@cat-factory/kernel 0.324.0 → 0.326.0

package/dist/domain/environment-reachability.logic.d.ts

@@ -0,0 +1,131 @@
+import type { EnvironmentAddress, EnvironmentRouteAttempt, EnvironmentRouteProof, EnvironmentUnreachableReason } from '@cat-factory/contracts';
+import type { RouteProbeOutcome, RouteProbeRequest } from '../ports/route-probe.js';
+/** How long one target gets before it counts as a route that does not carry. */
+export declare const ROUTE_PROBE_TIMEOUT_MS = 4000;
+/**
+ * How many stated addresses a proof will try, on top of the name itself.
+ *
+ * Bounded because the list is provider-supplied and the proof runs inside the deployer's settle
+ * path: an unbounded list is an unbounded stall on a run that is otherwise ready to proceed. Four
+ * covers the shape this exists for (an internal and a public balancer per environment, with room
+ * for a second availability zone) and the consumer measured live balancers answering in 34ms to
+ * 162ms, so the ceiling is well under a second of ordinary cost.
+ */
+export declare const MAX_PROBED_ADDRESSES = 4;
+/**
+ * One target a proof will try, in the order the proof will try it.
+ *
+ * A discriminated union rather than a dial target with a "skip me" flag, because the refused
+ * member carries NO {@link RouteProbeRequest}: an address the platform will not dial must be
+ * structurally undialable by whoever iterates this list, not merely marked. Handing out a request
+ * beside a boolean is how the next caller opens the socket anyway.
+ */
+export type RouteProbeTarget = 
+/** Open a socket to this. `address` is null when the target dials the URL's own name. */
+{
+    kind: 'dial';
+    request: RouteProbeRequest;
+    address: string | null;
+    label: string;
+}
+/** RECORD this and dial nothing: a stated address {@link isBridgeableAddress} refuses. */
+ | {
+    kind: 'refused';
+    address: string;
+    label: string;
+    reason: EnvironmentUnreachableReason;
+};
+/**
+ * The targets a proof tries for one environment, in order: the URL's own name first, then each
+ * stated address in the PROVIDER'S preference order.
+ *
+ * The name goes first because it is the answer that needs no bridge, and a deployment where it
+ * works must not start paying for `--add-host` entries and the warm-pool evictions they cost. The
+ * addresses keep the provider's order because the provider is the only thing that knows which of
+ * its balancers is the one it wants used; the platform decides only which one CARRIED.
+ *
+ * **A stated address is dialled only if a bridge could NAME it.** The rule is
+ * `isBridgeableAddress`, and applying it HERE rather than only at bridge-build time is the whole
+ * safety property of the probe: `addresses` is provider-authored data, so without it the
+ * orchestrator opens sockets wherever a manifest says and records the results on a row a workspace
+ * can read back, which is a liveness oracle against the deployment's own private network. The
+ * refusal costs nothing real either, because an address no bridge may name is an address no
+ * container could be pointed at, so proving it would prove something unusable. Refused addresses
+ * are RECORDED (`kind: 'refused'`) rather than dropped: a shortened list nobody is told about is
+ * how a provider's bad address becomes an unexplained `name_unresolved`.
+ *
+ * Empty when there is no host or port to dial, which the caller reads as `no_candidate`: an
+ * environment with no URL was never going to be reached, and that is a different fact from one
+ * that was tried and failed.
+ */
+export declare function planRouteProbes(host: string | null | undefined, port: number | null | undefined, candidates?: readonly EnvironmentAddress[], timeoutMs?: number): RouteProbeTarget[];
+/**
+ * Record one DIALLED attempt for the proof's log, whether it carried or not.
+ *
+ * `detail` rides along for the one outcome that names no layer: `probe_failed` says "we could not
+ * tell", and the probe's own message is then the only thing that distinguishes a resolver fault
+ * from a runtime restriction from a bug here. Capped rather than dropped or passed whole, because
+ * it lands in an operator's failure prose and in an agent's prompt.
+ */
+export declare function recordRouteAttempt(target: Extract<RouteProbeTarget, {
+    kind: 'dial';
+}>, outcome: RouteProbeOutcome): EnvironmentRouteAttempt;
+/** Record a target the platform REFUSED to dial, so the omission is on the proof rather than lost. */
+export declare function recordRefusedAttempt(target: Extract<RouteProbeTarget, {
+    kind: 'refused';
+}>): EnvironmentRouteAttempt;
+/**
+ * Fold a completed set of attempts into the proof that is stored and narrated.
+ *
+ * Three outcomes, and which one this returns is the most consequential line in the feature,
+ * because only `not_reached` fails a deployer frame:
+ *
+ *   - **`reached`** as soon as any attempt carried, publishing the target that did.
+ *   - **`inconclusive`** when nothing carried AND some attempt left a route unruled-out: a probe
+ *     that could not classify its own failure, or nothing to try at all. A workerd connect message
+ *     matching none of that facade's markers, or a Node errno outside the mapped five, arrives
+ *     here, and reading either as a verdict about the environment is how a diagnostic becomes a
+ *     second way for a healthy deploy to die. The reason names the attempt that left it unknown.
+ *   - **`not_reached`** only when EVERY attempt established something and none of them carried.
+ *     The reported reason is then the FIRST attempt's, which is always the name, so a reader is
+ *     told what happened to the address they were given rather than what happened to the last
+ *     balancer in someone's preference list. The attempt log carries the rest, in order.
+ */
+export declare function reduceRouteProof(attempts: readonly EnvironmentRouteAttempt[], carriedVia: string | null, checkedAt: number): EnvironmentRouteProof;
+/**
+ * The operator-facing sentence for an environment nothing could reach, with every target tried.
+ *
+ * States the LAYER rather than a verdict about the application, because they are different faults
+ * with different owners and the whole point of proving the route is to stop reporting one as the
+ * other. The attempt list is included verbatim, each attempt carrying its `detail` where it has
+ * one: a reader who wants to reproduce the finding needs the exact targets, the reason alone names
+ * none of them, and a `probe_failed` with its detail stripped is a sentence saying only that
+ * something went wrong somewhere.
+ */
+export declare function describeUnreachableEnvironment(url: string | null, proof: EnvironmentRouteProof): string;
+/**
+ * The operator-facing sentence for a proof that established nothing either way, with every target
+ * tried.
+ *
+ * Its own describer rather than a branch inside {@link describeUnreachableEnvironment}, because
+ * every clause differs: this one may not say "unreachable", must not name a layer as the fault,
+ * and exists to be readable beside a run that CONTINUED. Nothing settles on it; it is what the
+ * deployer logs and what the environment surface shows so an inconclusive proof is visible rather
+ * than merely harmless.
+ */
+export declare function describeInconclusiveRoute(url: string | null, proof: EnvironmentRouteProof): string;
+/**
+ * The proof recorded when nothing was wired to open a socket.
+ *
+ * Its own constructor rather than a `not_reached` with a special reason, because the two are
+ * verdicts about different things: `not_reached` is about the environment and fails the frame,
+ * `unproved` is about the deployment and must never fail anything. A facade that cannot probe is
+ * a facade that behaves exactly as it did before this existed.
+ *
+ * Distinct from `inconclusive` too, which is the probe having RUN and established nothing. Both
+ * are admissions rather than verdicts, and the difference is who is told: an inconclusive proof is
+ * narrated to the agent that has to interpret a connection failure, an unproved one is withheld
+ * from every prompt (`reachabilityNote`) because it is the standing state of the deployment.
+ */
+export declare function unprovedRoute(checkedAt: number): EnvironmentRouteProof;
+//# sourceMappingURL=environment-reachability.logic.d.ts.map

