@reticlehq/server 2.3.0 → 2.5.0

package/dist/input/network-detail.js

@@ -1,6 +1,16 @@
-import { EventType, REDACTED_VALUE, isSensitiveKey, scrubKnownSecrets, } from '@reticlehq/core';
+import { EventType, REDACTED_VALUE, defaultIsSensitiveKey, scrubKnownSecrets, } from '@reticlehq/core';
+import { drivenRedactionPolicy } from './driven-redaction.js';
 /** Bound on a captured wire body — matches the in-page capture so the two are comparable. */
 const MAX_WIRE_BODY_CHARS = 8192;
+/**
+ * The rule this module redacts by.
+ *
+ * `defaultIsSensitiveKey`, never the ambient `isSensitiveKey`: a daemon serves many sessions in one
+ * process, so an ambient policy here would let one app's config decide another app's redaction.
+ * Callers that have a session's declarations pass a policy explicitly; everything else gets the
+ * built-in floor, which is exactly what this module did before the rule became configurable.
+ */
+const DEFAULT_POLICY = { isSensitiveKey: defaultIsSensitiveKey };
 /**
  * Redact a sensitive key's value whatever its TYPE — string, number, array, or a nested object.
  *
@@ -8,19 +18,19 @@ const MAX_WIRE_BODY_CHARS = 8192;
  * SDK's sanitizer (Playwright hands it over raw), so its redaction has to be as strong as the SDK's,
  * which is key-based over a parsed object — not string-shaped.
  */
-function redactByKey(value) {
+function redactByKey(value, policy) {
     if (Array.isArray(value))
-        return value.map(redactByKey);
-    if (value !== null && typeof value === 'object') {
+        return value.map((v) => redactByKey(v, policy));
+    if (value !== null && 'object' === typeof value) {
         const out = {};
         for (const [k, v] of Object.entries(value)) {
-            out[k] = isSensitiveKey(k) ? REDACTED_VALUE : redactByKey(v);
+            out[k] = policy.isSensitiveKey(k) ? REDACTED_VALUE : redactByKey(v, policy);
         }
         return out;
     }
     return value;
 }
-function projectWireBody(raw) {
+function projectWireBody(raw, policy) {
     const bounded = raw.length > MAX_WIRE_BODY_CHARS ? raw.slice(0, MAX_WIRE_BODY_CHARS) : raw;
     const byShape = scrubKnownSecrets(bounded);
     // Prefer a STRUCTURAL pass. A sensitive key must be redacted regardless of its value type — a
@@ -29,7 +39,7 @@ function projectWireBody(raw) {
     // straight to the agent's context and the on-disk journal. Parsing and walking redacts them by key
     // whatever the shape.
     try {
-        return JSON.stringify(redactByKey(JSON.parse(byShape)));
+        return JSON.stringify(redactByKey(JSON.parse(byShape), policy));
     }
     catch {
         // Not JSON (a truncated capture, or a form-encoded body — the shape a login form actually POSTs).
@@ -37,8 +47,8 @@ function projectWireBody(raw) {
         // truncated body still contains, and the `key=value` pair of `application/x-www-form-urlencoded`,
         // which neither the JSON path nor the old regex ever touched — so `password=hunter2` leaked.
         return byShape
-            .replace(/"([^"]+)"\s*:\s*"([^"]*)"/g, (whole, key) => isSensitiveKey(key) ? `"${key}":"${REDACTED_VALUE}"` : whole)
-            .replace(/([^&?=\s]+)=([^&\s]*)/g, (whole, key) => isSensitiveKey(key) ? `${key}=${REDACTED_VALUE}` : whole);
+            .replace(/"([^"]+)"\s*:\s*"([^"]*)"/g, (whole, key) => policy.isSensitiveKey(key) ? `"${key}":"${REDACTED_VALUE}"` : whole)
+            .replace(/([^&?=\s]+)=([^&\s]*)/g, (whole, key) => policy.isSensitiveKey(key) ? `${key}=${REDACTED_VALUE}` : whole);
     }
 }
 /**
@@ -50,31 +60,37 @@ function projectWireBody(raw) {
  * credential HEADER is redacted whole by key; any other header value is still swept for known secret
  * SHAPES (a JWT echoed in a custom header), matching how request bodies are handled.
  */
