@paybond/kit 0.10.0 → 0.11.1

package/dist/dev/trace-security-headers.js

@@ -0,0 +1,16 @@
+/** Security headers applied to every dev trace dashboard HTTP response. */
+export const DEV_TRACE_SECURITY_HEADERS = {
+    "cache-control": "no-store",
+    "content-security-policy": "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; connect-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'",
+    "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=()",
+    "referrer-policy": "no-referrer",
+    "x-content-type-options": "nosniff",
+    "x-frame-options": "DENY",
+};
+/** Merge dev trace security headers with a response content type. */
+export function devTraceResponseHeaders(contentType) {
+    return {
+        ...DEV_TRACE_SECURITY_HEADERS,
+        "content-type": contentType,
+    };
+}

package/dist/dev/trace-server.d.ts

@@ -0,0 +1,8 @@
+import { type Server } from "node:http";
+export type DevTraceServerOptions = {
+    port?: number;
+    host?: string;
+    cwd?: string;
+    onListen?: (url: string) => void;
+};
+export declare function startDevTraceServer(options?: DevTraceServerOptions): Promise<Server>;

package/dist/dev/trace-server.js

@@ -0,0 +1,38 @@
+import { createServer } from "node:http";
+import { DEV_TRACE_DEFAULT_PORT, listDevTraceEvents, devTraceHasCredentials } from "./trace-buffer.js";
+import { devTraceResponseHeaders } from "./trace-security-headers.js";
+import { loadDevTraceDashboardHtml } from "./trace-ui.js";
+export async function startDevTraceServer(options = {}) {
+    const port = options.port ?? DEV_TRACE_DEFAULT_PORT;
+    const host = options.host ?? "127.0.0.1";
+    const cwd = options.cwd ?? process.cwd();
+    const dashboardHtml = loadDevTraceDashboardHtml();
+    const server = createServer((req, res) => {
+        const url = new URL(req.url ?? "/", `http://${host}:${port}`);
+        const events = listDevTraceEvents(cwd);
+        if (url.pathname === "/api/events") {
+            res.writeHead(200, devTraceResponseHeaders("application/json; charset=utf-8"));
+            res.end(JSON.stringify({
+                events,
+                has_credentials: devTraceHasCredentials(),
+            }, null, 2));
+            return;
+        }
+        if (url.pathname === "/" || url.pathname.startsWith("/runs/")) {
+            res.writeHead(200, devTraceResponseHeaders("text/html; charset=utf-8"));
+            res.end(dashboardHtml);
+            return;
+        }
+        res.writeHead(404, devTraceResponseHeaders("text/plain; charset=utf-8"));
+        res.end("Not found");
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(port, host, () => {
+            server.off("error", reject);
+            options.onListen?.(`http://${host}:${port}`);
+            resolve();
+        });
+    });
+    return server;
+}

package/dist/dev/trace-ui.d.ts

@@ -0,0 +1,4 @@
+/** Resolve bundled or monorepo dev trace dashboard HTML. */
+export declare function resolveDevTraceUiDashboardPath(cwd?: string): string;
+/** Load the self-contained dev trace dashboard HTML shell. */
+export declare function loadDevTraceDashboardHtml(cwd?: string): string;

package/dist/dev/trace-ui.js

@@ -0,0 +1,25 @@
+import { readFileSync } from "node:fs";
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+const MODULE_DIR = dirname(fileURLToPath(import.meta.url));
+/** Resolve bundled or monorepo dev trace dashboard HTML. */
+export function resolveDevTraceUiDashboardPath(cwd = process.cwd()) {
+    const candidates = [
+        join(cwd, "kit/dev/trace-ui/dashboard.html"),
+        join(MODULE_DIR, "../../dev/trace-ui/dashboard.html"),
+        join(MODULE_DIR, "../../../dev/trace-ui/dashboard.html"),
+        join(MODULE_DIR, "../../../../dev/trace-ui/dashboard.html"),
+        join(MODULE_DIR, "../../../../../kit/dev/trace-ui/dashboard.html"),
+    ];
+    for (const candidate of candidates) {
+        if (existsSync(candidate)) {
+            return candidate;
+        }
+    }
+    throw new Error("Dev trace dashboard not found. Run from the Paybond monorepo or install @paybond/kit with bundled dev assets.");
+}
+/** Load the self-contained dev trace dashboard HTML shell. */
+export function loadDevTraceDashboardHtml(cwd = process.cwd()) {
+    return readFileSync(resolveDevTraceUiDashboardPath(cwd), "utf8");
+}

