@query-doctor/core 0.10.9 → 0.11.0

package/dist/ci/policy.cjs

@@ -0,0 +1,73 @@
+"use client";
+const require_taxonomy = require("./taxonomy.cjs");
+//#region src/ci/policy.ts
+/**
+* Opinionated safe defaults (epic #3493). A captured new query already ran in a
+* test (tested by definition), so it's informational; everything that marks a
+* genuine, diff-introduced problem fails by default. The set is deliberately
+* narrow so the gate under-fires.
+*/
+const DEFAULT_CONDITION_POLICIES = {
+	"untested-data-access": "fail",
+	"schema-drift": "fail",
+	"new-query": "warn",
+	"regression-beyond-threshold": "fail",
+	"high-value-nudge": "fail"
+};
+/**
+* Fallback for a condition with neither a repo setting nor a documented default:
+* surface it, don't block. Under-firing on an unrecognised condition is the safe
+* side of the line.
+*/
+const FALLBACK_POLICY = "warn";
+/** Resolve the effective policy for a condition: repo config, else default, else fallback. */
+function policyFor(condition, config = {}) {
+	return config[condition] ?? DEFAULT_CONDITION_POLICIES[condition] ?? "warn";
+}
+/**
+* Fold a policy over a condition's base (taxonomy) conclusion. `fail` respects
+* the taxonomy; `warn` caps a failure at `neutral` (still surfaced, never
+* blocking); `off` is handled by dropping the condition before this runs.
+*/
+function applyPolicy(base, policy) {
+	if (policy === "warn") return base === "failure" ? "neutral" : base;
+	return base;
+}
+const SEVERITY = {
+	success: 0,
+	neutral: 1,
+	failure: 2
+};
+/**
+* Evaluate a run: apply each condition's policy, then take the run conclusion as
+* the worst surfaced conclusion. Pure — the same (results, config) always yields
+* the same evaluation.
+*
+* Only diff-introduced conditions should reach here: detectors (e.g. the crude
+* gate, #3496) evaluate the PR diff, so pre-existing untouched code never
+* produces a result and can't trip a condition. With no results, the run passes.
+*/
+function evaluateRun(results, config = {}) {
+	const conditions = [];
+	for (const result of results) {
+		const policy = policyFor(result.condition, config);
+		if (policy === "off") continue;
+		conditions.push({
+			condition: result.condition,
+			policy,
+			verdict: result.verdict,
+			conclusion: applyPolicy(require_taxonomy.conclusionForVerdict(result.verdict), policy)
+		});
+	}
+	return {
+		conclusion: conditions.reduce((worst, c) => SEVERITY[c.conclusion] > SEVERITY[worst] ? c.conclusion : worst, "success"),
+		conditions
+	};
+}
+//#endregion
+exports.DEFAULT_CONDITION_POLICIES = DEFAULT_CONDITION_POLICIES;
+exports.FALLBACK_POLICY = FALLBACK_POLICY;
+exports.evaluateRun = evaluateRun;
+exports.policyFor = policyFor;
+
+//# sourceMappingURL=policy.cjs.map

package/dist/ci/policy.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.cjs","names":["conclusionForVerdict"],"sources":["../../src/ci/policy.ts"],"sourcesContent":["import { conclusionForVerdict, type CiConclusion } from \"./taxonomy.ts\";\nimport type { CiVerdict } from \"./verdict.ts\";\n\n// The policy engine (#3500). Turns the single hard-coded gate into a\n// configurable condition set: a per-repo config gives each condition\n// `fail | warn | off`, and this pure function folds (config, condition results)\n// into one run conclusion plus the per-condition verdicts that produced it.\n//\n// It sits one layer above the taxonomy (#3498): the taxonomy says what a\n// verdict *would* conclude; the policy decides whether this repo lets that\n// condition fail, soften to a warning, or be suppressed entirely.\n\n/** What a repo lets a condition do: fail the run, warn-only, or ignore it. */\nexport type ConditionPolicy = \"fail\" | \"warn\" | \"off\";\n\n/** One condition's evaluated outcome, before policy is applied. */\nexport interface ConditionResult {\n  /** Stable condition key, matched against the repo config (e.g. \"untested-data-access\"). */\n  condition: string;\n  verdict: CiVerdict;\n}\n\n/** A condition after policy resolution — its effective conclusion and the policy that shaped it. */\nexport interface ResolvedCondition {\n  condition: string;\n  policy: ConditionPolicy;\n  verdict: CiVerdict;\n  conclusion: CiConclusion;\n}\n\nexport interface RunEvaluation {\n  /** The run's overall conclusion — the worst surfaced per-condition conclusion. */\n  conclusion: CiConclusion;\n  /** Per-condition results that were surfaced (an `off` condition is dropped). */\n  conditions: ResolvedCondition[];\n}\n\n/** Per-repo policy: condition key → its policy. Absent keys fall back to defaults. */\nexport type RepoPolicyConfig = Record<string, ConditionPolicy>;\n\n/**\n * Opinionated safe defaults (epic #3493). A captured new query already ran in a\n * test (tested by definition), so it's informational; everything that marks a\n * genuine, diff-introduced problem fails by default. The set is deliberately\n * narrow so the gate under-fires.\n */\nexport const DEFAULT_CONDITION_POLICIES: RepoPolicyConfig = {\n  \"untested-data-access\": \"fail\",\n  \"schema-drift\": \"fail\", // #3296 owns the signal; this just gates on it\n  \"new-query\": \"warn\", // captured ⇒ tested — informational, surfaced, non-blocking\n  \"regression-beyond-threshold\": \"fail\", // #3104\n  \"high-value-nudge\": \"fail\", // narrow set only\n};\n\n/**\n * Fallback for a condition with neither a repo setting nor a documented default:\n * surface it, don't block. Under-firing on an unrecognised condition is the safe\n * side of the line.\n */\nexport const FALLBACK_POLICY: ConditionPolicy = \"warn\";\n\n/** Resolve the effective policy for a condition: repo config, else default, else fallback. */\nexport function policyFor(\n  condition: string,\n  config: RepoPolicyConfig = {},\n): ConditionPolicy {\n  return (\n    config[condition] ??\n    DEFAULT_CONDITION_POLICIES[condition] ??\n    FALLBACK_POLICY\n  );\n}\n\n/**\n * Fold a policy over a condition's base (taxonomy) conclusion. `fail` respects\n * the taxonomy; `warn` caps a failure at `neutral` (still surfaced, never\n * blocking); `off` is handled by dropping the condition before this runs.\n */\nfunction applyPolicy(\n  base: CiConclusion,\n  policy: ConditionPolicy,\n): CiConclusion {\n  if (policy === \"warn\") return base === \"failure\" ? \"neutral\" : base;\n  return base;\n}\n\nconst SEVERITY: Record<CiConclusion, number> = {\n  success: 0,\n  neutral: 1,\n  failure: 2,\n};\n\n/**\n * Evaluate a run: apply each condition's policy, then take the run conclusion as\n * the worst surfaced conclusion. Pure — the same (results, config) always yields\n * the same evaluation.\n *\n * Only diff-introduced conditions should reach here: detectors (e.g. the crude\n * gate, #3496) evaluate the PR diff, so pre-existing untouched code never\n * produces a result and can't trip a condition. With no results, the run passes.\n */\nexport function evaluateRun(\n  results: ConditionResult[],\n  config: RepoPolicyConfig = {},\n): RunEvaluation {\n  const conditions: ResolvedCondition[] = [];\n  for (const result of results) {\n    const policy = policyFor(result.condition, config);\n    if (policy === \"off\") continue; // suppressed entirely — not surfaced\n    conditions.push({\n      condition: result.condition,\n      policy,\n      verdict: result.verdict,\n      conclusion: applyPolicy(conclusionForVerdict(result.verdict), policy),\n    });\n  }\n  const conclusion = conditions.reduce<CiConclusion>(\n    (worst, c) =>\n      SEVERITY[c.conclusion] > SEVERITY[worst] ? c.conclusion : worst,\n    \"success\",\n  );\n  return { conclusion, conditions };\n}\n"],"mappings":";;;;;;;;;AA8CA,MAAa,6BAA+C;CAC1D,wBAAwB;CACxB,gBAAgB;CAChB,aAAa;CACb,+BAA+B;CAC/B,oBAAoB;CACrB;;;;;;AAOD,MAAa,kBAAmC;;AAGhD,SAAgB,UACd,WACA,SAA2B,EAAE,EACZ;AACjB,QACE,OAAO,cACP,2BAA2B,cAAA;;;;;;;AAU/B,SAAS,YACP,MACA,QACc;AACd,KAAI,WAAW,OAAQ,QAAO,SAAS,YAAY,YAAY;AAC/D,QAAO;;AAGT,MAAM,WAAyC;CAC7C,SAAS;CACT,SAAS;CACT,SAAS;CACV;;;;;;;;;;AAWD,SAAgB,YACd,SACA,SAA2B,EAAE,EACd;CACf,MAAM,aAAkC,EAAE;AAC1C,MAAK,MAAM,UAAU,SAAS;EAC5B,MAAM,SAAS,UAAU,OAAO,WAAW,OAAO;AAClD,MAAI,WAAW,MAAO;AACtB,aAAW,KAAK;GACd,WAAW,OAAO;GAClB;GACA,SAAS,OAAO;GAChB,YAAY,YAAYA,iBAAAA,qBAAqB,OAAO,QAAQ,EAAE,OAAO;GACtE,CAAC;;AAOJ,QAAO;EAAE,YALU,WAAW,QAC3B,OAAO,MACN,SAAS,EAAE,cAAc,SAAS,SAAS,EAAE,aAAa,OAC5D,UACD;EACoB;EAAY"}

