@codyswann/lisa 2.235.0 → 2.237.0

package/dist/cli/ui-observability-checks.d.ts

@@ -0,0 +1,23 @@
+import type { AwsCountCheck, SentryReachabilityCheck } from "./ui-observability-providers.js";
+/**
+ * Default Sentry reachability: REST when SENTRY_AUTH_TOKEN is set.
+ * @param timeoutMs - Request budget
+ * @param signal - Abort signal
+ * @returns Reachability outcome
+ */
+export declare const defaultSentryCheck: SentryReachabilityCheck;
+/**
+ * Count CloudWatch alarms after confirming AWS identity.
+ * @param timeoutMs - Command budget
+ * @param signal - Abort signal
+ * @returns Alarm count, or not-authenticated
+ */
+export declare const defaultCloudWatchCheck: AwsCountCheck;
+/**
+ * Count recent X-Ray traces after confirming AWS identity.
+ * @param timeoutMs - Command budget
+ * @param signal - Abort signal
+ * @returns Trace count, or not-authenticated
+ */
+export declare const defaultXRayCheck: AwsCountCheck;
+//# sourceMappingURL=ui-observability-checks.d.ts.map

package/dist/cli/ui-observability-checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ui-observability-checks.d.ts","sourceRoot":"","sources":["../../src/cli/ui-observability-checks.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,aAAa,EACb,uBAAuB,EACxB,MAAM,iCAAiC,CAAC;AAiGzC;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,uBAsBhC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,EAAE,aAyBpC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,EAAE,aA0B9B,CAAC"}

package/dist/cli/ui-observability-checks.js

@@ -0,0 +1,156 @@
+/**
+ * Shell-out reachability checks for observability provider probes.
+ *
+ * Reuses the same CLIs/tokens skills already use (SENTRY_AUTH_TOKEN REST,
+ * `aws sts` / `cloudwatch` / `xray`) — no second SDK.
+ * @module cli/ui-observability-checks
+ */
+import { execFile } from "node:child_process";
+const NOT_AUTHENTICATED = "not-authenticated";
+/**
+ * Read one env var through a single reviewable process.env exception.
+ * @param name - Environment variable name
+ * @returns Trimmed value, or undefined when unset/blank
+ */
+function readEnv(name) {
+    // eslint-disable-next-line no-restricted-syntax -- observability probe must read developer-local auth tokens once
+    const value = process.env[name];
+    if (typeof value !== "string") {
+        return undefined;
+    }
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
+/**
+ * Run a fixed argv via execFile without a shell.
+ * @param file - Executable name
+ * @param args - Argument vector
+ * @param timeoutMs - Child-process timeout
+ * @param signal - Probe cancellation signal
+ * @returns stdout on success
+ */
+async function runCommand(file, args, timeoutMs, signal) {
+    return await new Promise((resolve, reject) => {
+        execFile(
+        // eslint-disable-next-line sonarjs/no-os-command-from-path -- fixed user-installed aws CLI
+        file, [...args], { signal, timeout: timeoutMs, encoding: "utf8" }, (error, stdout) => {
+            if (error !== null) {
+                reject(error);
+                return;
+            }
+            resolve(stdout);
+        });
+    });
+}
+/**
+ * Classify an AWS CLI failure as missing auth vs other probe failure.
+ * @param error - Thrown command error
+ * @returns Whether the failure indicates missing credentials
+ */
+function isAwsAuthFailure(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const lowered = message.toLowerCase();
+    return (lowered.includes("unable to locate credentials") ||
+        lowered.includes("could not load credentials") ||
+        lowered.includes("no credentials") ||
+        lowered.includes("expiredtoken") ||
+        lowered.includes("the security token included in the request is invalid") ||
+        lowered.includes("is not authorized to perform") ||
+        lowered.includes("accessdenied") ||
+        lowered.includes("error loading sso") ||
+        lowered.includes("sso session"));
+}
+/**
+ * Confirm AWS identity, mapping credential failures to not-authenticated.
+ * @param timeoutMs - Command budget
+ * @param signal - Abort signal
+ * @returns not-authenticated when credentials are missing; otherwise void
+ */
+async function requireAwsIdentity(timeoutMs, signal) {
+    try {
+        await runCommand("aws", ["sts", "get-caller-identity", "--output", "json"], timeoutMs, signal);
+        return undefined;
+    }
+    catch (error) {
+        if (isAwsAuthFailure(error)) {
+            return NOT_AUTHENTICATED;
+        }
+        throw error;
+    }
+}
+/**
+ * Default Sentry reachability: REST when SENTRY_AUTH_TOKEN is set.
+ * @param timeoutMs - Request budget
+ * @param signal - Abort signal
+ * @returns Reachability outcome
+ */
+export const defaultSentryCheck = async (timeoutMs, signal) => {
+    const token = readEnv("SENTRY_AUTH_TOKEN");
+    if (token === undefined) {
+        return NOT_AUTHENTICATED;
+    }
+    const response = await fetch("https://sentry.io/api/0/", {
+        headers: {
+            accept: "application/json",
+            authorization: `Bearer ${token}`,
+        },
+        signal: AbortSignal.any([signal, AbortSignal.timeout(timeoutMs)]),
+    });
+    if (response.ok) {
+        return "reachable";
+    }
+    if (response.status === 401 || response.status === 403) {
+        return NOT_AUTHENTICATED;
+    }
+    throw new Error(`Sentry API returned HTTP ${String(response.status)}`);
+};
+/**
+ * Count CloudWatch alarms after confirming AWS identity.
+ * @param timeoutMs - Command budget
+ * @param signal - Abort signal
+ * @returns Alarm count, or not-authenticated
+ */
+export const defaultCloudWatchCheck = async (timeoutMs, signal) => {
+    const auth = await requireAwsIdentity(timeoutMs, signal);
+    if (auth !== undefined) {
+        return auth;
+    }
+    const stdout = await runCommand("aws", ["cloudwatch", "describe-alarms", "--output", "json"], timeoutMs, signal);
+    const parsed = JSON.parse(stdout);
+    const metric = Array.isArray(parsed.MetricAlarms)
+        ? parsed.MetricAlarms.length
+        : 0;
+    const composite = Array.isArray(parsed.CompositeAlarms)
+        ? parsed.CompositeAlarms.length
+        : 0;
+    return metric + composite;
+};
+/**
+ * Count recent X-Ray traces after confirming AWS identity.
+ * @param timeoutMs - Command budget
+ * @param signal - Abort signal
+ * @returns Trace count, or not-authenticated
+ */
+export const defaultXRayCheck = async (timeoutMs, signal) => {
+    const auth = await requireAwsIdentity(timeoutMs, signal);
+    if (auth !== undefined) {
+        return auth;
+    }
+    const end = new Date();
+    const start = new Date(end.getTime() - 60 * 60 * 1000);
+    const stdout = await runCommand("aws", [
+        "xray",
+        "get-trace-summaries",
+        "--start-time",
+        start.toISOString(),
+        "--end-time",
+        end.toISOString(),
+        "--output",
+        "json",
+    ], timeoutMs, signal);
+    const parsed = JSON.parse(stdout);
+    return Array.isArray(parsed.TraceSummaries)
+        ? parsed.TraceSummaries.length
+        : 0;
+};
+//# sourceMappingURL=ui-observability-checks.js.map