package/dist/dev/wiremock-up.d.ts

@@ -0,0 +1,15 @@
+export type DevWiremockUpOptions = {
+    port?: number;
+    down?: boolean;
+};
+export type DevWiremockUpResult = {
+    gateway_url: string;
+    port: number;
+    wiremock_dir: string;
+    container_name: string;
+    status: "started" | "already_running" | "stopped";
+    next_commands: string[];
+};
+/** Resolve bundled or monorepo WireMock mapping directory for `paybond dev up`. */
+export declare function resolveDevWiremockDir(cwd?: string): string;
+export declare function runDevWiremockUp(options?: DevWiremockUpOptions): Promise<DevWiremockUpResult>;

package/dist/dev/wiremock-up.js

@@ -0,0 +1,118 @@
+import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { DEV_WIREMOCK_CONTAINER_NAME, DEV_WIREMOCK_DEFAULT_PORT, } from "./offline-gateway.js";
+const MODULE_DIR = dirname(fileURLToPath(import.meta.url));
+function spawnCommand(command, args) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(command, args, { stdio: ["ignore", "pipe", "pipe"] });
+        const stdoutChunks = [];
+        const stderrChunks = [];
+        child.stdout?.on("data", (chunk) => stdoutChunks.push(chunk));
+        child.stderr?.on("data", (chunk) => stderrChunks.push(chunk));
+        child.on("error", reject);
+        child.on("close", (code) => {
+            resolve({
+                code: code ?? 1,
+                stdout: Buffer.concat(stdoutChunks).toString("utf8"),
+                stderr: Buffer.concat(stderrChunks).toString("utf8"),
+            });
+        });
+    });
+}
+/** Resolve bundled or monorepo WireMock mapping directory for `paybond dev up`. */
+export function resolveDevWiremockDir(cwd = process.cwd()) {
+    const candidates = [
+        join(cwd, "examples/partner-dry-run-wiremock/gateway-wiremock"),
+        join(cwd, "kit/dev/wiremock"),
+        join(MODULE_DIR, "../../../dev/wiremock"),
+        join(MODULE_DIR, "../../../../dev/wiremock"),
+        join(MODULE_DIR, "../../../../../kit/dev/wiremock"),
+    ];
+    for (const candidate of candidates) {
+        if (existsSync(join(candidate, "mappings"))) {
+            return candidate;
+        }
+    }
+    throw new Error("WireMock mappings not found. Run from the Paybond monorepo or install @paybond/kit with bundled dev assets.");
+}
+async function dockerContainerRunning(name) {
+    const result = await spawnCommand("docker", ["inspect", "-f", "{{.State.Running}}", name]);
+    return result.code === 0 && result.stdout.trim() === "true";
+}
+async function waitWiremockReady(baseUrl, attempts = 40, delayMs = 250) {
+    const adminUrl = `${baseUrl.replace(/\/+$/, "")}/__admin/mappings`;
+    let lastError;
+    for (let attempt = 0; attempt < attempts; attempt += 1) {
+        try {
+            const response = await fetch(adminUrl, { signal: AbortSignal.timeout(2_000) });
+            if (response.ok) {
+                return;
+            }
+        }
+        catch (err) {
+            lastError = err;
+        }
+        await new Promise((resolve) => setTimeout(resolve, delayMs));
+    }
+    throw new Error(`WireMock not ready at ${adminUrl}: ${String(lastError)}`);
+}
+function buildNextCommands(gatewayUrl) {
+    return [
+        `paybond dev loop --gateway ${gatewayUrl} --no-login`,
+        "paybond dev smoke --offline",
+        "paybond dev trace",
+    ];
+}
+export async function runDevWiremockUp(options = {}) {
+    const port = options.port ?? DEV_WIREMOCK_DEFAULT_PORT;
+    const gatewayUrl = `http://127.0.0.1:${port}`;
+    const wiremockDir = resolveDevWiremockDir();
+    if (options.down) {
+        if (await dockerContainerRunning(DEV_WIREMOCK_CONTAINER_NAME)) {
+            await spawnCommand("docker", ["rm", "-f", DEV_WIREMOCK_CONTAINER_NAME]);
+        }
+        return {
+            gateway_url: gatewayUrl,
+            port,
+            wiremock_dir: wiremockDir,
+            container_name: DEV_WIREMOCK_CONTAINER_NAME,
+            status: "stopped",
+            next_commands: [],
+        };
+    }
+    if (await dockerContainerRunning(DEV_WIREMOCK_CONTAINER_NAME)) {
+        return {
+            gateway_url: gatewayUrl,
+            port,
+            wiremock_dir: wiremockDir,
+            container_name: DEV_WIREMOCK_CONTAINER_NAME,
+            status: "already_running",
+            next_commands: buildNextCommands(gatewayUrl),
+        };
+    }
+    const run = await spawnCommand("docker", [
+        "run",
+        "-d",
+        "--name",
+        DEV_WIREMOCK_CONTAINER_NAME,
+        "-p",
+        `${port}:8080`,
+        "-v",
+        `${wiremockDir}:/home/wiremock`,
+        "wiremock/wiremock:3.3.1",
+    ]);
+    if (run.code !== 0) {
+        throw new Error(run.stderr.trim() || run.stdout.trim() || "docker run failed");
+    }
+    await waitWiremockReady(gatewayUrl);
+    return {
+        gateway_url: gatewayUrl,
+        port,
+        wiremock_dir: wiremockDir,
+        container_name: DEV_WIREMOCK_CONTAINER_NAME,
+        status: "started",
+        next_commands: buildNextCommands(gatewayUrl),
+    };
+}