-function projectHeaders(headers) {
+function projectHeaders(headers, policy) {
     const out = {};
     for (const [k, v] of Object.entries(headers)) {
         const key = k.toLowerCase();
-        out[key] = isSensitiveKey(key) ? REDACTED_VALUE : scrubKnownSecrets(v);
+        out[key] = policy.isSensitiveKey(key) ? REDACTED_VALUE : scrubKnownSecrets(v);
     }
     return out;
 }
-/** Shape a raw authoritative response into a NET_DETAIL payload (lower-cased headers). */
-export function buildNetworkDetail(raw) {
+/**
+ * Shape a raw authoritative response into a NET_DETAIL payload (lower-cased headers).
+ *
+ * `policy` defaults to the built-in rule so this stays a PURE builder — the driven-path union is
+ * resolved by `attachNetworkDetail`, at the glue layer, where reading process state is not a lie
+ * about the function's inputs.
+ */
+export function buildNetworkDetail(raw, policy = DEFAULT_POLICY) {
     return {
         url: raw.url,
         ...(raw.method === undefined ? {} : { method: raw.method }),
         status: raw.status,
-        headers: projectHeaders(raw.headers),
+        headers: projectHeaders(raw.headers, policy),
         ...(raw.resourceType === undefined ? {} : { resourceType: raw.resourceType }),
-        ...(raw.requestBody === undefined || raw.requestBody.length === 0
+        ...(raw.requestBody === undefined || 0 === raw.requestBody.length
             ? {}
-            : { requestBody: projectWireBody(raw.requestBody) }),
-        ...(raw.pageUrl === undefined || raw.pageUrl.length === 0 ? {} : { pageUrl: raw.pageUrl }),
+            : { requestBody: projectWireBody(raw.requestBody, policy) }),
+        ...(raw.pageUrl === undefined || 0 === raw.pageUrl.length ? {} : { pageUrl: raw.pageUrl }),
     };
 }
 function keyOf(url, method) {
-    const m = typeof method === 'string' ? method.toUpperCase() : '';
-    const u = typeof url === 'string' ? url : '';
+    const m = 'string' === typeof method ? method.toUpperCase() : '';
+    const u = 'string' === typeof url ? url : '';
     return `${m} ${u}`;
 }
 /**
@@ -111,9 +127,9 @@ export function mergeNetworkDetail(events) {
             // finding — that is the whole reason for capturing it — so the authoritative one wins and the
             // divergence is flagged rather than silently resolved.
             const wireBody = e.data['requestBody'];
-            if (typeof wireBody === 'string') {
+            if ('string' === typeof wireBody) {
                 const pageBody = data['requestBody'];
-                if (typeof pageBody === 'string' && pageBody !== wireBody) {
+                if ('string' === typeof pageBody && pageBody !== wireBody) {
                     data['requestBodyDivergedFromPage'] = true;
                 }
                 data['requestBody'] = wireBody;
@@ -146,9 +162,13 @@ export function attachNetworkDetail(page, emit) {
                 status: response.status(),
                 headers,
                 ...(resourceType === undefined ? {} : { resourceType }),
-                ...(postData === null ? {} : { requestBody: postData }),
+                ...(null === postData ? {} : { requestBody: postData }),
                 pageUrl: page.url(),
-            }));
+            }, 
+            // Resolved per response, not per attachment: a session declaring extra keys can connect
+            // after the listener is attached, and capturing the policy once would leave every
+            // already-driven page redacting by the rule that was in force before the app said so.
+            drivenRedactionPolicy()));
         });
         // `response.headers()` REJECTS when the page/CDP session is closing — precisely when responses race
         // teardown (navigation, tab close). Without this catch the rejection floats; on the daemon path a

