@interf/compiler 0.13.0 → 0.18.0

package/dist/packages/{local-service → engine}/server.d.ts

@@ -1,5 +1,7 @@
 import { type Server } from "node:http";
 import { type LocalServiceRunHandlers, type LocalServiceRuntime } from "./runtime.js";
+import type { IdempotencyStore, RunLeaseStore, TokenValidator } from "./cloud-seams.js";
+import type { BillingEventSink } from "./compile/billing-events.js";
 /** Generate a fresh per-instance bearer token. */
 export declare function createLocalServiceAuthToken(): string;
 export interface StartLocalServiceOptions {
@@ -21,6 +23,29 @@ export interface StartLocalServiceOptions {
      * and any caller that explicitly opts in).
      */
     authToken?: string | null | "auto";
+    /**
+     * 0.17 — cloud-variant auth seam (B4.3). When provided, every
+     * mutating request runs through this validator instead of the local
+     * constant-time bearer check, and the resulting `account_id` is
+     * stashed on the runtime context for billing-event attribution.
+     * Local default: `undefined` — fall back to `runtime.authToken`
+     * comparison.
+     */
+    tokenValidator?: TokenValidator;
+    /**
+     * 0.17 — cloud-variant interface seams forwarded to
+     * `LocalServiceRuntime`. Local default: in-process `Map`s on the
+     * runtime. Cloud variants pass shared implementations (Redis,
+     * Cassandra, etc.) so multi-replica engines coordinate. See
+     * `cloud-seams.ts` for the contracts.
+     */
+    idempotencyStore?: IdempotencyStore;
+    runLeaseStore?: RunLeaseStore;
+    /**
+     * 0.17 — billing event sink. Local default writes per-run JSONL.
+     * Cloud variants inject a Metronome HTTP sender once 0.18+ ships.
+     */
+    billingEventSink?: BillingEventSink;
 }
 export interface StartedLocalService {
     runtime: LocalServiceRuntime;

package/dist/packages/{local-service → engine}/server.js

@@ -5,12 +5,15 @@ import { existsSync, statSync, readFileSync } from "node:fs";
 import { dirname, extname, join, normalize, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { LOCAL_SERVICE_LOOPBACK_HOSTS, LocalServiceConfigSchema, LocalServiceDiscoverySchema, LocalServiceErrorSchema, OpenPathRequestSchema, ServiceRegistryEntrySchema, } from "./lib/schema.js";
-import { assertPathWithinRoot, } from "../shared/path-guards.js";
+import { assertPathWithinRoot, } from "../contracts/utils/path-guards.js";
 import { createLocalServiceRuntime, } from "./runtime.js";
 import { buildLocalServiceUrl, LOCAL_SERVICE_DEFAULT_HOST, LOCAL_SERVICE_DEFAULT_PORT, LOCAL_SERVICE_ROUTES, PREPARATION_SUBRESOURCES, } from "./routes.js";
 import { registerServiceLocally, unregisterService, } from "./service-registry.js";
-import { createStoredPreparation, deleteStoredPreparation, getStoredPreparation, listStoredPreparations, preparationWireShape, rehydratePreparations, } from "./preparation-store.js";
+import { createStoredPreparation, deleteStoredPreparation, getStoredPreparation, listStoredPreparations, preparationWireShape, rehydratePreparations, updateStoredPreparation, } from "./preparation-store.js";
 import { clearConnection, readActiveConnection, writeConnection, } from "./connection-config.js";
+import { userMethodsRoot } from "./instance-paths.js";
+import { builtinMethodPackagePath, methodDefinitionPath, } from "../methods/package/local-methods.js";
+import { userMethodPath, userMethodExists } from "../methods/package/user-methods.js";
 /** HTTP methods that require an authenticated bearer token + Origin guard. */
