@senpi/runtime 3.0.56 → 3.0.58

package/dist/validate/signal-stage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signal-stage.js","sourceRoot":"","sources":["../../src/validate/signal-stage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAc3C;;;;;;;GAOG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEhC,SAAS,aAAa,CACpB,IAAY,EACZ,QAA6B,EAC7B,KAAqF;IAErF,OAAO;QACL,IAAI;QACJ,QAAQ;QACR,KAAK,EAAE,MAAM;QACb,KAAK,EAAE,OAAO;QACd,QAAQ,EAAE,MAAM;QAChB,GAAG,KAAK;KACT,CAAC;AACJ,CAAC;AAED,2FAA2F;AAC3F,SAAS,QAAQ,CAAC,MAAoB,EAAE,KAAa;IACnD,MAAM,OAAO,GAAG,MAAM,CAAC,OAA0D,CAAC;IAClF,MAAM,KAAK,GAAG,OAAO,OAAO,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,MAAM,SAAS,GAAG,OAAO,OAAO,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACzF,IAAI,KAAK,IAAI,SAAS;QAAE,OAAO,GAAG,SAAS,IAAI,KAAK,EAAE,CAAC;IACvD,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,OAAO,UAAU,KAAK,GAAG,CAAC,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,IAAa;IACrC,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;SAC9C,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;SACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;QAClF,OAAO,GAAG,IAAI,KAAK,CAAC,CAAC,OAAO,SAAS,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;IAChF,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,OAAsB,EAAE,OAAuB;IAC1E,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAEtC,uFAAuF;QACvF,0FAA0F;QAC1F,+BAA+B;QAC/B,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtD,MAAM,OAAO,GAAG,MAAM,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACjF,QAAQ,CAAC,IAAI,CACX,aAAa,CAAC,aAAa,CAAC,cAAc,EAAE,OAAO,EAAE;gBACnD,IAAI,EAAE,GAAG,KAAK,iDAAiD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,iCAAiC,EAAE;gBACxH,GAAG,EAAE,gKAAgK;gBACrK,GAAG,EAAE,mCAAmC,KAAK,gCAAgC;gBAC7E,QAAQ,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,EAAE;aACzF,CAAC,CACH,CAAC;YACF,SAAS;QACX,CAAC;QAED,oEAAoE;QACpE,MAAM,IAAI,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAClE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAAC,EAAE,CAAC;YAC1C,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAC1C,QAAQ,CAAC,IAAI,CACX,aAAa,CAAC,aAAa,CAAC,cAAc,EAAE,OAAO,EAAE;gBACnD,IAAI,EAAE,GAAG,KAAK,iCAAiC,UAAU,CAAC,CAAC,CAAC,IAAI,4CAA4C,EAAE;gBAC9G,GAAG,EAAE,2MAA2M;gBAChN,GAAG,EACD,UAAU,CAAC,MAAM,GAAG,CAAC;oBACnB,CAAC,CAAC,oBAAoB,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;oBAC9C,CAAC,CAAC,WAAW,UAAU,CAAC,CAAC,CAAC,IAAI,mBAAmB,GAAG;gBACxD,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE;aACxD,CAAC,CACH,CAAC;YACF,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAI,MAAM,CAAC,IAAgC,CAAC,SAAS,CAAC;QACrE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,GAAG,CAAC,IAAI,SAAS,GAAG,qBAAqB,EAAE,CAAC;YACxF,QAAQ,CAAC,IAAI,CACX,aAAa,CAAC,aAAa,CAAC,mBAAmB,EAAE,SAAS,EAAE;gBAC1D,IAAI,EAAE,GAAG,KAAK,uBAAuB,SAAS,EAAE;gBAChD,GAAG,EAAE,+CAA+C,SAAS,UAAU,SAAS,kBAAkB,SAAS,GAAG,GAAG,sIAAsI;gBACvP,GAAG,EAAE,MAAM,SAAS,GAAG,GAAG,+BAA+B,SAAS,GAAG,GAAG,QAAQ,SAAS,mFAAmF;gBAC5K,QAAQ,EAAE,EAAE,SAAS,EAAE;aACxB,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/validate/target.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Resolving what the caller pointed at.
+ *
+ * Runs before anything is parsed. Its whole job is to answer "what am I validating, and how deep
+ * can I go against it" — and, when it cannot, to say so in terms of what is actually on disk rather
+ * than what was expected to be.
+ *
+ * That last part is why these failures are worth care despite being the least interesting ones: they
+ * are the first thing an agent hits, and a refusal that cannot name the real alternatives turns into
+ * guessing. So the resolver reads the directory before it complains about it.
+ *
+ * ## Filenames are conventions, not contract
+ *
+ * Nothing in the runtime requires a recipe to be called `runtime.yaml`, or a scanner directory to be
+ * called `scanners/` — install accepts any path, and the scanner location is a field inside the
+ * recipe. Those names are used here only to break ties when a caller points at a directory, and the
+ * resolver refuses rather than guesses when they do not.
+ */
+import type { Depth, Finding } from "./types.js";
+/** What the caller pointed at. A union so "a path and inline content" is not representable. */
+export type TargetInput = {
+    kind: "path";
+    path?: string;
+    cwd: string;
+} | {
+    kind: "content";
+    content: string;
+    dir?: string;
+    cwd: string;
+};
+export type TargetKind = 
+/** A recipe, named directly or found inside a directory. Every depth is reachable. */
+"recipe"
+/** A directory of scanner code with no recipe. Code can be checked; nothing can be executed. */
+ | "scanner-dir"
+/** A single entry file. Same limits as a scanner directory. */
+ | "entrypoint"
+/** Recipe content supplied inline. Reaches execution only when a directory is supplied too. */
+ | "inline";
+export interface ResolvedTarget {
+    kind: TargetKind;
+    /** Absolute path to the recipe, when one was found. */
+    recipePath?: string;
+    /** Recipe content, when supplied inline instead of on disk. */
+    recipeContent?: string;
+    /** Absolute directory that relative paths inside the recipe resolve against. */
+    baseDir?: string;
+    /** Absolute scanner directory, for the code-only forms. */
+    scannerRoot?: string;
+    /** Entry filename within {@link scannerRoot}, for the single-file form. */
+    entrypoint?: string;
+    /** Depths this target can reach. */
+    allowedDepths: readonly Depth[];
+}
+export type TargetResolution = {
+    ok: true;
+    target: ResolvedTarget;
+} | {
+    ok: false;
+    finding: Finding;
+};
+/**
+ * Resolve what to validate, or say why it could not be resolved.
+ *
+ * `requestedDepth` is checked against what the target can reach, so "a live run against a bare
+ * scanner directory" fails here — before a process is spawned — rather than deep inside a launch
+ * that was never going to be buildable.
+ */
+export declare function resolveTarget(input: TargetInput, requestedDepth: Depth): TargetResolution;
+//# sourceMappingURL=target.d.ts.map