package/dist/input/network-mock-tools.js

@@ -5,7 +5,7 @@ import { sessionIdShape } from '../tools/tool-kit.js';
 import { asString } from '../tools/tools-helpers.js';
 function mockProvider(deps) {
     const p = deps.realInput;
-    return p !== undefined && typeof p.setMocks === 'function' ? p : undefined;
+    return p !== undefined && 'function' === typeof p.setMocks ? p : undefined;
 }
 const ruleShape = z.object({
     urlContains: z
@@ -80,7 +80,7 @@ export const NETWORK_MOCK_TOOLS = [
                 };
             }
             const session = deps.sessions.resolve(asString(args['sessionId']));
-            const rules = args['clear'] === true ? [] : toRules(args['mocks']);
+            const rules = true === args['clear'] ? [] : toRules(args['mocks']);
             const applied = await provider.setMocks(session.url, rules);
             return { applied, count: applied ? rules.length : 0 };
         },

package/dist/input/network-mock.js

@@ -10,7 +10,7 @@ export function matchMock(rules, req) {
             continue;
         if (rule.method !== undefined && rule.method.toUpperCase() !== req.method.toUpperCase())
             continue;
-        if (rule.abort === true)
+        if (true === rule.abort)
             return { kind: 'abort' };
         const outcome = {
             kind: 'fulfill',
@@ -27,11 +27,11 @@ export function matchMock(rules, req) {
 }
 /** Apply a matched outcome to a Playwright Route. Exported so the route handler is testable in isolation. */
 export async function applyOutcome(route, outcome, sleep) {
-    if (outcome.kind === 'continue') {
+    if ('continue' === outcome.kind) {
         await route.continue();
         return;
     }
-    if (outcome.kind === 'abort') {
+    if ('abort' === outcome.kind) {
         await route.abort('failed');
         return;
     }
@@ -51,7 +51,7 @@ const realSleep = (ms) => new Promise((res) => setTimeout(res, ms));
  */
 export async function installNetworkMocks(page, rules, sleep = realSleep) {
     await page.unroute('**/*').catch(() => undefined);
-    if (rules.length === 0)
+    if (0 === rules.length)
         return;
     await page.route('**/*', (route) => {
         const req = route.request();

package/dist/input/real-input.js

@@ -1,3 +1,4 @@
+import { gotoOptions } from '../pool/playwright-launcher.js';
 import { BrowserLaunchKind } from '@reticlehq/core';
 import { getSessionMetrics } from '../telemetry/session-metrics.js';
 import { classifyConnectFailure } from '../telemetry/connect-failure.js';
@@ -93,7 +94,7 @@ const SCREENSHOT_DETERMINISM = { style: HIDE_RETICLE_CHROME_CSS, animations: 'di
 export async function capturePage(page, opts) {
     const buf = await page.screenshot(opts.clip !== undefined
         ? { ...SCREENSHOT_DETERMINISM, clip: opts.clip }
-        : opts.fullPage === true
+        : true === opts.fullPage
             ? { ...SCREENSHOT_DETERMINISM, fullPage: true }
             : { ...SCREENSHOT_DETERMINISM });
     return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
@@ -269,7 +270,11 @@ export class LaunchedRealInputProvider {
         if (this.#onNetworkDetail !== undefined)
             attachNetworkDetail(page, this.#onNetworkDetail);
         try {
-            await page.goto(this.#driveUrl);
+            // Same navigation rule as the pool, and for the same measured reason: Playwright's default
+            // waits for `load`, which an app with one never-finishing subresource never fires — 30s of
+            // nothing and then a failure that blames the app. The SDK connect is a module script, so it
+            // has already run by DOMContentLoaded. See gotoOptions.
+            await page.goto(this.#driveUrl, gotoOptions(undefined));
         }
         catch (e) {
             throw new DriveError(DriveErrorCode.NAVIGATE_FAILED, e instanceof Error ? e.message : String(e));
@@ -369,7 +374,7 @@ export function selectPage(pages, sessionUrl) {
         return exact;
     const target = stripVolatile(sessionUrl);
     const loose = pages.filter((p) => stripVolatile(p.url()) === target);
-    return loose.length === 1 ? loose[0] : undefined;
+    return 1 === loose.length ? loose[0] : undefined;
 }
 function stripVolatile(url) {
     const hash = url.indexOf('#');

