@reticlehq/server 2.0.0

package/dist/project/reticle-dir.js

@@ -0,0 +1,144 @@
+import { join } from 'node:path';
+import { CONTRACT_FILE_VERSION, ContractFileSchema, ContractReadError, FLOW_NAME_PATTERN, ReticleDir, } from '@reticlehq/core';
+export function reticleDirPaths(root) {
+    return {
+        root,
+        contract: join(root, ReticleDir.CONTRACT_FILE),
+        flows: join(root, ReticleDir.FLOWS_SUBDIR),
+        baselines: join(root, ReticleDir.BASELINES_SUBDIR),
+        project: join(root, ReticleDir.PROJECT_FILE),
+        visual: join(root, ReticleDir.VISUAL_SUBDIR),
+        runs: join(root, ReticleDir.RUNS_SUBDIR),
+    };
+}
+/** The verification-run artifact path for `runId` (.reticle/runs/<runId>.json). */
+export function runPath(root, runId) {
+    return join(root, ReticleDir.RUNS_SUBDIR, `${runId}.json`);
+}
+/**
+ * A runId must be a single safe path segment — same guard as flow names (rejects '../', '/', '\\',
+ * absolute, dotfiles). uuid-style ids (hyphens/underscores) pass. Guards every disk op before join.
+ */
+export function isValidRunId(runId) {
+    return FLOW_NAME_PATTERN.test(runId) && !runId.includes('..');
+}
+/** The PNG baseline path for `name` (.reticle/visual/<name>.png). */
+export function visualPath(root, name) {
+    return join(root, ReticleDir.VISUAL_SUBDIR, `${name}.png`);
+}
+/** The overlay-diff PNG path for `name` (.reticle/visual/<name>.diff.png). */
+export function visualDiffPath(root, name) {
+    return join(root, ReticleDir.VISUAL_SUBDIR, `${name}.diff.png`);
+}
+/**
+ * Path to a flow file. With a `projectId`, the flow lives in a per-project subdir
+ * (`.reticle/flows/<projectId>/<name>.json`) so a shared daemon serving many apps can't collide two
+ * apps' flows of the same name; without one it's the flat legacy path (`.reticle/flows/<name>.json`),
+ * which is also where pre-existing (untagged) flows stay. Callers pass ONLY a validated projectId.
+ */
+export function flowPath(root, name, projectId) {
+    const flowsDir = join(root, ReticleDir.FLOWS_SUBDIR);
+    return projectId === undefined
+        ? join(flowsDir, `${name}.json`)
+        : join(flowsDir, projectId, `${name}.json`);
+}
+/** The directory a flow write targets: the per-project subdir, or the flat flows root for global. */
+export function flowDir(root, projectId) {
+    const flowsDir = join(root, ReticleDir.FLOWS_SUBDIR);
+    return projectId === undefined ? flowsDir : join(flowsDir, projectId);
+}
+/**
+ * A flow name must be a single safe path segment — rejects '../', '/', '\\', absolute, dotfiles.
+ * Guards every disk op before a path is ever joined, so a traversal name never escapes .reticle/.
+ */
+export function isValidFlowName(name) {
+    return FLOW_NAME_PATTERN.test(name) && !name.includes('..');
+}
+export function baselinePath(root, name) {
+    return join(root, ReticleDir.BASELINES_SUBDIR, `${name}.json`);
+}
+/** Idempotent: creates .reticle/, .reticle/flows/, .reticle/baselines/ (recursive mkdir → safe to re-run). */
+export async function ensureReticleDir(fs, root) {
+    const p = reticleDirPaths(root);
+    await fs.mkdir(p.root);
+    await fs.mkdir(p.flows);
+    await fs.mkdir(p.baselines);
+}
+const JSON_INDENT = 2;
+/**
+ * Serialize capabilities into a byte-stable, diffable string: arrays sorted lexicographically,
+ * flows sorted by name, object keys emitted in a fixed declared order (NOT insertion order),
+ * 2-space indent, trailing newline. Two semantically-equal registries → identical bytes.
+ */
+function stableSerialize(capabilities, generatedAt) {
+    const envelope = {
+        version: CONTRACT_FILE_VERSION,
+        generatedAt,
+        capabilities: {
+            testids: [...capabilities.testids].sort(),
+            signals: [...capabilities.signals].sort(),
+            stores: [...capabilities.stores].sort(),
+            flows: [...capabilities.flows]
+                .map((f) => ({ name: f.name, steps: [...f.steps] }))
+                .sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0)),
+            ...(capabilities.governance !== undefined
+                ? { governance: serializeGovernance(capabilities.governance) }
+                : {}),
+        },
+    };
+    return `${JSON.stringify(envelope, null, JSON_INDENT)}\n`;
+}
+/** Field-ordered, sorted rebuild of declared governance for byte-stable serialization. */
+function serializeGovernance(g) {
+    return {
+        ...(g.owner !== undefined ? { owner: g.owner } : {}),
+        ...(g.safety !== undefined ? { safety: [...g.safety].sort() } : {}),
+        ...(g.scope !== undefined ? { scope: [...g.scope].sort() } : {}),
+        ...(g.redact !== undefined ? { redact: [...g.redact].sort() } : {}),
+        ...(g.risk !== undefined
+            ? {
+                risk: [...g.risk]
+                    .map((z) => ({
+                    surface: z.surface,
+                    ...(z.paths !== undefined ? { paths: [...z.paths].sort() } : {}),
+                    ...(z.note !== undefined ? { note: z.note } : {}),
+                }))
+                    .sort((a, b) => (a.surface < b.surface ? -1 : a.surface > b.surface ? 1 : 0)),
+            }
+            : {}),
+    };
+}
+/** Write the contract to .reticle/contract.json (auto-creating .reticle/ first). */
+export async function writeContract(fs, root, capabilities, now) {
+    await ensureReticleDir(fs, root);
+    await fs.writeFile(reticleDirPaths(root).contract, stableSerialize(capabilities, now()));
+}
+/** Never throws. Missing → MISSING. Bad JSON / failed schema → MALFORMED. */
+export async function readContract(fs, root) {
+    const path = reticleDirPaths(root).contract;
+    if (!(await fs.exists(path)))
+        return { ok: false, reason: ContractReadError.MISSING };
+    let text;
+    try {
+        text = await fs.readFile(path);
+    }
+    catch (error) {
+        // Handles the exists/read TOCTOU race: a vanished file reads as MISSING, anything else MALFORMED.
+        return {
+            ok: false,
+            reason: fs.isNotFound(error) ? ContractReadError.MISSING : ContractReadError.MALFORMED,
+        };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return { ok: false, reason: ContractReadError.MALFORMED };
+    }
+    const result = ContractFileSchema.safeParse(parsed);
+    if (!result.success)
+        return { ok: false, reason: ContractReadError.MALFORMED };
+    return { ok: true, capabilities: result.data.capabilities, generatedAt: result.data.generatedAt };
+}
+//# sourceMappingURL=reticle-dir.js.map

