@haystackeditor/cli 0.15.30 → 0.16.0

package/schemas/cloud-verifier.v1.json

@@ -6,9 +6,7 @@
   "additionalProperties": false,
   "required": [
     "schema_version",
-    "operation",
-    "run_id",
-    "status"
+    "operation"
   ],
   "properties": {
     "schema_version": {
@@ -17,7 +15,8 @@
     "operation": {
       "enum": [
         "start",
-        "status"
+        "status",
+        "reproducibility"
       ]
     },
     "run_id": {
@@ -62,86 +61,24 @@
     "timed_out": {
       "type": "boolean"
     },
-    "output": {
-      "type": "object"
-    },
     "error": {
       "type": "string"
     },
     "result": {
-      "oneOf": [
-        {
-          "type": "object",
-          "additionalProperties": false,
-          "required": [
-            "verdict",
-            "summary",
-            "casesTotal",
-            "casesFailed",
-            "regressions",
-            "outputLocation",
-            "wallSeconds"
-          ],
-          "properties": {
-            "verdict": {
-              "type": "string"
-            },
-            "summary": {
-              "type": "string"
-            },
-            "casesTotal": {
-              "type": "integer",
-              "minimum": 0
-            },
-            "casesFailed": {
-              "type": "integer",
-              "minimum": 0
-            },
-            "regressions": {
-              "type": "array",
-              "items": {
-                "type": "object",
-                "additionalProperties": false,
-                "required": [
-                  "caseId",
-                  "title"
-                ],
-                "properties": {
-                  "caseId": {
-                    "type": "string"
-                  },
-                  "title": {
-                    "type": "string"
-                  }
-                }
-              }
-            },
-            "outputLocation": {
-              "type": "string"
-            },
-            "wallSeconds": {
-              "type": "number",
-              "minimum": 0
-            }
-          }
+      "type": "object",
+      "description": "Opaque VerifyResultV1 document, validated by the hosted service against the canonical P0 contract.",
+      "required": [
+        "version",
+        "provider"
+      ],
+      "properties": {
+        "version": {
+          "const": "dv-verify-result-v1"
         },
-        {
-          "type": "object",
-          "description": "Opaque VerifyResultV1 document, validated by the hosted service against the canonical P0 contract.",
-          "required": [
-            "version",
-            "provider"
-          ],
-          "properties": {
-            "version": {
-              "const": "dv-verify-result-v1"
-            },
-            "provider": {
-              "const": "haystack"
-            }
-          }
+        "provider": {
+          "const": "haystack"
         }
-      ]
+      }
     },
     "provider": {
       "const": "haystack"
@@ -164,6 +101,26 @@
           "type": "string"
         }
       }
+    },
+    "series_key": {
+      "type": "string"
+    },
+    "requested_runs": {
+      "type": "integer",
+      "minimum": 2,
+      "maximum": 10
+    },
+    "runs": {
+      "type": "array",
+      "items": {
+        "$ref": "#"
+      }
+    },
+    "reproducible": {
+      "const": false
+    },
+    "reason": {
+      "type": "string"
     }
   },
   "allOf": [
@@ -180,39 +137,37 @@
       },
       "then": {
         "required": [
-          "repository",
-          "base_commit",
-          "head_commit",
-          "created_at"
-        ],
-        "anyOf": [
-          {
-            "required": [
-              "completed_at",
-              "output"
-            ]
-          },
-          {
-            "required": [
-              "result"
-            ]
-          }
+          "result"
         ]
       }
     },
     {
       "if": {
         "properties": {
-          "provider": {
-            "const": "haystack"
+          "operation": {
+            "const": "reproducibility"
           }
-        },
+        }
+      },
+      "then": {
         "required": [
-          "provider"
+          "series_key",
+          "repository",
+          "base_commit",
+          "head_commit",
+          "requested_runs",
+          "runs",
+          "reproducible",
+          "reason"
         ]
       },
-      "then": {
+      "else": {
         "required": [
+          "schema_version",
+          "operation",
+          "run_id",
+          "status",
+          "provider",
           "version",
           "repository",
           "base_commit",

