@descryy/mcp 0.11.5 → 0.11.7

package/dist/module-trust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-trust.js","sourceRoot":"","sources":["../src/module-trust.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAEhC,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEnD,MAAM,CAAC,MAAM,0BAA0B,GAAG,mCAAmC,CAAC;AAC9E,MAAM,CAAC,MAAM,kCAAkC,GAAG,mCAAmC,CAAC;AAItF,mNAAmN;AACnN,MAAM,UAAU,mBAAmB,CAAC,SAAiB;IACnD,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrG,IAAI,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,2BAA2B,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,oBAA4B;IAC/E,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,GAAG,EAAE,CAAC;IACrE,OAAO,oBAAoB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,kBAAkB;IACzB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;IACtD,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,MAAM,CAAC;AAC3C,CAAC;AAED,oKAAoK;AACpK,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC9D,IAAI,kBAAkB,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACnD,OAAO;QACL,OAAO,EAAE,KAAK;QACd,MAAM,EACJ,IAAI,SAAS,oFAAoF;YACjG,uGAAuG;YACvG,qGAAqG;YACrG,yCAAyC,0BAA0B,sCAAsC;YACzG,wFAAwF;KAC3F,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB;IAChC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;IAC9D,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,MAAM,CAAC;AAC3C,CAAC;AAED,kYAAkY;AAClY,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,OAIlD;IACC,IAAI,yBAAyB,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAE1D,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACzF,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAE/C,OAAO;QACL,OAAO,EAAE,KAAK;QACd,MAAM,EACJ,IAAI,OAAO,CAAC,SAAS,iBAAiB,OAAO,CAAC,oBAAoB,YAAY,OAAO,CAAC,QAAQ,SAAS;YACvG,qGAAqG;YACrG,8FAA8F;YAC9F,sGAAsG;YACtG,gEAAgE,kCAAkC,KAAK;YACvG,kGAAkG;YAClG,wCAAwC;KAC3C,CAAC;AACJ,CAAC"}

package/dist/path-confinement.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Confines a caller-named path to a set of roots, with a disclosed, operator-set
+ * escape hatch (A-F6). Generalizes two `observe-runtime.ts` call sites with no such
+ * check: `evidencePath` (relative joined onto repo root with no re-check — `..`
+ * escaped it) and `attach.logFilePath` (read in full every poll, unchecked). */
+export type PathConfinementDecision = {
+    readonly allowed: true;
+    readonly resolved: string;
+} | {
+    readonly allowed: false;
+    readonly reason: string;
+};
+export interface PathConfinementOptions {
+    /** The path as configured, absolute or relative. Relative is resolved against `process.cwd()` — callers that mean "relative to the repo" must join it themselves before calling this. */
+    readonly candidate: string;
+    /** Confined when the resolved candidate is under any of these. */
+    readonly allowedRoots: readonly string[];
+    /** Set to `"1"` or `"true"` in this server's own environment to bypass confinement. */
+    readonly envVar: string;
+    /** What the value is, for the refusal message — e.g. `"evidencePath"`. */
+    readonly what: string;
+}
+export declare function checkPathConfinement(options: PathConfinementOptions): PathConfinementDecision;
+export type SensitivePathDecision = {
+    readonly sensitive: false;
+} | {
+    readonly sensitive: true;
+    readonly reason: string;
+};
+export declare function checkNotSensitivePath(candidate: string, envVar: string): SensitivePathDecision;
+//# sourceMappingURL=path-confinement.d.ts.map

package/dist/path-confinement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-confinement.d.ts","sourceRoot":"","sources":["../src/path-confinement.ts"],"names":[],"mappings":"AAAA;;;;gFAIgF;AAIhF,MAAM,MAAM,uBAAuB,GAC/B;IAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAOzD,MAAM,WAAW,sBAAsB;IACrC,yLAAyL;IACzL,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,kEAAkE;IAClE,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,uFAAuF;IACvF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,sBAAsB,GAAG,uBAAuB,CAe7F;AAQD,MAAM,MAAM,qBAAqB,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1H,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,qBAAqB,CAY9F"}

