@equipe-tech/observability 0.2.1 → 0.3.5

package/dist/testing/conformance/ConformanceRunner.js

@@ -0,0 +1,198 @@
+import { Effect, Schema } from "effect";
+import { observabilityProfiles, } from "../../profile/ObservabilityProfile.js";
+import { conformanceChecks } from "./ConformanceRegistry.js";
+import { ConformanceFailure, InvalidConformanceSuite } from "./ConformanceFailure.js";
+const ProfileNameSchema = Schema.Literals([
+    "nestjs-api",
+    "worker",
+    "react-web",
+    "cli",
+    "library",
+]);
+const TargetText = Schema.String.check(Schema.isPattern(/\S/));
+const ContractIndexDocument = Schema.Struct({
+    index: Schema.Literal(1),
+    contractVersion: Schema.Int.check(Schema.isGreaterThan(0)),
+    service: TargetText,
+    events: Schema.Array(Schema.Struct({
+        name: TargetText,
+        kind: Schema.Literals(["request", "operation", "domain", "defect", "audit"]),
+        attributes: Schema.Array(TargetText),
+        attributeClassifications: Schema.Array(Schema.Struct({
+            name: TargetText,
+            classification: Schema.Literals(["public", "internal", "sensitive", "forbidden"]),
+        })),
+    })),
+    metrics: Schema.Array(Schema.Struct({
+        name: TargetText,
+        kind: Schema.Literals(["counter", "histogram", "observable_gauge"]),
+        unit: Schema.String,
+        attributes: Schema.Array(TargetText),
+    })),
+    aliases: Schema.Array(Schema.Struct({
+        kind: Schema.Literals(["event", "metric"]),
+        from: TargetText,
+        to: TargetText,
+    })),
+});
+const TargetDocument = Schema.Struct({
+    name: TargetText,
+    profile: ProfileNameSchema,
+    environment: TargetText,
+    topology: Schema.Literals(["local", "deployed"]),
+    capabilities: Schema.Struct({
+        traces: Schema.Boolean,
+        metrics: Schema.Boolean,
+        defects: Schema.Boolean,
+        browserIngest: Schema.Boolean,
+        audit: Schema.Boolean,
+    }),
+    binding: Schema.Struct({
+        identity: Schema.Struct({
+            serviceName: TargetText,
+            serviceVersion: TargetText,
+            environment: TargetText,
+        }),
+        contract: ContractIndexDocument,
+        producerContractProvenance: TargetText,
+    }),
+    providers: Schema.Array(Schema.Struct({
+        id: Schema.Literals(conformanceChecks.map((check) => check.id)),
+        owner: Schema.Literals([
+            "telemetry",
+            "cli",
+            "evlog",
+            "sentry",
+            "nestjs",
+            "react",
+            "application",
+        ]),
+        verify: Schema.instanceOf(Function),
+    })),
+});
+const decodeTarget = Schema.decodeUnknownEffect(TargetDocument);
+const invalidSuite = (code, message, offendingValue, cause) => new InvalidConformanceSuite({ code, message, offendingValue, cause: cause ?? offendingValue });
+const capabilitySelectionIsValid = (requirement, selected, environment) => {
+    if (requirement === "forbidden")
+        return selected === false;
+    if (requirement === "required")
+        return selected;
+    if (requirement === "required-in-production" && environment === "production")
+        return selected;
+    return true;
+};
+const validateTarget = (target) => Effect.gen(function* () {
+    const document = yield* decodeTarget(target).pipe(Effect.mapError((cause) => invalidSuite("OBS_CONFORMANCE_TARGET_INVALID", "The conformance target document is invalid. Supply valid identity, profile, environment, topology, boolean capabilities, and callable evidence providers.", "conformance target", cause)));
+    const profile = observabilityProfiles[document.profile];
+    if (document.environment !== document.binding.identity.environment ||
+        document.binding.contract.service !== document.binding.identity.serviceName) {
+        return yield* invalidSuite("OBS_CONFORMANCE_TARGET_INVALID", "The target environment, resource identity, and contract service must describe one application binding.", `${document.name}:${document.environment}`);
+    }
+    const capabilityRequirements = [
+        ["traces", profile.traces, target.capabilities.traces],
+        ["metrics", profile.metrics, target.capabilities.metrics],
+        ["defects", profile.defects, target.capabilities.defects],
+        ["browserIngest", profile.browserIngest, target.capabilities.browserIngest],
+    ];
+    for (const [capability, requirement, selected] of capabilityRequirements) {