package/dist/doctor-completion.d.ts

@@ -0,0 +1,17 @@
+/** Stripe payment-rail webhook event types that must not appear as tool-completion predicates. */
+export declare const STRIPE_FUNDING_WEBHOOK_EVENT_TYPES: readonly ["payment_intent.succeeded", "charge.succeeded"];
+export type CompletionDoctorCheck = {
+    name: string;
+    ok: boolean;
+    message: string;
+    details?: Record<string, unknown>;
+};
+export declare function isStripeFundingWebhookEventType(eventType: unknown): boolean;
+type GatewayJsonClient = {
+    getJson(path: string): Promise<Record<string, unknown>>;
+};
+export declare function runCompletionCatalogDoctorChecks(options: {
+    cwd: string;
+    gateway?: GatewayJsonClient;
+}): Promise<CompletionDoctorCheck[]>;
+export {};

package/dist/doctor-completion.js

@@ -0,0 +1,428 @@
+import { readdir, readFile } from "node:fs/promises";
+import path from "node:path";
+import { loadCompletionCatalog } from "./completion-catalog.js";
+import { completionPresetDeprecationWarning, isVendorPack, resolveCompletionPreset, vendorEvidenceSchema, } from "./completion-resolve.js";
+/** Stripe payment-rail webhook event types that must not appear as tool-completion predicates. */
+export const STRIPE_FUNDING_WEBHOOK_EVENT_TYPES = [
+    "payment_intent.succeeded",
+    "charge.succeeded",
+];
+function stableJson(value) {
+    return JSON.stringify(value);
+}
+function schemasMatch(expected, actual) {
+    return stableJson(expected) === stableJson(actual);
+}
+function parametersMatch(expected, actual) {
+    return stableJson(expected) === stableJson(actual);
+}
+const SCAFFOLD_GLOBS = [
+    /^paybond-completion-[\w-]+\.(ts|js|py)$/,
+    /^paybond-paid-tool-guard\.(ts|js|py)$/,
+    /^paybond_completion_[\w]+\.py$/,
+];
+async function findCompletionScaffolds(cwd) {
+    const matches = [];
+    try {
+        const entries = await readdir(cwd);
+        for (const entry of entries) {
+            if (SCAFFOLD_GLOBS.some((pattern) => pattern.test(entry))) {
+                matches.push(path.join(cwd, entry));
+            }
+        }
+    }
+    catch {
+        return matches;
+    }
+    return matches;
+}
+function extractPresetIdFromScaffold(body) {
+    const tsMatch = body.match(/export const COMPLETION_PRESET_ID = "([^"]+)"/);
+    if (tsMatch?.[1]) {
+        return tsMatch[1];
+    }
+    const pyMatch = body.match(/^COMPLETION_PRESET_ID = "([^"]+)"/m);
+    return pyMatch?.[1];
+}
+function schemaPropertyKeys(schema) {
+    if (!schema) {
+        return [];
+    }
+    const properties = schema.properties;
+    if (properties !== null && typeof properties === "object" && !Array.isArray(properties)) {
+        return Object.keys(properties);
+    }
+    return [];
+}
+function vendorSchemaForbiddenHits(preset, vendorSchema, forbidden) {
+    if (!vendorSchema) {
+        return [];
+    }
+    const fieldMap = preset.evidence_field_map ?? {};
+    const unmappedVendorKeys = schemaPropertyKeys(vendorSchema).filter((key) => !(key in fieldMap));
+    return forbiddenFieldHits(unmappedVendorKeys, forbidden);
+}
+function forbiddenFieldHits(propertyKeys, forbidden) {
+    if (!forbidden?.length) {
+        return [];
+    }
+    const blocked = new Set(forbidden);
+    return propertyKeys.filter((key) => blocked.has(key));
+}
+export function isStripeFundingWebhookEventType(eventType) {
+    return (typeof eventType === "string" &&
+        STRIPE_FUNDING_WEBHOOK_EVENT_TYPES.includes(eventType));
+}
+function extractTemplateParametersFromScaffold(body) {
+    const tsMatch = body.match(/export const completionTemplateParameters = (\{[\s\S]*?\}) as const;/);
+    if (tsMatch?.[1]) {