package/dist/path-confinement.js

@@ -0,0 +1,44 @@
+/**
+ * Confines a caller-named path to a set of roots, with a disclosed, operator-set
+ * escape hatch (A-F6). Generalizes two `observe-runtime.ts` call sites with no such
+ * check: `evidencePath` (relative joined onto repo root with no re-check — `..`
+ * escaped it) and `attach.logFilePath` (read in full every poll, unchecked). */
+import { resolve, sep } from "node:path";
+function isWithin(resolvedCandidate, root) {
+    const resolvedRoot = resolve(root);
+    return resolvedCandidate === resolvedRoot || resolvedCandidate.startsWith(resolvedRoot + sep);
+}
+export function checkPathConfinement(options) {
+    const resolved = resolve(options.candidate);
+    if (options.allowedRoots.some((root) => isWithin(resolved, root))) {
+        return { allowed: true, resolved };
+    }
+    if (process.env[options.envVar] === "1" || process.env[options.envVar] === "true") {
+        return { allowed: true, resolved };
+    }
+    return {
+        allowed: false,
+        reason: `"${options.candidate}" (${options.what}) resolves to ${resolved}, outside ` +
+            `${options.allowedRoots.length === 1 ? "" : "every one of "}${options.allowedRoots.join(", ")}. ` +
+            `Refused by default; set ${options.envVar}=1 in this server's own environment to allow it.`,
+    };
+}
+/** Name-based blocklist for logFilePath (can't root-confine — logs live anywhere),
+ *  narrowed to the exploit's shape (`~/.ssh/id_rsa`). NOT primary defence: `redact()`
+ *  unconditionally scans every byte first — this only stops the read itself. */
+const SENSITIVE_PATH_SEGMENT = /(^|[/\\])(\.ssh|\.aws|\.gnupg|\.kube|\.netrc|\.npmrc|\.git-credentials|\.pgpass|shadow|id_rsa|id_dsa|id_ecdsa|id_ed25519|\.env(\..+)?|[^/\\]+\.pem|[^/\\]+\.key)($|[/\\])/i;
+export function checkNotSensitivePath(candidate, envVar) {
+    const resolved = resolve(candidate);
+    if (!SENSITIVE_PATH_SEGMENT.test(resolved))
+        return { sensitive: false };
+    if (process.env[envVar] === "1" || process.env[envVar] === "true")
+        return { sensitive: false };
+    return {
+        sensitive: true,
+        reason: `"${candidate}" names a file shape that is never an application log (an SSH/cloud/credential ` +
+            `location) — refusing to read it as one. This is a narrow, name-based check, not a guarantee that ` +
+            `every sensitive path is caught; set ${envVar}=1 in this server's own environment if this path ` +
+            "genuinely is your application's log.",
+    };
+}
+//# sourceMappingURL=path-confinement.js.map

package/dist/path-confinement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-confinement.js","sourceRoot":"","sources":["../src/path-confinement.ts"],"names":[],"mappings":"AAAA;;;;gFAIgF;AAEhF,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAMzC,SAAS,QAAQ,CAAC,iBAAyB,EAAE,IAAY;IACvD,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO,iBAAiB,KAAK,YAAY,IAAI,iBAAiB,CAAC,UAAU,CAAC,YAAY,GAAG,GAAG,CAAC,CAAC;AAChG,CAAC;AAaD,MAAM,UAAU,oBAAoB,CAAC,OAA+B;IAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QAClE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACrC,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;QAClF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACrC,CAAC;IACD,OAAO;QACL,OAAO,EAAE,KAAK;QACd,MAAM,EACJ,IAAI,OAAO,CAAC,SAAS,MAAM,OAAO,CAAC,IAAI,iBAAiB,QAAQ,YAAY;YAC5E,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACjG,2BAA2B,OAAO,CAAC,MAAM,kDAAkD;KAC9F,CAAC;AACJ,CAAC;AAED;;gFAEgF;AAChF,MAAM,sBAAsB,GAC1B,4KAA4K,CAAC;AAI/K,MAAM,UAAU,qBAAqB,CAAC,SAAiB,EAAE,MAAc;IACrE,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACpC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACxE,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC/F,OAAO;QACL,SAAS,EAAE,IAAI;QACf,MAAM,EACJ,IAAI,SAAS,iFAAiF;YAC9F,mGAAmG;YACnG,uCAAuC,MAAM,mDAAmD;YAChG,sCAAsC;KACzC,CAAC;AACJ,CAAC"}