package/dist/input/scroll-find.js

@@ -38,7 +38,7 @@ export async function scrollToFind(session, q, opts = {}) {
             return { found: true, element: hit, scrolls, exhausted: false };
         // Fall through to linear refinement from current position (already near the target).
         const data = asRecord(sr.result);
-        if (data['atEnd'] === true || data['scrolled'] === false) {
+        if (true === data['atEnd'] || false === data['scrolled']) {
             return { found: false, scrolls, exhausted: true };
         }
     }
@@ -50,7 +50,7 @@ export async function scrollToFind(session, q, opts = {}) {
         if (hit !== undefined)
             return { found: true, element: hit, scrolls, exhausted: false };
         // Reached the bottom or the container would not move — no more rows to reveal.
-        if (data['atEnd'] === true || data['scrolled'] === false) {
+        if (true === data['atEnd'] || false === data['scrolled']) {
             return { found: false, scrolls, exhausted: true };
         }
     }

package/dist/input/scroll-tools.d.ts

@@ -1,7 +1,2 @@
 import type { ToolDef } from '../tools/tools.js';
-/**
- * reticle_scroll_to — the windowed/virtualized-list escape hatch. A plain reticle_query
- * only sees rendered nodes, so an off-screen row in a react-window/react-virtualized list returns
- * nothing. This scrolls the container until the row mounts, then returns its ref.
- */
 export declare const SCROLL_TOOLS: ToolDef[];

package/dist/input/scroll-tools.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { QueryBy } from '@reticlehq/core';
 import { ReticleTool } from '../tools/tool-names.js';
 import { asNumber, asString } from '../tools/tools-helpers.js';
 import { scrollToFind } from './scroll-find.js';
@@ -7,14 +8,20 @@ import { scrollToFind } from './scroll-find.js';
  * only sees rendered nodes, so an off-screen row in a react-window/react-virtualized list returns
  * nothing. This scrolls the container until the row mounts, then returns its ref.
  */
+/**
+ * The query strategies, derived from QueryBy — the same vocabulary reticle_query uses, and for the
+ * same reason. A free string here produced the identical false negative: `by:'css'` scrolled the
+ * whole list and reported `{ found: false, exhausted: true }`, which reads as "the row is not in
+ * this list" rather than "that strategy does not exist".
+ */
+const QUERY_BY_LIST = Object.values(QueryBy).join(' | ');
+const queryByEnum = z.enum(Object.values(QueryBy));
 export const SCROLL_TOOLS = [
     {
         name: ReticleTool.SCROLL_TO,
-        description: 'Find an element in a VIRTUALIZED list that has not rendered yet. Pass `by` (role|text|testid|label|placeholder|alt) and `value` (query string) to identify the target row. Scrolls the container until the row mounts, the list ends, or maxScrolls (default 20) is spent. Pass targetIndex + totalCount for bisection — jumps directly to the estimated offset in one scroll (e.g. targetIndex:800 totalCount:1000 jumps to 80% of scrollHeight). Returns { found, element?, scrolls, exhausted }.',
+        description: 'Find an element in a VIRTUALIZED list that has not rendered yet. Pass `by` (see the parameter for the exact strategies) and `value` (query string) to identify the target row. Scrolls the container until the row mounts, the list ends, or maxScrolls (default 20) is spent. Pass targetIndex + totalCount for bisection — jumps directly to the estimated offset in one scroll (e.g. targetIndex:800 totalCount:1000 jumps to 80% of scrollHeight). Returns { found, element?, scrolls, exhausted }.',
         inputSchema: {
-            by: z
-                .string()
-                .describe('Query strategy for finding the target: role | text | testid | label | placeholder | alt'),
+            by: queryByEnum.describe(`Query strategy for finding the target: ${QUERY_BY_LIST}`),
             value: z
                 .string()
                 .describe('Query value for the selected strategy (the element to scroll into view).'),

package/dist/input/viewport-tools.js

@@ -8,7 +8,7 @@ const MIN_DIM = 64;
 const MAX_DIM = 10000;
 function viewportProvider(deps) {
     const p = deps.realInput;
-    return p !== undefined && typeof p.setViewport === 'function'
+    return p !== undefined && 'function' === typeof p.setViewport
         ? p
         : undefined;
 }
@@ -54,6 +54,6 @@ export const VIEWPORT_TOOLS = [
 ];
 /** Clamp a requested dimension into [MIN_DIM, MAX_DIM]; a missing/NaN value falls back to MIN_DIM. */
 function clampDim(value) {
-    const n = typeof value === 'number' && Number.isFinite(value) ? Math.round(value) : MIN_DIM;
+    const n = 'number' === typeof value && Number.isFinite(value) ? Math.round(value) : MIN_DIM;
     return Math.max(MIN_DIM, Math.min(n, MAX_DIM));
 }