package/dist/validate/target.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"target.d.ts","sourceRoot":"","sources":["../../src/validate/target.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAiBjD,+FAA+F;AAC/F,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpE,MAAM,MAAM,UAAU;AACpB,sFAAsF;AACpF,QAAQ;AACV,gGAAgG;GAC9F,aAAa;AACf,+DAA+D;GAC7D,YAAY;AACd,+FAA+F;GAC7F,QAAQ,CAAC;AAEb,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,UAAU,CAAC;IACjB,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oCAAoC;IACpC,aAAa,EAAE,SAAS,KAAK,EAAE,CAAC;CACjC;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,cAAc,CAAA;CAAE,GACpC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC;AA6GpC;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,GAAG,gBAAgB,CAQzF"}

package/dist/validate/target.js

@@ -0,0 +1,231 @@
+/**
+ * Resolving what the caller pointed at.
+ *
+ * Runs before anything is parsed. Its whole job is to answer "what am I validating, and how deep
+ * can I go against it" — and, when it cannot, to say so in terms of what is actually on disk rather
+ * than what was expected to be.
+ *
+ * That last part is why these failures are worth care despite being the least interesting ones: they
+ * are the first thing an agent hits, and a refusal that cannot name the real alternatives turns into
+ * guessing. So the resolver reads the directory before it complains about it.
+ *
+ * ## Filenames are conventions, not contract
+ *
+ * Nothing in the runtime requires a recipe to be called `runtime.yaml`, or a scanner directory to be
+ * called `scanners/` — install accepts any path, and the scanner location is a field inside the
+ * recipe. Those names are used here only to break ties when a caller points at a directory, and the
+ * resolver refuses rather than guesses when they do not.
+ */
+import { existsSync, readdirSync, statSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { VALIDATE_CODE } from "./codes.js";
+/**
+ * The conventional recipe filename. Used only to break ties inside a directory; an explicitly
+ * named file is honoured whatever it is called.
+ */
+const CONVENTIONAL_RECIPE = "runtime.yaml";
+/**
+ * The deploy manifest. It is a `.yaml` sitting beside recipes, so it must be excluded from
+ * recipe candidates or a package root would resolve to its own manifest. It belongs to the deploy
+ * layer and is outside what this validates.
+ */
+const DEPLOY_MANIFEST = "strategy.yaml";
+const RECIPE_EXTENSIONS = [".yaml", ".yml"];
+const ALL_DEPTHS = ["static", "import", "live"];
+const CODE_ONLY = ["import"];
+const CONFIG_ONLY = ["static"];
+function invocationFinding(code, parts) {
+    return {
+        code,
+        severity: "error",
+        stage: "invocation",
+        actor: "agent",
+        fix_kind: code === VALIDATE_CODE.noRecipe || code === VALIDATE_CODE.ambiguousRecipe ? "choice" : "command",
+        ...parts,
+    };
+}
+/** Directory entries that could be a recipe: a YAML file that is not the deploy manifest. */
+function recipeCandidates(dir) {
+    return readdirSync(dir, { withFileTypes: true })
+        .filter((e) => e.isFile())
+        .map((e) => e.name)
+        .filter((name) => name !== DEPLOY_MANIFEST)
+        .filter((name) => RECIPE_EXTENSIONS.some((ext) => name.endsWith(ext)))
+        .sort();
+}
+/** Subdirectories that themselves hold a conventionally-named recipe — a package's instances. */
+function instanceDirs(dir) {
+    return readdirSync(dir, { withFileTypes: true })
+        .filter((e) => e.isDirectory() && !e.name.startsWith("."))
+        .map((e) => e.name)
+        .filter((name) => existsSync(join(dir, name, CONVENTIONAL_RECIPE)))
+        .sort();
+}
+function hasPythonFiles(dir) {
+    return readdirSync(dir, { withFileTypes: true }).some((e) => e.isFile() && e.name.endsWith(".py"));
+}
+/** How the resolved target would be written on a command line, for use inside a computed fix. */
+function asArg(cwd, absolute) {
+    const rel = relative(cwd, absolute);
+    if (rel === "")
+        return ".";
+    return rel.startsWith("..") || isAbsolute(rel) ? absolute : `./${rel}`;
+}
+function resolveDirectory(dir, cwd) {
+    const conventional = join(dir, CONVENTIONAL_RECIPE);
+    if (existsSync(conventional) && statSync(conventional).isFile()) {
+        return { ok: true, target: { kind: "recipe", recipePath: conventional, baseDir: dir, allowedDepths: ALL_DEPTHS } };
+    }
+    const candidates = recipeCandidates(dir);
+    if (candidates.length === 1) {
+        const only = join(dir, candidates[0]);
+        return { ok: true, target: { kind: "recipe", recipePath: only, baseDir: dir, allowedDepths: ALL_DEPTHS } };
+    }
+    if (candidates.length > 1) {
+        return {
+            ok: false,
+            finding: invocationFinding(VALIDATE_CODE.ambiguousRecipe, {
+                what: `${asArg(cwd, dir)} holds ${candidates.length} possible recipes and none is named ${CONVENTIONAL_RECIPE}`,
+                why: "Picking one would be a guess, and validating the wrong recipe is worse than refusing.",
+                fix: `Name the one you mean:\n${candidates.map((c) => `  senpi validate ${asArg(cwd, join(dir, c))}`).join("\n")}`,
+                where: { file: asArg(cwd, dir) },
+                evidence: { candidates },
+            }),
+        };
+    }
+    // No recipe here. A package root holding instance directories is the common case — an agent
+    // reaches for the package by name because that is how every other tool refers to it.
+    const instances = instanceDirs(dir);
+    if (instances.length > 0) {
+        return {
+            ok: false,
+            finding: invocationFinding(VALIDATE_CODE.noRecipe, {
+                what: `${asArg(cwd, dir)} has no recipe of its own — it holds ${instances.length} instance${instances.length === 1 ? "" : "s"}`,
+                why: "Validation runs against one runtime. A package groups several, each with its own recipe and its own wallet.",
+                fix: `Pick an instance:\n${instances.map((i) => `  senpi validate ${asArg(cwd, join(dir, i))}`).join("\n")}`,
