wingfoil 0.2.1

package/dist/core/exit-code.d.ts

@@ -0,0 +1,85 @@
+import type { CoreError, CoreResult } from './types';
+/** The three-code exit contract (spec-005 §1). Canonical home for the type; `src/cli` re-exports it. */
+export type ExitCode = 0 | 1 | 2;
+/** The exit code a {@link CoreError} maps to (spec-005 §1). */
+export declare function exitCodeForError(error: CoreError): ExitCode;
+/** The exit code for a whole {@link CoreResult}: `0` on success, else the error's mapped code. */
+export declare function exitCodeForResult(result: CoreResult<unknown>): ExitCode;
+/**
+ * How a CLI argument parser terminated, reduced to the two fields the exit-code decision needs — the
+ * parser's own outcome identifier and the exit code it *suggests*. Commander's `CommanderError` is
+ * structurally this (`.code` / `.exitCode`), so `src/cli` hands one straight in; the interface is
+ * declared structurally rather than importing `commander` so `core` keeps no dependency on the CLI's
+ * parser (REQ-SYS-05 — the same mapping has to be applicable from the MCP surface).
+ */
+export interface ParseOutcome {
+    /** The parser's outcome identifier, e.g. Commander's `'commander.unknownCommand'`. */
+    readonly code: string;
+    /** The exit code the parser suggests for this outcome — advisory, not the contract's answer. */
+    readonly exitCode: number;
+}
+/**
+ * How a parse outcome resolves against spec-005 §1: the exit code, and whether the **surface** still
+ * owes the `error:` line the section requires of every non-zero exit.
+ */
+export interface ParseTermination {
+    /** The contract's answer, overriding the parser's suggestion. */
+    readonly exitCode: ExitCode;
+    /**
+     * `true` when the parser terminated non-zero having written no error message of its own, so the
+     * surface must emit one to satisfy spec-005 §1's "a non-zero exit code is **always** accompanied by
+     * an error message on stderr". `false` when the parser already wrote its own `error: …` line (every
+     * code in {@link USAGE_ERROR_PARSE_CODES}) or when the exit is `0`. The message *text* is the
+     * surface's to compose — only the obligation is decided here.
+     */
+    readonly needsErrorLine: boolean;
+}
+/**
+ * Resolve a CLI argument parser's own termination against spec-005 §1 (REQ-INT-04 — task-101 /
+ * `bug-098`, extended by task-103 / `bug-103`). The parser reaches this both when it *refuses* an
+ * invocation and when it *completes* one without running a command (`--help`, `--version`), so the
+ * rule has three branches:
+ *
+ * - an outcome in {@link USAGE_ERROR_PARSE_CODES} is a malformed invocation → exit **2**, overriding
+ *   the parser's suggestion (Commander suggests `1` for every one of them). It wrote its own message,
+ *   so the surface owes nothing;
+ * - {@link INCOMPLETE_INVOCATION_PARSE_CODE} with a **non-zero** suggestion is an invocation the
+ *   parser found incomplete — a noun with no verb, `wingfoil` with no arguments, `help <unknown>`.
+ *   §1 lists a "missing required argument" among the malformed invocations, so it is exit **2** as
+ *   well; unlike the codes above it printed only help text, so `needsErrorLine` is `true`;
+ * - anything else is a *successful* termination or an outcome this contract does not classify, and
+ *   keeps the parser's own suggested code, narrowed to the three-code contract: `0` stays `0` (so
+ *   `--help`, `--version` and an explicit `help` still exit `0`, as spec-005 §1 requires), any
+ *   non-zero suggestion becomes `1`. That default is deliberately the status quo rather than `2`: an
+ *   unrecognised outcome must not silently acquire a usage-error meaning it was never shown to have —
+ *   and, for the same reason, must not acquire a manufactured error message either. The only code
+ *   that reaches it non-zero today is `commander.executeSubCommandAsync`, and WingFoil registers no
+ *   executable subcommand.
+ */
+export declare function classifyParseOutcome(outcome: ParseOutcome): ParseTermination;
+/**
+ * The exit code alone for a parse outcome — {@link classifyParseOutcome}'s `exitCode`, kept as a named
+ * function for callers (and tests) that care only about the code. It *delegates* rather than repeating
+ * the rule, so the code and the error-line obligation can never be decided from two different tables.
+ */
+export declare function exitCodeForParseOutcome(outcome: ParseOutcome): ExitCode;
+/** A thrown error's surface rendering: the human `reason` (spec-005 §3) and the process exit code. */
+export interface ThrownOutcome {
+    readonly reason: string;
+    readonly exitCode: ExitCode;
+}
+/**
+ * Select the exit code and reason for a core operation that *threw* (the throw-path companion to
+ * {@link exitCodeForResult}, which handles the return path). Keeping this in `src/core` is what lets a
+ * thrown usage/integrity error stay "core owns exit-code selection" (spec-008-cli-grammar
+ * Consequences), so both surfaces apply it identically rather than each re-deciding:
+ *
+ * - a {@link UsageError} (a malformed argument, e.g. `dna set`'s invalid key path) → exit **2**, with
+ *   its already-clean `.message` as the reason (task-025-implement-dna-set);
+ * - a {@link ValidationError} carries its own `exitCode` (integrity/cross-field → 2, field-level → 1,
+ *   per spec-009-validation-strategy §3), with the reason joined from its issue messages (never the
+ *   composite `${code} ${path} (${file}): …` form its `.message` builds);
+ * - anything else is a logic error → exit **1**, with the error's message (or its string form).
+ */
+export declare function exitCodeForThrow(error: unknown): ThrownOutcome;
+//# sourceMappingURL=exit-code.d.ts.map

