@descryy/mcp 0.11.4 → 0.11.5

package/dist/tools/validate.d.ts

@@ -1,133 +0,0 @@
-/**
- * `validate` — §15 static validation: env/config checks.
- * Omits a var unless its read fails-on-absence AND declaration surface is complete
- * (18/107 wrong findings measured otherwise); refuses rather than `ok` when no reads
- * exist. Pass `files` for NEW_READ_UNDECLARED — catches accessor-shape-independent reads.
- * Add `changedLines` (from get_git_diff's patch) to verify against an added line rather
- * than a file scope, and get `defect` instead of `lead` back for it — see C2, UAT phase 4. */
-import type { AttributeFinding, AttributeReport, ConfigGraph, ConfigReadSite, EnvClaim, EnvEvidence, EnvFindingKind, EnvReport, MigrationIntegrityFinding, MigrationIntegrityReport, ObservedRouteFinding, OrmRegistrationFinding, OrmRegistrationReport, RollbackFinding, RollbackReport } from "@descryy/core";
-import type { ResolutionLevel } from "@descryy/ir";
-import { type ToolDefinition } from "./kit.ts";
-/** One env/config finding. `claim` distinguishes `defect` (code contradiction) from
- *  `lead` (worth a look) — conflating them caused 18/107 wrong findings on two repos. */
-export interface EnvFindingReport {
-    readonly kind: EnvFindingKind;
-    readonly name: string;
-    readonly claim: EnvClaim;
-    readonly detail: string;
-    /** Every location the finding rests on. Never empty. */
-    readonly evidence: readonly EnvEvidence[];
-    readonly resolution: ResolutionLevel;
-}
-/** A variable and how much of the repo depends on it (§15.3's third check feeding
- *  the first). Only variables with a computable dependent set appear — unknown ≠ zero. */
-export interface ConfigDependencyReport {
-    readonly name: string;
-    /** A lower bound, never a total. */
-    readonly dependents: number | null;
-    /** True when the traversal's budget stopped it short. */
-    readonly truncated: boolean;
-    /** Up to three read sites. */
-    readonly readAt: readonly ConfigReadSite[];
-    /** A few dependent files, for a reader who wants to look. */
-    readonly sample: readonly string[];
-}
-export interface ValidateData {
-    readonly findings: readonly EnvFindingReport[];
-    /** The count before `maxFindings` capped it — P27's disclosed remainder (§4 technique 5). */
-    readonly findingsTotal: number;
-    readonly surfaces: EnvReport["surfaces"];
-    readonly reads: EnvReport["reads"];
-    /** Null when no read existed at all, so the coverage guard could not be evaluated. */
-    readonly coverage: EnvReport["coverage"];
-    /** Declared and read nowhere. A dead-configuration lead, not a finding. */
-    readonly declaredNeverRead: number;
-    /** False when no adapter supplied environment reads — otherwise "no missing
-     *  variables" would misstate code that was never read as clean. */
-    readonly readsAvailable: boolean;
-    readonly configGraph: {
-        readonly counts: ConfigGraph["counts"];
-        /** True when the graph carried at least one resolved import edge. */
-        readonly importsAvailable: boolean;
-        /** The ten most-depended-on variables that had a computable dependent set. */
-        readonly mostDependedOn: readonly ConfigDependencyReport[];
-    };
-    readonly rollback: {
-        readonly findings: readonly RollbackFinding[];
-        /** The count before `maxFindings` capped it — P27's disclosed remainder (§4 technique 5). */
-        readonly findingsTotal: number;
-        readonly examined: RollbackReport["examined"];
-        /** Operations this check declined to report, by reason. The size of what it did not say. */
-        readonly withheld: RollbackReport["withheld"];
-        /** False when no source supplied migration operations. */
-        readonly ran: boolean;
-        /** Named in plain words when `ran` is false. */
-        readonly blockers: readonly string[];
-    };
-    /** §"attribute read, type doesn't declare it" — always a defect (graph-provable
-     *  contradiction between two producers), never a lead. */
-    readonly attributeExistence: {
-        readonly findings: readonly AttributeFinding[];
-        readonly findingsTotal: number;
-        readonly examined: AttributeReport["examined"];