+                where: { file: asArg(cwd, dir) },
+                evidence: { instances },
+            }),
+        };
+    }
+    // Scanner code with no recipe beside it. Legitimate mid-authoring: code exists before the
+    // recipe is finished, and the import checks need nothing else.
+    if (hasPythonFiles(dir)) {
+        return { ok: true, target: { kind: "scanner-dir", scannerRoot: dir, allowedDepths: CODE_ONLY } };
+    }
+    return {
+        ok: false,
+        finding: invocationFinding(VALIDATE_CODE.noRecipe, {
+            what: `${asArg(cwd, dir)} holds no recipe and no scanner code`,
+            why: "There is nothing here to validate.",
+            fix: `Point at a directory containing a recipe (${CONVENTIONAL_RECIPE}), or at a scanner directory to check its code alone.`,
+            where: { file: asArg(cwd, dir) },
+            evidence: { entries: readdirSync(dir).slice(0, 20) },
+        }),
+    };
+}
+/**
+ * Resolve what to validate, or say why it could not be resolved.
+ *
+ * `requestedDepth` is checked against what the target can reach, so "a live run against a bare
+ * scanner directory" fails here — before a process is spawned — rather than deep inside a launch
+ * that was never going to be buildable.
+ */
+export function resolveTarget(input, requestedDepth) {
+    const resolved = resolveTargetShape(input);
+    if (!resolved.ok)
+        return resolved;
+    const { target } = resolved;
+    if (target.allowedDepths.includes(requestedDepth))
+        return resolved;
+    return { ok: false, finding: depthUnreachable(target, requestedDepth, input) };
+}
+function resolveTargetShape(input) {
+    if (input.kind === "content") {
+        if (input.dir === undefined) {
+            return {
+                ok: true,
+                target: { kind: "inline", recipeContent: input.content, allowedDepths: CONFIG_ONLY },
+            };
+        }
+        const baseDir = resolve(input.cwd, input.dir);
+        if (!existsSync(baseDir)) {
+            return {
+                ok: false,
+                finding: invocationFinding(VALIDATE_CODE.targetNotFound, {
+                    what: `The directory ${input.dir} does not exist`,
+                    why: "Relative scanner paths inside the recipe are resolved against it.",
+                    fix: `Pass a directory that exists. Resolved from ${input.cwd} to ${baseDir}.`,
+                    evidence: { requested: input.dir, resolved: baseDir, cwd: input.cwd },
+                }),
+            };
+        }
+        return {
+            ok: true,
+            target: { kind: "inline", recipeContent: input.content, baseDir, allowedDepths: ALL_DEPTHS },
+        };
+    }
+    const path = resolve(input.cwd, input.path ?? ".");
+    if (!existsSync(path)) {
+        return {
+            ok: false,
+            finding: invocationFinding(VALIDATE_CODE.targetNotFound, {
+                what: `${input.path ?? "."} does not exist`,
+                why: "Nothing can be validated until the target resolves to a file or directory.",
+                // Relative-path mistakes are the usual cause, so name what it resolved against.
+                fix: `Check the path. It was resolved from ${input.cwd} to ${path}.`,
+                evidence: { requested: input.path ?? ".", resolved: path, cwd: input.cwd },
+            }),
+        };
+    }
+    if (statSync(path).isDirectory())
+        return resolveDirectory(path, input.cwd);
+    if (path.endsWith(".py")) {
+        return {
+            ok: true,
+            target: {
+                kind: "entrypoint",
+                scannerRoot: dirname(path),
+                entrypoint: basename(path),
+                allowedDepths: CODE_ONLY,
+            },
+        };
+    }
+    return {
+        ok: true,
+        target: { kind: "recipe", recipePath: path, baseDir: dirname(path), allowedDepths: ALL_DEPTHS },
+    };
+}
+/**
+ * The requested depth is not reachable against this target.
+ *
+ * Split by cause because the remedies are different, and because the reason a live run needs a
+ * recipe is worth stating: the inputs a scanner is called with, the account it runs against, and
+ * the schema its output is judged by all live in the recipe. Supplying defaults would let a scanner
+ * pass against invented inputs and fail on real ones — which is the failure this exists to catch.
+ */
+function depthUnreachable(target, requested, input) {
+    if (target.kind === "inline") {
+        return invocationFinding(VALIDATE_CODE.needsDir, {
+            what: `A ${requested} run needs a directory, and recipe content was supplied without one`,
+            why: "Relative scanner paths in the recipe have nothing to resolve against, so the scanner cannot be located.",
+            fix: "Re-run with --dir pointing at the directory the recipe belongs to.",
+            evidence: { requested_depth: requested, allowed_depths: target.allowedDepths },
+        });
+    }
+    const what = target.kind === "entrypoint"
+        ? `A ${requested} run needs a recipe, and the target is a single scanner file`
+        : `A ${requested} run needs a recipe, and the target is a scanner directory`;
+    return invocationFinding(VALIDATE_CODE.needsRecipe, {
+        what,
+        why: "Executing a scanner needs the inputs it is called with, the account it runs against, and the schema " +
+            "its output is judged by — all of which live in the recipe. Substituting defaults would let it pass " +
+            "against invented inputs and fail on real ones.",
+        fix: `Point at the recipe to run every check, or keep this target and use --stage import to check the code alone:\n` +
+            `  senpi validate ${asArg(input.cwd, dirname(target.scannerRoot ?? "."))}\n` +
+            `  senpi validate ${asArg(input.cwd, target.scannerRoot ?? ".")} --stage import`,
+        where: { file: asArg(input.cwd, target.scannerRoot ?? ".") },
+        evidence: { requested_depth: requested, allowed_depths: target.allowedDepths },
+    });
+}
+//# sourceMappingURL=target.js.map