package/dist/planner/predict-then-propose.d.ts

@@ -0,0 +1,134 @@
+/**
+ * RG-10's second half, joined to its first: predict, then propose — never
+ * predict, then drive. `documents/plans/runtime-gap-closure.md`'s Lane C3.
+ *
+ * The predict half is `reachablePages` (`@descryy/core`): a one-sided
+ * forward walk from any node — typically a `DATABASE_COLUMN` a diff touches
+ * — over `PROPAGATES_TO`/`READS`/`ASSIGNS`/`RETURNS`, crossing `USES_API`
+ * backward at an `API_ENDPOINT`, to whatever `PAGE`/`COMPONENT` the data can
+ * reach. That traversal already existed (Gap 8 step 3) and is untouched
+ * here.
+ *
+ * The propose half reuses lane journey's planner (`./propose-journey.ts`)
+ * exactly as `propose_journey` itself does — same function, same "propose,
+ * never invent" discipline, same navigate-only limitation (the graph has no
+ * selector, so a `PAGE` reached through the walk becomes a navigate step
+ * only when its own qualified name looks like a route path; everything
+ * else is `reachedNotProposed`, not guessed into a click). This module
+ * builds no second planner and no second projection — it is the join, not
+ * a third implementation.
+ *
+ * **This module never drives anything and never writes to a `Finding`.**
+ * Proving or disproving what it predicts is: a human (or an agent acting on
+ * a human's behalf) reviews the proposal, drives the application for real
+ * (`browser_start_session`, the browser primitives, `browser_save_scenario`
+ * to commit what actually happened), and records the outcome against the
+ * finding that predicted it — a step this module does not take, because
+ * `packages/ir/src/finding.ts` and the finding funnel are outside this
+ * lane's owned files. See the `predict_reach` tool's own description for
+ * where that handoff is named to a caller.
+ *
+ * ## `proveOrDisprove` — the join, added by the pipeline-joins lane (RG-10, §5 Lane C3)
+ *
+ * Still never drives anything. It takes evidence a caller *already*
+ * collected by driving an accepted scenario for real — `browser_run_scenario`'s
+ * own `graph: BrowserGraphWrite` (or, in a live pipeline run, the same
+ * `graphNodeId`-correlated evidence `descry-desktop`'s runtime execution
+ * already produces) — and compares it against what {@link predictThenPropose}
+ * predicted. `ObservedReach` is declared structurally, not imported from
+ * `../browser/*`, so this module (and every caller of it, including
+ * `descry-desktop`'s pipeline) takes no dependency on the browser package;
+ * a real `BrowserGraphWrite`'s resolved node ids structurally satisfy it
+ * without a cast.
+ *
+ * **Both directions are real answers, not just the confirming one.** A
+ * predicted page absent from `observed.visitedNodeIds` after the declared
+ * journey ran to completion is a disproof — the propagation this module
+ * predicted did not show up where the graph said it would — and rule 6/7
+ * require that to be as visible as a proof, never silently dropped in favour
+ * of the cases that confirmed the prediction.
+ */
+import { type AdjacencyProvider } from "@descryy/core";
+import { type JourneyCandidateNode, type JourneyPathHop, type ProposedJourney } from "./propose-journey.ts";
+export interface PredictThenProposeOptions {
+    readonly targetUrl: string;
+    readonly name: string;
+    readonly savedAtCommit: string;
+}
+export interface PredictedReach {
+    /** Every PAGE/COMPONENT node the walk reached, in the order it found them. */
+    readonly reachedPages: readonly JourneyCandidateNode[];
+    /** Null iff `reachedPages` is empty — nothing to propose a journey toward. */
+    readonly proposal: ProposedJourney | null;
+    readonly notes: readonly string[];
+}
+/**
+ * Walks from `startNodeId` to whatever pages the data can reach, and — when
+ * it reaches at least one — proposes a navigate-only journey to them via
+ * the shared planner. Pure over `provider`: no browser, no write, no I/O.
+ */
+export declare function predictThenPropose(provider: AdjacencyProvider, startNodeId: string, options: PredictThenProposeOptions): PredictedReach;
+/**
+ * What a caller already observed by driving an accepted journey for real —
+ * never produced by this module. Structural: a real `BrowserGraphWrite`
+ * (`browser_run_scenario`'s own reply) or a live run's `graphNodeId`-
+ * correlated evidence both satisfy this without a cast; see this module's
+ * header.
+ */
+export interface ObservedReach {
+    /** Graph node ids the real, already-driven journey's evidence actually correlated to. */
+    readonly visitedNodeIds: readonly string[];
+}
+/** One predicted page, resolved against what really happened. */
+export interface ProvenReach {
+    /** Predicted pages the real drive's own evidence shows were actually reached. */
+    readonly proven: readonly JourneyCandidateNode[];
+    /**
+     * Predicted pages the declared journey ran to completion without ever
+     * reaching. A real disproof — not "not yet checked" (that's simply the
+     * absence of an `ObservedReach` at all) — see this module's header for why
+     * this is recorded with the same weight as `proven`.
+     */
+    readonly disproven: readonly JourneyCandidateNode[];
+}
+/**
+ * The join itself: never drives, only compares. `predicted.reachedPages`
+ * partitions cleanly into `proven`/`disproven` against `observed.visitedNodeIds`
+ * — every predicted page lands in exactly one, so a caller can never read a
+ * prediction as "not checked" once it has a real `ObservedReach` in hand.
+ */
+export declare function proveOrDisprove(predicted: PredictedReach, observed: ObservedReach): ProvenReach;
+/** One real edge, in the shape `@descryy/ir`'s `GraphPathHop` needs — never invented, only
+ *  ever a copy of a hop `reachablePages` actually walked (see `queries.ts`'s `ReachPathHop`). */
+export type PredictedPathHop = JourneyPathHop;
+/**
+ * `prove_reach`'s join into the finding funnel: the real path from `startNodeId` to whichever
+ * predicted pages a caller names (typically the ones a real drive proved), deduplicated by
+ * (from, to, edgeType) and ordered by first appearance. Pure — no I/O, no re-traversal; it only
+ * reassembles the `path` each `JourneyCandidateNode` already carries from `predictThenPropose`.
+ *
+ * Union, not intersection or average: rule 2 says omit an edge you are unsure of, not omit one
+ * two pages happen to share — every hop named here is a real edge on at least one named page's
+ * real path, and `minimumResolution` (the caller's next step) already takes the conservative
+ * floor across all of them.
+ */
+export declare function combinedGraphPath(predicted: PredictedReach, pageIds: readonly string[]): readonly PredictedPathHop[];
+/** One proposed navigate step, resolved against how it actually replayed — structural, the same
+ *  reasoning as `ObservedReach`: a real `ScenarioStepResult` (`browser/scenario-runner.ts`)
+ *  already satisfies this without a cast, so this module still takes no dependency on the
+ *  browser package (see this module's header). */
+export interface ReplayedStep {
+    readonly url: string;
+    readonly status: "ran" | "unresolved" | "skipped";
+}
+/**
+ * Which predicted pages a real drive of the proposed scenario actually navigated to —
+ * `prove_reach`'s own `ObservedReach.visitedNodeIds`, built without guessing: a page counts as
+ * visited only when a step whose `url` is byte-identical to the exact navigate URL
+ * `proposeJourney` built FROM that page's own route name came back `"ran"`. A step that never
+ * resolved (the app was down, the route 404'd before the browser could navigate) does not count
+ * — reaching a URL and having the navigation actually run are the same fact here, and this
+ * never inflates "predicted" into "visited" for a step that did not.
+ */
+export declare function visitedPageIds(predicted: PredictedReach, targetUrl: string, steps: readonly ReplayedStep[]): readonly string[];
+//# sourceMappingURL=predict-then-propose.d.ts.map