package/dist/domain/environment-reachability.logic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment-reachability.logic.d.ts","sourceRoot":"","sources":["../../src/domain/environment-reachability.logic.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACvB,qBAAqB,EACrB,4BAA4B,EAC7B,MAAM,wBAAwB,CAAA;AAE/B,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAMnF,gFAAgF;AAChF,eAAO,MAAM,sBAAsB,OAAO,CAAA;AAE1C;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,IAAI,CAAA;AAErC;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB;AAC1B,yFAAyF;AACvF;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE;AACrF,0FAA0F;GACxF;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,4BAA4B,CAAA;CAAE,CAAA;AAE7F;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/B,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/B,UAAU,GAAE,SAAS,kBAAkB,EAAO,EAC9C,SAAS,GAAE,MAA+B,GACzC,gBAAgB,EAAE,CA4BpB;AA8BD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,OAAO,CAAC,gBAAgB,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,EACnD,OAAO,EAAE,iBAAiB,GACzB,uBAAuB,CAQzB;AAED,sGAAsG;AACtG,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,OAAO,CAAC,gBAAgB,EAAE;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC,GACrD,uBAAuB,CAEzB;AAwCD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,SAAS,uBAAuB,EAAE,EAC5C,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,SAAS,EAAE,MAAM,GAChB,qBAAqB,CA6BvB;AAcD;;;;;;;;;GASG;AACH,wBAAgB,8BAA8B,CAC5C,GAAG,EAAE,MAAM,GAAG,IAAI,EAClB,KAAK,EAAE,qBAAqB,GAC3B,MAAM,CAKR;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,GAAG,IAAI,EAClB,KAAK,EAAE,qBAAqB,GAC3B,MAAM,CAKR;AAaD;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,qBAAqB,CAEtE"}

