@gate-forge/core 0.7.1 → 0.8.0

package/dist/schemas/runtime-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-config.d.ts","sourceRoot":"","sources":["../../src/schemas/runtime-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAMnE;AAUD,kEAAkE;AAClE,eAAO,MAAM,wBAAwB,yBAAyB,CAAC;AAE/D,sEAAsE;AACtE,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAE7D,8DAA8D;AAC9D,eAAO,MAAM,+BAA+B,MAAM,CAAC;AAEnD,kEAAkE;AAClE,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAEhD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;;kBAgB/B,CAAC;AAEL,gCAAgC;AAChC,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;kBA0B7B,CAAC;AAEL,8BAA8B;AAC9B,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;kBAiD5B,CAAC;AAEL,uCAAuC;AACvC,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}
+{"version":3,"file":"runtime-config.d.ts","sourceRoot":"","sources":["../../src/schemas/runtime-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAMnE;AAUD,kEAAkE;AAClE,eAAO,MAAM,wBAAwB,yBAAyB,CAAC;AAE/D,sEAAsE;AACtE,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAE7D,8DAA8D;AAC9D,eAAO,MAAM,+BAA+B,MAAM,CAAC;AAEnD,kEAAkE;AAClE,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAEhD;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB;;;;kBASlB,CAAC;AAEZ,kCAAkC;AAClC,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,6EAA6E;AAC7E,eAAO,MAAM,mCAAmC,MAAM,CAAC;AAEvD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,aAK5B,CAAC;AAGL;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;;kBAgB/B,CAAC;AAEL,gCAAgC;AAChC,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;kBA0B7B,CAAC;AAEL,8BAA8B;AAC9B,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA4F5B,CAAC;AAEL,uCAAuC;AACvC,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/schemas/runtime-config.js

@@ -47,6 +47,35 @@ export const SERVICE_URL_PLACEHOLDER = '${service:<id>:url}';
 export const DEFAULT_PREPARE_TIMEOUT_SECONDS = 600;
 /** Default budget for one service readiness probe, in seconds. */
 export const DEFAULT_READY_TIMEOUT_SECONDS = 60;
+/**
+ * One managed-run recipe step (managed-run plan (2026-09-29), Part B): the app-owned
+ * lifecycle command Gateforge sequences for `gateforge run`. Commands
+ * are argv lists (never a shell string), each step carries its own
+ * timeout, and a step may be retried a bounded number of times.
+ */
+export const RecipeStepSchema = z
+    .object({
+    /** Commands to run in order; the first non-zero exit fails the step. */
+    commands: z.array(z.array(z.string().min(1)).min(1)).min(1),
+    /** Wall-clock budget for the whole step (default 600s). */
+    timeoutSeconds: z.number().int().min(1).max(3600).optional(),
+    /** Extra attempts after the first failure (0 = run once, the default). */
+    retries: z.number().int().min(0).max(10).optional(),
+})
+    .strict();
+/** Default wall-clock budget for one managed-run recipe step, in seconds. */
+export const DEFAULT_RECIPE_STEP_TIMEOUT_SECONDS = 600;
+/**
+ * Environment file a recipe may load, as a PATH only. An entry carrying
+ * a value (`NAME=value`) is rejected: the recipe never holds secret
+ * material, and `gateforge run` never prints the values it loads.
+ */
+export const RecipeEnvFileSchema = z
+    .string()
+    .min(1)
+    .refine((value) => !value.includes('='), {
+    message: 'env_files entries are paths only — put the secret in the file, never inline',
+});
 /**
  * One service readiness probe: a log line matching `log` (regex source
  * over the captured stdout+stderr) OR an `http` GET returning 2xx.
@@ -122,6 +151,16 @@ export const RuntimeConfigSchema = z
         .object({
         /** Command to run in the checkout (package-manager install, build). */
         command: z.string().min(1).optional(),
+        /**
+         * Managed-run preparation commands (managed-run plan (2026-09-29), Part B):
+         * argv lists `gateforge run` executes before the recipe
+         * lifecycle. Absent = no preparation step.
+         */
+        commands: z.array(z.array(z.string().min(1)).min(1)).min(1).optional(),
+        /** Wall-clock budget for `gateforge run`'s preparation step. */
+        runTimeoutSeconds: z.number().int().min(1).max(3600).optional(),
+        /** Extra attempts of the preparation step after a failure. */
+        runRetries: z.number().int().min(0).max(10).optional(),
         /**
          * Repo-relative dependency directories explicitly allowed to be
          * reused from the user repository (linked, never copied as
@@ -129,12 +168,47 @@ export const RuntimeConfigSchema = z
          */
         reuse: z.array(RuntimeReusePathSchema).optional(),
         timeoutSeconds: z.number().int().min(1).max(3600).optional(),
+        preflight: z.array(z.object({
+            name: z.string().min(1),
+            command: z.string().min(1),
+            timeoutSeconds: z.number().int().min(1).max(3600).optional(),
+        }).strict()).optional(),
     })
         .strict()
         .optional(),
+    health: z.array(z.object({
+        name: z.string().min(1),
+        tcp: z.string().min(1).optional(),
+        http: z.string().url().optional(),
+        command: z.string().min(1).optional(),
+        logAbsent: z.object({
+            command: z.string().min(1),
+            pattern: z.string().min(1),
+        }).strict().optional(),
+        tls: z.boolean().optional(),
+        timeoutSeconds: z.number().int().min(1).max(3600).optional(),
+    }).strict().superRefine((probe, ctx) => {
+        const kinds = [probe.tcp !== undefined, probe.http !== undefined, probe.command !== undefined, probe.logAbsent !== undefined].filter(Boolean).length;
+        if (kinds !== 1)
+            ctx.addIssue({ code: 'custom', path: ['tcp'], message: "health requires exactly one of 'tcp', 'http', 'command', or 'logAbsent'" });
+        if (probe.tls === true && probe.http === undefined)
+            ctx.addIssue({ code: 'custom', path: ['tls'], message: "'tls' requires an 'http' health probe" });
+    })).optional(),
+    /** Managed-run lifecycle: start the candidate's own services. */
+    services_up: RecipeStepSchema.optional(),
+    /** Managed-run lifecycle: stop those services (always the last step). */
+    services_down: RecipeStepSchema.optional(),
+    /** Managed-run lifecycle: reset the database/state under test. */
+    reset: RecipeStepSchema.optional(),
+    /** Managed-run lifecycle: seed the fixture the suite expects. */
+    seed: RecipeStepSchema.optional(),
+    /** Managed-run lifecycle: readiness probe for the started services. */
+    healthcheck: RecipeStepSchema.optional(),
+    /** Environment files the recipe loads, as paths only (no values). */
+    env_files: z.array(RecipeEnvFileSchema).optional(),
     /** Candidate-owned services to start, probe, and clean up. */
     services: z.array(RuntimeServiceSchema).optional(),
-    /** Operator environment variable names allowed through to commands/services. */
+    /** Operator environment names allowed through to commands, services and supervised tests. */
     envAllowlist: z.array(z.string().min(1)).optional(),
     /** Whole-run execution budget handed to the supervised gate. */
     executionTimeoutSeconds: z.number().int().min(1).max(3600).optional(),

