@bitkyc08/opencodex 2.11.1 → 2.12.0

package/src/lab/live/transport.ts

@@ -0,0 +1,116 @@
+import type { FailureClassification } from "../conformance/types";
+import { assertLeaseScope, LabCredentialError } from "./credential-lease";
+import type {
+  LabCredentialLeaseV1, LabDestinationV1, LabPinnedSender, LabTransport, LabTransportRequest,
+  LabTransportResponse, LiveRunConfig, TransportErrorCode,
+} from "./types";
+
+export interface MockTransportEntry {
+  matchPath?: string | RegExp;
+  status: number;
+  headers?: Record<string, string>;
+  body: string;
+  error?: TransportErrorCode;
+}
+export interface MockTransportOptions { entries?: MockTransportEntry[]; onRequest?: (req: LabTransportRequest) => void }
+
+/** Test seam only. No live runner path creates this implicitly. */
+export function createMockTransport(opts: MockTransportOptions = {}): LabTransport {
+  let callIndex = 0;
+  return {
+    async request(req): Promise<LabTransportResponse> {
+      opts.onRequest?.(req);
+      const entry = opts.entries?.[callIndex] ?? opts.entries?.[opts.entries.length - 1];
+      callIndex += 1;
+      if (!entry) throw new TransportError("harness_failure", "no mock transport entry");
+      if (entry.error) throw new TransportError(entry.error, entry.error);
+      if (entry.matchPath) {
+        const ok = typeof entry.matchPath === "string" ? req.path.includes(entry.matchPath) : entry.matchPath.test(req.path);
+        if (!ok) throw new TransportError("harness_failure", "mock path mismatch");
+      }
+      if (entry.status >= 300 && entry.status < 400) throw new TransportError("redirect_blocked", "redirect response");
+      return { status: entry.status, headers: { "content-type": "application/json", ...(entry.headers ?? {}) }, body: entry.body };
+    },
+  };
+}
+
+export interface PinnedTransportOptions {
+  destination: LabDestinationV1;
+  lease: LabCredentialLeaseV1;
+  sender: LabPinnedSender;
+  limits: LiveRunConfig;
+  transportId?: string;
+}
+
+function assertRelativeRequestPath(path: string): void {
+  if (!path.startsWith("/") || path.startsWith("//") || path.includes("://") || /[\r\n]/.test(path)) {
+    throw new TransportError("harness_failure", "request path attempted to widen destination");
+  }
+}
+
+function selectedPinnedAddress(destination: LabDestinationV1): { address: string; family: 4 | 6 } {
+  const row = destination.addresses.find((a) => a.family === 4) ?? destination.addresses[0];
+  if (!row) throw new TransportError("harness_failure", "approved destination has no address");
+  return { address: row.address, family: row.family };
+}
+
+/** Uses only the frozen approved address set. Secret injection is owned by the trusted sender, outside Lab. */
+export function createPinnedTransport(opts: PinnedTransportOptions): LabTransport {
+  const transportId = opts.transportId ?? "default";
+  return {
+    async request(req): Promise<LabTransportResponse> {
+      assertRelativeRequestPath(req.path);
+      assertLeaseScope(opts.lease, opts.destination, transportId);
+      const inputBytes = new TextEncoder().encode(req.body ?? "").byteLength;
+      if (inputBytes > opts.limits.maxInputBytes) throw new TransportError("input_byte_limit", "request exceeds input byte budget");
+      opts.lease.consume();
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(new TransportError("total_timeout", "live request total timeout")), opts.limits.totalTimeoutMs);
+      const onAbort = () => controller.abort(req.signal?.reason);
+      req.signal?.addEventListener("abort", onAbort, { once: true });
+      try {
+        const response = await opts.sender(opts.lease, opts.destination, selectedPinnedAddress(opts.destination), req, controller.signal, opts.limits);
+        const outputBytes = new TextEncoder().encode(response.body).byteLength;
+        if (outputBytes > opts.limits.maxOutputBytes) throw new TransportError("output_byte_limit", "response exceeds output byte budget");
+        if (response.status >= 300 && response.status < 400) throw new TransportError("redirect_blocked", "redirect response");
+        if (response.status === 401 || response.status === 403) throw new TransportError("auth_blocked", `HTTP ${response.status}`);
