@orkestrel/probe 0.0.26 → 0.0.28

package/dist/src/core/index.cjs

@@ -266,7 +266,7 @@ var ProbeError = class extends Error {
 	constructor(message, options) {
 		const cause = options.cause;
 		super(message, cause === void 0 ? void 0 : { cause });
-		Object.defineProperty(this, Symbol.for("@orkestrel/probe.error"), { value: this });
+		Object.defineProperty(this, Symbol.for("@orkestrel/probe.ProbeError"), { value: this });
 		this.origin = options.origin;
 		this.code = options.code;
 		if (options.context !== void 0) this.context = options.context;
@@ -295,7 +295,7 @@ function isProbeError(value) {
 	if (!(0, _orkestrel_contract.isError)(value)) return false;
 	return (0, _orkestrel_contract.holds)(() => {
 		if (_orkestrel_contract.INTRINSICS.prototype(value) === Error.prototype) return false;
-		if (_orkestrel_contract.INTRINSICS.describe(value, Symbol.for("@orkestrel/probe.error"))?.value !== value) return false;
+		if (_orkestrel_contract.INTRINSICS.describe(value, Symbol.for("@orkestrel/probe.ProbeError"))?.value !== value) return false;
 		const origin = _orkestrel_contract.INTRINSICS.reflect.read(value, "origin");
 		const code = _orkestrel_contract.INTRINSICS.reflect.read(value, "code");
 		const context = _orkestrel_contract.INTRINSICS.reflect.read(value, "context");
@@ -358,11 +358,11 @@ var isStage = (0, _orkestrel_contract.literalOf)(PROBE_STAGES);
 * Checks whether a value carries a proposed file's path and text.
 *
 * @remarks
-* Rejects an empty, absolute, or workspace-escaping path. A contained relative path may contain
-* `.` or may traverse to a parent that remains inside the workspace. Every stage resolves a file
-* by that path, so admitting an escape here would defer the refusal until a stage had already
-* accepted the draft. An `Issue` carries no such minimum because this package produces issues
-* rather than admits them.
+* Rejects an empty path, an absolute path, or a path that resolves outside the workspace. A
+* contained relative path may contain `.` or may traverse to a parent that remains inside the
+* workspace. Every stage resolves a file by that path, so admitting such a path here would defer
+* the refusal until a stage had already accepted the draft. An `Issue` carries no such minimum
+* because this package produces issues rather than admits them.
 *
 * @param value - The value to check
 * @returns True if the value is a draft; false otherwise
@@ -490,14 +490,14 @@ var isIssue = (0, _orkestrel_contract.recordOf)({
 * Checks whether a value carries one stage's outcome.
 *
 * @param value - The value to check
-* @returns True if the value is a check; false otherwise
+* @returns True if the value is a stage result; false otherwise
 *
 * @example
 * ```ts
-* isCheck({ stage: 'lint', elapsed: 17, issues: [] }) // true
+* isStageResult({ stage: 'lint', elapsed: 17, issues: [] }) // true
 * ```
 */
-var isCheck = (0, _orkestrel_contract.recordOf)({
+var isStageResult = (0, _orkestrel_contract.recordOf)({
 	stage: isStage,
 	elapsed: _orkestrel_contract.isNumber,
 	issues: (0, _orkestrel_contract.arrayOf)(isIssue)
@@ -543,9 +543,9 @@ var isProject = (0, _orkestrel_contract.recordOf)({
 * Checks whether a value carries a complete verdict.
 *
 * @remarks
-* Accepts any check count, because arity is the coordinator's obligation rather than this guard's:
-* a stage that could not start throws before a verdict is built, so a short list can only arrive
-* from a caller that assembled one by hand.
+* Accepts any stage result count, because arity is the coordinator's obligation rather than this
+* guard's: a stage that could not start throws before a verdict is built, so a short list can only
+* arrive from a caller that assembled one by hand.
 *
 * @param value - The value to check
 * @returns True if the value is a verdict; false otherwise
@@ -563,8 +563,8 @@ var isVerdict = (0, _orkestrel_contract.recordOf)({
 	toolchain: isToolchain,
 	project: isProject,
 	reason: _orkestrel_contract.isNonEmptyString,
-	case: (0, _orkestrel_contract.arrayOf)(isCheck),
-	control: (0, _orkestrel_contract.arrayOf)(isCheck),
+	case: (0, _orkestrel_contract.arrayOf)(isStageResult),
+	control: (0, _orkestrel_contract.arrayOf)(isStageResult),
 	elapsed: _orkestrel_contract.isNumber,
 	receipt: _orkestrel_contract.isString
 }, ["reason", "receipt"]);
@@ -610,19 +610,19 @@ function formatIssue(issue) {
 * A clean stage renders one line. The count appears even when it is zero, because that line is
 * what shows a reader the stage ran; a silent stage and a skipped stage read the same.
 *
-* @param check - The stage outcome to render
+* @param result - The stage outcome to render
 * @returns The summary line, then one indented line per issue
 *
 * @example
 * ```ts
-* formatCheck({ stage: 'lint', elapsed: 17, issues: [] })
+* formatStageResult({ stage: 'lint', elapsed: 17, issues: [] })
 * // 'lint: 0 issues (17 ms)'
 * ```
 */
-function formatCheck(check) {
-	const count = check.issues.length;
+function formatStageResult(result) {
+	const count = result.issues.length;
 	const noun = count === 1 ? "issue" : "issues";
-	return [`${check.stage}: ${count} ${noun} (${check.elapsed} ms)`, ...check.issues.map((issue) => `  ${formatIssue(issue)}`)].join("\n");
+	return [`${result.stage}: ${count} ${noun} (${result.elapsed} ms)`, ...result.issues.map((issue) => `  ${formatIssue(issue)}`)].join("\n");
 }
 /**
 * Renders the closing line a rendered verdict ends with: the receipt it earned, or its absence.
@@ -683,8 +683,8 @@ function formatReceipt(verdict) {
 * The heading lines carry everything the receipt binds, each in the name-then-value form the
 * toolchain line established: the call's identity, the claim it answered, the tools that ran, and
 * the project that judged the candidates. A verdict carrying the control's reason renders it next,
-* before either phase's checks. A reader comparing two verdicts therefore reads what differed
-* without recomputing anything.
+* before either phase's stage results. A reader comparing two verdicts therefore reads what
+* differed without recomputing anything.
 *
 * @param verdict - The verdict to render
 * @returns The identity, claim, toolchain, project, and reason when present, then every case and
@@ -706,8 +706,8 @@ function formatVerdict(verdict) {
 		tools,
 		project,
 		...reason,
-		...verdict.case.map((check) => `case ${formatCheck(check)}`),
-		...verdict.control.map((check) => `control ${formatCheck(check)}`),
+		...verdict.case.map((result) => `case ${formatStageResult(result)}`),
+		...verdict.control.map((result) => `control ${formatStageResult(result)}`),
 		formatProof(verdict)
 	].join("\n");
 }
@@ -715,8 +715,8 @@ function formatVerdict(verdict) {
 * Computes the proof token a verdict carries, or returns nothing when the claim was not proven.
 *
 * @remarks
-* A receipt is minted on these conditions together: both phases report one check per stage, the
-* case carries no issue, the control carries at least one `origin: 'claimant'` issue
+* A receipt is minted on these conditions together: both phases report one stage result per stage,
+* the case carries no issue, the control carries at least one `origin: 'claimant'` issue
 * at the stage it declared, and every other control stage carries no claimant issue. A control
 * that fails somewhere else has falsified the instrument rather than the claim, so no receipt is
 * minted for it.
@@ -742,7 +742,7 @@ function formatVerdict(verdict) {
 * refuses the receipt. A workspace issue in the control does not decide whether the claimant's
 * candidate broke, while one in the case still means that the case did not run clean.
 *
-* @param verdict - The verdict whose case and control checks decide the outcome
+* @param verdict - The verdict whose case and control stage results decide the outcome
 * @param stage - The stage the claim's control declared it must fail at
 * @returns The receipt token, or `undefined` when any condition fails
 *
@@ -754,11 +754,11 @@ function formatVerdict(verdict) {
 * ```
 */
 function computeReceipt(verdict, stage) {
-	const ran = PROBE_STAGES.every((name) => verdict.case.filter((check) => check.stage === name).length === 1 && verdict.control.filter((check) => check.stage === name).length === 1);
-	const clean = verdict.case.every((check) => check.issues.length === 0);
-	const broke = verdict.control.find((check) => check.stage === stage)?.issues.some((issue) => issue.origin === "claimant") ?? false;
-	const faulted = verdict.case.some((check) => check.issues.some((issue) => issue.origin === "instrument")) || verdict.control.some((check) => check.issues.some((issue) => issue.origin === "instrument"));
-	const stayed = verdict.control.every((check) => check.stage === stage || check.issues.every((issue) => issue.origin !== "claimant"));
+	const ran = PROBE_STAGES.every((name) => verdict.case.filter((result) => result.stage === name).length === 1 && verdict.control.filter((result) => result.stage === name).length === 1);
+	const clean = verdict.case.every((result) => result.issues.length === 0);
+	const broke = verdict.control.find((result) => result.stage === stage)?.issues.some((issue) => issue.origin === "claimant") ?? false;
+	const faulted = verdict.case.some((result) => result.issues.some((issue) => issue.origin === "instrument")) || verdict.control.some((result) => result.issues.some((issue) => issue.origin === "instrument"));
+	const stayed = verdict.control.every((result) => result.stage === stage || result.issues.every((issue) => issue.origin !== "claimant"));
 	if (!ran || !clean || !broke || faulted || !stayed) return void 0;
 	const { typescript, oxlint, vitest } = verdict.toolchain;
 	return [
@@ -922,14 +922,13 @@ exports.RUNTIME_PLUGIN = RUNTIME_PLUGIN;
 exports.TYPE_MIRROR = TYPE_MIRROR;
 exports.computeReceipt = computeReceipt;
 exports.createDestroyedError = createDestroyedError;
-exports.formatCheck = formatCheck;
 exports.formatIssue = formatIssue;
 exports.formatProof = formatProof;
 exports.formatReceipt = formatReceipt;
 exports.formatSpecification = formatSpecification;
+exports.formatStageResult = formatStageResult;
 exports.formatVerdict = formatVerdict;
 exports.isCase = isCase;
-exports.isCheck = isCheck;
 exports.isClaim = isClaim;
 exports.isControl = isControl;
 exports.isDraft = isDraft;
@@ -938,6 +937,7 @@ exports.isParty = isParty;
 exports.isProbeError = isProbeError;
 exports.isProject = isProject;
 exports.isStage = isStage;
+exports.isStageResult = isStageResult;
 exports.isToolchain = isToolchain;
 exports.isVerdict = isVerdict;
 exports.matchesSpecification = matchesSpecification;

package/dist/src/core/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","names":["isError","holds","INTRINSICS","isObject","isFunction","isString","isNumber","literalOf","recordOf","andOf","isNonEmptyString","isString","arrayOf","isLSPRange","isNumber","objectShape","stringShape","arrayShape","literalShape"],"sources":["../../../src/core/constants.ts","../../../src/core/errors.ts","../../../src/core/validators.ts","../../../src/core/helpers.ts","../../../src/core/shapers.ts"],"sourcesContent":["/**\n * Lists the stages a claim passes through, in the order a verdict reports them:\n * `['type', 'lint', 'runtime']`.\n *\n * @remarks\n * One list feeds the `Stage` type, the wire shape, the stage guard, and the receipt computation, so\n * a stage cannot be admitted by one and refused by another. The type derives from this list rather\n * than standing beside it, so a stage the list omits is a stage no member of the union names.\n *\n * @example\n * ```ts\n * PROBE_STAGES // ['type', 'lint', 'runtime']\n * ```\n */\nexport const PROBE_STAGES = Object.freeze(['type', 'lint', 'runtime'] as const)\n\n/**\n * Lists the parties that can own action on an issue or probe failure:\n * `['claimant', 'workspace', 'instrument']`.\n *\n * @remarks\n * One list feeds the `Party` type and its guard, so a party cannot be admitted by one and refused\n * by another.\n *\n * @example\n * ```ts\n * PROBE_PARTIES // ['claimant', 'workspace', 'instrument']\n * ```\n */\nexport const PROBE_PARTIES = Object.freeze(['claimant', 'workspace', 'instrument'] as const)\n\n/**\n * Lists the conditions that can end a probe operation:\n * `['refused', 'missing', 'malformed', 'destroyed', 'deadline']`.\n *\n * @remarks\n * One list feeds the code union and the error guard, so a condition cannot be constructed by one\n * and refused by the other. The guard reads this list rather than the class, which is what lets it\n * refuse a lookalike carrying a condition this package never declared.