package/dist/schemas/runtime-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-config.js","sourceRoot":"","sources":["../../src/schemas/runtime-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAAa;IACxD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrF,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpE,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1G,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC;AACtC,CAAC;AAED,6EAA6E;AAC7E,MAAM,sBAAsB,GAAG,CAAC;KAC7B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,MAAM,CAAC,4BAA4B,EAAE;IACpC,OAAO,EAAE,4EAA4E;CACtF,CAAC,CAAC;AAEL,kEAAkE;AAClE,MAAM,CAAC,MAAM,wBAAwB,GAAG,sBAAsB,CAAC;AAE/D,sEAAsE;AACtE,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAE7D,8DAA8D;AAC9D,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAG,CAAC;AAEnD,kEAAkE;AAClE,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CAC7D,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IACzF,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,KAAK,CAAC;YACb,OAAO,EAAE,gFAAgF;SAC1F,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAKL;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE,yCAAyC,CAAC;IACpF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9B,KAAK,EAAE,sBAAsB;CAC9B,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC5B,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACnE,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EAAE,qBAAqB,OAAO,CAAC,EAAE,0EAA0E;SACnH,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QACzD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,QAAQ,CAAC;YAChB,OAAO,EAAE,YAAY,OAAO,CAAC,EAAE,4EAA4E;SAC5G,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAKL;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,aAAa,EAAE,kBAAkB;IACjC,uEAAuE;IACvE,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,uEAAuE;QACvE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACrC;;;;WAIG;QACH,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,QAAQ,EAAE;QACjD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;KAC7D,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;IACb,8DAA8D;IAC9D,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAClD,gFAAgF;IAChF,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnD,gEAAgE;IAChE,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CACtE,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,OAAO,KAAK,SAAS;YAAE,SAAS;QACpC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC;gBAC/B,OAAO,EAAE,yBAAyB,OAAO,CAAC,EAAE,4CAA4C;aACzF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,OAAO,EAAE,kDAAkD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG;SACrF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC"}
+{"version":3,"file":"runtime-config.js","sourceRoot":"","sources":["../../src/schemas/runtime-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAAa;IACxD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrF,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpE,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1G,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC;AACtC,CAAC;AAED,6EAA6E;AAC7E,MAAM,sBAAsB,GAAG,CAAC;KAC7B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,MAAM,CAAC,4BAA4B,EAAE;IACpC,OAAO,EAAE,4EAA4E;CACtF,CAAC,CAAC;AAEL,kEAAkE;AAClE,MAAM,CAAC,MAAM,wBAAwB,GAAG,sBAAsB,CAAC;AAE/D,sEAAsE;AACtE,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAE7D,8DAA8D;AAC9D,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAG,CAAC;AAEnD,kEAAkE;AAClE,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEhD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,wEAAwE;IACxE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,2DAA2D;IAC3D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC5D,0EAA0E;IAC1E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ,6EAA6E;AAC7E,MAAM,CAAC,MAAM,mCAAmC,GAAG,GAAG,CAAC;AAEvD;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;IACvC,OAAO,EAAE,6EAA6E;CACvF,CAAC,CAAC;AAGL;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CAC7D,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IACzF,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,KAAK,CAAC;YACb,OAAO,EAAE,gFAAgF;SAC1F,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAKL;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE,yCAAyC,CAAC;IACpF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9B,KAAK,EAAE,sBAAsB;CAC9B,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC5B,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACnE,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EAAE,qBAAqB,OAAO,CAAC,EAAE,0EAA0E;SACnH,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QACzD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,QAAQ,CAAC;YAChB,OAAO,EAAE,YAAY,OAAO,CAAC,EAAE,4EAA4E;SAC5G,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAKL;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,aAAa,EAAE,kBAAkB;IACjC,uEAAuE;IACvE,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,uEAAuE;QACvE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACrC;;;;WAIG;QACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACtE,gEAAgE;QAChE,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;QAC/D,8DAA8D;QAC9D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;QACtD;;;;WAIG;QACH,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,QAAQ,EAAE;QACjD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;QAC5D,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;YAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;SAC7D,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KACxB,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;IACb,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACjC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACjC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACrC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;YAClB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;SAC3B,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACtB,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC3B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;KAC7D,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QACrJ,IAAI,KAAK,KAAK,CAAC;YAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,yEAAyE,EAAE,CAAC,CAAC;QACrJ,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;YAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAC;IACxJ,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACd,iEAAiE;IACjE,WAAW,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IACxC,yEAAyE;IACzE,aAAa,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IAC1C,kEAAkE;IAClE,KAAK,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IAClC,iEAAiE;IACjE,IAAI,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IACjC,uEAAuE;IACvE,WAAW,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IACxC,qEAAqE;IACrE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;IAClD,8DAA8D;IAC9D,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAClD,6FAA6F;IAC7F,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnD,gEAAgE;IAChE,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CACtE,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,OAAO,KAAK,SAAS;YAAE,SAAS;QACpC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC;gBAC/B,OAAO,EAAE,yBAAyB,OAAO,CAAC,EAAE,4CAA4C;aACzF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,OAAO,EAAE,kDAAkD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG;SACrF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/schemas/signature-profile.d.ts