package/dist/project/reticle-dir.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reticle-dir.js","sourceRoot":"","sources":["../../src/project/reticle-dir.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,UAAU,GAIX,MAAM,iBAAiB,CAAC;AAqBzB,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO;QACL,IAAI;QACJ,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,aAAa,CAAC;QAC9C,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC;QAC1C,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,gBAAgB,CAAC;QAClD,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC;QAC5C,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,aAAa,CAAC;QAC5C,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC;KACzC,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,KAAa;IACjD,OAAO,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,WAAW,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAChE,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,IAAY;IACnD,OAAO,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,aAAa,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;AAC7D,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,IAAY;IACvD,OAAO,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,aAAa,EAAE,GAAG,IAAI,WAAW,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,IAAY,EAAE,SAAkB;IACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;IACrD,OAAO,SAAS,KAAK,SAAS;QAC5B,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,OAAO,CAAC;QAChC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;AAChD,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,SAAkB;IACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;IACrD,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AACxE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,IAAY;IACrD,OAAO,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,gBAAgB,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,8GAA8G;AAC9G,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAkB,EAAE,IAAY;IACrE,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACvB,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACxB,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,CAAC;AAEtB;;;;GAIG;AACH,SAAS,eAAe,CAAC,YAAkC,EAAE,WAAmB;IAC9E,MAAM,QAAQ,GAAG;QACf,OAAO,EAAE,qBAAqB;QAC9B,WAAW;QACX,YAAY,EAAE;YACZ,OAAO,EAAE,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE;YACzC,OAAO,EAAE,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE;YACzC,MAAM,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE;YACvC,KAAK,EAAE,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC;iBAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;iBACnD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnE,GAAG,CAAC,YAAY,CAAC,UAAU,KAAK,SAAS;gBACvC,CAAC,CAAC,EAAE,UAAU,EAAE,mBAAmB,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE;gBAC9D,CAAC,CAAC,EAAE,CAAC;SACR;KACF,CAAC;IACF,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC;AAC5D,CAAC;AAED,0FAA0F;AAC1F,SAAS,mBAAmB,CAAC,CAAqB;IAChD,OAAO;QACL,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS;YACtB,CAAC,CAAC;gBACE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;qBACd,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACX,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChE,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAClD,CAAC,CAAC;qBACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aAChF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,EAAkB,EAClB,IAAY,EACZ,YAAkC,EAClC,GAAiB;IAEjB,MAAM,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACjC,MAAM,EAAE,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,eAAe,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;AAC3F,CAAC;AAMD,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAkB,EAAE,IAAY;IACjE,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;IAC5C,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,CAAC,OAAO,EAAE,CAAC;IAEtF,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kGAAkG;QAClG,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,SAAS;SACvF,CAAC;IACJ,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,CAAC,SAAS,EAAE,CAAC;IAC5D,CAAC;IAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,CAAC,SAAS,EAAE,CAAC;IAC/E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;AACpG,CAAC"}