+        try {
+            return JSON.parse(tsMatch[1]);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    const pyMatch = body.match(/^completion_template_parameters: dict\[str, Any\] = (\{[\s\S]*?\})\n\n/m);
+    if (pyMatch?.[1]) {
+        try {
+            return JSON.parse(pyMatch[1].replace(/'/g, '"'));
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return undefined;
+}
+function extractVendorContractPinFromScaffold(body) {
+    const tsApi = body.match(/export const VENDOR_CONTRACT_API_VERSION = "([^"]+)"/);
+    const pyApi = body.match(/^VENDOR_CONTRACT_API_VERSION = "([^"]+)"/m);
+    const tsVendorDigest = body.match(/export const VENDOR_SCHEMA_DIGEST_HEX = "([^"]+)"/);
+    const pyVendorDigest = body.match(/^VENDOR_SCHEMA_DIGEST_HEX = "([^"]+)"/m);
+    const tsCanonicalDigest = body.match(/export const CANONICAL_SCHEMA_DIGEST_HEX = "([^"]+)"/);
+    const pyCanonicalDigest = body.match(/^CANONICAL_SCHEMA_DIGEST_HEX = "([^"]+)"/m);
+    const tsQuality = body.match(/export const VENDOR_QUALITY_FIELDS = (\[[\s\S]*?\]) as const;/);
+    const pyQuality = body.match(/^VENDOR_QUALITY_FIELDS: tuple\[str, \.\.\.\] = tuple\((\[[\s\S]*?\])\)/m);
+    let qualityFields;
+    const qualityRaw = tsQuality?.[1] ?? pyQuality?.[1];
+    if (qualityRaw) {
+        try {
+            const parsed = JSON.parse(qualityRaw);
+            if (Array.isArray(parsed)) {
+                qualityFields = parsed.filter((entry) => typeof entry === "string");
+            }
+        }
+        catch {
+            qualityFields = undefined;
+        }
+    }
+    return {
+        apiVersion: tsApi?.[1] ?? pyApi?.[1],
+        vendorSchemaDigest: tsVendorDigest?.[1] ?? pyVendorDigest?.[1],
+        canonicalSchemaDigest: tsCanonicalDigest?.[1] ?? pyCanonicalDigest?.[1],
+        qualityFields,
+    };
+}
+function extractEvidenceSchemaFromScaffold(body) {
+    const tsMatch = body.match(/export const completionEvidenceSchema = (\{[\s\S]*?\}) as const;/);
+    if (tsMatch?.[1]) {
+        try {
+            return JSON.parse(tsMatch[1]);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    const pyMatch = body.match(/^completion_evidence_schema: dict\[str, Any\] = (\{[\s\S]*?\})\n\n/m);
+    if (pyMatch?.[1]) {
+        try {
+            return JSON.parse(pyMatch[1].replace(/'/g, '"'));
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return undefined;
+}
+export async function runCompletionCatalogDoctorChecks(options) {
+    const checks = [];
+    let catalog;
+    try {
+        catalog = loadCompletionCatalog();
+        checks.push({
+            name: "completion_catalog",
+            ok: true,
+            message: `catalog v${catalog.version} loaded (${catalog.presets.length} presets)`,
+        });
+    }
+    catch (err) {
+        checks.push({
+            name: "completion_catalog",
+            ok: false,
+            message: err instanceof Error ? err.message : String(err),
+        });
+        return checks;
+    }
+    const scaffoldPaths = await findCompletionScaffolds(options.cwd);
+    const fundingEventWarnings = [];
+    const packStaleWarnings = [];
+    const qualityFieldWarnings = [];
+    if (scaffoldPaths.length === 0) {
+        checks.push({
+            name: "completion_local_scaffold",
+            ok: true,
+            message: "no local completion scaffold files in cwd",
+        });
+    }
+    else {
+        const divergences = [];
+        const deprecatedPresets = [];
+        const forbiddenFieldWarnings = [];
+        for (const scaffoldPath of scaffoldPaths) {
+            const body = await readFile(scaffoldPath, "utf8");