package/dist/ci/policy.d.cts

@@ -0,0 +1,57 @@
+'use client';
+
+import { CiVerdict } from "./verdict.cjs";
+import { CiConclusion } from "./taxonomy.cjs";
+
+//#region src/ci/policy.d.ts
+/** What a repo lets a condition do: fail the run, warn-only, or ignore it. */
+type ConditionPolicy = "fail" | "warn" | "off";
+/** One condition's evaluated outcome, before policy is applied. */
+interface ConditionResult {
+  /** Stable condition key, matched against the repo config (e.g. "untested-data-access"). */
+  condition: string;
+  verdict: CiVerdict;
+}
+/** A condition after policy resolution — its effective conclusion and the policy that shaped it. */
+interface ResolvedCondition {
+  condition: string;
+  policy: ConditionPolicy;
+  verdict: CiVerdict;
+  conclusion: CiConclusion;
+}
+interface RunEvaluation {
+  /** The run's overall conclusion — the worst surfaced per-condition conclusion. */
+  conclusion: CiConclusion;
+  /** Per-condition results that were surfaced (an `off` condition is dropped). */
+  conditions: ResolvedCondition[];
+}
+/** Per-repo policy: condition key → its policy. Absent keys fall back to defaults. */
+type RepoPolicyConfig = Record<string, ConditionPolicy>;
+/**
+ * Opinionated safe defaults (epic #3493). A captured new query already ran in a
+ * test (tested by definition), so it's informational; everything that marks a
+ * genuine, diff-introduced problem fails by default. The set is deliberately
+ * narrow so the gate under-fires.
+ */
+declare const DEFAULT_CONDITION_POLICIES: RepoPolicyConfig;
+/**
+ * Fallback for a condition with neither a repo setting nor a documented default:
+ * surface it, don't block. Under-firing on an unrecognised condition is the safe
+ * side of the line.
+ */
+declare const FALLBACK_POLICY: ConditionPolicy;
+/** Resolve the effective policy for a condition: repo config, else default, else fallback. */
+declare function policyFor(condition: string, config?: RepoPolicyConfig): ConditionPolicy;
+/**
+ * Evaluate a run: apply each condition's policy, then take the run conclusion as
+ * the worst surfaced conclusion. Pure — the same (results, config) always yields
+ * the same evaluation.
+ *
+ * Only diff-introduced conditions should reach here: detectors (e.g. the crude
+ * gate, #3496) evaluate the PR diff, so pre-existing untouched code never
+ * produces a result and can't trip a condition. With no results, the run passes.
+ */
+declare function evaluateRun(results: ConditionResult[], config?: RepoPolicyConfig): RunEvaluation;
+//#endregion
+export { ConditionPolicy, ConditionResult, DEFAULT_CONDITION_POLICIES, FALLBACK_POLICY, RepoPolicyConfig, ResolvedCondition, RunEvaluation, evaluateRun, policyFor };
+//# sourceMappingURL=policy.d.cts.map

package/dist/ci/policy.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.cts","names":[],"sources":["../../src/ci/policy.ts"],"mappings":";;;;;;;KAaY,eAAA;;UAGK,eAAA;EAHU;EAKzB,SAAA;EACA,OAAA,EAAS,SAAA;AAAA;AAHX;AAAA,UAOiB,iBAAA;EACf,SAAA;EACA,MAAA,EAAQ,eAAA;EACR,OAAA,EAAS,SAAA;EACT,UAAA,EAAY,YAAA;AAAA;AAAA,UAGG,aAAA;EAXG;EAalB,UAAA,EAAY,YAAA;EAToB;EAWhC,UAAA,EAAY,iBAAA;AAAA;;KAIF,gBAAA,GAAmB,MAAA,SAAe,eAAA;;;;;;;cAQjC,0BAAA,EAA4B,gBAAA;;;;;AAhBzC;cA6Ba,eAAA,EAAiB,eAAA;;iBAGd,SAAA,CACd,SAAA,UACA,MAAA,GAAQ,gBAAA,GACP,eAAA;;;;;;;AA3BH;;;iBA+DgB,WAAA,CACd,OAAA,EAAS,eAAA,IACT,MAAA,GAAQ,gBAAA,GACP,aAAA"}