+        if (!capabilitySelectionIsValid(requirement, selected, target.environment)) {
+            return yield* invalidSuite("OBS_CONFORMANCE_TARGET_INVALID", `The ${target.profile} profile declares ${capability} as ${requirement}, but the target selected ${selected}.`, `${capability}=${selected}`);
+        }
+    }
+    const providerIds = new Set();
+    for (const provider of target.providers) {
+        if (providerIds.has(provider.id)) {
+            return yield* invalidSuite("OBS_CONFORMANCE_PROVIDER_DUPLICATE", `The conformance target declares duplicate evidence providers for ${provider.id}.`, provider.id);
+        }
+        providerIds.add(provider.id);
+    }
+    return {
+        name: document.name,
+        profile,
+        environment: document.environment,
+        topology: document.topology,
+        capabilities: document.capabilities,
+        binding: document.binding,
+    };
+});
+const toFailure = (target, check, violation) => new ConformanceFailure({
+    code: check.code,
+    checkId: check.id,
+    profile: target.profile.name,
+    rule: check.rule,
+    message: violation.message,
+    offendingValue: violation.offendingValue,
+    cause: violation.cause ?? violation.offendingValue,
+});
+const runCheck = (target, check, providers) => Effect.gen(function* () {
+    if (!check.applies(target)) {
+        return {
+            status: "not-applicable",
+            id: check.id,
+            profile: target.profile.name,
+            rule: check.rule,
+            reason: check.notApplicableReason(target),
+        };
+    }
+    const provider = providers.find((candidate) => candidate.id === check.id);
+    if (provider === undefined) {
+        return yield* invalidSuite("OBS_CONFORMANCE_PROVIDER_MISSING", `The applicable conformance check ${check.id} has no evidence provider. Supply the owner provider for this target.`, check.id);
+    }
+    return yield* check.run(target, provider).pipe(Effect.match({
+        onFailure: (violation) => ({
+            status: "fail",
+            id: check.id,
+            profile: target.profile.name,
+            rule: check.rule,
+            failure: toFailure(target, check, violation),
+        }),
+        onSuccess: (evidence) => ({
+            status: "pass",
+            id: check.id,
+            profile: target.profile.name,
+            rule: check.rule,
+            evidence,
+        }),
+    }));
+});
+export const runConformance = (target) => Effect.gen(function* () {
+    const context = yield* validateTarget(target);
+    const checks = [];
+    let conforms = true;
+    for (const check of conformanceChecks) {
+        const result = yield* runCheck(context, check, target.providers);
+        if (result.status === "fail")
+            conforms = false;
+        checks.push(result);
+    }
+    return {
+        target: target.name,
+        profile: target.profile,
+        conforms,
+        checks,
+    };
+});
+export const runConformanceSuite = (targets) => Effect.gen(function* () {
+    const documents = yield* Schema.decodeUnknownEffect(Schema.Array(TargetDocument))(targets).pipe(Effect.mapError((cause) => invalidSuite("OBS_CONFORMANCE_TARGET_INVALID", "The conformance suite input is invalid. Supply an array of complete target documents.", "conformance suite", cause)));
+    const seenProfiles = new Map();
+    for (const target of documents) {
+        const previous = seenProfiles.get(target.profile);
+        if (previous !== undefined) {
+            return yield* invalidSuite("OBS_CONFORMANCE_TARGET_INVALID", `The conformance suite declares duplicate targets for profile ${target.profile}: "${previous}" and "${target.name}".`, target.profile);
+        }
+        seenProfiles.set(target.profile, target.name);
+    }
+    const profiles = [];
+    let conforms = true;
+    for (const target of targets) {
+        const report = yield* runConformance(target);
+        if (!report.conforms)
+            conforms = false;
+        profiles.push(report);
+    }
+    return {
+        version: 1,
+        conforms,
+        profiles,
+    };
+});

package/dist/testing/conformance/TelemetryEvidence.d.ts

@@ -0,0 +1,91 @@
+import { Option } from "effect";
+import { type EmitReceipt, type TelemetryContract } from "../../contract/index.js";
+import type { TelemetryContractInput } from "../../contract/TelemetryContract.js";
+type StaticEventNames<Definition extends TelemetryContractInput> = {
+    readonly events: {