@@ -0,0 +1,99 @@
+/**
+ * Engine-side signature profiles for behavior cases (plan 2026-09-25
+ * Phase 1): the ONE grammar a `signatureProfile` string may use, parsed
+ * and validated identically by the config schema (fail fast, at config
+ * time) and by the witness-owned request driver (fail closed, at run
+ * time).
+ *
+ * Grammar (a media-type style name plus bounded parameters):
+ *
+ *   hmac-sha256
+ *   hmac-sha256;header=x-hub-signature-256
+ *   hmac-sha256;timestampHeader=x-webhook-timestamp;toleranceMs=300000
+ *   hmac-sha256;attemptHeader=x-webhook-attempt;attempt=2
+ *   hmac-sha256;forgery=signature
+ *
+ * Why a string and not a nested object: the case action travels from
+ * the compiled catalog into the witness, and `signatureProfile` is the
+ * single declared key that channel already carries. The profile names
+ * what the ENGINE does with a secret it holds — never what a suite
+ * claims. A suite cannot ask for a signature it made up: the profile
+ * can only select a header name, a timestamp window, an attempt
+ * counter, or ask the engine to perform a signature forgery itself.
+ *
+ * Trust invariants (unchanged by this grammar):
+ * - the secret is read from the trusted lease's actor material and
+ *   never leaves the witness process;
+ * - the signature is computed over the EXACT bytes the driver sends,
+ *   never over a re-serialization;
+ * - a `forgery` is performed by the engine, deterministically, and
+ *   never reveals the secret.
+ */
+/** Signature algorithms a profile may name. */
+export declare const BEHAVIOR_SIGNATURE_ALGORITHMS: readonly ["hmac-sha256"];
+/** Inferred signature algorithm name. */
+export type BehaviorSignatureAlgorithm = (typeof BEHAVIOR_SIGNATURE_ALGORITHMS)[number];
+/**
+ * The deterministic forgeries the engine may perform itself.
+ *
+ * Only the SIGNATURE side: the engine binds the submitted bytes to the
+ * declared fixture, so a body the engine altered after signing is not
+ * evidence of anything (the grader refuses it outright). A forged
+ * signature is the honest negative case — the body the receiver verifies
+ * is exactly the body the owner declared.
+ */
+export declare const BEHAVIOR_SIGNATURE_FORGERIES: readonly ["none", "signature"];
+/** Inferred forgery name. */
+export type BehaviorSignatureForgery = (typeof BEHAVIOR_SIGNATURE_FORGERIES)[number];
+/**
+ * The engine-only carrier of a webhook signing secret inside a trusted
+ * lease's actor material. It is consumed here, never forwarded as a
+ * request header.
+ */
+export declare const BEHAVIOR_SIGNING_SECRET_HEADER = "x-gateforge-signing-secret";
+/** Default signature header the profiles stamp. */
+export declare const DEFAULT_SIGNATURE_HEADER = "x-signature";
+/** Default timestamp header the `hmac-sha256` profile stamps. */
+export declare const DEFAULT_SIGNATURE_TIMESTAMP_HEADER = "x-webhook-timestamp";
+/** Default attempt header the `hmac-sha256` profile stamps. */
+export declare const DEFAULT_SIGNATURE_ATTEMPT_HEADER = "x-webhook-attempt";
+/** A parsed, validated signature profile. */
+export interface BehaviorSignatureProfile {
+    /** The signing algorithm over the exact request bytes. */
+    algorithm: BehaviorSignatureAlgorithm;
+    /** Header carrying the hex digest. */
+    header: string;
+    /** Header carrying the engine's timestamp, or null when unstamped. */
+    timestampHeader: string | null;
+    /** Tolerance the engine requires of its own stamp, in ms. */
+    toleranceMs: number | null;
+    /** Header carrying the delivery attempt number, or null when absent. */
+    attemptHeader: string | null;
+    /** The attempt number the engine stamps (1 when no header). */
+    attempt: number;
+    /** The forgery the engine performs, or `none`. */
+    forgery: BehaviorSignatureForgery;
+}
+/** A parsed profile or the exact reason it was refused. */
+export type SignatureProfileResult = {
+    ok: true;
+    profile: BehaviorSignatureProfile;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Parses one `signatureProfile` string into a validated profile.
+ *
+ * Args:
+ *   text (string): the declared profile, name plus optional
+ *     `;key=value` parameters.
+ *
+ * Returns:
+ *   SignatureProfileResult: the profile, or the reason it was refused.
+ *   An unknown algorithm, an unknown parameter, a malformed value, or a
+ *   reserved header name never yields a default — the caller fails
+ *   closed.
+ */
+export declare function parseBehaviorSignatureProfile(text: string): SignatureProfileResult;
+//# sourceMappingURL=signature-profile.d.ts.map