\n *\n * @example\n * ```ts\n * PROBE_ERROR_CODES // ['refused', 'missing', 'malformed', 'destroyed', 'deadline']\n * ```\n */\nexport const PROBE_ERROR_CODES = Object.freeze([\n\t'refused',\n\t'missing',\n\t'malformed',\n\t'destroyed',\n\t'deadline',\n] as const)\n\n/**\n * Names the leading token every receipt carries, `'probe'`.\n *\n * @remarks\n * A receipt travels away from the verdict that minted it — an agent pastes it into the promotion\n * action — so it names itself rather than relying on where it was found.\n *\n * @example\n * ```ts\n * const receipt =\n * \t'probe:6ca20c3bff623031d3955b9d1a76d71d:type:typescript@6.0.3:oxlint@1.79.0:vitest@4.1.11:configs/src/tsconfig.core.json@d61f11b52460b1c6707cfac2c6078d59'\n * receipt.startsWith(RECEIPT_PREFIX) // true\n * ```\n */\nexport const RECEIPT_PREFIX = 'probe'\n\n/**\n * Names the character joining a receipt's tokens, `':'`.\n *\n * @remarks\n * A project path can contain this character, so the project field goes last and a reader rejoins\n * every field from index 6 onward with this separator rather than expecting a fixed count.\n *\n * @example\n * ```ts\n * const receipt =\n * \t'probe:6ca20c3bff623031d3955b9d1a76d71d:type:typescript@6.0.3:oxlint@1.79.0:vitest@4.1.11:configs/src/tsconfig.core.json@d61f11b52460b1c6707cfac2c6078d59'\n * receipt.split(RECEIPT_SEPARATOR).length // 7\n * ```\n */\nexport const RECEIPT_SEPARATOR = ':'\n\n/**\n * Names the default inspection deadline a `Probe` applies when its construction omits one,\n * 30,000 ms.\n *\n * @remarks\n * `ProbeOptions.deadline` overrides this value per instance.\n *\n * @example\n * ```ts\n * PROBE_DEADLINE // 30_000\n * ```\n */\nexport const PROBE_DEADLINE = 30_000\n\n/**\n * Bounds the default type warm at 90,000 ms, independently of active inspections.\n *\n * @remarks\n * `ProbeOptions.warm` overrides this value. Veneer's slowest measured warm on 2026-10-05 took\n * 50,000 ms; this bound leaves 40,000 ms for host contention without changing inspection budgets.\n *\n * @example\n * ```ts\n * PROBE_WARM // 90_000\n * ```\n */\nexport const PROBE_WARM = 90_000\n\n/**\n * Bounds consecutive failed warms or idle losses before a stage's floor is spent.\n *\n * @example\n * ```ts\n * PROBE_RESTARTS // 1\n * ```\n */\nexport const PROBE_RESTARTS = 1\n\n/**\n * Names the 2,000 ms bound the lint stage holds over the lifecycle exchanges the protocol leaves\n * to the server: the `initialize` reply warming waits for and the `shutdown` reply ending waits for.\n *\n * @remarks\n * It does not reach the diagnostics an inspection waits for, which the caller's own signal bounds.\n * The transport's cooperative window is half of it; `LINT_TEARDOWN` also accounts for process\n * termination and exit confirmation. Measured 2026-08-27: the workspace `oxlint --lsp` answers\n * `initialize` in 155 ms, so\n * this bound is more than ten times that reply.\n *\n * @example\n * ```ts\n * LINT_DEADLINE // 2_000\n * ```\n */\nexport const LINT_DEADLINE = 2_000\n\n/**\n * Bounds lint teardown at 16,000 ms, including protocol exchanges and process termination.\n *\n * @remarks\n * Shutdown and exit each have `LINT_DEADLINE`; transport grace and stream drain each have half\n * that bound. The installed process transport permits 5,000 ms for Windows tree termination and\n * another 5,000 ms for exit confirmation. This also covers POSIX escalation's shorter grace.\n * The process confirmation constant is not exposed by the declared LSP dependency.\n *\n * @example\n * ```ts\n * LINT_TEARDOWN // 16_000\n * ```\n */\nexport const LINT_TEARDOWN = LINT_DEADLINE * 3 + 5_000 * 2\n\n/**\n * Names the total enumerable key bound `ProbeServer` applies to inbound metadata and to produced\n * tool content alike, 4096.\n *\n * @remarks\n * `@orkestrel/mcp`'s default leaf is sized for metadata: a verdict costs 38 keys empty and 11 more\n * for each issue a stage reports, so the default carries a verdict whose control refuses one\n * declaration and stops carrying the next one. A whole tool-call result carrying the record beside\n * its rendering costs 44 keys plus 11 for each issue, so this bound carries a record reporting up\n * to 368 issues. Past that the reply falls back to the rendered text, and past the 4 MiB content\n * bound to the receipt block.\n *\n * @example\n * ```ts\n * PROBE_KEYS // 4096\n * ```\n */\nexport const PROBE_KEYS = 4096\n\n/**\n * Names the specification lifetime the runtime stage replaces its resident Vitest service at,\n * 64 specifications.\n *\n * @remarks\n * Vite retains one unresolved URL for every fresh specification path, so an inspection that writes\n * a specification grows a map the resident service never releases. The stage replaces that service\n * rather than deleting from each map it owns, and this is the count of specifications one service\n * carries before the replacement. Any bound holds the retention flat, because the replacement\n * releases everything the instance held; this value trades the cost of the replacement against how\n * far the map grows between them. On 2026-08-20, over this package's own workspace on the host\n * `guides/probe.md` § Cost names, two runs of 66 inspections put the crossing inspection at 480 ms\n * and 269 ms against median inspections of 156 ms and 155 ms.\n *\n * @example\n * ```ts\n * PROBE_SPECIFICATIONS // 64\n * ```\n */\nexport const PROBE_SPECIFICATIONS = 64\n\n/**\n * Names the Vite plugin the runtime stage installs into a target workspace's Vitest\n * configuration, `'orkestrel-runtime-overlay'`.\n *\n * @remarks\n * The stage declares the plugin under this name and reads a configured project's plugin list for\n * the same name to decide whether that project carries the overlay. One name feeds both, so a\n * project the stage instrumented is never reported as a workspace project it could not reach.\n *\n * @example\n * ```ts\n * RUNTIME_PLUGIN // 'orkestrel-runtime-overlay'\n * ```\n */\nexport const RUNTIME_PLUGIN = 'orkestrel-runtime-overlay'\n\n/**\n * Names the workspace-relative directory the type stage keeps its workspace mirror under,\n * `'tmp/type'`.\n *\n * @remarks\n * Each stage owns one directory beneath this one, named for the writing host's process id and a\n * fresh UUID, and deletes it at teardown. The directory sits under `tmp/` so nothing the stage\n * writes reaches a version-controlled path, and beside `tmp/probes/` rather than inside it because\n * the workbench Vitest project collects `tmp/probes/**` and would otherwise collect a mirrored test.\n * A target that runs its own `check`, `lint:check`, or `format:check` while a probe is resident\n * reads whatever it does not exclude, so exclude this directory there.\n *\n * @example\n * ```ts\n * TYPE_MIRROR // 'tmp/type'\n * ```\n */\nexport const TYPE_MIRROR = 'tmp/type'\n","import type { Party, ProbeErrorCode, ProbeErrorContext, ProbeErrorOptions } from './types.js'\nimport {\n\tINTRINSICS,\n\tholds,\n\tisError,\n\tisFunction,\n\tisNumber,\n\tisObject,\n\tisString,\n} from '@orkestrel/contract'\nimport { PROBE_ERROR_CODES, PROBE_PARTIES } from './constants.js'\n\n/**\n * Reports one probe failure under stable ownership and condition axes.\n *\n * @remarks\n * Every failure raised while serving a claim arrives as one of these, so a consumer catching from\n * `prove`, from a stage, or from a workspace leaf branches on {@link Party} and\n * {@link ProbeErrorCode} rather than on message text. Narrow a caught value with\n * {@link isProbeError} before reading either member. A pure leaf called directly with a value\n * `isClaim` would refuse raises the host's own fault unchanged, because those leaves are written to\n * be total over a validated claim rather than over every value.\n *\n * @example\n * ```ts\n * const error = new ProbeError('Path escapes the workspace: ../secrets.env', {\n * \torigin: 'claimant',\n * \tcode: 'refused',\n * \tcontext: { path: '../secrets.env' },\n * })\n * error.origin // 'claimant'\n * error.code // 'refused'\n * error.context?.path // '../secrets.env'\n * ```\n */\nexport class ProbeError extends Error {\n\toverride readonly name = 'ProbeError'\n\treadonly origin: Party\n\treadonly code: ProbeErrorCode\n\treadonly context?: ProbeErrorContext\n\n\t/**\n\t * Creates one classified probe failure.\n\t *\n\t * @param message - Human-readable description of what failed\n\t * @param options - The ownership, condition, optional structured context, and optional cause\n\t */\n\tconstructor(message: string, options: ProbeErrorOptions) {\n\t\tconst cause = options.cause\n\t\tsuper(message, cause === undefined ? undefined : { cause })\n\t\tObject.defineProperty(this, Symbol.for('@orkestrel/probe.error'), { value: this })\n\t\tthis.origin = options.origin\n\t\tthis.code = options.code\n\t\tif (options.context !== undefined) this.context = options.context\n\t}\n}\n\n/**\n * Checks whether an unknown value is a {@link ProbeError}.\n *\n * @remarks\n * Recognition requires the native `Error` base, a non-base prototype, an own global brand holding\n * the error itself, a declared party and condition, and context members of their declared types.\n * The brand carries recognition across duplicate installations and module formats. A subclass may\n * replace `name`. A transparent proxy, a plain `Error`, a property-only lookalike, and an error with\n * invalid members stay outside the type.\n *\n * @param value - The value to inspect\n * @returns True if the value is a `ProbeError` instance; false otherwise\n *\n * @example\n * ```ts\n * isProbeError(createDestroyedError('probe')) // true\n * isProbeError(new Error('The probe has been destroyed')) // false\n * ```\n */\nexport function isProbeError(value: unknown): value is ProbeError {\n\tif (!isError(value)) return false\n\treturn holds(() => {\n\t\tif (INTRINSICS.prototype(value) === Error.prototype) return false\n\t\tconst descriptor = INTRINSICS.describe(value, Symbol.for('@orkestrel/probe.error'))\n\t\tif (descriptor?.value !== value) return false\n\t\tconst origin: unknown = INTRINSICS.reflect.read(value, 'origin')\n\t\tconst code: unknown = INTRINSICS.reflect.read(value, 'code')\n\t\tconst context: unknown = INTRINSICS.reflect.read(value, 'context')\n\t\tif (context !== undefined) {\n\t\t\tif (!isObject(context) && !isFunction(context)) return false\n\t\t\tconst stage: unknown = INTRINSICS.reflect.read(context, 'stage')\n\t\t\tif (stage !== undefined && stage !== 'type' && stage !== 'lint' && stage !== 'runtime')\n\t\t\t\treturn false\n\t\t\tfor (const key of ['path', 'project', 'name']) {\n\t\t\t\tconst member: unknown = INTRINSICS.reflect.read(context, key)\n\t\t\t\tif (member !== undefined && !isString(member)) return false\n\t\t\t}\n\t\t\tconst deadline: unknown = INTRINSICS.reflect.read(context, 'deadline')\n\t\t\tif (deadline !== undefined && !isNumber(deadline)) return false\n\t\t}\n\t\treturn (\n\t\t\tPROBE_PARTIES.some((declared) => declared === origin) &&\n\t\t\tPROBE_ERROR_CODES.some((declared) => declared === code)\n\t\t)\n\t})\n}\n\n/**\n * Creates the failure raised when an instrument is used after it was torn down.\n *\n * @remarks\n * Every resident entity in this package refuses this way, so the subject names which one in the\n * message and the condition is the same for all of them. A caller that meets this builds a\n * replacement rather than retrying: teardown is permanent.\n *\n * @param subject - The torn-down entity, named as the message names it, such as `type stage`\n * @returns A typed teardown failure\n *\n * @example\n * ```ts\n * createDestroyedError('type stage').message // 'The type stage has been destroyed'\n * createDestroyedError('probe').code // 'destroyed'\n * ```\n */\nexport function createDestroyedError(subject: string): ProbeError {\n\treturn new ProbeError(`The ${subject} has been destroyed`, {\n\t\torigin: 'claimant',\n\t\tcode: 'destroyed',\n\t})\n}\n","import type { Guard } from '@orkestrel/contract'\nimport type {\n\tCase,\n\tCheck,\n\tClaim,\n\tControl,\n\tDraft,\n\tIssue,\n\tParty,\n\tProject,\n\tStage,\n\tToolchain,\n\tVerdict,\n} from './types.js'\nimport {\n\tandOf,\n\tarrayOf,\n\tisNonEmptyString,\n\tisNumber,\n\tisString,\n\tliteralOf,\n\trecordOf,\n} from '@orkestrel/contract'\nimport { isLSPRange } from '@orkestrel/lsp'\nimport { PROBE_PARTIES, PROBE_STAGES } from './constants.js'\n\n/**\n * Checks whether a value names a stage.\n *\n * @param value - The value to check\n * @returns True if the value is a stage name; false otherwise\n *\n * @example\n * ```ts\n * isStage('lint') // true\n * isStage('typecheck') // false\n * ```\n */\nexport const isStage: Guard<Stage> = literalOf(PROBE_STAGES)\n\n/**\n * Checks whether a value carries a proposed file's path and text.