 const MUTATING_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
 /** Generate a fresh per-instance bearer token. */
@@ -85,7 +88,7 @@ function corsHeadersFor(origin, allowed) {
         "access-control-allow-origin": origin ?? allowed.hostUrls[0] ?? "",
         "access-control-allow-credentials": "false",
         "access-control-allow-methods": "GET,POST,PATCH,DELETE,OPTIONS",
-        "access-control-allow-headers": "content-type, authorization, x-interf-workspace, x-interf-idempotency-key",
+        "access-control-allow-headers": "content-type, authorization, x-interf-idempotency-key",
         vary: "origin",
     };
 }
@@ -152,6 +155,11 @@ function contentType(filePath) {
             return "image/x-icon";
         case ".txt":
             return "text/plain; charset=utf-8";
+        case ".md":
+            return "text/markdown; charset=utf-8";
+        case ".yml":
+        case ".yaml":
+            return "application/yaml; charset=utf-8";
         case ".map":
             return "application/json; charset=utf-8";
         case ".webmanifest":
@@ -274,15 +282,45 @@ function safeStaticPath(root, relativePath) {
     }
     return absolute;
 }
+/**
+ * Resolve the on-disk root path for a method id. Used by the
+ * `/v1/methods/<id>/files/<relpath>` route. Resolution order matches
+ * the runtime: preparation-draft (if a prep id is supplied) → user
+ * library → built-in. Returns `null` when the method id resolves
+ * nowhere.
+ */
+function resolveMethodPackageRoot(methodId, prepDataDir) {
+    if (prepDataDir) {
+        const localPath = methodDefinitionPath(prepDataDir, methodId);
+        if (existsSync(join(localPath, "method.json")))
+            return localPath;
+    }
+    if (userMethodExists(methodId)) {
+        return userMethodPath(methodId);
+    }
+    const builtinPath = builtinMethodPackagePath(methodId);
+    if (existsSync(join(builtinPath, "method.json")))
+        return builtinPath;
+    return null;
+}
 function sendFile(res, filePath) {
     if (!existsSync(filePath))
         return false;
     try {
         if (!statSync(filePath).isFile())
             return false;
-        writeHeaders(res, 200, {
-            "content-type": contentType(filePath),
-        });
+        const type = contentType(filePath);
+        const headers = { "content-type": type };
+        // 0.17 — never cache HTML responses. UI deploys ship a fresh
+        // dist via `npm run web:build` and a restart; without `no-store`,
+        // a browser sitting on a stale `index.html` would keep loading
+        // hashed asset paths that no longer exist. Hashed Next.js bundles
+        // under `_next/static/<hash>/` keep the default long-cache
+        // because the filename itself changes when content changes.
+        if (type.startsWith("text/html")) {
+            headers["cache-control"] = "no-store";
+        }
+        writeHeaders(res, 200, headers);
         res.end(readFileSync(filePath));
         return true;
     }
@@ -290,6 +328,25 @@ function sendFile(res, filePath) {
         return false;
     }
 }
+/**
+ * Reject any path that contains `..` or absolute segments — used by the
+ * 0.16 file-serving endpoints (`/v1/methods/<id>/files/...`,
+ * `/v1/preparations/<id>/files/...`). The `safeStaticPath` helper used
+ * by the static-asset path silently strips traversal segments; for the
+ * API endpoints we want a hard reject so the response is unambiguous.