+        readonly [Alias in keyof Definition["events"]]: string extends Definition["events"][Alias]["name"] ? never : Definition["events"][Alias];
+    };
+};
+import { CorrelationContext } from "../../Correlation.js";
+import type { DataPolicyInput } from "../../policy/DataPolicy.js";
+import { type ProfileName } from "../../profile/ObservabilityProfile.js";
+import type { LifecycleReport } from "../../profile/ObservabilityAdapter.js";
+import type { AuditPublishReceipt, CommitAuditResult, CommittedAuditRecord } from "../../audit/AuditPublisher.js";
+import type { CapturedTelemetry } from "../index.js";
+import { type ConformanceEvidenceProvider, type ConformanceCheckId, type ConformanceTargetBinding } from "./ConformanceModel.js";
+export declare const conformanceTargetBinding: <Definition extends TelemetryContractInput>(contract: TelemetryContract<Definition>, identity: ConformanceTargetBinding["identity"]) => ConformanceTargetBinding;
+export type ConformanceProvider<Id extends ConformanceCheckId> = ConformanceEvidenceProvider<Id>;
+export declare const profileConformance: (input: {
+    readonly profile: ProfileName;
+    readonly service: {
+        readonly name: string;
+        readonly version: string;
+        readonly environment: string;
+    };
+}) => ConformanceProvider<"profile.official">;
+export declare const identityConformance: (input: {
+    readonly identity: {
+        readonly serviceName: string;
+        readonly serviceVersion: string;
+        readonly environment: string;
+        readonly instance?: Option.Option<string> | undefined;
+    };
+}) => ConformanceProvider<"identity.canonical">;
+export declare const contractConformance: <Definition extends TelemetryContractInput & StaticEventNames<Definition>>(input: {
+    readonly contract: Definition;
+}) => ConformanceProvider<"contract.compiles">;
+export declare const producersConformance: (input: {
+    readonly receipt: EmitReceipt;
+}) => ConformanceProvider<"producers.contract-derived">;
+export declare const correlationConformance: (input: {
+    readonly correlation: CorrelationContext;
+}) => ConformanceProvider<"correlation.canonical">;
+export declare const policyConformance: (input: {
+    readonly policy: DataPolicyInput;
+}) => ConformanceProvider<"policy.compiles">;
+export declare const lifecycleConformance: (input: {
+    readonly report: LifecycleReport;
+}) => ConformanceProvider<"lifecycle.profile-compliant">;
+export declare const libraryLifecycleConformance: (input: {
+    readonly runtimeMarkers: ReadonlyArray<string>;
+}) => ConformanceProvider<"lifecycle.profile-compliant">;
+export declare const auditConformance: (input: {
+    readonly commit?: CommitAuditResult<unknown> | undefined;
+    readonly operationalAction?: string | undefined;
+    readonly operationalRecordId?: string | undefined;
+    readonly operationalRecord?: CommittedAuditRecord | undefined;
+}) => ConformanceProvider<"audit.durable-before-operational">;
+export type TelemetryDestinationReceipt = {
+    readonly topology: "local" | "deployed";
+    readonly assessment: "owner-readback" | "application-supplied-readback";
+    readonly runId: string;
+    readonly identity: ConformanceTargetBinding["identity"];
+    readonly observationId: string;
+};
+type TelemetryDestinationAssessment = {
+    readonly topology: "local" | "deployed";
+    readonly runId: string;
+    readonly identity: ConformanceTargetBinding["identity"];
+    readonly observationId: string;
+    readonly readback: () => CapturedTelemetry;
+};
+export declare const assessTelemetryDestination: (assessment: TelemetryDestinationAssessment) => TelemetryDestinationReceipt;
+export declare const applicationDeployedTelemetryDestinationReceipt: (assessment: {
+    readonly runId: string;
+    readonly identity: ConformanceTargetBinding["identity"];
+    readonly observationId: string;
+    readonly readback: () => CapturedTelemetry;
+}) => TelemetryDestinationReceipt;
+export declare const telemetryDestinationTelemetry: (receipt: TelemetryDestinationReceipt) => CapturedTelemetry | undefined;
+export declare const telemetryDestinationMatches: (receipt: TelemetryDestinationReceipt, topology: "local" | "deployed", runId: string, binding: ConformanceTargetBinding) => boolean;
+export declare const telemetryCanaryConformance: (input: {
+    readonly runId: string;
+    readonly receipt: TelemetryDestinationReceipt;
+    readonly eventRunIdAttribute?: string | undefined;
+    readonly metricRunIdAttribute?: string | undefined;