package/dist/journal/ambient-store.d.ts

@@ -1,7 +1,5 @@
 import type { FileSystemPort } from '../project/fs-port.js';
 import { type AmbientCounts } from './ambient.js';
-/** Bumped on any breaking change to the persisted ambient-map shape. */
-export declare const AMBIENT_FILE_VERSION = 1;
 /**
  * Persists the learned ambient-churn region map at `.reticle/ambient.json`. Local, single-project
  * memory (stays OSS — OSS-VS-SERVER). Loads never throw: missing/malformed/wrong-version degrades to

package/dist/journal/ambient-store.js

@@ -2,7 +2,7 @@ import { dirname } from 'node:path';
 import { reticleDirPaths } from '../project/reticle-dir.js';
 import { AmbientFileSchema } from './ambient.js';
 /** Bumped on any breaking change to the persisted ambient-map shape. */
-export const AMBIENT_FILE_VERSION = 1;
+const AMBIENT_FILE_VERSION = 1;
 /**
  * Persists the learned ambient-churn region map at `.reticle/ambient.json`. Local, single-project
  * memory (stays OSS — OSS-VS-SERVER). Loads never throw: missing/malformed/wrong-version degrades to

package/dist/journal/ambient.js

@@ -8,7 +8,7 @@ import { z } from 'zod';
  */
 export function ambientKeyOf(event) {
     const region = event.data?.['region'];
-    if (typeof region === 'string' && region.length > 0)
+    if ('string' === typeof region && region.length > 0)
         return region;
     return event.ref;
 }

package/dist/journal/attach-journal.d.ts

@@ -7,7 +7,7 @@ export interface JournalTarget {
     elapsed(): number;
     setJournal(recorder: JournalRecorder, reader?: JournalReader): void;
 }
-export interface JournalAttachDeps {
+interface JournalAttachDeps {
     fs: FileSystemPort;
     reticleRoot: string;
     /** Journaling is on by default; the opt-out (`.reticle.json` journal:false / env) sets this false. */
@@ -19,3 +19,4 @@ export interface JournalAttachDeps {
  * journaling concern). The recorder's clock is the session's own elapsed time.
  */
 export declare function makeJournalAttach(deps: JournalAttachDeps): (session: JournalTarget) => void;
+export {};

package/dist/journal/deviation-report.js

@@ -6,13 +6,13 @@ function headlineFor(report) {
     if (report.insufficientSamples) {
         return `envelope too new (need ${String(MIN_ENVELOPE_SAMPLES)} runs) — see causal summary${truncNote}`;
     }
-    if (report.deviations.length === 0) {
-        const s = report.nominalSegments === 1 ? '' : 's';
+    if (0 === report.deviations.length) {
+        const s = 1 === report.nominalSegments ? '' : 's';
         return `${String(report.nominalSegments)} segment${s} nominal${truncNote}`;
     }
     const routes = [...new Set(report.deviations.map((d) => d.route))].join(', ');
     const n = report.deviations.length;
-    return `${String(n)} deviation${n === 1 ? '' : 's'}: ${routes}${truncNote}`;
+    return `${String(n)} deviation${1 === n ? '' : 's'}: ${routes}${truncNote}`;
 }
 /**
  * Judge observed segments against their per-route envelopes. Segments without a route, or whose
@@ -27,7 +27,7 @@ export function buildDeviationReport(envelopes, segments, zThreshold) {
         if (segment.route === undefined)
             continue;
         // A truncated segment's counts understate reality — judging it could read a false "nominal".
-        if (segment.truncated === true) {
+        if (true === segment.truncated) {
             truncated += 1;
             continue;
         }
@@ -36,7 +36,7 @@ export function buildDeviationReport(envelopes, segments, zThreshold) {
             continue;
         judged += 1;
         const segDeviations = compareSegment(envelope, segment, zThreshold);
-        if (segDeviations.length === 0)
+        if (0 === segDeviations.length)
             nominal += 1;
         else
             deviations.push(...segDeviations);
@@ -47,7 +47,7 @@ export function buildDeviationReport(envelopes, segments, zThreshold) {
         nominalSegments: nominal,
         judgedSegments: judged,
         truncatedSegments: truncated,
-        insufficientSamples: judged === 0,
+        insufficientSamples: 0 === judged,
     };
     return { ...base, headline: headlineFor(base) };
 }