package/dist/cli/ui-observability-checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ui-observability-checks.js","sourceRoot":"","sources":["../../src/cli/ui-observability-checks.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAM9C,MAAM,iBAAiB,GAAG,mBAA4B,CAAC;AAEvD;;;;GAIG;AACH,SAAS,OAAO,CAAC,IAAY;IAC3B,kHAAkH;IAClH,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,UAAU,CACvB,IAAY,EACZ,IAAuB,EACvB,SAAiB,EACjB,MAAmB;IAEnB,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,QAAQ;QACN,2FAA2F;QAC3F,IAAI,EACJ,CAAC,GAAG,IAAI,CAAC,EACT,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAChD,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YAChB,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,MAAM,CAAC,KAAK,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,KAAc;IACtC,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACtC,OAAO,CACL,OAAO,CAAC,QAAQ,CAAC,8BAA8B,CAAC;QAChD,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAC;QAC9C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAClC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;QAChC,OAAO,CAAC,QAAQ,CAAC,uDAAuD,CAAC;QACzE,OAAO,CAAC,QAAQ,CAAC,8BAA8B,CAAC;QAChD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;QAChC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAChC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,kBAAkB,CAC/B,SAAiB,EACjB,MAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,UAAU,CACd,KAAK,EACL,CAAC,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,CAAC,EAClD,SAAS,EACT,MAAM,CACP,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,iBAAiB,CAAC;QAC3B,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA4B,KAAK,EAC9D,SAAS,EACT,MAAM,EACN,EAAE;IACF,MAAM,KAAK,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC3C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,0BAA0B,EAAE;QACvD,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,UAAU,KAAK,EAAE;SACjC;QACD,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;KAClE,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvD,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,4BAA4B,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACzE,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAkB,KAAK,EACxD,SAAS,EACT,MAAM,EACN,EAAE;IACF,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACzD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAC7B,KAAK,EACL,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,CAAC,EACrD,SAAS,EACT,MAAM,CACP,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAG/B,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;QAC/C,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM;QAC5B,CAAC,CAAC,CAAC,CAAC;IACN,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC;QACrD,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM;QAC/B,CAAC,CAAC,CAAC,CAAC;IACN,OAAO,MAAM,GAAG,SAAS,CAAC;AAC5B,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAkB,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE;IACzE,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACzD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,MAAM,UAAU,CAC7B,KAAK,EACL;QACE,MAAM;QACN,qBAAqB;QACrB,cAAc;QACd,KAAK,CAAC,WAAW,EAAE;QACnB,YAAY;QACZ,GAAG,CAAC,WAAW,EAAE;QACjB,UAAU;QACV,MAAM;KACP,EACD,SAAS,EACT,MAAM,CACP,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAmC,CAAC;IACpE,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC;QACzC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM;QAC9B,CAAC,CAAC,CAAC,CAAC;AACR,CAAC,CAAC"}