\n *\n * @remarks\n * Rejects an empty, absolute, or workspace-escaping path. A contained relative path may contain\n * `.` or may traverse to a parent that remains inside the workspace. Every stage resolves a file\n * by that path, so admitting an escape here would defer the refusal until a stage had already\n * accepted the draft. An `Issue` carries no such minimum because this package produces issues\n * rather than admits them.\n *\n * @param value - The value to check\n * @returns True if the value is a draft; false otherwise\n *\n * @example\n * ```ts\n * const text = \"export function createGreeting(): string {\\n\\treturn 'hi'\\n}\\n\"\n * isDraft({ path: 'src/core/factories.ts', text }) // true\n * isDraft({ path: '../../etc/hosts', text: '' }) // false\n * isDraft({ path: 'src/core/factories.ts' }) // false\n * ```\n */\nexport const isDraft: Guard<Draft> = recordOf({\n\tpath: andOf<string>(isNonEmptyString, (path) => {\n\t\tif (/^(?:[\\\\/]|[A-Za-z]:)/.test(path)) return false\n\t\treturn (\n\t\t\tpath.split(/[\\\\/]+/).reduce((depth, segment) => {\n\t\t\t\tif (depth < 0 || segment === '' || segment === '.') return depth\n\t\t\t\treturn segment === '..' ? depth - 1 : depth + 1\n\t\t\t}, 0) >= 0\n\t\t)\n\t}),\n\ttext: isString,\n})\n\n/**\n * Checks whether a value carries a claim's candidate drafts and its test.\n *\n * @param value - The value to check\n * @returns True if the value is a case; false otherwise\n *\n * @example\n * ```ts\n * const test = { path: 'tests/src/core/greeting.test.ts', text: 'test(\"greets\", () => {})\\n' }\n * isCase({ files: [], test }) // true\n * ```\n */\nexport const isCase: Guard<Case> = recordOf({ files: arrayOf(isDraft), test: isDraft })\n\n/**\n * Checks whether a value carries a case plus the stage and reason it must fail for.\n *\n * @param value - The value to check\n * @returns True if the value is a control; false otherwise\n *\n * @example\n * ```ts\n * const test = { path: 'tests/src/core/greeting.test.ts', text: 'test(\"greets\", () => {})\\n' }\n * isControl({ files: [], test, stage: 'type', reason: 'must not compile' }) // true\n * isControl({ files: [], test }) // false\n * ```\n */\nexport const isControl: Guard<Control> = recordOf({\n\tfiles: arrayOf(isDraft),\n\ttest: isDraft,\n\tstage: isStage,\n\treason: isNonEmptyString,\n})\n\n/**\n * Checks whether a value carries a project, a case, and a control.\n *\n * @remarks\n * Exact rather than open: a claim is this package's own record, so an unknown member is a caller\n * sending a contract this service does not implement rather than a wider caller it must tolerate.\n *\n * `CLAIM_SHAPE` is the wire contract's shape and this is the admission rule the tool enforces, and\n * the rule is strictly narrower than the shape. They agree on every member but `Draft.path`: the\n * shape constrains it to a non-empty string, while `isDraft` also refuses an absolute path\n * and one that traverses out of the workspace, so `../../etc/hosts` satisfies\n * `compileGuard(CLAIM_SHAPE)` and is refused here. `ProbeServer` advertises the shape and enforces\n * this rule, so it names the refused member rather than reporting only that the claim was invalid.\n *\n * @param value - The value to check\n * @returns True if the value is a claim; false otherwise\n *\n * @example\n * ```ts\n * isClaim({ project: 'tsconfig.json', case: subject, control }) // true\n * isClaim({ project: 'tsconfig.json', case: subject }) // false\n * ```\n */\nexport const isClaim: Guard<Claim> = recordOf({\n\tproject: isNonEmptyString,\n\tcase: isCase,\n\tcontrol: isControl,\n})\n\n/**\n * Checks whether a value names a party an issue carries.\n *\n * @param value - The value to check\n * @returns True if the value is a party; false otherwise\n *\n * @example\n * ```ts\n * isParty('claimant') // true\n * isParty('workspace') // true\n * isParty('instrument') // true\n * isParty('stage') // false\n * ```\n */\nexport const isParty: Guard<Party> = literalOf(PROBE_PARTIES)\n\n/**\n * Checks whether a value carries one message, its location, and the origin of the fault it names.\n *\n * @remarks\n * `origin` is required rather than optional. Every issue this package produces sets it, and a\n * receipt turns on it: a control's issue disproves the claim only when its origin names the\n * claimant.\n *\n * @param value - The value to check\n * @returns True if the value is an issue; false otherwise\n *\n * @example\n * ```ts\n * isIssue({ origin: 'claimant', path: 'src/core/greeting.ts', message: 'not assignable' }) // true\n * isIssue({ path: 'src/core/greeting.ts', message: 'not assignable' }) // false\n * ```\n */\nexport const isIssue: Guard<Issue> = recordOf(\n\t{ origin: isParty, path: isString, message: isString, range: isLSPRange },\n\t['range'],\n)\n\n/**\n * Checks whether a value carries one stage's outcome.\n *\n * @param value - The value to check\n * @returns True if the value is a check; false otherwise\n *\n * @example\n * ```ts\n * isCheck({ stage: 'lint', elapsed: 17, issues: [] }) // true\n * ```\n */\nexport const isCheck: Guard<Check> = recordOf({\n\tstage: isStage,\n\telapsed: isNumber,\n\tissues: arrayOf(isIssue),\n})\n\n/**\n * Checks whether a value names every resolved tool version.\n *\n * @param value - The value to check\n * @returns True if the value is a toolchain; false otherwise\n *\n * @example\n * ```ts\n * isToolchain({ typescript: '6.0.3', oxlint: '1.79.0', vitest: '4.1.11' }) // true\n * isToolchain({ typescript: '6.0.3' }) // false\n * ```\n */\nexport const isToolchain: Guard<Toolchain> = recordOf({\n\ttypescript: isString,\n\toxlint: isString,\n\tvitest: isString,\n})\n\n/**\n * Checks whether a value names one resolved TypeScript project and what it contained.\n *\n * @remarks\n * Rejects an empty path and an empty digest. A verdict names the project that judged it, so a\n * blank member here would report a project the type stage never applied.\n *\n * @param value - The value to check\n * @returns True if the value is a project; false otherwise\n *\n * @example\n * ```ts\n * isProject({ path: 'configs/src/tsconfig.core.json', digest: '3b674fdf121c85ef' }) // true\n * isProject({ path: 'configs/src/tsconfig.core.json', digest: '' }) // false\n * ```\n */\nexport const isProject: Guard<Project> = recordOf({\n\tpath: isNonEmptyString,\n\tdigest: isNonEmptyString,\n})\n\n/**\n * Checks whether a value carries a complete verdict.\n *\n * @remarks\n * Accepts any check count, because arity is the coordinator's obligation rather than this guard's:\n * a stage that could not start throws before a verdict is built, so a short list can only arrive\n * from a caller that assembled one by hand.\n *\n * @param value - The value to check\n * @returns True if the value is a verdict; false otherwise\n *\n * @example\n * ```ts\n * const basis = { id: '01J8Z0', digest: '6ca20c3b', toolchain, project, elapsed: 337 }\n * isVerdict({ ...basis, case: [], control: [] }) // true\n * isVerdict({ ...basis, case: [] }) // false\n * ```\n */\nexport const isVerdict: Guard<Verdict> = recordOf(\n\t{\n\t\tid: isString,\n\t\tdigest: isString,\n\t\ttoolchain: isToolchain,\n\t\tproject: isProject,\n\t\treason: isNonEmptyString,\n\t\tcase: arrayOf(isCheck),\n\t\tcontrol: arrayOf(isCheck),\n\t\telapsed: isNumber,\n\t\treceipt: isString,\n\t},\n\t['reason', 'receipt'],\n)\n","import type { Check, Issue, Stage, Verdict } from './types.js'\nimport { PROBE_STAGES, RECEIPT_PREFIX, RECEIPT_SEPARATOR } from './constants.js'\n\n/**\n * Renders one tool message as a single line an agent can classify and locate.\n *\n * @remarks\n * `Issue.range` is stored zero-based, and this is the only place it is rendered, so the one-based\n * line an editor shows is derived here and nowhere else. The rendered location carries the line\n * alone: a reader opens a file at a line, and the column would widen every issue line in every\n * verdict for a precision that address does not use.\n *\n * @param issue - The message and location a stage reported\n * @returns The bracketed origin, location, and message, separated by spaces\n *\n * @example\n * ```ts\n * const located: Issue = {\n * \torigin: 'claimant',\n * \tpath: 'src/core/greeting.ts',\n * \tmessage: 'not assignable',\n * \trange: { start: { line: 0, character: 6 }, end: { line: 0, character: 13 } },\n * }\n * const whole: Issue = {\n * \torigin: 'claimant',\n * \tpath: 'src/core/greeting.ts',\n * \tmessage: 'not assignable',\n * }\n * formatIssue(located) // '[claimant] src/core/greeting.ts:1 not assignable'\n * formatIssue(whole) // '[claimant] src/core/greeting.ts not assignable'\n * ```\n */\nexport function formatIssue(issue: Issue): string {\n\tconst range = issue.range\n\tconst where = range === undefined ? issue.path : `${issue.path}:${range.start.line + 1}`\n\treturn `[${issue.origin}] ${where} ${issue.message}`\n}\n\n/**\n * Renders one stage's outcome as its summary line followed by every message it reported.\n *\n * @remarks\n * A clean stage renders one line. The count appears even when it is zero, because that line is\n * what shows a reader the stage ran; a silent stage and a skipped stage read the same.\n *\n * @param check - The stage outcome to render\n * @returns The summary line, then one indented line per issue\n *\n * @example\n * ```ts\n * formatCheck({ stage: 'lint', elapsed: 17, issues: [] })\n * // 'lint: 0 issues (17 ms)'\n * ```\n */\nexport function formatCheck(check: Check): string {\n\tconst count = check.issues.length\n\tconst noun = count === 1 ? 'issue' : 'issues'\n\tconst summary = `${check.stage}: ${count} ${noun} (${check.elapsed} ms)`\n\tconst lines = check.issues.map((issue) => `  ${formatIssue(issue)}`)\n\treturn [summary, ...lines].join('\\n')\n}\n\n/**\n * Renders the closing line a rendered verdict ends with: the receipt it earned, or its absence.\n *\n * @remarks\n * One implementation serves every rendering of that line, so the line a reader quotes off a whole\n * verdict and the line a bounded reply falls back to cannot drift apart.\n *\n * @param verdict - The verdict whose `receipt` decides the line\n * @returns `receipt <token>` when the verdict carries a receipt, and `no receipt` when it does not\n *\n * @example\n * ```ts\n * formatProof(proven)\n * // 'receipt probe:6ca20c3bff623031d3955b9d1a76d71d:type:typescript@6.0.3:oxlint@1.79.0:vitest@4.1.11:configs/src/tsconfig.core.json@d61f11b52460b1c6707cfac2c6078d59'\n * formatProof(disproven) // 'no receipt'\n * ```\n */\nexport function formatProof(verdict: Verdict): string {\n\treturn verdict.receipt === undefined ? 'no receipt' : `receipt ${verdict.receipt}`\n}\n\n/**\n * Renders the smallest text a verdict can travel as: what it judged, and how it ended.\n *\n * @remarks\n * A reply whose bounds refuse both the record and the whole rendering answers with this text, so it\n * carries what a reader cannot recompute — the call's identity, the claim's digest, and the\n * control's reason when the verdict carries one — and closes with the same line `formatVerdict`\n * closes with. Every line here is a line `formatVerdict` renders at the same position relative to\n * the ones around it, so a reader meets one shape whichever answer arrived.\n *\n * @param verdict - The verdict to render\n * @returns The identity and claim lines, the reason when present, then the closing receipt line\n *\n * @example\n * ```ts\n * formatReceipt(disproven).split('\\n')\n * // ['probe 88a5addc-7d33-40dc-9a5a-104b71f8787d (549 ms)', 'claim 6ca20c3bff623031d3955b9d1a76d71d', 'no receipt']\n * ```\n */\nexport function formatReceipt(verdict: Verdict): string {\n\tconst reason = verdict.reason === undefined ? [] : [`reason ${verdict.reason}`]\n\treturn [\n\t\t`probe ${verdict.id} (${verdict.elapsed} ms)`,\n\t\t`claim ${verdict.digest}`,\n\t\t...reason,\n\t\tformatProof(verdict),\n\t].join('\\n')\n}\n\n/**\n * Renders a whole verdict as the text an agent reads.\n *\n * @remarks\n * Every stage appears for both the case and the control, so no failing stage can be masked by an\n * earlier one. The closing line always states the receipt or its absence, so a reader never has to\n * infer from silence whether the claim was proven.\n *\n * The heading lines carry everything the receipt binds, each in the name-then-value form the\n * toolchain line established: the call's identity, the claim it answered, the tools that ran, and\n * the project that judged the candidates. A verdict carrying the control's reason renders it next,\n * before either phase's checks. A reader comparing two verdicts therefore reads what differed\n * without recomputing anything.