package/dist/ci/policy.d.mts

@@ -0,0 +1,57 @@
+'use client';
+
+import { CiVerdict } from "./verdict.mjs";
+import { CiConclusion } from "./taxonomy.mjs";
+
+//#region src/ci/policy.d.ts
+/** What a repo lets a condition do: fail the run, warn-only, or ignore it. */
+type ConditionPolicy = "fail" | "warn" | "off";
+/** One condition's evaluated outcome, before policy is applied. */
+interface ConditionResult {
+  /** Stable condition key, matched against the repo config (e.g. "untested-data-access"). */
+  condition: string;
+  verdict: CiVerdict;
+}
+/** A condition after policy resolution — its effective conclusion and the policy that shaped it. */
+interface ResolvedCondition {
+  condition: string;
+  policy: ConditionPolicy;
+  verdict: CiVerdict;
+  conclusion: CiConclusion;
+}
+interface RunEvaluation {
+  /** The run's overall conclusion — the worst surfaced per-condition conclusion. */
+  conclusion: CiConclusion;
+  /** Per-condition results that were surfaced (an `off` condition is dropped). */
+  conditions: ResolvedCondition[];
+}
+/** Per-repo policy: condition key → its policy. Absent keys fall back to defaults. */
+type RepoPolicyConfig = Record<string, ConditionPolicy>;
+/**
+ * Opinionated safe defaults (epic #3493). A captured new query already ran in a
+ * test (tested by definition), so it's informational; everything that marks a
+ * genuine, diff-introduced problem fails by default. The set is deliberately
+ * narrow so the gate under-fires.
+ */
+declare const DEFAULT_CONDITION_POLICIES: RepoPolicyConfig;
+/**
+ * Fallback for a condition with neither a repo setting nor a documented default:
+ * surface it, don't block. Under-firing on an unrecognised condition is the safe
+ * side of the line.
+ */
+declare const FALLBACK_POLICY: ConditionPolicy;
+/** Resolve the effective policy for a condition: repo config, else default, else fallback. */
+declare function policyFor(condition: string, config?: RepoPolicyConfig): ConditionPolicy;
+/**
+ * Evaluate a run: apply each condition's policy, then take the run conclusion as
+ * the worst surfaced conclusion. Pure — the same (results, config) always yields
+ * the same evaluation.
+ *
+ * Only diff-introduced conditions should reach here: detectors (e.g. the crude
+ * gate, #3496) evaluate the PR diff, so pre-existing untouched code never
+ * produces a result and can't trip a condition. With no results, the run passes.
+ */
+declare function evaluateRun(results: ConditionResult[], config?: RepoPolicyConfig): RunEvaluation;
+//#endregion
+export { ConditionPolicy, ConditionResult, DEFAULT_CONDITION_POLICIES, FALLBACK_POLICY, RepoPolicyConfig, ResolvedCondition, RunEvaluation, evaluateRun, policyFor };
+//# sourceMappingURL=policy.d.mts.map

package/dist/ci/policy.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.mts","names":[],"sources":["../../src/ci/policy.ts"],"mappings":";;;;;;;KAaY,eAAA;;UAGK,eAAA;EAHU;EAKzB,SAAA;EACA,OAAA,EAAS,SAAA;AAAA;AAHX;AAAA,UAOiB,iBAAA;EACf,SAAA;EACA,MAAA,EAAQ,eAAA;EACR,OAAA,EAAS,SAAA;EACT,UAAA,EAAY,YAAA;AAAA;AAAA,UAGG,aAAA;EAXG;EAalB,UAAA,EAAY,YAAA;EAToB;EAWhC,UAAA,EAAY,iBAAA;AAAA;;KAIF,gBAAA,GAAmB,MAAA,SAAe,eAAA;;;;;;;cAQjC,0BAAA,EAA4B,gBAAA;;;;;AAhBzC;cA6Ba,eAAA,EAAiB,eAAA;;iBAGd,SAAA,CACd,SAAA,UACA,MAAA,GAAQ,gBAAA,GACP,eAAA;;;;;;;AA3BH;;;iBA+DgB,WAAA,CACd,OAAA,EAAS,eAAA,IACT,MAAA,GAAQ,gBAAA,GACP,aAAA"}

package/dist/ci/policy.mjs

@@ -0,0 +1,70 @@
+"use client";
+import { conclusionForVerdict } from "./taxonomy.mjs";
+//#region src/ci/policy.ts
+/**
+* Opinionated safe defaults (epic #3493). A captured new query already ran in a
+* test (tested by definition), so it's informational; everything that marks a
+* genuine, diff-introduced problem fails by default. The set is deliberately
+* narrow so the gate under-fires.
+*/
+const DEFAULT_CONDITION_POLICIES = {
+	"untested-data-access": "fail",
+	"schema-drift": "fail",
+	"new-query": "warn",
+	"regression-beyond-threshold": "fail",
+	"high-value-nudge": "fail"
+};
+/**
+* Fallback for a condition with neither a repo setting nor a documented default:
+* surface it, don't block. Under-firing on an unrecognised condition is the safe
+* side of the line.
+*/
+const FALLBACK_POLICY = "warn";
+/** Resolve the effective policy for a condition: repo config, else default, else fallback. */
+function policyFor(condition, config = {}) {
+	return config[condition] ?? DEFAULT_CONDITION_POLICIES[condition] ?? "warn";
+}
+/**
+* Fold a policy over a condition's base (taxonomy) conclusion. `fail` respects
+* the taxonomy; `warn` caps a failure at `neutral` (still surfaced, never
+* blocking); `off` is handled by dropping the condition before this runs.
+*/
+function applyPolicy(base, policy) {
+	if (policy === "warn") return base === "failure" ? "neutral" : base;
+	return base;
+}
+const SEVERITY = {
+	success: 0,
+	neutral: 1,
+	failure: 2
+};
+/**
+* Evaluate a run: apply each condition's policy, then take the run conclusion as
+* the worst surfaced conclusion. Pure — the same (results, config) always yields
+* the same evaluation.
+*
+* Only diff-introduced conditions should reach here: detectors (e.g. the crude
+* gate, #3496) evaluate the PR diff, so pre-existing untouched code never
+* produces a result and can't trip a condition. With no results, the run passes.
+*/
+function evaluateRun(results, config = {}) {
+	const conditions = [];
+	for (const result of results) {
+		const policy = policyFor(result.condition, config);
+		if (policy === "off") continue;
+		conditions.push({
+			condition: result.condition,
+			policy,
+			verdict: result.verdict,
+			conclusion: applyPolicy(conclusionForVerdict(result.verdict), policy)
+		});
+	}
+	return {
+		conclusion: conditions.reduce((worst, c) => SEVERITY[c.conclusion] > SEVERITY[worst] ? c.conclusion : worst, "success"),
+		conditions
+	};
+}
+//#endregion
+export { DEFAULT_CONDITION_POLICIES, FALLBACK_POLICY, evaluateRun, policyFor };
+
+//# sourceMappingURL=policy.mjs.map