package/dist/runs/build-verification-run.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The verification-run assembler. A PURE mapping from already-produced verification results
+ * (flow-replay outcomes, standalone checks, risks, evidence, repair packets) into the stable
+ * ReticleVerificationRun artifact, with a deterministic verdict computed here. The clock is injected
+ * (the single `createdAt` site — never Date.now() in logic, per rule 7). Gathering the inputs from a
+ * live session is a separate adapter concern; this file owns the shape + the verdict rules so both
+ * the MCP path and the programmatic Replay/Verify API produce byte-identical verdicts.
+ */
+import { type ReticleVerificationRun, type RunVerdict } from '@reticlehq/core';
+/**
+ * Everything a caller supplies; schemaVersion/createdAt/verdict are filled/computed by the builder.
+ * runId is a plain string here (string in) — the schema brands it to RunId on the way out (branded out),
+ * so construction sites stay ergonomic while consumers get the nominal type.
+ */
+export type VerificationRunInput = Omit<ReticleVerificationRun, 'schemaVersion' | 'createdAt' | 'verdict' | 'runId'> & {
+    runId: string;
+};
+/**
+ * Compute the verdict deterministically from the run's flows, checks, and risks.
+ * Rules (in order): a gated risk blocks → FAIL; mixed pass+fail → PARTIAL; any fail → FAIL; else PASS.
+ * Confidence: nothing ran → LOW; an oracle-backed flow or any check ran → HIGH; only smoke → MEDIUM.
+ */
+export declare function computeVerdict(input: VerificationRunInput): RunVerdict;
+/**
+ * Assemble the final, schema-valid ReticleVerificationRun. Stamps schemaVersion + createdAt (injected
+ * clock) and computes the verdict; the result is parsed through the protocol schema so a malformed
+ * input can never escape as an "artifact".
+ */
+export declare function buildVerificationRun(input: VerificationRunInput, now: () => number): ReticleVerificationRun;
+//# sourceMappingURL=build-verification-run.d.ts.map

package/dist/runs/build-verification-run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-verification-run.d.ts","sourceRoot":"","sources":["../../src/runs/build-verification-run.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAOL,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EAChB,MAAM,iBAAiB,CAAC;AAGzB;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,IAAI,CACrC,sBAAsB,EACtB,eAAe,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,CACpD,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtB;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,oBAAoB,GAAG,UAAU,CAwCtE;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,oBAAoB,EAC3B,GAAG,EAAE,MAAM,MAAM,GAChB,sBAAsB,CAQxB"}

package/dist/runs/build-verification-run.js

@@ -0,0 +1,71 @@
+/**
+ * The verification-run assembler. A PURE mapping from already-produced verification results
+ * (flow-replay outcomes, standalone checks, risks, evidence, repair packets) into the stable
+ * ReticleVerificationRun artifact, with a deterministic verdict computed here. The clock is injected
+ * (the single `createdAt` site — never Date.now() in logic, per rule 7). Gathering the inputs from a
+ * live session is a separate adapter concern; this file owns the shape + the verdict rules so both
+ * the MCP path and the programmatic Replay/Verify API produce byte-identical verdicts.
+ */
+import { ReticleVerificationRunSchema, RUN_FILE_VERSION, RunCheckStatus, RunConfidence, RunFlowStatus, VerdictStatus, } from '@reticlehq/core';
+import { redactForProfile } from './profile-redact.js';
+/**
+ * Compute the verdict deterministically from the run's flows, checks, and risks.
+ * Rules (in order): a gated risk blocks → FAIL; mixed pass+fail → PARTIAL; any fail → FAIL; else PASS.
+ * Confidence: nothing ran → LOW; an oracle-backed flow or any check ran → HIGH; only smoke → MEDIUM.
+ */
+export function computeVerdict(input) {
+    const passes = input.flows.filter((f) => f.status === RunFlowStatus.PASS || f.status === RunFlowStatus.HEALED)
+        .length + input.checks.filter((c) => c.status === RunCheckStatus.PASS).length;
+    const fails = input.flows.filter((f) => f.status === RunFlowStatus.FAIL).length +
+        input.checks.filter((c) => c.status === RunCheckStatus.FAIL).length;
+    const blockingRisks = input.risks.filter((r) => r.gated).length;
+    const reasons = [];
+    for (const f of input.flows) {
+        if (f.status === RunFlowStatus.FAIL) {
+            reasons.push(f.failureReason !== undefined
+                ? `flow ${f.name}: ${f.failureReason}`
+                : `flow ${f.name} failed`);
+        }
+    }
+    for (const c of input.checks) {
+        if (c.status === RunCheckStatus.FAIL)
+            reasons.push(`check failed: ${c.predicate}`);
+    }
+    for (const r of input.risks) {
+        if (r.gated)
+            reasons.push(`blocked: ${r.surface} risk — ${r.detail}`);
+    }
+    let status;
+    if (blockingRisks > 0)
+        status = VerdictStatus.FAIL;
+    else if (fails > 0 && passes > 0)
+        status = VerdictStatus.PARTIAL;
+    else if (fails > 0)
+        status = VerdictStatus.FAIL;
+    else
+        status = VerdictStatus.PASS;
+    const ran = input.flows.length + input.checks.length;
+    let confidence;
+    if (ran === 0)
+        confidence = RunConfidence.LOW;
+    else if (input.flows.some((f) => f.oracle !== undefined) || input.checks.length > 0)
+        confidence = RunConfidence.HIGH;
+    else
+        confidence = RunConfidence.MEDIUM;
+    return { status, reasons, confidence, blockingRisks };
+}
+/**
+ * Assemble the final, schema-valid ReticleVerificationRun. Stamps schemaVersion + createdAt (injected
+ * clock) and computes the verdict; the result is parsed through the protocol schema so a malformed
+ * input can never escape as an "artifact".
+ */
+export function buildVerificationRun(input, now) {
+    const run = {
+        schemaVersion: RUN_FILE_VERSION,
+        createdAt: now(),
+        verdict: computeVerdict(input),
+        ...input,
+    };
+    return redactForProfile(ReticleVerificationRunSchema.parse(run));
+}
+//# sourceMappingURL=build-verification-run.js.map