+}) => ConformanceProvider<"canary.telemetry-destination">;
+export declare const auditCanaryConformance: (input: {
+    readonly ledgerReceiptId: string;
+    readonly publish: AuditPublishReceipt;
+}) => ConformanceProvider<"canary.audit">;
+export {};

package/dist/testing/conformance/TelemetryEvidence.js

@@ -0,0 +1,370 @@
+import { Effect, Exit, Option, Schema } from "effect";
+import { parseResourceIdentity } from "../../ResourceIdentity.js";
+import { contractIndex, defineTelemetryContract, telemetryContractProvenance, } from "../../contract/index.js";
+import { CorrelationContext } from "../../Correlation.js";
+import { parseDataPolicy } from "../../policy/DataPolicy.js";
+import { observabilityProfiles } from "../../profile/ObservabilityProfile.js";
+import { isCommittedAuditRecord } from "../../audit/CommittedAuditRecordInternal.js";
+import { ConformanceViolation, defineConformanceEvidenceProvider, } from "./ConformanceModel.js";
+export const conformanceTargetBinding = (contract, identity) => ({
+    identity,
+    contract: contractIndex(contract, identity.serviceName),
+    producerContractProvenance: telemetryContractProvenance(contract),
+});
+const violation = (message, offendingValue, cause) => new ConformanceViolation({ message, offendingValue, cause: cause ?? offendingValue });
+const officialProfile = (profile) => observabilityProfiles[profile] !== undefined;
+export const profileConformance = (input) => defineConformanceEvidenceProvider({
+    id: "profile.official",
+    owner: "telemetry",
+    verify: (target) => Effect.gen(function* () {
+        if (!officialProfile(input.profile)) {
+            return yield* Effect.fail(violation(`Profile "${input.profile}" is not one of the five official profiles. Select nestjs-api, worker, react-web, cli, or library.`, input.profile));
+        }
+        if (target.profile.name !== input.profile) {
+            return yield* Effect.fail(violation(`The evidence profile ${input.profile} differs from target profile ${target.profile.name}. Use one profile for the complete conformance target.`, `${input.profile} != ${target.profile.name}`));
+        }
+        if (input.service.name !== target.binding.identity.serviceName ||
+            input.service.version !== target.binding.identity.serviceVersion ||
+            input.service.environment !== target.binding.identity.environment) {
+            return yield* Effect.fail(violation("The profile service identity differs from the target binding.", `${input.service.name}@${input.service.version}:${input.service.environment}`));
+        }
+        return {
+            owner: "telemetry",
+            receiptType: "profile-descriptor",
+            receiptId: input.profile,
+            summary: `official profile ${input.profile} for ${input.service.name}`,
+        };
+    }),
+});
+export const identityConformance = (input) => defineConformanceEvidenceProvider({
+    id: "identity.canonical",
+    owner: "telemetry",
+    verify: (target) => Effect.gen(function* () {
+        const identity = yield* parseResourceIdentity(input.identity).pipe(Effect.mapError((cause) => violation(`The canonical resource identity is invalid: ${cause.message}`, `${cause.field}=${cause.value}`, cause)));
+        if (identity.serviceName !== target.binding.identity.serviceName ||
+            identity.serviceVersion !== target.binding.identity.serviceVersion ||
+            identity.environment !== target.binding.identity.environment) {
+            return yield* Effect.fail(violation("The resource identity receipt differs from the target binding. Use the same service name, version, and environment for every provider.", `${identity.serviceName}@${identity.serviceVersion}:${identity.environment}`));
+        }
+        return {
+            owner: "telemetry",
+            receiptType: "resource-identity",
+            receiptId: identity.serviceName,
+            summary: `canonical identity ${identity.serviceName}@${identity.serviceVersion} in ${identity.environment}`,
+        };
+    }),
+});
+export const contractConformance = (input) => defineConformanceEvidenceProvider({
+    id: "contract.compiles",
+    owner: "telemetry",
+    verify: (target) => Effect.gen(function* () {
+        const compiled = yield* Effect.exit(defineTelemetryContract(input.contract));
+        if (!Exit.isSuccess(compiled)) {
+            return yield* Effect.fail(violation("The telemetry contract does not compile. Fix every reported contract issue.", "telemetry contract input", compiled.cause));