package/dist/commands/ask.d.ts

@@ -1,14 +0,0 @@
-export interface AskOptions {
-    json?: boolean;
-    session?: string;
-}
-export interface AskResponse {
-    schema_version: string;
-    ref: string;
-    head_sha: string;
-    answer: string;
-    evidence: Array<Record<string, unknown>>;
-    session_id: string;
-}
-export declare function fetchAskPayload(ref: string, question: string, options: Pick<AskOptions, 'session'>): Promise<AskResponse>;
-export declare function askHaystackCommand(ref: string, question: string, options: AskOptions): Promise<void>;

package/dist/commands/cloud-verifier-behaviors.d.ts

@@ -1,27 +0,0 @@
-export declare const MAX_BEHAVIOR_ARTIFACT_BYTES: number;
-type RecordValue = Record<string, any>;
-export interface BehaviorValidationIssue {
-    path: string;
-    message: string;
-}
-export interface BehaviorValidationResult {
-    version: 'haystack-behavior-validation-v1';
-    status: 'valid' | 'invalid';
-    issues: BehaviorValidationIssue[];
-    summary: {
-        actions: number;
-        boundaries: number;
-    };
-}
-export declare function derivedBehaviorActionId(repository: string, trigger: RecordValue): string;
-export declare function derivedBehaviorSymbolId(repository: string, sourcePath: string, qualifiedName: string): string;
-export declare function derivedBehaviorBoundaryId(repository: string, kind: string, identityKey: string): string;
-export declare function validateBehaviorArtifact(value: RecordValue, references: {
-    universe: RecordValue;
-    evidence: RecordValue;
-}): BehaviorValidationResult;
-export declare function resolveBehaviorArtifactRoot(gitRoot: string | null, currentDirectory?: string): string;
-export declare function cloudVerifierBehaviorsValidateCommand(options: {
-    json?: boolean;
-}): Promise<void>;
-export {};

package/dist/commands/cloud-verifier-data-store-census.d.ts

@@ -1,47 +0,0 @@
-/**
- * Data-store census.
- *
- * The one job the Cloud Verifier needs from a repository map: what data stores
- * does this application use, so we can clone each one into a replica. Not
- * processes, not API calls, not code structure — the databases, caches, object
- * stores, search indexes, and queues that hold state a test must run against.
- *
- * Four source signals, strongest first:
- *   1. a service image in a compose/k8s manifest (`image: postgres:16`) — a
- *      store instance the app is wired to run beside, the surest signal;
- *   2. a connection URL scheme or conventional env var (`postgres://`,
- *      `REDIS_URL`) — an instance named in config;
- *   3. a config declaration that names a store without an image, library, or URL
- *      (Django `ENGINE`, PHP PDO, Laravel `DB_CONNECTION`, Rails `adapter:`);
- *   4. a client library in a dependency manifest (`pg`, `redis`, `mongoose`) —
- *      the app talks to that engine.
- *
- * Signals are folded per engine into one data store, with the evidence, a
- * confidence, and how to reproduce it. Everything here is a general convention,
- * never a repository-specific constant.
- */
-export type DataStoreCategory = 'relational-database' | 'document-database' | 'key-value-store' | 'wide-column-database' | 'columnar-database' | 'graph-database' | 'vector-database' | 'object-storage' | 'search-index' | 'message-queue' | 'time-series-database' | 'embedded-database';
-export interface DataStoreSignal {
-    kind: 'service-image' | 'client-library' | 'connection-url' | 'config-declaration';
-    value: string;
-    path: string;
-}
-export type DataStoreConfidence = 'running' | 'configured' | 'library';
-export interface DataStore {
-    engine: string;
-    category: DataStoreCategory;
-    clone_strategy: string;
-    confidence: DataStoreConfidence;
-    signals: DataStoreSignal[];
-}
-export interface DataStoreCensusInput {
-    path: string;
-    lowerName: string;
-    text: string;
-}
-/**
- * Fold a stream of manifest/compose/config files into the distinct data stores
- * the application uses. `inputs` is every scanned text file with its lowercased
- * basename; the detector reads only the manifests and configs it recognizes.
- */
-export declare function detectDataStores(inputs: DataStoreCensusInput[]): DataStore[];