package/dist/validate/target.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"target.js","sourceRoot":"","sources":["../../src/validate/target.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAG3C;;;GAGG;AACH,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAE3C;;;;GAIG;AACH,MAAM,eAAe,GAAG,eAAe,CAAC;AAExC,MAAM,iBAAiB,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAqC5C,MAAM,UAAU,GAAqB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AAClE,MAAM,SAAS,GAAqB,CAAC,QAAQ,CAAC,CAAC;AAC/C,MAAM,WAAW,GAAqB,CAAC,QAAQ,CAAC,CAAC;AAEjD,SAAS,iBAAiB,CACxB,IAAY,EACZ,KAA+G;IAE/G,OAAO;QACL,IAAI;QACJ,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,YAAY;QACnB,KAAK,EAAE,OAAO;QACd,QAAQ,EAAE,IAAI,KAAK,aAAa,CAAC,QAAQ,IAAI,IAAI,KAAK,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;QAC1G,GAAG,KAAK;KACT,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,SAAS,gBAAgB,CAAC,GAAW;IACnC,OAAO,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SAC7C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACzB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SAClB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,eAAe,CAAC;SAC1C,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;SACrE,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,iGAAiG;AACjG,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SAC7C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SACzD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SAClB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAC;SAClE,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,OAAO,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACrG,CAAC;AAED,iGAAiG;AACjG,SAAS,KAAK,CAAC,GAAW,EAAE,QAAgB;IAC1C,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACpC,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,GAAG,CAAC;IAC3B,OAAO,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW,EAAE,GAAW;IAChD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,YAAY,CAAC,IAAI,QAAQ,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QAChE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,CAAC;IACrH,CAAC;IAED,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAE,CAAC,CAAC;QACvC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,CAAC;IAC7G,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,iBAAiB,CAAC,aAAa,CAAC,eAAe,EAAE;gBACxD,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,UAAU,CAAC,MAAM,uCAAuC,mBAAmB,EAAE;gBAC/G,GAAG,EAAE,uFAAuF;gBAC5F,GAAG,EAAE,2BAA2B,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAClH,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE;gBAChC,QAAQ,EAAE,EAAE,UAAU,EAAE;aACzB,CAAC;SACH,CAAC;IACJ,CAAC;IAED,4FAA4F;IAC5F,qFAAqF;IACrF,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,iBAAiB,CAAC,aAAa,CAAC,QAAQ,EAAE;gBACjD,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,wCAAwC,SAAS,CAAC,MAAM,YAAY,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE;gBAC/H,GAAG,EAAE,6GAA6G;gBAClH,GAAG,EAAE,sBAAsB,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC5G,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE;gBAChC,QAAQ,EAAE,EAAE,SAAS,EAAE;aACxB,CAAC;SACH,CAAC;IACJ,CAAC;IAED,0FAA0F;IAC1F,+DAA+D;IAC/D,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,CAAC;IACnG,CAAC;IAED,OAAO;QACL,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,iBAAiB,CAAC,aAAa,CAAC,QAAQ,EAAE;YACjD,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,sCAAsC;YAC9D,GAAG,EAAE,oCAAoC;YACzC,GAAG,EAAE,6CAA6C,mBAAmB,uDAAuD;YAC5H,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE;YAChC,QAAQ,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;SACrD,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,KAAkB,EAAE,cAAqB;IACrE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAElC,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;IAC5B,IAAI,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEnE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,gBAAgB,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAkB;IAC5C,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,CAAC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE;aACrF,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,iBAAiB,CAAC,aAAa,CAAC,cAAc,EAAE;oBACvD,IAAI,EAAE,iBAAiB,KAAK,CAAC,GAAG,iBAAiB;oBACjD,GAAG,EAAE,mEAAmE;oBACxE,GAAG,EAAE,+CAA+C,KAAK,CAAC,GAAG,OAAO,OAAO,GAAG;oBAC9E,QAAQ,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE;iBACtE,CAAC;aACH,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE;SAC7F,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;IACnD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,iBAAiB,CAAC,aAAa,CAAC,cAAc,EAAE;gBACvD,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,IAAI,GAAG,iBAAiB;gBAC3C,GAAG,EAAE,4EAA4E;gBACjF,gFAAgF;gBAChF,GAAG,EAAE,wCAAwC,KAAK,CAAC,GAAG,OAAO,IAAI,GAAG;gBACpE,QAAQ,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,IAAI,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE;aAC3E,CAAC;SACH,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;QAAE,OAAO,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAE3E,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE;gBACN,IAAI,EAAE,YAAY;gBAClB,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC;gBAC1B,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC;gBAC1B,aAAa,EAAE,SAAS;aACzB;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE;KAChG,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAC,MAAsB,EAAE,SAAgB,EAAE,KAAkB;IACpF,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,iBAAiB,CAAC,aAAa,CAAC,QAAQ,EAAE;YAC/C,IAAI,EAAE,KAAK,SAAS,qEAAqE;YACzF,GAAG,EAAE,yGAAyG;YAC9G,GAAG,EAAE,oEAAoE;YACzE,QAAQ,EAAE,EAAE,eAAe,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,CAAC,aAAa,EAAE;SAC/E,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GACR,MAAM,CAAC,IAAI,KAAK,YAAY;QAC1B,CAAC,CAAC,KAAK,SAAS,8DAA8D;QAC9E,CAAC,CAAC,KAAK,SAAS,4DAA4D,CAAC;IAEjF,OAAO,iBAAiB,CAAC,aAAa,CAAC,WAAW,EAAE;QAClD,IAAI;QACJ,GAAG,EACD,sGAAsG;YACtG,qGAAqG;YACrG,gDAAgD;QAClD,GAAG,EACD,+GAA+G;YAC/G,oBAAoB,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,IAAI,GAAG,CAAC,CAAC,IAAI;YAC5E,oBAAoB,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,IAAI,GAAG,CAAC,iBAAiB;QAClF,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,IAAI,GAAG,CAAC,EAAE;QAC5D,QAAQ,EAAE,EAAE,eAAe,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,CAAC,aAAa,EAAE;KAC/E,CAAC,CAAC;AACL,CAAC"}

