@sequenceholdings/pipeline-spec 0.1.0

package/dist/orm-satisfies.js

@@ -0,0 +1,119 @@
+/**
+ * Serving `satisfies:` enforcement against an ORM synced-table contract
+ * (SEQ-2499). Pure — callers (offline `validateSpecGraph`, provision plan)
+ * supply the active contract catalog; this module never fetches ORM state.
+ *
+ * Compatibility posture:
+ * - Projection is the **producer**; ORM contract columns are the **consumer
+ *   requirement** (`checkCompatibility`).
+ * - Extra projection columns are allowed (additive pipeline supersets).
+ * - Primary keys must match exactly (same set + order).
+ * - `content_hash` on `satisfies` must equal the active contract hash.
+ */
+import { z } from 'zod';
+import { checkCompatibility } from './compatibility.js';
+import { columnIdentifierSchema, columnMapSchema, identifierSchema } from './columns.js';
+export const ORM_SATISFIES_FINDING_CODES = [
+    'orm_contract_unavailable',
+    'orm_contract_hash_mismatch',
+    'orm_contract_pk_mismatch',
+    'missing_column',
+    'type_incompatible',
+    'nullability_violation',
+    'domain_violation',
+    'domain_shrunk',
+];
+/** One ORM synced-table contract entry for offline `satisfies` validation. */
+export const ormSyncedContractRequirementSchema = z.strictObject({
+    namespace: z
+        .string()
+        .regex(/^[a-z][a-z0-9_]{0,40}$/, 'must be an ORM namespace (lowercase, ≤41 chars)'),
+    table: identifierSchema,
+    columns: columnMapSchema,
+    primary_key: z.array(columnIdentifierSchema).min(1),
+    content_hash: z
+        .string()
+        .regex(/^[a-f0-9]{64}$/, 'must be a sha256 hex digest (64 hex chars)'),
+});
+/**
+ * Offline ORM contract catalog for `seq-studio pipeline validate --orm-contracts`
+ * or `<pipeline-dir>/orm-contracts.json`. Keys must be `namespace.table`.
+ */
+export const ormContractCatalogSchema = z
+    .record(z.string().min(1), ormSyncedContractRequirementSchema)
+    .superRefine((catalog, ctx) => {
+    for (const [key, value] of Object.entries(catalog)) {
+        const expected = `${value.namespace}.${value.table}`;
+        if (key !== expected) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: [key],
+                message: `catalog key '${key}' must equal '${expected}' (namespace.table)`,
+            });
+        }
+    }
+});
+export function ormContractCatalogKey({ namespace, table, }) {
+    return `${namespace}.${table}`;
+}
+function primaryKeysEqual(left, right) {
+    if (left.length !== right.length)
+        return false;
+    return left.every((value, index) => value === right[index]);
+}
+/**
+ * Does this serving projection satisfy the declared ORM contract binding?
+ * Returns findings (empty = ok). Hash + PK mismatches are always errors;
+ * column findings reuse `checkCompatibility` severities.
+ */
+export function checkServingSatisfiesOrmContract({ projection, satisfies, contract, }) {
+    const target = `${satisfies.namespace}.${satisfies.table}`;
+    if (!contract) {
+        return [
+            {
+                code: 'orm_contract_unavailable',
+                severity: 'error',
+                message: `satisfies references ORM contract '${target}' but no active synced-table contract was provided to validation`,
+            },
+        ];
+    }
+    if (contract.namespace !== satisfies.namespace || contract.table !== satisfies.table) {
+        return [
+            {
+                code: 'orm_contract_unavailable',
+                severity: 'error',
+                message: `satisfies references '${target}' but the supplied contract is '${contract.namespace}.${contract.table}'`,
+            },
+        ];
+    }
+    const findings = [];
+    if (contract.content_hash !== satisfies.content_hash) {
+        findings.push({
+            code: 'orm_contract_hash_mismatch',
+            severity: 'error',
+            message: `satisfies.content_hash does not match the active ORM contract for '${target}' ` +
+                `(declared '${satisfies.content_hash.slice(0, 12)}…', active '${contract.content_hash.slice(0, 12)}…')`,
+        });
+    }
+    if (!primaryKeysEqual(projection.primary_key, contract.primary_key)) {
+        findings.push({
+            code: 'orm_contract_pk_mismatch',
+            severity: 'error',
+            message: `projection.primary_key [${projection.primary_key.join(', ')}] must exactly match ` +
+                `ORM contract primary_key [${contract.primary_key.join(', ')}] for '${target}'`,
+        });
+    }
+    for (const finding of checkCompatibility(projection.columns, contract.columns)) {
+        findings.push(toOrmSatisfiesFinding(finding, target));
+    }
+    return findings;
+}
+function toOrmSatisfiesFinding(finding, target) {
+    return {
+        code: finding.code,
+        severity: finding.severity,
+        column: finding.column,
+        message: `ORM contract '${target}': ${finding.message}`,
+    };
+}
+//# sourceMappingURL=orm-satisfies.js.map