package/dist/core/exit-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exit-code.d.ts","sourceRoot":"","sources":["../../src/core/exit-code.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,SAAS,EAAiB,UAAU,EAAE,MAAM,SAAS,CAAC;AAGpE,wGAAwG;AACxG,MAAM,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAgBjC,+DAA+D;AAC/D,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,GAAG,QAAQ,CAE3D;AAED,kGAAkG;AAClG,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,QAAQ,CAEvE;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,sFAAsF;IACtF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gGAAgG;IAChG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAoDD;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,YAAY,GAAG,gBAAgB,CAM5E;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,YAAY,GAAG,QAAQ,CAEvE;AAED,sGAAsG;AACtG,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;CAC7B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,CAS9D"}

package/dist/core/exit-code.js

@@ -0,0 +1,163 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.exitCodeForError = exitCodeForError;
+exports.exitCodeForResult = exitCodeForResult;
+exports.classifyParseOutcome = classifyParseOutcome;
+exports.exitCodeForParseOutcome = exitCodeForParseOutcome;
+exports.exitCodeForThrow = exitCodeForThrow;
+/**
+ * Exit-code selection (spec-005-cli-command-contract §1, REQ-INT-04 — task-012-cli-exit-code-contract).
+ *
+ * The `0`/`1`/`2` contract has a single source of truth here in `core`, not duplicated across the CLI
+ * and MCP surfaces: both derive severity from the same `CoreError` model (REQ-SYS-05), so this module
+ * owns the mapping from a domain outcome to its exit code and each surface only *applies* it
+ * (`src/cli/exit.ts`'s `exitWith`).
+ *
+ * Parse-level usage errors (`2`) are *detected* by a surface before any core call — an unknown
+ * command, an unknown option, a missing required argument — but since
+ * task-101-route-commander-parse-errors-through-the-exit-code-contract (`bug-098`) their **code** is
+ * decided here too, by {@link classifyParseOutcome}. Before that task the CLI's argument parser
+ * terminated through its own `process.exit(1)` and those classes never reached this module at all, so
+ * an unknown command reported `1` — the code spec-005 §1 reserves for a *well-formed* invocation that
+ * failed. Keeping the parse mapping here is what that task's AC6 protects: one place decides an exit
+ * code, not one place per error origin.
+ *
+ * task-103-a-missing-verb-exits-2-with-an-error-line (`bug-103`) added the second half of the same
+ * §1 rule to that one place: the section also states that a non-zero exit is **always** accompanied by
+ * an error message on stderr, and one parse outcome — an invocation the parser found incomplete —
+ * carries no message of its own. So {@link classifyParseOutcome} answers two questions rather than
+ * one, from a single rule: which exit code, and whether the surface still owes the `error:` line.
+ */
+const validation_1 = require("../validation");
+const usage_error_1 = require("./usage-error");
+/**
+ * Every `CoreError.code` is a **logic** error — a well-formed invocation that failed on business logic
+ * — so all map to exit `1`. Declared as an exhaustive `Record<CoreErrorCode, ExitCode>` on purpose: a
+ * future `CoreErrorCode` will not compile until its exit code is chosen here, rather than silently
+ * defaulting.
+ */
+const EXIT_CODE_BY_ERROR = {
+    NOT_FOUND: 1,
+    INVALID_TRANSITION: 1,
+    VALIDATION: 1,
+    CONFLICT: 1,
+    IO: 1,
+};
+/** The exit code a {@link CoreError} maps to (spec-005 §1). */
+function exitCodeForError(error) {
+    return EXIT_CODE_BY_ERROR[error.code];
+}
+/** The exit code for a whole {@link CoreResult}: `0` on success, else the error's mapped code. */
+function exitCodeForResult(result) {
+    return result.ok ? 0 : exitCodeForError(result.error);
+}
+/**
+ * The argument-parser outcomes that are **usage errors** under spec-005 §1 ("the invocation itself is
+ * malformed: unknown command/pillar/verb, unknown flag, missing required argument, invalid flag
+ * value") and therefore exit `2`, whatever the parser itself suggests.
+ *
+ * The identifiers are Commander's, confirmed against the **installed** version (`commander@15.0.0`,
+ * `node_modules/commander/lib/command.js` — `unknownOption()`, `excessArguments()`,
+ * `unknownCommand()`, `missingArgument()`, `optionMissingArgument()`, `missingMandatoryOptionValue()`,
+ * `conflictingOption()`, each calling `this.error(message, { code })`, plus `commander.error` as
+ * `error()`'s own default and `commander.invalidArgument` from `InvalidArgumentError`). They are
+ * version surface: a Commander upgrade that renames or adds one must revisit this set, which is why
+ * the codes are listed explicitly here rather than inferred from the suggested exit code.
+ *
+ * One of them, `commander.excessArguments`, is mapped but **unreachable in production today**: every
+ * derived command registers a variadic `[positionals...]` (`src/cli/program.ts`), so Commander never
+ * has an excess argument to refuse — `wingfoil dna show project extra` is accepted and an extra
+ * positional on a write verb is refused by WingFoil's own check instead, already at exit `2`. It is
+ * listed because the mapping must stay correct for the code rather than for today's registration
+ * shape; a reader finding it never fires is not looking at a mistake.
+ */
+const USAGE_ERROR_PARSE_CODES = new Set([