-        /** False when no READS edge onto a type-like node carried field-existence info at all. */
-        readonly ran: boolean;
-    };
-    /** §"migration outside its directory, or broken revision chain" — both always
-     *  defects, both graph-provable. */
-    readonly migrationIntegrity: {
-        readonly findings: readonly MigrationIntegrityFinding[];
-        readonly findingsTotal: number;
-        readonly examined: MigrationIntegrityReport["examined"];
-        readonly migrationsDirectory: string | null;
-        /** False when no module in the graph carried migration revision attrs. */
-        readonly ran: boolean;
-        readonly withheld: MigrationIntegrityReport["withheld"];
-    };
-    /** §"ORM model inherits the declarative base but no __init__.py in its package
-     *  reaches its module" — always a lead, never a defect: a model registered by an
-     *  explicit scan rather than by import, or deliberately excluded from migrations,
-     *  triggers this without being a bug. See `orm-registration.ts`'s header. */
-    readonly ormRegistration: {
-        readonly findings: readonly OrmRegistrationFinding[];
-        readonly findingsTotal: number;
-        readonly examined: OrmRegistrationReport["examined"];
-        /** False when no MODEL node in the graph carried an outgoing INHERITS edge. */
-        readonly ran: boolean;
-        readonly withheld: OrmRegistrationReport["withheld"];
-    };
-    /** §"an observed HTTP response against a path no route serves" — UAT phase 5 §5
-     *  (D2). Always a lead: a status code and path alone can never rule out a
-     *  legitimately missing resource. See `@descryy/core`'s `observed-routes.ts`. */
-    readonly observedRoutes: {
-        readonly findings: readonly ObservedRouteFinding[];
-        readonly findingsTotal: number;
-        readonly examined: number;
-        /** False when no evidence database exists yet, or it holds no NETWORK_RESPONSE/
-         *  HTTP_ERROR events — never created here: this is a read tool. */
-        readonly ran: boolean;
-    };
-}
-/** The minimal shape every one of `validate`'s finding sources satisfies — enough
- *  for a composer to count and rank without knowing which producer emitted an item. */
-export interface ValidateFinding {
-    readonly claim: "defect" | "lead";
-    readonly detail: string;
-}
-/**
- * Flattens every one of `validate`'s finding sources into one array: the
- * top-level env array plus the nested reports (`rollback`, `attributeExistence`,
- * `migrationIntegrity`, `ormRegistration`, `observedRoutes`).
- *
- * `validate` publishes findings across several separate sub-objects because
- * each check examines a different kind of evidence and discloses its own
- * `ran`/`examined`/`withheld` detail alongside its findings. A composer that
- * reads only one of them silently drops the rest — the exact failure UAT
- * phase 5 §4 found in `pre_push`, which read `data.findings` and nothing
- * else. This function is the one place that knows the full list, so a new
- * sub-check added here is inherited by every composer automatically instead
- * of requiring a second, easily-forgotten edit at each call site.
- */
-export declare function collectValidateFindings(data: ValidateData): readonly ValidateFinding[];
-export declare const validateTool: ToolDefinition;
-//# sourceMappingURL=validate.d.ts.map

package/dist/tools/validate.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/tools/validate.ts"],"names":[],"mappings":"AAAA;;;;;;8FAM8F;AAkB9F,OAAO,KAAK,EAEV,gBAAgB,EAChB,eAAe,EACf,WAAW,EACX,cAAc,EACd,QAAQ,EACR,WAAW,EACX,cAAc,EACd,SAAS,EACT,yBAAyB,EACzB,wBAAwB,EACxB,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,EACrB,eAAe,EACf,cAAc,EACf,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAInD,OAAO,EAKL,KAAK,cAAc,EACpB,MAAM,UAAU,CAAC;AAKlB;yFACyF;AACzF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;IAC1C,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;CACtC;AAED;0FAC0F;AAC1F,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oCAAoC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,yDAAyD;IACzD,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,8BAA8B;IAC9B,QAAQ,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC;IAC3C,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC/C,6FAA6F;IAC7F,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;IACzC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;IACnC,sFAAsF;IACtF,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;IACzC,2EAA2E;IAC3E,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC;uEACmE;IACnE,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE;QACpB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;QACvC,qEAAqE;QACrE,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;QACnC,8EAA8E;QAC9E,QAAQ,CAAC,cAAc,EAAE,SAAS,sBAAsB,EAAE,CAAC;KAC5D,CAAC;IACF,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAC;QAC9C,6FAA6F;QAC7F,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;QAC9C,4FAA4F;QAC5F,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;QAC9C,0DAA0D;QAC1D,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;QACtB,gDAAgD;QAChD,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;KACtC,CAAC;IACF;8DAC0D;IAC1D,QAAQ,CAAC,kBAAkB,EAAE;QAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,CAAC;QAC/C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,UAAU,CAAC,CAAC;QAC/C,0FAA0F;QAC1F,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;KACvB,CAAC;IACF;wCACoC;IACpC,QAAQ,CAAC,kBAAkB,EAAE;QAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,yBAAyB,EAAE,CAAC;QACxD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,QAAQ,EAAE,wBAAwB,CAAC,UAAU,CAAC,CAAC;QACxD,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5C,0EAA0E;QAC1E,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,wBAAwB,CAAC,UAAU,CAAC,CAAC;KACzD,CAAC;IACF;;;iFAG6E;IAC7E,QAAQ,CAAC,eAAe,EAAE;QACxB,QAAQ,CAAC,QAAQ,EAAE,SAAS,sBAAsB,EAAE,CAAC;QACrD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC,UAAU,CAAC,CAAC;QACrD,+EAA+E;QAC/E,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC,UAAU,CAAC,CAAC;KACtD,CAAC;IACF;;qFAEiF;IACjF,QAAQ,CAAC,cAAc,EAAE;QACvB,QAAQ,CAAC,QAAQ,EAAE,SAAS,oBAAoB,EAAE,CAAC;QACnD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B;2EACmE;QACnE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;KACvB,CAAC;CACH;AAuFD;uFACuF;AACvF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,MAAM,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,YAAY,GAAG,SAAS,eAAe,EAAE,CAStF;AAkaD,eAAO,MAAM,YAAY,EAAE,cAsC1B,CAAC"}

package/dist/tools/validate.js

@@ -1,520 +0,0 @@
-/**
- * `validate` — §15 static validation: env/config checks.
- * Omits a var unless its read fails-on-absence AND declaration surface is complete
- * (18/107 wrong findings measured otherwise); refuses rather than `ok` when no reads
- * exist. Pass `files` for NEW_READ_UNDECLARED — catches accessor-shape-independent reads.
- * Add `changedLines` (from get_git_diff's patch) to verify against an added line rather
- * than a file scope, and get `defect` instead of `lead` back for it — see C2, UAT phase 4. */
-import { existsSync } from "node:fs";
-import { join } from "node:path";
-import { buildConfigGraph, checkAttributeExistence, checkEnvironment, checkMigrationIntegrity, checkObservedRoutes, checkOrmModelRegistration, checkRollbackReadiness, declaredRoutesFrom, scanConfigSurfaces, scanMigrations, } from "@descryy/core";
-import { EvidenceStore } from "@descryy/runtime-evidence-store";
-import { extractObservedRouteEvidence } from "../evidence/observed-route-evidence.js";
-import { optionalInteger, optionalStringArray, ToolInputError, } from "./kit.js";
-import { DEFAULT_EVIDENCE_RELATIVE_PATH } from "./observe-runtime.js";
-import { capBySize, sizeCapNote } from "../capped.js";
-/**
- * `fitToBudget` for `ValidateData` — six independently-`maxFindings`-capped
- * finding lists, none sharing a payload with another, so shrinking is only
- * ever dropping trailing rows from one list at a time. Trimmed in an order
- * that spends the budget on the two lists this tool exists to catch last:
- * `observedRoutes`, `ormRegistration` and `rollback` are always leads, worth
- * a look but never a graph-provable contradiction; `attributeExistence` and
- * `migrationIntegrity` are always defects; `findings` (env) mixes both and is
- * kept longest because it is the check's own headline count.