package/dist/runs/build-verification-run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-verification-run.js","sourceRoot":"","sources":["../../src/runs/build-verification-run.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,4BAA4B,EAC5B,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,aAAa,EACb,aAAa,GAGd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAYvD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAA2B;IACxD,MAAM,MAAM,GACV,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM,CAAC;SAC5F,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,cAAc,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IAClF,MAAM,KAAK,GACT,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC,IAAI,CAAC,CAAC,MAAM;QACjE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,cAAc,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IACtE,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IAEhE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC,IAAI,EAAE,CAAC;YACpC,OAAO,CAAC,IAAI,CACV,CAAC,CAAC,aAAa,KAAK,SAAS;gBAC3B,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,aAAa,EAAE;gBACtC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,SAAS,CAC5B,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,MAAM,KAAK,cAAc,CAAC,IAAI;YAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,KAAK;YAAE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,IAAI,MAAqB,CAAC;IAC1B,IAAI,aAAa,GAAG,CAAC;QAAE,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC;SAC9C,IAAI,KAAK,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC;QAAE,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC;SAC5D,IAAI,KAAK,GAAG,CAAC;QAAE,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC;;QAC3C,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC;IAEjC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;IACrD,IAAI,UAAyB,CAAC;IAC9B,IAAI,GAAG,KAAK,CAAC;QAAE,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC;SACzC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QACjF,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC;;QAC7B,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC;IAEvC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAA2B,EAC3B,GAAiB;IAEjB,MAAM,GAAG,GAAG;QACV,aAAa,EAAE,gBAAgB;QAC/B,SAAS,EAAE,GAAG,EAAE;QAChB,OAAO,EAAE,cAAc,CAAC,KAAK,CAAC;QAC9B,GAAG,KAAK;KACT,CAAC;IACF,OAAO,gBAAgB,CAAC,4BAA4B,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;AACnE,CAAC"}

package/dist/runs/profile-redact.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Profile gating for the verification-run artifact. A DEV run keeps everything (it stays on the
+ * developer's machine). A PROD_PREVIEW run is one a host may surface downstream (attach to a deploy,
+ * show an end customer), so it must not leak the app's internals: the repair packets (which name
+ * source files + carry fix instructions) are dropped, and app-state assertion values are redacted.
+ * The trustworthy summary — verdict, flows, risks, counts — is preserved. Pure; keyed on run.profile.
+ */
+import { type ReticleVerificationRun } from '@reticlehq/core';
+/** Marker left in place of a redacted value so a consumer can tell it was withheld, not absent. */
+export declare const REDACTED = "[redacted:prod-preview]";
+/**
+ * Return the run unchanged for DEV; for PROD_PREVIEW return a copy with dev-only fields removed:
+ * the repair block (source-naming) is dropped and stateAssertion values are redacted.
+ */
+export declare function redactForProfile(run: ReticleVerificationRun): ReticleVerificationRun;
+//# sourceMappingURL=profile-redact.d.ts.map

package/dist/runs/profile-redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile-redact.d.ts","sourceRoot":"","sources":["../../src/runs/profile-redact.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAc,KAAK,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAE1E,mGAAmG;AACnG,eAAO,MAAM,QAAQ,4BAA4B,CAAC;AAElD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,sBAAsB,GAAG,sBAAsB,CAiBpF"}

package/dist/runs/profile-redact.js

@@ -0,0 +1,32 @@
+/**
+ * Profile gating for the verification-run artifact. A DEV run keeps everything (it stays on the
+ * developer's machine). A PROD_PREVIEW run is one a host may surface downstream (attach to a deploy,
+ * show an end customer), so it must not leak the app's internals: the repair packets (which name
+ * source files + carry fix instructions) are dropped, and app-state assertion values are redacted.
+ * The trustworthy summary — verdict, flows, risks, counts — is preserved. Pure; keyed on run.profile.
+ */
+import { RunProfile } from '@reticlehq/core';
+/** Marker left in place of a redacted value so a consumer can tell it was withheld, not absent. */
+export const REDACTED = '[redacted:prod-preview]';
+/**
+ * Return the run unchanged for DEV; for PROD_PREVIEW return a copy with dev-only fields removed:
+ * the repair block (source-naming) is dropped and stateAssertion values are redacted.
+ */
+export function redactForProfile(run) {
+    if (run.profile !== RunProfile.PROD_PREVIEW)
+        return run;
+    const evidence = {
+        ...run.evidence,
+        stateAssertions: run.evidence.stateAssertions.map((s) => ({
+            store: s.store,
+            path: s.path,
+            expected: REDACTED,
+            actual: REDACTED,
+            ok: s.ok,
+        })),
+    };
+    const { repair, ...rest } = run;
+    void repair; // intentionally dropped — fix instructions name source files
+    return { ...rest, evidence };
+}
+//# sourceMappingURL=profile-redact.js.map

package/dist/runs/profile-redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile-redact.js","sourceRoot":"","sources":["../../src/runs/profile-redact.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAA+B,MAAM,iBAAiB,CAAC;AAE1E,mGAAmG;AACnG,MAAM,CAAC,MAAM,QAAQ,GAAG,yBAAyB,CAAC;AAElD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAA2B;IAC1D,IAAI,GAAG,CAAC,OAAO,KAAK,UAAU,CAAC,YAAY;QAAE,OAAO,GAAG,CAAC;IAExD,MAAM,QAAQ,GAAG;QACf,GAAG,GAAG,CAAC,QAAQ;QACf,eAAe,EAAE,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACxD,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,QAAQ;YAChB,EAAE,EAAE,CAAC,CAAC,EAAE;SACT,CAAC,CAAC;KACJ,CAAC;IAEF,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;IAChC,KAAK,MAAM,CAAC,CAAC,6DAA6D;IAC1E,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC"}