+        if (response.status === 429) throw new TransportError("quota_blocked", "HTTP 429");
+        if (response.status === 451) throw new TransportError("region_blocked", "HTTP 451");
+        if (response.status >= 500) throw new TransportError("provider_transient", `HTTP ${response.status}`);
+        return response;
+      } catch (error) {
+        if (error instanceof LabCredentialError) {
+          throw new TransportError(error.code === "budget_exhausted" ? "request_limit" : "harness_failure", error.message);
+        }
+        throw error;
+      } finally {
+        clearTimeout(timer);
+        req.signal?.removeEventListener("abort", onAbort);
+      }
+    },
+  };
+}
+
+export class TransportError extends Error {
+  override readonly name = "TransportError";
+  constructor(readonly code: TransportErrorCode, message: string) { super(message); }
+}
+
+export function classifyTransportError(error: unknown): { classification: FailureClassification; secondaryCode: string } {
+  const code = error instanceof TransportError ? error.code : undefined;
+  switch (code) {
+    case "auth_blocked": return { classification: "authentication_blocked", secondaryCode: code };
+    case "quota_blocked": return { classification: "quota_blocked", secondaryCode: code };
+    case "network_blocked": return { classification: "network_failure", secondaryCode: code };
+    case "region_blocked": return { classification: "region_blocked", secondaryCode: code };
+    case "provider_transient": return { classification: "provider_transient", secondaryCode: code };
+    case "connect_timeout": case "first_byte_timeout": case "inactivity_timeout": case "total_timeout":
+      return { classification: "timeout", secondaryCode: code };
+    case "request_limit": case "input_byte_limit": case "output_byte_limit": case "output_token_limit":
+    case "tool_call_limit": case "artifact_byte_limit": case "memory_limit": case "child_process_limit":
+      return { classification: "budget_exhausted", secondaryCode: code };
+    case "live_transport_required": case "untrusted_route_executor": case "redirect_blocked": case "destination_mismatch": case "host_sni_mismatch": case "harness_failure":
+      return { classification: "harness_failure", secondaryCode: code };
+    default: return { classification: "harness_failure", secondaryCode: "execution_error" };
+  }
+}

package/src/lab/live/types.ts

@@ -0,0 +1,197 @@
+import type { FailureClassification, NormalizedObservation } from "../conformance/types";
+import type { RouteDependencyV1, RouteSubjectV1 } from "../events/types";
+
+export interface LabDestinationV1 {
+  readonly scheme: "http" | "https";
+  readonly host: string;
+  readonly port: number;
+  readonly basePath: string;
+  readonly sniHost: string;
+  readonly addresses: ReadonlyArray<{ readonly address: string; readonly family: 4 | 6 }>;
+  readonly privateNetwork: boolean;
+  readonly fingerprint: string;
+}
+
+export type LabBehaviorSource =
+  | "request"
+  | "model_override"
+  | "provider_config"
+  | "registry_runtime_default"
+  | "generated_model_metadata"
+  | "global_config"
+  | "adapter_default"
+  | "lab_forced";
+
+export interface LabBehaviorValue {
+  source: LabBehaviorSource;
+  value: unknown;
+}
+
+/** Authoritative effective values emitted by the production route/model/adapter resolver. */
+export type LabBehaviorValues = Record<string, LabBehaviorValue>;
+
+export interface LabRouteContext {
+  providerId: string;
+  /** Config-owner identity only; HMACed before it enters evidence. */
+  providerInstanceKey: string;
+  clientModelId: string;
+  upstreamModelId: string;
+  effectiveAdapter: string;
+  inboundProtocol: string;
+  upstreamProtocol: string;
+  surface: string;
+  baseUrl: string;
+  /** Generated compatibility hash, not package marketing version. */
+  opencodexCompatibilityVersion: string;
+  /** Closed, effective behavior inputs from the production resolver. */
+  behaviorValues: LabBehaviorValues;
+  allowPrivateNetwork?: boolean;
+  labRunApproval?: boolean;
+  requiredClaims?: string[];
+  availableHarnessFeatures?: string[];
+  dependencies?: RouteDependencyV1[];
+}
+
+export interface LiveRunConfig {
+  totalTimeoutMs: number;
+  connectTimeoutMs: number;