package/dist/cli/ui-observability-providers.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Live-status probes for connected observability providers.
+ *
+ * READ-ONLY detection by reachability (Sentry auth, CloudWatch alarms, X-Ray
+ * traces). Missing credentials degrade to unknown — never a fabricated
+ * "disconnected" claim.
+ * @module cli/ui-observability-providers
+ */
+import type { JsonValue } from "../sync/json-path.js";
+import type { ProbeResult, StatusProbe } from "./ui-status.js";
+/** Structured value for a reachable observability provider. */
+export type ObservabilityProviderValue = {
+    readonly [key: string]: JsonValue;
+    readonly status: "connected" | "connected-but-empty";
+    readonly emptyKind?: "alarms" | "traces";
+};
+/** Injectable Sentry reachability check. */
+export type SentryReachabilityCheck = (timeoutMs: number, signal: AbortSignal) => Promise<"reachable" | "not-authenticated">;
+/** Injectable AWS count check (alarms or traces), or not-authenticated. */
+export type AwsCountCheck = (timeoutMs: number, signal: AbortSignal) => Promise<number | "not-authenticated">;
+export declare const SENTRY_PROBE_ID = "sentry";
+export declare const CLOUDWATCH_ALARMS_PROBE_ID = "cloudwatch-alarms";
+export declare const XRAY_PROBE_ID = "x-ray";
+/**
+ * Map Sentry reachability onto the live-status tri-state.
+ * @param outcome - Reachability check result
+ * @returns Probe result for the sentry provider
+ */
+export declare function mapSentryReachability(outcome: "reachable" | "not-authenticated"): ProbeResult<ObservabilityProviderValue>;
+/**
+ * Map an AWS count check onto connected / empty / unknown.
+ * @param outcome - Count or not-authenticated
+ * @param emptyKind - Whether zero means no alarms or no traces
+ * @returns Probe result for CloudWatch or X-Ray
+ */
+export declare function mapAwsCountCheck(outcome: number | "not-authenticated", emptyKind: "alarms" | "traces"): ProbeResult<ObservabilityProviderValue>;
+/**
+ * Create the Sentry observability probe.
+ * @param options - Injectable collaborators
+ * @param options.check - Optional reachability check for focused tests
+ * @returns Bounded status probe
+ */
+export declare function createSentryProbe(options?: {
+    readonly check?: SentryReachabilityCheck;
+}): StatusProbe<ObservabilityProviderValue>;
+/**
+ * Create the CloudWatch Alarms observability probe.
+ * @param options - Injectable collaborators
+ * @param options.check - Optional alarm-count check for focused tests
+ * @returns Bounded status probe
+ */
+export declare function createCloudWatchAlarmsProbe(options?: {
+    readonly check?: AwsCountCheck;
+}): StatusProbe<ObservabilityProviderValue>;
+/**
+ * Create the X-Ray observability probe.
+ * @param options - Injectable collaborators
+ * @param options.check - Optional trace-count check for focused tests
+ * @returns Bounded status probe
+ */
+export declare function createXRayProbe(options?: {
+    readonly check?: AwsCountCheck;
+}): StatusProbe<ObservabilityProviderValue>;
+/**
+ * Register all three observability provider probes.
+ * @returns Sentry, CloudWatch Alarms, and X-Ray probes
+ */
+export declare function createObservabilityProviderProbes(): readonly StatusProbe<ObservabilityProviderValue>[];
+//# sourceMappingURL=ui-observability-providers.d.ts.map