package/dist/ci/policy.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.mjs","names":[],"sources":["../../src/ci/policy.ts"],"sourcesContent":["import { conclusionForVerdict, type CiConclusion } from \"./taxonomy.ts\";\nimport type { CiVerdict } from \"./verdict.ts\";\n\n// The policy engine (#3500). Turns the single hard-coded gate into a\n// configurable condition set: a per-repo config gives each condition\n// `fail | warn | off`, and this pure function folds (config, condition results)\n// into one run conclusion plus the per-condition verdicts that produced it.\n//\n// It sits one layer above the taxonomy (#3498): the taxonomy says what a\n// verdict *would* conclude; the policy decides whether this repo lets that\n// condition fail, soften to a warning, or be suppressed entirely.\n\n/** What a repo lets a condition do: fail the run, warn-only, or ignore it. */\nexport type ConditionPolicy = \"fail\" | \"warn\" | \"off\";\n\n/** One condition's evaluated outcome, before policy is applied. */\nexport interface ConditionResult {\n  /** Stable condition key, matched against the repo config (e.g. \"untested-data-access\"). */\n  condition: string;\n  verdict: CiVerdict;\n}\n\n/** A condition after policy resolution — its effective conclusion and the policy that shaped it. */\nexport interface ResolvedCondition {\n  condition: string;\n  policy: ConditionPolicy;\n  verdict: CiVerdict;\n  conclusion: CiConclusion;\n}\n\nexport interface RunEvaluation {\n  /** The run's overall conclusion — the worst surfaced per-condition conclusion. */\n  conclusion: CiConclusion;\n  /** Per-condition results that were surfaced (an `off` condition is dropped). */\n  conditions: ResolvedCondition[];\n}\n\n/** Per-repo policy: condition key → its policy. Absent keys fall back to defaults. */\nexport type RepoPolicyConfig = Record<string, ConditionPolicy>;\n\n/**\n * Opinionated safe defaults (epic #3493). A captured new query already ran in a\n * test (tested by definition), so it's informational; everything that marks a\n * genuine, diff-introduced problem fails by default. The set is deliberately\n * narrow so the gate under-fires.\n */\nexport const DEFAULT_CONDITION_POLICIES: RepoPolicyConfig = {\n  \"untested-data-access\": \"fail\",\n  \"schema-drift\": \"fail\", // #3296 owns the signal; this just gates on it\n  \"new-query\": \"warn\", // captured ⇒ tested — informational, surfaced, non-blocking\n  \"regression-beyond-threshold\": \"fail\", // #3104\n  \"high-value-nudge\": \"fail\", // narrow set only\n};\n\n/**\n * Fallback for a condition with neither a repo setting nor a documented default:\n * surface it, don't block. Under-firing on an unrecognised condition is the safe\n * side of the line.\n */\nexport const FALLBACK_POLICY: ConditionPolicy = \"warn\";\n\n/** Resolve the effective policy for a condition: repo config, else default, else fallback. */\nexport function policyFor(\n  condition: string,\n  config: RepoPolicyConfig = {},\n): ConditionPolicy {\n  return (\n    config[condition] ??\n    DEFAULT_CONDITION_POLICIES[condition] ??\n    FALLBACK_POLICY\n  );\n}\n\n/**\n * Fold a policy over a condition's base (taxonomy) conclusion. `fail` respects\n * the taxonomy; `warn` caps a failure at `neutral` (still surfaced, never\n * blocking); `off` is handled by dropping the condition before this runs.\n */\nfunction applyPolicy(\n  base: CiConclusion,\n  policy: ConditionPolicy,\n): CiConclusion {\n  if (policy === \"warn\") return base === \"failure\" ? \"neutral\" : base;\n  return base;\n}\n\nconst SEVERITY: Record<CiConclusion, number> = {\n  success: 0,\n  neutral: 1,\n  failure: 2,\n};\n\n/**\n * Evaluate a run: apply each condition's policy, then take the run conclusion as\n * the worst surfaced conclusion. Pure — the same (results, config) always yields\n * the same evaluation.\n *\n * Only diff-introduced conditions should reach here: detectors (e.g. the crude\n * gate, #3496) evaluate the PR diff, so pre-existing untouched code never\n * produces a result and can't trip a condition. With no results, the run passes.\n */\nexport function evaluateRun(\n  results: ConditionResult[],\n  config: RepoPolicyConfig = {},\n): RunEvaluation {\n  const conditions: ResolvedCondition[] = [];\n  for (const result of results) {\n    const policy = policyFor(result.condition, config);\n    if (policy === \"off\") continue; // suppressed entirely — not surfaced\n    conditions.push({\n      condition: result.condition,\n      policy,\n      verdict: result.verdict,\n      conclusion: applyPolicy(conclusionForVerdict(result.verdict), policy),\n    });\n  }\n  const conclusion = conditions.reduce<CiConclusion>(\n    (worst, c) =>\n      SEVERITY[c.conclusion] > SEVERITY[worst] ? c.conclusion : worst,\n    \"success\",\n  );\n  return { conclusion, conditions };\n}\n"],"mappings":";;;;;;;;;AA8CA,MAAa,6BAA+C;CAC1D,wBAAwB;CACxB,gBAAgB;CAChB,aAAa;CACb,+BAA+B;CAC/B,oBAAoB;CACrB;;;;;;AAOD,MAAa,kBAAmC;;AAGhD,SAAgB,UACd,WACA,SAA2B,EAAE,EACZ;AACjB,QACE,OAAO,cACP,2BAA2B,cAAA;;;;;;;AAU/B,SAAS,YACP,MACA,QACc;AACd,KAAI,WAAW,OAAQ,QAAO,SAAS,YAAY,YAAY;AAC/D,QAAO;;AAGT,MAAM,WAAyC;CAC7C,SAAS;CACT,SAAS;CACT,SAAS;CACV;;;;;;;;;;AAWD,SAAgB,YACd,SACA,SAA2B,EAAE,EACd;CACf,MAAM,aAAkC,EAAE;AAC1C,MAAK,MAAM,UAAU,SAAS;EAC5B,MAAM,SAAS,UAAU,OAAO,WAAW,OAAO;AAClD,MAAI,WAAW,MAAO;AACtB,aAAW,KAAK;GACd,WAAW,OAAO;GAClB;GACA,SAAS,OAAO;GAChB,YAAY,YAAY,qBAAqB,OAAO,QAAQ,EAAE,OAAO;GACtE,CAAC;;AAOJ,QAAO;EAAE,YALU,WAAW,QAC3B,OAAO,MACN,SAAS,EAAE,cAAc,SAAS,SAAS,EAAE,aAAa,OAC5D,UACD;EACoB;EAAY"}