- */
-function fitValidate(rest, budgetBytes) {
-    const scaffoldBytes = Buffer.byteLength(JSON.stringify({
-        ...rest,
-        findings: [],
-        rollback: { ...rest.rollback, findings: [] },
-        attributeExistence: { ...rest.attributeExistence, findings: [] },
-        migrationIntegrity: { ...rest.migrationIntegrity, findings: [] },
-        ormRegistration: { ...rest.ormRegistration, findings: [] },
-        observedRoutes: { ...rest.observedRoutes, findings: [] },
-    }), "utf8");
-    let budget = Math.max(budgetBytes - scaffoldBytes, 0);
-    const spend = (items) => {
-        const fit = capBySize(items, budget, 0);
-        budget = Math.max(budget - Buffer.byteLength(JSON.stringify(fit.shown), "utf8"), 0);
-        return fit;
-    };
-    const observedRoutesFit = spend(rest.observedRoutes.findings);
-    const ormRegistrationFit = spend(rest.ormRegistration.findings);
-    const rollbackFit = spend(rest.rollback.findings);
-    const migrationIntegrityFit = spend(rest.migrationIntegrity.findings);
-    const attributeExistenceFit = spend(rest.attributeExistence.findings);
-    const findingsFit = spend(rest.findings);
-    const notes = [];
-    const noteIfDropped = (noun, fit, before) => {
-        if (fit.droppedForSize > 0)
-            notes.push(sizeCapNote(noun, fit.shown.length, before, fit.droppedForSize));
-    };
-    noteIfDropped("env/config finding", findingsFit, rest.findings.length);
-    noteIfDropped("rollback finding", rollbackFit, rest.rollback.findings.length);
-    noteIfDropped("attribute-existence finding", attributeExistenceFit, rest.attributeExistence.findings.length);
-    noteIfDropped("migration-integrity finding", migrationIntegrityFit, rest.migrationIntegrity.findings.length);
-    noteIfDropped("ORM-registration finding", ormRegistrationFit, rest.ormRegistration.findings.length);
-    noteIfDropped("observed-route finding", observedRoutesFit, rest.observedRoutes.findings.length);
-    const droppedNow = findingsFit.droppedForSize +
-        rollbackFit.droppedForSize +
-        attributeExistenceFit.droppedForSize +
-        migrationIntegrityFit.droppedForSize +
-        ormRegistrationFit.droppedForSize +
-        observedRoutesFit.droppedForSize;
-    const shownNow = findingsFit.shown.length +
-        rollbackFit.shown.length +
-        attributeExistenceFit.shown.length +
-        migrationIntegrityFit.shown.length +
-        ormRegistrationFit.shown.length +
-        observedRoutesFit.shown.length;
-    const totalBefore = rest.findings.length +
-        rest.rollback.findings.length +
-        rest.attributeExistence.findings.length +
-        rest.migrationIntegrity.findings.length +
-        rest.ormRegistration.findings.length +
-        rest.observedRoutes.findings.length;
-    return {
-        data: {
-            ...rest,
-            findings: findingsFit.shown,
-            rollback: { ...rest.rollback, findings: rollbackFit.shown },
-            attributeExistence: { ...rest.attributeExistence, findings: attributeExistenceFit.shown },
-            migrationIntegrity: { ...rest.migrationIntegrity, findings: migrationIntegrityFit.shown },
-            ormRegistration: { ...rest.ormRegistration, findings: ormRegistrationFit.shown },
-            observedRoutes: { ...rest.observedRoutes, findings: observedRoutesFit.shown },
-        },
-        notes,
-        ...(droppedNow === 0 ? {} : { truncatedDetail: { shown: shownNow, total: totalBefore, more: null } }),
-    };
-}
-/**
- * Flattens every one of `validate`'s finding sources into one array: the
- * top-level env array plus the nested reports (`rollback`, `attributeExistence`,
- * `migrationIntegrity`, `ormRegistration`, `observedRoutes`).
- *
- * `validate` publishes findings across several separate sub-objects because
- * each check examines a different kind of evidence and discloses its own
- * `ran`/`examined`/`withheld` detail alongside its findings. A composer that
- * reads only one of them silently drops the rest — the exact failure UAT
- * phase 5 §4 found in `pre_push`, which read `data.findings` and nothing
- * else. This function is the one place that knows the full list, so a new
- * sub-check added here is inherited by every composer automatically instead
- * of requiring a second, easily-forgotten edit at each call site.
- */
-export function collectValidateFindings(data) {
-    return [
-        ...data.findings,
-        ...data.rollback.findings,
-        ...data.attributeExistence.findings,
-        ...data.migrationIntegrity.findings,
-        ...data.ormRegistration.findings,
-        ...data.observedRoutes.findings,
-    ];
-}
-const SCHEMA = {
-    type: "object",
-    properties: {
-        files: {
-            type: "array",
-            items: { type: "string" },
-            description: "Restrict the code side to these repo-relative files — the scoped-subgraph run. " +