package/dist/orm-satisfies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orm-satisfies.js","sourceRoot":"","sources":["../src/orm-satisfies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,kBAAkB,EAA6B,MAAM,oBAAoB,CAAA;AAClF,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,gBAAgB,EAAkB,MAAM,cAAc,CAAA;AAGxG,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,0BAA0B;IAC1B,4BAA4B;IAC5B,0BAA0B;IAC1B,gBAAgB;IAChB,mBAAmB;IACnB,uBAAuB;IACvB,kBAAkB;IAClB,eAAe;CACP,CAAA;AA2BV,8EAA8E;AAC9E,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/D,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,KAAK,CAAC,wBAAwB,EAAE,iDAAiD,CAAC;IACrF,KAAK,EAAE,gBAAgB;IACvB,OAAO,EAAE,eAAe;IACxB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,KAAK,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;CACzE,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,kCAAkC,CAAC;KAC7D,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC5B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,KAAK,EAAE,CAAA;QACpD,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,OAAO,EAAE,gBAAgB,GAAG,iBAAiB,QAAQ,qBAAqB;aAC3E,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAA;AAEJ,MAAM,UAAU,qBAAqB,CAAC,EACpC,SAAS,EACT,KAAK,GAIN;IACC,OAAO,GAAG,SAAS,IAAI,KAAK,EAAE,CAAA;AAChC,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAuB,EAAE,KAAwB;IACzE,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IAC9C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAA;AAC7D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gCAAgC,CAAC,EAC/C,UAAU,EACV,SAAS,EACT,QAAQ,GAKT;IACC,MAAM,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,KAAK,EAAE,CAAA;IAE1D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL;gBACE,IAAI,EAAE,0BAA0B;gBAChC,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,sCAAsC,MAAM,kEAAkE;aACxH;SACF,CAAA;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,SAAS,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;QACrF,OAAO;YACL;gBACE,IAAI,EAAE,0BAA0B;gBAChC,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,yBAAyB,MAAM,mCAAmC,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,KAAK,GAAG;aACnH;SACF,CAAA;IACH,CAAC;IAED,MAAM,QAAQ,GAA0B,EAAE,CAAA;IAE1C,IAAI,QAAQ,CAAC,YAAY,KAAK,SAAS,CAAC,YAAY,EAAE,CAAC;QACrD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,4BAA4B;YAClC,QAAQ,EAAE,OAAO;YACjB,OAAO,EACL,sEAAsE,MAAM,IAAI;gBAChF,cAAc,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK;SAC1G,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACpE,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,0BAA0B;YAChC,QAAQ,EAAE,OAAO;YACjB,OAAO,EACL,2BAA2B,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB;gBACnF,6BAA6B,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,MAAM,GAAG;SAClF,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,kBAAkB,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/E,QAAQ,CAAC,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;IACvD,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAA6B,EAC7B,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,iBAAiB,MAAM,MAAM,OAAO,CAAC,OAAO,EAAE;KACxD,CAAA;AACH,CAAC"}

package/dist/primitives.d.ts

@@ -0,0 +1,11 @@
+import { z } from 'zod';
+/**
+ * Grammar primitives shared across the envelope, bodies, and operations —
+ * kept dependency-free (constants only) so any schema module can import them
+ * without cycles.
+ */
+export declare const isoDurationSchema: z.ZodString;
+export declare const symbolicRefSchema: z.ZodString;
+/** Repo-relative code path (entrypoints, decoders). Never absolute, never escaping the repo. */
+export declare const repoRelativePathSchema: z.ZodString;
+//# sourceMappingURL=primitives.d.ts.map

package/dist/primitives.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"primitives.d.ts","sourceRoot":"","sources":["../src/primitives.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB;;;;GAIG;AAEH,eAAO,MAAM,iBAAiB,aAEiD,CAAA;AAE/E,eAAO,MAAM,iBAAiB,aAE8E,CAAA;AAE5G,gGAAgG;AAChG,eAAO,MAAM,sBAAsB,aAI0C,CAAA"}

package/dist/primitives.js

@@ -0,0 +1,20 @@
+import { z } from 'zod';
+import { ISO_DURATION_PATTERN, SYMBOLIC_REF_PATTERN } from './constants.js';
+/**
+ * Grammar primitives shared across the envelope, bodies, and operations —
+ * kept dependency-free (constants only) so any schema module can import them
+ * without cycles.
+ */
+export const isoDurationSchema = z
+    .string()
+    .regex(ISO_DURATION_PATTERN, 'must be an ISO-8601 duration (e.g. PT4H, P1D)');
+export const symbolicRefSchema = z
+    .string()
+    .regex(SYMBOLIC_REF_PATTERN, 'must be a symbolic reference slug (a-z, 0-9, -, _) — never a literal value');
+/** Repo-relative code path (entrypoints, decoders). Never absolute, never escaping the repo. */
+export const repoRelativePathSchema = z
+    .string()
+    .min(1)
+    .refine((value) => !value.startsWith('/') && !value.startsWith('.'), 'must be a repo-relative path')
+    .refine((value) => !value.split('/').includes('..'), 'must not contain ..');
+//# sourceMappingURL=primitives.js.map

package/dist/primitives.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"primitives.js","sourceRoot":"","sources":["../src/primitives.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AAE3E;;;;GAIG;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,EAAE;KACR,KAAK,CAAC,oBAAoB,EAAE,+CAA+C,CAAC,CAAA;AAE/E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,EAAE;KACR,KAAK,CAAC,oBAAoB,EAAE,4EAA4E,CAAC,CAAA;AAE5G,gGAAgG;AAChG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,8BAA8B,CAAC;KACnG,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,qBAAqB,CAAC,CAAA"}