package/dist/planner/predict-then-propose.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"predict-then-propose.d.ts","sourceRoot":"","sources":["../../src/planner/predict-then-propose.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,EAAkB,KAAK,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEvE,OAAO,EAAkB,KAAK,oBAAoB,EAAE,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAE5H,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,cAAc;IAC7B,8EAA8E;IAC9E,QAAQ,CAAC,YAAY,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACvD,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,yBAAyB,GACjC,cAAc,CAmBhB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,yFAAyF;IACzF,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAED,iEAAiE;AACjE,MAAM,WAAW,WAAW;IAC1B,iFAAiF;IACjF,QAAQ,CAAC,MAAM,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACjD;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACrD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,aAAa,GAAG,WAAW,CAQ/F;AAED;iGACiG;AACjG,MAAM,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAE9C;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,gBAAgB,EAAE,CAcpH;AAED;;;kDAGkD;AAClD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,YAAY,GAAG,SAAS,CAAC;CACnD;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,MAAM,EAAE,CAQ9H"}

package/dist/planner/predict-then-propose.js

@@ -0,0 +1,138 @@
+/**
+ * RG-10's second half, joined to its first: predict, then propose — never
+ * predict, then drive. `documents/plans/runtime-gap-closure.md`'s Lane C3.
+ *
+ * The predict half is `reachablePages` (`@descryy/core`): a one-sided
+ * forward walk from any node — typically a `DATABASE_COLUMN` a diff touches
+ * — over `PROPAGATES_TO`/`READS`/`ASSIGNS`/`RETURNS`, crossing `USES_API`
+ * backward at an `API_ENDPOINT`, to whatever `PAGE`/`COMPONENT` the data can
+ * reach. That traversal already existed (Gap 8 step 3) and is untouched
+ * here.
+ *
+ * The propose half reuses lane journey's planner (`./propose-journey.ts`)
+ * exactly as `propose_journey` itself does — same function, same "propose,
+ * never invent" discipline, same navigate-only limitation (the graph has no
+ * selector, so a `PAGE` reached through the walk becomes a navigate step
+ * only when its own qualified name looks like a route path; everything
+ * else is `reachedNotProposed`, not guessed into a click). This module
+ * builds no second planner and no second projection — it is the join, not
+ * a third implementation.
+ *
+ * **This module never drives anything and never writes to a `Finding`.**
+ * Proving or disproving what it predicts is: a human (or an agent acting on
+ * a human's behalf) reviews the proposal, drives the application for real
+ * (`browser_start_session`, the browser primitives, `browser_save_scenario`
+ * to commit what actually happened), and records the outcome against the
+ * finding that predicted it — a step this module does not take, because
+ * `packages/ir/src/finding.ts` and the finding funnel are outside this
+ * lane's owned files. See the `predict_reach` tool's own description for
+ * where that handoff is named to a caller.
+ *
+ * ## `proveOrDisprove` — the join, added by the pipeline-joins lane (RG-10, §5 Lane C3)
+ *
+ * Still never drives anything. It takes evidence a caller *already*
+ * collected by driving an accepted scenario for real — `browser_run_scenario`'s
+ * own `graph: BrowserGraphWrite` (or, in a live pipeline run, the same
+ * `graphNodeId`-correlated evidence `descry-desktop`'s runtime execution
+ * already produces) — and compares it against what {@link predictThenPropose}
+ * predicted. `ObservedReach` is declared structurally, not imported from
+ * `../browser/*`, so this module (and every caller of it, including
+ * `descry-desktop`'s pipeline) takes no dependency on the browser package;
+ * a real `BrowserGraphWrite`'s resolved node ids structurally satisfy it
+ * without a cast.
+ *
+ * **Both directions are real answers, not just the confirming one.** A
+ * predicted page absent from `observed.visitedNodeIds` after the declared
+ * journey ran to completion is a disproof — the propagation this module
+ * predicted did not show up where the graph said it would — and rule 6/7
+ * require that to be as visible as a proof, never silently dropped in favour
+ * of the cases that confirmed the prediction.
+ */
+import { reachablePages } from "@descryy/core";
+import { proposeJourney } from "./propose-journey.js";
+/**
+ * Walks from `startNodeId` to whatever pages the data can reach, and — when
+ * it reaches at least one — proposes a navigate-only journey to them via
+ * the shared planner. Pure over `provider`: no browser, no write, no I/O.
+ */
+export function predictThenPropose(provider, startNodeId, options) {
+    const reach = reachablePages(provider, startNodeId);
+    // `reachablePages` already restricts itself to PAGE/COMPONENT nodes (see
+    // its own doc); no re-filtering needed here. `path` — the real edge chain
+    // this walk used to reach this node — is carried through so a later caller
+    // (`prove_reach`) can build a real `graphPath` from it, never a guessed one.