package/dist/domain/environment-reachability.logic.js

@@ -0,0 +1,277 @@
+// Proving that a `ready` environment can be reached: what to try, in what order, and what the
+// answers add up to.
+//
+// The rule lives here rather than in the provisioning service because two layers act on the
+// result and neither may re-derive it: the DEPLOYER settles a frame on the verdict, and the
+// container transports build a host bridge out of the address that carried. A second derivation
+// is how the platform would come to record a bridge as applied against an address nothing ever
+// reached, which is strictly worse evidence than no bridge at all.
+//
+// Deliberately not a gate. `docs/initiatives/deployment-failure-remediation.md` withdrew a
+// `deploy-health` gate that would have probed the environment handle, on the grounds that the
+// deployer owns provisioning through to a terminal verdict, and this is that verdict getting one
+// more fact behind it.
+import { environmentUnreachableReasonSchema } from '@cat-factory/contracts';
+import { isBridgeableAddress } from '../shared/environment-host-bridge.logic.js';
+/** How much of a probe's own error message is kept on the attempt it explains. */
+const MAX_PROBE_DETAIL_CHARS = 200;
+/** How long one target gets before it counts as a route that does not carry. */
+export const ROUTE_PROBE_TIMEOUT_MS = 4000;
+/**
+ * How many stated addresses a proof will try, on top of the name itself.
+ *
+ * Bounded because the list is provider-supplied and the proof runs inside the deployer's settle
+ * path: an unbounded list is an unbounded stall on a run that is otherwise ready to proceed. Four
+ * covers the shape this exists for (an internal and a public balancer per environment, with room
+ * for a second availability zone) and the consumer measured live balancers answering in 34ms to
+ * 162ms, so the ceiling is well under a second of ordinary cost.
+ */
+export const MAX_PROBED_ADDRESSES = 4;
+/**
+ * The targets a proof tries for one environment, in order: the URL's own name first, then each
+ * stated address in the PROVIDER'S preference order.
+ *
+ * The name goes first because it is the answer that needs no bridge, and a deployment where it
+ * works must not start paying for `--add-host` entries and the warm-pool evictions they cost. The
+ * addresses keep the provider's order because the provider is the only thing that knows which of
+ * its balancers is the one it wants used; the platform decides only which one CARRIED.
+ *
+ * **A stated address is dialled only if a bridge could NAME it.** The rule is
+ * `isBridgeableAddress`, and applying it HERE rather than only at bridge-build time is the whole
+ * safety property of the probe: `addresses` is provider-authored data, so without it the
+ * orchestrator opens sockets wherever a manifest says and records the results on a row a workspace
+ * can read back, which is a liveness oracle against the deployment's own private network. The
+ * refusal costs nothing real either, because an address no bridge may name is an address no
+ * container could be pointed at, so proving it would prove something unusable. Refused addresses
+ * are RECORDED (`kind: 'refused'`) rather than dropped: a shortened list nobody is told about is
+ * how a provider's bad address becomes an unexplained `name_unresolved`.
+ *
+ * Empty when there is no host or port to dial, which the caller reads as `no_candidate`: an
+ * environment with no URL was never going to be reached, and that is a different fact from one
+ * that was tried and failed.
+ */
+export function planRouteProbes(host, port, candidates = [], timeoutMs = ROUTE_PROBE_TIMEOUT_MS) {
+    if (!host || !port)
+        return [];
+    const targets = [
+        { kind: 'dial', request: { host, port, timeoutMs }, address: null, label: `${host}:${port}` },
+    ];
+    const seen = new Set();
+    let dialable = 0;
+    let refused = 0;
+    for (const candidate of candidates) {
+        const address = candidate.address.trim();
+        if (!address || seen.has(address))
+            continue;
+        seen.add(address);
+        const label = `${host}@${address}:${port}`;
+        // Bounded separately, and by `continue` rather than `break`, so a manifest listing four
+        // refused addresses ahead of a good one still gets the good one dialled. A refusal costs no
+        // I/O; the dial budget is what the deployer's settle path is actually waiting on.
+        if (!isBridgeableAddress(address)) {
+            if (refused < MAX_PROBED_ADDRESSES) {
+                refused += 1;
+                targets.push({ kind: 'refused', address, label, reason: 'address_refused' });
+            }
+            continue;
+        }
+        if (dialable >= MAX_PROBED_ADDRESSES)
+            continue;
+        dialable += 1;
+        targets.push({ kind: 'dial', request: { host, address, port, timeoutMs }, address, label });
+    }
+    return targets;
+}
+/**
+ * The user-facing reason one probe outcome states, for the target it was tried against.
+ *
+ * A NAME that does not resolve and an ADDRESS that does not resolve are not the same event, and
+ * only the first can happen: an address is dialled, never looked up. A resolver answering
+ * `unresolved` for a literal is a probe malfunction, so it is reported as `probe_failed` rather
+ * than as a claim about DNS that would send a reader to the wrong zone.
+ */
+function reasonFor(outcome, address) {
+    switch (outcome.state) {
+        case 'carried':
+            // Never reached: `recordRouteAttempt` answers `carried` before asking. Present so the
+            // switch stays total against the port's union.
+            return 'probe_failed';
+        case 'unresolved':
+            return address === null ? 'name_unresolved' : 'probe_failed';
+        case 'no_route':
+            return 'no_route';
+        case 'refused':
+            return 'connection_refused';
+        case 'failed':
+            return 'probe_failed';
+    }
+}
+/**
+ * Record one DIALLED attempt for the proof's log, whether it carried or not.
+ *
+ * `detail` rides along for the one outcome that names no layer: `probe_failed` says "we could not
+ * tell", and the probe's own message is then the only thing that distinguishes a resolver fault
+ * from a runtime restriction from a bug here. Capped rather than dropped or passed whole, because
+ * it lands in an operator's failure prose and in an agent's prompt.
+ */
+export function recordRouteAttempt(target, outcome) {
+    if (outcome.state === 'carried')
+        return { target: target.label, outcome: 'carried' };
+    const detail = outcome.state === 'failed' ? outcome.detail.trim() : '';
+    return {
+        target: target.label,
+        outcome: reasonFor(outcome, target.address),
+        ...(detail ? { detail: detail.slice(0, MAX_PROBE_DETAIL_CHARS) } : {}),
+    };
+}
+/** Record a target the platform REFUSED to dial, so the omission is on the proof rather than lost. */
+export function recordRefusedAttempt(target) {
+    return { target: target.label, outcome: target.reason };
+}
+/**
+ * Whether one attempt's outcome leaves a route the platform never actually RULED OUT.
+ *
+ * The rule that decides whether a proof is a verdict about the environment or an admission about
+ * the platform, and it lives here because two layers read the answer and neither may re-derive it:
+ * the deployer fails a frame on the first and must never fail one on the second. `probe_failed`
+ * names no layer by construction, so an attempt that produced it establishes nothing; every other
+ * outcome does establish something, `address_refused` included, since an address no bridge may
+ * name is one no container could have been pointed at either way.
+ */
+const LEAVES_ROUTE_UNKNOWN = {
+    no_candidate: true,
+    name_unresolved: false,
+    no_route: false,
+    connection_refused: false,
+    address_refused: false,
+    probe_failed: true,
+};
+/**
+ * Read an attempt's stored outcome as a known reason, or undefined.
+ *
+ * Derived from the picklist's own options rather than a hand-listed set, so adding a member fails
+ * the `Record` above until it has picked a side. An outcome this build does not know (a proof
+ * written by a newer one) is treated as leaving the route unknown, which is the disposition that
+ * cannot turn an unreadable value into a failed deploy.
+ */
+function knownReason(outcome) {
+    return environmentUnreachableReasonSchema.options.includes(outcome)
+        ? outcome
+        : undefined;
+}
+function leavesRouteUnknown(outcome) {
+    const reason = knownReason(outcome);
+    return reason === undefined || LEAVES_ROUTE_UNKNOWN[reason];
+}
+/**
+ * Fold a completed set of attempts into the proof that is stored and narrated.
+ *
+ * Three outcomes, and which one this returns is the most consequential line in the feature,
+ * because only `not_reached` fails a deployer frame:
+ *
+ *   - **`reached`** as soon as any attempt carried, publishing the target that did.
+ *   - **`inconclusive`** when nothing carried AND some attempt left a route unruled-out: a probe
+ *     that could not classify its own failure, or nothing to try at all. A workerd connect message
+ *     matching none of that facade's markers, or a Node errno outside the mapped five, arrives
+ *     here, and reading either as a verdict about the environment is how a diagnostic becomes a
+ *     second way for a healthy deploy to die. The reason names the attempt that left it unknown.
+ *   - **`not_reached`** only when EVERY attempt established something and none of them carried.
+ *     The reported reason is then the FIRST attempt's, which is always the name, so a reader is
+ *     told what happened to the address they were given rather than what happened to the last
+ *     balancer in someone's preference list. The attempt log carries the rest, in order.
+ */
+export function reduceRouteProof(attempts, carriedVia, checkedAt) {
+    if (attempts.some((attempt) => attempt.outcome === 'carried'))
+        return { state: 'reached', via: carriedVia, reason: null, attempts: [...attempts], checkedAt };
+    if (attempts.length === 0) {
+        return {
+            state: 'inconclusive',
+            via: null,
+            reason: 'no_candidate',
+            attempts: [],
+            checkedAt,
+        };
+    }
+    const unknown = attempts.find((attempt) => leavesRouteUnknown(attempt.outcome));
+    if (unknown) {
+        return {
+            state: 'inconclusive',
+            via: null,
+            reason: unknown.outcome,
+            attempts: [...attempts],
+            checkedAt,
+        };
+    }
+    return {
+        state: 'not_reached',
+        via: null,
+        reason: attempts[0]?.outcome ?? 'probe_failed',
+        attempts: [...attempts],
+        checkedAt,
+    };
+}
+/** What each unreachable reason means for whoever has to fix it, in one clause. */
+const UNREACHABLE_CAUSES = {
+    no_candidate: 'the environment carries no address to try, so nothing could be dialled',
+    name_unresolved: 'its hostname resolves nowhere from this deployment, and no address the provider stated for it carried either',
+    no_route: 'nothing answered within the probe window, so no route reaches it',
+    connection_refused: 'the route reaches it and nothing is listening on that port',
+    address_refused: 'every address its provider stated is one no host bridge may name (loopback, link-local or vendor metadata, or a non-canonical literal), so none could be dialled',
+    probe_failed: 'the probe could not complete, so nothing was established either way',
+};
+/**
+ * The operator-facing sentence for an environment nothing could reach, with every target tried.
+ *
+ * States the LAYER rather than a verdict about the application, because they are different faults
+ * with different owners and the whole point of proving the route is to stop reporting one as the
+ * other. The attempt list is included verbatim, each attempt carrying its `detail` where it has
+ * one: a reader who wants to reproduce the finding needs the exact targets, the reason alone names
+ * none of them, and a `probe_failed` with its detail stripped is a sentence saying only that
+ * something went wrong somewhere.
+ */
+export function describeUnreachableEnvironment(url, proof) {
+    const reason = proof.reason;
+    const cause = (reason && UNREACHABLE_CAUSES[reason]) || UNREACHABLE_CAUSES.probe_failed;
+    const where = url ? `The environment at ${url} is unreachable` : 'The environment is unreachable';
+    return `${where}: ${cause}.${describeRouteAttempts(proof)}`;
+}
+/**
+ * The operator-facing sentence for a proof that established nothing either way, with every target
+ * tried.
+ *
+ * Its own describer rather than a branch inside {@link describeUnreachableEnvironment}, because
+ * every clause differs: this one may not say "unreachable", must not name a layer as the fault,
+ * and exists to be readable beside a run that CONTINUED. Nothing settles on it; it is what the
+ * deployer logs and what the environment surface shows so an inconclusive proof is visible rather
+ * than merely harmless.
+ */
+export function describeInconclusiveRoute(url, proof) {
+    const reason = proof.reason;
+    const cause = (reason && UNREACHABLE_CAUSES[reason]) || UNREACHABLE_CAUSES.probe_failed;
+    const where = url ? `The route to the environment at ${url}` : 'The route to the environment';
+    return `${where} could not be established either way: ${cause}.${describeRouteAttempts(proof)}`;
+}
+/** ` Tried: <target> (<outcome>: <detail>), ….`, or empty when nothing was tried. */
+function describeRouteAttempts(proof) {
+    const tried = proof.attempts
+        .map((attempt) => `${attempt.target} (${attempt.outcome}${attempt.detail ? `: ${attempt.detail}` : ''})`)
+        .join(', ');
+    return tried ? ` Tried: ${tried}.` : '';
+}
+/**
+ * The proof recorded when nothing was wired to open a socket.
+ *
+ * Its own constructor rather than a `not_reached` with a special reason, because the two are
+ * verdicts about different things: `not_reached` is about the environment and fails the frame,
+ * `unproved` is about the deployment and must never fail anything. A facade that cannot probe is
+ * a facade that behaves exactly as it did before this existed.
+ *
+ * Distinct from `inconclusive` too, which is the probe having RUN and established nothing. Both
+ * are admissions rather than verdicts, and the difference is who is told: an inconclusive proof is
+ * narrated to the agent that has to interpret a connection failure, an unproved one is withheld
+ * from every prompt (`reachabilityNote`) because it is the standing state of the deployment.
+ */
+export function unprovedRoute(checkedAt) {
+    return { state: 'unproved', via: null, reason: null, attempts: [], checkedAt };
+}
+//# sourceMappingURL=environment-reachability.logic.js.map