package/dist/ci/taxonomy.cjs

@@ -0,0 +1,28 @@
+"use client";
+//#region src/ci/taxonomy.ts
+const CLASS_TO_CONCLUSION = {
+	pass: "success",
+	"coverage-gap": "failure",
+	finding: "failure",
+	"uncertain-conservative-flag": "failure",
+	"setup-broken": "failure",
+	"infra-error": "neutral"
+};
+/** Map one verdict class to its CI conclusion. Total and deterministic. */
+function conclusionForVerdictClass(verdictClass) {
+	return CLASS_TO_CONCLUSION[verdictClass];
+}
+/** Convenience over {@link conclusionForVerdictClass} for a whole verdict. */
+function conclusionForVerdict(verdict) {
+	return conclusionForVerdictClass(verdict.verdictClass);
+}
+/** True when a class blocks the PR (a red check), as opposed to passing or neutral. */
+function isBlocking(verdictClass) {
+	return conclusionForVerdictClass(verdictClass) === "failure";
+}
+//#endregion
+exports.conclusionForVerdict = conclusionForVerdict;
+exports.conclusionForVerdictClass = conclusionForVerdictClass;
+exports.isBlocking = isBlocking;
+
+//# sourceMappingURL=taxonomy.cjs.map

package/dist/ci/taxonomy.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"taxonomy.cjs","names":[],"sources":["../../src/ci/taxonomy.ts"],"sourcesContent":["import type { VerdictClass } from \"./verdict.ts\";\n\n// The failure taxonomy (#3498). The single deterministic hinge between \"what the\n// tool honestly knows\" (the verdict class) and \"what the CI check concludes\".\n// Keeping it a pure function of the verdict class — not scattered `if` branches\n// at each call site — is what guarantees every condition gets the *right*\n// conclusion and the same one every time.\n\n/**\n * A GitHub check-run conclusion, narrowed to the three this loop uses.\n * `neutral` reports \"we didn't/couldn't decide\" without a red X; `failure`\n * blocks; `success` is the clean pass.\n */\nexport type CiConclusion = \"success\" | \"failure\" | \"neutral\";\n\nconst CLASS_TO_CONCLUSION: Record<VerdictClass, CiConclusion> = {\n  pass: \"success\",\n  // A known coverage gap, a real finding, and a conservative \"unverified\" flag\n  // all block the PR. They differ in their *reason and framing* (carried by the\n  // verdict), not in whether they gate — an uncertain result still fails, but\n  // with honest \"we're not sure, flagging to be safe\" messaging rather than a\n  // \"your query is broken\" claim.\n  \"coverage-gap\": \"failure\",\n  finding: \"failure\",\n  \"uncertain-conservative-flag\": \"failure\",\n  // Capture isn't emitting: a setup problem the user must fix, surfaced as a\n  // failure with setup next-steps — never silently green, or it reads as safe.\n  \"setup-broken\": \"failure\",\n  // A transient infra/transport error (e.g. a dropped WebSocket to the API) is\n  // not the user's query problem, so it resolves to neutral, never a red X\n  // (adopts #3401).\n  \"infra-error\": \"neutral\",\n};\n\n/** Map one verdict class to its CI conclusion. Total and deterministic. */\nexport function conclusionForVerdictClass(\n  verdictClass: VerdictClass,\n): CiConclusion {\n  return CLASS_TO_CONCLUSION[verdictClass];\n}\n\n/** Convenience over {@link conclusionForVerdictClass} for a whole verdict. */\nexport function conclusionForVerdict(verdict: {\n  verdictClass: VerdictClass;\n}): CiConclusion {\n  return conclusionForVerdictClass(verdict.verdictClass);\n}\n\n/** True when a class blocks the PR (a red check), as opposed to passing or neutral. */\nexport function isBlocking(verdictClass: VerdictClass): boolean {\n  return conclusionForVerdictClass(verdictClass) === \"failure\";\n}\n"],"mappings":";;AAeA,MAAM,sBAA0D;CAC9D,MAAM;CAMN,gBAAgB;CAChB,SAAS;CACT,+BAA+B;CAG/B,gBAAgB;CAIhB,eAAe;CAChB;;AAGD,SAAgB,0BACd,cACc;AACd,QAAO,oBAAoB;;;AAI7B,SAAgB,qBAAqB,SAEpB;AACf,QAAO,0BAA0B,QAAQ,aAAa;;;AAIxD,SAAgB,WAAW,cAAqC;AAC9D,QAAO,0BAA0B,aAAa,KAAK"}

package/dist/ci/taxonomy.d.cts

@@ -0,0 +1,22 @@
+'use client';
+
+import { VerdictClass } from "./verdict.cjs";
+
+//#region src/ci/taxonomy.d.ts
+/**
+ * A GitHub check-run conclusion, narrowed to the three this loop uses.
+ * `neutral` reports "we didn't/couldn't decide" without a red X; `failure`
+ * blocks; `success` is the clean pass.
+ */
+type CiConclusion = "success" | "failure" | "neutral";
+/** Map one verdict class to its CI conclusion. Total and deterministic. */
+declare function conclusionForVerdictClass(verdictClass: VerdictClass): CiConclusion;
+/** Convenience over {@link conclusionForVerdictClass} for a whole verdict. */
+declare function conclusionForVerdict(verdict: {
+  verdictClass: VerdictClass;
+}): CiConclusion;
+/** True when a class blocks the PR (a red check), as opposed to passing or neutral. */
+declare function isBlocking(verdictClass: VerdictClass): boolean;
+//#endregion
+export { CiConclusion, conclusionForVerdict, conclusionForVerdictClass, isBlocking };
+//# sourceMappingURL=taxonomy.d.cts.map