+    'commander.unknownCommand',
+    'commander.unknownOption',
+    'commander.excessArguments',
+    'commander.missingArgument',
+    'commander.optionMissingArgument',
+    'commander.missingMandatoryOptionValue',
+    'commander.conflictingOption',
+    'commander.invalidArgument',
+    'commander.error',
+]);
+/**
+ * The parser outcome that reports an **incomplete invocation**: the parser had nothing to run and
+ * printed the command's help to stderr instead of an error (task-103, `bug-103`).
+ *
+ * This is *not* an error code — it is the same identifier Commander uses when the user asks for help
+ * with the built-in `help` command, which must keep exiting `0`. The two are separated by the
+ * **suggested exit code** carried alongside it: `Command#help(contextOptions)`
+ * (`node_modules/commander/lib/command.js`, commander@15.0.0) suggests `1` exactly when it was called
+ * as `help({ error: true })`, which is what its three "there is nothing here to run" call sites do —
+ * the missing-subcommand branch, the nothing-hooked-up branch, and `_dispatchSubcommand`'s
+ * `if (!subCommand)`, where `wingfoil help <unknown>` lands. A user-requested help suggests `0`.
+ *
+ * That one bit is the whole discriminator, and it is read from the parser's own two fields rather
+ * than by re-reading argv — so this module still decides alone, and the surface never re-parses an
+ * invocation the parser has already parsed.
+ */
+const INCOMPLETE_INVOCATION_PARSE_CODE = 'commander.help';
+/**
+ * Resolve a CLI argument parser's own termination against spec-005 §1 (REQ-INT-04 — task-101 /
+ * `bug-098`, extended by task-103 / `bug-103`). The parser reaches this both when it *refuses* an
+ * invocation and when it *completes* one without running a command (`--help`, `--version`), so the
+ * rule has three branches:
+ *
+ * - an outcome in {@link USAGE_ERROR_PARSE_CODES} is a malformed invocation → exit **2**, overriding
+ *   the parser's suggestion (Commander suggests `1` for every one of them). It wrote its own message,
+ *   so the surface owes nothing;
+ * - {@link INCOMPLETE_INVOCATION_PARSE_CODE} with a **non-zero** suggestion is an invocation the
+ *   parser found incomplete — a noun with no verb, `wingfoil` with no arguments, `help <unknown>`.
+ *   §1 lists a "missing required argument" among the malformed invocations, so it is exit **2** as
+ *   well; unlike the codes above it printed only help text, so `needsErrorLine` is `true`;
+ * - anything else is a *successful* termination or an outcome this contract does not classify, and
+ *   keeps the parser's own suggested code, narrowed to the three-code contract: `0` stays `0` (so
+ *   `--help`, `--version` and an explicit `help` still exit `0`, as spec-005 §1 requires), any
+ *   non-zero suggestion becomes `1`. That default is deliberately the status quo rather than `2`: an
+ *   unrecognised outcome must not silently acquire a usage-error meaning it was never shown to have —
+ *   and, for the same reason, must not acquire a manufactured error message either. The only code
+ *   that reaches it non-zero today is `commander.executeSubCommandAsync`, and WingFoil registers no
+ *   executable subcommand.
+ */
+function classifyParseOutcome(outcome) {
+    if (USAGE_ERROR_PARSE_CODES.has(outcome.code))
+        return { exitCode: 2, needsErrorLine: false };
+    if (outcome.code === INCOMPLETE_INVOCATION_PARSE_CODE && outcome.exitCode !== 0) {
+        return { exitCode: 2, needsErrorLine: true };
+    }
+    return { exitCode: outcome.exitCode === 0 ? 0 : 1, needsErrorLine: false };
+}
+/**
+ * The exit code alone for a parse outcome — {@link classifyParseOutcome}'s `exitCode`, kept as a named
+ * function for callers (and tests) that care only about the code. It *delegates* rather than repeating
+ * the rule, so the code and the error-line obligation can never be decided from two different tables.
+ */
+function exitCodeForParseOutcome(outcome) {
+    return classifyParseOutcome(outcome).exitCode;
+}
+/**
+ * Select the exit code and reason for a core operation that *threw* (the throw-path companion to
+ * {@link exitCodeForResult}, which handles the return path). Keeping this in `src/core` is what lets a
+ * thrown usage/integrity error stay "core owns exit-code selection" (spec-008-cli-grammar
+ * Consequences), so both surfaces apply it identically rather than each re-deciding:
+ *
+ * - a {@link UsageError} (a malformed argument, e.g. `dna set`'s invalid key path) → exit **2**, with
+ *   its already-clean `.message` as the reason (task-025-implement-dna-set);
+ * - a {@link ValidationError} carries its own `exitCode` (integrity/cross-field → 2, field-level → 1,
+ *   per spec-009-validation-strategy §3), with the reason joined from its issue messages (never the
+ *   composite `${code} ${path} (${file}): …` form its `.message` builds);
+ * - anything else is a logic error → exit **1**, with the error's message (or its string form).
+ */
+function exitCodeForThrow(error) {
+    if (error instanceof usage_error_1.UsageError) {
+        return { reason: error.message, exitCode: 2 };
+    }
+    if (error instanceof validation_1.ValidationError) {
+        const reason = error.issues.length > 0 ? error.issues.map((issue) => issue.message).join('; ') : error.message;
+        return { reason, exitCode: error.exitCode === 2 ? 2 : 1 };
+    }
+    return { reason: error instanceof Error ? error.message : String(error), exitCode: 1 };
+}
+//# sourceMappingURL=exit-code.js.map