package/dist/validate/telemetry.d.ts

@@ -0,0 +1,24 @@
+/**
+ * What validate reports about itself — and, harder, what it must not.
+ *
+ * The goal is the harness-improvement loop: which codes fire in the field, at what depth runs
+ * stop, whether passes produce proofs, which verification reasons refuse deploys. That is
+ * answerable entirely with **closed-set dimensions** — and it has to be, because validate handles
+ * exactly the material telemetry must never carry: recipe config, scanner source, wallet
+ * addresses, file paths, exception text. So the rule is structural, not disciplinary: every
+ * attribute value is either drawn from a compile-time set or clamped to `"other"`. There is no
+ * code path by which free text reaches an attribute.
+ *
+ * Pure builders, exported for the redaction tests; the OTel instruments live in
+ * `telemetry/metrics.ts` with the rest of the fleet's and consume these unchanged.
+ */
+import type { Finding } from "./types.js";
+import type { ValidateResult } from "./run.js";
+import type { VerifyReason } from "./proof.js";
+/** One run: how deep it went, how it ended, whether the pass became durable. */
+export declare function runAttributes(result: ValidateResult): Record<string, string>;
+/** One finding: the class and where it sits — never the message, never the location. */
+export declare function findingAttributes(finding: Finding): Record<string, string>;
+/** One verification: the outcome alone. Which package it was is nobody's business here. */
+export declare function verificationAttributes(outcome: "ok" | VerifyReason): Record<string, string>;
+//# sourceMappingURL=telemetry.d.ts.map

package/dist/validate/telemetry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.d.ts","sourceRoot":"","sources":["../../src/validate/telemetry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAsB/C,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQ5E;AAED,wFAAwF;AACxF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQ1E;AAED,2FAA2F;AAC3F,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,IAAI,GAAG,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAI3F"}