package/dist/commands/cloud-verifier-data-store-drift.d.ts

@@ -1,42 +0,0 @@
-/**
- * Data-store drift check.
- *
- * A checked-in universe map lists the stores the Cloud Verifier clones. As the
- * app changes, that map silently goes stale — a new Redis nobody added to the
- * map, or a Mongo the code dropped — and a stale map makes the verifier clone
- * the wrong things. The static detector is a pure function of the repo, so the
- * only moment repo-derived drift can enter is a change to a file the detector
- * reads. This command catches that at the source: re-detect the stores, diff
- * against the checked-in baseline, and flag the delta.
- *
- * It is built to run per-PR and cost almost nothing: given a base ref, it first
- * checks whether the diff touches any file the detector reads (the exact gate —
- * nothing else can change the result) and exits immediately if not.
- */
-export declare const DATA_STORE_BASELINE_PATH = ".haystack/cloud-verifier/data-stores.json";
-export declare const DATA_STORE_BASELINE_SCHEMA = "cloud-verifier-data-stores-v1";
-export interface StoreSnapshot {
-    engine: string;
-    category: string;
-    confidence: string;
-    clone_strategy: string;
-}
-export interface DataStoreDrift {
-    added: StoreSnapshot[];
-    removed: StoreSnapshot[];
-    changed: Array<{
-        engine: string;
-        from: string;
-        to: string;
-    }>;
-}
-/** Diff two store lists by engine. Pure and order-independent. */
-export declare function diffDataStores(baseline: StoreSnapshot[], current: StoreSnapshot[]): DataStoreDrift;
-export declare function hasDrift(drift: DataStoreDrift): boolean;
-export declare function cloudVerifierDataStoreDriftCommand(options: {
-    json?: boolean;
-    root?: string;
-    baseline?: string;
-    baseRef?: string;
-    update?: boolean;
-}): void;

package/dist/commands/cloud-verifier-identity-census.d.ts

@@ -1,88 +0,0 @@
-import { type DataStore } from './cloud-verifier-data-store-census.js';
-export declare const IDENTITY_CENSUS_SCHEMA_VERSION = "cloud-verifier-identity-census-v1";
-export declare const IDENTITY_CENSUS_CONTRACT_REVISION = 39;
-export type IdentityCensusProjection = 'runtime_roles' | 'stateful_resources' | 'external_dependencies' | 'registry_families' | 'registry_entries' | 'registry_edges';
-export type IdentityCensusProofStatus = 'proof-complete' | 'discovery-lead' | 'non-inventory';
-export interface IdentityCensusSource {
-    path: string;
-    start_line: number;
-    end_line: number;
-    anchor: string;
-}
-export interface IdentityCensusMatrixAxis {
-    symbol_identity_key: string;
-    item_identity_key: string;
-    item_value: string;
-    source: IdentityCensusSource;
-}
-export interface IdentityCensusRecord {
-    id: string;
-    kind: string;
-    projections: IdentityCensusProjection[];
-    presumptive_inventory: boolean;
-    proof_status: IdentityCensusProofStatus;
-    semantic_identity_id?: string;
-    execution_identity_id?: string;
-    identity_components?: Record<string, string | string[]>;
-    missing_proof_components?: string[];
-    owner_identity_key: string;
-    identity_key: string;
-    selector_key?: string;
-    implementation_key?: string;
-    operation_token?: string;
-    address_token?: string;
-    package_name?: string;
-    package_version?: string;
-    package_artifact_kind?: string;
-    package_artifact_filename?: string;
-    package_artifact_url?: string;
-    package_artifact_hash?: string;
-    operation_identity_key?: string;
-    materialization_root_identity_key?: string;
-    reproduction_operation_token?: string;
-    matrix_axes?: IdentityCensusMatrixAxis[];
-    selector_family_record_id?: string;
-    parent_selector_entry_record_id?: string;
-    child_selector_family_record_id?: string;
-    relation_kind?: 'implementation-owns-selector' | 'implementation-invokes-selector' | 'parent-key-partitions-selector';
-    source: IdentityCensusSource;
-    supporting_tokens: string[];
-}
-export interface IdentityCensusResult {
-    schema_version: typeof IDENTITY_CENSUS_SCHEMA_VERSION;
-    contract_revision: typeof IDENTITY_CENSUS_CONTRACT_REVISION;
-    repository_root: string;
-    source_commit: string | null;
-    source_tree: string | null;
-    source_manifest: {
-        digest: string;
-        tracked_files_total: number;
-        production_files_scanned: number;
-        files_omitted: number;
-    };
-    record_digest: string;
-    counts: {
-        records: number;
-        by_kind: Record<string, number>;
-        by_projection: Record<string, number>;
-        by_proof_status: Record<IdentityCensusProofStatus, number>;
-        presumptive_inventory: number;
-    };
-    projection_record_ids: Record<IdentityCensusProjection, string[]>;
-    records: IdentityCensusRecord[];
-    omissions: Array<{
-        path: string;
-        reason: string;
-    }>;
-    data_stores: DataStore[];
-}
-export declare function isDataStoreInputName(lowerName: string): boolean;
-export declare function collectDataStores(root: string, tracked: string[], omissions?: Array<{
-    path: string;
-    reason: string;
-}>): DataStore[];
-export declare function scanUniverseIdentities(repositoryRoot: string): IdentityCensusResult;
-export declare function cloudVerifierIdentityCensusCommand(options: {
-    json?: boolean;
-    root?: string;
-}): void;