package/dist/schemas/signature-profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature-profile.d.ts","sourceRoot":"","sources":["../../src/schemas/signature-profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,+CAA+C;AAC/C,eAAO,MAAM,6BAA6B,0BAA2B,CAAC;AAEtE,yCAAyC;AACzC,MAAM,MAAM,0BAA0B,GAAG,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAC;AAExF;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,gCAAiC,CAAC;AAE3E,6BAA6B;AAC7B,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,4BAA4B,CAAC,CAAC,MAAM,CAAC,CAAC;AAErF;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,+BAA+B,CAAC;AAE3E,mDAAmD;AACnD,eAAO,MAAM,wBAAwB,gBAAgB,CAAC;AAEtD,iEAAiE;AACjE,eAAO,MAAM,kCAAkC,wBAAwB,CAAC;AAExE,+DAA+D;AAC/D,eAAO,MAAM,gCAAgC,sBAAsB,CAAC;AAKpE,6CAA6C;AAC7C,MAAM,WAAW,wBAAwB;IACvC,0DAA0D;IAC1D,SAAS,EAAE,0BAA0B,CAAC;IACtC,sCAAsC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,6DAA6D;IAC7D,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,wEAAwE;IACxE,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,OAAO,EAAE,wBAAwB,CAAC;CACnC;AAqBD,2DAA2D;AAC3D,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,wBAAwB,CAAA;CAAE,GAC/C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC;;;;;;;;;;;;GAYG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,GAAG,sBAAsB,CAkFlF"}