package/dist/resolve.d.ts

@@ -0,0 +1,124 @@
+import { z } from 'zod';
+import { type PostgresSnapshotBinding, type SnapshotTransport } from './snapshot-transport.js';
+import { type StageSpec } from './envelope.js';
+/**
+ * The facts a deploy target contributes to resolution. Supplied by the
+ * caller, never discovered by the SDK.
+ *
+ * **One-workspace-per-deployment invariant:** each deploy target binds
+ * exactly one `workspace_id`. The field is schema-optional ONLY so that
+ * resolution can fail with a structured, enumerable error
+ * (`missing_workspace_binding`) instead of a generic parse error — there is
+ * no global-host fallback. (Today's shared first-party workspace is a
+ * transitional N:1 fact; the model assumes the target 1:1 coupling.)
+ */
+export declare const targetFactsSchema: z.ZodObject<{
+    deploy_target: z.ZodString;
+    tenant_id: z.ZodOptional<z.ZodString>;
+    workspace_id: z.ZodOptional<z.ZodString>;
+    catalog: z.ZodString;
+    lakebase_branch: z.ZodOptional<z.ZodString>;
+    postgres_snapshot_bindings: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        bindingId: z.ZodString;
+        database: z.ZodString;
+        bindingHash: z.ZodString;
+        installationId: z.ZodString;
+    }, z.core.$strict>>>;
+    alert_channel_bindings: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    credential_bindings: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, z.core.$strict>;
+export type TargetFacts = z.infer<typeof targetFactsSchema>;
+export type TargetFactsInput = z.input<typeof targetFactsSchema>;
+/** Where the resolved snapshot came from — stamped by the caller (deploy adapter / CI). */
+export interface SpecProvenanceInput {
+    readonly source_repo: string;
+    readonly source_commit: string;
+}
+export interface ResolvedProvenance extends SpecProvenanceInput {
+    readonly spec_hash: string;
+    readonly contract_hash: string;
+}
+/** Identity facts stamped onto every resolved snapshot. */
+export interface ResolvedIdentity {
+    readonly deploy_target: string;
+    readonly tenant_id?: string;
+    readonly workspace_id: string;
+    readonly catalog: string;
+    readonly lakebase_branch?: string;
+}
+/** Concrete bindings for the spec's symbolic references. */
+export interface ResolvedBindings {
+    readonly credentials: Readonly<Record<string, string>>;
+    readonly alert_channels: Readonly<Record<string, string>>;
+}
+export interface ResolvedFeedNames {
+    /**
+     * Volume batch-directory prefix: `/Volumes/src_<source>/bronze/<feed>`
+     * (batches land under `batch_id=<ts>/`). Rooted in the per-source catalog,
+     * NOT the deployment catalog.
+     */
+    readonly volume_path: string;
+    /** Platform-derived append-only bronze table FQN: `src_<source>.bronze.<feed>`. */
+    readonly bronze_table: string;
+}
+export interface ResolvedIngestionNames {
+    readonly kind: 'ingestion';
+    readonly feeds: Readonly<Record<string, ResolvedFeedNames>>;
+}
+export interface ResolvedOutputNames {
+    /**
+     * Physical FQN of the output relation. Defaults to the deploy catalog;
+     * `config.catalog` pins a parallel UC namespace (e.g. `src_banksouth_fis`).
+     */
+    readonly table: string;
+    /** Physical FQN of the quarantine sibling — present iff any column quarantines. */
+    readonly quarantine_table?: string;
+}
+/**
+ * UC catalog a transformation writes. `config.catalog` pins a parallel
+ * source catalog; `identity.catalog` stays the deploy target.
+ */
+export declare function transformationOutputCatalog(spec: Extract<StageSpec, {
+    type: 'transformation';
+}>, deployCatalog: string, deployTarget?: string): string;
+export interface ResolvedTransformationNames {
+    readonly kind: 'transformation';
+    readonly outputs: Readonly<Record<string, ResolvedOutputNames>>;
+}
+export interface ResolvedServingNames {
+    readonly transport?: {
+        readonly kind: 'native_lakebase_sync_v1';
+    } | (PostgresSnapshotBinding & Omit<SnapshotTransport, 'binding'>);
+    readonly kind: 'serving';
+    /** FQN of the UC source relation the sync reads. */
+    readonly source_table: string;
+    /**
+     * The declared public view. The Postgres physical relation is deliberately
+     * ABSENT: physical names are captured at provision time and stored in the
+     * registry, never re-derived (the estate has documented derivation drift).
+     */
+    readonly view: string;
+    /** Optional Lakebase reporting-schema compatibility relation. */
+    readonly reporting_table?: string;
+}
+export type ResolvedNames = ResolvedIngestionNames | ResolvedTransformationNames | ResolvedServingNames;
+/**
+ * The immutable resolved snapshot: the portable spec, the identity it was
+ * resolved against, concrete bindings, derived physical names, and hashed
+ * provenance. Serialize with `canonicalJson` for storage — byte-stable.
+ */
+export interface ResolvedSpec {
+    readonly spec: StageSpec;
+    readonly identity: ResolvedIdentity;
+    readonly bindings: ResolvedBindings;
+    readonly derived: ResolvedNames;
+    readonly provenance: ResolvedProvenance;
+}
+/**
+ * Resolve a portable spec against a deploy target's facts. Pure — binds
+ * symbolic references, derives physical names per the body derivation rules,
+ * stamps identity + hashed provenance. Throws `SpecResolutionError` with an
+ * enumerable code on any unresolvable fact.
+ */
+export declare function resolveSpec(spec: StageSpec, facts: TargetFactsInput, provenance: SpecProvenanceInput): ResolvedSpec;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../src/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAkC,KAAK,uBAAuB,EAAE,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAK9H,OAAO,EAAsB,KAAK,SAAS,EAAE,MAAM,eAAe,CAAA;AA0BlE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;kBAiB5B,CAAA;AAEF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAC3D,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAEhE,2FAA2F;AAC3F,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC/B;AAED,MAAM,WAAW,kBAAmB,SAAQ,mBAAmB;IAC7D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC/B;AAED,2DAA2D;AAC3D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAClC;AAED,4DAA4D;AAC5D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACtD,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CAC1D;AAED,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,mFAAmF;IACnF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAA;CAC5D;AAED,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,mFAAmF;IACnF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CACnC;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,OAAO,CAAC,SAAS,EAAE;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,CAAC,EACpD,aAAa,EAAE,MAAM,EACrB,YAAY,CAAC,EAAE,MAAM,GACpB,MAAM,CAKR;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;IAC/B,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAA;CAChE;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAA;KAAE,GAAG,CAAC,uBAAuB,GAAG,IAAI,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC,CAAA;IAClI,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,oDAAoD;IACpD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,iEAAiE;IACjE,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAClC;AAED,MAAM,MAAM,aAAa,GAAG,sBAAsB,GAAG,2BAA2B,GAAG,oBAAoB,CAAA;AAEvG;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAA;IACnC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAA;IACnC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAA;CACxC;AAuHD;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,SAAS,EACf,KAAK,EAAE,gBAAgB,EACvB,UAAU,EAAE,mBAAmB,GAC9B,YAAY,CAqCd"}