package/dist/runs/render-report.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Render an ReticleVerificationRun into a legible human/agent-facing report — the "is this actually
+ * useful?" moment. Pure + deterministic (no clock, no IO): the same run renders the same text, so it's
+ * safe in CI and as a partner-facing artifact. Raw JSON is the contract; this is the read.
+ */
+import { type ReticleVerificationRun } from '@reticlehq/core';
+/** Render the run as a plain-text report. Sections with no content are omitted. */
+export declare function renderRunReport(run: ReticleVerificationRun): string;
+//# sourceMappingURL=render-report.d.ts.map

package/dist/runs/render-report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"render-report.d.ts","sourceRoot":"","sources":["../../src/runs/render-report.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAIL,KAAK,sBAAsB,EAI5B,MAAM,iBAAiB,CAAC;AA+BzB,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,GAAG,EAAE,sBAAsB,GAAG,MAAM,CA6CnE"}

package/dist/runs/render-report.js

@@ -0,0 +1,70 @@
+/**
+ * Render an ReticleVerificationRun into a legible human/agent-facing report — the "is this actually
+ * useful?" moment. Pure + deterministic (no clock, no IO): the same run renders the same text, so it's
+ * safe in CI and as a partner-facing artifact. Raw JSON is the contract; this is the read.
+ */
+import { RunCheckStatus, RunFlowStatus, VerdictStatus, } from '@reticlehq/core';
+const VERDICT_GLYPH = {
+    [VerdictStatus.PASS]: '✓ PASS',
+    [VerdictStatus.FAIL]: '✗ FAIL',
+    [VerdictStatus.PARTIAL]: '◑ PARTIAL',
+};
+const flowGlyph = (s) => s === RunFlowStatus.PASS
+    ? '✓'
+    : s === RunFlowStatus.HEALED
+        ? '✓~'
+        : s === RunFlowStatus.SKIPPED
+            ? '–'
+            : '✗';
+function flowLine(f) {
+    const head = `  ${flowGlyph(f.status)} ${f.name} (${f.steps} steps, ${f.durationMs}ms)`;
+    return f.failureReason !== undefined ? `${head} — ${f.failureReason}` : head;
+}
+function checkLine(c) {
+    const glyph = c.status === RunCheckStatus.PASS ? '✓' : '✗';
+    return `  ${glyph} ${c.kind}: ${c.predicate}`;
+}
+function riskLine(r) {
+    return `  ⚠ ${r.surface} (${r.severity})${r.gated ? ' [GATED]' : ''} — ${r.detail}`;
+}
+/** Render the run as a plain-text report. Sections with no content are omitted. */
+export function renderRunReport(run) {
+    const out = [];
+    out.push(`Reticle verification — ${run.project.name}  [${run.profile}]`);
+    out.push(`Verdict: ${VERDICT_GLYPH[run.verdict.status]}  ·  confidence: ${run.verdict.confidence}` +
+        (run.verdict.blockingRisks > 0 ? `  ·  ${run.verdict.blockingRisks} blocking risk(s)` : ''));
+    if (run.flows.length > 0) {
+        const passed = run.flows.filter((f) => f.status === RunFlowStatus.PASS || f.status === RunFlowStatus.HEALED).length;
+        out.push('', `Flows: ${passed}/${run.flows.length} passed`);
+        for (const f of run.flows)
+            out.push(flowLine(f));
+    }
+    const failedChecks = run.checks.filter((c) => c.status === RunCheckStatus.FAIL);
+    if (run.checks.length > 0) {
+        out.push('', `Checks: ${run.checks.length - failedChecks.length}/${run.checks.length} passed`);
+        for (const c of run.checks)
+            out.push(checkLine(c));
+    }
+    if (run.risks.length > 0) {
+        out.push('', 'Risks:');
+        for (const r of run.risks)
+            out.push(riskLine(r));
+    }
+    const packets = run.repair?.failurePackets ?? [];
+    if (packets.length > 0) {
+        out.push('', 'How to fix:');
+        for (const p of packets) {
+            const where = p.sourceLocation !== undefined
+                ? ` (${p.sourceLocation.file}${p.sourceLocation.line !== undefined ? `:${p.sourceLocation.line}` : ''})`
+                : '';
+            out.push(`  → ${p.flow ?? 'check'}${where}: ${p.suggestedPrompt}`);
+        }
+    }
+    if (run.verdict.status !== VerdictStatus.PASS && run.verdict.reasons.length > 0) {
+        out.push('', 'Why it failed:');
+        for (const reason of run.verdict.reasons)
+            out.push(`  - ${reason}`);
+    }
+    return out.join('\n');
+}
+//# sourceMappingURL=render-report.js.map