+  firstByteTimeoutMs: number;
+  inactivityTimeoutMs: number;
+  maxRequests: number;
+  maxInputBytes: number;
+  maxOutputBytes: number;
+  maxOutputTokens: number;
+  maxToolCalls: number;
+  maxMemoryBytes: number;
+  maxChildProcesses: number;
+  maxArtifacts: number;
+  perArtifactBytes: number;
+  aggregateArtifactBytes: number;
+}
+
+export type DnsResolver = (hostname: string) => Promise<Array<{ address: string; family: 4 | 6 }>>;
+
+export type TransportErrorCode =
+  | "auth_blocked"
+  | "quota_blocked"
+  | "network_blocked"
+  | "region_blocked"
+  | "provider_transient"
+  | "redirect_blocked"
+  | "destination_mismatch"
+  | "host_sni_mismatch"
+  | "connect_timeout"
+  | "first_byte_timeout"
+  | "inactivity_timeout"
+  | "total_timeout"
+  | "request_limit"
+  | "input_byte_limit"
+  | "output_byte_limit"
+  | "output_token_limit"
+  | "tool_call_limit"
+  | "artifact_byte_limit"
+  | "memory_limit"
+  | "child_process_limit"
+  | "live_transport_required"
+  | "untrusted_route_executor"
+  | "harness_failure";
+
+export interface LabTransportRequest {
+  method: "GET" | "POST";
+  path: string;
+  headers?: Record<string, string>;
+  body?: string;
+  signal?: AbortSignal;
+}
+
+export interface LabTransportResponse {
+  status: number;
+  headers: Record<string, string>;
+  body: string;
+}
+
+export type TransportRequest = LabTransportRequest;
+export type TransportResponse = LabTransportResponse;
+
+export interface LabTransport {
+  request(req: LabTransportRequest): Promise<LabTransportResponse>;
+}
+
+export const LAB_CREDENTIAL_LEASE = Symbol("LabCredentialLeaseV1");
+
+/** Opaque capability. Scope metadata and secret material are deliberately not public fields. */
+export interface LabCredentialLeaseV1 {
+  readonly [LAB_CREDENTIAL_LEASE]: true;
+  readonly remainingRequests: number;
+  consume(): void;
+}
+
+export interface LabPinnedAddress {
+  address: string;
+  family: 4 | 6;
+}
+
+/** Trusted provider/credential transport seam. Implementations own secret injection outside Lab. */
+export type LabPinnedSender = (
+  lease: LabCredentialLeaseV1,
+  destination: LabDestinationV1,
+  pinned: LabPinnedAddress,
+  request: LabTransportRequest,
+  signal: AbortSignal,
+  limits: LiveRunConfig,
+) => Promise<LabTransportResponse>;
+
+export interface LabRouteExecutorInput {
+  routeContext: LabRouteContext;
+  destination: LabDestinationV1;
+  routeSubject: RouteSubjectV1;
+  scenarioId: string;
+  initiatingRequest?: string;
+  limits: LiveRunConfig;
+  signal: AbortSignal;
+  environment: Readonly<Record<string, string>>;
+}
+
+/** Trusted exact-route execution function. The wrapper capability is issued only by the host integration. */
+export type LabRouteExecutor = (input: LabRouteExecutorInput) => Promise<NormalizedObservation>;
+
+export const REQUIRED_LAB_SANDBOX_BOUNDARIES = [
+  "destination_pinning",
+  "credential_binding",
+  "wall_clock",
+  "connect_timeout",
+  "first_byte_timeout",
+  "inactivity_timeout",
+  "request_budget",
+  "input_byte_budget",
+  "output_byte_budget",
+  "output_token_budget",
+  "tool_call_budget",
+  "memory_limit",
+  "child_process_limit",
+  "artifact_budget",
+] as const;
+export type LabSandboxBoundary = typeof REQUIRED_LAB_SANDBOX_BOUNDARIES[number];
+
+/** Opaque host-issued capability; runtime trust is established outside Lab. */
+export interface TrustedLabRouteExecutor {
+  execute(input: LabRouteExecutorInput): Promise<NormalizedObservation>;
+  readonly enforcedBoundaries: readonly LabSandboxBoundary[];
+}
+
+export type LiveExecutionAuthority = "trusted_route" | "test_transport" | "none";
+
+export interface LiveScenarioRunResult {
+  scenarioId: string;
+  suite: string;
+  startedAt: number;
+  completedAt: number;
+  passed: boolean;
+  classification: FailureClassification;
+  secondaryCode?: string;
+  assertionResults: import("../conformance/types").AssertionResult[];
+  diagnostics: string[];
+  routeSubject?: RouteSubjectV1;
+  transportError?: TransportErrorCode;
+  executionAuthority: LiveExecutionAuthority;
+}

package/src/lab/observe/from-conformance.ts

@@ -0,0 +1,344 @@
+/**
+ * Persistence seam: transform CL-01 conformance results into valid observation events.