+            const scaffoldName = path.basename(scaffoldPath);
+            const presetId = extractPresetIdFromScaffold(body);
+            if (!presetId) {
+                continue;
+            }
+            const deprecationWarning = completionPresetDeprecationWarning(presetId);
+            if (deprecationWarning) {
+                deprecatedPresets.push(`${scaffoldName}: ${deprecationWarning}`);
+            }
+            let resolved;
+            try {
+                resolved = resolveCompletionPreset(presetId);
+            }
+            catch {
+                divergences.push(`${scaffoldName}: unknown preset ${presetId}`);
+                continue;
+            }
+            const embedded = extractEvidenceSchemaFromScaffold(body);
+            const expected = isVendorPack(resolved.preset)
+                ? resolved.preset.evidence_schema
+                : resolved.evidenceSchema;
+            if (embedded && !schemasMatch(expected, embedded)) {
+                divergences.push(`${scaffoldName}: evidence_schema diverges from catalog for ${presetId}`);
+            }
+            const forbidden = resolved.preset.forbidden_evidence_fields;
+            const hits = [
+                ...forbiddenFieldHits(schemaPropertyKeys(embedded), forbidden),
+                ...vendorSchemaForbiddenHits(resolved.preset, vendorEvidenceSchema(resolved.preset), forbidden),
+            ];
+            const uniqueHits = [...new Set(hits)];
+            if (uniqueHits.length > 0) {
+                forbiddenFieldWarnings.push(`${scaffoldName}: evidence schema includes forbidden field(s) for ${presetId}: ${uniqueHits.join(", ")}`);
+            }
+            if (resolved.harborTemplateId === "webhook_confirmation_v1") {
+                const embeddedParams = extractTemplateParametersFromScaffold(body);
+                const expectedEventType = embeddedParams?.expected_event_type ?? resolved.parameters.expected_event_type;
+                if (isStripeFundingWebhookEventType(expectedEventType)) {
+                    fundingEventWarnings.push(`${scaffoldName}: expected_event_type ${String(expectedEventType)} is a Stripe funding webhook, not tool-completion evidence`);
+                }
+            }
+            if (isVendorPack(resolved.preset)) {
+                const contract = resolved.preset.vendor_contract;
+                const pin = extractVendorContractPinFromScaffold(body);
+                if (contract) {
+                    if (!pin.apiVersion) {
+                        packStaleWarnings.push(`${scaffoldName}: missing VENDOR_CONTRACT_API_VERSION pin for ${presetId}; re-run paybond init completion`);
+                    }
+                    else if (pin.apiVersion !== contract.api_version) {
+                        packStaleWarnings.push(`${scaffoldName}: pinned api_version ${pin.apiVersion} lags catalog ${contract.api_version} for ${presetId}`);
+                    }
+                    if (pin.vendorSchemaDigest && pin.vendorSchemaDigest !== contract.schema_digest_hex) {
+                        packStaleWarnings.push(`${scaffoldName}: pinned vendor schema digest diverges from catalog for ${presetId}`);
+                    }
+                    if (pin.canonicalSchemaDigest && pin.canonicalSchemaDigest !== contract.canonical_schema_digest_hex) {
+                        packStaleWarnings.push(`${scaffoldName}: pinned canonical schema digest diverges from catalog for ${presetId}`);
+                    }
+                    const expectedQuality = contract.quality_fields ?? [];
+                    if (expectedQuality.length > 0 && !pin.qualityFields) {