package/dist/resolve.js

@@ -0,0 +1,194 @@
+import { z } from 'zod';
+import { postgresSnapshotBindingsSchema } from './snapshot-transport.js';
+import { resolveCatalogBinding } from './catalog-binding.js';
+import { quarantineAssetName } from './constants.js';
+import { requireResolvedColumns } from './columns.js';
+import { SpecResolutionError } from './errors.js';
+import { deployTargetSchema } from './envelope.js';
+import { feedBronzeTable, feedVolumePath, ingestionSourceIdentity, symbolicRefSchema, } from './bodies/ingestion.js';
+import { computeContractHash, computeSpecHash } from './hash.js';
+import { collectBindingGaps } from './binding-gaps.js';
+import { assertFeedDocumentationResolved } from './documentation.js';
+/**
+ * A portable spec resolved against a deploy target's facts produces the
+ * immutable **resolved snapshot** that deployments record and telemetry
+ * references. `resolveSpec` is pure — no I/O, no discovery: the caller
+ * (deploy adapter / CLI) supplies the facts.
+ */
+const nonEmpty = z.string().min(1);
+/** Numeric Databricks workspace id (`DATABRICKS_ORG_ID`), not the `dbc-…` host prefix. */
+const workspaceIdSchema = nonEmpty.regex(/^\d+$/, 'workspace_id must be the numeric Databricks workspace id (DATABRICKS_ORG_ID)');
+/**
+ * The facts a deploy target contributes to resolution. Supplied by the
+ * caller, never discovered by the SDK.
+ *
+ * **One-workspace-per-deployment invariant:** each deploy target binds
+ * exactly one `workspace_id`. The field is schema-optional ONLY so that
+ * resolution can fail with a structured, enumerable error
+ * (`missing_workspace_binding`) instead of a generic parse error — there is
+ * no global-host fallback. (Today's shared first-party workspace is a
+ * transitional N:1 fact; the model assumes the target 1:1 coupling.)
+ */
+export const targetFactsSchema = z.strictObject({
+    deploy_target: deployTargetSchema,
+    tenant_id: nonEmpty.optional(),
+    workspace_id: workspaceIdSchema.optional(),
+    /** UC catalog physical names are derived into (e.g. `banksouth`, `staging`). */
+    catalog: nonEmpty,
+    lakebase_branch: nonEmpty.optional(),
+    postgres_snapshot_bindings: postgresSnapshotBindingsSchema.optional(),
+    /** Symbolic alert channel → concrete route (Slack channel id, pager key). */
+    alert_channel_bindings: z.record(symbolicRefSchema, nonEmpty).default({}),
+    /**
+     * Databricks source credential family → binding id (secret-manager
+     * reference, never a secret value). Edge-worker Data Sync credential
+     * families stay on the worker binding and are validated by the Data Sync
+     * operation that runs on the registered machine.
+     */
+    credential_bindings: z.record(symbolicRefSchema, nonEmpty).default({}),
+});
+/**
+ * UC catalog a transformation writes. `config.catalog` pins a parallel
+ * source catalog; `identity.catalog` stays the deploy target.
+ */
+export function transformationOutputCatalog(spec, deployCatalog, deployTarget) {
+    return resolveCatalogBinding({
+        binding: spec.config?.catalog,
+        deployTarget,
+    }) ?? deployCatalog;
+}
+function requireCredential(facts, symbolic) {
+    const binding = facts.credential_bindings[symbolic];
+    if (!binding) {
+        throw new SpecResolutionError('missing_credential_binding', `target '${facts.deploy_target}' has no credential binding for symbolic name '${symbolic}'`, symbolic);
+    }
+    return binding;
+}
+function resolveBindings(spec, facts) {
+    const credentials = {};
+    if (spec.type === 'ingestion') {
+        // Edge-worker credentials name the Data Sync environment family used by
+        // the registered machine (for example, fis_ibm -> FIS_IBM). The VM owns
+        // those credentials, so they must not be resolved through the Databricks
+        // managed-secret binding map.
+        //
+        // Keyless/public databricks sources omit `source.credential` — only
+        // resolve when a symbolic family is declared (never invent a sentinel
+        // binding).
+        if (spec.source?.credential) {
+            credentials[spec.source.credential] = requireCredential(facts, spec.source.credential);
+        }
+    }
+    const alertChannels = {};
+    for (const channel of spec.alerts?.channels ?? []) {
+        const route = facts.alert_channel_bindings[channel];
+        if (!route) {
+            throw new SpecResolutionError('missing_alert_channel_binding', `target '${facts.deploy_target}' has no alert channel binding for symbolic name '${channel}'`, channel);
+        }
+        alertChannels[channel] = route;
+    }
+    return { credentials, alert_channels: alertChannels };
+}
+function resolveServingTransport({ transport, facts }) {
+    if (transport.kind === 'native_lakebase_sync_v1')
+        return transport;
+    const binding = facts.postgres_snapshot_bindings?.[transport.binding];