package/dist/schemas/signature-profile.js

@@ -0,0 +1,197 @@
+/**
+ * Engine-side signature profiles for behavior cases (plan 2026-09-25
+ * Phase 1): the ONE grammar a `signatureProfile` string may use, parsed
+ * and validated identically by the config schema (fail fast, at config
+ * time) and by the witness-owned request driver (fail closed, at run
+ * time).
+ *
+ * Grammar (a media-type style name plus bounded parameters):
+ *
+ *   hmac-sha256
+ *   hmac-sha256;header=x-hub-signature-256
+ *   hmac-sha256;timestampHeader=x-webhook-timestamp;toleranceMs=300000
+ *   hmac-sha256;attemptHeader=x-webhook-attempt;attempt=2
+ *   hmac-sha256;forgery=signature
+ *
+ * Why a string and not a nested object: the case action travels from
+ * the compiled catalog into the witness, and `signatureProfile` is the
+ * single declared key that channel already carries. The profile names
+ * what the ENGINE does with a secret it holds — never what a suite
+ * claims. A suite cannot ask for a signature it made up: the profile
+ * can only select a header name, a timestamp window, an attempt
+ * counter, or ask the engine to perform a signature forgery itself.
+ *
+ * Trust invariants (unchanged by this grammar):
+ * - the secret is read from the trusted lease's actor material and
+ *   never leaves the witness process;
+ * - the signature is computed over the EXACT bytes the driver sends,
+ *   never over a re-serialization;
+ * - a `forgery` is performed by the engine, deterministically, and
+ *   never reveals the secret.
+ */
+/** Signature algorithms a profile may name. */
+export const BEHAVIOR_SIGNATURE_ALGORITHMS = ['hmac-sha256'];
+/**
+ * The deterministic forgeries the engine may perform itself.
+ *
+ * Only the SIGNATURE side: the engine binds the submitted bytes to the
+ * declared fixture, so a body the engine altered after signing is not
+ * evidence of anything (the grader refuses it outright). A forged
+ * signature is the honest negative case — the body the receiver verifies
+ * is exactly the body the owner declared.
+ */
+export const BEHAVIOR_SIGNATURE_FORGERIES = ['none', 'signature'];
+/**
+ * The engine-only carrier of a webhook signing secret inside a trusted
+ * lease's actor material. It is consumed here, never forwarded as a
+ * request header.
+ */
+export const BEHAVIOR_SIGNING_SECRET_HEADER = 'x-gateforge-signing-secret';
+/** Default signature header the profiles stamp. */
+export const DEFAULT_SIGNATURE_HEADER = 'x-signature';
+/** Default timestamp header the `hmac-sha256` profile stamps. */
+export const DEFAULT_SIGNATURE_TIMESTAMP_HEADER = 'x-webhook-timestamp';
+/** Default attempt header the `hmac-sha256` profile stamps. */
+export const DEFAULT_SIGNATURE_ATTEMPT_HEADER = 'x-webhook-attempt';
+/** Header names the engine refuses to sign with or send. */
+const FORBIDDEN_HEADERS = new Set([BEHAVIOR_SIGNING_SECRET_HEADER]);
+/** One profile parameter the grammar accepts. */
+const PARAMETER_NAMES = new Set([
+    'header',
+    'timestampHeader',
+    'toleranceMs',
+    'attemptHeader',
+    'attempt',
+    'forgery',
+]);
+/** Upper bound on a declared clock tolerance (24 h). */
+const MAX_TOLERANCE_MS = 86_400_000;
+/** Upper bound on a declared attempt number. */
+const MAX_ATTEMPT = 1000;
+/** Header-name grammar (RFC 7230 token, deliberately narrow). */
+const HEADER_NAME = /^[A-Za-z0-9][A-Za-z0-9-]{0,63}$/;
+/**
+ * Parses one `signatureProfile` string into a validated profile.
+ *
+ * Args:
+ *   text (string): the declared profile, name plus optional
+ *     `;key=value` parameters.
+ *
+ * Returns:
+ *   SignatureProfileResult: the profile, or the reason it was refused.
+ *   An unknown algorithm, an unknown parameter, a malformed value, or a
+ *   reserved header name never yields a default — the caller fails
+ *   closed.
+ */
+export function parseBehaviorSignatureProfile(text) {
+    const parts = text.split(';');
+    const name = (parts[0] ?? '').trim();
+    if (BEHAVIOR_SIGNATURE_ALGORITHMS.includes(name) === false) {
+        return {
+            ok: false,
+            error: `unsupported signature profile '${name}' — supported: ` +
+                `${BEHAVIOR_SIGNATURE_ALGORITHMS.join(', ')} (with optional ;key=value parameters ` +
+                `${[...PARAMETER_NAMES].sort().join(', ')})`,
+        };
+    }
+    const profile = {
+        algorithm: name,
+        header: DEFAULT_SIGNATURE_HEADER,
+        timestampHeader: DEFAULT_SIGNATURE_TIMESTAMP_HEADER,
+        toleranceMs: null,
+        attemptHeader: DEFAULT_SIGNATURE_ATTEMPT_HEADER,
+        attempt: 1,
+        forgery: 'none',
+    };
+    const seen = new Set();
+    for (const part of parts.slice(1)) {
+        if (part.trim().length === 0)
+            continue;
+        const separator = part.indexOf('=');
+        if (separator < 0)
+            return { ok: false, error: `signature profile parameter '${part}' must be key=value` };
+        const key = part.slice(0, separator).trim();
+        const value = part.slice(separator + 1).trim();
+        if (PARAMETER_NAMES.has(key) === false) {
+            return { ok: false, error: `unknown signature profile parameter '${key}'` };
+        }
+        if (seen.has(key))
+            return { ok: false, error: `duplicate signature profile parameter '${key}'` };
+        seen.add(key);
+        if (key === 'header') {
+            const header = headerError(value);
+            if (header !== null)
+                return { ok: false, error: header };
+            profile.header = value;
+            continue;
+        }
+        if (key === 'timestampHeader') {
+            if (value === 'none') {
+                profile.timestampHeader = null;
+                continue;
+            }
+            const header = headerError(value);
+            if (header !== null)
+                return { ok: false, error: header };
+            profile.timestampHeader = value;
+            continue;
+        }
+        if (key === 'attemptHeader') {
+            if (value === 'none') {
+                profile.attemptHeader = null;
+                continue;
+            }
+            const header = headerError(value);
+            if (header !== null)
+                return { ok: false, error: header };
+            profile.attemptHeader = value;
+            continue;
+        }
+        if (key === 'toleranceMs') {
+            const parsed = integerError(value, 0, MAX_TOLERANCE_MS);
+            if (parsed !== null)
+                return { ok: false, error: `signature profile toleranceMs: ${parsed}` };
+            profile.toleranceMs = Number(value);
+            continue;
+        }
+        if (key === 'attempt') {
+            const parsed = integerError(value, 1, MAX_ATTEMPT);
+            if (parsed !== null)
+                return { ok: false, error: `signature profile attempt: ${parsed}` };
+            profile.attempt = Number(value);
+            continue;
+        }
+        if (BEHAVIOR_SIGNATURE_FORGERIES.includes(value) === false) {
+            return {
+                ok: false,
+                error: `signature profile forgery must be one of ${BEHAVIOR_SIGNATURE_FORGERIES.join(', ')} (got '${value}')`,
+            };
+        }
+        profile.forgery = value;
+    }
+    if (profile.timestampHeader === null)
+        profile.toleranceMs = null;
+    if (profile.attemptHeader === null)
+        profile.attempt = 1;
+    return { ok: true, profile };
+}
+/** Rejects a malformed or reserved header name; null when legal. */
+function headerError(value) {
+    if (HEADER_NAME.test(value) === false) {
+        return `'${value}' is not a legal header name`;
+    }
+    if (FORBIDDEN_HEADERS.has(value.toLowerCase())) {
+        return `'${value}' is reserved for the engine-side signing secret and can never be stamped`;
+    }
+    return null;
+}
+/** Rejects a non-integer or out-of-range value; null when legal. */
+function integerError(value, min, max) {
+    if (/^\d+$/.test(value) === false)
+        return `'${value}' is not a non-negative integer`;
+    const parsed = Number(value);
+    if (parsed < min || parsed > max)
+        return `'${value}' is outside [${String(min)}, ${String(max)}]`;
+    return null;
+}
+//# sourceMappingURL=signature-profile.js.map