package/dist/runs/render-report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"render-report.js","sourceRoot":"","sources":["../../src/runs/render-report.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,cAAc,EACd,aAAa,EACb,aAAa,GAKd,MAAM,iBAAiB,CAAC;AAEzB,MAAM,aAAa,GAA4C;IAC7D,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,QAAQ;IAC9B,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,QAAQ;IAC9B,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,WAAW;CACrC,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,CAAgB,EAAU,EAAE,CAC7C,CAAC,KAAK,aAAa,CAAC,IAAI;IACtB,CAAC,CAAC,GAAG;IACL,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,MAAM;QAC1B,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,OAAO;YAC3B,CAAC,CAAC,GAAG;YACL,CAAC,CAAC,GAAG,CAAC;AAEd,SAAS,QAAQ,CAAC,CAAgB;IAChC,MAAM,IAAI,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC,UAAU,KAAK,CAAC;IACxF,OAAO,CAAC,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/E,CAAC;AAED,SAAS,SAAS,CAAC,CAAW;IAC5B,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,KAAK,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAC3D,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,SAAS,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AACtF,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,eAAe,CAAC,GAA2B;IACzD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,GAAG,CAAC,IAAI,CAAC,0BAA0B,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC;IACzE,GAAG,CAAC,IAAI,CACN,YAAY,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE;QACvF,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,OAAO,CAAC,aAAa,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC,CAC9F,CAAC;IAEF,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM,CAC5E,CAAC,MAAM,CAAC;QACT,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,SAAS,CAAC,CAAC;QAC5D,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK;YAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,cAAc,CAAC,IAAI,CAAC,CAAC;IAChF,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,YAAY,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,SAAS,CAAC,CAAC;QAC/F,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM;YAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK;YAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,cAAc,IAAI,EAAE,CAAC;IACjD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,KAAK,GACT,CAAC,CAAC,cAAc,KAAK,SAAS;gBAC5B,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,CAAC,cAAc,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG;gBACxG,CAAC,CAAC,EAAE,CAAC;YACT,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,OAAO,GAAG,KAAK,KAAK,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAED,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,aAAa,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;QAC/B,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO;YAAE,GAAG,CAAC,IAAI,CAAC,OAAO,MAAM,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC"}

package/dist/runs/repair-prompt.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Repair-packet generation — turn a failed flow replay into a concise, paste-ready instruction the
+ * host's coding agent can act on to close its own loop. Pure + deterministic (no LLM): it lifts the
+ * already-computed decision envelope (whatChanged / whereInSource / nextAction) into the artifact's
+ * RepairPacket shape. This is the OEM self-heal value — a verdict that also says how to fix.
+ */
+import { type FlowReplayResult, type RepairPacket } from '@reticlehq/core';
+/**
+ * Build a repair packet for a failed replay, or undefined when the flow passed. The actual cause is
+ * the decision's whatChanged, falling back to the replay error or a generic message.
+ */
+export declare function buildRepairPacket(replay: FlowReplayResult): RepairPacket | undefined;
+/** Build the repair packets for a set of replays (failed ones only). */
+export declare function buildRepairPackets(replays: ReadonlyArray<FlowReplayResult>): RepairPacket[];
+//# sourceMappingURL=repair-prompt.d.ts.map

package/dist/runs/repair-prompt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repair-prompt.d.ts","sourceRoot":"","sources":["../../src/runs/repair-prompt.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAEL,KAAK,gBAAgB,EAErB,KAAK,YAAY,EAElB,MAAM,iBAAiB,CAAC;AAgCzB;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,GAAG,YAAY,GAAG,SAAS,CAiBpF;AAED,wEAAwE;AACxE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,aAAa,CAAC,gBAAgB,CAAC,GAAG,YAAY,EAAE,CAE3F"}

package/dist/runs/repair-prompt.js

@@ -0,0 +1,59 @@
+/**
+ * Repair-packet generation — turn a failed flow replay into a concise, paste-ready instruction the
+ * host's coding agent can act on to close its own loop. Pure + deterministic (no LLM): it lifts the
+ * already-computed decision envelope (whatChanged / whereInSource / nextAction) into the artifact's
+ * RepairPacket shape. This is the OEM self-heal value — a verdict that also says how to fix.
+ */
+import { ReplayStatus, } from '@reticlehq/core';
+/** The step a replay broke at — drift takes precedence (the legible cause), else first non-ok step. */
+function failingStepNumber(steps) {
+    const drifted = steps.find((s) => s.drift !== undefined);
+    if (drifted !== undefined)
+        return drifted.step;
+    return steps.find((s) => !s.ok)?.step;
+}
+/** Parse a "file:line" source coordinate. Skips page URLs (which also contain colons). */
+function parseSource(where) {
+    if (where === undefined || where.includes('://'))
+        return undefined;
+    const match = /^(.*):(\d+)$/.exec(where);
+    if (match !== null && match[1] !== undefined && match[2] !== undefined) {
+        return { file: match[1], line: Number(match[2]) };
+    }
+    return { file: where };
+}
+/** Compose the paste-ready fix instruction from the decision envelope. */
+function suggestedPrompt(name, actual, where, nextAction) {
+    const parts = [`Fix the "${name}" flow.`, actual.endsWith('.') ? actual : `${actual}.`];
+    if (where !== undefined)
+        parts.push(`Look at ${where}.`);
+    if (nextAction !== undefined)
+        parts.push(nextAction);
+    return parts.join(' ');
+}
+/**
+ * Build a repair packet for a failed replay, or undefined when the flow passed. The actual cause is
+ * the decision's whatChanged, falling back to the replay error or a generic message.
+ */
+export function buildRepairPacket(replay) {
+    if (replay.status === ReplayStatus.OK)
+        return undefined;
+    const decision = replay.decision;
+    const actual = decision?.whatChanged ?? replay.error?.message ?? 'the flow failed';
+    const where = decision?.whereInSource;
+    const sourceLocation = parseSource(where);
+    const step = failingStepNumber(replay.steps);
+    return {
+        flow: replay.name,
+        ...(step !== undefined ? { step } : {}),
+        expected: `the "${replay.name}" flow holds (its steps run and its success consequence fires)`,
+        actual,
+        ...(sourceLocation !== undefined ? { sourceLocation } : {}),
+        suggestedPrompt: suggestedPrompt(replay.name, actual, where, decision?.nextAction),
+    };
+}
+/** Build the repair packets for a set of replays (failed ones only). */
+export function buildRepairPackets(replays) {
+    return replays.map(buildRepairPacket).filter((p) => p !== undefined);
+}
+//# sourceMappingURL=repair-prompt.js.map