package/dist/cli/ui-observability-providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ui-observability-providers.d.ts","sourceRoot":"","sources":["../../src/cli/ui-observability-providers.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAO/D,+DAA+D;AAC/D,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,qBAAqB,CAAC;IACrD,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;CAC1C,CAAC;AAEF,4CAA4C;AAC5C,MAAM,MAAM,uBAAuB,GAAG,CACpC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,WAAW,KAChB,OAAO,CAAC,WAAW,GAAG,mBAAmB,CAAC,CAAC;AAEhD,2EAA2E;AAC3E,MAAM,MAAM,aAAa,GAAG,CAC1B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,WAAW,KAChB,OAAO,CAAC,MAAM,GAAG,mBAAmB,CAAC,CAAC;AAE3C,eAAO,MAAM,eAAe,WAAW,CAAC;AACxC,eAAO,MAAM,0BAA0B,sBAAsB,CAAC;AAC9D,eAAO,MAAM,aAAa,UAAU,CAAC;AASrC;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,WAAW,GAAG,mBAAmB,GACzC,WAAW,CAAC,0BAA0B,CAAC,CASzC;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,GAAG,mBAAmB,EACrC,SAAS,EAAE,QAAQ,GAAG,QAAQ,GAC7B,WAAW,CAAC,0BAA0B,CAAC,CAezC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,GAAE;IACP,QAAQ,CAAC,KAAK,CAAC,EAAE,uBAAuB,CAAC;CACrC,GACL,WAAW,CAAC,0BAA0B,CAAC,CAQzC;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,GAAE;IACP,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;CAC3B,GACL,WAAW,CAAC,0BAA0B,CAAC,CAQzC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,OAAO,GAAE;IACP,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;CAC3B,GACL,WAAW,CAAC,0BAA0B,CAAC,CAQzC;AAED;;;GAGG;AACH,wBAAgB,iCAAiC,IAAI,SAAS,WAAW,CAAC,0BAA0B,CAAC,EAAE,CAMtG"}

package/dist/cli/ui-observability-providers.js

@@ -0,0 +1,99 @@
+import { defaultCloudWatchCheck, defaultSentryCheck, defaultXRayCheck, } from "./ui-observability-checks.js";
+export const SENTRY_PROBE_ID = "sentry";
+export const CLOUDWATCH_ALARMS_PROBE_ID = "cloudwatch-alarms";
+export const XRAY_PROBE_ID = "x-ray";
+const PROBE_TIMEOUT_MS = 5_000;
+const NOT_AUTHENTICATED = "not-authenticated";
+const SENTRY_UNKNOWN_MESSAGE = "Sentry auth/MCP is not reachable — authenticate Sentry MCP/CLI or set SENTRY_AUTH_TOKEN";
+const AWS_UNKNOWN_MESSAGE = "AWS credentials are not authenticated for this machine";
+/**
+ * Map Sentry reachability onto the live-status tri-state.
+ * @param outcome - Reachability check result
+ * @returns Probe result for the sentry provider
+ */
+export function mapSentryReachability(outcome) {
+    if (outcome === "reachable") {
+        return { state: "value", value: { status: "connected" } };
+    }
+    return {
+        state: "unknown",
+        reason: NOT_AUTHENTICATED,
+        message: SENTRY_UNKNOWN_MESSAGE,
+    };
+}
+/**
+ * Map an AWS count check onto connected / empty / unknown.
+ * @param outcome - Count or not-authenticated
+ * @param emptyKind - Whether zero means no alarms or no traces
+ * @returns Probe result for CloudWatch or X-Ray
+ */
+export function mapAwsCountCheck(outcome, emptyKind) {
+    if (outcome === "not-authenticated") {
+        return {
+            state: "unknown",
+            reason: NOT_AUTHENTICATED,
+            message: AWS_UNKNOWN_MESSAGE,
+        };
+    }
+    if (outcome > 0) {
+        return { state: "value", value: { status: "connected" } };
+    }
+    return {
+        state: "value",
+        value: { status: "connected-but-empty", emptyKind },
+    };
+}
+/**
+ * Create the Sentry observability probe.
+ * @param options - Injectable collaborators
+ * @param options.check - Optional reachability check for focused tests
+ * @returns Bounded status probe
+ */
+export function createSentryProbe(options = {}) {
+    const check = options.check ?? defaultSentryCheck;
+    return {
+        id: SENTRY_PROBE_ID,
+        timeoutMs: PROBE_TIMEOUT_MS,
+        run: async (signal) => mapSentryReachability(await check(PROBE_TIMEOUT_MS + 250, signal)),
+    };
+}
+/**
+ * Create the CloudWatch Alarms observability probe.
+ * @param options - Injectable collaborators
+ * @param options.check - Optional alarm-count check for focused tests
+ * @returns Bounded status probe
+ */
+export function createCloudWatchAlarmsProbe(options = {}) {
+    const check = options.check ?? defaultCloudWatchCheck;
+    return {
+        id: CLOUDWATCH_ALARMS_PROBE_ID,
+        timeoutMs: PROBE_TIMEOUT_MS,
+        run: async (signal) => mapAwsCountCheck(await check(PROBE_TIMEOUT_MS + 250, signal), "alarms"),
+    };
+}
+/**
+ * Create the X-Ray observability probe.
+ * @param options - Injectable collaborators
+ * @param options.check - Optional trace-count check for focused tests
+ * @returns Bounded status probe
+ */
+export function createXRayProbe(options = {}) {
+    const check = options.check ?? defaultXRayCheck;
+    return {
+        id: XRAY_PROBE_ID,
+        timeoutMs: PROBE_TIMEOUT_MS,
+        run: async (signal) => mapAwsCountCheck(await check(PROBE_TIMEOUT_MS + 250, signal), "traces"),
+    };
+}
+/**
+ * Register all three observability provider probes.
+ * @returns Sentry, CloudWatch Alarms, and X-Ray probes
+ */
+export function createObservabilityProviderProbes() {
+    return [
+        createSentryProbe(),
+        createCloudWatchAlarmsProbe(),
+        createXRayProbe(),
+    ];
+}
+//# sourceMappingURL=ui-observability-providers.js.map