package/dist/schemas/signature-profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature-profile.js","sourceRoot":"","sources":["../../src/schemas/signature-profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,+CAA+C;AAC/C,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,aAAa,CAAU,CAAC;AAKtE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,MAAM,EAAE,WAAW,CAAU,CAAC;AAK3E;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,4BAA4B,CAAC;AAE3E,mDAAmD;AACnD,MAAM,CAAC,MAAM,wBAAwB,GAAG,aAAa,CAAC;AAEtD,iEAAiE;AACjE,MAAM,CAAC,MAAM,kCAAkC,GAAG,qBAAqB,CAAC;AAExE,+DAA+D;AAC/D,MAAM,CAAC,MAAM,gCAAgC,GAAG,mBAAmB,CAAC;AAEpE,4DAA4D;AAC5D,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC;AAoBzF,iDAAiD;AACjD,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC;IACnD,QAAQ;IACR,iBAAiB;IACjB,aAAa;IACb,eAAe;IACf,SAAS;IACT,SAAS;CACV,CAAC,CAAC;AAEH,wDAAwD;AACxD,MAAM,gBAAgB,GAAG,UAAU,CAAC;AAEpC,gDAAgD;AAChD,MAAM,WAAW,GAAG,IAAI,CAAC;AAEzB,iEAAiE;AACjE,MAAM,WAAW,GAAG,iCAAiC,CAAC;AAOtD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,6BAA6B,CAAC,IAAY;IACxD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,IAAK,6BAAmD,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;QAClF,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EACH,kCAAkC,IAAI,iBAAiB;gBACvD,GAAG,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,wCAAwC;gBACnF,GAAG,CAAC,GAAG,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SAC/C,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAA6B;QACxC,SAAS,EAAE,IAAkC;QAC7C,MAAM,EAAE,wBAAwB;QAChC,eAAe,EAAE,kCAAkC;QACnD,WAAW,EAAE,IAAI;QACjB,aAAa,EAAE,gCAAgC;QAC/C,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,MAAM;KAChB,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACvC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,SAAS,GAAG,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,IAAI,qBAAqB,EAAE,CAAC;QAC1G,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/C,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC;YACvC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wCAAwC,GAAG,GAAG,EAAE,CAAC;QAC9E,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0CAA0C,GAAG,GAAG,EAAE,CAAC;QACjG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YAClC,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YACzD,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,iBAAiB,EAAE,CAAC;YAC9B,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;gBACrB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;gBAC/B,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YAClC,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YACzD,OAAO,CAAC,eAAe,GAAG,KAAK,CAAC;YAChC,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,eAAe,EAAE,CAAC;YAC5B,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;gBACrB,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;gBAC7B,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YAClC,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YACzD,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,EAAE,gBAAgB,CAAC,CAAC;YACxD,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kCAAkC,MAAM,EAAE,EAAE,CAAC;YAC7F,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YACpC,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;YACnD,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,MAAM,EAAE,EAAE,CAAC;YACzF,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAChC,SAAS;QACX,CAAC;QACD,IAAK,4BAAkD,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;YAClF,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,4CAA4C,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,KAAK,IAAI;aAC9G,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,OAAO,GAAG,KAAiC,CAAC;IACtD,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,KAAK,IAAI;QAAE,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IACjE,IAAI,OAAO,CAAC,aAAa,KAAK,IAAI;QAAE,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC;IACxD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED,oEAAoE;AACpE,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QACtC,OAAO,IAAI,KAAK,8BAA8B,CAAC;IACjD,CAAC;IACD,IAAI,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,KAAK,2EAA2E,CAAC;IAC9F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oEAAoE;AACpE,SAAS,YAAY,CAAC,KAAa,EAAE,GAAW,EAAE,GAAW;IAC3D,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,KAAK,iCAAiC,CAAC;IACrF,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,KAAK,iBAAiB,MAAM,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;IAClG,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/schemas/test-map.d.ts

@@ -60,9 +60,11 @@ export declare const TestMapEntrySchema: z.ZodObject<{
         integration: "integration";
         component: "component";
     }>>;
+    source: z.ZodOptional<z.ZodLiteral<"annotation">>;
     categories: z.ZodOptional<z.ZodArray<z.ZodString>>;
     claims: z.ZodArray<z.ZodString>;
     caseIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    twinOf: z.ZodOptional<z.ZodString>;
     reason: z.ZodString;
 }, z.core.$strict>;
 /** Inferred test-map-entry type. */
@@ -92,9 +94,11 @@ export declare const TestMapSchema: z.ZodObject<{
             integration: "integration";
             component: "component";
         }>>;
+        source: z.ZodOptional<z.ZodLiteral<"annotation">>;
         categories: z.ZodOptional<z.ZodArray<z.ZodString>>;
         claims: z.ZodArray<z.ZodString>;
         caseIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        twinOf: z.ZodOptional<z.ZodString>;
         reason: z.ZodString;
     }, z.core.$strict>>;
 }, z.core.$strict>;