package/dist/core/exit-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exit-code.js","sourceRoot":"","sources":["../../src/core/exit-code.ts"],"names":[],"mappings":";;AA8CA,4CAEC;AAGD,8CAEC;AAyGD,oDAMC;AAOD,0DAEC;AAqBD,4CASC;AA3MD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,8CAAgD;AAGhD,+CAA2C;AAK3C;;;;;GAKG;AACH,MAAM,kBAAkB,GAAoC;IAC1D,SAAS,EAAE,CAAC;IACZ,kBAAkB,EAAE,CAAC;IACrB,UAAU,EAAE,CAAC;IACb,QAAQ,EAAE,CAAC;IACX,EAAE,EAAE,CAAC;CACN,CAAC;AAEF,+DAA+D;AAC/D,SAAgB,gBAAgB,CAAC,KAAgB;IAC/C,OAAO,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,kGAAkG;AAClG,SAAgB,iBAAiB,CAAC,MAA2B;IAC3D,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAgBD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC;IAC3D,0BAA0B;IAC1B,yBAAyB;IACzB,2BAA2B;IAC3B,2BAA2B;IAC3B,iCAAiC;IACjC,uCAAuC;IACvC,6BAA6B;IAC7B,2BAA2B;IAC3B,iBAAiB;CAClB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,gCAAgC,GAAG,gBAAgB,CAAC;AAmB1D;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAgB,oBAAoB,CAAC,OAAqB;IACxD,IAAI,uBAAuB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IAC7F,IAAI,OAAO,CAAC,IAAI,KAAK,gCAAgC,IAAI,OAAO,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAChF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AAC7E,CAAC;AAED;;;;GAIG;AACH,SAAgB,uBAAuB,CAAC,OAAqB;IAC3D,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;AAChD,CAAC;AAQD;;;;;;;;;;;;GAYG;AACH,SAAgB,gBAAgB,CAAC,KAAc;IAC7C,IAAI,KAAK,YAAY,wBAAU,EAAE,CAAC;QAChC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,KAAK,YAAY,4BAAe,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;QAC/G,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AACzF,CAAC"}