package/dist/commands/cloud-verifier-materialization.d.ts

@@ -1,16 +0,0 @@
-import type { UniverseValidationIssue } from './cloud-verifier-universe.js';
-export declare const MAX_GENERATED_CASE_FANOUT = 64;
-type YamlRecord = Record<string, unknown>;
-export interface MaterializationValidationContext {
-    universeIds: Set<string>;
-    evidenceById: Map<string, YamlRecord>;
-    coverageSubjects: MaterializationCoverageSubject[];
-}
-export interface MaterializationCoverageSubject {
-    id: string;
-    path: string;
-    kind: 'artifact' | 'runtime role' | 'resource' | 'external dependency';
-}
-export declare function validateMaterializationCapabilityMetadata(record: YamlRecord, path: string, issues: UniverseValidationIssue[]): void;
-export declare function validateMaterializationPlan(value: unknown, context: MaterializationValidationContext, issues: UniverseValidationIssue[], required: boolean): void;
-export {};

package/dist/commands/cloud-verifier-pascal-selector-census.d.ts

@@ -1,29 +0,0 @@
-type PascalRegistryProjection = 'registry_families' | 'registry_entries' | 'registry_edges';
-/**
- * A deliberately structural subset of the identity census RecordInput shape.
- * `proofComplete` lets the caller opt these exact, closed registries into its
- * proof-complete validation gate without making this scanner depend on the
- * central census module.
- */
-export interface PascalSelectorRecordInput {
-    kind: string;
-    projections: PascalRegistryProjection[];
-    presumptiveInventory: boolean;
-    proofStatus: 'proof-complete' | 'discovery-lead';
-    path: string;
-    line: number;
-    anchor: string;
-    owner: string;
-    identity: string;
-    tokens: string[];
-    selectorKey?: string;
-    implementationKey?: string;
-    selectorFamilyRecordId?: string;
-    parentSelectorEntryRecordId?: string;
-    childSelectorFamilyRecordId?: string;
-    relationKind?: 'parent-key-partitions-selector';
-    semanticIdentityKey: string;
-    identityComponents: Record<string, string | string[]>;
-}
-export declare function scanPascalSelectorIdentities(repositoryRoot: string, trackedPaths: string[]): PascalSelectorRecordInput[];
-export {};