+    if (!binding || binding.database !== transport.database)
+        throw new SpecResolutionError('invalid_target_facts', 'snapshot transport binding missing or mismatched');
+    const { binding: _alias, ...target } = transport;
+    return { ...target, ...binding };
+}
+function deriveNames(spec, facts) {
+    const catalog = facts.catalog;
+    switch (spec.type) {
+        case 'ingestion': {
+            // Ingestion names derive from the spec's OWN source identity into the
+            // per-source catalog (`src_<source>`) — never from the deployment
+            // catalog, which owns silver/gold/report/serving only. Canonical derivations
+            // live beside the body schema so docs, resolver, and tests can't drift.
+            const source = ingestionSourceIdentity(spec);
+            const feeds = Object.fromEntries(Object.keys(spec.feeds).map((feed) => [
+                feed,
+                {
+                    volume_path: feedVolumePath({ source, feed }),
+                    bronze_table: feedBronzeTable({ source, feed }),
+                },
+            ]));
+            return { kind: 'ingestion', feeds };
+        }
+        case 'transformation': {
+            const outputCatalog = transformationOutputCatalog(spec, catalog, facts.deploy_target);
+            const outputs = Object.fromEntries(Object.entries(spec.outputs).map(([asset, output]) => {
+                const table = `${outputCatalog}.${asset}`;
+                // Quarantine rows come from EITHER level (SEQ-2437/SEQ-2439): the
+                // output-level type-violation posture, or any single column's
+                // on_violation — both land in the same platform-derived sibling.
+                const columns = requireResolvedColumns(output.columns, `${spec.stage}: outputs.${asset}.columns`);
+                const quarantines = output.on_type_violation === 'quarantine' ||
+                    Object.values(columns).some((column) => column.on_violation === 'quarantine');
+                return [
+                    asset,
+                    quarantines
+                        ? { table, quarantine_table: `${outputCatalog}.${quarantineAssetName(asset)}` }
+                        : { table },
+                ];
+            }));
+            return { kind: 'transformation', outputs };
+        }
+        case 'serving':
+            return {
+                kind: 'serving',
+                ...(spec.transport ? { transport: resolveServingTransport({ transport: spec.transport, facts }) } : {}),
+                // Optional `source.catalog` binds a parallel producer namespace
+                // (e.g. `src_banksouth_fis`); the synced-table destination still uses
+                // `facts.catalog`.
+                source_table: `${resolveCatalogBinding({
+                    binding: spec.source.catalog,
+                    deployTarget: facts.deploy_target,
+                }) ?? catalog}.${spec.source.output}`,
+                view: spec.expose.view,
+                ...(spec.expose.reporting_table
+                    ? { reporting_table: spec.expose.reporting_table }
+                    : {}),
+            };
+    }
+}
+/**
+ * Resolve a portable spec against a deploy target's facts. Pure — binds
+ * symbolic references, derives physical names per the body derivation rules,
+ * stamps identity + hashed provenance. Throws `SpecResolutionError` with an
+ * enumerable code on any unresolvable fact.
+ */
+export function resolveSpec(spec, facts, provenance) {
+    assertFeedDocumentationResolved(spec);
+    const gaps = collectBindingGaps(spec, facts);
+    const gap = gaps[0];
+    if (gap) {
+        throw new SpecResolutionError(gap.code, gap.message, gap.symbolic);
+    }
+    const target = targetFactsSchema.parse(facts);
+    const workspaceId = target.workspace_id;
+    if (workspaceId === undefined) {
+        throw new SpecResolutionError('missing_workspace_binding', `target '${target.deploy_target}' has no workspace binding — every deploy target must bind exactly one workspace_id (no fallback)`, target.deploy_target);
+    }
+    const identity = {
+        deploy_target: target.deploy_target,
+        workspace_id: workspaceId,
+        catalog: target.catalog,
+        ...(target.tenant_id !== undefined ? { tenant_id: target.tenant_id } : {}),
+        ...(target.lakebase_branch !== undefined ? { lakebase_branch: target.lakebase_branch } : {}),
+    };
+    return {
+        spec,
+        identity,
+        bindings: resolveBindings(spec, target),
+        derived: deriveNames(spec, target),
+        provenance: {
+            source_repo: provenance.source_repo,
+            source_commit: provenance.source_commit,
+            spec_hash: computeSpecHash(spec),
+            contract_hash: computeContractHash(spec),
+        },
+    };
+}
+//# sourceMappingURL=resolve.js.map