package/dist/core/git-identity.d.ts

@@ -0,0 +1,32 @@
+import { type CoreResult } from './types';
+/**
+ * The single source of truth for "a configured/attributable identity": non-empty `name` AND
+ * non-empty `email`. Both the write-time precondition below (`requireGitIdentity`, REQ-SEC-01,
+ * task-014-git-identity-required) and the read-time historical audit (`isValidAttribution` in
+ * `src/memory/audit.ts`, REQ-SEC-02, task-015-complete-audit-trail) build on this exact predicate for
+ * their shared base check — see `isValidAttribution`'s doc-comment for the audit-only augmentations
+ * it layers on top for historical commits (a concern this write-time check has no need for, since it
+ * only ever looks at the *current* live git config). Pure predicate — no git/filesystem access.
+ */
+export declare function isConfiguredIdentity(name: string, email: string): boolean;
+/** The `user.name`/`user.email` pair `readGitIdentity` resolves at a given root — either may be `''` (unset). */
+export interface GitIdentity {
+    readonly name: string;
+    readonly email: string;
+}
+/**
+ * Read the live `user.name`/`user.email` git identity configured at `root`, with no "is it valid"
+ * judgement of its own (that is {@link isConfiguredIdentity}'s job) — the single read primitive both
+ * {@link requireGitIdentity} (REQ-SEC-01) and `src/core/approval-authority.ts`'s
+ * `requireApprovalAuthority` (REQ-SEC-03, task-040-role-based-approval-authority) build on, so the two
+ * checks never each re-implement their own `git config` read.
+ */
+export declare function readGitIdentity(root: string): GitIdentity;
+/**
+ * Verify a git identity is configured at `root` before a state mutation. Returns a
+ * `CoreResult.error` (code `VALIDATION` — a failed precondition, mapped to exit `1` by
+ * `exitCodeForError`) carrying the exact REQ-SEC-01 message when either `user.name` or `user.email`
+ * is unset; otherwise `ok`.
+ */
+export declare function requireGitIdentity(root: string): CoreResult<void>;
+//# sourceMappingURL=git-identity.d.ts.map

package/dist/core/git-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-identity.d.ts","sourceRoot":"","sources":["../../src/core/git-identity.ts"],"names":[],"mappings":"AAaA,OAAO,EAAmB,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AAqB3D;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAEzE;AAED,iHAAiH;AACjH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAEzD;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAMjE"}