\n *\n * @param verdict - The verdict to render\n * @returns The identity, claim, toolchain, project, and reason when present, then every case and\n * control stage, then the receipt line\n *\n * @example\n * ```ts\n * formatVerdict(verdict).split('\\n')[1] // 'claim 6ca20c3bff623031d3955b9d1a76d71d'\n * ```\n */\nexport function formatVerdict(verdict: Verdict): string {\n\tconst { typescript, oxlint, vitest } = verdict.toolchain\n\tconst tools = `toolchain typescript ${typescript}, oxlint ${oxlint}, vitest ${vitest}`\n\tconst project = `project ${verdict.project.path} ${verdict.project.digest}`\n\tconst reason = verdict.reason === undefined ? [] : [`reason ${verdict.reason}`]\n\treturn [\n\t\t`probe ${verdict.id} (${verdict.elapsed} ms)`,\n\t\t`claim ${verdict.digest}`,\n\t\ttools,\n\t\tproject,\n\t\t...reason,\n\t\t...verdict.case.map((check) => `case ${formatCheck(check)}`),\n\t\t...verdict.control.map((check) => `control ${formatCheck(check)}`),\n\t\tformatProof(verdict),\n\t].join('\\n')\n}\n\n/**\n * Computes the proof token a verdict carries, or returns nothing when the claim was not proven.\n *\n * @remarks\n * A receipt is minted on these conditions together: both phases report one check per stage, the\n * case carries no issue, the control carries at least one `origin: 'claimant'` issue\n * at the stage it declared, and every other control stage carries no claimant issue. A control\n * that fails somewhere else has falsified the instrument rather than the claim, so no receipt is\n * minted for it.\n *\n * Both phases owe every stage, not the case alone. `stayed` reads the control entries a verdict\n * carries, so a control that omits a stage entirely would otherwise read as a stage that stayed\n * clean, and the receipt would certify an inspection that never ran. `prove` records every stage\n * for both phases, so this condition refuses only a verdict a caller assembled by hand.\n *\n * The token names every condition the verdict was reached under, so a receipt read away from its\n * verdict still says what was judged and what judged it: the claim's digest, the stage the control\n * broke at, the tool versions, and the project the candidate drafts were checked against.\n * The call's identity is deliberately absent. It carries no integrity and it is the only value\n * stopping two honest runs of one claim from producing one comparable string, so leaving it out is\n * what makes \"re-run `prove` and compare tokens\" a verification a reader can perform.\n *\n * The project goes last, and its own path and digest are joined by `@`. Split the token on\n * `RECEIPT_SEPARATOR`, take fields 0 through 5, and rejoin the remainder with that separator to\n * read the project field; inside it the digest is everything after the final `@`. That rule stays\n * total for a workspace-relative project path containing either character.\n *\n * An `origin: 'instrument'` issue in either phase means the inspection did not complete and\n * refuses the receipt. A workspace issue in the control does not decide whether the claimant's\n * candidate broke, while one in the case still means that the case did not run clean.\n *\n * @param verdict - The verdict whose case and control checks decide the outcome\n * @param stage - The stage the claim's control declared it must fail at\n * @returns The receipt token, or `undefined` when any condition fails\n *\n * @example\n * ```ts\n * computeReceipt(proven, 'type')\n * // 'probe:6ca20c3bff623031d3955b9d1a76d71d:type:typescript@6.0.3:oxlint@1.79.0:vitest@4.1.11:configs/src/tsconfig.core.json@d61f11b52460b1c6707cfac2c6078d59'\n * computeReceipt(proven, 'lint') // undefined\n * ```\n */\nexport function computeReceipt(verdict: Verdict, stage: Stage): string | undefined {\n\tconst ran = PROBE_STAGES.every(\n\t\t(name) =>\n\t\t\tverdict.case.filter((check) => check.stage === name).length === 1 &&\n\t\t\tverdict.control.filter((check) => check.stage === name).length === 1,\n\t)\n\tconst clean = verdict.case.every((check) => check.issues.length === 0)\n\tconst declared = verdict.control.find((check) => check.stage === stage)\n\tconst broke = declared?.issues.some((issue) => issue.origin === 'claimant') ?? false\n\tconst faulted =\n\t\tverdict.case.some((check) => check.issues.some((issue) => issue.origin === 'instrument')) ||\n\t\tverdict.control.some((check) => check.issues.some((issue) => issue.origin === 'instrument'))\n\tconst stayed = verdict.control.every(\n\t\t(check) => check.stage === stage || check.issues.every((issue) => issue.origin !== 'claimant'),\n\t)\n\tif (!ran || !clean || !broke || faulted || !stayed) return undefined\n\tconst { typescript, oxlint, vitest } = verdict.toolchain\n\treturn [\n\t\tRECEIPT_PREFIX,\n\t\tverdict.digest,\n\t\tstage,\n\t\t`typescript@${typescript}`,\n\t\t`oxlint@${oxlint}`,\n\t\t`vitest@${vitest}`,\n\t\t`${verdict.project.path}@${verdict.project.digest}`,\n\t].join(RECEIPT_SEPARATOR)\n}\n\n/**\n * Renders one generated specification: the caller's own test text, then the marker naming the\n * revision that wrote it.\n *\n * @remarks\n * The marker is what makes a file in a target workspace attributable to this package. A generated\n * specification carries text the caller supplied, so its name alone cannot separate it from a\n * developer's own file, and a sweep reading the name alone deletes that file. The marker goes last\n * so every line of the caller's text keeps the number a reported stack frame gives it, and the text\n * gains a terminating newline first so the marker is never appended to a line of the test.\n *\n * @param text - The caller's own test text\n * @param revision - The writing host's process id and a fresh UUID, joined by `-`\n * @returns The bytes the runtime stage writes for that revision\n *\n * @example\n * ```ts\n * formatSpecification(\"test('greets', () => {})\\n\", '4821-9f0c')\n * // \"test('greets', () => {})\\n// @orkestrel/probe generated specification 4821-9f0c\\n\"\n * ```\n */\nexport function formatSpecification(text: string, revision: string): string {\n\tconst body = text === '' || text.endsWith('\\n') ? text : `${text}\\n`\n\treturn `${body}// @orkestrel/probe generated specification ${revision}\\n`\n}\n\n/**\n * Checks whether one file's text is the generated specification written for one revision.\n *\n * @remarks\n * Reads the marker `formatSpecification` writes, taken from that function rather than restated, so\n * the writer and the reader cannot drift apart. An empty body renders the marker alone, which is\n * why the comparison is built from a call rather than from a second copy of the text.\n *\n * @param text - The file's full contents\n * @param revision - The revision the file's name declares\n * @returns True if the text ends with this package's marker for that revision; false otherwise\n *\n * @example\n * ```ts\n * matchesSpecification(formatSpecification('', '4821-9f0c'), '4821-9f0c') // true\n * matchesSpecification('export const NOTE = 1\\n', '4821-9f0c') // false\n * ```\n */\nexport function matchesSpecification(text: string, revision: string): boolean {\n\treturn text.endsWith(formatSpecification('', revision))\n}\n","import { arrayShape, literalShape, objectShape, stringShape } from '@orkestrel/contract'\nimport { PROBE_STAGES } from './constants.js'\n\n/**\n * Describes one proposed file a claim carries.\n *\n * @remarks\n * `path` is constrained to a non-empty string because every stage resolves a file by it, so an\n * empty path names no file. That minimum is the whole of the constraint here, and it is the one\n * place the wire contract is wider than what this package admits: `isDraft` enforces the same\n * minimum and also refuses an absolute path and one that traverses out of the workspace, which no\n * JSON Schema keyword can express. A caller that satisfies this shape can still be refused, and\n * `ProbeServer` names the member when it is.\n *\n * @example\n * ```ts\n * compileGuard(DRAFT_SHAPE)({ path: 'src/core/greeting.ts', text: '' }) // true\n * ```\n */\nexport const DRAFT_SHAPE = objectShape(\n\t{\n\t\tpath: stringShape({ min: 1, description: 'Workspace-relative path, which need not exist.' }),\n\t\ttext: stringShape({ description: \"The file's full contents.\" }),\n\t},\n\t{ description: 'One proposed file a claim carries.' },\n)\n\n/**\n * Describes the drafts a claim asserts about and the test that exercises them.\n *\n * @example\n * ```ts\n * const test = { path: 'tests/src/core/greeting.test.ts', text: '' }\n * compileGuard(CASE_SHAPE)({ files: [], test }) // true\n * ```\n */\nexport const CASE_SHAPE = objectShape(\n\t{\n\t\tfiles: arrayShape(DRAFT_SHAPE, { description: 'The candidate drafts the test imports.' }),\n\t\ttest: DRAFT_SHAPE,\n\t},\n\t{ description: 'The drafts a claim asserts about, and the test that exercises them.' },\n)\n\n/**\n * Describes the negative control, which is a case plus where and why it must break.\n *\n * @remarks\n * Built from `CASE_SHAPE`'s own properties rather than a second copy of them, so the control and\n * the case cannot describe a draft differently.\n *\n * @example\n * ```ts\n * const test = { path: 'tests/src/core/greeting.test.ts', text: '' }\n * compileGuard(CONTROL_SHAPE)({ files: [], test, stage: 'type', reason: 'must not compile' }) // true\n * ```\n */\nexport const CONTROL_SHAPE = objectShape(\n\t{\n\t\t...CASE_SHAPE.properties,\n\t\tstage: literalShape(PROBE_STAGES, { description: 'The stage this control must fail at.' }),\n\t\treason: stringShape({ min: 1, description: 'Why the control fails at that stage.' }),\n\t},\n\t{ description: 'A case that must fail, naming the stage where it must fail and why.' },\n)\n\n/**\n * Describes one claim and is the sole source of both the published tool schema and the guard\n * applied to an arriving claim.\n *\n * @remarks\n * The Model Context Protocol tool publishes `compileSchema(CLAIM_SHAPE)` and admits a call with\n * `isClaim`. Deriving the advertised schema from this one value is what stops the two from drifting\n * apart across a release on any member either can express. `isClaim` is narrower on the one member\n * neither a schema keyword nor this shape can carry — the containment rule on `Draft.path` — and\n * `validators.ts` names where.\n *\n * @example\n * ```ts\n * const schema = compileSchema(CLAIM_SHAPE)\n * const admits = compileGuard(CLAIM_SHAPE)\n * schema.type // 'object'\n * admits({ project: 'tsconfig.json' }) // false\n * ```\n */\nexport const CLAIM_SHAPE = objectShape(\n\t{\n\t\tproject: stringShape({\n\t\t\tmin: 1,\n\t\t\tdescription:\n\t\t\t\t'Workspace-relative TypeScript project the candidate drafts are checked against.',\n\t\t}),\n\t\tcase: CASE_SHAPE,\n\t\tcontrol: CONTROL_SHAPE,\n\t},\n\t{ description: 'One claim: the project, the case, and the control that must