package/dist/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../src/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,8BAA8B,EAAwD,MAAM,yBAAyB,CAAA;AAC9H,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAA;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AACjD,OAAO,EAAE,kBAAkB,EAAkB,MAAM,eAAe,CAAA;AAClE,OAAO,EACL,eAAe,EACf,cAAc,EACd,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,EAAE,+BAA+B,EAAE,MAAM,oBAAoB,CAAA;AAEpE;;;;;GAKG;AAEH,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;AAElC,0FAA0F;AAC1F,MAAM,iBAAiB,GAAG,QAAQ,CAAC,KAAK,CACtC,OAAO,EACP,8EAA8E,CAC/E,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9C,aAAa,EAAE,kBAAkB;IACjC,SAAS,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC9B,YAAY,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IAC1C,gFAAgF;IAChF,OAAO,EAAE,QAAQ;IACjB,eAAe,EAAE,QAAQ,CAAC,QAAQ,EAAE;IACpC,0BAA0B,EAAE,8BAA8B,CAAC,QAAQ,EAAE;IACrE,6EAA6E;IAC7E,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACzE;;;;;OAKG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACvE,CAAC,CAAA;AAyDF;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CACzC,IAAoD,EACpD,aAAqB,EACrB,YAAqB;IAErB,OAAO,qBAAqB,CAAC;QAC3B,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO;QAC7B,YAAY;KACb,CAAC,IAAI,aAAa,CAAA;AACrB,CAAC;AAqCD,SAAS,iBAAiB,CAAC,KAAkB,EAAE,QAAgB;IAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAA;IACnD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,mBAAmB,CAC3B,4BAA4B,EAC5B,WAAW,KAAK,CAAC,aAAa,kDAAkD,QAAQ,GAAG,EAC3F,QAAQ,CACT,CAAA;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,IAAe,EAAE,KAAkB;IAC1D,MAAM,WAAW,GAA2B,EAAE,CAAA;IAC9C,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAC9B,wEAAwE;QACxE,wEAAwE;QACxE,yEAAyE;QACzE,8BAA8B;QAC9B,EAAE;QACF,oEAAoE;QACpE,sEAAsE;QACtE,YAAY;QACZ,IAAI,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC;YAC5B,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QACxF,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAA2B,EAAE,CAAA;IAChD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,MAAM,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,KAAK,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAA;QACnD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,mBAAmB,CAC3B,+BAA+B,EAC/B,WAAW,KAAK,CAAC,aAAa,qDAAqD,OAAO,GAAG,EAC7F,OAAO,CACR,CAAA;QACH,CAAC;QACD,aAAa,CAAC,OAAO,CAAC,GAAG,KAAK,CAAA;IAChC,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,CAAA;AACvD,CAAC;AAED,SAAS,uBAAuB,CAAC,EAAE,SAAS,EAAE,KAAK,EAElD;IACC,IAAI,SAAS,CAAC,IAAI,KAAK,yBAAyB;QAAE,OAAO,SAAS,CAAA;IAClE,MAAM,OAAO,GAAG,KAAK,CAAC,0BAA0B,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;IACrE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ;QAAE,MAAM,IAAI,mBAAmB,CAAC,sBAAsB,EAAE,kDAAkD,CAAC,CAAA;IAClK,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,CAAA;IAChD,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,EAAE,CAAA;AAClC,CAAC;AAED,SAAS,WAAW,CAAC,IAAe,EAAE,KAAkB;IACtD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAA;IAC7B,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,sEAAsE;YACtE,kEAAkE;YAClE,6EAA6E;YAC7E,wEAAwE;YACxE,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAA;YAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAC9B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBACpC,IAAI;gBACJ;oBACE,WAAW,EAAE,cAAc,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;oBAC7C,YAAY,EAAE,eAAe,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;iBAChD;aACF,CAAC,CACH,CAAA;YACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAA;QACrC,CAAC;QACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,aAAa,GAAG,2BAA2B,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,CAAA;YACrF,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAChC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE;gBACnD,MAAM,KAAK,GAAG,GAAG,aAAa,IAAI,KAAK,EAAE,CAAA;gBACzC,kEAAkE;gBAClE,8DAA8D;gBAC9D,iEAAiE;gBACjE,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,aAAa,KAAK,UAAU,CAAC,CAAA;gBACjG,MAAM,WAAW,GACf,MAAM,CAAC,iBAAiB,KAAK,YAAY;oBACzC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,KAAK,YAAY,CAAC,CAAA;gBAC/E,OAAO;oBACL,KAAK;oBACL,WAAW;wBACT,CAAC,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAG,aAAa,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,EAAE;wBAC/E,CAAC,CAAC,EAAE,KAAK,EAAE;iBACd,CAAA;YACH,CAAC,CAAC,CACH,CAAA;YACD,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAA;QAC5C,CAAC;QACD,KAAK,SAAS;YACZ,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,uBAAuB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvG,gEAAgE;gBAChE,sEAAsE;gBACtE,mBAAmB;gBACnB,YAAY,EAAE,GACZ,qBAAqB,CAAC;oBACpB,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;oBAC5B,YAAY,EAAE,KAAK,CAAC,aAAa;iBAClC,CAAC,IAAI,OACR,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;gBACxB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;gBACtB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe;oBAC7B,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE;oBAClD,CAAC,CAAC,EAAE,CAAC;aACR,CAAA;IACL,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CACzB,IAAe,EACf,KAAuB,EACvB,UAA+B;IAE/B,+BAA+B,CAAC,IAAI,CAAC,CAAA;IACrC,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IACnB,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;IACpE,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC7C,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAA;IACvC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,mBAAmB,CAC3B,2BAA2B,EAC3B,WAAW,MAAM,CAAC,aAAa,mGAAmG,EAClI,MAAM,CAAC,aAAa,CACrB,CAAA;IACH,CAAC;IAED,MAAM,QAAQ,GAAqB;QACjC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,YAAY,EAAE,WAAW;QACzB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,MAAM,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7F,CAAA;IAED,OAAO;QACL,IAAI;QACJ,QAAQ;QACR,QAAQ,EAAE,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC;QACvC,OAAO,EAAE,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC;QAClC,UAAU,EAAE;YACV,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,SAAS,EAAE,eAAe,CAAC,IAAI,CAAC;YAChC,aAAa,EAAE,mBAAmB,CAAC,IAAI,CAAC;SACzC;KACF,CAAA;AACH,CAAC"}