package/dist/cli/ui-observability-providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ui-observability-providers.js","sourceRoot":"","sources":["../../src/cli/ui-observability-providers.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,8BAA8B,CAAC;AAqBtC,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC;AACxC,MAAM,CAAC,MAAM,0BAA0B,GAAG,mBAAmB,CAAC;AAC9D,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC;AAErC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAC9C,MAAM,sBAAsB,GAC1B,yFAAyF,CAAC;AAC5F,MAAM,mBAAmB,GACvB,wDAAwD,CAAC;AAE3D;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAA0C;IAE1C,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;QAC5B,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,CAAC;IAC5D,CAAC;IACD,OAAO;QACL,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,sBAAsB;KAChC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAqC,EACrC,SAA8B;IAE9B,IAAI,OAAO,KAAK,mBAAmB,EAAE,CAAC;QACpC,OAAO;YACL,KAAK,EAAE,SAAS;YAChB,MAAM,EAAE,iBAAiB;YACzB,OAAO,EAAE,mBAAmB;SAC7B,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,CAAC;IAC5D,CAAC;IACD,OAAO;QACL,KAAK,EAAE,OAAO;QACd,KAAK,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,SAAS,EAAE;KACpD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAEI,EAAE;IAEN,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,kBAAkB,CAAC;IAClD,OAAO;QACL,EAAE,EAAE,eAAe;QACnB,SAAS,EAAE,gBAAgB;QAC3B,GAAG,EAAE,KAAK,EAAC,MAAM,EAAC,EAAE,CAClB,qBAAqB,CAAC,MAAM,KAAK,CAAC,gBAAgB,GAAG,GAAG,EAAE,MAAM,CAAC,CAAC;KACrE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,UAEI,EAAE;IAEN,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,sBAAsB,CAAC;IACtD,OAAO;QACL,EAAE,EAAE,0BAA0B;QAC9B,SAAS,EAAE,gBAAgB;QAC3B,GAAG,EAAE,KAAK,EAAC,MAAM,EAAC,EAAE,CAClB,gBAAgB,CAAC,MAAM,KAAK,CAAC,gBAAgB,GAAG,GAAG,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,UAEI,EAAE;IAEN,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,gBAAgB,CAAC;IAChD,OAAO;QACL,EAAE,EAAE,aAAa;QACjB,SAAS,EAAE,gBAAgB;QAC3B,GAAG,EAAE,KAAK,EAAC,MAAM,EAAC,EAAE,CAClB,gBAAgB,CAAC,MAAM,KAAK,CAAC,gBAAgB,GAAG,GAAG,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iCAAiC;IAC/C,OAAO;QACL,iBAAiB,EAAE;QACnB,2BAA2B,EAAE;QAC7B,eAAe,EAAE;KAClB,CAAC;AACJ,CAAC"}

package/dist/core/learnings-budget-check.d.ts

@@ -0,0 +1,42 @@
+/** A learnings file that satisfies every hard budget. */
+export interface LearningsBudgetOk {
+    readonly kind: "ok";
+    readonly entryCount: number;
+    readonly maxEntries: number;
+    readonly measuredTokens: number;
+    readonly maxTokens: number;
+}
+/** No learnings file exists at the resolved path — an expected, silent case. */
+export interface LearningsBudgetMissing {
+    readonly kind: "missing";
+    readonly detail: string;
+}
+/** The learnings file breached a budget or is otherwise unsafe or invalid. */
+export interface LearningsBudgetViolation {
+    readonly kind: "violation";
+    readonly detail: string;
+}
+/** Structured outcome of one budget check. */
+export type LearningsBudgetResult = LearningsBudgetOk | LearningsBudgetMissing | LearningsBudgetViolation;
+/**
+ * Check one already-resolved absolute learnings path against the shared hard
+ * budgets. Callers resolve the path (from config or an explicit argument) and
+ * decide the exit policy from the returned discriminated union.
+ * @param file - Absolute learnings file path
+ * @returns Structured budget-check result
+ */
+export declare function checkLearningsBudget(file: string): Promise<LearningsBudgetResult>;
+/**
+ * Render a caught failure without allowing filesystem paths or control bytes
+ * embedded in an Error message to forge additional terminal/CI output.
+ * @param error - Unknown thrown failure
+ * @returns Stable, single-line diagnostic detail
+ */
+export declare function formatErrorDetail(error: unknown): string;
+/**
+ * Quote one path after applying terminal-safe JSON-style escaping.
+ * @param file - Path to render in diagnostics
+ * @returns Quoted, terminal-safe path
+ */
+export declare function formatDiagnosticPath(file: string): string;
+//# sourceMappingURL=learnings-budget-check.d.ts.map