package/dist/validate/telemetry.js

@@ -0,0 +1,60 @@
+/**
+ * What validate reports about itself — and, harder, what it must not.
+ *
+ * The goal is the harness-improvement loop: which codes fire in the field, at what depth runs
+ * stop, whether passes produce proofs, which verification reasons refuse deploys. That is
+ * answerable entirely with **closed-set dimensions** — and it has to be, because validate handles
+ * exactly the material telemetry must never carry: recipe config, scanner source, wallet
+ * addresses, file paths, exception text. So the rule is structural, not disciplinary: every
+ * attribute value is either drawn from a compile-time set or clamped to `"other"`. There is no
+ * code path by which free text reaches an attribute.
+ *
+ * Pure builders, exported for the redaction tests; the OTel instruments live in
+ * `telemetry/metrics.ts` with the rest of the fleet's and consume these unchanged.
+ */
+import { ALL_VALIDATE_CODES } from "./codes.js";
+const VERDICTS = new Set(["PASS", "FAIL", "UNPROVEN"]);
+const DEPTHS = new Set(["static", "import", "live"]);
+/**
+ * Mirrors the `TargetKind` union in `target.ts`. A test asserts it covers every member — a value
+ * missing here does not fail loudly, it silently clamps to `"other"`, so the dimension goes quietly
+ * useless for exactly the kinds nobody thought about.
+ */
+const TARGET_KINDS = new Set(["recipe", "scanner-dir", "entrypoint", "inline"]);
+const SEVERITIES = new Set(["error", "warning"]);
+const STAGES = new Set(["invocation", "static", "import", "live", "proof"]);
+const ACTORS = new Set(["agent", "user", "ops"]);
+const FIX_KINDS = new Set(["edit", "command", "choice", "lookup", "locate-only"]);
+const KNOWN_CODES = new Set(ALL_VALIDATE_CODES);
+const VERIFY_OUTCOMES = new Set(["ok", "no_proof", "content_changed", "runtime_version_changed"]);
+/** The only route into an attribute value: in the set, or `"other"`. */
+function clamp(value, set) {
+    return value !== undefined && set.has(value) ? value : "other";
+}
+/** One run: how deep it went, how it ended, whether the pass became durable. */
+export function runAttributes(result) {
+    return {
+        "senpi.validate.verdict": clamp(result.verdict, VERDICTS),
+        "senpi.validate.deepest_stage": clamp(result.stages_run[result.stages_run.length - 1], DEPTHS),
+        "senpi.validate.target_kind": clamp(result.target.kind, TARGET_KINDS),
+        "senpi.validate.exit_code": String(result.exit_code),
+        "senpi.validate.proof_recorded": String(result.proof_recorded === true),
+    };
+}
+/** One finding: the class and where it sits — never the message, never the location. */
+export function findingAttributes(finding) {
+    return {
+        "senpi.validate.code": clamp(finding.code, KNOWN_CODES),
+        "senpi.validate.severity": clamp(finding.severity, SEVERITIES),
+        "senpi.validate.stage": clamp(finding.stage, STAGES),
+        "senpi.validate.actor": clamp(finding.actor, ACTORS),
+        "senpi.validate.fix_kind": clamp(finding.fix_kind, FIX_KINDS),
+    };
+}
+/** One verification: the outcome alone. Which package it was is nobody's business here. */
+export function verificationAttributes(outcome) {
+    return {
+        "senpi.validate.verify_outcome": clamp(outcome, VERIFY_OUTCOMES),
+    };
+}
+//# sourceMappingURL=telemetry.js.map

package/dist/validate/telemetry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.js","sourceRoot":"","sources":["../../src/validate/telemetry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAKhD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AACvD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AACrD;;;;GAIG;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAS,CAAC,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC;AACxF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AACjD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAC5E,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AACjD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;AAClF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS,kBAAkB,CAAC,CAAC;AACxD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,CAAC,CAAC;AAElG,wEAAwE;AACxE,SAAS,KAAK,CAAC,KAAyB,EAAE,GAAgB;IACxD,OAAO,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;AACjE,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,aAAa,CAAC,MAAsB;IAClD,OAAO;QACL,wBAAwB,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC;QACzD,8BAA8B,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC;QAC9F,4BAA4B,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC;QACrE,0BAA0B,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;QACpD,+BAA+B,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,KAAK,IAAI,CAAC;KACxE,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,iBAAiB,CAAC,OAAgB;IAChD,OAAO;QACL,qBAAqB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC;QACvD,yBAAyB,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC9D,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;QACpD,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;QACpD,yBAAyB,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,sBAAsB,CAAC,OAA4B;IACjE,OAAO;QACL,+BAA+B,EAAE,KAAK,CAAC,OAAO,EAAE,eAAe,CAAC;KACjE,CAAC;AACJ,CAAC"}