package/dist/journal/deviation-service.js

@@ -20,7 +20,7 @@ export async function reportAndAccumulate(store, segments, zThreshold) {
             if (segment.route === undefined)
                 continue;
             // Never learn from a truncated sample — its understated counts would poison the baseline.
-            if (segment.truncated === true)
+            if (true === segment.truncated)
                 continue;
             const current = envelopes.get(segment.route) ?? emptyEnvelope(segment.route);
             envelopes.set(segment.route, addSegmentToEnvelope(current, segment));

package/dist/journal/envelope-store.d.ts

@@ -1,7 +1,5 @@
 import type { FileSystemPort } from '../project/fs-port.js';
 import { type RouteEnvelope } from './envelope.js';
-/** Bumped on any breaking change to the persisted envelope shape (matches the runs/contract convention). */
-export declare const ENVELOPE_FILE_VERSION = 1;
 /**
  * Persists the learned per-route envelopes at `.reticle/envelopes.json`. Local, single-project statistics
  * (single-player memory stays OSS — OSS-VS-SERVER). Loads never throw: a missing, malformed, or

package/dist/journal/envelope-store.js

@@ -3,7 +3,7 @@ import { dirname } from 'node:path';
 import { reticleDirPaths } from '../project/reticle-dir.js';
 import { RouteEnvelopeSchema } from './envelope.js';
 /** Bumped on any breaking change to the persisted envelope shape (matches the runs/contract convention). */
-export const ENVELOPE_FILE_VERSION = 1;
+const ENVELOPE_FILE_VERSION = 1;
 const EnvelopeFileSchema = z.object({
     version: z.literal(ENVELOPE_FILE_VERSION),
     routes: z.record(RouteEnvelopeSchema),

package/dist/journal/envelope.d.ts

@@ -21,7 +21,7 @@ export declare function stddev(stats: MetricStats): number;
 /** How many stddevs above the mean `x` sits (0 when there's no spread yet). */
 export declare function zScore(stats: MetricStats, x: number): number;
 /** The metrics an envelope tracks per route. */
-export declare const ENVELOPE_METRICS: readonly ["durationMs", "net", "netErrors", "consoleErrors"];
+declare const ENVELOPE_METRICS: readonly ["durationMs", "net", "netErrors", "consoleErrors"];
 export type EnvelopeMetric = (typeof ENVELOPE_METRICS)[number];
 export interface RouteEnvelope {
     route: string;
@@ -31,8 +31,6 @@ export interface RouteEnvelope {
 }
 /** Below this, an envelope is noise — the deviation report falls back to the causal summary. */
 export declare const MIN_ENVELOPE_SAMPLES = 3;
-/** Default flag threshold in stddevs. The number is a placeholder for fleet-calibrated priors. */
-export declare const DEFAULT_Z_THRESHOLD = 3;
 /** Persisted shape of a route envelope. Validated on load; a bad file degrades to no envelope. */
 export declare const RouteEnvelopeSchema: z.ZodObject<{
     route: z.ZodString;
@@ -229,3 +227,4 @@ export interface Deviation {
  * falls back to the causal summary in that case.
  */
 export declare function compareSegment(envelope: RouteEnvelope, segment: SegmentRollup, zThreshold?: number): Deviation[];
+export {};

package/dist/journal/envelope.js

@@ -15,14 +15,14 @@ export function stddev(stats) {
 /** How many stddevs above the mean `x` sits (0 when there's no spread yet). */
 export function zScore(stats, x) {
     const sd = stddev(stats);
-    return sd === 0 ? 0 : (x - stats.mean) / sd;
+    return 0 === sd ? 0 : (x - stats.mean) / sd;
 }
 /** The metrics an envelope tracks per route. */
-export const ENVELOPE_METRICS = ['durationMs', 'net', 'netErrors', 'consoleErrors'];
+const ENVELOPE_METRICS = ['durationMs', 'net', 'netErrors', 'consoleErrors'];
 /** Below this, an envelope is noise — the deviation report falls back to the causal summary. */
 export const MIN_ENVELOPE_SAMPLES = 3;
 /** Default flag threshold in stddevs. The number is a placeholder for fleet-calibrated priors. */
-export const DEFAULT_Z_THRESHOLD = 3;
+const DEFAULT_Z_THRESHOLD = 3;
 const MetricStatsSchema = z.object({
     count: z.number(),
     mean: z.number(),