+        }
+        const index = contractIndex(compiled.value, target.binding.identity.serviceName);
+        if (JSON.stringify(index) !== JSON.stringify(target.binding.contract) ||
+            telemetryContractProvenance(compiled.value) !== target.binding.producerContractProvenance) {
+            return yield* Effect.fail(violation("The compiled telemetry contract differs from the target contract binding. Derive every provider from the same compiled contract.", `contract v${input.contract.version}`));
+        }
+        const eventCount = Object.keys(input.contract.events).length;
+        const metricCount = Object.keys(input.contract.metrics).length;
+        return {
+            owner: "telemetry",
+            receiptType: "telemetry-contract",
+            receiptId: `v${input.contract.version}`,
+            summary: `contract compiled with ${eventCount} events and ${metricCount} metrics`,
+        };
+    }),
+});
+export const producersConformance = (input) => defineConformanceEvidenceProvider({
+    id: "producers.contract-derived",
+    owner: "telemetry",
+    verify: (target) => Effect.gen(function* () {
+        const eventName = input.receipt.decision === "sampled_out" ? input.receipt.name : input.receipt.event.name;
+        if (input.receipt.contractProvenance !== target.binding.producerContractProvenance ||
+            !target.binding.contract.events.some((event) => event.name === eventName)) {
+            return yield* Effect.fail(violation("The producer receipt does not originate from the complete target contract binding or name one of its events.", eventName));
+        }
+        if (input.receipt.decision === "sampled_out") {
+            return {
+                owner: "telemetry",
+                receiptType: "emit-receipt",
+                receiptId: input.receipt.name,
+                summary: "producer derived from the contract returned a sampled_out receipt",
+            };
+        }
+        return {
+            owner: "telemetry",
+            receiptType: "emit-receipt",
+            receiptId: input.receipt.event.name,
+            summary: `recorded emit with ${input.receipt.redactions.length} policy redactions`,
+        };
+    }),
+});
+export const correlationConformance = (input) => defineConformanceEvidenceProvider({
+    id: "correlation.canonical",
+    owner: "telemetry",
+    verify: () => Effect.gen(function* () {
+        const valid = Schema.is(CorrelationContext)(input.correlation);
+        if (!valid) {
+            return yield* Effect.fail(violation("The correlation context is not a canonical CorrelationContext. Use the typed correlation parsers.", "correlation context"));
+        }
+        const linkage = input.correlation.trace;
+        const correlationId = linkage._tag === "Traced"
+            ? linkage.traceId
+            : (Option.getOrUndefined(input.correlation.runId) ??
+                Option.getOrUndefined(input.correlation.requestId) ??
+                "untraced");
+        return {
+            owner: "telemetry",
+            receiptType: "correlation-context",
+            receiptId: correlationId,
+            summary: `canonical correlation with ${linkage._tag} trace linkage`,
+        };
+    }),
+});
+export const policyConformance = (input) => defineConformanceEvidenceProvider({
+    id: "policy.compiles",
+    owner: "telemetry",
+    verify: () => Effect.gen(function* () {
+        const policy = yield* parseDataPolicy(input.policy).pipe(Effect.mapError((cause) => violation("The data policy does not compile. Fix every reported policy issue.", "data policy input", cause)));
+        return {
+            owner: "telemetry",
+            receiptType: "data-policy",
+            receiptId: `${policy.attributes.size}`,
+            summary: `compiled data policy with ${policy.attributes.size} attribute rules`,
+        };
+    }),
+});
+const failedOutcomes = (report) => report.outcomes
+    .filter((outcome) => outcome.result.kind === "failed" || outcome.result.kind === "deadline-exceeded")
+    .map((outcome) => outcome.participant === "adapter"
+    ? `${outcome.adapter}:${outcome.result.kind}`
+    : `runtime-disposal:${outcome.result.kind}`);
+export const lifecycleConformance = (input) => defineConformanceEvidenceProvider({
+    id: "lifecycle.profile-compliant",
+    owner: "telemetry",
+    verify: () => Effect.gen(function* () {
+        const failed = failedOutcomes(input.report);