package/dist/commands/cloud-verifier-python-manifest-selector-census.d.ts

@@ -1,27 +0,0 @@
-type RegistryProjection = 'registry_families' | 'registry_entries' | 'registry_edges';
-/**
- * A structural subset of the identity census input contract. Keeping the
- * scanner independent avoids a cycle through the census coordinator.
- */
-export interface PythonManifestSelectorRecordInput {
-    kind: string;
-    projections: RegistryProjection[];
-    presumptiveInventory: true;
-    proofStatus: 'proof-complete';
-    path: string;
-    line: number;
-    anchor: string;
-    owner: string;
-    identity: string;
-    tokens: string[];
-    selectorKey?: string;
-    implementationKey?: string;
-    selectorFamilyRecordId?: string;
-    parentSelectorEntryRecordId?: string;
-    childSelectorFamilyRecordId?: string;
-    relationKind?: 'implementation-owns-selector' | 'parent-key-partitions-selector';
-    semanticIdentityKey: string;
-    identityComponents: Record<string, string | string[]>;
-}
-export declare function scanPythonManifestSelectorIdentities(repositoryRoot: string, trackedPaths: string[]): PythonManifestSelectorRecordInput[];
-export {};

package/dist/commands/cloud-verifier-specialized-operational-census.d.ts

@@ -1,51 +0,0 @@
-export type SpecializedOperationalProjection = 'runtime_roles' | 'stateful_resources' | 'external_dependencies';
-export interface SpecializedOperationalSource {
-    path: string;
-    start_line: number;
-    end_line: number;
-    anchor: string;
-}
-export interface SpecializedOperationalMatrixAxis {
-    symbol_identity_key: string;
-    item_identity_key: string;
-    item_value: string;
-    source: SpecializedOperationalSource;
-}
-/**
- * A neutral input accepted structurally by identity-census.ts's addRecord.
- * proofComplete/discoveryLead make the specialized scanner's confidence
- * explicit; presumptiveInventory is the compatibility projection used by the
- * current census contract.
- */
-export interface SpecializedOperationalRecordInput {
-    kind: string;
-    projections: SpecializedOperationalProjection[];
-    presumptiveInventory: boolean;
-    proofComplete: boolean;
-    discoveryLead: boolean;
-    proofStatus: 'proof-complete' | 'discovery-lead';
-    identityComponents: Record<string, string | string[]>;
-    missingProofComponents?: string[];
-    path: string;
-    line: number;
-    anchor: string;
-    owner: string;
-    identity: string;
-    tokens: string[];
-    selectorKey?: string;
-    implementationKey?: string;
-    operationToken?: string;
-    addressToken?: string;
-    operationIdentityKey?: string;
-    executionIdentityKey?: string;
-    semanticIdentityKey?: string;
-    materializationRootIdentityKey?: string;
-    reproductionOperationToken?: string;
-    matrixAxes?: SpecializedOperationalMatrixAxis[];
-}
-/**
- * Enumerate specialized operational identities without consulting repository
- * names or prose. Inputs are sorted, paths are exact, and semantic identities
- * never include line numbers, so inserted blank lines do not change central IDs.
- */
-export declare function scanSpecializedOperationalIdentities(repositoryRoot: string, trackedPaths: string[]): SpecializedOperationalRecordInput[];

package/dist/commands/cloud-verifier-universe.d.ts

@@ -1,31 +0,0 @@
-declare const ARTIFACT_NAMES: readonly ["universe.yml", "evidence.yml", "review.yml"];
-export declare const VALIDATOR_CONTRACT_REVISION = 39;
-export declare const MAX_UNIVERSE_ARTIFACT_BYTES: number;
-export declare const UNIVERSE_PROVISIONAL_ACCESS_REQUEST_FIELDS: readonly ["selected-application-id-and-environment-id", "approved-replica-destination-policy-and-approval-ref", "bounded-resource-kinds-opaque-catalog-handles-and-dependency-edges", "artifact-runtime-and-non-secret-config-opaque-catalog-refs", "external-integration-kinds-and-secret-reference-names", "replica-capabilities-strategies-consistency-freshness-latency-and-cost-bounds", "replica-only-golden-descriptor-and-lease-reference-contract"];
-type ArtifactName = (typeof ARTIFACT_NAMES)[number];
-export interface UniverseValidationIssue {
-    file: ArtifactName;
-    path: string;
-    message: string;
-}
-export interface UniverseValidationResult {
-    validator_contract_revision: number;
-    status: 'valid' | 'invalid';
-    issues: UniverseValidationIssue[];
-    summary: {
-        universe_ids: number;
-        evidence_ids: number;
-        review_ids: number;
-        /** Clone-injection entries by materiality. Absent when the map declares none. */
-        clone_injection_materiality?: Record<string, number>;
-    };
-}
-export type UniverseArtifactTexts = Partial<Record<ArtifactName, string>>;
-export interface UniverseValidationOptions {
-    repositoryRoot?: string;
-}
-export declare function validateUniverseArtifactTexts(texts: UniverseArtifactTexts, options?: UniverseValidationOptions): UniverseValidationResult;
-export declare function cloudVerifierUniverseValidateCommand(options: {
-    json?: boolean;
-}): Promise<void>;
-export {};