package/dist/journal/journal-query.js

@@ -8,7 +8,7 @@ export function mergeEventsBySeq(journal, buffer) {
     const bySeq = new Map();
     const noSeq = [];
     for (const event of [...journal, ...buffer]) {
-        if (typeof event.seq === 'number')
+        if ('number' === typeof event.seq)
             bySeq.set(event.seq, event);
         else
             noSeq.push(event);

package/dist/journal/journal-recorder.d.ts

@@ -8,7 +8,7 @@ export interface JournalSink {
 export interface JournalReader {
     readEvents(): Promise<ReticleEvent[]>;
 }
-export interface JournalRecorderOptions {
+interface JournalRecorderOptions {
     /** Injected elapsed-ms clock (never read from Date here — the clock-injection rule). */
     now: () => number;
     /** Flush the pending-event batch once this many accumulate. */
@@ -35,3 +35,4 @@ export declare class JournalRecorder {
     /** Persist any buffered events now (call on session end). Awaits the write chain to settle. */
     flush(): Promise<void>;
 }
+export {};

package/dist/journal/journal-recorder.js

@@ -27,7 +27,7 @@ export class JournalRecorder {
         const active = this.#active;
         if (active !== undefined) {
             out = { ...event, actionId: active.actionId, attribution: EventAttribution.WINDOW };
-            if (typeof event.seq === 'number') {
+            if ('number' === typeof event.seq) {
                 active.seqFrom =
                     active.seqFrom === undefined ? event.seq : Math.min(active.seqFrom, event.seq);
                 active.seqTo = active.seqTo === undefined ? event.seq : Math.max(active.seqTo, event.seq);
@@ -71,7 +71,7 @@ export class JournalRecorder {
         await this.#chain;
     }
     #enqueueFlush() {
-        if (this.#pending.length === 0)
+        if (0 === this.#pending.length)
             return;
         const batch = this.#pending;
         this.#pending = [];

package/dist/journal/rollups.js

@@ -1,4 +1,4 @@
-import { EventType } from '@reticlehq/core';
+import { EventType, StreamDirection } from '@reticlehq/core';
 function finalize(acc) {
     return {
         ...(acc.route === undefined ? {} : { route: acc.route }),
@@ -9,13 +9,13 @@ function finalize(acc) {
         net: { total: acc.netTotal, errors: acc.netErrors },
         consoleErrors: acc.consoleErrors,
         statePathsChanged: acc.statePaths,
-        ...(acc.streams.frames === 0 ? {} : { streams: acc.streams }),
+        ...(0 === acc.streams.frames ? {} : { streams: acc.streams }),
         ...(acc.truncated ? { truncated: true } : {}),
     };
 }
 function isNetError(event) {
     const status = event.data['status'];
-    return event.data['ok'] === false || (typeof status === 'number' && status >= 400);
+    return false === event.data['ok'] || ('number' === typeof status && status >= 400);
 }
 /**
  * Fold an ordered event list into route segments split at each ROUTE_CHANGE. Pure: no clock, no IO —
@@ -41,13 +41,13 @@ export function computeSegments(events) {
             if (acc !== undefined)
                 segments.push(finalize(acc));
             const pathname = event.data['pathname'];
-            acc = open(typeof pathname === 'string' ? pathname : undefined, event.t);
+            acc = open('string' === typeof pathname ? pathname : undefined, event.t);
             continue;
         }
         if (acc === undefined)
             acc = open(undefined, event.t);
         acc.to = event.t;
-        if (typeof event.actionId === 'string')
+        if ('string' === typeof event.actionId)
             acc.actionIds.add(event.actionId);
         if (event.type === EventType.NET_REQUEST) {
             acc.netTotal += 1;
@@ -59,17 +59,17 @@ export function computeSegments(events) {
         }
         if (event.type === EventType.STATE_CHANGE) {
             const name = event.data['name'];
-            if (typeof name === 'string' && !acc.statePaths.includes(name))
+            if ('string' === typeof name && !acc.statePaths.includes(name))
                 acc.statePaths.push(name);
         }
         if (event.type === EventType.NET_STREAM) {
             acc.streams.frames += 1;
             const direction = event.data['direction'];
-            if (direction === 'open')
+            if (StreamDirection.OPEN === direction)
                 acc.streams.opened += 1;
-            else if (direction === 'in')
+            else if (StreamDirection.IN === direction)
                 acc.streams.in += 1;
-            else if (direction === 'out')
+            else if (StreamDirection.OUT === direction)
                 acc.streams.out += 1;
         }
         if (event.type === EventType.TRUNCATED || event.type === EventType.TRANSPORT_OVERFLOW) {