+        const disposed = input.report.outcomes.some((outcome) => outcome.participant === "runtime-disposal" && outcome.result.kind === "completed");
+        if (input.report.operation !== "close" || !disposed) {
+            return yield* Effect.fail(violation("Shutdown compliance requires a close receipt with completed runtime disposal. Close the runtime before submitting lifecycle evidence.", input.report.operation));
+        }
+        if (input.report.degraded || failed.length > 0) {
+            return yield* Effect.fail(violation(`The lifecycle report is ${input.report.degraded ? "degraded" : "failed"} for outcomes ${failed.join(", ")}. Close the runtime within the profile deadline.`, failed.join(",") || "degraded lifecycle report"));
+        }
+        return {
+            owner: "telemetry",
+            receiptType: "lifecycle-report",
+            receiptId: input.report.operation,
+            summary: `lifecycle ${input.report.operation} completed in ${input.report.durationMillis}ms`,
+        };
+    }),
+});
+export const libraryLifecycleConformance = (input) => defineConformanceEvidenceProvider({
+    id: "lifecycle.profile-compliant",
+    owner: "telemetry",
+    verify: () => Effect.gen(function* () {
+        if (input.runtimeMarkers.length > 0) {
+            return yield* Effect.fail(violation(`The library profile forbids a global runtime, adapters, exporters, Sentry clients, and browser ingest. Found ${input.runtimeMarkers.join(", ")}.`, input.runtimeMarkers.join(",")));
+        }
+        return {
+            owner: "telemetry",
+            receiptType: "runtime-absence",
+            receiptId: "library",
+            summary: "no global runtime, adapter, exporter, Sentry client, or browser ingest installed",
+        };
+    }),
+});
+export const auditConformance = (input) => defineConformanceEvidenceProvider({
+    id: "audit.durable-before-operational",
+    owner: "telemetry",
+    verify: () => Effect.gen(function* () {
+        if (input.commit === undefined) {
+            return yield* Effect.fail(violation(`The audit action ${input.operationalAction ?? "unknown"} has no durable commit receipt. Call recordAudit with a durable ledger write before the operational copy.`, `audit action ${input.operationalAction ?? "unknown"} has no durable commit receipt`));
+        }
+        if (!isCommittedAuditRecord(input.commit.record) ||
+            input.commit.record !== input.operationalRecord ||
+            input.commit.record.action !== input.operationalAction ||
+            input.commit.record.recordId !== input.operationalRecordId) {
+            return yield* Effect.fail(violation("The durable receipt does not identify the complete requested operational audit record and action. Supply the same owner-produced committed record to both paths.", `${input.operationalRecordId ?? "missing record"}:${input.operationalAction ?? "missing action"}`));
+        }
+        return {
+            owner: "telemetry",
+            receiptType: "commit-audit-result",
+            receiptId: input.commit.record.recordId,
+            summary: "durable ledger receipt precedes the operational audit copy",
+        };
+    }),
+});
+const cloneOption = (value) => Option.isSome(value) ? Option.some(value.value) : Option.none();
+const cloneCapturedTelemetry = (telemetry) => ({
+    spans: telemetry.spans.map((span) => ({
+        ...span,
+        parentSpanId: cloneOption(span.parentSpanId),
+        statusMessage: cloneOption(span.statusMessage),
+        attributes: new Map(span.attributes),
+        events: span.events.map((event) => ({ ...event, attributes: new Map(event.attributes) })),
+        links: span.links.map((link) => ({ ...link, attributes: new Map(link.attributes) })),
+        eventNames: [...span.eventNames],
+        linkedSpanIds: [...span.linkedSpanIds],
+        resourceAttributes: new Map(span.resourceAttributes),
+    })),
+    logs: telemetry.logs.map((log) => ({
+        ...log,
+        traceId: cloneOption(log.traceId),
+        spanId: cloneOption(log.spanId),
+        severityText: cloneOption(log.severityText),
+        body: cloneOption(log.body),
+        attributes: new Map(log.attributes),
+        resourceAttributes: new Map(log.resourceAttributes),
+    })),
+    metrics: telemetry.metrics.map((metric) => {
+        const common = {
+            ...metric,
+            points: metric.points.map((point) => ({
+                ...point,
+                value: cloneOption(point.value),