package/dist/domain/environment-reachability.logic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment-reachability.logic.js","sourceRoot":"","sources":["../../src/domain/environment-reachability.logic.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,qBAAqB;AACrB,EAAE;AACF,4FAA4F;AAC5F,4FAA4F;AAC5F,gGAAgG;AAChG,+FAA+F;AAC/F,mEAAmE;AACnE,EAAE;AACF,2FAA2F;AAC3F,8FAA8F;AAC9F,iGAAiG;AACjG,uBAAuB;AAQvB,OAAO,EAAE,kCAAkC,EAAE,MAAM,wBAAwB,CAAA;AAE3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAA;AAEhF,kFAAkF;AAClF,MAAM,sBAAsB,GAAG,GAAG,CAAA;AAElC,gFAAgF;AAChF,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAA;AAE1C;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAA;AAgBrC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,eAAe,CAC7B,IAA+B,EAC/B,IAA+B,EAC/B,UAAU,GAAkC,EAAE,EAC9C,SAAS,GAAW,sBAAsB;IAE1C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAA;IAC7B,MAAM,OAAO,GAAuB;QAClC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE;KAC9F,CAAA;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;QACxC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,SAAQ;QAC3C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACjB,MAAM,KAAK,GAAG,GAAG,IAAI,IAAI,OAAO,IAAI,IAAI,EAAE,CAAA;QAC1C,wFAAwF;QACxF,4FAA4F;QAC5F,kFAAkF;QAClF,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,IAAI,OAAO,GAAG,oBAAoB,EAAE,CAAC;gBACnC,OAAO,IAAI,CAAC,CAAA;gBACZ,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAA;YAC9E,CAAC;YACD,SAAQ;QACV,CAAC;QACD,IAAI,QAAQ,IAAI,oBAAoB;YAAE,SAAQ;QAC9C,QAAQ,IAAI,CAAC,CAAA;QACb,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;IAC7F,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,SAAS,CAChB,OAA0B,EAC1B,OAAsB;IAEtB,QAAQ,OAAO,CAAC,KAAK,EAAE,CAAC;QACtB,KAAK,SAAS;YACZ,sFAAsF;YACtF,+CAA+C;YAC/C,OAAO,cAAc,CAAA;QACvB,KAAK,YAAY;YACf,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,cAAc,CAAA;QAC9D,KAAK,UAAU;YACb,OAAO,UAAU,CAAA;QACnB,KAAK,SAAS;YACZ,OAAO,oBAAoB,CAAA;QAC7B,KAAK,QAAQ;YACX,OAAO,cAAc,CAAA;IACzB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAmD,EACnD,OAA0B;IAE1B,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAA;IACpF,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACtE,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,KAAK;QACpB,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC;QAC3C,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,sBAAsB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvE,CAAA;AACH,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,oBAAoB,CAClC,MAAsD;IAEtD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAAA;AACzD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,oBAAoB,GAAkD;IAC1E,YAAY,EAAE,IAAI;IAClB,eAAe,EAAE,KAAK;IACtB,QAAQ,EAAE,KAAK;IACf,kBAAkB,EAAE,KAAK;IACzB,eAAe,EAAE,KAAK;IACtB,YAAY,EAAE,IAAI;CACnB,CAAA;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,OAAe;IAClC,OAAQ,kCAAkC,CAAC,OAA6B,CAAC,QAAQ,CAAC,OAAO,CAAC;QACxF,CAAC,CAAE,OAAwC;QAC3C,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe;IACzC,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAA;IACnC,OAAO,MAAM,KAAK,SAAS,IAAI,oBAAoB,CAAC,MAAM,CAAC,CAAA;AAC7D,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAA4C,EAC5C,UAAyB,EACzB,SAAiB;IAEjB,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC;QAC3D,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,SAAS,EAAE,CAAA;IAChG,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,KAAK,EAAE,cAAc;YACrB,GAAG,EAAE,IAAI;YACT,MAAM,EAAE,cAAqD;YAC7D,QAAQ,EAAE,EAAE;YACZ,SAAS;SACV,CAAA;IACH,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAA;IAC/E,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO;YACL,KAAK,EAAE,cAAc;YACrB,GAAG,EAAE,IAAI;YACT,MAAM,EAAE,OAAO,CAAC,OAAO;YACvB,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC;YACvB,SAAS;SACV,CAAA;IACH,CAAC;IACD,OAAO;QACL,KAAK,EAAE,aAAa;QACpB,GAAG,EAAE,IAAI;QACT,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,cAAc;QAC9C,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC;QACvB,SAAS;KACV,CAAA;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,kBAAkB,GAAiD;IACvE,YAAY,EAAE,wEAAwE;IACtF,eAAe,EACb,8GAA8G;IAChH,QAAQ,EAAE,kEAAkE;IAC5E,kBAAkB,EAAE,4DAA4D;IAChF,eAAe,EACb,kKAAkK;IACpK,YAAY,EAAE,qEAAqE;CACpF,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,8BAA8B,CAC5C,GAAkB,EAClB,KAA4B;IAE5B,MAAM,MAAM,GAAG,KAAK,CAAC,MAA6C,CAAA;IAClE,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC,IAAI,kBAAkB,CAAC,YAAY,CAAA;IACvF,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,GAAG,iBAAiB,CAAC,CAAC,CAAC,gCAAgC,CAAA;IACjG,OAAO,GAAG,KAAK,KAAK,KAAK,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAA;AAC7D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAAkB,EAClB,KAA4B;IAE5B,MAAM,MAAM,GAAG,KAAK,CAAC,MAA6C,CAAA;IAClE,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC,IAAI,kBAAkB,CAAC,YAAY,CAAA;IACvF,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,mCAAmC,GAAG,EAAE,CAAC,CAAC,CAAC,8BAA8B,CAAA;IAC7F,OAAO,GAAG,KAAK,yCAAyC,KAAK,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAA;AACjG,CAAC;AAED,qFAAqF;AACrF,SAAS,qBAAqB,CAAC,KAA4B;IACzD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ;SACzB,GAAG,CACF,CAAC,OAAO,EAAE,EAAE,CACV,GAAG,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CACzF;SACA,IAAI,CAAC,IAAI,CAAC,CAAA;IACb,OAAO,KAAK,CAAC,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;AACzC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,CAAA;AAChF,CAAC"}

package/dist/domain/environment-readiness.logic.d.ts

@@ -37,6 +37,13 @@ export interface EnvironmentReadinessInput {
     status: EnvironmentStatus;
     /** The provider's own last error, when it recorded one; used verbatim in a `failed` verdict. */
     lastError?: string | null;
+    /**
+     * The provider's own account of a state it has not left yet, when it gave one. It is the only
+     * channel that survives a `provisioning` poll, because `lastError` is persisted on `failed`
+     * alone (see `ProvisionedEnvironment.statusNote`). It is what lets a `timed_out` verdict name
+     * the state the environment was stuck in rather than only how long it was stuck.
+     */
+    statusNote?: string | null;
 }
 /**
  * Human-readable elapsed time for a readiness verdict's message, in the coarsest unit that
@@ -44,6 +51,21 @@ export interface EnvironmentReadinessInput {
  * operator is quoted a duration rather than a millisecond count.
  */
 export declare function describeWaitedFor(ms: number): string;
+/**
+ * How an environment that has stopped at a status it will never leave for `ready` is explained to
+ * a person: `failed` / `expired` / `tearing_down` / `torn_down`. Shared, because every reader that
+ * has to give up on such an environment owes the same account, and the two that stated it
+ * separately disagreed about it.
+ *
+ * The provider's own error is the whole message where it recorded one, because on these statuses
+ * that error IS the verdict. With none, the state is NAMED and the last note is APPENDED rather
+ * than substituted, and both halves of that matter. Naming the state is what separates "the
+ * provider refused it" from "something tore it down under the run", which send an operator to
+ * different places. Appending rather than substituting is because a bare note reads as the reason
+ * the environment ended up here, which nothing here knows: a `torn_down` row's note describes the
+ * spin-up it was in the middle of, not who tore it down.
+ */
+export declare function describeTerminalEnvironment(env: EnvironmentReadinessInput): string;
 /**
  * Judge one readiness poll: the environment as the provider just reported it, against how long
  * the step has been waiting.