package/dist/core/git-identity.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isConfiguredIdentity = isConfiguredIdentity;
+exports.readGitIdentity = readGitIdentity;
+exports.requireGitIdentity = requireGitIdentity;
+/**
+ * Git-identity pre-flight check (REQ-SEC-01, adr-006-git-identity-role-based-authz —
+ * task-014-git-identity-required).
+ *
+ * Git identity is WingFoil's sole attribution mechanism: the commit author *is* the "who" of the
+ * audit trail (adr-001 / adr-006 — no separate auth/session/IAM layer). So every state-mutating
+ * operation must refuse to run when `user.name`/`user.email` are unset, rather than produce a commit
+ * with an unattributable author. This check lives in `src/core` so the CLI and every MCP Tool enforce
+ * it identically by construction (REQ-SYS-05) — a mutation calls it first and returns its
+ * `CoreResult.error` unchanged, so the surface renders the exact message and writes nothing.
+ */
+const node_child_process_1 = require("node:child_process");
+const types_1 = require("./types");
+/** Exact refusal message required by REQ-SEC-01's fit criterion — do not reword. */
+const IDENTITY_ERROR = 'git identity not configured (user.name/user.email)';
+/**
+ * The effective value of a git config `key` at `root`, or `''` when it is unset — git exits non-zero
+ * for an unset key, which we treat as absent (the same "empty means unconfigured" contract the check
+ * relies on). Resolves local → global → system exactly as any git command would.
+ */
+function readGitConfig(root, key) {
+    try {
+        // `env: process.env` is passed explicitly (identical to the default in production): it makes git's
+        // config resolution follow the current environment by design, so a caller/test can scope it via
+        // `GIT_CONFIG_GLOBAL`/`GIT_CONFIG_SYSTEM`/`GIT_CONFIG_NOSYSTEM` deterministically.
+        return (0, node_child_process_1.execFileSync)('git', ['-C', root, 'config', key], { encoding: 'utf-8', env: process.env }).trim();
+    }
+    catch {
+        return '';
+    }
+}
+/**
+ * The single source of truth for "a configured/attributable identity": non-empty `name` AND
+ * non-empty `email`. Both the write-time precondition below (`requireGitIdentity`, REQ-SEC-01,
+ * task-014-git-identity-required) and the read-time historical audit (`isValidAttribution` in
+ * `src/memory/audit.ts`, REQ-SEC-02, task-015-complete-audit-trail) build on this exact predicate for
+ * their shared base check — see `isValidAttribution`'s doc-comment for the audit-only augmentations
+ * it layers on top for historical commits (a concern this write-time check has no need for, since it
+ * only ever looks at the *current* live git config). Pure predicate — no git/filesystem access.
+ */
+function isConfiguredIdentity(name, email) {
+    return name.length > 0 && email.length > 0;
+}
+/**
+ * Read the live `user.name`/`user.email` git identity configured at `root`, with no "is it valid"
+ * judgement of its own (that is {@link isConfiguredIdentity}'s job) — the single read primitive both
+ * {@link requireGitIdentity} (REQ-SEC-01) and `src/core/approval-authority.ts`'s
+ * `requireApprovalAuthority` (REQ-SEC-03, task-040-role-based-approval-authority) build on, so the two
+ * checks never each re-implement their own `git config` read.
+ */
+function readGitIdentity(root) {
+    return { name: readGitConfig(root, 'user.name'), email: readGitConfig(root, 'user.email') };
+}
+/**
+ * Verify a git identity is configured at `root` before a state mutation. Returns a
+ * `CoreResult.error` (code `VALIDATION` — a failed precondition, mapped to exit `1` by
+ * `exitCodeForError`) carrying the exact REQ-SEC-01 message when either `user.name` or `user.email`
+ * is unset; otherwise `ok`.
+ */
+function requireGitIdentity(root) {
+    const { name, email } = readGitIdentity(root);
+    if (!isConfiguredIdentity(name, email)) {
+        return (0, types_1.coreErr)({ code: 'VALIDATION', message: IDENTITY_ERROR });
+    }
+    return (0, types_1.coreOk)(undefined);
+}
+//# sourceMappingURL=git-identity.js.map

package/dist/core/git-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-identity.js","sourceRoot":"","sources":["../../src/core/git-identity.ts"],"names":[],"mappings":";;AA2CA,oDAEC;AAeD,0CAEC;AAQD,gDAMC;AA5ED;;;;;;;;;;GAUG;AACH,2DAAkD;AAElD,mCAA2D;AAE3D,oFAAoF;AACpF,MAAM,cAAc,GAAG,oDAAoD,CAAC;AAE5E;;;;GAIG;AACH,SAAS,aAAa,CAAC,IAAY,EAAE,GAAW;IAC9C,IAAI,CAAC;QACH,mGAAmG;QACnG,gGAAgG;QAChG,mFAAmF;QACnF,OAAO,IAAA,iCAAY,EAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1G,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,oBAAoB,CAAC,IAAY,EAAE,KAAa;IAC9D,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7C,CAAC;AAQD;;;;;;GAMG;AACH,SAAgB,eAAe,CAAC,IAAY;IAC1C,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC;AAC9F,CAAC;AAED;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,IAAY;IAC7C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,IAAA,eAAO,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,IAAA,cAAM,EAAO,SAAS,CAAC,CAAC;AACjC,CAAC"}