+ * Deterministic harness execution stays separate from ledger persistence.
+ */
+import { createHash } from "node:crypto";
+import { createArtifactStore, type ArtifactStore } from "../artifacts/store";
+import { sanitizeDiagnostic, truncateUtf8 } from "../artifacts/sanitize";
+import {
+  LAB_EVENT_SCHEMA_VERSION,
+  LAB_PRODUCER,
+  LAB_PRODUCER_VERSION,
+  type ObservationOutcome,
+} from "../constants";
+import {
+  jcsStringify,
+  scenarioManifestDigest,
+  subjectIdForSubject,
+  suiteManifestDigest,
+} from "../digest";
+import type { ObservationEvent, ProtocolSubjectV1 } from "../events/types";
+import { assignEventId } from "../events/validate";
+import { appendLabEvent } from "../ledger/store";
+import { ensureLabDirs } from "../paths";
+import type {
+  CaseAuthority,
+  CaseRecord,
+  ProtocolExecutionContextV1,
+  ScenarioRunResult,
+} from "../conformance/types";
+import { expandScenario } from "../conformance/manifest";
+import { suiteManifestObjectForCase } from "../conformance/suite-manifest";
+import { fixtureDigest } from "../conformance/digest";
+import { resolveProtocolExecutionContext } from "../conformance/executor";
+
+const COMPAT_VERSION = "protocol-v1";
+
+export interface PersistConformanceOptions {
+  configDir?: string;
+  recordedAt?: number;
+  /** Optional explicit override for the runner-provided execution timestamps. */
+  startedAt?: number;
+  completedAt?: number;
+  producerVersion?: string;
+  artifactStore?: ArtifactStore;
+}
+
+export interface PersistedConformanceObservation {
+  event: ObservationEvent;
+  ledgerPath: string;
+}
+
+function validateExecutionContext(
+  caseRecord: CaseRecord,
+  ctx: ProtocolExecutionContextV1,
+): ProtocolExecutionContextV1 {
+  const checks: Array<[string, string[], string]> = [
+    ["inboundProtocols", caseRecord.requirements.inboundProtocols, ctx.inboundProtocol],
+    ["upstreamProtocols", caseRecord.requirements.upstreamProtocols, ctx.upstreamProtocol],
+    ["surfaces", caseRecord.requirements.surfaces, ctx.surface],
+  ];
+  for (const [name, declared, actual] of checks) {
+    if (declared.length === 0) throw new Error(`case ${caseRecord.id} has empty ${name}`);
+    if (!declared.includes(actual)) {
+      throw new Error(`case ${caseRecord.id} execution context violates ${name}`);
+    }
+  }
+  return ctx;
+}
+
+function behaviorFingerprintForCase(
+  caseRecord: CaseRecord,
+  executionContext?: ProtocolExecutionContextV1,
+): string {
+  const ctx = validateExecutionContext(
+    caseRecord,
+    executionContext ?? resolveProtocolExecutionContext(caseRecord),
+  );
+  const adapter = upstreamAdapter(ctx.upstreamProtocol);
+  const values = {
+    schemaVersion: 1,
+    resolverVersion: 1,
+    values: {
+      "wire.adapter": {
+        source: "lab_forced",
+        value: adapter,
+      },
+      "wire.upstreamProtocol": {
+        source: "lab_forced",
+        value: ctx.upstreamProtocol,
+      },
+      "runtime.arch": {
+        source: "lab_forced",
+        value: process.arch,
+      },
+      "runtime.bunVersion": {
+        source: "lab_forced",
+        value: process.versions.bun ?? Bun.version,
+      },
+      "runtime.platform": {
+        source: "lab_forced",
+        value: process.platform,
+      },
+    },
+  };
+  return createHash("sha256").update(jcsStringify(values)).digest("hex");
+}
+
+function protocolSubject(caseRecord: CaseRecord, result: ScenarioRunResult): ProtocolSubjectV1 {
+  const ctx = validateExecutionContext(
+    caseRecord,
+    result.executionContext ?? resolveProtocolExecutionContext(caseRecord),
+  );
+  return {
+    subjectSchemaVersion: 1,
+    subjectKind: "protocol",
+    opencodexCompatibilityVersion: COMPAT_VERSION,
+    effectiveAdapter: upstreamAdapter(ctx.upstreamProtocol),
+    inboundProtocol: ctx.inboundProtocol,