+ */
+function isTraversalRelativePath(relPath) {
+    if (relPath.length === 0)
+        return true;
+    const segments = relPath.split(/[\\/]+/);
+    for (const segment of segments) {
+        if (segment === ".." || segment === "")
+            return true;
+    }
+    if (relPath.startsWith("/") || /^[A-Za-z]:/.test(relPath))
+        return true;
+    return false;
+}
 function sendCompilerUiAsset(req, res, _runtime) {
     const staticRoot = compilerUiStaticRoot();
     const url = parseRequestUrl(req);
@@ -378,6 +435,7 @@ async function routeApi(req, res, runtime) {
                 runs: LOCAL_SERVICE_ROUTES.runs,
                 action_proposals: LOCAL_SERVICE_ROUTES.actionProposals,
                 executor: LOCAL_SERVICE_ROUTES.executor,
+                agents: LOCAL_SERVICE_ROUTES.agents,
                 open_path: LOCAL_SERVICE_ROUTES.openPath,
             },
         }));
@@ -390,6 +448,15 @@ async function routeApi(req, res, runtime) {
         const uptimeSeconds = Number.isFinite(startedMs)
             ? Math.max(0, Math.floor((Date.now() - startedMs) / 1000))
             : 0;
+        const agentSnapshot = runtime.getAgentsRegistry();
+        // 0.16 — `connection_kind` lets the UI know whether OS-open is even
+        // possible. A loopback bind means the engine has filesystem access
+        // to the same host as the user; non-loopback (cloud) returns
+        // "remote" so the UI routes to api-served / signed-URL paths
+        // instead. The current binary refuses non-loopback binds (see the
+        // host whitelist below), so the value is "local" today; the field
+        // is in place so the UI can read it without a CLI version sniff.
+        const isLoopback = LOCAL_SERVICE_LOOPBACK_HOSTS.includes(runtime.host);
         sendJson(res, 200, {
             kind: "interf-instance",
             version: 1,
@@ -402,6 +469,11 @@ async function routeApi(req, res, runtime) {
             package_version: runtime.packageVersion ?? null,
             preparation_count: listStoredPreparations().length,
             auth_required: Boolean(runtime.authToken),
+            // 0.15 connected-agents fields:
+            agent_count: agentSnapshot.agents.length,
+            default_agent: agentSnapshot.active_agent?.name ?? null,
+            // 0.16 connection-mode flag:
+            connection_kind: isLoopback ? "local" : "remote",
         });
         return true;
     }
@@ -434,6 +506,17 @@ async function routeApi(req, res, runtime) {
                 sendError(res, 400, "Missing required field: source.locator");
                 return true;
             }
+            // TODO(cloud): activate remote-folder validator branch when the
+            // cloud variant lands. The local binary only knows how to read
+            // bytes from a local path; a `remote-folder` binding requires
+            // the cloud variant's per-account object-storage mount layer.
+            // Until then, reject any kind other than `local-folder` so the
+            // wire shape and runtime stay consistent.
+            const requestedKind = typeof body.source.kind === "string" ? body.source.kind : "local-folder";
+            if (requestedKind !== "local-folder") {
+                sendError(res, 400, `Unsupported source kind: ${requestedKind}. The local engine only accepts local-folder bindings; remote-folder requires the cloud variant.`);
+                return true;
+            }
             const stored = createStoredPreparation(runtime, {
                 id: body.id,
                 source: { kind: "local-folder", locator: body.source.locator },
@@ -471,6 +554,25 @@ async function routeApi(req, res, runtime) {
                 sendJson(res, 200, preparationWireShape(storedPrep));
                 return true;
             }
+            if (method === "PATCH") {
+                try {
+                    const body = (await readJsonBody(req));
+                    if (!body || typeof body !== "object") {
+                        sendError(res, 400, "Request body must be a JSON object.");
+                        return true;
+                    }
+                    const updated = updateStoredPreparation(decodedPrepId, {
+                        method_id: body.method_id,
+                        about: body.about,
+                        ...(body.checks !== undefined ? { checks: body.checks } : {}),
+                    });
+                    sendJson(res, 200, preparationWireShape(updated));
+                }
+                catch (error) {
+                    sendError(res, 400, error instanceof Error ? error.message : String(error));
+                }
+                return true;
+            }
             if (method === "DELETE") {
                 deleteStoredPreparation(runtime, decodedPrepId);
                 sendJson(res, 200, { id: decodedPrepId, deleted: true });
@@ -479,6 +581,10 @@ async function routeApi(req, res, runtime) {
         }
         else if (subPath === PREPARATION_SUBRESOURCES.compileRuns) {
             if (method === "POST") {
+                if (!storedPrep.methodId) {