package/dist/validate/types.d.ts

@@ -0,0 +1,115 @@
+/**
+ * The `senpi validate` finding model — the shape every check speaks.
+ *
+ * A finding is the unit of feedback. It is consumed by an agent operating in a self-fixing loop,
+ * so it carries four things a bare message does not: WHAT happened, WHY it matters in production,
+ * the FIX to apply, and the raw EVIDENCE behind it. It also carries who can act (`actor`) and what
+ * shape the action takes (`fix_kind`), so a caller can route or filter without parsing prose.
+ *
+ * Field naming is snake_case because a finding is a WIRE shape — it is serialized verbatim into
+ * `--json` output that agents parse. Matches `runtime-api/routes/signals.schema.ts`, which is
+ * snake_case for the same reason. Internal-only types in this module use camelCase as usual.
+ */
+/**
+ * The check depth a finding came from. Also the grouping used to enable coverage assertions
+ * layer-by-layer while the feature is being built: a stage whose checks do not exist yet has no
+ * producing tests, so it is excluded from the coverage set until it lands.
+ *
+ * `invocation` precedes the depths proper — it covers "you pointed at the wrong thing", which is
+ * resolved before any recipe is read.
+ */
+export type ValidationStage = "invocation" | "static" | "import" | "live" | "proof";
+/**
+ * How deep a run goes. Each depth includes the ones before it.
+ *
+ * A subset of {@link ValidationStage}: every depth is a stage a finding can come from, but
+ * `invocation` and `proof` are not depths — the first happens before a depth is chosen, the second
+ * after the run is over.
+ *
+ * The ordering is a dependency, not a preference: a recipe that will not parse cannot produce a
+ * launch configuration, and a module that will not import cannot be executed.
+ */
+export type Depth = "static" | "import" | "live";
+/** Depths in the order they run, so a caller can expand a requested depth to everything it implies. */
+export declare const DEPTH_ORDER: readonly Depth[];
+/** Every depth up to and including `depth`. */
+export declare function depthsUpTo(depth: Depth): Depth[];
+/** Count findings by severity. Defined here so the verdict rule has one place to read from. */
+export declare function severityOfFindings(findings: readonly {
+    severity: Severity;
+}[]): {
+    errors: number;
+    warnings: number;
+};
+/** `error` fails the run; `warning` is reported and only fails under `--strict`. */
+export type Severity = "error" | "warning";
+/**
+ * Who can actually resolve this.
+ *
+ * Load-bearing for loop control, not documentation: an agent that keeps editing `scan.py` to fix
+ * absent credentials will loop until something else stops it. A finding whose actor is not `agent`
+ * forces the loop to stop rather than retry.
+ */
+export type Actor = 
+/** Fixable by changing the strategy package. */
+"agent"
+/** Needs a human decision or a value only the user has. */
+ | "user"
+/** Environment, not the package — credentials, dependencies, disk. */
+ | "ops";
+/**
+ * The shape of the remedy. Lets a caller check that a fix is actually actionable, and lets tests
+ * assert the right *kind* of guidance was produced rather than merely that some string exists.
+ */
+export type FixKind = 
+/** Change a specific file at a specific place. */
+"edit"
+/** Run a specific command. */
+ | "command"
+/** Pick from options enumerated from what is really present. */
+ | "choice"
+/** Read the correct value from an authoritative source. */
+ | "lookup"
+/**
+ * The failure can be located but not authored — a genuine defect in strategy logic. Held to a
+ * weaker bar than the others: name the failing line exactly, do not pretend to know the fix.
+ */
+ | "locate-only";
+/** Where a finding points. All fields optional — an environment fault has no location. */
+export interface FindingLocation {
+    /** Package-relative path, e.g. `scanners/universe.py`. Never absolute. */
+    file?: string;
+    /** 1-indexed. */
+    line?: number;
+    /** Dotted path into the recipe, e.g. `strategy.margin_pct` or `scanners.0.entrypoint`. */
+    yaml_path?: string;
+}
+/**
+ * One reported problem.
+ *
+ * `fix` MUST be computed against the actual state of this package, never rendered from a template.
+ * This is not stylistic: a templated next-step instruction once fired at a strategy it did not
+ * apply to, and following it destroyed a live position. If a fix cannot be computed, the code
+ * belongs to `fix_kind: "locate-only"` and should say where the failure is rather than guess.
+ */
+export interface Finding {
+    code: string;
+    severity: Severity;
+    stage: ValidationStage;
+    actor: Actor;
+    fix_kind: FixKind;
+    where?: FindingLocation;
+    /** The specific thing that happened, at the specific place. */
+    what: string;
+    /** The consequence in production — why this is worth acting on. */
+    why: string;
+    /** The concrete next action, derived from this package's real state. */
+    fix: string;
+    /**
+     * Raw material for whoever is fixing it: the full error chain, captured output, observed data
+     * shapes. Never summarized away. Bounded with an explicit truncation marker when large — see the
+     * evidence-bounding rule; unbounded capture is a memory fault, silent clipping is a lying one.
+     */
+    evidence?: Record<string, unknown>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/validate/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/validate/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,YAAY,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;AAEpF;;;;;;;;;GASG;AACH,MAAM,MAAM,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEjD,uGAAuG;AACvG,eAAO,MAAM,WAAW,EAAE,SAAS,KAAK,EAA0C,CAAC;AAEnF,+CAA+C;AAC/C,wBAAgB,UAAU,CAAC,KAAK,EAAE,KAAK,GAAG,KAAK,EAAE,CAEhD;AAED,+FAA+F;AAC/F,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,SAAS;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,EAAE,GAC1C;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAQtC;AAED,oFAAoF;AACpF,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;AAE3C;;;;;;GAMG;AACH,MAAM,MAAM,KAAK;AACf,gDAAgD;AAC9C,OAAO;AACT,2DAA2D;GACzD,MAAM;AACR,sEAAsE;GACpE,KAAK,CAAC;AAEV;;;GAGG;AACH,MAAM,MAAM,OAAO;AACjB,kDAAkD;AAChD,MAAM;AACR,8BAA8B;GAC5B,SAAS;AACX,gEAAgE;GAC9D,QAAQ;AACV,2DAA2D;GACzD,QAAQ;AACV;;;GAGG;GACD,aAAa,CAAC;AAElB,0FAA0F;AAC1F,MAAM,WAAW,eAAe;IAC9B,0EAA0E;IAC1E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iBAAiB;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0FAA0F;IAC1F,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,eAAe,CAAC;IACvB,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,GAAG,EAAE,MAAM,CAAC;IACZ,wEAAwE;IACxE,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC"}