-                "Configuration files are always read in full, because a declaration is repository-wide. " +
-                "Also enables a second, stronger env-var rule (NEW_READ_UNDECLARED): a variable read in " +
-                "one of these files and declared nowhere is reported regardless of whether the accessor " +
-                "fails on absence, catching a case the default rule structurally cannot.",
-        },
-        coverageFloor: {
-            type: "number",
-            minimum: 0,
-            maximum: 1,
-            description: "Fraction of required variables the repository must declare somewhere before any " +
-                "missing-variable finding is emitted. Default 0.6. Lowering it trades precision for " +
-                "recall on a repository whose configuration lives outside the code.",
-        },
-        maxFindings: {
-            type: "integer",
-            minimum: 1,
-            description: "Cap on findings returned. Default 25; overflow is disclosed, not dropped.",
-        },
-        changedLines: {
-            type: "array",
-            items: {
-                type: "object",
-                properties: {
-                    file: {
-                        type: "string",
-                        description: "A repo-relative path, matching one entry of \"files\".",
-                    },
-                    ranges: {
-                        type: "array",
-                        items: {
-                            type: "object",
-                            properties: {
-                                start: { type: "integer", minimum: 1 },
-                                end: { type: "integer", minimum: 1 },
-                            },
-                            required: ["start", "end"],
-                            additionalProperties: false,
-                        },
-                        description: "1-based, inclusive line ranges this file's diff actually added.",
-                    },
-                },
-                required: ["file", "ranges"],
-                additionalProperties: false,
-            },
-            description: "Which lines the diff actually added, per file — e.g. from get_git_diff's patch text run " +
-                "through addedLineRanges. Sharpens NEW_READ_UNDECLARED (which \"files\" alone already " +
-                "enables) from \"in a file this call scoped to\" to \"on a line this diff actually added\": " +
-                "without it, a pre-existing undeclared read in a file you touched for an unrelated reason is " +
-                "reported as a lead rather than a defect, because this call cannot tell it apart from a read " +
-                "the change just introduced. A file named in \"files\" but absent here is treated the same as " +
-                "when this argument is omitted entirely, for that file only.",
-        },
-    },
-    additionalProperties: false,
-};
-/** `changedLines`' wire shape ({ file, ranges }[], JSON-schema-friendly) into the
- *  `Map` `checkEnvironment` takes. Malformed input is refused, not silently dropped —
- *  a caller that thinks it narrowed the check and did not is worse off than one who
- *  never tried. */
-function parseChangedLines(args) {
-    const raw = args["changedLines"];
-    if (raw === undefined)
-        return undefined;
-    if (!Array.isArray(raw)) {
-        throw new ToolInputError('"changedLines" must be an array of { file, ranges }.');
-    }
-    const map = new Map();
-    for (const entry of raw) {
-        if (typeof entry !== "object" || entry === null) {
-            throw new ToolInputError('Each "changedLines" entry must be an object with "file" and "ranges".');
-        }
-        const row = entry;
-        const file = row["file"];
-        const ranges = row["ranges"];
-        if (typeof file !== "string" || file === "" || !Array.isArray(ranges)) {
-            throw new ToolInputError('Each "changedLines" entry needs a non-empty "file" and a "ranges" array.');
-        }
-        const parsedRanges = [];
-        for (const range of ranges) {
-            const r = typeof range === "object" && range !== null ? range : null;
-            const start = r?.["start"];
-            const end = r?.["end"];
-            if (typeof start !== "number" || typeof end !== "number") {
-                throw new ToolInputError(`"changedLines" entry for "${file}" has a range that is not { start, end }.`);
-            }
-            parsedRanges.push({ start, end });
-        }
-        map.set(file, parsedRanges);
-    }
-    return map;
-}
-/**
- * UAT phase 5 §5 (D2): reads `observe_runtime`'s own evidence database, if one
- * already exists, and checks its `NETWORK_RESPONSE`/`HTTP_ERROR` evidence
- * against the graph's declared routes.
- *
- * Never creates the database — this is a read tool, and `observe_runtime` (an
- * action tool) is the only thing with a legitimate reason to write one.