+                    sendError(res, 400, `Preparation ${storedPrep.id} has no method bound. Set one via PATCH /v1/preparations/${storedPrep.id} { "method_id": "<id>" } before compiling.`);
+                    return true;
+                }
                 try {
                     const body = (await readJsonBody(req));
                     const request = { preparation: storedPrep.id, ...(body ?? {}) };
@@ -509,12 +615,16 @@ async function routeApi(req, res, runtime) {
                 return true;
             }
         }
-        else if (subPath === PREPARATION_SUBRESOURCES.testRuns) {
+        else if (subPath === PREPARATION_SUBRESOURCES.verifyRuns) {
             if (method === "POST") {
+                if (!storedPrep.methodId) {
+                    sendError(res, 400, `Preparation ${storedPrep.id} has no method bound. Set one via PATCH /v1/preparations/${storedPrep.id} { "method_id": "<id>" } before verifying.`);
+                    return true;
+                }
                 try {
                     const body = (await readJsonBody(req));
                     const request = { preparation: storedPrep.id, ...(body ?? {}) };
-                    const resource = await runtime.createTestRun(storedPrep.prepDataDir, request);
+                    const resource = await runtime.createVerifyRun(storedPrep.prepDataDir, request);
                     sendJson(res, 201, resource);
                 }
                 catch (error) {
@@ -620,6 +730,58 @@ async function routeApi(req, res, runtime) {
                 return true;
             }
         }
+        else if (subPath.startsWith(`${PREPARATION_SUBRESOURCES.files}/`)) {
+            // GET /v1/preparations/<id>/files/<relpath> — read-only file
+            // serving inside the prep's portable-context root. Used by the
+            // locator pattern's `api-served` kind.
+            if (method === "GET") {
+                const rawRelPath = subPath.slice(PREPARATION_SUBRESOURCES.files.length + 1);
+                let relPath;
+                try {
+                    relPath = decodeURIComponent(rawRelPath);
+                }
+                catch {
+                    sendError(res, 400, "File path is not valid URI-encoded UTF-8.");
+                    return true;
+                }
+                if (isTraversalRelativePath(relPath)) {
+                    sendError(res, 400, "File path escapes portable-context root.");
+                    return true;
+                }
+                const safePath = safeStaticPath(storedPrep.portableContextPath, relPath);
+                if (!safePath) {
+                    sendError(res, 400, "File path escapes portable-context root.");
+                    return true;
+                }
+                if (!sendFile(res, safePath)) {
+                    sendError(res, 404, `File not found: ${relPath}`);
+                }
+                return true;
+            }
+        }
+        else if (subPath.startsWith(`${PREPARATION_SUBRESOURCES.artifacts}/`)) {
+            // GET /v1/preparations/<id>/artifacts/<artifact-id> — per-Artifact
+            // status from the latest compile run. 0.17.
+            if (method === "GET") {
+                const rawArtifactId = subPath.slice(PREPARATION_SUBRESOURCES.artifacts.length + 1);
+                let artifactId;
+                try {
+                    artifactId = decodeURIComponent(rawArtifactId);
+                }
+                catch {
+                    sendError(res, 400, "Artifact id is not valid URI-encoded UTF-8.");
+                    return true;
+                }
+                const preparation = runtime.getPreparation(storedPrep.prepDataDir, storedPrep.id);
+                const status = preparation?.artifacts.find((entry) => entry.artifact_id === artifactId);
+                if (!status) {
+                    sendError(res, 404, `Artifact not found: ${artifactId}`);
+                    return true;
+                }
+                sendJson(res, 200, status);
+                return true;
+            }
+        }
         sendError(res, 404, `Unknown preparation sub-route: ${subPath}`);
         return true;
     }
@@ -644,6 +806,50 @@ async function routeApi(req, res, runtime) {
             sendJson(res, 200, methodResource);
         return true;
     }
+    const methodRunsMatch = path.match(/^\/v1\/methods\/([^/]+)\/runs$/);
+    if (method === "GET" && methodRunsMatch?.[1]) {
+        const firstPrep = listStoredPreparations()[0];
+        const runs = runtime.listMethodRuns(firstPrep?.prepDataDir ?? runtime.rootPath, decodeURIComponent(methodRunsMatch[1]));
+        sendJson(res, 200, { runs });
+        return true;
+    }
+    // GET /v1/methods/<id>/files/<relpath> — read-only file serving inside
+    // the method root. Used by the locator pattern's `api-served` kind so
+    // the UI can render SKILL.md / contract files in a side drawer over a
+    // remote engine. Resolution: prep-draft (when first prep exists) →
+    // user library → built-in. Path-guard rejects any traversal outside
+    // the resolved root.