package/dist/journal/session-end.d.ts

@@ -17,7 +17,7 @@ export interface SessionEndTarget {
     ambientCounts(): AmbientCounts;
     ownAmbientCounts(): AmbientCounts;
 }
-export interface SessionEndDeps {
+interface SessionEndDeps {
     fs: FileSystemPort;
     reticleRoot: string;
     /** Journaling/persistence off (opt-out) → teardown is a no-op. */
@@ -29,3 +29,4 @@ export interface SessionEndDeps {
  * starts already knowing which regions churn.
  */
 export declare function makeSessionEnd(deps: SessionEndDeps): (session: SessionEndTarget) => Promise<void>;
+export {};

package/dist/journal/session-journal.js

@@ -37,7 +37,7 @@ export class SessionJournal {
         this.#sessionId = sessionId;
     }
     async appendEvents(events) {
-        if (events.length === 0)
+        if (0 === events.length)
             return;
         await this.#ensureDir();
         const text = `${events.map((e) => JSON.stringify(e)).join('\n')}\n`;
@@ -108,11 +108,11 @@ export class SessionJournal {
     #ingestTail(tail) {
         const cache = this.#eventCache ?? (this.#eventCache = []);
         const end = tail.lastIndexOf('\n') + 1;
-        if (end === 0)
+        if (0 === end)
             return 0; // no complete line yet
         const complete = tail.slice(0, end);
         for (const line of complete.split('\n')) {
-            if (line.length === 0)
+            if (0 === line.length)
                 continue;
             let parsed;
             try {
@@ -148,7 +148,7 @@ export class SessionJournal {
         }
         const out = [];
         for (const line of text.split('\n')) {
-            if (line.length === 0)
+            if (0 === line.length)
                 continue;
             let parsed;
             try {

package/dist/license/license.d.ts

@@ -70,20 +70,6 @@ export declare function assertEnterprise(feature: string, ctx: GateContext): voi
 /** Env names that carry the activation: the operator's key, and the issuer public key baked at release. */
 export declare const LICENSE_KEY_ENV = "RETICLE_LICENSE_KEY";
 export declare const LICENSE_PUBLIC_KEY_ENV = "RETICLE_LICENSE_PUBLIC_KEY";
-/**
- * Issuer public key COMPILED INTO the build. Empty in the source tree; the release pipeline replaces
- * this literal with the real spki PEM. Baking it (rather than only reading env) is what makes the
- * enterprise gate fail closed: a self-hosted operator can no longer disable enforcement by simply
- * never setting RETICLE_LICENSE_PUBLIC_KEY, because the baked key takes precedence. The public key is
- * safe to ship openly — it can only verify licenses, never mint them (that needs the private key).
- */
-export declare const BAKED_ISSUER_PUBLIC_KEY_PEM = "";
-/**
- * Resolve the issuer public-key PEM enforcement uses: the baked-in release key wins, so it can't be
- * turned off from the environment. Only when nothing is baked (dev/repo) does the env var apply — that
- * env path is the test/self-eval escape hatch, not the production switch.
- */
-export declare function resolveIssuerPublicKeyPem(env: NodeJS.ProcessEnv, baked?: string): string | undefined;
 /** The human-facing state of enterprise activation on this machine (what `reticle license status` shows). */
 interface LicenseReport {
     status: 'active' | 'missing' | 'invalid' | 'expired' | 'eval';