- */
-function readObservedRoutes(repoPath, provider) {
-    const evidencePath = join(repoPath, DEFAULT_EVIDENCE_RELATIVE_PATH);
-    if (!existsSync(evidencePath)) {
-        return {
-            findings: [],
-            examined: 0,
-            ran: false,
-            note: `No evidence database exists yet at ${evidencePath} — observe_runtime has not run against ` +
-                "this repository. observedRoutes did not run.",
-        };
-    }
-    const store = new EvidenceStore({ path: evidencePath });
-    try {
-        const events = [
-            ...store.query({ executionId: null, eventType: "NETWORK_REQUEST" }),
-            ...store.query({ executionId: null, eventType: "NETWORK_RESPONSE" }),
-            ...store.query({ executionId: null, eventType: "HTTP_ERROR" }),
-        ];
-        const observed = extractObservedRouteEvidence(events);
-        if (observed.length === 0) {
-            return {
-                findings: [],
-                examined: 0,
-                ran: false,
-                note: "The evidence database exists but holds no NETWORK_RESPONSE/HTTP_ERROR evidence with a " +
-                    "usable method, URL and status. observedRoutes did not run.",
-            };
-        }
-        const result = checkObservedRoutes(observed, declaredRoutesFrom(provider));
-        return { findings: result.findings, examined: result.examined, ran: true, note: null };
-    }
-    finally {
-        store.close();
-    }
-}
-async function run(args, ctx) {
-    const files = optionalStringArray(args, "files");
-    const maxFindings = optionalInteger(args, "maxFindings", 1);
-    const rawFloor = args["coverageFloor"];
-    const coverageFloor = typeof rawFloor === "number" && rawFloor >= 0 && rawFloor <= 1 ? rawFloor : undefined;
-    const changedLines = parseChangedLines(args);
-    ctx.progress("Reading configuration files");
-    const scan = scanConfigSurfaces(ctx.session.repoPath);
-    ctx.progress("Cross-checking against environment reads in the graph");
-    const provider = ctx.session.provider();
-    const checked = checkEnvironment(provider, scan, {
-        ...(files === undefined ? {} : { files }),
-        ...(maxFindings === undefined ? {} : { maxFindings }),
-        ...(coverageFloor === undefined ? {} : { coverageFloor }),
-        ...(changedLines === undefined ? {} : { changedLines }),
-    });
-    ctx.progress("Tracing what depends on each configuration variable");
-    const configGraph = buildConfigGraph(provider, scan);
-    ctx.progress("Reading migrations for destructive operations");
-    const rollback = checkRollbackReadiness(provider, scanMigrations(ctx.session.repoPath), {
-        ...(files === undefined ? {} : { files }),
-        ...(maxFindings === undefined ? {} : { maxFindings }),
-    });
-    ctx.progress("Checking attribute reads against declared types");
-    const attributeExistence = checkAttributeExistence(provider, {
-        ...(files === undefined ? {} : { files }),
-        ...(maxFindings === undefined ? {} : { maxFindings }),
-    });
-    ctx.progress("Checking migration location and revision chain");
-    const migrationIntegrity = checkMigrationIntegrity(provider, {
-        ...(files === undefined ? {} : { files }),
-        ...(maxFindings === undefined ? {} : { maxFindings }),
-    });
-    ctx.progress("Checking ORM models are reached by their package's __init__");
-    const ormRegistration = checkOrmModelRegistration(provider, {
-        ...(files === undefined ? {} : { files }),
-        ...(maxFindings === undefined ? {} : { maxFindings }),
-    });
-    ctx.progress("Checking observed HTTP responses against declared routes");
-    const observedRoutes = readObservedRoutes(ctx.session.repoPath, provider);
-    const report = checked.data;
-    const defects = report.findings.filter((f) => f.claim === "defect").length +
-        attributeExistence.data.findings.length +
-        migrationIntegrity.data.findings.length;
-    const leads = report.findings.length - report.findings.filter((f) => f.claim === "defect").length;
-    // Nothing compared at all: no config files, reads, migrations, attribute reads,
-    // or migration revisions — any one alone is a real answer, none of them is not.
-    const nothingToCheck = report.surfaces.length === 0 &&
-        !report.readsAvailable &&
-        !rollback.data.ran &&
-        !attributeExistence.data.ran &&
-        !migrationIntegrity.data.ran &&
-        !ormRegistration.data.ran &&
-        !observedRoutes.ran;
-    // A `files` scope matching zero FILE nodes means those files were never read into
-    // the graph (bad path, or unparsed) — not "read and clean". Same collapse as
-    // `contracts(paths)`, one level down.
-    const filesMatchedNothing = files !== undefined && report.reads.filesWithReads + report.reads.filesWithoutReads === 0;
-    // Leads and rollback findings are worth a look; defects are what this tool exists
-    // to catch. Never blur the two into one count (see EnvFindingReport.claim).
-    const otherFindings = leads + rollback.data.findings.length + ormRegistration.data.findings.length + observedRoutes.findings.length;
-    // A "Clean" verdict from a files scope matching nothing would misreport "checked,
-    // fine" when nothing was read. Only pure-Clean is downgraded — real findings from
-    // unscoped checks still surface.
-    const falseClean = filesMatchedNothing && defects === 0 && otherFindings === 0;
-    const verdict = falseClean
-        ? "not checked"
-        : defects > 0
-            ? `${defects} defect(s) found`
-            : otherFindings > 0
-                ? `No defects; ${otherFindings} lead(s)/rollback finding(s) to review`
-                : "Clean";
-    const scopeNotes = filesMatchedNothing
-        ? [
-            `0 of the ${(files ?? []).length} named file(s) matched a FILE node this graph's read side ` +
-                "considered — either the path is wrong, or the file was never read into the graph. The " +
-                "environment-read half of this report has nothing to say about them; it is not evidence " +
-                "they are clean.",
-        ]
-        : [];
-    // render.ts requires truncatedDetail whenever truncated=true. `truncated` folds 5
-    // independently-truncatable sources; shown/total cover the finding lists a
-    // maxFindings cap acts on — configGraph's own truncation stays prose-only.