package/dist/core/learnings-budget-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"learnings-budget-check.d.ts","sourceRoot":"","sources":["../../src/core/learnings-budget-check.ts"],"names":[],"mappings":"AA4BA,yDAAyD;AACzD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,gFAAgF;AAChF,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,8EAA8E;AAC9E,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,8CAA8C;AAC9C,MAAM,MAAM,qBAAqB,GAC7B,iBAAiB,GACjB,sBAAsB,GACtB,wBAAwB,CAAC;AAE7B;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,qBAAqB,CAAC,CAgChC;AA2CD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAYxD;AAoCD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzD"}

package/dist/core/learnings-budget-check.js

@@ -0,0 +1,210 @@
+/**
+ * Reusable core check for the canonical project-learnings document and its hard
+ * budgets.
+ *
+ * Extracted from the package-facing `scripts/check-learnings-budget.ts` so the
+ * identical bounded-read, token-budget, per-entry validation, and canonical
+ * format checks can be shared by every caller — the existing package script and
+ * the `lisa check-learnings-budget` CLI subcommand that ships the gate into host
+ * projects' CI. Every hardening property of the original script is preserved
+ * here: a bounded regular-file read, an `O_NONBLOCK` open with TOCTOU stat
+ * checks, and terminal-escape-safe diagnostic text. The function never throws
+ * for an expected condition — a missing file is a distinct result and every
+ * other failure is a `violation` carrying a single-line, terminal-safe detail —
+ * so each caller owns its own exit policy.
+ * @module learnings-budget-check
+ */
+import { constants } from "node:fs";
+import { open } from "node:fs/promises";
+import { LEARNINGS_CONTRACT, estimateLearningTokens, } from "./learnings-contract.js";
+import { parseLearningsFile, renderLearningsFile, } from "./learnings-document.js";
+import { validateLearningEntry } from "./learnings-entry.js";
+/**
+ * Check one already-resolved absolute learnings path against the shared hard
+ * budgets. Callers resolve the path (from config or an explicit argument) and
+ * decide the exit policy from the returned discriminated union.
+ * @param file - Absolute learnings file path
+ * @returns Structured budget-check result
+ */
+export async function checkLearningsBudget(file) {
+    try {
+        const content = await readBoundedRegularFile(file, LEARNINGS_CONTRACT.maxTokens);
+        const measuredTokens = estimateLearningTokens(content);
+        if (measuredTokens > LEARNINGS_CONTRACT.maxTokens) {
+            throw new Error(`maxTokens exceeded: measured ${measuredTokens}, allowed ${LEARNINGS_CONTRACT.maxTokens}`);
+        }
+        const entries = parseLearningsFile(content);
+        for (const entry of entries) {
+            validateLearningEntry(entry);
+        }
+        if (renderLearningsFile(entries) !== content) {
+            throw new Error("non-canonical project learnings format");
+        }
+        return {
+            kind: "ok",
+            entryCount: entries.length,
+            maxEntries: LEARNINGS_CONTRACT.maxEntries,
+            measuredTokens,
+            maxTokens: LEARNINGS_CONTRACT.maxTokens,
+        };
+    }
+    catch (error) {
+        const detail = formatErrorDetail(error);
+        return isFileNotFound(error)
+            ? { kind: "missing", detail }
+            : { kind: "violation", detail: withRemediation(detail, file) };
+    }
+}
+/**
+ * Append a terse, actionable remediation clause to a file-level budget breach
+ * so an operator reading CI output learns the fix, not just the number. Only
+ * the whole-file budgets (token ceiling, entry count, canonical format) are
+ * augmented; per-entry validation failures already name the offending entry
+ * and are left verbatim, as are non-budget filesystem errors.
+ * @param detail - Terminal-safe diagnostic detail
+ * @param file - Absolute learnings file path
+ * @returns The detail, with a remediation clause when one applies
+ */
+function withRemediation(detail, file) {
+    if (detail.startsWith("Invalid learning entry")) {
+        return detail;
+    }
+    const target = formatDiagnosticPath(file);
+    if (detail.includes("maxEntries")) {
+        return `${detail} — consolidate or remove entries in ${target} to fit the learnings budget`;
+    }
+    if (detail.includes("maxTokens")) {
+        return `${detail} — shorten or remove entries in ${target} to fit the learnings budget`;
+    }
+    if (detail.includes("canonical") || detail.includes("format")) {
+        return `${detail} — re-generate ${target} with the learnings writer to restore the canonical format`;
+    }
+    return detail;
+}
+/**
+ * Whether a caught failure is a "file does not exist" filesystem error, which
+ * callers treat as an expected, silent condition rather than a violation.
+ * @param error - Unknown thrown failure
+ * @returns True when the error reports an absent path
+ */
+function isFileNotFound(error) {