package/dist/secret-scan.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Specs carry symbolic references only — credential families, alert channels,
+ * integrations. This scan walks every string leaf of a parsed spec and rejects
+ * anything that looks like a literal secret, credential, connection string, or
+ * webhook URL, so a copy-pasted token can never ride into the registry.
+ *
+ * It is a tripwire, not a scanner-of-record: the tight identifier grammars on
+ * symbolic fields do most of the work; this catches the free-text fields
+ * (descriptions, extraction params, runbook) where a literal could hide.
+ */
+export interface CredentialFinding {
+    /** Dotted path to the offending string leaf (e.g. `feeds.games.extraction.conn`) — display only. */
+    readonly path: string;
+    /**
+     * Exact path segments to the leaf. Use THESE for Zod issue paths — keys may
+     * themselves contain dots (`outputs['gold.players']`), so splitting the
+     * dotted string would point at the wrong location.
+     */
+    readonly segments: readonly string[];
+    readonly reason: string;
+}
+/**
+ * Reason the string looks like a credential/webhook literal, or null when it
+ * is clean. `urlAllowed` permits a plain https URL (for `runbook`) while still
+ * rejecting webhook hosts and embedded credentials.
+ */
+export declare function credentialLikeReason(value: string, urlAllowed?: boolean): string | null;
+/**
+ * Walk every string leaf of a parsed spec (post-YAML object tree) and collect
+ * credential-looking values. Object keys are grammar-constrained by the
+ * schemas, so only values are scanned.
+ */
+export declare function scanForCredentialLikeStrings(root: unknown): CredentialFinding[];
+//# sourceMappingURL=secret-scan.d.ts.map

package/dist/secret-scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-scan.d.ts","sourceRoot":"","sources":["../src/secret-scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,WAAW,iBAAiB;IAChC,oGAAoG;IACpG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AA6BD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,UAAQ,GAAG,MAAM,GAAG,IAAI,CAyBrF;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,OAAO,GAAG,iBAAiB,EAAE,CAI/E"}