+    const reachedPages = reach.data.map((r) => ({
+        id: r.node.id,
+        type: r.node.type,
+        name: r.node.name,
+        path: r.path,
+    }));
+    if (reachedPages.length === 0) {
+        return { reachedPages: [], proposal: null, notes: reach.notes };
+    }
+    const proposal = proposeJourney(reachedPages, options);
+    return { reachedPages, proposal, notes: [...reach.notes, ...proposal.notes] };
+}
+/**
+ * The join itself: never drives, only compares. `predicted.reachedPages`
+ * partitions cleanly into `proven`/`disproven` against `observed.visitedNodeIds`
+ * — every predicted page lands in exactly one, so a caller can never read a
+ * prediction as "not checked" once it has a real `ObservedReach` in hand.
+ */
+export function proveOrDisprove(predicted, observed) {
+    const visited = new Set(observed.visitedNodeIds);
+    const proven = [];
+    const disproven = [];
+    for (const page of predicted.reachedPages) {
+        (visited.has(page.id) ? proven : disproven).push(page);
+    }
+    return { proven, disproven };
+}
+/**
+ * `prove_reach`'s join into the finding funnel: the real path from `startNodeId` to whichever
+ * predicted pages a caller names (typically the ones a real drive proved), deduplicated by
+ * (from, to, edgeType) and ordered by first appearance. Pure — no I/O, no re-traversal; it only
+ * reassembles the `path` each `JourneyCandidateNode` already carries from `predictThenPropose`.
+ *
+ * Union, not intersection or average: rule 2 says omit an edge you are unsure of, not omit one
+ * two pages happen to share — every hop named here is a real edge on at least one named page's
+ * real path, and `minimumResolution` (the caller's next step) already takes the conservative
+ * floor across all of them.
+ */
+export function combinedGraphPath(predicted, pageIds) {
+    const wanted = new Set(pageIds);
+    const seen = new Set();
+    const hops = [];
+    for (const page of predicted.reachedPages) {
+        if (!wanted.has(page.id) || page.path === undefined)
+            continue;
+        for (const hop of page.path) {
+            const key = `${hop.from}::${hop.to}::${hop.edgeType}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            hops.push(hop);
+        }
+    }
+    return hops;
+}
+/**
+ * Which predicted pages a real drive of the proposed scenario actually navigated to —
+ * `prove_reach`'s own `ObservedReach.visitedNodeIds`, built without guessing: a page counts as
+ * visited only when a step whose `url` is byte-identical to the exact navigate URL
+ * `proposeJourney` built FROM that page's own route name came back `"ran"`. A step that never
+ * resolved (the app was down, the route 404'd before the browser could navigate) does not count
+ * — reaching a URL and having the navigation actually run are the same fact here, and this
+ * never inflates "predicted" into "visited" for a step that did not.
+ */
+export function visitedPageIds(predicted, targetUrl, steps) {
+    const base = targetUrl.endsWith("/") ? targetUrl.slice(0, -1) : targetUrl;
+    const ranUrls = new Set(steps.filter((s) => s.status === "ran").map((s) => s.url));
+    const visited = [];
+    for (const page of predicted.reachedPages) {
+        if (ranUrls.has(`${base}${page.name}`))
+            visited.push(page.id);
+    }
+    return visited;
+}
+//# sourceMappingURL=predict-then-propose.js.map

package/dist/planner/predict-then-propose.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"predict-then-propose.js","sourceRoot":"","sources":["../../src/planner/predict-then-propose.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,EAAE,cAAc,EAA0B,MAAM,eAAe,CAAC;AAEvE,OAAO,EAAE,cAAc,EAAwE,MAAM,sBAAsB,CAAC;AAgB5H;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAA2B,EAC3B,WAAmB,EACnB,OAAkC;IAElC,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACpD,yEAAyE;IACzE,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,MAAM,YAAY,GAA2B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE;QACb,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI;QACjB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI;QACjB,IAAI,EAAE,CAAC,CAAC,IAAI;KACb,CAAC,CAAC,CAAC;IAEJ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IAClE,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACvD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAChF,CAAC;AA2BD;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,SAAyB,EAAE,QAAuB;IAChF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IACjD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC/B,CAAC;AAMD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAyB,EAAE,OAA0B;IACrF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAuB,EAAE,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,SAAS;QAC9D,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;YACtD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAWD;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,SAAyB,EAAE,SAAiB,EAAE,KAA8B;IACzG,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACnF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC;QAC1C,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/planner/propose-journey.d.ts