package/dist/runs/repair-prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repair-prompt.js","sourceRoot":"","sources":["../../src/runs/repair-prompt.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,YAAY,GAKb,MAAM,iBAAiB,CAAC;AAEzB,uGAAuG;AACvG,SAAS,iBAAiB,CAAC,KAAoC;IAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IACzD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC;IAC/C,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC;AACxC,CAAC;AAED,0FAA0F;AAC1F,SAAS,WAAW,CAAC,KAAyB;IAC5C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACnE,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACvE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED,0EAA0E;AAC1E,SAAS,eAAe,CACtB,IAAY,EACZ,MAAc,EACd,KAAyB,EACzB,UAA8B;IAE9B,MAAM,KAAK,GAAG,CAAC,YAAY,IAAI,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;IACxF,IAAI,KAAK,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC;IACzD,IAAI,UAAU,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAwB;IACxD,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAExD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,MAAM,MAAM,GAAG,QAAQ,EAAE,WAAW,IAAI,MAAM,CAAC,KAAK,EAAE,OAAO,IAAI,iBAAiB,CAAC;IACnF,MAAM,KAAK,GAAG,QAAQ,EAAE,aAAa,CAAC;IACtC,MAAM,cAAc,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE7C,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,QAAQ,EAAE,QAAQ,MAAM,CAAC,IAAI,gEAAgE;QAC7F,MAAM;QACN,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,eAAe,EAAE,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,CAAC;KACnF,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,kBAAkB,CAAC,OAAwC;IACzE,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAqB,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;AAC1F,CAAC"}

package/dist/runs/replay-mapping.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Pure mapping from a flow-replay outcome (the existing reticle_flow_verify machinery) into the
+ * verification-run artifact's per-flow shape. DRIFT and ERROR both collapse to FAIL — from a host's
+ * perspective a flow that drifted no longer behaves, so it must not read as green. The actionable
+ * "why" is lifted from the replay's decision envelope (or its error) into failureReason.
+ */
+import { ReplayStatus, RunFlowStatus, type FlowReplayResult, type RunFlowResult } from '@reticlehq/core';
+/** OK → PASS; DRIFT/ERROR → FAIL (a healed flow is produced by the heal path, not plain replay). */
+export declare function runFlowStatusOf(status: ReplayStatus): RunFlowStatus;
+/** Map one replay (plus its measured duration) into a RunFlowResult for the artifact's flows[]. */
+export declare function mapReplayToFlowResult(replay: FlowReplayResult, durationMs: number): RunFlowResult;
+//# sourceMappingURL=replay-mapping.d.ts.map

package/dist/runs/replay-mapping.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay-mapping.d.ts","sourceRoot":"","sources":["../../src/runs/replay-mapping.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,YAAY,EACZ,aAAa,EACb,KAAK,gBAAgB,EACrB,KAAK,aAAa,EACnB,MAAM,iBAAiB,CAAC;AAGzB,oGAAoG;AACpG,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,aAAa,CAEnE;AAED,mGAAmG;AACnG,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,GAAG,aAAa,CAqBjG"}

package/dist/runs/replay-mapping.js

@@ -0,0 +1,35 @@
+/**
+ * Pure mapping from a flow-replay outcome (the existing reticle_flow_verify machinery) into the
+ * verification-run artifact's per-flow shape. DRIFT and ERROR both collapse to FAIL — from a host's
+ * perspective a flow that drifted no longer behaves, so it must not read as green. The actionable
+ * "why" is lifted from the replay's decision envelope (or its error) into failureReason.
+ */
+import { ReplayStatus, RunFlowStatus, } from '@reticlehq/core';
+import { SUCCESS_STEP_TOOL } from '../flows/flow-success.js';
+/** OK → PASS; DRIFT/ERROR → FAIL (a healed flow is produced by the heal path, not plain replay). */
+export function runFlowStatusOf(status) {
+    return status === ReplayStatus.OK ? RunFlowStatus.PASS : RunFlowStatus.FAIL;
+}
+/** Map one replay (plus its measured duration) into a RunFlowResult for the artifact's flows[]. */
+export function mapReplayToFlowResult(replay, durationMs) {
+    const status = runFlowStatusOf(replay.status);
+    const failureReason = status === RunFlowStatus.FAIL
+        ? (replay.decision?.whatChanged ??
+            replay.decision?.summary ??
+            replay.error?.message ??
+            'flow failed')
+        : undefined;
+    // A flow with a success oracle gets a synthetic 'success' step appended by replay; surface its label
+    // as the run's `oracle` so the verdict counts this flow as consequence-backed (→ HIGH confidence),
+    // not a bare smoke click. Without this, an oracle-backed pass reads as MEDIUM and undersells itself.
+    const oracle = replay.steps.find((s) => s.tool === SUCCESS_STEP_TOOL)?.anchor;
+    return {
+        name: replay.name,
+        status,
+        steps: replay.steps.length,
+        durationMs,
+        ...(oracle !== undefined ? { oracle } : {}),
+        ...(failureReason !== undefined ? { failureReason } : {}),
+    };
+}
+//# sourceMappingURL=replay-mapping.js.map