package/dist/domain/environment-readiness.logic.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"environment-readiness.logic.d.ts","sourceRoot":"","sources":["../../src/domain/environment-readiness.logic.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAkBnD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,QAAiB,CAAA;AAE1D;;;;;GAKG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAExC,iEAAiE;AACjE,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,iBAAiB,CAAA;IACzB,gGAAgG;IAChG,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAOpD;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,yBAAyB,EAC9B,QAAQ,EAAE,MAAM,EAChB,SAAS,GAAE,MAAqC,GAC/C,oBAAoB,CAwBtB"}
+{"version":3,"file":"environment-readiness.logic.d.ts","sourceRoot":"","sources":["../../src/domain/environment-readiness.logic.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAkBnD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,QAAiB,CAAA;AAE1D;;;;;GAKG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAExC,iEAAiE;AACjE,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,iBAAiB,CAAA;IACzB,gGAAgG;IAChG,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAOpD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,yBAAyB,GAAG,MAAM,CAQlF;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,yBAAyB,EAC9B,QAAQ,EAAE,MAAM,EAChB,SAAS,GAAE,MAAqC,GAC/C,oBAAoB,CA0BtB"}

package/dist/domain/environment-readiness.logic.js

@@ -41,6 +41,28 @@ export function describeWaitedFor(ms) {
     const seconds = Math.max(1, Math.round(ms / 1000));
     return `${seconds} second${seconds === 1 ? '' : 's'}`;
 }
+/**
+ * How an environment that has stopped at a status it will never leave for `ready` is explained to
+ * a person: `failed` / `expired` / `tearing_down` / `torn_down`. Shared, because every reader that
+ * has to give up on such an environment owes the same account, and the two that stated it
+ * separately disagreed about it.
+ *
+ * The provider's own error is the whole message where it recorded one, because on these statuses
+ * that error IS the verdict. With none, the state is NAMED and the last note is APPENDED rather
+ * than substituted, and both halves of that matter. Naming the state is what separates "the
+ * provider refused it" from "something tore it down under the run", which send an operator to
+ * different places. Appending rather than substituting is because a bare note reads as the reason
+ * the environment ended up here, which nothing here knows: a `torn_down` row's note describes the
+ * spin-up it was in the middle of, not who tore it down.
+ */
+export function describeTerminalEnvironment(env) {
+    const failure = env.lastError?.trim();
+    if (failure)
+        return failure;
+    const note = env.statusNote?.trim();
+    return (`Environment provisioning did not complete (status: ${env.status}).` +
+        (note ? ` Last provider note: ${note}` : ''));
+}
 /**
  * Judge one readiness poll: the environment as the provider just reported it, against how long
  * the step has been waiting.
@@ -54,23 +76,26 @@ export function describeWaitedFor(ms) {
 export function judgeEnvironmentReadiness(env, waitedMs, timeoutMs = ENVIRONMENT_READY_TIMEOUT_MS) {
     if (env.status === 'ready')
         return { kind: 'ready' };
+    const failure = env.lastError?.trim();
+    const note = env.statusNote?.trim();
+    // `failed` / `expired` / `tearing_down` / `torn_down`: none of these becomes `ready` on its own,
+    // so waiting out the deadline would only delay the same answer.
     if (env.status !== 'provisioning') {
-        // `failed` / `expired` / `tearing_down` / `torn_down`: none of these becomes `ready` on its
-        // own, so waiting out the deadline would only delay the same answer. Name the state, because
-        // "the provider refused it" and "something tore it down under the run" send an operator to
-        // different places.
-        return {
-            kind: 'failed',
-            error: env.lastError?.trim() ||
-                `Environment provisioning did not complete (status: ${env.status}).`,
-        };
+        return { kind: 'failed', error: describeTerminalEnvironment(env) };
     }
     if (waitedMs >= timeoutMs) {
         return {
             kind: 'timed_out',
             error: `Environment was still provisioning after ${describeWaitedFor(waitedMs)}` +
                 ` (readiness ceiling ${describeWaitedFor(timeoutMs)}).` +
-                (env.lastError?.trim() ? ` Last provider error: ${env.lastError.trim()}` : ''),
+                // BOTH, where a caller carries both, each under its own label and the fault FIRST. A
+                // recorded fault outranks a note on every reader (it is the more specific claim, and the
+                // only one of the two that is a fault), and dropping either would be the misattribution
+                // this pair exists to avoid: the note is the one channel a `provisioning` provider had,
+                // since that is exactly the status `lastError` is nulled on, so a caller reaching here
+                // with a fault as well carries it from an earlier poll and it is not superseded.
+                (failure ? ` Last provider error: ${failure}` : '') +
+                (note ? ` Last provider note: ${note}` : ''),
         };
     }
     return { kind: 'waiting', elapsedMs: waitedMs };

package/dist/domain/environment-readiness.logic.js.map

@@ -1 +1 @@
-{"version":3,"file":"environment-readiness.logic.js","sourceRoot":"","sources":["../../src/domain/environment-readiness.logic.ts"],"names":[],"mappings":"AAEA,8EAA8E;AAC9E,2FAA2F;AAC3F,8EAA8E;AAC9E,EAAE;AACF,8FAA8F;AAC9F,6FAA6F;AAC7F,gGAAgG;AAChG,8FAA8F;AAC9F,+FAA+F;AAC/F,6BAA6B;AAC7B,EAAE;AACF,4FAA4F;AAC5F,+FAA+F;AAC/F,6DAA6D;AAC7D,8EAA8E;AAE9E;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAqB1D;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAU;IAC1C,IAAI,EAAE,IAAI,MAAM,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC,CAAA;QACvC,OAAO,GAAG,OAAO,UAAU,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAA;IACvD,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAA;IAClD,OAAO,GAAG,OAAO,UAAU,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAA;AACvD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAA8B,EAC9B,QAAgB,EAChB,SAAS,GAAW,4BAA4B;IAEhD,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IACpD,IAAI,GAAG,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QAClC,4FAA4F;QAC5F,6FAA6F;QAC7F,2FAA2F;QAC3F,oBAAoB;QACpB,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,KAAK,EACH,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE;gBACrB,sDAAsD,GAAG,CAAC,MAAM,IAAI;SACvE,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,IAAI,SAAS,EAAE,CAAC;QAC1B,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,KAAK,EACH,4CAA4C,iBAAiB,CAAC,QAAQ,CAAC,EAAE;gBACzE,uBAAuB,iBAAiB,CAAC,SAAS,CAAC,IAAI;gBACvD,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,yBAAyB,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjF,CAAA;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAA;AACjD,CAAC"}
+{"version":3,"file":"environment-readiness.logic.js","sourceRoot":"","sources":["../../src/domain/environment-readiness.logic.ts"],"names":[],"mappings":"AAEA,8EAA8E;AAC9E,2FAA2F;AAC3F,8EAA8E;AAC9E,EAAE;AACF,8FAA8F;AAC9F,6FAA6F;AAC7F,gGAAgG;AAChG,8FAA8F;AAC9F,+FAA+F;AAC/F,6BAA6B;AAC7B,EAAE;AACF,4FAA4F;AAC5F,+FAA+F;AAC/F,6DAA6D;AAC7D,8EAA8E;AAE9E;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AA4B1D;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAU;IAC1C,IAAI,EAAE,IAAI,MAAM,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC,CAAA;QACvC,OAAO,GAAG,OAAO,UAAU,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAA;IACvD,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAA;IAClD,OAAO,GAAG,OAAO,UAAU,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAA;AACvD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,2BAA2B,CAAC,GAA8B;IACxE,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,CAAA;IACrC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAA;IAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAA;IACnC,OAAO,CACL,sDAAsD,GAAG,CAAC,MAAM,IAAI;QACpE,CAAC,IAAI,CAAC,CAAC,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC7C,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAA8B,EAC9B,QAAgB,EAChB,SAAS,GAAW,4BAA4B;IAEhD,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IACpD,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,CAAA;IACrC,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAA;IACnC,iGAAiG;IACjG,gEAAgE;IAChE,IAAI,GAAG,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QAClC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,2BAA2B,CAAC,GAAG,CAAC,EAAE,CAAA;IACpE,CAAC;IACD,IAAI,QAAQ,IAAI,SAAS,EAAE,CAAC;QAC1B,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,KAAK,EACH,4CAA4C,iBAAiB,CAAC,QAAQ,CAAC,EAAE;gBACzE,uBAAuB,iBAAiB,CAAC,SAAS,CAAC,IAAI;gBACvD,qFAAqF;gBACrF,yFAAyF;gBACzF,wFAAwF;gBACxF,wFAAwF;gBACxF,uFAAuF;gBACvF,iFAAiF;gBACjF,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnD,CAAC,IAAI,CAAC,CAAC,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C,CAAA;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAA;AACjD,CAAC"}