package/dist/ci/taxonomy.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"taxonomy.d.cts","names":[],"sources":["../../src/ci/taxonomy.ts"],"mappings":";;;;;;;;AAaA;;KAAY,YAAA;;iBAsBI,yBAAA,CACd,YAAA,EAAc,YAAA,GACb,YAAA;AAFH;AAAA,iBAOgB,oBAAA,CAAqB,OAAA;EACnC,YAAA,EAAc,YAAA;AAAA,IACZ,YAAA;;iBAKY,UAAA,CAAW,YAAA,EAAc,YAAA"}

package/dist/ci/taxonomy.d.mts

@@ -0,0 +1,22 @@
+'use client';
+
+import { VerdictClass } from "./verdict.mjs";
+
+//#region src/ci/taxonomy.d.ts
+/**
+ * A GitHub check-run conclusion, narrowed to the three this loop uses.
+ * `neutral` reports "we didn't/couldn't decide" without a red X; `failure`
+ * blocks; `success` is the clean pass.
+ */
+type CiConclusion = "success" | "failure" | "neutral";
+/** Map one verdict class to its CI conclusion. Total and deterministic. */
+declare function conclusionForVerdictClass(verdictClass: VerdictClass): CiConclusion;
+/** Convenience over {@link conclusionForVerdictClass} for a whole verdict. */
+declare function conclusionForVerdict(verdict: {
+  verdictClass: VerdictClass;
+}): CiConclusion;
+/** True when a class blocks the PR (a red check), as opposed to passing or neutral. */
+declare function isBlocking(verdictClass: VerdictClass): boolean;
+//#endregion
+export { CiConclusion, conclusionForVerdict, conclusionForVerdictClass, isBlocking };
+//# sourceMappingURL=taxonomy.d.mts.map

package/dist/ci/taxonomy.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"taxonomy.d.mts","names":[],"sources":["../../src/ci/taxonomy.ts"],"mappings":";;;;;;;;AAaA;;KAAY,YAAA;;iBAsBI,yBAAA,CACd,YAAA,EAAc,YAAA,GACb,YAAA;AAFH;AAAA,iBAOgB,oBAAA,CAAqB,OAAA;EACnC,YAAA,EAAc,YAAA;AAAA,IACZ,YAAA;;iBAKY,UAAA,CAAW,YAAA,EAAc,YAAA"}

package/dist/ci/taxonomy.mjs

@@ -0,0 +1,26 @@
+"use client";
+//#region src/ci/taxonomy.ts
+const CLASS_TO_CONCLUSION = {
+	pass: "success",
+	"coverage-gap": "failure",
+	finding: "failure",
+	"uncertain-conservative-flag": "failure",
+	"setup-broken": "failure",
+	"infra-error": "neutral"
+};
+/** Map one verdict class to its CI conclusion. Total and deterministic. */
+function conclusionForVerdictClass(verdictClass) {
+	return CLASS_TO_CONCLUSION[verdictClass];
+}
+/** Convenience over {@link conclusionForVerdictClass} for a whole verdict. */
+function conclusionForVerdict(verdict) {
+	return conclusionForVerdictClass(verdict.verdictClass);
+}
+/** True when a class blocks the PR (a red check), as opposed to passing or neutral. */
+function isBlocking(verdictClass) {
+	return conclusionForVerdictClass(verdictClass) === "failure";
+}
+//#endregion
+export { conclusionForVerdict, conclusionForVerdictClass, isBlocking };
+
+//# sourceMappingURL=taxonomy.mjs.map

package/dist/ci/taxonomy.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"taxonomy.mjs","names":[],"sources":["../../src/ci/taxonomy.ts"],"sourcesContent":["import type { VerdictClass } from \"./verdict.ts\";\n\n// The failure taxonomy (#3498). The single deterministic hinge between \"what the\n// tool honestly knows\" (the verdict class) and \"what the CI check concludes\".\n// Keeping it a pure function of the verdict class — not scattered `if` branches\n// at each call site — is what guarantees every condition gets the *right*\n// conclusion and the same one every time.\n\n/**\n * A GitHub check-run conclusion, narrowed to the three this loop uses.\n * `neutral` reports \"we didn't/couldn't decide\" without a red X; `failure`\n * blocks; `success` is the clean pass.\n */\nexport type CiConclusion = \"success\" | \"failure\" | \"neutral\";\n\nconst CLASS_TO_CONCLUSION: Record<VerdictClass, CiConclusion> = {\n  pass: \"success\",\n  // A known coverage gap, a real finding, and a conservative \"unverified\" flag\n  // all block the PR. They differ in their *reason and framing* (carried by the\n  // verdict), not in whether they gate — an uncertain result still fails, but\n  // with honest \"we're not sure, flagging to be safe\" messaging rather than a\n  // \"your query is broken\" claim.\n  \"coverage-gap\": \"failure\",\n  finding: \"failure\",\n  \"uncertain-conservative-flag\": \"failure\",\n  // Capture isn't emitting: a setup problem the user must fix, surfaced as a\n  // failure with setup next-steps — never silently green, or it reads as safe.\n  \"setup-broken\": \"failure\",\n  // A transient infra/transport error (e.g. a dropped WebSocket to the API) is\n  // not the user's query problem, so it resolves to neutral, never a red X\n  // (adopts #3401).\n  \"infra-error\": \"neutral\",\n};\n\n/** Map one verdict class to its CI conclusion. Total and deterministic. */\nexport function conclusionForVerdictClass(\n  verdictClass: VerdictClass,\n): CiConclusion {\n  return CLASS_TO_CONCLUSION[verdictClass];\n}\n\n/** Convenience over {@link conclusionForVerdictClass} for a whole verdict. */\nexport function conclusionForVerdict(verdict: {\n  verdictClass: VerdictClass;\n}): CiConclusion {\n  return conclusionForVerdictClass(verdict.verdictClass);\n}\n\n/** True when a class blocks the PR (a red check), as opposed to passing or neutral. */\nexport function isBlocking(verdictClass: VerdictClass): boolean {\n  return conclusionForVerdictClass(verdictClass) === \"failure\";\n}\n"],"mappings":";;AAeA,MAAM,sBAA0D;CAC9D,MAAM;CAMN,gBAAgB;CAChB,SAAS;CACT,+BAA+B;CAG/B,gBAAgB;CAIhB,eAAe;CAChB;;AAGD,SAAgB,0BACd,cACc;AACd,QAAO,oBAAoB;;;AAI7B,SAAgB,qBAAqB,SAEpB;AACf,QAAO,0BAA0B,QAAQ,aAAa;;;AAIxD,SAAgB,WAAW,cAAqC;AAC9D,QAAO,0BAA0B,aAAa,KAAK"}