+    return (error !== null &&
+        typeof error === "object" &&
+        readOwnString(error, "code") === "ENOENT");
+}
+/**
+ * Render a caught failure without allowing filesystem paths or control bytes
+ * embedded in an Error message to forge additional terminal/CI output.
+ * @param error - Unknown thrown failure
+ * @returns Stable, single-line diagnostic detail
+ */
+export function formatErrorDetail(error) {
+    if (error !== null && typeof error === "object") {
+        const code = readOwnString(error, "code");
+        if (code !== undefined && /^[A-Z][A-Z0-9_]*$/u.test(code)) {
+            const syscall = readOwnString(error, "syscall");
+            return syscall === undefined
+                ? `filesystem error ${code}`
+                : `filesystem error ${code} during ${escapeDiagnosticText(syscall)}`;
+        }
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    return escapeDiagnosticText(message);
+}
+/**
+ * Read one inert own string property without invoking an accessor.
+ * @param candidate - Object to inspect
+ * @param key - Property name to read
+ * @returns The own string value, or undefined
+ */
+function readOwnString(candidate, key) {
+    const descriptor = Object.getOwnPropertyDescriptor(candidate, key);
+    return descriptor !== undefined &&
+        "value" in descriptor &&
+        typeof descriptor.value === "string"
+        ? descriptor.value
+        : undefined;
+}
+/**
+ * Escape terminal controls while retaining ordinary diagnostic wording.
+ * @param value - Raw diagnostic text
+ * @returns Terminal-safe, single-line text
+ */
+function escapeDiagnosticText(value) {
+    const jsonBody = JSON.stringify(value).slice(1, -1);
+    return Array.from(jsonBody)
+        .map(character => {
+        const code = character.charCodeAt(0);
+        const isForbidden = (code >= 0x7f && code <= 0x9f) || code === 0x2028 || code === 0x2029;
+        return isForbidden
+            ? `\\u${code.toString(16).padStart(4, "0")}`
+            : character;
+    })
+        .join("");
+}
+/**
+ * Quote one path after applying terminal-safe JSON-style escaping.
+ * @param file - Path to render in diagnostics
+ * @returns Quoted, terminal-safe path
+ */
+export function formatDiagnosticPath(file) {
+    return `"${escapeDiagnosticText(file)}"`;
+}
+/**
+ * Read at most one byte beyond the hard budget from one verified regular-file
+ * handle. Non-blocking open prevents a FIFO path from stalling the gate.
+ * @param file - Absolute candidate learnings path
+ * @param maximumBytes - Shared executable maxTokens byte ceiling
+ * @returns Strictly decoded UTF-8 content within the byte ceiling
+ */
+async function readBoundedRegularFile(file, maximumBytes) {
+    const handle = await open(file, constants.O_RDONLY | constants.O_NONBLOCK);
+    try {
+        const before = await handle.stat({ bigint: true });
+        if (!before.isFile()) {
+            throw new Error("unsafe input: expected a regular file");
+        }
+        if (before.size > BigInt(maximumBytes)) {
+            throw new Error(`maxTokens exceeded: measured ${before.size}, allowed ${maximumBytes}`);
+        }
+        const buffer = Buffer.allocUnsafe(maximumBytes + 1);
+        const bytesRead = await fillBuffer(handle, buffer, 0);
+        if (bytesRead > maximumBytes) {
+            throw new Error(`maxTokens exceeded: measured at least ${bytesRead}, allowed ${maximumBytes}`);
+        }
+        const after = await handle.stat({ bigint: true });
+        if (after.dev !== before.dev ||
+            after.ino !== before.ino ||
+            after.size !== before.size ||
+            after.mtimeNs !== before.mtimeNs ||
+            after.ctimeNs !== before.ctimeNs) {
+            throw new Error("unsafe input: file changed during bounded read");
+        }
+        return new TextDecoder("utf-8", { fatal: true }).decode(buffer.subarray(0, bytesRead));
+    }
+    finally {
+        await handle.close();
+    }
+}
+/**
+ * Fill a fixed buffer from a handle via bounded recursion, returning the total
+ * bytes read. Recursion (rather than a mutable accumulator) keeps the module
+ * within the repository's immutability lint rules while preserving the
+ * original loop's "stop at EOF or buffer end" semantics; depth is bounded by
+ * the small fixed buffer, which a learnings file fills in one or two reads.
+ * @param handle - Verified regular-file handle
+ * @param buffer - Destination buffer sized to the byte ceiling plus one
+ * @param offset - Bytes already read into the buffer
+ * @returns Total bytes read into the buffer
+ */
+async function fillBuffer(handle, buffer, offset) {
+    if (offset >= buffer.length) {
+        return offset;
+    }
+    const result = await handle.read(buffer, offset, buffer.length - offset, null);
+    if (result.bytesRead === 0) {
+        return offset;
+    }
+    return fillBuffer(handle, buffer, offset + result.bytesRead);
+}
+//# sourceMappingURL=learnings-budget-check.js.map