package/dist/commands/config.d.ts

@@ -1,46 +0,0 @@
-/**
- * Config commands - manage preferences
- *
- * Repo-level preferences (auto_merge) are stored in .haystack.json.
- * User-level preferences (agentic_tool) are stored on the Haystack Platform API.
- */
-type AgenticTool = 'opencode' | 'claude-code' | 'codex';
-export declare function getAgenticToolStatus(): Promise<void>;
-export declare function setAgenticTool(tool: AgenticTool): Promise<void>;
-export declare function handleAgenticTool(tool?: string): Promise<void>;
-/**
- * Check if auto-merge is enabled for the current repo.
- * Returns false if .haystack.json is missing or on error.
- *
- * NOTE: This does NOT go through loadHaystackConfig() because that function
- * calls process.exit(1) when .haystack.json is missing — which is uncatchable
- * by try/catch. We read the file directly so missing config safely returns false.
- */
-export declare function isAutoMergeEnabled(): Promise<boolean>;
-export declare function getAutoMergeStatus(): Promise<void>;
-export declare function enableAutoMerge(): Promise<void>;
-export declare function disableAutoMerge(): Promise<void>;
-export declare function handleAutoMerge(action?: string): Promise<void>;
-/**
- * Check if auto-fix is enabled for the current repo.
- * Returns false if .haystack.json is missing or on error.
- *
- * Mirrors isAutoMergeEnabled() — direct file read so missing config returns
- * false instead of process.exit(1).
- */
-export declare function isAutoFixEnabled(): Promise<boolean>;
-export declare function getAutoFixStatus(): Promise<void>;
-export declare function enableAutoFix(): Promise<void>;
-export declare function disableAutoFix(): Promise<void>;
-export declare function handleAutoFix(action?: string): Promise<void>;
-/**
- * Resolve a source name (e.g. "cursor") to its GitHub bot username. Raw bot
- * usernames (anything ending in `[bot]`) pass through unchanged.
- *
- * Unknown names are REJECTED, not stored: this value must exactly match a
- * GitHub bot login or the merge queue waits forever for a reviewer that can
- * never post. (A typo used to be saved verbatim and reported as success.)
- */
-export declare function resolveToBot(input: string): string;
-export declare function handleWaitForReviewers(action?: string, reviewers?: string[]): Promise<void>;
-export {};

package/dist/commands/design-verify.d.ts

@@ -1,31 +0,0 @@
-/**
- * design-verify command — Kick off a blind design-by-execution verification
- * run for a PR.
- *
- * haystack design-verify <pr>
- *
- * Unlike `haystack review` (finding-oriented analysis of the diff), design
- * verification executes the change: it infers intent from the diff alone,
- * designs pre-registered behavioral test cases, runs control-before, before,
- * and after in isolated sandboxes, and reports evidence-backed anomaly
- * candidates outside the registered intent.
- *
- * The command waits by default and returns an agent-facing behavioral result.
- * --no-wait preserves the asynchronous trigger-only path.
- */
-import { type DesignVerifierUniverseRole } from '../utils/design-verifier-api.js';
-export interface DesignVerifyOptions {
-    json?: boolean;
-    wait?: boolean;
-    run?: string;
-    pollInterval?: string;
-    timeout?: string;
-    case?: string;
-    universe?: DesignVerifierUniverseRole;
-    replay?: boolean;
-    execJson?: string;
-    cwd?: string;
-    commandTimeout?: string;
-    action?: string;
-}
-export declare function designVerifyCommand(identifier: string, options: DesignVerifyOptions): Promise<void>;