@@ -0,0 +1,75 @@
+/**
+ * The planner — proposes, never invents. Lane A1, item 5 of
+ * `documents/plans/runtime-gap-closure.md`, closing the rest of RG-1.
+ *
+ * ## What this is and is not
+ *
+ * Takes the `PAGE`/`COMPONENT` nodes a diff-scope traversal already found
+ * (the same `scopeChange` the `scope` tool calls — this module receives its
+ * output, it does not recompute it) and turns them into a **proposed**
+ * `Scenario` — a value returned to the caller, never written to disk. Rule 1
+ * ("never fabricate input") is the whole shape of this module: the code
+ * graph has no DOM. It can name a route a `PAGE` node's own qualified path
+ * spells out; it has no selector, no accessible name, no evidence a button
+ * exists at all. So the proposal is **navigate-only** — one step per
+ * page-shaped route the scope touched — and every `COMPONENT` node (and
+ * every `PAGE` node with no path-shaped name to navigate to) is listed as
+ * *reached but not exercised*, disclosed rather than guessed into a `click`
+ * step this module cannot back with a real selector.
+ *
+ * ## Why this can never execute anything
+ *
+ * The only way a `Scenario` becomes replayable is `writeScenario`
+ * (`scenarios/storage.ts`), and the only caller in this codebase that calls
+ * it is `browser_save_scenario` — which requires a **live, already-driven
+ * browser session** and independently verifies every step actually
+ * resolves before it writes anything (`collectUnresolvedTargets`). This
+ * module never imports `writeScenario` and never touches a browser session.
+ * A proposal from here is data in a tool reply; nothing runs until a human
+ * (or an agent acting on a human's behalf) drives the app for real and
+ * calls `browser_save_scenario` — the acceptance act — which is what
+ * produces the one artifact (`descry/scenarios/*.scenario.json`) that
+ * `browser_run_scenario` can replay. See `propose-journey.test.ts`'s
+ * "nothing executes without an acceptance record" case.
+ */
+import type { EdgeType, ResolutionLevel } from "@descryy/ir";
+import { type Scenario } from "../scenarios/index.ts";
+/** One real, stored edge — see `@descryy/core`'s `ReachPathHop` (same shape, this planner takes
+ *  no dependency on that package's query layer to declare it). Field-compatible with
+ *  `@descryy/ir`'s `GraphPathHop` too, so a real array of these already satisfies it without a cast. */
+export interface JourneyPathHop {
+    readonly from: string;
+    readonly to: string;
+    readonly edgeType: EdgeType;
+    readonly resolution: ResolutionLevel;
+}
+export interface JourneyCandidateNode {
+    readonly id: string;
+    readonly type: string;
+    readonly name: string;
+    /** The real edge chain `reachablePages` walked to reach this node, when the caller has one
+     *  (`predictThenPropose` sets it; a plain diff-scope caller of this planner does not). Optional
+     *  so this planner's own, unrelated callers are unaffected — it is never read here, only
+     *  carried through for `prove_reach`'s join into the finding funnel. */
+    readonly path?: readonly JourneyPathHop[];
+}
+export interface ProposedJourney {
+    /** A `Scenario`-shaped proposal. `assertions` is always empty: this module has no evidence to assert against, and inventing one would be a confident false claim about a page it never observed. */
+    readonly scenario: Scenario;
+    /** `PAGE` nodes in scope whose name did not look like a navigable path, and every `COMPONENT` node — real graph hits, listed rather than guessed into a step. */
+    readonly reachedNotProposed: readonly JourneyCandidateNode[];
+    readonly notes: readonly string[];
+}
+/**
+ * Builds a proposed journey from the `PAGE`/`COMPONENT` nodes a diff scope
+ * already found. `nodes` is typically `[...scoped.changed, ...scoped.affected]`
+ * mapped to their graph node — the caller (the MCP tool) owns fetching that;
+ * this function is pure over the result so it is exhaustively testable
+ * without a graph.
+ */
+export declare function proposeJourney(nodes: readonly JourneyCandidateNode[], options: {
+    readonly targetUrl: string;
+    readonly name: string;
+    readonly savedAtCommit: string;
+}): ProposedJourney;
+//# sourceMappingURL=propose-journey.d.ts.map

package/dist/planner/propose-journey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"propose-journey.d.ts","sourceRoot":"","sources":["../../src/planner/propose-journey.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE7D,OAAO,EAA2B,KAAK,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAE/E;;wGAEwG;AACxG,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;CACtC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;4EAGwE;IACxE,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,eAAe;IAC9B,oMAAoM;IACpM,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,iKAAiK;IACjK,QAAQ,CAAC,kBAAkB,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC7D,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAOD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,SAAS,oBAAoB,EAAE,EACtC,OAAO,EAAE;IACP,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC,GACA,eAAe,CAwDjB"}