+                attributes: new Map(point.attributes),
+            })),
+            resourceAttributes: new Map(metric.resourceAttributes),
+        };
+        if (common.kind !== "histogram")
+            return common;
+        return {
+            ...common,
+            histogramPoints: common.histogramPoints.map((point) => ({
+                ...point,
+                attributes: new Map(point.attributes),
+                explicitBounds: [...point.explicitBounds],
+                bucketCounts: [...point.bucketCounts],
+            })),
+        };
+    }),
+});
+const destinationReceipts = new WeakMap();
+export const assessTelemetryDestination = (assessment) => {
+    const receipt = Object.freeze({
+        topology: assessment.topology,
+        assessment: assessment.topology === "local" ? "owner-readback" : "application-supplied-readback",
+        runId: assessment.runId,
+        identity: Object.freeze({
+            serviceName: assessment.identity.serviceName,
+            serviceVersion: assessment.identity.serviceVersion,
+            environment: assessment.identity.environment,
+        }),
+        observationId: assessment.observationId,
+    });
+    destinationReceipts.set(receipt, cloneCapturedTelemetry(assessment.readback()));
+    return receipt;
+};
+export const applicationDeployedTelemetryDestinationReceipt = (assessment) => assessTelemetryDestination({ ...assessment, topology: "deployed" });
+export const telemetryDestinationTelemetry = (receipt) => {
+    const telemetry = destinationReceipts.get(receipt);
+    return telemetry === undefined ? undefined : cloneCapturedTelemetry(telemetry);
+};
+export const telemetryDestinationMatches = (receipt, topology, runId, binding) => destinationReceipts.has(receipt) &&
+    receipt.topology === topology &&
+    receipt.runId === runId &&
+    receipt.identity.serviceName === binding.identity.serviceName &&
+    receipt.identity.serviceVersion === binding.identity.serviceVersion &&
+    receipt.identity.environment === binding.identity.environment;
+const traceGraphIsAcyclic = (spans) => {
+    const spanById = new Map();
+    for (const span of spans) {
+        if (spanById.has(span.spanId))
+            return false;
+        spanById.set(span.spanId, span);
+    }
+    for (const span of spans) {
+        const visited = new Set();
+        let current = span;
+        while (current !== undefined) {
+            if (visited.has(current.spanId))
+                return false;
+            visited.add(current.spanId);
+            current = Option.isSome(current.parentSpanId)
+                ? spanById.get(current.parentSpanId.value)
+                : undefined;
+        }
+    }
+    return true;
+};
+const matchesIdentity = (attributes, binding) => attributes.get("service.name") === binding.identity.serviceName &&
+    attributes.get("service.version") === binding.identity.serviceVersion &&
+    attributes.get("deployment.environment.name") === binding.identity.environment;
+export const telemetryCanaryConformance = (input) => defineConformanceEvidenceProvider({
+    id: "canary.telemetry-destination",
+    owner: "telemetry",
+    verify: (target) => Effect.gen(function* () {
+        const receipt = input.receipt;
+        const telemetry = telemetryDestinationTelemetry(receipt);
+        if (telemetry === undefined ||
+            !telemetryDestinationMatches(receipt, target.topology, input.runId, target.binding)) {
+            return yield* Effect.fail(violation("The telemetry canary lacks a Collector or destination read-back receipt bound to the current topology, run, and resource identity.", receipt?.observationId ?? "exporter capture"));
+        }
+        const eventRunIdAttribute = input.eventRunIdAttribute ?? "run.id";
+        const logs = telemetry.logs.filter((log) => {
+            const event = target.binding.contract.events.find((candidate) => candidate.name === log.attributes.get("event.name"));
+            return (log.attributes.get(eventRunIdAttribute) === receipt.runId &&
+                matchesIdentity(log.resourceAttributes, target.binding) &&
+                event !== undefined &&
+                (eventRunIdAttribute === "run.id" || event.attributes.includes(eventRunIdAttribute)));
+        });
+        const currentTraceIds = new Set(logs.flatMap((log) => (Option.isSome(log.traceId) ? [log.traceId.value] : [])));
+        const spans = telemetry.spans.filter((span) => currentTraceIds.has(span.traceId) &&