break.' },\n)\n"],"mappings":";;;;;;;;;;;;;;;;;;AAcA,IAAa,eAAe,OAAO,OAAO;CAAC;CAAQ;CAAQ;AAAS,CAAU;;;;;;;;;;;;;;AAe9E,IAAa,gBAAgB,OAAO,OAAO;CAAC;CAAY;CAAa;AAAY,CAAU;;;;;;;;;;;;;;;AAgB3F,IAAa,oBAAoB,OAAO,OAAO;CAC9C;CACA;CACA;CACA;CACA;AACD,CAAU;;;;;;;;;;;;;;;AAgBV,IAAa,iBAAiB;;;;;;;;;;;;;;;AAgB9B,IAAa,oBAAoB;;;;;;;;;;;;;AAcjC,IAAa,iBAAiB;;;;;;;;;;;;;AAc9B,IAAa,aAAa;;;;;;;;;AAU1B,IAAa,iBAAiB;;;;;;;;;;;;;;;;;AAkB9B,IAAa,gBAAgB;;;;;;;;;;;;;;;AAgB7B,IAAa,gBAAgB;;;;;;;;;;;;;;;;;;AAmB7B,IAAa,aAAa;;;;;;;;;;;;;;;;;;;;AAqB1B,IAAa,uBAAuB;;;;;;;;;;;;;;;AAgBpC,IAAa,iBAAiB;;;;;;;;;;;;;;;;;;AAmB9B,IAAa,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;ACnM3B,IAAa,aAAb,cAAgC,MAAM;CACrC,OAAyB;CACzB;CACA;CACA;;;;;;;CAQA,YAAY,SAAiB,SAA4B;EACxD,MAAM,QAAQ,QAAQ;EACtB,MAAM,SAAS,UAAU,KAAA,IAAY,KAAA,IAAY,EAAE,MAAM,CAAC;EAC1D,OAAO,eAAe,MAAM,OAAO,IAAI,wBAAwB,GAAG,EAAE,OAAO,KAAK,CAAC;EACjF,KAAK,SAAS,QAAQ;EACtB,KAAK,OAAO,QAAQ;EACpB,IAAI,QAAQ,YAAY,KAAA,GAAW,KAAK,UAAU,QAAQ;CAC3D;AACD;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,aAAa,OAAqC;CACjE,IAAI,EAAA,GAACA,oBAAAA,QAAAA,CAAQ,KAAK,GAAG,OAAO;CAC5B,QAAA,GAAOC,oBAAAA,MAAAA,OAAY;EAClB,IAAIC,oBAAAA,WAAW,UAAU,KAAK,MAAM,MAAM,WAAW,OAAO;EAE5D,IADmBA,oBAAAA,WAAW,SAAS,OAAO,OAAO,IAAI,wBAAwB,CAC7E,CAAA,EAAY,UAAU,OAAO,OAAO;EACxC,MAAM,SAAkBA,oBAAAA,WAAW,QAAQ,KAAK,OAAO,QAAQ;EAC/D,MAAM,OAAgBA,oBAAAA,WAAW,QAAQ,KAAK,OAAO,MAAM;EAC3D,MAAM,UAAmBA,oBAAAA,WAAW,QAAQ,KAAK,OAAO,SAAS;EACjE,IAAI,YAAY,KAAA,GAAW;GAC1B,IAAI,EAAA,GAACC,oBAAAA,SAAAA,CAAS,OAAO,KAAK,EAAA,GAACC,oBAAAA,WAAAA,CAAW,OAAO,GAAG,OAAO;GACvD,MAAM,QAAiBF,oBAAAA,WAAW,QAAQ,KAAK,SAAS,OAAO;GAC/D,IAAI,UAAU,KAAA,KAAa,UAAU,UAAU,UAAU,UAAU,UAAU,WAC5E,OAAO;GACR,KAAK,MAAM,OAAO;IAAC;IAAQ;IAAW;GAAM,GAAG;IAC9C,MAAM,SAAkBA,oBAAAA,WAAW,QAAQ,KAAK,SAAS,GAAG;IAC5D,IAAI,WAAW,KAAA,KAAa,EAAA,GAACG,oBAAAA,SAAAA,CAAS,MAAM,GAAG,OAAO;GACvD;GACA,MAAM,WAAoBH,oBAAAA,WAAW,QAAQ,KAAK,SAAS,UAAU;GACrE,IAAI,aAAa,KAAA,KAAa,EAAA,GAACI,oBAAAA,SAAAA,CAAS,QAAQ,GAAG,OAAO;EAC3D;EACA,OACC,cAAc,MAAM,aAAa,aAAa,MAAM,KACpD,kBAAkB,MAAM,aAAa,aAAa,IAAI;CAExD,CAAC;AACF;;;;;;;;;;;;;;;;;;AAmBA,SAAgB,qBAAqB,SAA6B;CACjE,OAAO,IAAI,WAAW,OAAO,QAAQ,sBAAsB;EAC1D,QAAQ;EACR,MAAM;CACP,CAAC;AACF;;;;;;;;;;;;;;ACxFA,IAAa,WAAA,GAAwBC,oBAAAA,UAAAA,CAAU,YAAY;;;;;;;;;;;;;;;;;;;;;;AAuB3D,IAAa,WAAA,GAAwBC,oBAAAA,SAAAA,CAAS;CAC7C,OAAA,GAAMC,oBAAAA,MAAAA,CAAcC,oBAAAA,mBAAmB,SAAS;EAC/C,IAAI,uBAAuB,KAAK,IAAI,GAAG,OAAO;EAC9C,OACC,KAAK,MAAM,QAAQ,CAAC,CAAC,QAAQ,OAAO,YAAY;GAC/C,IAAI,QAAQ,KAAK,YAAY,MAAM,YAAY,KAAK,OAAO;GAC3D,OAAO,YAAY,OAAO,QAAQ,IAAI,QAAQ;EAC/C,GAAG,CAAC,KAAK;CAEX,CAAC;CACD,MAAMC,oBAAAA;AACP,CAAC;;;;;;;;;;;;;AAcD,IAAa,UAAA,GAAsBH,oBAAAA,SAAAA,CAAS;CAAE,QAAA,GAAOI,oBAAAA,QAAAA,CAAQ,OAAO;CAAG,MAAM;AAAQ,CAAC;;;;;;;;;;;;;;AAetF,IAAa,aAAA,GAA4BJ,oBAAAA,SAAAA,CAAS;CACjD,QAAA,GAAOI,oBAAAA,QAAAA,CAAQ,OAAO;CACtB,MAAM;CACN,OAAO;CACP,QAAQF,oBAAAA;AACT,CAAC;;;;;;;;;;;;;;;;;;;;;;;;AAyBD,IAAa,WAAA,GAAwBF,oBAAAA,SAAAA,CAAS;CAC7C,SAASE,oBAAAA;CACT,MAAM;CACN,SAAS;AACV,CAAC;;;;;;;;;;;;;;;AAgBD,IAAa,WAAA,GAAwBH,oBAAAA,UAAAA,CAAU,aAAa;;;;;;;;;;;;;;;;;;AAmB5D,IAAa,WAAA,GAAwBC,oBAAAA,SAAAA,CACpC;CAAE,QAAQ;CAAS,MAAMG,oBAAAA;CAAU,SAASA,oBAAAA;CAAU,OAAOE,eAAAA;AAAW,GACxE,CAAC,OAAO,CACT;;;;;;;;;;;;AAaA,IAAa,WAAA,GAAwBL,oBAAAA,SAAAA,CAAS;CAC7C,OAAO;CACP,SAASM,oBAAAA;CACT,SAAA,GAAQF,oBAAAA,QAAAA,CAAQ,OAAO;AACxB,CAAC;;;;;;;;;;;;;AAcD,IAAa,eAAA,GAAgCJ,oBAAAA,SAAAA,CAAS;CACrD,YAAYG,oBAAAA;CACZ,QAAQA,oBAAAA;CACR,QAAQA,oBAAAA;AACT,CAAC;;;;;;;;;;;;;;;;;AAkBD,IAAa,aAAA,GAA4BH,oBAAAA,SAAAA,CAAS;CACjD,MAAME,oBAAAA;CACN,QAAQA,oBAAAA;AACT,CAAC;;;;;;;;;;;;;;;;;;;AAoBD,IAAa,aAAA,GAA4BF,oBAAAA,SAAAA,CACxC;CACC,IAAIG,oBAAAA;CACJ,QAAQA,oBAAAA;CACR,WAAW;CACX,SAAS;CACT,QAAQD,oBAAAA;CACR,OAAA,GAAME,oBAAAA,QAAAA,CAAQ,OAAO;CACrB,UAAA,GAASA,oBAAAA,QAAAA,CAAQ,OAAO;CACxB,SAASE,oBAAAA;CACT,SAASH,oBAAAA;AACV,GACA,CAAC,UAAU,SAAS,CACrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACtOA,SAAgB,YAAY,OAAsB;CACjD,MAAM,QAAQ,MAAM;CACpB,MAAM,QAAQ,UAAU,KAAA,IAAY,MAAM,OAAO,GAAG,MAAM,KAAK,GAAG,MAAM,MAAM,OAAO;CACrF,OAAO,IAAI,MAAM,OAAO,IAAI,MAAM,GAAG,MAAM;AAC5C;;;;;;;;;;;;;;;;;AAkBA,SAAgB,YAAY,OAAsB;CACjD,MAAM,QAAQ,MAAM,OAAO;CAC3B,MAAM,OAAO,UAAU,IAAI,UAAU;CAGrC,OAAO,CAAC,GAFW,MAAM,MAAM,IAAI,MAAM,GAAG,KAAK,IAAI,MAAM,QAAQ,OAElD,GADH,MAAM,OAAO,KAAK,UAAU,KAAK,YAAY,KAAK,GAC5C,CAAK,CAAC,CAAC,KAAK,IAAI;AACrC;;;;;;;;;;;;;;;;;;AAmBA,SAAgB,YAAY,SAA0B;CACrD,OAAO,QAAQ,YAAY,KAAA,IAAY,eAAe,WAAW,QAAQ;AAC1E;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,cAAc,SAA0B;CACvD,MAAM,SAAS,QAAQ,WAAW,KAAA,IAAY,CAAC,IAAI,CAAC,UAAU,QAAQ,QAAQ;CAC9E,OAAO;EACN,SAAS,QAAQ,GAAG,IAAI,QAAQ,QAAQ;EACxC,SAAS,QAAQ;EACjB,GAAG;EACH,YAAY,OAAO;CACpB,CAAC,CAAC,KAAK,IAAI;AACZ;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,SAAgB,cAAc,SAA0B;CACvD,MAAM,EAAE,YAAY,QAAQ,WAAW,QAAQ;CAC/C,MAAM,QAAQ,wBAAwB,WAAW,WAAW,OAAO,WAAW;CAC9E,MAAM,UAAU,WAAW,QAAQ,QAAQ,KAAK,GAAG,QAAQ,QAAQ;CACnE,MAAM,SAAS,QAAQ,WAAW,KAAA,IAAY,CAAC,IAAI,CAAC,UAAU,QAAQ,QAAQ;CAC9E,OAAO;EACN,SAAS,QAAQ,GAAG,IAAI,QAAQ,QAAQ;EACxC,SAAS,QAAQ;EACjB;EACA;EACA,GAAG;EACH,GAAG,QAAQ,KAAK,KAAK,UAAU,QAAQ,YAAY,KAAK,GAAG;EAC3D,GAAG,QAAQ,QAAQ,KAAK,UAAU,WAAW,YAAY,KAAK,GAAG;EACjE,YAAY,OAAO;CACpB,CAAC,CAAC,KAAK,IAAI;AACZ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4CA,SAAgB,eAAe,SAAkB,OAAkC;CAClF,MAAM,MAAM,aAAa,OACvB,SACA,QAAQ,KAAK,QAAQ,UAAU,MAAM,UAAU,IAAI,CAAC,CAAC,WAAW,KAChE,QAAQ,QAAQ,QAAQ,UAAU,MAAM,UAAU,IAAI,CAAC,CAAC,WAAW,CACrE;CACA,MAAM,QAAQ,QAAQ,KAAK,OAAO,UAAU,MAAM,OAAO,WAAW,CAAC;CAErE,MAAM,QADW,QAAQ,QAAQ,MAAM,UAAU,MAAM,UAAU,KACnD,CAAA,EAAU,OAAO,MAAM,UAAU,MAAM,WAAW,UAAU,KAAK;CAC/E,MAAM,UACL,QAAQ,KAAK,MAAM,UAAU,MAAM,OAAO,MAAM,UAAU,MAAM,WAAW,YAAY,CAAC,KACxF,QAAQ,QAAQ,MAAM,UAAU,MAAM,OAAO,MAAM,UAAU,MAAM,WAAW,YAAY,CAAC;CAC5F,MAAM,SAAS,QAAQ,QAAQ,OAC7B,UAAU,MAAM,UAAU,SAAS,MAAM,OAAO,OAAO,UAAU,MAAM,WAAW,UAAU,CAC9F;CACA,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,WAAW,CAAC,QAAQ,OAAO,KAAA;CAC3D,MAAM,EAAE,YAAY,QAAQ,WAAW,QAAQ;CAC/C,OAAO;EACN;EACA,QAAQ;EACR;EACA,cAAc;EACd,UAAU;EACV,UAAU;EACV,GAAG,QAAQ,QAAQ,KAAK,GAAG,QAAQ,QAAQ;CAC5C,CAAC,CAAC,KAAA,GAAsB;AACzB;;;;;;;;;;;;;;;;;;;;;;AAuBA,SAAgB,oBAAoB,MAAc,UAA0B;CAE3E,OAAO,GADM,SAAS,MAAM,KAAK,SAAS,IAAI,IAAI,OAAO,GAAG,KAAK,IAClD,8CAA8C,SAAS;AACvE;;;;;;;;;;;;;;;;;;;AAoBA,SAAgB,qBAAqB,MAAc,UAA2B;CAC7E,OAAO,KAAK,SAAS,oBAAoB,IAAI,QAAQ,CAAC;AACvD;;;;;;;;;;;;;;;;;;ACzPA,IAAa,eAAA,GAAcI,oBAAAA,YAAAA,CAC1B;CACC,OAAA,GAAMC,oBAAAA,YAAAA,CAAY;EAAE,KAAK;EAAG,aAAa;CAAiD,CAAC;CAC3F,OAAA,GAAMA,oBAAAA,YAAAA,CAAY,EAAE,aAAa,4BAA4B,CAAC;AAC/D,GACA,EAAE,aAAa,qCAAqC,CACrD;;;;;;;;;;AAWA,IAAa,cAAA,GAAaD,oBAAAA,YAAAA,CACzB;CACC,QAAA,GAAOE,oBAAAA,WAAAA,CAAW,aAAa,EAAE,aAAa,yCAAyC,CAAC;CACxF,MAAM;AACP,GACA,EAAE,aAAa,sEAAsE,CACtF;;;;;;;;;;;;;;AAeA,IAAa,iBAAA,GAAgBF,oBAAAA,YAAAA,CAC5B;CACC,GAAG,WAAW;CACd,QAAA,GAAOG,oBAAAA,aAAAA,CAAa,cAAc,EAAE,aAAa,uCAAuC,CAAC;CACzF,SAAA,GAAQF,oBAAAA,YAAAA,CAAY;EAAE,KAAK;EAAG,aAAa;CAAuC,CAAC;AACpF,GACA,EAAE,aAAa,sEAAsE,CACtF;;;;;;;;;;;;;;;;;;;;AAqBA,IAAa,eAAA,GAAcD,oBAAAA,YAAAA,CAC1B;CACC,UAAA,GAASC,oBAAAA,YAAAA,CAAY;EACpB,KAAK;EACL,aACC;CACF,CAAC;CACD,MAAM;CACN,SAAS;AACV,GACA,EAAE,aAAa,qEAAqE,CACrF"}
+{"version":3,"file":"index.cjs","names":["isError","holds","INTRINSICS","isObject","isFunction","isString","isNumber","literalOf","recordOf","andOf","isNonEmptyString","isString","arrayOf","isLSPRange","isNumber","objectShape","stringShape","arrayShape","literalShape"],"sources":["../../../src/core/constants.ts","../../../src/core/errors.ts","../../../src/core/validators.ts","../../../src/core/helpers.ts","../../../src/core/shapers.ts"],"sourcesContent":["/**\n * Lists the stages a claim passes through, in the order a verdict reports them:\n * `['type', 'lint', 'runtime']`.\n *\n * @remarks\n * One list feeds the `Stage` type, the wire shape, the stage guard, and the receipt computation, so\n * a stage cannot be admitted by one and refused by another. The type derives from this list rather\n * than standing beside it, so a stage the list omits is a stage no member of the union names.\n *\n * @example\n * ```ts\n * PROBE_STAGES // ['type', 'lint', 'runtime']\n * ```\n */\nexport const PROBE_STAGES = Object.freeze(['type', 'lint', 'runtime'] as const)\n\n/**\n * Lists the parties that can own action on an issue or probe failure:\n * `['claimant', 'workspace', 'instrument']`.\n *\n * @remarks\n * One list feeds the `Party` type and its guard, so a party cannot be admitted by one and refused\n * by another.\n *\n * @example\n * ```ts\n * PROBE_PARTIES // ['claimant', 'workspace', 'instrument']\n * ```\n */\nexport const PROBE_PARTIES = Object.freeze(['claimant', 'workspace', 'instrument'] as const)\n\n/**\n * Lists the conditions that can end a probe operation:\n * `['refused', 'missing', 'malformed', 'destroyed', 'deadline']`.\n *\n * @remarks\n * One list feeds the code union and the error guard, so a condition cannot be constructed by one\n * and refused by the other. The guard reads this list rather than the class, which is what lets it\n * refuse a lookalike carrying a condition this package never declared.\n *\n * @example\n * ```ts\n * PROBE_ERROR_CODES // ['refused', 'missing', 'malformed', 'destroyed', 'deadline']\n * ```\n */\nexport const PROBE_ERROR_CODES = Object.freeze([\n\t'refused',\n\t'missing',\n\t'malformed',\n\t'destroyed',\n\t'deadline',\n] as const)\n\n/**\n * Names the leading token every receipt carries, `'probe'`.\n *\n * @remarks\n * A receipt travels away from the verdict that minted it — an agent pastes it into the promotion\n * action — so it names itself rather than relying on where it was found.\n *\n * @example\n * ```ts\n * const receipt =\n * \t'probe:6ca20c3bff623031d3955b9d1a76d71d:type:typescript@6.0.3:oxlint@1.79.0:vitest@4.1.11:configs/src/tsconfig.core.json@d61f11b52460b1c6707cfac2c6078d59'\n * receipt.startsWith(RECEIPT_PREFIX) // true\n * ```\n */\nexport const RECEIPT_PREFIX = 'probe'\n\n/**\n * Names the character joining a receipt's tokens, `':'`.\n *\n * @remarks\n * A project path can contain this character, so the project field goes last and a reader rejoins\n * every field from index 6 onward with this separator rather than expecting a fixed count.\n *\n * @example\n * ```ts\n * const receipt =\n * \t'probe:6ca20c3bff623031d3955b9d1a76d71d:type:typescript@6.0.3:oxlint@1.79.0:vitest@4.1.11:configs/src/tsconfig.core.json@d61f11b52460b1c6707cfac2c6078d59'\n * receipt.split(RECEIPT_SEPARATOR).length // 7\n * ```\n */\nexport const RECEIPT_SEPARATOR = ':'\n\n/**\n * Names the default inspection deadline a `Probe` applies when its construction omits one,\n * 30,000 ms.\n *\n * @remarks\n * `ProbeOptions.deadline` overrides this value per instance.\n *\n * @example\n * ```ts\n * PROBE_DEADLINE // 30_000\n * ```\n */\nexport const PROBE_DEADLINE = 30_000\n\n/**\n * Bounds the default type warm at 90,000 ms, independently of active inspections.\n *\n * @remarks\n * `ProbeOptions.warm` overrides this value. Veneer's slowest measured warm on 2026-10-05 took\n * 50,000 ms; this bound leaves 40,000 ms for host contention without changing inspection budgets.\n *\n * @example\n * ```ts\n * PROBE_WARM // 90_000\n * ```\n */\nexport const PROBE_WARM = 90_000\n\n/**\n * Bounds consecutive failed warms or idle losses before a stage's floor is spent.\n *\n * @example\n * ```ts\n * PROBE_RESTARTS // 1\n * ```\n */\nexport const PROBE_RESTARTS = 1\n\n/**\n * Names the 2,000 ms bound the lint stage holds over the lifecycle exchanges the protocol leaves\n * to the server: the `initialize` reply warming waits for and the `shutdown` reply ending waits for.\n *\n * @remarks\n * It does not reach the diagnostics an inspection waits for, which the caller's own signal bounds.\n * The transport's cooperative window is half of it; `LINT_TEARDOWN` also accounts for process\n * termination and exit confirmation. Measured 2026-08-27: the workspace `oxlint --lsp` answers\n * `initialize` in 155 ms, so\n * this bound is more than ten times that reply.\n *\n * @example\n * ```ts\n * LINT_DEADLINE // 2_000\n * ```\n */\nexport const LINT_DEADLINE = 2_000\n\n/**\n * Bounds lint teardown at 16,000 ms, including protocol exchanges and process termination.\n *\n * @remarks\n * Shutdown and exit each have `LINT_DEADLINE`; transport grace and stream drain each have half\n * that bound. The installed process transport permits 5,000 ms for Windows tree termination and\n * another 5,000 ms for exit confirmation. This also covers POSIX escalation's shorter grace.\n * The process confirmation constant is not exposed by the declared LSP dependency.\n *\n * @example\n * ```ts\n * LINT_TEARDOWN // 16_000\n * ```\n */\nexport const LINT_TEARDOWN = LINT_DEADLINE * 3 + 5_000 * 2\n\n/**\n * Names the total enumerable key bound `ProbeServer` applies to inbound metadata and to produced\n * tool content alike, 4096.\n *\n * @remarks\n * `@orkestrel/mcp`'s default leaf is sized for metadata: a verdict costs 38 keys empty and 11 more\n * for each issue a stage reports, so the default carries a verdict whose control refuses one\n * declaration and stops carrying the next one. A whole tool-call result carrying the record beside\n * its rendering costs 44 keys plus 11 for each issue, so this bound carries a record reporting up\n * to 368 issues. Past that the reply falls back to the rendered text, and past the 4 MiB content\n * bound to the receipt block.\n *\n * @example\n * ```ts\n * PROBE_KEYS // 4096\n * ```\n */\nexport const PROBE_KEYS = 4096\n\n/**\n * Names the specification lifetime the runtime stage replaces its resident Vitest service at,\n * 64 specifications.\n *\n * @remarks\n * Vite retains one unresolved URL for every fresh specification path, so an inspection that writes\n * a specification grows a map the resident service never releases. The stage replaces that service\n * rather than deleting from each map it owns, and this is the count of specifications one service\n * carries before the replacement. Any bound holds the retention flat, because the replacement\n * releases everything the instance held; this value trades the cost of the replacement against how\n * far the map grows between them. On 2026-08-20, over this package's own workspace on the host\n * `guides/probe.md` § Cost names, two runs of 66 inspections put the crossing inspection at 480 ms\n * and 269 ms against median inspections of 156 ms and 155 ms.\n *\n * @example\n * ```ts\n * PROBE_SPECIFICATIONS // 64\n * ```\n */\nexport const PROBE_SPECIFICATIONS = 64\n\n/**\n * Names the Vite plugin the runtime stage installs into a target workspace's Vitest\n * configuration, `'orkestrel-runtime-overlay'`.