+    upstreamProtocol: ctx.upstreamProtocol,
+    surface: ctx.surface,
+    behaviorFingerprint: behaviorFingerprintForCase(caseRecord, ctx),
+  };
+}
+
+function upstreamAdapter(protocol: string): string {
+  switch (protocol) {
+    case "openai-responses":
+      return "openai-responses";
+    case "anthropic-messages":
+      return "anthropic";
+    case "openai-chat":
+      return "openai-chat";
+    default:
+      throw new Error(`unsupported protocol identity: ${protocol}`);
+  }
+}
+
+function outcomeFromResult(result: ScenarioRunResult): ObservationOutcome {
+  if (result.passed) return "pass";
+  switch (result.classification) {
+    case "timeout":
+    case "budget_exhausted":
+    case "authentication_blocked":
+    case "quota_blocked":
+    case "region_blocked":
+    case "network_failure":
+    case "provider_transient":
+      return "blocked";
+    case "inconclusive":
+    case "harness_failure":
+      return "inconclusive";
+    case "protocol_failure":
+    case "capability_failure":
+    case "behavioral_failure":
+      return "fail";
+    default: {
+      const _never: never = result.classification;
+      throw new Error(`unmapped failure classification: ${String(_never)}`);
+    }
+  }
+}
+
+function requireExecutionTimes(
+  result: ScenarioRunResult,
+  opts: PersistConformanceOptions,
+): { startedAt: number; completedAt: number } {
+  const startedAt = opts.startedAt ?? result.startedAt;
+  const completedAt = opts.completedAt ?? result.completedAt;
+  if (!Number.isInteger(startedAt) || !Number.isInteger(completedAt)) {
+    throw new Error("real startedAt/completedAt are required for persisted conformance evidence");
+  }
+  if (startedAt < 0 || completedAt < startedAt) {
+    throw new Error("invalid persisted conformance execution timestamps");
+  }
+  return { startedAt, completedAt };
+}
+
+/**
+ * Build a valid protocol_conformance observation from one CL-01 scenario result.
+ * Does not append; use persistConformanceResult for ledger write.
+ */
+export function observationFromConformanceResult(
+  result: ScenarioRunResult,
+  caseRecord: CaseRecord,
+  authority: CaseAuthority,
+  opts: PersistConformanceOptions = {},
+): { event: ObservationEvent; artifacts: ReturnType<ArtifactStore["put"]>[] } {
+  const paths = ensureLabDirs(opts.configDir);
+  const ownsStore = !opts.artifactStore;
+  const store = opts.artifactStore ?? createArtifactStore(paths.artifactsDir);
+  try {
+    const { startedAt, completedAt } = requireExecutionTimes(result, opts);
+    const recordedAt = opts.recordedAt ?? completedAt;
+
+    const expandedScenario = expandScenario(caseRecord, authority);
+    const scenarioDigest = scenarioManifestDigest(expandedScenario);
+    const suiteExpanded = suiteManifestObjectForCase(caseRecord, authority);
+    const suiteDigest = suiteManifestDigest(suiteExpanded);
+
+    const fixtureDigests: string[] = [];
+    const artifacts: ReturnType<ArtifactStore["put"]>[] = [];
+
+    const putFixture = (fixture: CaseRecord["fixture"]) => {
+      const bytes = new TextEncoder().encode(fixture.bytesUtf8);
+      const digest = fixtureDigest(bytes);
+      fixtureDigests.push(digest);
+      artifacts.push(
+        store.put({
+          artifactClass: "fixture",
+          payload: bytes,
+          expectedDigest: digest,
+          mediaType: fixture.mediaType,
+        }),
+      );
+    };
+    putFixture(caseRecord.fixture);
+    if (caseRecord.initiatingRequest) putFixture(caseRecord.initiatingRequest);
+
+    artifacts.push(
+      store.put({
+        artifactClass: "scenario_manifest",
+        payload: expandedScenario,
+        expectedDigest: scenarioDigest,
+      }),
+    );
+    artifacts.push(
+      store.put({
+        artifactClass: "suite_manifest",
+        payload: suiteExpanded,