package/dist/runs/replay-mapping.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay-mapping.js","sourceRoot":"","sources":["../../src/runs/replay-mapping.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,YAAY,EACZ,aAAa,GAGd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,oGAAoG;AACpG,MAAM,UAAU,eAAe,CAAC,MAAoB;IAClD,OAAO,MAAM,KAAK,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC;AAC9E,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,qBAAqB,CAAC,MAAwB,EAAE,UAAkB;IAChF,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,aAAa,GACjB,MAAM,KAAK,aAAa,CAAC,IAAI;QAC3B,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW;YAC7B,MAAM,CAAC,QAAQ,EAAE,OAAO;YACxB,MAAM,CAAC,KAAK,EAAE,OAAO;YACrB,aAAa,CAAC;QAChB,CAAC,CAAC,SAAS,CAAC;IAChB,qGAAqG;IACrG,mGAAmG;IACnG,qGAAqG;IACrG,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC9E,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM;QACN,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;QAC1B,UAAU;QACV,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;AACJ,CAAC"}

package/dist/runs/reticle-runner.d.ts

@@ -0,0 +1,48 @@
+/**
+ * ReticleRunner — the programmatic Replay/Verify API a host platform (OEM/design partner) or CI drives
+ * from its own pipeline, with no MCP stdio and no human. It reuses the existing flow-replay machinery
+ * and the verification-run assembler, returning a stable ReticleVerificationRun.
+ *
+ * Everything it needs from the live world is injected through RunnerPort, so the core orchestration is
+ * fully testable without a CDP browser. The live adapter (wrapping ToolDeps: replayNamedFlow,
+ * flows.list, the drive/CDP preview boot) and the token-guarded HTTP endpoint are thin layers built on
+ * top of this — the orchestration and the verdict live here so the MCP path and the API produce the
+ * same artifact byte-for-byte.
+ */
+import type { FlowReplayResult, ReticleVerificationRun, RunId } from '@reticlehq/core';
+import { type VerificationRunInput } from './build-verification-run.js';
+import { type ChangedFileInput, type RiskPolicy } from './risk-classify.js';
+/** The live capabilities ReticleRunner needs. Injected so tests pass fakes (no CDP, no session). */
+export interface RunnerPort {
+    /** Saved flow names to verify when the caller doesn't pass an explicit subset. */
+    listFlows(): Promise<string[]>;
+    /** Replay one saved flow against the live/preview app, returning the existing replay contract. */
+    replayFlow(name: string): Promise<FlowReplayResult>;
+    /** Injected clock — the single time source (no Date.now in logic, rule 7). */
+    now(): number;
+    /** Injected run-id generator (no Math.random in logic) — the live adapter supplies a branded uuid. */
+    newRunId(): RunId;
+}
+/** Run metadata the caller supplies; flows + verdict are produced by verify(). */
+export interface VerifyOptions {
+    names?: string[];
+    project: VerificationRunInput['project'];
+    agent: VerificationRunInput['agent'];
+    trigger: VerificationRunInput['trigger'];
+    profile: VerificationRunInput['profile'];
+    /** The change set under test — classified into risk surfaces (auth/payment/db/…). */
+    changedFiles?: ChangedFileInput[];
+    /** Which touched surfaces block the verdict (require human confirmation). */
+    policy?: RiskPolicy;
+}
+export declare class ReticleRunner {
+    #private;
+    constructor(port: RunnerPort);
+    /**
+     * Replay the named flows (or every saved flow), map each outcome into the artifact, and assemble a
+     * verdict. Sequential by design — flows share the one live app and parallel replay would race the
+     * DOM (the same reason reticle_flow_verify is sequential).
+     */
+    verify(opts: VerifyOptions): Promise<ReticleVerificationRun>;
+}
+//# sourceMappingURL=reticle-runner.d.ts.map

package/dist/runs/reticle-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reticle-runner.d.ts","sourceRoot":"","sources":["../../src/runs/reticle-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACvF,OAAO,EAAwB,KAAK,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAG9F,OAAO,EAGL,KAAK,gBAAgB,EACrB,KAAK,UAAU,EAChB,MAAM,oBAAoB,CAAC;AAE5B,oGAAoG;AACpG,MAAM,WAAW,UAAU;IACzB,kFAAkF;IAClF,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/B,kGAAkG;IAClG,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACpD,8EAA8E;IAC9E,GAAG,IAAI,MAAM,CAAC;IACd,sGAAsG;IACtG,QAAQ,IAAI,KAAK,CAAC;CACnB;AAED,kFAAkF;AAClF,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAC;IACzC,KAAK,EAAE,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACrC,OAAO,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAC;IACzC,OAAO,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAC;IACzC,qFAAqF;IACrF,YAAY,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAClC,6EAA6E;IAC7E,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB;AAED,qBAAa,aAAa;;gBAGZ,IAAI,EAAE,UAAU;IAI5B;;;;OAIG;IACG,MAAM,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,sBAAsB,CAAC;CA+BnE"}