package/dist/ci/verdict.cjs

@@ -0,0 +1,117 @@
+"use client";
+require("../_virtual/_rolldown/runtime.cjs");
+let zod = require("zod");
+//#region src/ci/verdict.ts
+/**
+* The versioned, shared verdict contract (#3497) — the cohesion mechanism for
+* the CI⇄MCP verdict loop (epic #3493). One condition's outcome on a CI run,
+* structured so an agent can *route* it (fix / add a test / escalate) without
+* scraping a build log. Every future condition — coverage gaps, regressions,
+* schema drift, nudges — emits this same shape, so no condition grows its own
+* red/green or its own remediation UX.
+*
+* The same payload is meant to render to the PR comment and to surface in the
+* MCP run object; the surfacing itself is owned by #3106/#3105, so this module
+* defines and validates the contract they consume, plus a reference renderer.
+*/
+/**
+* Bump only on a *breaking* change to the shape below, so a consumer can refuse
+* a payload it doesn't understand. Additive, backward-compatible fields do not
+* require a bump.
+*/
+const VERDICT_CONTRACT_VERSION = 1;
+/**
+* How honest the run can be about a condition. `pass` is the only clean
+* outcome; every other class is a non-pass the loop must route.
+* `uncertain-conservative-flag` is the deliberate "we could not check this, so
+* we're flagging to be safe" state — kept distinct so the tool's blindness is
+* never dressed up as either a clean pass or a hard failure.
+*/
+const VerdictClass = zod.z.enum([
+	"pass",
+	"coverage-gap",
+	"finding",
+	"infra-error",
+	"setup-broken",
+	"uncertain-conservative-flag"
+]);
+/**
+* The kind of action a verdict routes to. The ceiling is `auto-fix`; the floor
+* is `notify-human` — escalate-to-human-with-context, a designed success state
+* rather than a gap. `none` is only for a clean pass.
+*/
+const VerdictActionKind = zod.z.enum([
+	"auto-fix",
+	"add-test",
+	"triage",
+	"notify-human",
+	"none"
+]);
+/**
+* A routable next action. `detail` always carries the human- and
+* machine-readable specifics: the fix instruction, the test to add, or — for
+* `notify-human` — the context handed to the person. Modeling "notify human
+* (with context)" as a first-class value, not an absent field, is the point:
+* the escalate-to-human floor is always well-formed, never an absence.
+*/
+const VerdictAction = zod.z.object({
+	kind: VerdictActionKind,
+	detail: zod.z.string()
+});
+/** A next step / triage action that escalates to a human, carrying context. */
+function notifyHuman(context) {
+	return {
+		kind: "notify-human",
+		detail: context
+	};
+}
+/** The "nothing to do" action, for a clean pass. */
+const NO_ACTION = {
+	kind: "none",
+	detail: ""
+};
+const CiVerdict = zod.z.object({
+	version: zod.z.literal(1),
+	condition: zod.z.string().min(1),
+	verdictClass: VerdictClass,
+	reason: zod.z.string().min(1),
+	nextStep: VerdictAction,
+	triageAction: VerdictAction,
+	docsUrl: zod.z.string().url().optional(),
+	suggestedMcpTools: zod.z.array(zod.z.string()).default([])
+});
+const ACTION_LABEL = {
+	"auto-fix": "Fix",
+	"add-test": "Add a test",
+	triage: "Triage",
+	"notify-human": "Notify a human",
+	none: "No action"
+};
+/**
+* Render a verdict to Markdown for a PR comment. Intentionally presentation
+* only: it shows the fields, it does not decide pass/fail (that mapping is the
+* failure taxonomy, #3498). Kept alongside the contract so "the comment renders
+* from the contract" is demonstrably true and ready for the analyzer to import.
+*/
+function renderVerdictMarkdown(verdict) {
+	const parts = [`**${verdict.condition}** — ${verdict.reason}`];
+	if (verdict.nextStep.kind !== "none") parts.push(`**Next step (${ACTION_LABEL[verdict.nextStep.kind]}):** ${verdict.nextStep.detail}`);
+	if (verdict.triageAction.kind !== "none") parts.push(`**Triage (${ACTION_LABEL[verdict.triageAction.kind]}):** ${verdict.triageAction.detail}`);
+	if (verdict.suggestedMcpTools.length > 0) {
+		const tools = verdict.suggestedMcpTools.map((t) => `\`${t}\``).join(", ");
+		parts.push(`**MCP tools:** ${tools}`);
+	}
+	if (verdict.docsUrl) parts.push(`[Learn more](${verdict.docsUrl})`);
+	return parts.join("\n\n");
+}
+//#endregion
+exports.CiVerdict = CiVerdict;
+exports.NO_ACTION = NO_ACTION;
+exports.VERDICT_CONTRACT_VERSION = VERDICT_CONTRACT_VERSION;
+exports.VerdictAction = VerdictAction;
+exports.VerdictActionKind = VerdictActionKind;
+exports.VerdictClass = VerdictClass;
+exports.notifyHuman = notifyHuman;
+exports.renderVerdictMarkdown = renderVerdictMarkdown;
+
+//# sourceMappingURL=verdict.cjs.map