+            matchesIdentity(span.resourceAttributes, target.binding));
+        const metricRunIdAttribute = input.metricRunIdAttribute;
+        const metrics = telemetry.metrics.filter((metric) => matchesIdentity(metric.resourceAttributes, target.binding) &&
+            target.binding.contract.metrics.some((entry) => entry.name === metric.name &&
+                metricRunIdAttribute !== undefined &&
+                entry.attributes.includes(metricRunIdAttribute)) &&
+            metricRunIdAttribute !== undefined &&
+            metric.points.some((point) => point.attributes.get(metricRunIdAttribute) === receipt.runId));
+        const linked = logs.some((log) => {
+            if (Option.isNone(log.traceId) || Option.isNone(log.spanId))
+                return false;
+            const traceId = log.traceId.value;
+            const spanId = log.spanId.value;
+            const linkedSpan = spans.find((span) => span.traceId === traceId && span.spanId === spanId);
+            if (linkedSpan === undefined)
+                return false;
+            return spans.some((child) => {
+                if (child.traceId !== traceId || Option.isNone(child.parentSpanId))
+                    return false;
+                const parentSpanId = child.parentSpanId.value;
+                return spans.some((parent) => parent.traceId === traceId &&
+                    parent.spanId === parentSpanId &&
+                    parent.spanId !== child.spanId);
+            });
+        });
+        if (logs.length === 0 ||
+            (target.capabilities.traces &&
+                (spans.length === 0 || !linked || !traceGraphIsAcyclic(spans))) ||
+            (target.capabilities.metrics && metrics.length === 0)) {
+            return yield* Effect.fail(violation("The telemetry canary lacks current-run contract events, selected signals, canonical resources, or trace parentage.", receipt.runId));
+        }
+        return {
+            owner: "telemetry",
+            receiptType: "telemetry-canary",
+            receiptId: receipt.observationId,
+            summary: `captured current-run telemetry with ${logs.length} events, ${spans.length} spans, and ${metrics.length} metrics`,
+        };
+    }),
+});
+export const auditCanaryConformance = (input) => defineConformanceEvidenceProvider({
+    id: "canary.audit",
+    owner: "telemetry",
+    verify: () => Effect.gen(function* () {
+        if (input.publish.kind === "dropped") {
+            return yield* Effect.fail(violation("The audit canary dropped the operational copy. Keep the durable ledger write before publication and retry the canary.", `audit publish dropped: ${input.publish.reason}`));
+        }
+        return {
+            owner: "telemetry",
+            receiptType: "audit-canary",
+            receiptId: input.ledgerReceiptId,
+            summary: `audit canary ${input.publish.kind} with durable ledger receipt`,
+        };
+    }),
+});

package/dist/testing/conformance/index.d.ts

@@ -0,0 +1,10 @@
+export { conformanceChecks } from "./ConformanceRegistry.js";
+export type { ConformanceCheck } from "./ConformanceRegistry.js";
+export { ConformanceAssertionError, ConformanceFailure, InvalidConformanceSuite, conformanceFailureCodes, } from "./ConformanceFailure.js";
+export type { ConformanceFailureCode } from "./ConformanceFailure.js";
+export { assertConformanceFailure, assertConforms } from "./ConformanceAssertions.js";
+export { runConformance, runConformanceSuite } from "./ConformanceRunner.js";
+export { ConformanceViolation, defineConformanceEvidenceProvider } from "./ConformanceModel.js";
+export type { ConformanceCapabilitySelection, ConformanceCheckId, ConformanceEvidence, ConformanceEvidenceProvider, ConformanceFail, ConformanceNotApplicable, ConformanceOwner, ConformancePass, ConformanceProfileReport, ConformanceReport, ConformanceResult, ConformanceTarget, ConformanceTargetBinding, ConformanceTargetContext, ConformanceTopology, SourceRuleReference, } from "./ConformanceModel.js";
+export { applicationDeployedTelemetryDestinationReceipt, auditCanaryConformance, auditConformance, contractConformance, conformanceTargetBinding, correlationConformance, identityConformance, libraryLifecycleConformance, lifecycleConformance, policyConformance, producersConformance, profileConformance, telemetryCanaryConformance, telemetryDestinationMatches, telemetryDestinationTelemetry, } from "./TelemetryEvidence.js";
+export type { TelemetryDestinationReceipt } from "./TelemetryEvidence.js";