\n *\n * @remarks\n * The stage declares the plugin under this name and reads a configured project's plugin list for\n * the same name to decide whether that project carries the overlay. One name feeds both, so a\n * project the stage instrumented is never reported as a workspace project it could not reach.\n *\n * @example\n * ```ts\n * RUNTIME_PLUGIN // 'orkestrel-runtime-overlay'\n * ```\n */\nexport const RUNTIME_PLUGIN = 'orkestrel-runtime-overlay'\n\n/**\n * Names the workspace-relative directory the type stage keeps its workspace mirror under,\n * `'tmp/type'`.\n *\n * @remarks\n * Each stage owns one directory beneath this one, named for the writing host's process id and a\n * fresh UUID, and deletes it at teardown. The directory sits under `tmp/` so nothing the stage\n * writes reaches a version-controlled path, and beside `tmp/probes/` rather than inside it because\n * the workbench Vitest project collects `tmp/probes/**` and would otherwise collect a mirrored test.\n * A target that runs its own `check`, `lint:check`, or `format:check` while a probe is resident\n * reads whatever it does not exclude, so exclude this directory there.\n *\n * @example\n * ```ts\n * TYPE_MIRROR // 'tmp/type'\n * ```\n */\nexport const TYPE_MIRROR = 'tmp/type'\n","import type { Party, ProbeErrorCode, ProbeErrorContext, ProbeErrorOptions } from './types.js'\nimport {\n\tINTRINSICS,\n\tholds,\n\tisError,\n\tisFunction,\n\tisNumber,\n\tisObject,\n\tisString,\n} from '@orkestrel/contract'\nimport { PROBE_ERROR_CODES, PROBE_PARTIES } from './constants.js'\n\n/**\n * Reports one probe failure under stable ownership and condition axes.\n *\n * @remarks\n * Every failure raised while serving a claim arrives as one of these, so a consumer catching from\n * `prove`, from a stage, or from a workspace leaf branches on {@link Party} and\n * {@link ProbeErrorCode} rather than on message text. Narrow a caught value with\n * {@link isProbeError} before reading either member. A pure leaf called directly with a value\n * `isClaim` would refuse raises the host's own fault unchanged, because those leaves are written to\n * be total over a validated claim rather than over every value.\n *\n * @example\n * ```ts\n * const error = new ProbeError('Path escapes the workspace: ../secrets.env', {\n * \torigin: 'claimant',\n * \tcode: 'refused',\n * \tcontext: { path: '../secrets.env' },\n * })\n * error.origin // 'claimant'\n * error.code // 'refused'\n * error.context?.path // '../secrets.env'\n * ```\n */\nexport class ProbeError extends Error {\n\toverride readonly name = 'ProbeError'\n\treadonly origin: Party\n\treadonly code: ProbeErrorCode\n\treadonly context?: ProbeErrorContext\n\n\t/**\n\t * Creates one classified probe failure.\n\t *\n\t * @param message - Human-readable description of what failed\n\t * @param options - The ownership, condition, optional structured context, and optional cause\n\t */\n\tconstructor(message: string, options: ProbeErrorOptions) {\n\t\tconst cause = options.cause\n\t\tsuper(message, cause === undefined ? undefined : { cause })\n\t\tObject.defineProperty(this, Symbol.for('@orkestrel/probe.ProbeError'), { value: this })\n\t\tthis.origin = options.origin\n\t\tthis.code = options.code\n\t\tif (options.context !== undefined) this.context = options.context\n\t}\n}\n\n/**\n * Checks whether an unknown value is a {@link ProbeError}.\n *\n * @remarks\n * Recognition requires the native `Error` base, a non-base prototype, an own global brand holding\n * the error itself, a declared party and condition, and context members of their declared types.\n * The brand carries recognition across duplicate installations and module formats. A subclass may\n * replace `name`. A transparent proxy, a plain `Error`, a property-only lookalike, and an error with\n * invalid members stay outside the type.\n *\n * @param value - The value to inspect\n * @returns True if the value is a `ProbeError` instance; false otherwise\n *\n * @example\n * ```ts\n * isProbeError(createDestroyedError('probe')) // true\n * isProbeError(new Error('The probe has been destroyed')) // false\n * ```\n */\nexport function isProbeError(value: unknown): value is ProbeError {\n\tif (!isError(value)) return false\n\treturn holds(() => {\n\t\tif (INTRINSICS.prototype(value) === Error.prototype) return false\n\t\tconst descriptor = INTRINSICS.describe(value, Symbol.for('@orkestrel/probe.ProbeError'))\n\t\tif (descriptor?.value !== value) return false\n\t\tconst origin: unknown = INTRINSICS.reflect.read(value, 'origin')\n\t\tconst code: unknown = INTRINSICS.reflect.read(value, 'code')\n\t\tconst context: unknown = INTRINSICS.reflect.read(value, 'context')\n\t\tif (context !== undefined) {\n\t\t\tif (!isObject(context) && !isFunction(context)) return false\n\t\t\tconst stage: unknown = INTRINSICS.reflect.read(context, 'stage')\n\t\t\tif (stage !== undefined && stage !== 'type' && stage !== 'lint' && stage !== 'runtime')\n\t\t\t\treturn false\n\t\t\tfor (const key of ['path', 'project', 'name']) {\n\t\t\t\tconst member: unknown = INTRINSICS.reflect.read(context, key)\n\t\t\t\tif (member !== undefined && !isString(member)) return false\n\t\t\t}\n\t\t\tconst deadline: unknown = INTRINSICS.reflect.read(context, 'deadline')\n\t\t\tif (deadline !== undefined && !isNumber(deadline)) return false\n\t\t}\n\t\treturn (\n\t\t\tPROBE_PARTIES.some((declared) => declared === origin) &&\n\t\t\tPROBE_ERROR_CODES.some((declared) => declared === code)\n\t\t)\n\t})\n}\n\n/**\n * Creates the failure raised when an instrument is used after it was torn down.\n *\n * @remarks\n * Every resident entity in this package refuses this way, so the subject names which one in the\n * message and the condition is the same for all of them. A caller that meets this builds a\n * replacement rather than retrying: teardown is permanent.\n *\n * @param subject - The torn-down entity, named as the message names it, such as `type stage`\n * @returns A typed teardown failure\n *\n * @example\n * ```ts\n * createDestroyedError('type stage').message // 'The type stage has been destroyed'\n * createDestroyedError('probe').code // 'destroyed'\n * ```\n */\nexport function createDestroyedError(subject: string): ProbeError {\n\treturn new ProbeError(`The ${subject} has been destroyed`, {\n\t\torigin: 'claimant',\n\t\tcode: 'destroyed',\n\t})\n}\n","import type { Guard } from '@orkestrel/contract'\nimport type {\n\tCase,\n\tStageResult,\n\tClaim,\n\tControl,\n\tDraft,\n\tIssue,\n\tParty,\n\tProject,\n\tStage,\n\tToolchain,\n\tVerdict,\n} from './types.js'\nimport {\n\tandOf,\n\tarrayOf,\n\tisNonEmptyString,\n\tisNumber,\n\tisString,\n\tliteralOf,\n\trecordOf,\n} from '@orkestrel/contract'\nimport { isLSPRange } from '@orkestrel/lsp'\nimport { PROBE_PARTIES, PROBE_STAGES } from './constants.js'\n\n/**\n * Checks whether a value names a stage.\n *\n * @param value - The value to check\n * @returns True if the value is a stage name; false otherwise\n *\n * @example\n * ```ts\n * isStage('lint') // true\n * isStage('typecheck') // false\n * ```\n */\nexport const isStage: Guard<Stage> = literalOf(PROBE_STAGES)\n\n/**\n * Checks whether a value carries a proposed file's path and text.\n *\n * @remarks\n * Rejects an empty path, an absolute path, or a path that resolves outside the workspace. A\n * contained relative path may contain `.` or may traverse to a parent that remains inside the\n * workspace. Every stage resolves a file by that path, so admitting such a path here would defer\n * the refusal until a stage had already accepted the draft. An `Issue` carries no such minimum\n * because this package produces issues rather than admits them.\n *\n * @param value - The value to check\n * @returns True if the value is a draft; false otherwise\n *\n * @example\n * ```ts\n * const text = \"export function createGreeting(): string {\\n\\treturn 'hi'\\n}\\n\"\n * isDraft({ path: 'src/core/factories.ts', text }) // true\n * isDraft({ path: '../../etc/hosts', text: '' }) // false\n * isDraft({ path: 'src/core/factories.ts' }) // false\n * ```\n */\nexport const isDraft: Guard<Draft> = recordOf({\n\tpath: andOf<string>(isNonEmptyString, (path) => {\n\t\tif (/^(?:[\\\\/]|[A-Za-z]:)/.test(path)) return false\n\t\treturn (\n\t\t\tpath.split(/[\\\\/]+/).reduce((depth, segment) => {\n\t\t\t\tif (depth < 0 || segment === '' || segment === '.') return depth\n\t\t\t\treturn segment === '..' ? depth - 1 : depth + 1\n\t\t\t}, 0) >= 0\n\t\t)\n\t}),\n\ttext: isString,\n})\n\n/**\n * Checks whether a value carries a claim's candidate drafts and its test.\n *\n * @param value - The value to check\n * @returns True if the value is a case; false otherwise\n *\n * @example\n * ```ts\n * const test = { path: 'tests/src/core/greeting.test.ts', text: 'test(\"greets\", () => {})\\n' }\n * isCase({ files: [], test }) // true\n * ```\n */\nexport const isCase: Guard<Case> = recordOf({ files: arrayOf(isDraft), test: isDraft })\n\n/**\n * Checks whether a value carries a case plus the stage and reason it must fail for.\n *\n * @param value - The value to check\n * @returns True if the value is a control; false otherwise\n *\n * @example\n * ```ts\n * const test = { path: 'tests/src/core/greeting.test.ts', text: 'test(\"greets\", () => {})\\n' }\n * isControl({ files: [], test, stage: 'type', reason: 'must not compile' }) // true\n * isControl({ files: [], test }) // false\n * ```\n */\nexport const isControl: Guard<Control> = recordOf({\n\tfiles: arrayOf(isDraft),\n\ttest: isDraft,\n\tstage: isStage,\n\treason: isNonEmptyString,\n})\n\n/**\n * Checks whether a value carries a project, a case, and a control.\n *\n * @remarks\n * Exact rather than open: a claim is this package's own record, so an unknown member is a caller\n * sending a contract this service does not implement rather than a wider caller it must tolerate.\n *\n * `CLAIM_SHAPE` is the wire contract's shape and this is the admission rule the tool enforces, and\n * the rule is strictly narrower than the shape. They agree on every member but `Draft.path`: the\n * shape constrains it to a non-empty string, while `isDraft` also refuses an absolute path\n * and one that traverses out of the workspace, so `../../etc/hosts` satisfies\n * `compileGuard(CLAIM_SHAPE)` and is refused here. `ProbeServer` advertises the shape and enforces\n * this rule, so it names the refused member rather than reporting only that the claim was invalid.\n *\n * @param value - The value to check\n * @returns True if the value is a claim; false otherwise\n *\n * @example\n * ```ts\n * isClaim({ project: 'tsconfig.json', case: subject, control }) // true\n * isClaim({ project: 'tsconfig.json', case: subject }) // false\n * ```\n */\nexport const isClaim: Guard<Claim> = recordOf({\n\tproject: isNonEmptyString,\n\tcase: isCase,\n\tcontrol: isControl,\n})\n\n/**\n * Checks whether a value names a party an issue carries.\n *\n * @param value - The value to check\n * @returns True if the value is a party; false otherwise\n *\n * @example\n * ```ts\n * isParty('claimant') // true\n * isParty('workspace') // true\n * isParty('instrument') // true\n * isParty('stage') // false\n * ```\n */\nexport const isParty: Guard<Party> = literalOf(PROBE_PARTIES)\n\n/**\n * Checks whether a value carries one message, its location, and the origin of the fault it names.\n *\n * @remarks\n * `origin` is required rather than optional. Every issue this package produces sets it, and a\n * receipt turns on it: a control's issue disproves the claim only when its origin names the\n * claimant.\n *\n * @param value - The value to check\n * @returns True if the value is an issue; false otherwise\n *\n * @example\n * ```ts\n * isIssue({ origin: 'claimant', path: 'src/core/greeting.ts', message: 'not assignable' }) // true\n * isIssue({ path: 'src/core/greeting.ts', message: 'not assignable' }) // false\n * ```\n */\nexport const isIssue: Guard<Issue> = recordOf(\n\t{ origin: isParty, path: isString, message: isString, range: isLSPRange },\n\t['range'],\n)\n\n/**\n * Checks whether a value carries one stage's outcome.\n *\n * @param value - The value to check\n * @returns True if the value is a stage result; false otherwise\n *\n * @example\n * ```ts\n * isStageResult({ stage: 'lint', elapsed: 17, issues: [] }) // true\n * ```\n */\nexport const isStageResult: Guard<StageResult> = recordOf({\n\tstage: isStage,\n\telapsed: isNumber,\n\tissues: arrayOf(isIssue),\n})\n\n/**\n * Checks whether a value names every resolved tool version.