-    // `observedRoutes` has no cap of its own (bounded by evidence volume, not by
-    // this tool), so it contributes the same count to both.
-    const shown = report.findings.length +
-        rollback.data.findings.length +
-        attributeExistence.data.findings.length +
-        migrationIntegrity.data.findings.length +
-        ormRegistration.data.findings.length +
-        observedRoutes.findings.length;
-    const total = report.findingsTotal +
-        rollback.data.findingsTotal +
-        attributeExistence.data.findingsTotal +
-        migrationIntegrity.data.findingsTotal +
-        ormRegistration.data.findingsTotal +
-        observedRoutes.findings.length;
-    const truncated = checked.truncated ||
-        rollback.truncated ||
-        attributeExistence.truncated ||
-        migrationIntegrity.truncated ||
-        ormRegistration.truncated ||
-        configGraph.truncated;
-    const truncatedDetail = truncated
-        ? { shown, total: Math.max(total, shown), more: null }
-        : undefined;
-    const validateData = {
-        findings: report.findings.map((f) => ({
-            kind: f.kind,
-            name: f.name,
-            claim: f.claim,
-            detail: f.detail,
-            evidence: f.evidence,
-            resolution: f.resolution,
-        })),
-        findingsTotal: report.findingsTotal,
-        surfaces: report.surfaces,
-        reads: report.reads,
-        coverage: report.coverage,
-        declaredNeverRead: report.declaredNeverRead,
-        readsAvailable: report.readsAvailable,
-        // §15.3's third check feeds the first. Only variables with a computable
-        // dependent set are carried — unknown count is not a zero, not worth a row.
-        configGraph: {
-            counts: configGraph.data.counts,
-            importsAvailable: configGraph.data.importsAvailable,
-            mostDependedOn: configGraph.data.variables
-                .filter((v) => v.dependents !== null && v.dependents > 0)
-                .slice(0, 10)
-                .map((v) => ({
-                name: v.name,
-                dependents: v.dependents,
-                truncated: v.dependentsTruncated,
-                readAt: v.readAt.slice(0, 3),
-                sample: v.dependentSample,
-            })),
-        },
-        rollback: {
-            findings: rollback.data.findings,
-            findingsTotal: rollback.data.findingsTotal,
-            examined: rollback.data.examined,
-            withheld: rollback.data.withheld,
-            ran: rollback.data.ran,
-            blockers: rollback.data.blockers,
-        },
-        attributeExistence: {
-            findings: attributeExistence.data.findings,
-            findingsTotal: attributeExistence.data.findingsTotal,
-            examined: attributeExistence.data.examined,
-            ran: attributeExistence.data.ran,
-        },
-        migrationIntegrity: {
-            findings: migrationIntegrity.data.findings,
-            findingsTotal: migrationIntegrity.data.findingsTotal,
-            examined: migrationIntegrity.data.examined,
-            migrationsDirectory: migrationIntegrity.data.migrationsDirectory,
-            ran: migrationIntegrity.data.ran,
-            withheld: migrationIntegrity.data.withheld,
-        },
-        ormRegistration: {
-            findings: ormRegistration.data.findings,
-            findingsTotal: ormRegistration.data.findingsTotal,
-            examined: ormRegistration.data.examined,
-            ran: ormRegistration.data.ran,
-            withheld: ormRegistration.data.withheld,
-        },
-        observedRoutes: {
-            findings: observedRoutes.findings,
-            findingsTotal: observedRoutes.findings.length,
-            examined: observedRoutes.examined,
-            ran: observedRoutes.ran,
-        },
-    };
-    return {
-        result: {
-            ...checked,
-            data: validateData,
-            // Every check's disclosures reach the reader — dropping one half silently
-            // is the degradation rule 7 exists to prevent.
-            notes: [
-                ...scopeNotes,
-                ...(observedRoutes.note === null ? [] : [observedRoutes.note]),
-                ...checked.notes,
-                ...rollback.notes,
-                ...attributeExistence.notes,
-                ...migrationIntegrity.notes,
-                ...ormRegistration.notes,
-                ...configGraph.notes,
-            ],
-            truncated,
-            stamp: {
-                ...checked.stamp,
-                resolutionFloor: Math.min(checked.stamp.resolutionFloor, rollback.stamp.resolutionFloor, attributeExistence.stamp.resolutionFloor, migrationIntegrity.stamp.resolutionFloor, ormRegistration.stamp.resolutionFloor, configGraph.stamp.resolutionFloor),
-            },
-        },
-        // §11A.5's canonical name-level fact (exists or not) — the one claim R2 supports
-        // at class A. Value shape is never asserted here.