+    const methodFilesMatch = path.match(/^\/v1\/methods\/([^/]+)\/files\/(.+)$/);
+    if (method === "GET" && methodFilesMatch?.[1] && methodFilesMatch[2]) {
+        const methodId = decodeURIComponent(methodFilesMatch[1]);
+        let relPath;
+        try {
+            relPath = decodeURIComponent(methodFilesMatch[2]);
+        }
+        catch {
+            sendError(res, 400, "File path is not valid URI-encoded UTF-8.");
+            return true;
+        }
+        if (isTraversalRelativePath(relPath)) {
+            sendError(res, 400, "File path escapes method root.");
+            return true;
+        }
+        const firstPrep = listStoredPreparations()[0];
+        const root = resolveMethodPackageRoot(methodId, firstPrep?.prepDataDir);
+        if (!root) {
+            sendError(res, 404, `Method not found: ${methodId}`);
+            return true;
+        }
+        const safePath = safeStaticPath(root, relPath);
+        if (!safePath) {
+            sendError(res, 400, "File path escapes method root.");
+            return true;
+        }
+        if (!sendFile(res, safePath)) {
+            sendError(res, 404, `File not found: ${relPath}`);
+        }
+        return true;
+    }
     // ─────────────────────────────────────────────────────────────────────────
     // Run observability — instance-wide. Each run record carries a workspace,
     // so the runtime takes a "first prep" hint to scan registered preparations.
@@ -755,12 +961,12 @@ async function routeApi(req, res, runtime) {
             return true;
         }
     }
-    const testRunMatch = path.match(/^\/v1\/test-runs\/([^/]+)$/);
-    if (method === "GET" && testRunMatch?.[1]) {
+    const verifyRunMatch = path.match(/^\/v1\/verify-runs\/([^/]+)$/);
+    if (method === "GET" && verifyRunMatch?.[1]) {
         const firstPrep = listStoredPreparations()[0];
-        const run = runtime.getTestRun(firstPrep?.prepDataDir ?? runtime.rootPath, decodeURIComponent(testRunMatch[1]));
+        const run = runtime.getVerifyRun(firstPrep?.prepDataDir ?? runtime.rootPath, decodeURIComponent(verifyRunMatch[1]));
         if (!run)
-            sendError(res, 404, "Readiness check run not found.");
+            sendError(res, 404, "Verify run not found.");
         else
             sendJson(res, 200, run);
         return true;
@@ -800,19 +1006,119 @@ async function routeApi(req, res, runtime) {
         sendJson(res, 202, runtime.selectExecutor(body));
         return true;
     }
+    // ─────────────────────────────────────────────────────────────────────────
+    // Connected agents (0.15) — registry, role-map, role list.