package/dist/schemas/test-map.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"test-map.d.ts","sourceRoot":"","sources":["../../src/schemas/test-map.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB;;;;;kBAWpB,CAAC;AAEZ,mCAAmC;AACnC,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;kBAuC3B,CAAC;AAEL,oCAAoC;AACpC,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;kBA4BtB,CAAC;AAEL,uCAAuC;AACvC,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC"}
+{"version":3,"file":"test-map.d.ts","sourceRoot":"","sources":["../../src/schemas/test-map.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB;;;;;kBAWpB,CAAC;AAEZ,mCAAmC;AACnC,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;kBAmD3B,CAAC;AAEL,oCAAoC;AACpC,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA4BtB,CAAC;AAEL,uCAAuC;AACvC,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC"}

package/dist/schemas/test-map.js

@@ -57,6 +57,8 @@ export const TestMapEntrySchema = z
     selector: TestSelectorSchema,
     /** Declared kind; resolves `unknown`, never observed mocking (§5.3). */
     kind: TestKindSchema.optional(),
+    /** Origin marker for entries generated from test annotations. */
+    source: z.literal('annotation').optional(),
     /** Behavior-category labels (hints only, never proof; §3.2). */
     categories: z.array(z.string().min(1)).optional(),
     /** Claimed obligation ids — at least one; `'*'` never parses. */
@@ -66,6 +68,16 @@ export const TestMapEntrySchema = z
      * Optional: absence is not proof. Duplicate ids fail closed.
      */
     caseIds: z.array(z.string().min(1)).optional(),
+    /**
+     * Twin path coverage (E64): the logical key of the RAW test this
+     * witnessed test is the twin of. Additive and purely declarative —
+     * it grants nothing, claims nothing, and is read only when
+     * `enforcement.twinPaths` is configured (absent = the run never
+     * looks at it). With it, a run can say which two tests are meant to
+     * cover the same request path, so a divergence between them is a
+     * named finding instead of an invisible one.
+     */
+    twinOf: z.string().min(1, 'twinOf must be a non-empty logical key of the raw twin').optional(),
     /** Required free-text why (a declaration must be reviewable). */
     reason: z
         .string()

package/dist/schemas/test-map.js.map

@@ -1 +1 @@
-{"version":3,"file":"test-map.js","sourceRoot":"","sources":["../../src/schemas/test-map.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,yDAAyD;IACzD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,iFAAiF;IACjF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrC,sDAAsD;IACtD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,6DAA6D;IAC7D,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACjD,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,mEAAmE;IACnE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,sDAAsD;IACtD,QAAQ,EAAE,kBAAkB;IAC5B,wEAAwE;IACxE,IAAI,EAAE,cAAc,CAAC,QAAQ,EAAE;IAC/B,gEAAgE;IAChE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,iEAAiE;IACjE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,wDAAwD,CAAC;IACpG;;;OAGG;IACH,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC9C,iEAAiE;IACjE,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,EAAE,iFAAiF,CAAC;CAC7F,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO;IACxC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,EAAE,KAAK,SAAS;YAAE,SAAS;QAC/B,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACjB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC;gBACxB,OAAO,EAAE,sBAAsB,EAAE,GAAG;aACrC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACf,CAAC;AACH,CAAC,CAAC,CAAC;AAKL;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,CAAC;IACN,aAAa,EAAE,kBAAkB;IACjC,2EAA2E;IAC3E,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;CACnC,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;IAC7B,mEAAmE;IACnE,8BAA8B;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC7C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC9D,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC;gBAC7B,OAAO,EACL,0BAA0B,KAAK,CAAC,GAAG,wBAAwB,MAAM,CAC/D,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CACjC,WAAW,QAAQ,CAAC,QAAQ,CAAC,IAAI,eAAe,MAAM,CAAC,KAAK,CAAC,WAAW,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG;aAClG,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC,CAAC,CAAC"}
+{"version":3,"file":"test-map.js","sourceRoot":"","sources":["../../src/schemas/test-map.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,yDAAyD;IACzD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,iFAAiF;IACjF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrC,sDAAsD;IACtD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,6DAA6D;IAC7D,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACjD,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,mEAAmE;IACnE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,sDAAsD;IACtD,QAAQ,EAAE,kBAAkB;IAC5B,wEAAwE;IACxE,IAAI,EAAE,cAAc,CAAC,QAAQ,EAAE;IAC/B,iEAAiE;IACjE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;IAC1C,gEAAgE;IAChE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,iEAAiE;IACjE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,wDAAwD,CAAC;IACpG;;;OAGG;IACH,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC9C;;;;;;;;OAQG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,wDAAwD,CAAC,CAAC,QAAQ,EAAE;IAC9F,iEAAiE;IACjE,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,EAAE,iFAAiF,CAAC;CAC7F,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO;IACxC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,EAAE,KAAK,SAAS;YAAE,SAAS;QAC/B,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACjB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC;gBACxB,OAAO,EAAE,sBAAsB,EAAE,GAAG;aACrC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACf,CAAC;AACH,CAAC,CAAC,CAAC;AAKL;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,CAAC;IACN,aAAa,EAAE,kBAAkB;IACjC,2EAA2E;IAC3E,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;CACnC,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;IAC7B,mEAAmE;IACnE,8BAA8B;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC7C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC9D,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC;gBAC7B,OAAO,EACL,0BAA0B,KAAK,CAAC,GAAG,wBAAwB,MAAM,CAC/D,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CACjC,WAAW,QAAQ,CAAC,QAAQ,CAAC,IAAI,eAAe,MAAM,CAAC,KAAK,CAAC,WAAW,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG;aAClG,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/schemas/verdict.d.ts