package/dist/domain/types.d.ts

@@ -1,4 +1,4 @@
-export type { AgentKind, AgentState, AgentFailure, AgentFailureKind, AgentRunKind, ModelFamily, ModelFamilyPolicy, ModelPolicyMode, AccountRegion, ModelFamilyPolicyPreset, Block, BlockLevel, BlockStatus, BlockType, TaskType, CreateTaskType, TaskTypeFields, CustomTaskType, TaskTypePresentation, TaskTypeFieldDescriptor, TaskTypeFieldType, TaskTypeFieldOption, DescriptorField, DescriptorFieldType, DescriptorFieldOption, DescriptorFieldShowWhen, DescriptorFieldValue, DescriptorFieldValues, DocKind, Decision, EnvConfigRepairJob, EnvConfigRepairStatus, EnvironmentTestRun, EnvironmentTestStage, EnvironmentTestStatus, ExecutionInstance, ExecutionStatus, IntakeOrigin, InputGateIssue, InputGateIssueCode, InputGateMode, InputGateSeverity, InputGateStatus, RunInputGate, ResolveInputGateChoice, ResolveInputGateRequest, Pipeline, PipelineAvailability, PipelineStep, Position, PriorStepOutput, PromptFragment, PullRequestRef, PeerPullRequest, ReferenceRepo, AprioriBranch, SpendStatus, StepApproval, StepReviewComment, ReviewCommentSeverity, StepSubtasks, WebSearchAvailability, WebSearchProvider, Workspace, WorkspaceSnapshot, FragmentOwnerKind, FragmentTier, CreatePromptFragmentInput, CreateDocumentFragmentInput, UpdatePromptFragmentInput, FragmentSource, LinkFragmentSourceInput, FragmentSyncResult, FragmentSourceStatus, ResolvedFragment, ResolvedFragmentCatalog, Account, AccountType, AccountRole, AccountMember, CreateAccountInput, AddMemberInput, WorkspaceRole, WorkspacePermission, WorkspaceAccessMode, WorkspaceMember, Service, WorkspaceMount, MountServiceInput, UpdateMountInput, GitHubBranch, GitHubCheckRun, GitHubCommit, GitHubConnection, GitHubInstallationOption, GitHubAvailableRepo, GitHubIssue, GitHubIssueState, GitHubPullRequest, GitHubPullRequestState, OpenedPullRequest, GitHubRepo, RepoTreeEntry, SetRepoMonorepoInput, CommitFilesInput, LinkReposInput, OpenPullRequestInput, MergePullRequestInput, ProviderConfigFieldType, ProviderConfigField, ProviderDescriptor, ConnectionTestResult, ConnectionWarning, ConnectionWarningCode, UserSecretKind, UserSecretStatus, StoreUserSecretInput, TestUserSecretInput, UserSecretDescriptor, DocumentSourceKind, DocumentOrigin, DocumentLinkRole, DocumentRenderStatus, DocumentSourceDescriptor, CredentialField, DocumentConnection, SourceDocument, DocumentSearchResult, DocumentBoardPlan, PlanFrame, PlanModule, PlanTask, TaskSourceKind, TaskSourceDescriptor, TaskSourceState, TaskSourceDiagnostic, TaskSourceDiagnosticStatus, TaskConnection, TaskComment, TaskDependencyLink, SourceTask, TaskSearchResult, IssueIntakePredicate, TrackerBoard, BugCandidate, BugHuntAnalysis, BugHuntAnalysisStatus, BugHuntCandidate, BugHuntConfidence, BugHuntResult, RunBugHuntInput, EnvironmentSecretRef, EnvironmentAuthScheme, EnvironmentHttpMethod, EnvironmentRequestTemplate, EnvironmentStatus, TeardownConfirmation, EnvironmentAccessScheme, EnvironmentAccessMapping, EnvironmentResponseMapping, EnvironmentManifest, EnvironmentBackendConfig, EnvironmentBackendKind, KubernetesEnvironmentConfig, KubernetesConnectionConfig, KubernetesManifestSource, KubernetesUrlSource, KubernetesRenderer, KubernetesImageOverride, KubernetesHelmRelease, KubernetesHelmSet, KubernetesSecretEntry, KubernetesSecretInjection, KubernetesProvisionConfig, CloudflareEnvironmentConfig, CloudflareConnectionConfig, ProvisionType, EnvironmentFailureReason, InfraEngine, ManifestId, ServiceProvisioning, StackRecipe, RecipeStep, RecipeStepKind, RecipeHealthGate, RecipeEnvFile, PreflightCheckId, PreflightParams, PreflightRef, PreflightStatus, PreflightResult, FrontendConfig, FrontendBackendBinding, FrontendBackendSource, ResolvedFrontendBinding, LiveEnvHandle, ServiceConnection, KubernetesEngineConfig, InfraHandlerConfig, CustomManifestType, CustomManifestTypeSource, UpsertCustomManifestTypeInput, EnvironmentAccessHandle, EnvironmentHandle, EnvironmentConnection, TestEnvironmentConnectionInput, TestEnvironmentHandlerInput, ValidateEnvironmentRepoInput, BootstrapEnvironmentRepoInput, BootstrapRepoResult, TestSecretRef, TestSecretEntry, ServiceTestSecretsView, UpsertServiceTestSecretsInput, ProvisioningSubsystem, ProvisioningOperation, ProvisioningOutcome, ProvisioningLogEntry, RunnerPoolSecretRef, RunnerPoolAuthScheme, RunnerPoolRequestTemplate, RunnerJobState, RunnerPoolResponseMapping, RunnerPoolManifest, RunnerPoolConnection, TestRunnerPoolConnectionInput, RunnerBackendConfig, RunnerBackendKind, KubernetesRunnerConfig, KubernetesResourceQuantities, ReferenceArchitecture, CreateReferenceArchitectureInput, UpdateReferenceArchitectureInput, BootstrapStatus, BootstrapFailure, BootstrapFailureKind, BootstrapJob, BootstrapRepoInput, BlueprintModule, BlueprintService, BlueprintSource, BoardScanSpawnResult, ReviewItemCategory, ReviewItemSeverity, ReviewItemStatus, RequirementReviewItem, RequirementReviewStatus, RequirementReview, DocInterviewQa, DocInterviewStatus, DocInterviewSession, AnswerDocInterviewInput, KaizenGradingStatus, KaizenGrading, KaizenVerifiedCombo, KaizenOverview, KaizenRunGradings, RecommendationStatus, RequirementRecommendation, ReplyReviewItemInput, UpdateReviewItemStatusInput, IncorporateRequirementsInput, RequestRecommendationItem, RequestRecommendationsInput, ReRequestRecommendationInput, ResolveRequirementsExceededInput, ResolveRequirementsExceededChoice, FollowUpItemKind, FollowUpItemStatus, FollowUpResolution, FollowUpItem, FollowUpsStepState, AnswerFollowUpInput, StreamedFollowUp, ForkOption, ForkChatMessage, ForkDecisionStatus, ForkChoice, ForkDecisionStepState, ForkChatRequestInput, ChooseForkInput, ForkProposal, BinaryCandidate, BinaryCandidateComparison, BinaryCandidateChoice, BinaryCandidateKeep, BinaryCandidateNoChoiceReason, BinaryCandidateStatus, BinaryCandidateStepState, KeepBinaryCandidatesInput, BinaryGeneratorCapability, BinaryGenerationOptions, BinaryAssetRef, BinaryReferenceImage, JudgeFindingSeverity, JudgeFinding, JudgeVerdict, JudgeDisposition, JudgeStatus, JudgeRound, JudgeStepState, JudgeModelPin, JudgeModelPinStatus, ResolveJudgeInput, PrReviewSeverity, PrReviewCategory, PrReviewSlice, PrReviewSliceReview, PrReviewFinding, PrReviewFindingChallenge, PrReviewStatus, PrReviewResolution, PrReviewStepState, PrReviewPostReport, PrReviewPostFailure, PrReviewAgentOutput, PrReviewChallengeOutput, ResolvePrReviewInput, ChallengePrReviewFindingInput, ClarityReviewItem, ClarityReviewStatus, ClarityReview, ReplyClarityItemInput, UpdateClarityItemStatusInput, IncorporateClarityInput, ResolveClarityExceededInput, ResolveClarityExceededChoice, BrainstormStage, BrainstormItem, BrainstormStatus, BrainstormSession, ReplyBrainstormItemInput, UpdateBrainstormItemStatusInput, IncorporateBrainstormInput, ResolveBrainstormExceededInput, ResolveBrainstormExceededChoice, IterationCapChoice, ResolveIterationCapInput, RequirementPriority, RequirementKind, 