+    // ─────────────────────────────────────────────────────────────────────────
+    if (path === LOCAL_SERVICE_ROUTES.agents) {
+        if (method === "GET") {
+            sendJson(res, 200, runtime.getAgentsRegistry());
+            return true;
+        }
+        if (method === "POST") {
+            try {
+                const body = (await readJsonBody(req));
+                if (!body || typeof body !== "object") {
+                    sendError(res, 400, "Request body must be a JSON object.");
+                    return true;
+                }
+                if (!body.name || typeof body.name !== "string") {
+                    sendError(res, 400, "Missing required field: name");
+                    return true;
+                }
+                if (!body.display_name || typeof body.display_name !== "string") {
+                    sendError(res, 400, "Missing required field: display_name");
+                    return true;
+                }
+                if (!body.command || typeof body.command !== "string") {
+                    sendError(res, 400, "Missing required field: command");
+                    return true;
+                }
+                const updated = runtime.registerCustomAgent({
+                    name: body.name,
+                    display_name: body.display_name,
+                    command: body.command,
+                });
+                sendJson(res, 201, updated);
+            }
+            catch (error) {
+                sendError(res, 400, error instanceof Error ? error.message : String(error));
+            }
+            return true;
+        }
+    }
+    if (method === "GET" && path === `${LOCAL_SERVICE_ROUTES.agents}/roles`) {
+        sendJson(res, 200, {
+            kind: "interf-canonical-roles",
+            version: 1,
+            roles: ["extractor", "summarizer", "structurer", "verifier", "general"],
+        });
+        return true;
+    }
+    if (path === `${LOCAL_SERVICE_ROUTES.agents}/role-map`) {
+        if (method === "GET") {
+            const snapshot = runtime.getAgentsRegistry();
+            sendJson(res, 200, {
+                role_map: snapshot.role_map,
+                active_agent: snapshot.active_agent,
+            });
+            return true;
+        }
+        if (method === "PATCH") {
+            try {
+                const body = (await readJsonBody(req));
+                if (!body || typeof body !== "object") {
+                    sendError(res, 400, "Request body must be a JSON object.");
+                    return true;
+                }
+                const patch = {};
+                for (const [role, value] of Object.entries(body)) {
+                    if (typeof value !== "string") {
+                        sendError(res, 400, `Role-map values must be strings (or "" to clear). Got ${typeof value} for role "${role}".`);
+                        return true;
+                    }
+                    patch[role] = value;
+                }
+                const updated = runtime.patchAgentsRoleMap(patch);
+                sendJson(res, 200, updated);
+            }
+            catch (error) {
+                sendError(res, 400, error instanceof Error ? error.message : String(error));
+            }
+            return true;
+        }
+    }
+    // /v1/agents/<name> — only DELETE; built-in names return 400.
+    const agentMatch = path.match(/^\/v1\/agents\/([^/]+)$/);
+    if (agentMatch?.[1] && method === "DELETE") {
+        const name = decodeURIComponent(agentMatch[1]);
+        try {
+            const updated = runtime.unregisterCustomAgent(name);
+            sendJson(res, 200, updated);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            // Rejecting a built-in unregister is a 400 (bad request, the
+            // caller is asking for something the contract doesn't allow).
+            const status = /built-in agent/.test(message) ? 400 : 404;
+            sendError(res, status, message);
+        }
+        return true;
+    }
     if (method === "POST" && path === LOCAL_SERVICE_ROUTES.openPath) {
         const body = OpenPathRequestSchema.parse(await readJsonBody(req));
-        // Permit opening any registered preparation root or its bound source folder.
+        // Permit opening:
+        //  - any registered preparation root or its bound source folder
+        //  - the user method library at `~/.interf/methods/`
+        //  - the bundled built-in method root inside the installed package
+        //    (so SKILL.md / contract files in `interf-default` open correctly)
         const allowedRoots = [];
         for (const stored of listStoredPreparations()) {
             allowedRoots.push(stored.prepDataDir);
             if (stored.source.locator)
                 allowedRoots.push(stored.source.locator);
         }
-        if (allowedRoots.length === 0) {
-            sendError(res, 400, "No preparation registered; nothing to open.");
-            return true;
-        }
+        allowedRoots.push(userMethodsRoot());
+        allowedRoots.push(packageRoot()); // covers <pkg>/builtin-methods/...
         const openedPath = await openLocalPath(allowedRoots, body.path);
         sendJson(res, 202, { opened: true, path: openedPath });
         return true;
@@ -919,7 +1225,22 @@ export async function startLocalService(options = {}) {
         packageVersion: options.packageVersion,
         handlers: options.handlers,
         ...(authToken ? { authToken } : {}),
+        // 0.17 — forward cloud-variant injection points. Local default
+        // ignores idempotencyStore / runLeaseStore (the runtime's
+        // in-process maps stay authoritative); they're accepted on the
+        // options surface so cloud forks have a stable target.