+                        qualityFieldWarnings.push(`${scaffoldName}: missing VENDOR_QUALITY_FIELDS export for ${presetId}`);
+                    }
+                    else if (pin.qualityFields &&
+                        stableJson([...pin.qualityFields].sort()) !== stableJson([...expectedQuality].sort())) {
+                        qualityFieldWarnings.push(`${scaffoldName}: VENDOR_QUALITY_FIELDS diverge from catalog for ${presetId}`);
+                    }
+                }
+            }
+        }
+        if (divergences.length > 0) {
+            checks.push({
+                name: "completion_local_scaffold",
+                ok: true,
+                message: `warn: ${divergences.join("; ")}`,
+                details: { divergences },
+            });
+        }
+        else {
+            checks.push({
+                name: "completion_local_scaffold",
+                ok: true,
+                message: `checked ${scaffoldPaths.length} scaffold file(s); evidence schemas match catalog`,
+            });
+        }
+        if (deprecatedPresets.length > 0) {
+            checks.push({
+                name: "completion_deprecated_preset",
+                ok: true,
+                message: `warn: ${deprecatedPresets.join("; ")}`,
+                details: { warnings: deprecatedPresets },
+            });
+        }
+        else {
+            checks.push({
+                name: "completion_deprecated_preset",
+                ok: true,
+                message: "no deprecated completion presets in local scaffolds",
+            });
+        }
+        if (forbiddenFieldWarnings.length > 0) {
+            checks.push({
+                name: "completion_forbidden_fields",
+                ok: true,
+                message: `warn: ${forbiddenFieldWarnings.join("; ")}`,
+                details: { warnings: forbiddenFieldWarnings },
+            });
+        }
+        else {
+            checks.push({
+                name: "completion_forbidden_fields",
+                ok: true,
+                message: "local scaffold evidence schemas exclude catalog forbidden fields",
+            });
+        }
+    }
+    if (scaffoldPaths.length === 0) {
+        checks.push({
+            name: "completion_deprecated_preset",
+            ok: true,
+            message: "no local completion scaffold files in cwd",
+        });
+        checks.push({
+            name: "completion_forbidden_fields",
+            ok: true,
+            message: "no local completion scaffold files in cwd",
+        });
+    }
+    pushPackStaleCheck(checks, packStaleWarnings, scaffoldPaths.length);
+    pushQualityFieldsCheck(checks, qualityFieldWarnings, scaffoldPaths.length);
+    if (!options.gateway) {
+        checks.push({
+            name: "completion_policy_heads",
+            ok: true,
+            message: "skipped policy head check (no gateway credentials)",
+        });
+        pushFundingEventMisuseCheck(checks, fundingEventWarnings, scaffoldPaths.length);
+        return checks;
+    }
+    const archetypes = catalog.presets.filter((preset) => !isVendorPack(preset));
+    const headWarnings = [];
+    for (const preset of archetypes) {
+        if (preset.harbor_template_id === "true_v1") {
+            continue;
+        }
+        try {
+            const versions = await options.gateway.getJson(`/harbor/policy/v1/versions?${new URLSearchParams({ template_id: preset.harbor_template_id }).toString()}`);
+            const headSeq = versions.current_head_seq;
+            if (headSeq === null || headSeq === undefined) {
+                continue;
+            }