package/dist/planner/propose-journey.js

@@ -0,0 +1,96 @@
+/**
+ * The planner — proposes, never invents. Lane A1, item 5 of
+ * `documents/plans/runtime-gap-closure.md`, closing the rest of RG-1.
+ *
+ * ## What this is and is not
+ *
+ * Takes the `PAGE`/`COMPONENT` nodes a diff-scope traversal already found
+ * (the same `scopeChange` the `scope` tool calls — this module receives its
+ * output, it does not recompute it) and turns them into a **proposed**
+ * `Scenario` — a value returned to the caller, never written to disk. Rule 1
+ * ("never fabricate input") is the whole shape of this module: the code
+ * graph has no DOM. It can name a route a `PAGE` node's own qualified path
+ * spells out; it has no selector, no accessible name, no evidence a button
+ * exists at all. So the proposal is **navigate-only** — one step per
+ * page-shaped route the scope touched — and every `COMPONENT` node (and
+ * every `PAGE` node with no path-shaped name to navigate to) is listed as
+ * *reached but not exercised*, disclosed rather than guessed into a `click`
+ * step this module cannot back with a real selector.
+ *
+ * ## Why this can never execute anything
+ *
+ * The only way a `Scenario` becomes replayable is `writeScenario`
+ * (`scenarios/storage.ts`), and the only caller in this codebase that calls
+ * it is `browser_save_scenario` — which requires a **live, already-driven
+ * browser session** and independently verifies every step actually
+ * resolves before it writes anything (`collectUnresolvedTargets`). This
+ * module never imports `writeScenario` and never touches a browser session.
+ * A proposal from here is data in a tool reply; nothing runs until a human
+ * (or an agent acting on a human's behalf) drives the app for real and
+ * calls `browser_save_scenario` — the acceptance act — which is what
+ * produces the one artifact (`descry/scenarios/*.scenario.json`) that
+ * `browser_run_scenario` can replay. See `propose-journey.test.ts`'s
+ * "nothing executes without an acceptance record" case.
+ */
+import { SCENARIO_SCHEMA_VERSION } from "../scenarios/index.js";
+/** A qualified symbol name that looks like a route path: starts with `/`, single line, no whitespace. Deliberately conservative — false negatives (a real route this misses) fall through to `reachedNotProposed`, which is the safe direction (rule 2: when in doubt, omit). */
+function looksLikeRoutePath(name) {
+    return name.startsWith("/") && !/\s/.test(name) && !name.includes("\n");
+}
+/**
+ * Builds a proposed journey from the `PAGE`/`COMPONENT` nodes a diff scope
+ * already found. `nodes` is typically `[...scoped.changed, ...scoped.affected]`
+ * mapped to their graph node — the caller (the MCP tool) owns fetching that;
+ * this function is pure over the result so it is exhaustively testable
+ * without a graph.
+ */
+export function proposeJourney(nodes, options) {
+    const pages = nodes.filter((n) => n.type === "PAGE");
+    const components = nodes.filter((n) => n.type === "COMPONENT");
+    const routable = [];
+    const unroutable = [];
+    for (const page of pages)
+        (looksLikeRoutePath(page.name) ? routable : unroutable).push(page);
+    const base = options.targetUrl.endsWith("/") ? options.targetUrl.slice(0, -1) : options.targetUrl;
+    // Deduplicated and ordered — two PAGE nodes for the same route (a layout
+    // and a leaf, say) must not become two identical navigate steps.
+    const seenPaths = new Set();
+    const steps = [];
+    for (const page of routable) {
+        if (seenPaths.has(page.name))
+            continue;
+        seenPaths.add(page.name);
+        steps.push({ action: "navigate", url: `${base}${page.name}`, target: null, text: null });
+    }
+    const notes = [];
+    if (steps.length === 0) {
+        notes.push("No node in scope named a path-shaped route, so this proposal has no steps to offer. This is not a " +
+            "claim that nothing changed — it is a claim that nothing in scope looked like a navigable page from " +
+            "the graph alone. A human exploring the application directly (browser_start_session, then " +
+            "browser_save_scenario) is how a real journey gets declared from here.");
+    }
+    notes.push("Every step here is navigate-only: the code graph has no selector, no accessible name and no evidence " +
+        "an element exists, so this proposal never invents a click, a type or a submit. A human who accepts " +
+        "this proposal drives the rest of the journey for real and saves it with browser_save_scenario — that " +
+        "save is what turns a proposal into something replayable, and this module never calls it itself.");
+    if (unroutable.length + components.length > 0) {
+        notes.push(`${unroutable.length + components.length} node(s) in scope (${unroutable.length} page(s) with no ` +
+            `path-shaped name, ${components.length} component(s)) are reached but not proposed as a step — listed ` +
+            "in reachedNotProposed rather than guessed into one.");
+    }
+    return {
+        scenario: {
+            schemaVersion: SCENARIO_SCHEMA_VERSION,
+            name: options.name,
+            description: "Proposed by the planner from a diff scope's PAGE nodes — not accepted, not saved, not runnable until a human reviews it.",
+            targetUrl: steps[0]?.url ?? options.targetUrl,
+            savedAt: new Date().toISOString(),
+            savedAtCommit: options.savedAtCommit,
+            steps,
+            assertions: [],
+        },
+        reachedNotProposed: [...unroutable, ...components],
+        notes,
+    };
+}
+//# sourceMappingURL=propose-journey.js.map