+export type { AgentKind, AgentState, AgentFailure, AgentFailureKind, AgentRunKind, ModelFamily, ModelFamilyPolicy, ModelPolicyMode, AccountRegion, ModelFamilyPolicyPreset, Block, BlockLevel, BlockStatus, BlockType, TaskType, CreateTaskType, TaskTypeFields, CustomTaskType, TaskTypePresentation, TaskTypeFieldDescriptor, TaskTypeFieldType, TaskTypeFieldOption, DescriptorField, DescriptorFieldType, DescriptorFieldOption, DescriptorFieldShowWhen, DescriptorFieldValue, DescriptorFieldValues, DocKind, Decision, EnvConfigRepairJob, EnvConfigRepairStatus, EnvironmentTestRun, EnvironmentTestStage, EnvironmentTestStatus, ExecutionInstance, ExecutionStatus, IntakeOrigin, InputGateIssue, InputGateIssueCode, InputGateMode, InputGateSeverity, InputGateStatus, RunInputGate, ResolveInputGateChoice, ResolveInputGateRequest, Pipeline, PipelineAvailability, PipelineStep, Position, PriorStepOutput, PromptFragment, PullRequestRef, PeerPullRequest, ReferenceRepo, AprioriBranch, SpendStatus, StepApproval, StepReviewComment, ReviewCommentSeverity, StepSubtasks, WebSearchAvailability, WebSearchProvider, Workspace, WorkspaceSnapshot, FragmentOwnerKind, FragmentTier, CreatePromptFragmentInput, CreateDocumentFragmentInput, UpdatePromptFragmentInput, FragmentSource, LinkFragmentSourceInput, FragmentSyncResult, FragmentSourceStatus, ResolvedFragment, ResolvedFragmentCatalog, Account, AccountType, AccountRole, AccountMember, CreateAccountInput, AddMemberInput, WorkspaceRole, WorkspacePermission, WorkspaceAccessMode, WorkspaceMember, Service, WorkspaceMount, MountServiceInput, UpdateMountInput, GitHubBranch, GitHubCheckRun, GitHubCommit, GitHubConnection, GitHubInstallationOption, GitHubAvailableRepo, GitHubIssue, GitHubIssueState, GitHubPullRequest, GitHubPullRequestState, OpenedPullRequest, GitHubRepo, RepoTreeEntry, SetRepoMonorepoInput, CommitFilesInput, LinkReposInput, OpenPullRequestInput, MergePullRequestInput, ProviderConfigFieldType, ProviderConfigField, ProviderDescriptor, ConnectionTestResult, ConnectionWarning, ConnectionWarningCode, UserSecretKind, UserSecretStatus, StoreUserSecretInput, TestUserSecretInput, UserSecretDescriptor, DocumentSourceKind, DocumentOrigin, DocumentLinkRole, DocumentRenderStatus, DocumentSourceDescriptor, CredentialField, DocumentConnection, SourceDocument, DocumentSearchResult, DocumentBoardPlan, PlanFrame, PlanModule, PlanTask, TaskSourceKind, TaskSourceDescriptor, TaskSourceState, TaskSourceDiagnostic, TaskSourceDiagnosticStatus, TaskConnection, TaskComment, TaskDependencyLink, SourceTask, TaskSearchResult, IssueIntakePredicate, TrackerBoard, BugCandidate, BugHuntAnalysis, BugHuntAnalysisStatus, BugHuntCandidate, BugHuntConfidence, BugHuntResult, RunBugHuntInput, EnvironmentSecretRef, EnvironmentAuthScheme, EnvironmentHttpMethod, EnvironmentRequestTemplate, EnvironmentStatus, TeardownConfirmation, EnvironmentAccessScheme, EnvironmentAccessMapping, EnvironmentResponseMapping, EnvironmentManifest, EnvironmentBackendConfig, EnvironmentBackendKind, KubernetesEnvironmentConfig, KubernetesConnectionConfig, KubernetesManifestSource, KubernetesUrlSource, KubernetesRenderer, KubernetesImageOverride, KubernetesHelmRelease, KubernetesHelmSet, KubernetesSecretEntry, KubernetesSecretInjection, KubernetesProvisionConfig, CloudflareEnvironmentConfig, CloudflareConnectionConfig, ProvisionType, EnvironmentFailureReason, InfraEngine, ManifestId, ServiceProvisioning, StackRecipe, RecipeStep, RecipeStepKind, RecipeHealthGate, RecipeEnvFile, PreflightCheckId, PreflightParams, PreflightRef, PreflightStatus, PreflightResult, FrontendConfig, FrontendBackendBinding, FrontendBackendSource, ResolvedFrontendBinding, LiveEnvHandle, ServiceConnection, KubernetesEngineConfig, InfraHandlerConfig, CustomManifestType, CustomManifestTypeSource, UpsertCustomManifestTypeInput, EnvironmentAccessHandle, EnvironmentHandle, EnvironmentAddress, EnvironmentReachability, EnvironmentReachabilityNote, EnvironmentRouteAttempt, EnvironmentRouteProof, EnvironmentUnreachableReason, EnvironmentConnection, TestEnvironmentConnectionInput, TestEnvironmentHandlerInput, ValidateEnvironmentRepoInput, BootstrapEnvironmentRepoInput, BootstrapRepoResult, TestSecretRef, TestSecretEntry, ServiceTestSecretsView, UpsertServiceTestSecretsInput, ProvisioningSubsystem, ProvisioningOperation, ProvisioningOutcome, ProvisioningLogEntry, RunnerPoolSecretRef, RunnerPoolAuthScheme, RunnerPoolRequestTemplate, RunnerJobState, RunnerPoolResponseMapping, RunnerPoolManifest, RunnerPoolConnection, TestRunnerPoolConnectionInput, RunnerBackendConfig, RunnerBackendKind, KubernetesRunnerConfig, KubernetesResourceQuantities, ReferenceArchitecture, CreateReferenceArchitectureInput, UpdateReferenceArchitectureInput, BootstrapStatus, BootstrapFailure, BootstrapFailureKind, BootstrapJob, BootstrapRepoInput, BlueprintModule, BlueprintService, BlueprintSource, BoardScanSpawnResult, ReviewItemCategory, ReviewItemSeverity, ReviewItemStatus, RequirementReviewItem, RequirementReviewStatus, RequirementReview, DocInterviewQa, DocInterviewStatus, DocInterviewSession, AnswerDocInterviewInput, KaizenGradingStatus, KaizenGrading, KaizenVerifiedCombo, KaizenOverview, KaizenRunGradings, RecommendationStatus, RequirementRecommendation, ReplyReviewItemInput, UpdateReviewItemStatusInput, IncorporateRequirementsInput, RequestRecommendationItem, RequestRecommendationsInput, ReRequestRecommendationInput, ResolveRequirementsExceededInput, ResolveRequirementsExceededChoice, FollowUpItemKind, FollowUpItemStatus, FollowUpResolution, FollowUpItem, FollowUpsStepState, AnswerFollowUpInput, StreamedFollowUp, ForkOption, ForkChatMessage, ForkDecisionStatus, ForkChoice, ForkDecisionStepState, ForkChatRequestInput, ChooseForkInput, ForkProposal, BinaryCandidate, BinaryCandidateComparison, BinaryCandidateChoice, BinaryCandidateKeep, BinaryCandidateNoChoiceReason, BinaryCandidateStatus, BinaryCandidateStepState, KeepBinaryCandidatesInput, BinaryGeneratorCapability, BinaryGenerationOptions, BinaryAssetRef, BinaryReferenceImage, JudgeFindingSeverity, JudgeFinding, JudgeVerdict, JudgeDisposition, JudgeStatus, JudgeRound, JudgeStepState, JudgeModelPin, JudgeModelPinStatus, ResolveJudgeInput, PrReviewSeverity, PrReviewCategory, PrReviewSlice, PrReviewSliceReview, PrReviewFinding, PrReviewFindingChallenge, PrReviewStatus, PrReviewResolution, PrReviewStepState, PrReviewPostReport, PrReviewPostFailure, PrReviewAgentOutput, PrReviewChallengeOutput, ResolvePrReviewInput, ChallengePrReviewFindingInput, ClarityReviewItem, ClarityReviewStatus, ClarityReview, ReplyClarityItemInput, UpdateClarityItemStatusInput, IncorporateClarityInput, ResolveClarityExceededInput, ResolveClarityExceededChoice, BrainstormStage, BrainstormItem, BrainstormStatus, BrainstormSession, ReplyBrainstormItemInput, UpdateBrainstormItemStatusInput, IncorporateBrainstormInput, ResolveBrainstormExceededInput, ResolveBrainstormExceededChoice, IterationCapChoice, ResolveIterationCapInput, RequirementPriority, RequirementKind, 
 /** Implementation state: agreed-but-not-built vs observed-to-hold. */
 RequirementState, AcceptanceCriterion, RequirementItem, DomainRule, RequirementGroup, SpecModule, SpecDoc, CompanionAssessment, CompanionVerdict, DeployFixConfig, DeployFixState, DeployFixAttempt, GateStepState, GateFailingCheck, GateAttempt, RalphStepState, RalphVerdict, RalphAttempt, ValidationCheck, ValidationCheckOutcome, ValidationReport, ResolvedValidationChecks, ServiceValidationConfig, UpsertServiceValidationConfigInput, ReproductionProofMode, ResolvedReproduction, ReproductionStatus, ReproductionPhaseOutcome, ReproductionReport, HumanTestStepState, HumanTestEnvironment, HumanTestRound, RequestHumanTestFixInput, VisualConfirmStepState, VisualConfirmPair, VisualConfirmReferenceOrigin, VisualConfirmDesignGap, VisualConfirmDesignGapReason, VisualConfirmDesignReferences, VisualConfirmRound, MergeAssessment, MergeAxis, MergeDecision, MergeDecisionThresholds, MergeClassRule, MergeClassRules, ClassRulesByRole, SubmissionClassesByRole, RunMode, ChangeClass, ReviewEffort, MergeTrackDecision, MergeTrackRecord, MergeClassRollup, ReviewEffortDistribution, TagReviewEffortInput, PrVerificationReport, PrReportScope, PrReportOwnPullRequest, PrReportSectionStatus, PrReportStep, PrReportIssue, PrReportJudge, PrReportFollowUp, PrReportFollowUps, PrReportRun, PrReportCheck, PrReportCi, PrReportTestOutcome, PrReportTestConcern, PrReportTests, PrReportContext, PrReportContextDocument, PrReportValidation, PrReportValidationCommand, PrReportReproduction, PrReportReproductionPhase, PrReportEnvironment, PrReportEnvironments, PrReportEnvironmentTimeline, PrReportTimelineGap, PrReportEnvironmentEvidence, PrReportEvidenceArtifact, PrReportRequirement, PrReportRequirements, PrReportMerge, PrReportObservability, RiskPolicy, RequirementConcernLevel, CreateRiskPolicyInput, UpdateRiskPolicyInput, CloneRiskPolicyInput, RiskPolicyTier, RiskPolicyLibraryEntry, RiskPolicySuppression, RunAutonomy, RunDefaultScope, ComposeFileRef, ComposeSource, ComposeSourceKind, SharedStack, SharedStackStatus, CreateSharedStackInput, UpdateSharedStackInput, DetectSharedStackInput, SharedStackRecommendation, ConsensusStrategy, ConsensusParticipant, ConsensusGating, StepGating, ConsensusStepConfig, ConsensusGroup, CreateConsensusGroupInput, UpdateConsensusGroupInput, TaskEstimate, TaskEstimateBasis, SupersededTaskEstimate, ConsensusScore, ConsensusContribution, ConsensusRound, ConsensusSessionStatus, ConsensusSession, AgentConfigOption, AgentConfigDescriptor, AgentConfigCatalog, AgentConfigValues, TestReport, TestOutcome, TestConcern, TestConcernSeverity, RequirementVerdict, RequirementVerdictStatus, TesterQualityConfig, StepOptions, StepGateConfig, GateApproverPolicy, GateApprovalRecord, CloudProvider, InstanceSize, UpdateAccountInput, ModelFlavor, ModelPreset, CreateModelPresetInput, UpdateModelPresetInput, AgentPromptRevision, AgentPromptDetail, AgentPromptSummary, SaveAgentPromptInput, PromoteAgentPromptInput, WorkspaceAgentSettings, UpdateWorkspaceAgentSettingsInput, ServiceFragmentDefaults, SetServiceFragmentDefaultsInput, Notification, NotificationType, NotificationStatus, NotificationSeverity, NotificationPayload, ResolveNotificationAction, NotificationDeliveryChannel, NotificationChannelOverrides, NotificationRoutingMatrix, NotificationSettings, UpdateNotificationSettingsInput, WorkspaceSettings, UpdateWorkspaceSettingsInput, TaskLimitMode, TaskLimitPerType, UserSettings, UpdateUserSettingsInput, TutorialProgress, TutorialDecision, UpdateTutorialProgressInput, TutorialEvent, RecordTutorialEventInput, SlackConnection, SlackRoute, SlackNotificationSettings, SlackMemberMappingEntry, SlackMemberRole, SlackMemberMapping, SlackChannel, ConnectSlackByTokenInput, UpdateSlackSettingsInput, UpdateSlackMemberMappingInput, ScheduleTemplate, Recurrence, IssueIntakeConfig, PipelineSchedule, ScheduleRun, CreateScheduleInput, UpdateScheduleInput, TrackerKind, TrackerSettings, PutTrackerSettingsInput, WritebackOverride, LlmCallActivity, SandboxPromptOrigin, SandboxPromptVersion, SandboxFixtureKind, SandboxRepoRef, SandboxFixtureObjective, SandboxFixture, SandboxExperimentStatus, SandboxMatrix, SandboxExperiment, SandboxRunStatus, SandboxTokenUsage, SandboxRun, SandboxGradeDimension, SandboxObjectiveResult, SandboxGrade, Initiative, InitiativeStatus, InitiativeItem, InitiativeItemStatus, InitiativePhase, InitiativeEstimate, InitiativePipelineRule, InitiativeExecutionPolicy, InitiativeDecision, InitiativeDeviation, InitiativeFollowUp, InitiativeQa, InitiativeQaStatus, InitiativeInterviewState, InitiativePlanDraft, InitiativeDraftItem, InitiativeVersion, CreateInitiativeInput, AnswerInitiativeQuestionInput, PromoteInitiativeFollowUpInput, UpdateInitiativeItemInput, UpdateInitiativePolicyInput, AccountSettingsConfig, ContentStorageConfig, FigmaOAuthSecret, LinearOAuthSecret, S3CredentialsSecret, SlackOAuthSecret, WebSearchSecret, } from '@cat-factory/contracts';
 /**