml`, `none` when unbound. */
+    readonly source: 'built-in' | 'project' | 'none';
+    /**
+     * The command, as an argument vector, when the binding names one: the built-in command prefix
+     * (`wingfoil memory add --type <T>`, `wingfoil init`, `wingfoil agent execute`), or the project's
+     * `run`. The step's own operands (element id, `--workflow`, `--step`) are the caller's.
+     */
+    readonly argv?: readonly string[];
+    /**
+     * The Memory commit the step is expected to produce: the element type when the token names it
+     * (`null` for the workflow's own element), and the candidate verbs. A `set_state` lists three;
+     * which one applies follows spec-003's rule under the verb table (approval, last state, else start).
+     */
+    readonly expectedCommit?: {
+        readonly type: string | null;
+        readonly verbs: readonly ActionMemoryVerb[];
+    };
+    /** A check binding's severity (`dl-090` Q4). */
+    readonly severity?: 'warn' | 'reject';
+}
+/**
+ * The Memory type a typed state action names — the `T` of `<T>.set_state(…)` / `<T>.sync_state(…)` —
+ * or `null` for `element.set_state` / `element.sync_state` (the workflow's own element, not a type) and
+ * for any other token. The core check `E_WORKFLOW_ELEMENT_TYPE_UNKNOWN` (spec-003, `bug-282`) checks it
+ * against `memory.yaml`.
+ */
+export declare function typedStateType(token: string): string | null;
+/**
+ * Whether `name` (a {@link tokenName}) is a **built-in** token (spec-003's built-in table):
+ * `memory.add|submit|approve|reject|deprecate`, `element.set_state`, `<type>.set_state`,
+ * `<type>.sync_state`, `element.set_release`, `config.init` and every `agent.*`. A project may not
+ * rebind one (`E_BINDING_BUILTIN_TOKEN`).
+ */
+export declare function isBuiltinToken(name: string): boolean;
+/**
+ * Resolve one token to its binding (spec-003 § "Action expressions" built-in table, Layer 3): an
+ * action resolves through the built-in table first, then `bindings.actions`; a check only through
+ * `bindings.checks` (no check is built in, and none may be bound to an agent). An unresolved token is
+ * `{ kind: 'unbound', source: 'none' }`. Pure and total: the same inputs give the same answer.
+ *
+ * @param token - The token as written in `actions:` / `checks:` / `awaits.evidence`, arguments included.
+ * @param role - Whether the token is an action or a check.
+ * @param bindings - The validated `bindings.yaml`, or `null` when the project has none.
+ */
+export declare function resolveToken(token: string, role: 'action' | 'check', bindings: BindingsYaml | null): TokenBinding;
+/** Whether one `run` element interpolates only as a whole element (`dl-090` Q3 (a)). */
+export declare function isWholeInterpolation(element: string): boolean;
+/**
+ * Whether an argument vector runs `wingfoil agent execute` (`E_BINDING_AGENT_CHECK`, `dl-090` Q6): an
+ * `agent`, `execute` pair after a `wingfoil` program — called directly, through `npx`, or as the
+ * built `cli.js`.
+ */
+export declare function runsAgentExecute(run: readonly string[]): boolean;
+export {};
+//# sourceMappingURL=bindings.d.ts.map

package/dist/workflow/bindings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bindings.d.ts","sourceRoot":"","sources":["../../src/workflow/bindings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,sGAAsG;AACtG,eAAO,MAAM,aAAa,EAAG,yBAAkC,CAAC;AAoBhE,yFAAyF;AACzF,eAAO,MAAM,YAAY;;;;;;;iBAMT,CAAC;AACjB,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,uGAAuG;AACvG,eAAO,MAAM,aAAa;;;;iBAWtB,CAAC;AACL,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,0FAA0F;AAC1F,QAAA,MAAM,eAAe,uGAAoF,CAAC;AAC1G,iHAAiH;AACjH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,GAAG,IAAI,CAIxE;AAUD,kGAAkG;AAClG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,GAAG,kBAAkB,EAAE,CAc7F;AAED;;;;GAIG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;iBAQT,CAAC;AACjB,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAG/C;AAED,kHAAkH;AAClH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI1D;AAED,mGAAmG;AACnG,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,WAAW,GAAG,OAAO,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEhI,yFAAyF;AACzF,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,QAAQ,GAAG,OAAO,GAAG,KAAK,GAAG,SAAS,CAAC;AAE9E,6FAA6F;AAC7F,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,MAAM,CAAC;IACjD;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,gBAAgB,EAAE,CAAA;KAAE,CAAC;IACxG,gDAAgD;IAChD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;CACvC;AAaD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG3D;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAQpD;AAsBD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,EAAE,QAAQ,EAAE,YAAY,GAAG,IAAI,GAAG,YAAY,CAYjH;AAOD,wFAAwF;AACxF,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE7D;AAOD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAOhE"}