\n *\n * @param value - The value to check\n * @returns True if the value is a toolchain; false otherwise\n *\n * @example\n * ```ts\n * isToolchain({ typescript: '6.0.3', oxlint: '1.79.0', vitest: '4.1.11' }) // true\n * isToolchain({ typescript: '6.0.3' }) // false\n * ```\n */\nexport const isToolchain: Guard<Toolchain> = recordOf({\n\ttypescript: isString,\n\toxlint: isString,\n\tvitest: isString,\n})\n\n/**\n * Checks whether a value names one resolved TypeScript project and what it contained.\n *\n * @remarks\n * Rejects an empty path and an empty digest. A verdict names the project that judged it, so a\n * blank member here would report a project the type stage never applied.\n *\n * @param value - The value to check\n * @returns True if the value is a project; false otherwise\n *\n * @example\n * ```ts\n * isProject({ path: 'configs/src/tsconfig.core.json', digest: '3b674fdf121c85ef' }) // true\n * isProject({ path: 'configs/src/tsconfig.core.json', digest: '' }) // false\n * ```\n */\nexport const isProject: Guard<Project> = recordOf({\n\tpath: isNonEmptyString,\n\tdigest: isNonEmptyString,\n})\n\n/**\n * Checks whether a value carries a complete verdict.\n *\n * @remarks\n * Accepts any stage result count, because arity is the coordinator's obligation rather than this\n * guard's: a stage that could not start throws before a verdict is built, so a short list can only\n * arrive from a caller that assembled one by hand.\n *\n * @param value - The value to check\n * @returns True if the value is a verdict; false otherwise\n *\n * @example\n * ```ts\n * const basis = { id: '01J8Z0', digest: '6ca20c3b', toolchain, project, elapsed: 337 }\n * isVerdict({ ...basis, case: [], control: [] }) // true\n * isVerdict({ ...basis, case: [] }) // false\n * ```\n */\nexport const isVerdict: Guard<Verdict> = recordOf(\n\t{\n\t\tid: isString,\n\t\tdigest: isString,\n\t\ttoolchain: isToolchain,\n\t\tproject: isProject,\n\t\treason: isNonEmptyString,\n\t\tcase: arrayOf(isStageResult),\n\t\tcontrol: arrayOf(isStageResult),\n\t\telapsed: isNumber,\n\t\treceipt: isString,\n\t},\n\t['reason', 'receipt'],\n)\n","import type { StageResult, Issue, Stage, Verdict } from './types.js'\nimport { PROBE_STAGES, RECEIPT_PREFIX, RECEIPT_SEPARATOR } from './constants.js'\n\n/**\n * Renders one tool message as a single line an agent can classify and locate.\n *\n * @remarks\n * `Issue.range` is stored zero-based, and this is the only place it is rendered, so the one-based\n * line an editor shows is derived here and nowhere else. The rendered location carries the line\n * alone: a reader opens a file at a line, and the column would widen every issue line in every\n * verdict for a precision that address does not use.\n *\n * @param issue - The message and location a stage reported\n * @returns The bracketed origin, location, and message, separated by spaces\n *\n * @example\n * ```ts\n * const located: Issue = {\n * \torigin: 'claimant',\n * \tpath: 'src/core/greeting.ts',\n * \tmessage: 'not assignable',\n * \trange: { start: { line: 0, character: 6 }, end: { line: 0, character: 13 } },\n * }\n * const whole: Issue = {\n * \torigin: 'claimant',\n * \tpath: 'src/core/greeting.ts',\n * \tmessage: 'not assignable',\n * }\n * formatIssue(located) // '[claimant] src/core/greeting.ts:1 not assignable'\n * formatIssue(whole) // '[claimant] src/core/greeting.ts not assignable'\n * ```\n */\nexport function formatIssue(issue: Issue): string {\n\tconst range = issue.range\n\tconst where = range === undefined ? issue.path : `${issue.path}:${range.start.line + 1}`\n\treturn `[${issue.origin}] ${where} ${issue.message}`\n}\n\n/**\n * Renders one stage's outcome as its summary line followed by every message it reported.\n *\n * @remarks\n * A clean stage renders one line. The count appears even when it is zero, because that line is\n * what shows a reader the stage ran; a silent stage and a skipped stage read the same.\n *\n * @param result - The stage outcome to render\n * @returns The summary line, then one indented line per issue\n *\n * @example\n * ```ts\n * formatStageResult({ stage: 'lint', elapsed: 17, issues: [] })\n * // 'lint: 0 issues (17 ms)'\n * ```\n */\nexport function formatStageResult(result: StageResult): string {\n\tconst count = result.issues.length\n\tconst noun = count === 1 ? 'issue' : 'issues'\n\tconst summary = `${result.stage}: ${count} ${noun} (${result.elapsed} ms)`\n\tconst lines = result.issues.map((issue) => `  ${formatIssue(issue)}`)\n\treturn [summary, ...lines].join('\\n')\n}\n\n/**\n * Renders the closing line a rendered verdict ends with: the receipt it earned, or its absence.\n *\n * @remarks\n * One implementation serves every rendering of that line, so the line a reader quotes off a whole\n * verdict and the line a bounded reply falls back to cannot drift apart.\n *\n * @param verdict - The verdict whose `receipt` decides the line\n * @returns `receipt <token>` when the verdict carries a receipt, and `no receipt` when it does not\n *\n * @example\n * ```ts\n * formatProof(proven)\n * // 'receipt probe:6ca20c3bff623031d3955b9d1a76d71d:type:typescript@6.0.3:oxlint@1.79.0:vitest@4.1.11:configs/src/tsconfig.core.json@d61f11b52460b1c6707cfac2c6078d59'\n * formatProof(disproven) // 'no receipt'\n * ```\n */\nexport function formatProof(verdict: Verdict): string {\n\treturn verdict.receipt === undefined ? 'no receipt' : `receipt ${verdict.receipt}`\n}\n\n/**\n * Renders the smallest text a verdict can travel as: what it judged, and how it ended.\n *\n * @remarks\n * A reply whose bounds refuse both the record and the whole rendering answers with this text, so it\n * carries what a reader cannot recompute — the call's identity, the claim's digest, and the\n * control's reason when the verdict carries one — and closes with the same line `formatVerdict`\n * closes with. Every line here is a line `formatVerdict` renders at the same position relative to\n * the ones around it, so a reader meets one shape whichever answer arrived.\n *\n * @param verdict - The verdict to render\n * @returns The identity and claim lines, the reason when present, then the closing receipt line\n *\n * @example\n * ```ts\n * formatReceipt(disproven).split('\\n')\n * // ['probe 88a5addc-7d33-40dc-9a5a-104b71f8787d (549 ms)', 'claim 6ca20c3bff623031d3955b9d1a76d71d', 'no receipt']\n * ```\n */\nexport function formatReceipt(verdict: Verdict): string {\n\tconst reason = verdict.reason === undefined ? [] : [`reason ${verdict.reason}`]\n\treturn [\n\t\t`probe ${verdict.id} (${verdict.elapsed} ms)`,\n\t\t`claim ${verdict.digest}`,\n\t\t...reason,\n\t\tformatProof(verdict),\n\t].join('\\n')\n}\n\n/**\n * Renders a whole verdict as the text an agent reads.\n *\n * @remarks\n * Every stage appears for both the case and the control, so no failing stage can be masked by an\n * earlier one. The closing line always states the receipt or its absence, so a reader never has to\n * infer from silence whether the claim was proven.\n *\n * The heading lines carry everything the receipt binds, each in the name-then-value form the\n * toolchain line established: the call's identity, the claim it answered, the tools that ran, and\n * the project that judged the candidates. A verdict carrying the control's reason renders it next,\n * before either phase's stage results. A reader comparing two verdicts therefore reads what\n * differed without recomputing anything.\n *\n * @param verdict - The verdict to render\n * @returns The identity, claim, toolchain, project, and reason when present, then every case and\n * control stage, then the receipt line\n *\n * @example\n * ```ts\n * formatVerdict(verdict).split('\\n')[1] // 'claim 6ca20c3bff623031d3955b9d1a76d71d'\n * ```\n */\nexport function formatVerdict(verdict: Verdict): string {\n\tconst { typescript, oxlint, vitest } = verdict.toolchain\n\tconst tools = `toolchain typescript ${typescript}, oxlint ${oxlint}, vitest ${vitest}`\n\tconst project = `project ${verdict.project.path} ${verdict.project.digest}`\n\tconst reason = verdict.reason === undefined ? [] : [`reason ${verdict.reason}`]\n\treturn [\n\t\t`probe ${verdict.id} (${verdict.elapsed} ms)`,\n\t\t`claim ${verdict.digest}`,\n\t\ttools,\n\t\tproject,\n\t\t...reason,\n\t\t...verdict.case.map((result) => `case ${formatStageResult(result)}`),\n\t\t...verdict.control.map((result) => `control ${formatStageResult(result)}`),\n\t\tformatProof(verdict),\n\t].join('\\n')\n}\n\n/**\n * Computes the proof token a verdict carries, or returns nothing when the claim was not proven.\n *\n * @remarks\n * A receipt is minted on these conditions together: both phases report one stage result per stage,\n * the case carries no issue, the control carries at least one `origin: 'claimant'` issue\n * at the stage it declared, and every other control stage carries no claimant issue. A control\n * that fails somewhere else has falsified the instrument rather than the claim, so no receipt is\n * minted for it.\n *\n * Both phases owe every stage, not the case alone. `stayed` reads the control entries a verdict\n * carries, so a control that omits a stage entirely would otherwise read as a stage that stayed\n * clean, and the receipt would certify an inspection that never ran. `prove` records every stage\n * for both phases, so this condition refuses only a verdict a caller assembled by hand.\n *\n * The token names every condition the verdict was reached under, so a receipt read away from its\n * verdict still says what was judged and what judged it: the claim's digest, the stage the control\n * broke at, the tool versions, and the project the candidate drafts were checked against.\n * The call's identity is deliberately absent. It carries no integrity and it is the only value\n * stopping two honest runs of one claim from producing one comparable string, so leaving it out is\n * what makes \"re-run `prove` and compare tokens\" a verification a reader can perform.\n *\n * The project goes last, and its own path and digest are joined by `@`. Split the token on\n * `RECEIPT_SEPARATOR`, take fields 0 through 5, and rejoin the remainder with that separator to\n * read the project field; inside it the digest is everything after the final `@`. That rule stays\n * total for a workspace-relative project path containing either character.\n *\n * An `origin: 'instrument'` issue in either phase means the inspection did not complete and\n * refuses the receipt. A workspace issue in the control does not decide whether the claimant's\n * candidate broke, while one in the case still means that the case did not run clean.\n *\n * @param verdict - The verdict whose case and control stage results decide the outcome\n * @param stage - The stage the claim's control declared it must fail at\n * @returns The receipt token, or `undefined` when any condition fails\n *\n * @example\n * ```ts\n * computeReceipt(proven, 'type')\n * // 'probe:6ca20c3bff623031d3955b9d1a76d71d:type:typescript@6.0.3:oxlint@1.79.0:vitest@4.1.11:configs/src/tsconfig.core.json@d61f11b52460b1c6707cfac2c6078d59'\n * computeReceipt(proven, 'lint') // undefined\n * ```\n */\nexport function computeReceipt(verdict: Verdict, stage: Stage): string | undefined {\n\tconst ran = PROBE_STAGES.every(\n\t\t(name) =>\n\t\t\tverdict.case.filter((result) => result.stage === name).length === 1 &&\n\t\t\tverdict.control.filter((result) => result.stage === name).length === 1,\n\t)\n\tconst clean = verdict.case.every((result) => result.issues.length === 0)\n\tconst declared = verdict.control.find((result) => result.stage === stage)\n\tconst broke = declared?.issues.some((issue) => issue.origin === 'claimant') ?? false\n\tconst faulted =\n\t\tverdict.case.some((result) => result.issues.some((issue) => issue.origin === 'instrument')) ||\n\t\tverdict.control.some((result) => result.issues.some((issue) => issue.origin === 'instrument'))\n\tconst stayed = verdict.control.every(\n\t\t(result) =>\n\t\t\tresult.stage === stage || result.issues.every((issue) => issue.origin !== 'claimant'),\n\t)\n\tif (!ran || !clean || !broke || faulted || !stayed) return undefined\n\tconst { typescript, oxlint, vitest } = verdict.toolchain\n\treturn [\n\t\tRECEIPT_PREFIX,\n\t\tverdict.digest,\n\t\tstage,\n\t\t`typescript@${typescript}`,\n\t\t`oxlint@${oxlint}`,\n\t\t`vitest@${vitest}`,\n\t\t`${verdict.project.path}@${verdict.project.digest}`,\n\t].join(RECEIPT_SEPARATOR)\n}\n\n/**\n * Renders one generated specification: the caller's own test text, then the marker naming the\n * revision that wrote it.