package/dist/validate/types.js

@@ -0,0 +1,31 @@
+/**
+ * The `senpi validate` finding model — the shape every check speaks.
+ *
+ * A finding is the unit of feedback. It is consumed by an agent operating in a self-fixing loop,
+ * so it carries four things a bare message does not: WHAT happened, WHY it matters in production,
+ * the FIX to apply, and the raw EVIDENCE behind it. It also carries who can act (`actor`) and what
+ * shape the action takes (`fix_kind`), so a caller can route or filter without parsing prose.
+ *
+ * Field naming is snake_case because a finding is a WIRE shape — it is serialized verbatim into
+ * `--json` output that agents parse. Matches `runtime-api/routes/signals.schema.ts`, which is
+ * snake_case for the same reason. Internal-only types in this module use camelCase as usual.
+ */
+/** Depths in the order they run, so a caller can expand a requested depth to everything it implies. */
+export const DEPTH_ORDER = ["static", "import", "live"];
+/** Every depth up to and including `depth`. */
+export function depthsUpTo(depth) {
+    return DEPTH_ORDER.slice(0, DEPTH_ORDER.indexOf(depth) + 1);
+}
+/** Count findings by severity. Defined here so the verdict rule has one place to read from. */
+export function severityOfFindings(findings) {
+    let errors = 0;
+    let warnings = 0;
+    for (const f of findings) {
+        if (f.severity === "error")
+            errors += 1;
+        else
+            warnings += 1;
+    }
+    return { errors, warnings };
+}
+//# sourceMappingURL=types.js.map

package/dist/validate/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/validate/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAwBH,uGAAuG;AACvG,MAAM,CAAC,MAAM,WAAW,GAAqB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAU,CAAC;AAEnF,+CAA+C;AAC/C,MAAM,UAAU,UAAU,CAAC,KAAY;IACrC,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,kBAAkB,CAChC,QAA2C;IAE3C,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO;YAAE,MAAM,IAAI,CAAC,CAAC;;YACnC,QAAQ,IAAI,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC"}

package/dist/validate/wallet.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Which account a live tick runs against.
+ *
+ * Executing a scanner needs an account identity — it is handed to the exchange reads the scanner
+ * makes. But during authoring no account exists yet: the wallet is created when the strategy is
+ * funded, which is deliberately after validation. So one is resolved rather than required.
+ */
+/**
+ * The stand-in used when no real account is available.
+ *
+ * Faithful rather than a workaround: an account with no history returns an empty book, which is
+ * exactly what a freshly funded strategy sees on its first tick. A scanner that breaks on an empty
+ * position list is broken, and would break identically in production — catching that is the point.
+ * The deploy preflight already validates against this same address for the same reason.
+ */
+export declare const PLACEHOLDER_ADDRESS = "0x0000000000000000000000000000000000000000";
+export type WalletSource = 
+/** Named on the command line. */
+"explicit"
+/** The recipe's own wallet, when it resolved to a real address. */
+ | "recipe"
+/** A default configured for this machine. */
+ | "environment"
+/** The stand-in. */
+ | "placeholder";
+export interface ResolvedWallet {
+    address: string;
+    source: WalletSource;
+    /** What the account's state implies about what a passing run establishes. */
+    book: "real" | "empty";
+}
+export interface WalletInputs {
+    /** From `--wallet`. */
+    explicit?: string;
+    /** `strategy.wallet` after environment substitution — often still a placeholder. */
+    fromRecipe?: string;
+    /** A machine-level default. */
+    fromEnvironment?: string;
+}
+/**
+ * Resolve in order of specificity.
+ *
+ * The recipe's own wallet is preferred over any default because validating an edit to a deployed
+ * strategy against its real positions is more faithful than forcing a cold start. It is accepted
+ * only when it *looks* like an address: an unresolved placeholder is a non-empty string that the
+ * schema accepts happily, and passing that to the exchange would produce a confusing failure well
+ * away from its cause.
+ */
+export declare function resolveWallet(inputs: WalletInputs): ResolvedWallet;
+/** Whether a supplied address is well formed. Checked before anything runs. */
+export declare function isWellFormedAddress(value: string): boolean;
+/**
+ * What running against this account does and does not establish.
+ *
+ * Rides the result so a caller cannot report more confidence than the run earned. Against an empty
+ * book, logic that depends on open positions never executes — which is correct for a strategy about
+ * to be funded, and worth saying out loud rather than leaving to inference.
+ */
+export declare function walletClaim(wallet: ResolvedWallet): {
+    proves: string;
+    doesNotProve: string[];
+};
+//# sourceMappingURL=wallet.d.ts.map