package/dist/planner/propose-journey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"propose-journey.js","sourceRoot":"","sources":["../../src/planner/propose-journey.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAIH,OAAO,EAAE,uBAAuB,EAAiB,MAAM,uBAAuB,CAAC;AA+B/E,iRAAiR;AACjR,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,KAAsC,EACtC,OAIC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;IAE/D,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE7F,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAClG,yEAAyE;IACzE,iEAAiE;IACjE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,KAAK,GAAgC,EAAE,CAAC;IAC9C,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACvC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CACR,oGAAoG;YAClG,qGAAqG;YACrG,2FAA2F;YAC3F,uEAAuE,CAC1E,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CACR,uGAAuG;QACrG,qGAAqG;QACrG,uGAAuG;QACvG,iGAAiG,CACpG,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,KAAK,CAAC,IAAI,CACR,GAAG,UAAU,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,sBAAsB,UAAU,CAAC,MAAM,mBAAmB;YAChG,qBAAqB,UAAU,CAAC,MAAM,iEAAiE;YACvG,qDAAqD,CACxD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ,EAAE;YACR,aAAa,EAAE,uBAAuB;YACtC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,WAAW,EAAE,0HAA0H;YACvI,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,OAAO,CAAC,SAAS;YAC7C,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACjC,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,KAAK;YACL,UAAU,EAAE,EAAE;SACf;QACD,kBAAkB,EAAE,CAAC,GAAG,UAAU,EAAE,GAAG,UAAU,CAAC;QAClD,KAAK;KACN,CAAC;AACJ,CAAC"}

package/dist/protocol.d.ts

@@ -0,0 +1,57 @@
+/**
+ * JSON-RPC 2.0 + the MCP slice this server speaks — hand-written, not the SDK:
+ * v1.30.0 pulls 17 deps, nearly all for HTTP/OAuth transports this stdio-only
+ * server never opens (same call as `node:sqlite`, `node --test`, `tsc` elsewhere).
+ * Spec-drift risk is mitigated by a pinned `PROTOCOL_VERSION` and exact-frame tests. */
+/** JSON-RPC 2.0 ids: string or number, never null in a request. */
+export type RpcId = string | number;
+export interface RpcRequest {
+    readonly jsonrpc: "2.0";
+    readonly id: RpcId;
+    readonly method: string;
+    readonly params?: Record<string, unknown>;
+}
+export interface RpcNotification {
+    readonly jsonrpc: "2.0";
+    readonly method: string;
+    readonly params?: Record<string, unknown>;
+}
+export interface RpcError {
+    readonly code: number;
+    readonly message: string;
+    readonly data?: unknown;
+}
+export interface RpcResponse {
+    readonly jsonrpc: "2.0";
+    readonly id: RpcId;
+    readonly result?: unknown;
+    readonly error?: RpcError;
+}
+export type RpcMessage = RpcRequest | RpcNotification;
+/** Standard JSON-RPC codes. MCP adds none of its own at this layer. */
+export declare const RPC_PARSE_ERROR = -32700;
+export declare const RPC_INVALID_REQUEST = -32600;
+export declare const RPC_METHOD_NOT_FOUND = -32601;
+export declare const RPC_INVALID_PARAMS = -32602;
+export declare const RPC_INTERNAL_ERROR = -32603;
+/** The version this server implements. Negotiation echoes the client's version if
+ *  it's on `SUPPORTED_PROTOCOL_VERSIONS`, else answers with this — never claims
+ *  compatibility with an unchecked client version. */
+export declare const PROTOCOL_VERSION = "2025-06-18";
+export declare const SUPPORTED_PROTOCOL_VERSIONS: readonly string[];
+export declare function negotiateVersion(requested: unknown): string;
+/** A frame that couldn't be understood well enough to answer. Distinct from a
+ *  merely-wrong request — JSON-RPC says a message with no usable id gets no
+ *  response; replying with a fabricated id would be uncorrelatable. */
+export declare class ProtocolError extends Error {
+    readonly code: number;
+    /** Null when the frame carried no usable id and must therefore go unanswered. */
+    readonly id: RpcId | null;
+    constructor(code: number, message: string, id: RpcId | null);
+}
+/** Parse one line into a request or notification, or throw `ProtocolError`. */
+export declare function parseMessage(line: string): RpcMessage;
+export declare function isRequest(message: RpcMessage): message is RpcRequest;
+export declare function ok(id: RpcId, result: unknown): RpcResponse;
+export declare function fail(id: RpcId, code: number, message: string, data?: unknown): RpcResponse;
+//# sourceMappingURL=protocol.d.ts.map

package/dist/protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAAA;;;;wFAIwF;AAExF,mEAAmE;AACnE,MAAM,MAAM,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;AAEpC,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;CAC3B;AAED,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,eAAe,CAAC;AAEtD,uEAAuE;AACvE,eAAO,MAAM,eAAe,SAAS,CAAC;AACtC,eAAO,MAAM,mBAAmB,SAAS,CAAC;AAC1C,eAAO,MAAM,oBAAoB,SAAS,CAAC;AAC3C,eAAO,MAAM,kBAAkB,SAAS,CAAC;AACzC,eAAO,MAAM,kBAAkB,SAAS,CAAC;AAEzC;;sDAEsD;AACtD,eAAO,MAAM,gBAAgB,eAAe,CAAC;AAC7C,eAAO,MAAM,2BAA2B,EAAE,SAAS,MAAM,EAIxD,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,CAI3D;AAED;;uEAEuE;AACvE,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,QAAQ,CAAC,EAAE,EAAE,KAAK,GAAG,IAAI,CAAC;gBAEd,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,GAAG,IAAI;CAM5D;AAMD,+EAA+E;AAC/E,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAsCrD;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,IAAI,UAAU,CAEpE;AAED,wBAAgB,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,GAAG,WAAW,CAE1D;AAED,wBAAgB,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,WAAW,CAM1F"}