\n *\n * @remarks\n * The marker is what makes a file in a target workspace attributable to this package. A generated\n * specification carries text the caller supplied, so its name alone cannot separate it from a\n * developer's own file, and a sweep reading the name alone deletes that file. The marker goes last\n * so every line of the caller's text keeps the number a reported stack frame gives it, and the text\n * gains a terminating newline first so the marker is never appended to a line of the test.\n *\n * @param text - The caller's own test text\n * @param revision - The writing host's process id and a fresh UUID, joined by `-`\n * @returns The bytes the runtime stage writes for that revision\n *\n * @example\n * ```ts\n * formatSpecification(\"test('greets', () => {})\\n\", '4821-9f0c')\n * // \"test('greets', () => {})\\n// @orkestrel/probe generated specification 4821-9f0c\\n\"\n * ```\n */\nexport function formatSpecification(text: string, revision: string): string {\n\tconst body = text === '' || text.endsWith('\\n') ? text : `${text}\\n`\n\treturn `${body}// @orkestrel/probe generated specification ${revision}\\n`\n}\n\n/**\n * Checks whether one file's text is the generated specification written for one revision.\n *\n * @remarks\n * Reads the marker `formatSpecification` writes, taken from that function rather than restated, so\n * the writer and the reader cannot drift apart. An empty body renders the marker alone, which is\n * why the comparison is built from a call rather than from a second copy of the text.\n *\n * @param text - The file's full contents\n * @param revision - The revision the file's name declares\n * @returns True if the text ends with this package's marker for that revision; false otherwise\n *\n * @example\n * ```ts\n * matchesSpecification(formatSpecification('', '4821-9f0c'), '4821-9f0c') // true\n * matchesSpecification('export const NOTE = 1\\n', '4821-9f0c') // false\n * ```\n */\nexport function matchesSpecification(text: string, revision: string): boolean {\n\treturn text.endsWith(formatSpecification('', revision))\n}\n","import { arrayShape, literalShape, objectShape, stringShape } from '@orkestrel/contract'\nimport { PROBE_STAGES } from './constants.js'\n\n/**\n * Describes one proposed file a claim carries.\n *\n * @remarks\n * `path` is constrained to a non-empty string because every stage resolves a file by it, so an\n * empty path names no file. That minimum is the whole of the constraint here, and it is the one\n * place the wire contract is wider than what this package admits: `isDraft` enforces the same\n * minimum and also refuses an absolute path and one that traverses out of the workspace, which no\n * JSON Schema keyword can express. A caller that satisfies this shape can still be refused, and\n * `ProbeServer` names the member when it is.\n *\n * @example\n * ```ts\n * compileGuard(DRAFT_SHAPE)({ path: 'src/core/greeting.ts', text: '' }) // true\n * ```\n */\nexport const DRAFT_SHAPE = objectShape(\n\t{\n\t\tpath: stringShape({ min: 1, description: 'Workspace-relative path, which need not exist.' }),\n\t\ttext: stringShape({ description: \"The file's full contents.\" }),\n\t},\n\t{ description: 'One proposed file a claim carries.' },\n)\n\n/**\n * Describes the drafts a claim asserts about and the test that exercises them.\n *\n * @example\n * ```ts\n * const test = { path: 'tests/src/core/greeting.test.ts', text: '' }\n * compileGuard(CASE_SHAPE)({ files: [], test }) // true\n * ```\n */\nexport const CASE_SHAPE = objectShape(\n\t{\n\t\tfiles: arrayShape(DRAFT_SHAPE, { description: 'The candidate drafts the test imports.' }),\n\t\ttest: DRAFT_SHAPE,\n\t},\n\t{ description: 'The drafts a claim asserts about, and the test that exercises them.' },\n)\n\n/**\n * Describes the negative control, which is a case plus where and why it must break.\n *\n * @remarks\n * Built from `CASE_SHAPE`'s own properties rather than a second copy of them, so the control and\n * the case cannot describe a draft differently.\n *\n * @example\n * ```ts\n * const test = { path: 'tests/src/core/greeting.test.ts', text: '' }\n * compileGuard(CONTROL_SHAPE)({ files: [], test, stage: 'type', reason: 'must not compile' }) // true\n * ```\n */\nexport const CONTROL_SHAPE = objectShape(\n\t{\n\t\t...CASE_SHAPE.properties,\n\t\tstage: literalShape(PROBE_STAGES, { description: 'The stage this control must fail at.' }),\n\t\treason: stringShape({ min: 1, description: 'Why the control fails at that stage.' }),\n\t},\n\t{ description: 'A case that must fail, naming the stage where it must fail and why.' },\n)\n\n/**\n * Describes one claim and is the sole source of both the published tool schema and the guard\n * applied to an arriving claim.\n *\n * @remarks\n * The Model Context Protocol tool publishes `compileSchema(CLAIM_SHAPE)` and admits a call with\n * `isClaim`. Deriving the advertised schema from this one value is what stops the two from drifting\n * apart across a release on any member either can express. `isClaim` is narrower on the one member\n * neither a schema keyword nor this shape can carry — the containment rule on `Draft.path` — and\n * `validators.ts` names where.\n *\n * @example\n * ```ts\n * const schema = compileSchema(CLAIM_SHAPE)\n * const admits = compileGuard(CLAIM_SHAPE)\n * schema.type // 'object'\n * admits({ project: 'tsconfig.json' }) // false\n * ```\n */\nexport const CLAIM_SHAPE = objectShape(\n\t{\n\t\tproject: stringShape({\n\t\t\tmin: 1,\n\t\t\tdescription:\n\t\t\t\t'Workspace-relative TypeScript project the candidate drafts are checked against.',\n\t\t}),\n\t\tcase: CASE_SHAPE,\n\t\tcontrol: CONTROL_SHAPE,\n\t},\n\t{ description: 'One claim: the project, the case, and the control that must break.' },\n)\n"],"mappings":";;;;;;;;;;;;;;;;;;AAcA,IAAa,eAAe,OAAO,OAAO;CAAC;CAAQ;CAAQ;AAAS,CAAU;;;;;;;;;;;;;;AAe9E,IAAa,gBAAgB,OAAO,OAAO;CAAC;CAAY;CAAa;AAAY,CAAU;;;;;;;;;;;;;;;AAgB3F,IAAa,oBAAoB,OAAO,OAAO;CAC9C;CACA;CACA;CACA;CACA;AACD,CAAU;;;;;;;;;;;;;;;AAgBV,IAAa,iBAAiB;;;;;;;;;;;;;;;AAgB9B,IAAa,oBAAoB;;;;;;;;;;;;;AAcjC,IAAa,iBAAiB;;;;;;;;;;;;;AAc9B,IAAa,aAAa;;;;;;;;;AAU1B,IAAa,iBAAiB;;;;;;;;;;;;;;;;;AAkB9B,IAAa,gBAAgB;;;;;;;;;;;;;;;AAgB7B,IAAa,gBAAgB;;;;;;;;;;;;;;;;;;AAmB7B,IAAa,aAAa;;;;;;;;;;;;;;;;;;;;AAqB1B,IAAa,uBAAuB;;;;;;;;;;;;;;;AAgBpC,IAAa,iBAAiB;;;;;;;;;;;;;;;;;;AAmB9B,IAAa,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;ACnM3B,IAAa,aAAb,cAAgC,MAAM;CACrC,OAAyB;CACzB;CACA;CACA;;;;;;;CAQA,YAAY,SAAiB,SAA4B;EACxD,MAAM,QAAQ,QAAQ;EACtB,MAAM,SAAS,UAAU,KAAA,IAAY,KAAA,IAAY,EAAE,MAAM,CAAC;EAC1D,OAAO,eAAe,MAAM,OAAO,IAAI,6BAA6B,GAAG,EAAE,OAAO,KAAK,CAAC;EACtF,KAAK,SAAS,QAAQ;EACtB,KAAK,OAAO,QAAQ;EACpB,IAAI,QAAQ,YAAY,KAAA,GAAW,KAAK,UAAU,QAAQ;CAC3D;AACD;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,aAAa,OAAqC;CACjE,IAAI,EAAA,GAACA,oBAAAA,QAAAA,CAAQ,KAAK,GAAG,OAAO;CAC5B,QAAA,GAAOC,oBAAAA,MAAAA,OAAY;EAClB,IAAIC,oBAAAA,WAAW,UAAU,KAAK,MAAM,MAAM,WAAW,OAAO;EAE5D,IADmBA,oBAAAA,WAAW,SAAS,OAAO,OAAO,IAAI,6BAA6B,CAClF,CAAA,EAAY,UAAU,OAAO,OAAO;EACxC,MAAM,SAAkBA,oBAAAA,WAAW,QAAQ,KAAK,OAAO,QAAQ;EAC/D,MAAM,OAAgBA,oBAAAA,WAAW,QAAQ,KAAK,OAAO,MAAM;EAC3D,MAAM,UAAmBA,oBAAAA,WAAW,QAAQ,KAAK,OAAO,SAAS;EACjE,IAAI,YAAY,KAAA,GAAW;GAC1B,IAAI,EAAA,GAACC,oBAAAA,SAAAA,CAAS,OAAO,KAAK,EAAA,GAACC,oBAAAA,WAAAA,CAAW,OAAO,GAAG,OAAO;GACvD,MAAM,QAAiBF,oBAAAA,WAAW,QAAQ,KAAK,SAAS,OAAO;GAC/D,IAAI,UAAU,KAAA,KAAa,UAAU,UAAU,UAAU,UAAU,UAAU,WAC5E,OAAO;GACR,KAAK,MAAM,OAAO;IAAC;IAAQ;IAAW;GAAM,GAAG;IAC9C,MAAM,SAAkBA,oBAAAA,WAAW,QAAQ,KAAK,SAAS,GAAG;IAC5D,IAAI,WAAW,KAAA,KAAa,EAAA,GAACG,oBAAAA,SAAAA,CAAS,MAAM,GAAG,OAAO;GACvD;GACA,MAAM,WAAoBH,oBAAAA,WAAW,QAAQ,KAAK,SAAS,UAAU;GACrE,IAAI,aAAa,KAAA,KAAa,EAAA,GAACI,oBAAAA,SAAAA,CAAS,QAAQ,GAAG,OAAO;EAC3D;EACA,OACC,cAAc,MAAM,aAAa,aAAa,MAAM,KACpD,kBAAkB,MAAM,aAAa,aAAa,IAAI;CAExD,CAAC;AACF;;;;;;;;;;;;;;;;;;AAmBA,SAAgB,qBAAqB,SAA6B;CACjE,OAAO,IAAI,WAAW,OAAO,QAAQ,sBAAsB;EAC1D,QAAQ;EACR,MAAM;CACP,CAAC;AACF;;;;;;;;;;;;;;ACxFA,IAAa,WAAA,GAAwBC,oBAAAA,UAAAA,CAAU,YAAY;;;;;;;;;;;;;;;;;;;;;;AAuB3D,IAAa,WAAA,GAAwBC,oBAAAA,SAAAA,CAAS;CAC7C,OAAA,GAAMC,oBAAAA,MAAAA,CAAcC,oBAAAA,mBAAmB,SAAS;EAC/C,IAAI,uBAAuB,KAAK,IAAI,GAAG,OAAO;EAC9C,OACC,KAAK,MAAM,QAAQ,CAAC,CAAC,QAAQ,OAAO,YAAY;GAC/C,IAAI,QAAQ,KAAK,YAAY,MAAM,YAAY,KAAK,OAAO;GAC3D,OAAO,YAAY,OAAO,QAAQ,IAAI,QAAQ;EAC/C,GAAG,CAAC,KAAK;CAEX,CAAC;CACD,MAAMC,oBAAAA;AACP,CAAC;;;;;;;;;;;;;AAcD,IAAa,UAAA,GAAsBH,oBAAAA,SAAAA,CAAS;CAAE,QAAA,GAAOI,oBAAAA,QAAAA,CAAQ,OAAO;CAAG,MAAM;AAAQ,CAAC;;;;;;;;;;;;;;AAetF,IAAa,aAAA,GAA4BJ,oBAAAA,SAAAA,CAAS;CACjD,QAAA,GAAOI,oBAAAA,QAAAA,CAAQ,OAAO;CACtB,MAAM;CACN,OAAO;CACP,QAAQF,oBAAAA;AACT,CAAC;;;;;;;;;;;;;;;;;;;;;;;;AAyBD,IAAa,WAAA,GAAwBF,oBAAAA,SAAAA,CAAS;CAC7C,SAASE,oBAAAA;CACT,MAAM;CACN,SAAS;AACV,CAAC;;;;;;;;;;;;;;;AAgBD,IAAa,WAAA,GAAwBH,oBAAAA,UAAAA,CAAU,aAAa;;;;;;;;;;;;;;;;;;AAmB5D,IAAa,WAAA,GAAwBC,oBAAAA,SAAAA,CACpC;CAAE,QAAQ;CAAS,MAAMG,oBAAAA;CAAU,SAASA,oBAAAA;CAAU,OAAOE,eAAAA;AAAW,GACxE,CAAC,OAAO,CACT;;;;;;;;;;;;AAaA,IAAa,iBAAA,GAAoCL,oBAAAA,SAAAA,CAAS;CACzD,OAAO;CACP,SAASM,oBAAAA;CACT,SAAA,GAAQF,oBAAAA,QAAAA,CAAQ,OAAO;AACxB,CAAC;;;;;;;;;;;;;AAcD,IAAa,eAAA,GAAgCJ,oBAAAA,SAAAA,CAAS;CACrD,YAAYG,oBAAAA;CACZ,QAAQA,oBAAAA;CACR,QAAQA,oBAAAA;AACT,CAAC;;;;;;;;;;;;;;;;;AAkBD,IAAa,aAAA,GAA4BH,oBAAAA,SAAAA,CAAS;CACjD,MAAME,oBAAAA;CACN,QAAQA,oBAAAA;AACT,CAAC;;;;;;;;;;;;;;;;;;;AAoBD,IAAa,aAAA,GAA4BF,oBAAAA,SAAAA,CACxC;CACC,IAAIG,oBAAAA;CACJ,QAAQA,oBAAAA;CACR,WAAW;CACX,SAAS;CACT,QAAQD,oBAAAA;CACR,OAAA,GAAME,oBAAAA,QAAAA,CAAQ,aAAa;CAC3B,UAAA,GAASA,oBAAAA,QAAAA,CAAQ,aAAa;CAC9B,SAASE,oBAAAA;CACT,SAASH,oBAAAA;AACV,GACA,CAAC,UAAU,SAAS,CACrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACtOA,SAAgB,YAAY,OAAsB;CACjD,MAAM,QAAQ,MAAM;CACpB,MAAM,QAAQ,UAAU,KAAA,IAAY,MAAM,OAAO,GAAG,MAAM,KAAK,GAAG,MAAM,MAAM,OAAO;CACrF,OAAO,IAAI,MAAM,OAAO,IAAI,MAAM,GAAG,MAAM;AAC5C;;;;;;;;;;;;;;;;;AAkBA,SAAgB,kBAAkB,QAA6B;CAC9D,MAAM,QAAQ,OAAO,OAAO;CAC5B,MAAM,OAAO,UAAU,IAAI,UAAU;CAGrC,OAAO,CAAC,GAFW,OAAO,MAAM,IAAI,MAAM,GAAG,KAAK,IAAI,OAAO,QAAQ,OAEpD,GADH,OAAO,OAAO,KAAK,UAAU,KAAK,YAAY,KAAK,GAC7C,CAAK,CAAC,CAAC,KAAK,IAAI;AACrC;;;;;;;;;;;;;;;;;;AAmBA,SAAgB,YAAY,SAA0B;CACrD,OAAO,QAAQ,YAAY,KAAA,IAAY,eAAe,WAAW,QAAQ;AAC1E;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,cAAc,SAA0B;CACvD,MAAM,SAAS,QAAQ,WAAW,KAAA,IAAY,CAAC,IAAI,CAAC,UAAU,QAAQ,QAAQ;CAC9E,OAAO;EACN,SAAS,QAAQ,GAAG,IAAI,QAAQ,QAAQ;EACxC,SAAS,QAAQ;EACjB,GAAG;EACH,YAAY,OAAO;CACpB,CAAC,CAAC,KAAK,IAAI;AACZ;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,SAAgB,cAAc,SAA0B;CACvD,MAAM,EAAE,YAAY,QAAQ,WAAW,QAAQ;CAC/C,MAAM,QAAQ,wBAAwB,WAAW,WAAW,OAAO,WAAW;CAC9E,MAAM,UAAU,WAAW,QAAQ,QAAQ,KAAK,GAAG,QAAQ,QAAQ;CACnE,MAAM,SAAS,QAAQ,WAAW,KAAA,IAAY,CAAC,IAAI,CAAC,UAAU,QAAQ,QAAQ;CAC9E,OAAO;EACN,SAAS,QAAQ,GAAG,IAAI,QAAQ,QAAQ;EACxC,SAAS,QAAQ;EACjB;EACA;EACA,GAAG;EACH,GAAG,QAAQ,KAAK,KAAK,WAAW,QAAQ,kBAAkB,MAAM,GAAG;EACnE,GAAG,QAAQ,QAAQ,KAAK,WAAW,WAAW,kBAAkB,MAAM,GAAG;EACzE,YAAY,OAAO;CACpB,CAAC,CAAC,KAAK,IAAI;AACZ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4CA,SAAgB,eAAe,SAAkB,OAAkC;CAClF,MAAM,MAAM,aAAa,OACvB,SACA,QAAQ,KAAK,QAAQ,WAAW,OAAO,UAAU,IAAI,CAAC,CAAC,WAAW,KAClE,QAAQ,QAAQ,QAAQ,WAAW,OAAO,UAAU,IAAI,CAAC,CAAC,WAAW,CACvE;CACA,MAAM,QAAQ,QAAQ,KAAK,OAAO,WAAW,OAAO,OAAO,WAAW,CAAC;CAEvE,MAAM,QADW,QAAQ,QAAQ,MAAM,WAAW,OAAO,UAAU,KACrD,CAAA,EAAU,OAAO,MAAM,UAAU,MAAM,WAAW,UAAU,KAAK;CAC/E,MAAM,UACL,QAAQ,KAAK,MAAM,WAAW,OAAO,OAAO,MAAM,UAAU,MAAM,WAAW,YAAY,CAAC,KAC1F,QAAQ,QAAQ,MAAM,WAAW,OAAO,OAAO,MAAM,UAAU,MAAM,WAAW,YAAY,CAAC;CAC9F,MAAM,SAAS,QAAQ,QAAQ,OAC7B,WACA,OAAO,UAAU,SAAS,OAAO,OAAO,OAAO,UAAU,MAAM,WAAW,UAAU,CACtF;CACA,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,WAAW,CAAC,QAAQ,OAAO,KAAA;CAC3D,MAAM,EAAE,YAAY,QAAQ,WAAW,QAAQ;CAC/C,OAAO;EACN;EACA,QAAQ;EACR;EACA,cAAc;EACd,UAAU;EACV,UAAU;EACV,GAAG,QAAQ,QAAQ,KAAK,GAAG,QAAQ,QAAQ;CAC5C,CAAC,CAAC,KAAA,GAAsB;AACzB;;;;;;;;;;;;;;;;;;;;;;AAuBA,SAAgB,oBAAoB,MAAc,UAA0B;CAE3E,OAAO,GADM,SAAS,MAAM,KAAK,SAAS,IAAI,IAAI,OAAO,GAAG,KAAK,IAClD,8CAA8C,SAAS;AACvE;;;;;;;;;;;;;;;;;;;AAoBA,SAAgB,qBAAqB,MAAc,UAA2B;CAC7E,OAAO,KAAK,SAAS,oBAAoB,IAAI,QAAQ,CAAC;AACvD;;;;;;;;;;;;;;;;;;AC1PA,IAAa,eAAA,GAAcI,oBAAAA,YAAAA,CAC1B;CACC,OAAA,GAAMC,oBAAAA,YAAAA,CAAY;EAAE,KAAK;EAAG,aAAa;CAAiD,CAAC;CAC3F,OAAA,GAAMA,oBAAAA,YAAAA,CAAY,EAAE,aAAa,4BAA4B,CAAC;AAC/D,GACA,EAAE,aAAa,qCAAqC,CACrD;;;;;;;;;;AAWA,IAAa,cAAA,GAAaD,oBAAAA,YAAAA,CACzB;CACC,QAAA,GAAOE,oBAAAA,WAAAA,CAAW,aAAa,EAAE,aAAa,yCAAyC,CAAC;CACxF,MAAM;AACP,GACA,EAAE,aAAa,sEAAsE,CACtF;;;;;;;;;;;;;;AAeA,IAAa,iBAAA,GAAgBF,oBAAAA,YAAAA,CAC5B;CACC,GAAG,WAAW;CACd,QAAA,GAAOG,oBAAAA,aAAAA,CAAa,cAAc,EAAE,aAAa,uCAAuC,CAAC;CACzF,SAAA,GAAQF,oBAAAA,YAAAA,CAAY;EAAE,KAAK;EAAG,aAAa;CAAuC,CAAC;AACpF,GACA,EAAE,aAAa,sEAAsE,CACtF;;;;;;;;;;;;;;;;;;;;AAqBA,IAAa,eAAA,GAAcD,oBAAAA,YAAAA,CAC1B;CACC,UAAA,GAASC,oBAAAA,YAAAA,CAAY;EACpB,KAAK;EACL,aACC;CACF,CAAC;CACD,MAAM;CACN,SAAS;AACV,GACA,EAAE,aAAa,qEAAqE,CACrF"}