package/dist/ci/verdict.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"verdict.cjs","names":["z"],"sources":["../../src/ci/verdict.ts"],"sourcesContent":["import { z } from \"zod\";\n\n/**\n * The versioned, shared verdict contract (#3497) — the cohesion mechanism for\n * the CI⇄MCP verdict loop (epic #3493). One condition's outcome on a CI run,\n * structured so an agent can *route* it (fix / add a test / escalate) without\n * scraping a build log. Every future condition — coverage gaps, regressions,\n * schema drift, nudges — emits this same shape, so no condition grows its own\n * red/green or its own remediation UX.\n *\n * The same payload is meant to render to the PR comment and to surface in the\n * MCP run object; the surfacing itself is owned by #3106/#3105, so this module\n * defines and validates the contract they consume, plus a reference renderer.\n */\n\n/**\n * Bump only on a *breaking* change to the shape below, so a consumer can refuse\n * a payload it doesn't understand. Additive, backward-compatible fields do not\n * require a bump.\n */\nexport const VERDICT_CONTRACT_VERSION = 1;\n\n/**\n * How honest the run can be about a condition. `pass` is the only clean\n * outcome; every other class is a non-pass the loop must route.\n * `uncertain-conservative-flag` is the deliberate \"we could not check this, so\n * we're flagging to be safe\" state — kept distinct so the tool's blindness is\n * never dressed up as either a clean pass or a hard failure.\n */\nexport const VerdictClass = z.enum([\n  \"pass\",\n  \"coverage-gap\",\n  \"finding\",\n  \"infra-error\",\n  \"setup-broken\",\n  \"uncertain-conservative-flag\",\n]);\nexport type VerdictClass = z.infer<typeof VerdictClass>;\n\n/**\n * The kind of action a verdict routes to. The ceiling is `auto-fix`; the floor\n * is `notify-human` — escalate-to-human-with-context, a designed success state\n * rather than a gap. `none` is only for a clean pass.\n */\nexport const VerdictActionKind = z.enum([\n  \"auto-fix\",\n  \"add-test\",\n  \"triage\",\n  \"notify-human\",\n  \"none\",\n]);\nexport type VerdictActionKind = z.infer<typeof VerdictActionKind>;\n\n/**\n * A routable next action. `detail` always carries the human- and\n * machine-readable specifics: the fix instruction, the test to add, or — for\n * `notify-human` — the context handed to the person. Modeling \"notify human\n * (with context)\" as a first-class value, not an absent field, is the point:\n * the escalate-to-human floor is always well-formed, never an absence.\n */\nexport const VerdictAction = z.object({\n  kind: VerdictActionKind,\n  detail: z.string(),\n});\nexport type VerdictAction = z.infer<typeof VerdictAction>;\n\n/** A next step / triage action that escalates to a human, carrying context. */\nexport function notifyHuman(context: string): VerdictAction {\n  return { kind: \"notify-human\", detail: context };\n}\n\n/** The \"nothing to do\" action, for a clean pass. */\nexport const NO_ACTION: VerdictAction = { kind: \"none\", detail: \"\" };\n\nexport const CiVerdict = z.object({\n  version: z.literal(VERDICT_CONTRACT_VERSION),\n  /** The condition evaluated, e.g. \"untested-data-access\", \"regression-beyond-threshold\". */\n  condition: z.string().min(1),\n  verdictClass: VerdictClass,\n  /** Plain-language why, honest about the tool's epistemic state. */\n  reason: z.string().min(1),\n  /** The best-available next step; `notify-human` is a valid, well-formed value. */\n  nextStep: VerdictAction,\n  /** The non-fix exit — triage/acknowledge, or escalate to a human. */\n  triageAction: VerdictAction,\n  /** Deep link to the relevant guide, when one applies. */\n  docsUrl: z.string().url().optional(),\n  /** MCP tools an agent should reach for to act on this verdict. */\n  suggestedMcpTools: z.array(z.string()).default([]),\n});\nexport type CiVerdict = z.infer<typeof CiVerdict>;\n\nconst ACTION_LABEL: Record<VerdictActionKind, string> = {\n  \"auto-fix\": \"Fix\",\n  \"add-test\": \"Add a test\",\n  triage: \"Triage\",\n  \"notify-human\": \"Notify a human\",\n  none: \"No action\",\n};\n\n/**\n * Render a verdict to Markdown for a PR comment. Intentionally presentation\n * only: it shows the fields, it does not decide pass/fail (that mapping is the\n * failure taxonomy, #3498). Kept alongside the contract so \"the comment renders\n * from the contract\" is demonstrably true and ready for the analyzer to import.\n */\nexport function renderVerdictMarkdown(verdict: CiVerdict): string {\n  const parts: string[] = [`**${verdict.condition}** — ${verdict.reason}`];\n  if (verdict.nextStep.kind !== \"none\") {\n    parts.push(\n      `**Next step (${ACTION_LABEL[verdict.nextStep.kind]}):** ${verdict.nextStep.detail}`,\n    );\n  }\n  if (verdict.triageAction.kind !== \"none\") {\n    parts.push(\n      `**Triage (${ACTION_LABEL[verdict.triageAction.kind]}):** ${verdict.triageAction.detail}`,\n    );\n  }\n  if (verdict.suggestedMcpTools.length > 0) {\n    const tools = verdict.suggestedMcpTools.map((t) => `\\`${t}\\``).join(\", \");\n    parts.push(`**MCP tools:** ${tools}`);\n  }\n  if (verdict.docsUrl) {\n    parts.push(`[Learn more](${verdict.docsUrl})`);\n  }\n  return parts.join(\"\\n\\n\");\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAoBA,MAAa,2BAA2B;;;;;;;;AASxC,MAAa,eAAeA,IAAAA,EAAE,KAAK;CACjC;CACA;CACA;CACA;CACA;CACA;CACD,CAAC;;;;;;AAQF,MAAa,oBAAoBA,IAAAA,EAAE,KAAK;CACtC;CACA;CACA;CACA;CACA;CACD,CAAC;;;;;;;;AAUF,MAAa,gBAAgBA,IAAAA,EAAE,OAAO;CACpC,MAAM;CACN,QAAQA,IAAAA,EAAE,QAAQ;CACnB,CAAC;;AAIF,SAAgB,YAAY,SAAgC;AAC1D,QAAO;EAAE,MAAM;EAAgB,QAAQ;EAAS;;;AAIlD,MAAa,YAA2B;CAAE,MAAM;CAAQ,QAAQ;CAAI;AAEpE,MAAa,YAAYA,IAAAA,EAAE,OAAO;CAChC,SAASA,IAAAA,EAAE,QAAA,EAAiC;CAE5C,WAAWA,IAAAA,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC5B,cAAc;CAEd,QAAQA,IAAAA,EAAE,QAAQ,CAAC,IAAI,EAAE;CAEzB,UAAU;CAEV,cAAc;CAEd,SAASA,IAAAA,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;CAEpC,mBAAmBA,IAAAA,EAAE,MAAMA,IAAAA,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;CACnD,CAAC;AAGF,MAAM,eAAkD;CACtD,YAAY;CACZ,YAAY;CACZ,QAAQ;CACR,gBAAgB;CAChB,MAAM;CACP;;;;;;;AAQD,SAAgB,sBAAsB,SAA4B;CAChE,MAAM,QAAkB,CAAC,KAAK,QAAQ,UAAU,OAAO,QAAQ,SAAS;AACxE,KAAI,QAAQ,SAAS,SAAS,OAC5B,OAAM,KACJ,gBAAgB,aAAa,QAAQ,SAAS,MAAM,OAAO,QAAQ,SAAS,SAC7E;AAEH,KAAI,QAAQ,aAAa,SAAS,OAChC,OAAM,KACJ,aAAa,aAAa,QAAQ,aAAa,MAAM,OAAO,QAAQ,aAAa,SAClF;AAEH,KAAI,QAAQ,kBAAkB,SAAS,GAAG;EACxC,MAAM,QAAQ,QAAQ,kBAAkB,KAAK,MAAM,KAAK,EAAE,IAAI,CAAC,KAAK,KAAK;AACzE,QAAM,KAAK,kBAAkB,QAAQ;;AAEvC,KAAI,QAAQ,QACV,OAAM,KAAK,gBAAgB,QAAQ,QAAQ,GAAG;AAEhD,QAAO,MAAM,KAAK,OAAO"}