@@ -35,10 +35,10 @@ export type UnresolvedReason = z.infer<typeof UnresolvedReasonSchema>;
 /**
  * Stable cause codes for the shared report model (plan §5.4, ADR 0005).
  * Blocking-obligation causes name WHY an obligation is not satisfied and
- * select its next action; the three `DIAGNOSTIC_*` codes are advisory
- * result causes for the separate diagnostic run (plan §3.5) — never
- * obligation verdicts. The seven verdict VALUES are unchanged; causes
- * enrich them without weakening any contract.
+ * select its next action. `DIAGNOSTIC_*` codes advise on the separate
+ * diagnostic run; `TEST_MAP_OUT_OF_SYNC` advises on generated mappings.
+ * These report advisories are never obligation verdicts. The seven verdict
+ * VALUES are unchanged; causes enrich reports without weakening contracts.
  */
 export declare const CauseCodeSchema: z.ZodEnum<{
     TEST_INVENTORY_INCOMPLETE: "TEST_INVENTORY_INCOMPLETE";
@@ -46,6 +46,7 @@ export declare const CauseCodeSchema: z.ZodEnum<{
     TEST_MAPPING_MISSING: "TEST_MAPPING_MISSING";
     TEST_MAPPING_AMBIGUOUS: "TEST_MAPPING_AMBIGUOUS";
     TEST_MAPPING_STALE: "TEST_MAPPING_STALE";
+    TEST_MAP_OUT_OF_SYNC: "TEST_MAP_OUT_OF_SYNC";
     EVIDENCE_NOT_COLLECTED: "EVIDENCE_NOT_COLLECTED";
     VERIFIER_UNSUPPORTED: "VERIFIER_UNSUPPORTED";
     TEST_NOT_EXECUTED: "TEST_NOT_EXECUTED";
@@ -72,6 +73,20 @@ export declare const CauseCodeSchema: z.ZodEnum<{
     ENFORCEMENT_BOUNDARY_UNVERIFIED: "ENFORCEMENT_BOUNDARY_UNVERIFIED";
     RUNTIME_PREPARATION_FAILED: "RUNTIME_PREPARATION_FAILED";
     RUNTIME_READINESS_FAILED: "RUNTIME_READINESS_FAILED";
+    QUARANTINE_EXPIRED: "QUARANTINE_EXPIRED";
+    MIGRATION_MISSING: "MIGRATION_MISSING";
+    MIGRATION_LINEAGE_BROKEN: "MIGRATION_LINEAGE_BROKEN";
+    MIGRATION_DOWNGRADE_NOOP: "MIGRATION_DOWNGRADE_NOOP";
+    MIGRATION_DRIFT: "MIGRATION_DRIFT";
+    MIGRATION_ROUNDTRIP_FAILED: "MIGRATION_ROUNDTRIP_FAILED";
+    MIGRATION_DATA_LOST: "MIGRATION_DATA_LOST";
+    MIGRATION_CONFLICT: "MIGRATION_CONFLICT";
+    MIGRATION_SCRATCH_UNSAFE: "MIGRATION_SCRATCH_UNSAFE";
+    ADAPTER_CANNOT_WITNESS: "ADAPTER_CANNOT_WITNESS";
+    ADAPTER_VOLATILE_FIELD_SKIPPED: "ADAPTER_VOLATILE_FIELD_SKIPPED";
+    RESOURCE_SINGLETON_PER_TENANT: "RESOURCE_SINGLETON_PER_TENANT";
+    RESPONSE_FIELD_MISSING_FROM_MODEL: "RESPONSE_FIELD_MISSING_FROM_MODEL";
+    TWIN_PATH_DIVERGENT: "TWIN_PATH_DIVERGENT";
 }>;
 /** Inferred cause-code union. */
 export type CauseCode = z.infer<typeof CauseCodeSchema>;

package/dist/schemas/verdict.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verdict.d.ts","sourceRoot":"","sources":["../../src/schemas/verdict.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;EAQxB,CAAC;AAEH,8BAA8B;AAC9B,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEpD,iEAAiE;AACjE,eAAO,MAAM,sBAAsB;;;;;;;;kBASxB,CAAC;AAEZ,wCAAwC;AACxC,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgC1B,CAAC;AAEH,iCAAiC;AACjC,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAiDjE,CAAC"}
+{"version":3,"file":"verdict.d.ts","sourceRoot":"","sources":["../../src/schemas/verdict.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;EAQxB,CAAC;AAEH,8BAA8B;AAC9B,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEpD,iEAAiE;AACjE,eAAO,MAAM,sBAAsB;;;;;;;;kBASxB,CAAC;AAEZ,wCAAwC;AACxC,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+C1B,CAAC;AAEH,iCAAiC;AACjC,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CA8EjE,CAAC"}