+        ...(options.billingEventSink ? { billingEventSink: options.billingEventSink } : {}),
+        ...(options.idempotencyStore ? { idempotencyStore: options.idempotencyStore } : {}),
+        ...(options.runLeaseStore ? { runLeaseStore: options.runLeaseStore } : {}),
     });
+    // 0.17 — token validator (B4.3). Local default: undefined. Cloud
+    // variants pass an async per-account validator. Stashed on the
+    // runtime via `setTokenValidator` so `isAuthorizedMutation` can
+    // pick it up; the local engine ignores it (the static bearer
+    // check still runs).
+    if (options.tokenValidator) {
+        runtime.setTokenValidator(options.tokenValidator);
+    }
     // Rehydrate 0.13 preparations as synthetic workspaces so subsequent
     // compile / test / readiness calls find them after a service restart.
     try {

package/dist/packages/engine/verify/index.d.ts

@@ -0,0 +1,13 @@
+export * as schema from "./lib/schema.js";
+export * as verify from "./verify.js";
+export * as execution from "./verify-execution.js";
+export * as paths from "./verify-paths.js";
+export * as profilePresets from "./verify-profile-presets.js";
+export * as readinessCheckRun from "./readiness-check-run.js";
+export * as sandbox from "./verify-sandbox.js";
+export * as specs from "./verify-specs.js";
+export * as targets from "./verify-targets.js";
+export * as types from "./verify-types.js";
+export type { TestCase, TestCaseExpect, TestCheckResult, TestCaseResult, TestSpec, TestTargetResult, TestTargetRun, ReadinessCheckRun, TestTargetType, } from "./lib/schema.js";
+export type { LoadedTestSpec, TestTargetCandidate, } from "./verify-types.js";
+export type { TestSandboxRetentionMode, } from "./verify-sandbox.js";

package/dist/packages/engine/verify/index.js

@@ -0,0 +1,10 @@
+export * as schema from "./lib/schema.js";
+export * as verify from "./verify.js";
+export * as execution from "./verify-execution.js";
+export * as paths from "./verify-paths.js";
+export * as profilePresets from "./verify-profile-presets.js";
+export * as readinessCheckRun from "./readiness-check-run.js";
+export * as sandbox from "./verify-sandbox.js";
+export * as specs from "./verify-specs.js";
+export * as targets from "./verify-targets.js";
+export * as types from "./verify-types.js";

package/dist/packages/{testing → engine/verify}/lib/schema.d.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { type TestCaseExpect, type TestTargetType } from "../../contracts/lib/schema.js";
+import { type TestCaseExpect, type TestTargetType } from "../../../contracts/lib/schema.js";
 export declare const TestCaseSchema: z.ZodObject<{
     id: z.ZodString;
     question: z.ZodString;

package/dist/packages/{testing → engine/verify}/lib/schema.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { RuntimeExecutorInfoSchema, TestCaseExpectSchema, TestTargetTypeSchema, PreparationNameSchema, } from "../../contracts/lib/schema.js";
+import { RuntimeExecutorInfoSchema, TestCaseExpectSchema, TestTargetTypeSchema, PreparationNameSchema, } from "../../../contracts/lib/schema.js";
 const TestCaseCoreSchema = z.object({
     id: z.string().regex(/^[a-z0-9][a-z0-9-]{0,79}$/),
     question: z.string().min(1),

package/dist/packages/{testing → engine/verify}/readiness-check-run.d.ts

@@ -1,8 +1,9 @@
 import type { MethodExecutor } from "../agents/lib/executors.js";
-import type { SourcePreparationConfig } from "../project-model/lib/schema.js";