+        expectedDigest: suiteDigest,
+      }),
+    );
+
+    const assertionReport = store.put({
+      artifactClass: "assertion_report",
+      payload: {
+        scenarioId: result.scenarioId,
+        passed: result.passed,
+        classification: result.classification,
+        assertions: result.assertionResults.map((a) => ({
+          id: a.id,
+          operator: a.operator,
+          required: a.required,
+          passed: a.passed,
+          observedSummary: a.observedSummary,
+          reason: a.reason,
+        })),
+      },
+    });
+    artifacts.push(assertionReport);
+
+    const subject = protocolSubject(caseRecord, result);
+    const subjectId = subjectIdForSubject(subject);
+    const outcome = outcomeFromResult(result);
+    const authorityLimits = authority.manifestDefaults.executionLimits;
+
+    const eventWithoutId = {
+      schemaVersion: LAB_EVENT_SCHEMA_VERSION,
+      eventKind: "observation" as const,
+      recordedAt,
+      producer: LAB_PRODUCER,
+      producerVersion: opts.producerVersion ?? LAB_PRODUCER_VERSION,
+      evidenceLayer: "protocol_conformance" as const,
+      scenarioId: caseRecord.id,
+      scenarioVersion: String(authority.manifestDefaults.version),
+      scenarioManifestDigest: scenarioDigest,
+      suiteId: caseRecord.suite,
+      suiteVersion: String(authority.manifestDefaults.suiteVersion),
+      suiteManifestDigest: suiteDigest,
+      fixtureDigests,
+      subject,
+      subjectId,
+      startedAt,
+      completedAt,
+      executionMode: "fixture" as const,
+      attempt: 1,
+      limits: { ...authorityLimits },
+      outcome,
+      assertions: result.assertionResults.map((a) => ({
+        id: a.id,
+        operator: a.operator,
+        required: a.required,
+        passed: a.passed,
+        expectedSummary: "see_assertion_report",
+        // Sanitize before truncating; see from-live.ts for the same boundary.
+        observedSummary: truncateUtf8(sanitizeDiagnostic(a.observedSummary), 512),
+        ...(a.reason ? { reason: a.reason } : {}),
+      })),
+      ...(caseRecord.expectedFailure
+        ? { expectedFailure: { ...caseRecord.expectedFailure } }
+        : {}),
+      environment: {
+        runtime: {
+          platform: process.platform,
+          arch: process.arch,
+          bunVersion: process.versions.bun ?? Bun.version,
+        },
+      },
+      artifactRefs: artifacts,
+      ...(result.passed
+        ? {}
+        : {
+            failure: {
+              class: result.classification,
+              code: result.secondaryCode ?? result.classification,
+              retryable: false,
+              attribution:
+                result.classification === "harness_failure"
+                  ? ("harness" as const)
+                  : ("opencodex" as const),
+            },
+          }),
+    };
+
+    const event = assignEventId(eventWithoutId) as ObservationEvent;
+    return { event, artifacts };
+  } finally {
+    if (ownsStore) store.close();
+  }
+}
+
+/** Transform → validate → append one CL-01 result into the canonical JSONL ledger. */
+export function persistConformanceResult(
+  result: ScenarioRunResult,
+  caseRecord: CaseRecord,
+  authority: CaseAuthority,
+  opts: PersistConformanceOptions = {},
+): PersistedConformanceObservation {
+  const paths = ensureLabDirs(opts.configDir);
+  const ownsStore = !opts.artifactStore;
+  const store = opts.artifactStore ?? createArtifactStore(paths.artifactsDir);
+  try {
+    const { event } = observationFromConformanceResult(result, caseRecord, authority, {
+      ...opts,
+      artifactStore: store,
+    });
+    appendLabEvent(paths.ledgerPath, event);
+    return { event, ledgerPath: paths.ledgerPath };
+  } finally {
+    if (ownsStore) store.close();
+  }
+}
+
+export { behaviorFingerprintForCase };