-        nameLevel: true,
-        fitToBudget: (budgetBytes) => fitValidate(validateData, budgetBytes),
-        ...(truncatedDetail === undefined ? {} : { truncatedDetail }),
-        ...(nothingToCheck
-            ? { state: "refused" }
-            : falseClean
-                ? { state: "empty" }
-                : {}),
-        headline: nothingToCheck
-            ? "No configuration files, environment reads, migrations or attribute reads were found, so " +
-                "there was nothing to check."
-            : falseClean
-                ? `0 of the ${(files ?? []).length} named file(s) matched anything on the read side. Not ` +
-                    "checked, not clean."
-                : `${verdict}. ${report.surfaces.length} configuration file(s) declare ` +
-                    `${countDeclared(report.surfaces)} variable(s); ` +
-                    `${report.reads.required} variable(s) are read through an accessor that fails when unset; ` +
-                    `${rollback.data.examined.operations} destructive migration operation(s) examined; ` +
-                    `${attributeExistence.data.examined.readEdgesExamined} attribute read(s) checked against ` +
-                    `a declared type; ${migrationIntegrity.data.examined.modulesWithRevision} migration(s) ` +
-                    "checked for location and revision-chain integrity; " +
-                    `${ormRegistration.data.examined.candidates} ORM model(s) inheriting a declarative base ` +
-                    "checked for package-import reachability; " +
-                    `${observedRoutes.examined} observed HTTP response(s) checked against declared routes.`,
-    };
-}
-function countDeclared(surfaces) {
-    return surfaces.reduce((total, s) => total + s.declared, 0);
-}
-export const validateTool = {
-    name: "validate",
-    class: "read",
-    tier: "conclusion",
-    // 1.1.0 (C2, UAT phase 4): without "changedLines", NEW_READ_UNDECLARED for a
-    // pre-existing read in a "files"-scoped file is now a `lead`, worded without
-    // an authorship claim, where it used to be a `defect` calling it "a new read
-    // this change introduces" — a claim `files` alone never supported. A caller
-    // that passes "changedLines" gets the stronger `defect` back, now genuinely
-    // verified against an added line rather than assumed from file scope.
-    version: "1.1.0",
-    title: "Environment and configuration checks",
-    description: "Cross-check the environment variables the code requires against the ones this repository " +
-        "declares. Reports a variable only when the code reads it with no fallback and no " +
-        "configuration file declares it, and only when the repository's declaration surface is " +
-        "complete enough for that absence to mean something — a variable supplied by a secrets " +
-        "manager or a platform is disclosed with a count, never reported as missing. Pass \"files\" " +
-        "(the diff you are about to push) to also catch a variable your change reads that no " +
-        "declaration surface declares, regardless of whether the accessor fails on absence — the " +
-        "usual shape on a codebase where almost no read is required; without \"changedLines\" this is " +
-        "reported as a lead, because a file-scoped read cannot yet be told apart from one the diff never " +
-        "touched. Pass \"changedLines\" (from get_git_diff's patch text) to sharpen it to a defect, " +
-        "verified against a line the diff actually added. Also reports variables set in " +
-        "one configuration file and documented in no example file, stated as a lead rather than a " +
-        "defect. Two further checks, both always defects because both are provable from the graph " +
-        "alone: an attribute read on a value whose declared type does not name it (from a READS " +
-        "edge's attrs.unresolvedFields), and a migration whose location or declared parent revision " +
-        "disagrees with the rest of the project's migrations (from attrs.migrationRevision, " +
-        "migrationDownRevision and migrationDir). Both are silent wherever the producer supplied no " +
-        "signal — absence of the attrs key is never read as a clean result. A fifth check reports a " +
-        "class inheriting an ORM declarative base (a MODEL node with an INHERITS edge) whose own " +
-        "module no __init__.py in its package reaches, directly or transitively — the shape behind a " +
-        "model silently missing from Base.metadata and having its table dropped by the next " +
-        "autogenerate. Always a lead, never a defect: an explicit scan/glob registration or a " +
-        "deliberately excluded model triggers it without being a bug.",
-    inputSchema: SCHEMA,
-    run,
-};
-//# sourceMappingURL=validate.js.map