package/dist/core/learnings-budget-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"learnings-budget-check.js","sourceRoot":"","sources":["../../src/core/learnings-budget-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,IAAI,EAAmB,MAAM,kBAAkB,CAAC;AACzD,OAAO,EACL,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AA6B7D;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAY;IAEZ,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAC1C,IAAI,EACJ,kBAAkB,CAAC,SAAS,CAC7B,CAAC;QACF,MAAM,cAAc,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,cAAc,GAAG,kBAAkB,CAAC,SAAS,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CACb,gCAAgC,cAAc,aAAa,kBAAkB,CAAC,SAAS,EAAE,CAC1F,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC5C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,mBAAmB,CAAC,OAAO,CAAC,KAAK,OAAO,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO;YACL,IAAI,EAAE,IAAI;YACV,UAAU,EAAE,OAAO,CAAC,MAAM;YAC1B,UAAU,EAAE,kBAAkB,CAAC,UAAU;YACzC,cAAc;YACd,SAAS,EAAE,kBAAkB,CAAC,SAAS;SACxC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACxC,OAAO,cAAc,CAAC,KAAK,CAAC;YAC1B,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE;YAC7B,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;IACnE,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,eAAe,CAAC,MAAc,EAAE,IAAY;IACnD,IAAI,MAAM,CAAC,UAAU,CAAC,wBAAwB,CAAC,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAClC,OAAO,GAAG,MAAM,uCAAuC,MAAM,8BAA8B,CAAC;IAC9F,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACjC,OAAO,GAAG,MAAM,mCAAmC,MAAM,8BAA8B,CAAC;IAC1F,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9D,OAAO,GAAG,MAAM,kBAAkB,MAAM,4DAA4D,CAAC;IACvG,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,CACL,KAAK,KAAK,IAAI;QACd,OAAO,KAAK,KAAK,QAAQ;QACzB,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,QAAQ,CAC1C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1C,IAAI,IAAI,KAAK,SAAS,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1D,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YAChD,OAAO,OAAO,KAAK,SAAS;gBAC1B,CAAC,CAAC,oBAAoB,IAAI,EAAE;gBAC5B,CAAC,CAAC,oBAAoB,IAAI,WAAW,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;QACzE,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC;AACvC,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,SAAiB,EAAE,GAAW;IACnD,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACnE,OAAO,UAAU,KAAK,SAAS;QAC7B,OAAO,IAAI,UAAU;QACrB,OAAO,UAAU,CAAC,KAAK,KAAK,QAAQ;QACpC,CAAC,CAAC,UAAU,CAAC,KAAK;QAClB,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,KAAa;IACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;SACxB,GAAG,CAAC,SAAS,CAAC,EAAE;QACf,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,WAAW,GACf,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,CAAC;QACvE,OAAO,WAAW;YAChB,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YAC5C,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC,CAAC;SACD,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,sBAAsB,CACnC,IAAY,EACZ,YAAoB;IAEpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAC3E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CACb,gCAAgC,MAAM,CAAC,IAAI,aAAa,YAAY,EAAE,CACvE,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACtD,IAAI,SAAS,GAAG,YAAY,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,yCAAyC,SAAS,aAAa,YAAY,EAAE,CAC9E,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,IACE,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;YACxB,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;YACxB,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;YAC1B,KAAK,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;YAChC,KAAK,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,EAChC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CACrD,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAC9B,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,UAAU,CACvB,MAAkB,EAClB,MAAc,EACd,MAAc;IAEd,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAC9B,MAAM,EACN,MAAM,EACN,MAAM,CAAC,MAAM,GAAG,MAAM,EACtB,IAAI,CACL,CAAC;IACF,IAAI,MAAM,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;AAC/D,CAAC"}

package/dist/core/learnings-document.js

@@ -66,7 +66,12 @@ function validateParsedLearningEntry(candidate, index) {
     }
     catch (error) {
         const id = readDiagnosticEntryId(candidate);
-        const label = id === undefined ? `entry ${index + 1}` : `entry ${JSON.stringify(id)}`;
+        // Single-quote the id rather than JSON.stringify it: the message is later
+        // rendered through a JSON-body escaper for terminal safety, which would
+        // double-escape embedded double quotes into `\"id\"`. Single quotes read
+        // cleanly and are not re-escaped, while control-character neutralization
+        // still happens downstream.
+        const label = id === undefined ? `entry ${index + 1}` : `entry '${id}'`;
         const detail = error instanceof Error ? error.message : String(error);
         throw new Error(`Invalid learning ${label}: ${detail}`);
     }