+            const versionRows = Array.isArray(versions.versions) ? versions.versions : [];
+            const head = versionRows.find((row) => typeof row === "object" &&
+                row !== null &&
+                row.version_seq === headSeq);
+            if (!head) {
+                continue;
+            }
+            const headParams = readObject(head.parameters) ?? {};
+            if (!parametersMatch(preset.parameters, headParams)) {
+                headWarnings.push(`${preset.harbor_template_id} head seq ${String(headSeq)} parameters diverge from catalog preset ${preset.preset_id}`);
+            }
+            if (preset.harbor_template_id === "webhook_confirmation_v1" &&
+                isStripeFundingWebhookEventType(headParams.expected_event_type)) {
+                fundingEventWarnings.push(`${preset.harbor_template_id} head seq ${String(headSeq)} uses Stripe funding event type ${String(headParams.expected_event_type)}`);
+            }
+        }
+        catch (err) {
+            headWarnings.push(`${preset.harbor_template_id}: could not load policy versions (${err instanceof Error ? err.message : String(err)})`);
+        }
+    }
+    if (headWarnings.length > 0) {
+        checks.push({
+            name: "completion_policy_heads",
+            ok: true,
+            message: `warn: ${headWarnings.join("; ")}`,
+            details: { warnings: headWarnings },
+        });
+    }
+    else {
+        checks.push({
+            name: "completion_policy_heads",
+            ok: true,
+            message: "published policy heads match catalog defaults (or no heads published)",
+        });
+    }
+    pushFundingEventMisuseCheck(checks, fundingEventWarnings, scaffoldPaths.length);
+    return checks;
+}
+function pushPackStaleCheck(checks, warnings, scaffoldCount) {
+    if (warnings.length > 0) {
+        checks.push({
+            name: "completion_pack_stale",
+            ok: true,
+            message: `warn: ${warnings.join("; ")}`,
+            details: { warnings },
+        });
+        return;
+    }
+    checks.push({
+        name: "completion_pack_stale",
+        ok: true,
+        message: scaffoldCount === 0
+            ? "no local completion scaffold files in cwd"
+            : "local vendor pack scaffolds match catalog contract pins",
+    });
+}
+function pushQualityFieldsCheck(checks, warnings, scaffoldCount) {
+    if (warnings.length > 0) {
+        checks.push({
+            name: "completion_quality_fields",
+            ok: true,
+            message: `warn: ${warnings.join("; ")}`,
+            details: { warnings },
+        });
+        return;
+    }
+    checks.push({
+        name: "completion_quality_fields",
+        ok: true,
+        message: scaffoldCount === 0
+            ? "no local completion scaffold files in cwd"
+            : "vendor pack scaffolds export catalog quality_fields pins",
+    });
+}
+function pushFundingEventMisuseCheck(checks, warnings, scaffoldCount) {
+    if (warnings.length > 0) {
+        checks.push({
+            name: "completion_funding_event_misuse",
+            ok: true,
+            message: `warn: ${warnings.join("; ")}`,
+            details: { warnings },
+        });
+        return;
+    }
+    checks.push({
+        name: "completion_funding_event_misuse",
+        ok: true,
+        message: scaffoldCount === 0
+            ? "no local completion scaffold files in cwd"
+            : "no Stripe funding webhook event types in webhook_confirmed scaffolds or policy heads",
+    });
+}
+function readObject(value) {
+    if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+        return value;
+    }
+    return undefined;
+}