-import { type TestTargetCandidate, type TestTargetResult } from "./test.js";
-import type { TestSandboxRetentionMode } from "./test-sandbox.js";
-import { type ReadinessCheckRun, type TestRunMode } from "./lib/schema.js";
+import type { SourcePreparationConfig } from "../../project/lib/schema.js";
+import type { TestTargetType } from "../../contracts/lib/schema.js";
+import { type TestTargetCandidate, type TestTargetResult } from "./verify.js";
+import type { TestSandboxRetentionMode } from "./verify-sandbox.js";
+import { type ReadinessCheckRun } from "./lib/schema.js";
 export interface SavedReadinessCheckOutcome {
     runPath: string;
     displayRunPath?: string;
@@ -13,7 +14,11 @@ export interface ReadinessCheckRunResult {
     sourcePath: string;
     preparationConfig: SourcePreparationConfig;
     portableContextPath: string | null;
-    mode: TestRunMode;
+    /**
+     * 0.17 — restored. Populated when the verify run targets
+     * `source-files`; null when targeting `compiled`. Aggregates back
+     * onto the saved `ReadinessCheckRun` payload's `source_files` field.
+     */
     sourceFilesOutcome: SavedReadinessCheckOutcome | null;
     compiledOutcome: SavedReadinessCheckOutcome | null;
     readinessRunPath: string | null;
@@ -36,22 +41,28 @@ export declare function saveReadinessCheckRun(options: {
     portableContextPath: string | null;
     preparationName: string;
     checksFingerprint: string;
-    mode: TestRunMode;
-    sourceFilesOutcome: SavedReadinessCheckOutcome | null;
+    sourceFilesOutcome?: SavedReadinessCheckOutcome | null;
     compiledOutcome: SavedReadinessCheckOutcome | null;
 }): string;
-export declare function runSavedSourceFilesCheck(options: {
+export declare function runSavedPortableContextCheck(options: {
     sourcePath: string;
     preparationConfig: SourcePreparationConfig;
     executor?: MethodExecutor | null;
+    portableContextPath?: string | null;
     preserveSandboxes?: TestSandboxRetentionMode;
     runSuffix?: string | null;
 }): Promise<SavedReadinessCheckOutcome | null>;
-export declare function runSavedPortableContextCheck(options: {
+/**
+ * 0.17 — restored. Runs the saved readiness checks against the source
+ * folder baseline (no portable-context indirection) so users can see how
+ * much value the Method actually adds. The lower-level `verify-execution`
+ * + `verify-sandbox` source-files paths have stayed in tree since 0.13;
+ * this is the orchestrator hook that was missing.
+ */
+export declare function runSavedSourceFilesCheck(options: {
     sourcePath: string;
     preparationConfig: SourcePreparationConfig;
     executor?: MethodExecutor | null;
-    portableContextPath?: string | null;
     preserveSandboxes?: TestSandboxRetentionMode;
     runSuffix?: string | null;
 }): Promise<SavedReadinessCheckOutcome | null>;
@@ -59,9 +70,14 @@ export declare function runReadinessChecksForExecutor(options: {
     sourcePath: string;
     preparationConfig: SourcePreparationConfig;
     portableContextPath: string | null;
-    mode: TestRunMode;
     executor?: MethodExecutor | null;
     preserveSandboxes?: TestSandboxRetentionMode;
     runSuffix?: string | null;
     saveLatest?: boolean;
+    /**
+     * 0.17 — selects which target the readiness checks judge against.
+     * Defaults to `compiled` for backward compatibility with existing
+     * callers.
+     */
+    target?: TestTargetType;
 }): Promise<ReadinessCheckRunResult>;