package/dist/secret-scan.js

@@ -0,0 +1,98 @@
+/**
+ * Specs carry symbolic references only — credential families, alert channels,
+ * integrations. This scan walks every string leaf of a parsed spec and rejects
+ * anything that looks like a literal secret, credential, connection string, or
+ * webhook URL, so a copy-pasted token can never ride into the registry.
+ *
+ * It is a tripwire, not a scanner-of-record: the tight identifier grammars on
+ * symbolic fields do most of the work; this catches the free-text fields
+ * (descriptions, extraction params, runbook) where a literal could hide.
+ */
+/** Fields that legitimately hold an https URL (still scanned for webhook/credential shapes). */
+const URL_ALLOWED_PATHS = new Set(['runbook']);
+const WEBHOOK_HOST_PATTERN = /hooks\.slack\.com|webhook\.site|discord(?:app)?\.com\/api\/webhooks|outlook\.office\.com\/webhook/i;
+/** Scan backward from delimiters so long descriptions cannot cause regex backtracking. */
+function containsUrlScheme(value) {
+    for (let delimiter = value.indexOf('://'); delimiter !== -1; delimiter = value.indexOf('://', delimiter + 3)) {
+        for (let cursor = delimiter - 1; cursor >= 0; cursor--) {
+            const character = value.charAt(cursor);
+            if (/[a-z]/i.test(character))
+                return true;
+            if (!/[0-9+.-]/.test(character))
+                break;
+        }
+    }
+    return false;
+}
+const CONNECTION_STRING_PATTERN = /^(?:jdbc|odbc):|(?:^|;)\s*(?:PWD|UID|DSN|DRIVER)\s*=/i;
+const KEY_VALUE_SECRET_PATTERN = /(?:password|passwd|pwd|secret|api[_-]?key|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token)\s*[=:]\s*\S+/i;
+/** Well-known token prefixes (Slack, GitHub, OpenAI/Anthropic-style, AWS) and PEM blocks. */
+const TOKEN_PREFIX_PATTERN = /\b(?:xox[a-z]-[A-Za-z0-9-]+|ghp_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|sk-[A-Za-z0-9_-]{16,}|AKIA[0-9A-Z]{16})\b|-----BEGIN [A-Z ]*PRIVATE KEY-----/;
+/** Three dot-separated base64url segments of meaningful length — a JWT. */
+const JWT_PATTERN = /\bey[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{5,}\b/;
+/**
+ * Reason the string looks like a credential/webhook literal, or null when it
+ * is clean. `urlAllowed` permits a plain https URL (for `runbook`) while still
+ * rejecting webhook hosts and embedded credentials.
+ */
+export function credentialLikeReason(value, urlAllowed = false) {
+    if (WEBHOOK_HOST_PATTERN.test(value))
+        return 'looks like a webhook URL — use a symbolic alert channel reference';
+    if (CONNECTION_STRING_PATTERN.test(value))
+        return 'looks like a connection string — use a symbolic credential reference';
+    if (KEY_VALUE_SECRET_PATTERN.test(value))
+        return 'looks like an embedded credential — use a symbolic credential reference';
+    if (TOKEN_PREFIX_PATTERN.test(value))
+        return 'looks like a literal secret token — use a symbolic credential reference';
+    if (JWT_PATTERN.test(value))
+        return 'looks like a literal JWT — use a symbolic credential reference';
+    if (containsUrlScheme(value)) {
+        if (urlAllowed && value.startsWith('https://')) {
+            // An allowed URL must not smuggle credentials in its userinfo
+            // (https://user:password@host/…) — parse and reject, don't trust shape.
+            try {
+                const url = new URL(value);
+                if (url.username !== '' || url.password !== '') {
+                    return 'URL carries userinfo credentials — use a symbolic credential reference';
+                }
+                return null;
+            }
+            catch {
+                return 'must be a valid https:// URL';
+            }
+        }
+        return urlAllowed
+            ? 'must be an https:// URL'
+            : 'URLs and connection strings are not allowed here — use a symbolic reference';
+    }
+    return null;
+}
+/**
+ * Walk every string leaf of a parsed spec (post-YAML object tree) and collect
+ * credential-looking values. Object keys are grammar-constrained by the
+ * schemas, so only values are scanned.
+ */
+export function scanForCredentialLikeStrings(root) {
+    const findings = [];
+    walk(root, [], findings);
+    return findings;
+}
+function walk(value, path, findings) {
+    if (typeof value === 'string') {
+        const urlAllowed = URL_ALLOWED_PATHS.has(path.join('.'));
+        const reason = credentialLikeReason(value, urlAllowed);
+        if (reason)
+            findings.push({ path: path.join('.'), segments: path, reason });
+        return;
+    }
+    if (Array.isArray(value)) {
+        value.forEach((entry, index) => walk(entry, [...path, String(index)], findings));
+        return;
+    }
+    if (value !== null && typeof value === 'object') {
+        for (const [key, entry] of Object.entries(value)) {
+            walk(entry, [...path, key], findings);
+        }
+    }
+}
+//# sourceMappingURL=secret-scan.js.map

package/dist/secret-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-scan.js","sourceRoot":"","sources":["../src/secret-scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAcH,gGAAgG;AAChG,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;AAEnE,MAAM,oBAAoB,GAAG,oGAAoG,CAAA;AAEjI,0FAA0F;AAC1F,SAAS,iBAAiB,CAAC,KAAa;IACtC,KAAK,IAAI,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,SAAS,KAAK,CAAC,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC;QAC7G,KAAK,IAAI,MAAM,GAAG,SAAS,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC;YACvD,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YACtC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;gBAAE,OAAO,IAAI,CAAA;YACzC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;gBAAE,MAAK;QACxC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,yBAAyB,GAAG,uDAAuD,CAAA;AAEzF,MAAM,wBAAwB,GAAG,0HAA0H,CAAA;AAE3J,6FAA6F;AAC7F,MAAM,oBAAoB,GAAG,4JAA4J,CAAA;AAEzL,2EAA2E;AAC3E,MAAM,WAAW,GAAG,iEAAiE,CAAA;AAErF;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa,EAAE,UAAU,GAAG,KAAK;IACpE,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,mEAAmE,CAAA;IAChH,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,sEAAsE,CAAA;IACxH,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,yEAAyE,CAAA;IAC1H,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,yEAAyE,CAAA;IACtH,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,gEAAgE,CAAA;IACpG,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,IAAI,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/C,8DAA8D;YAC9D,wEAAwE;YACxE,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;gBAC1B,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;oBAC/C,OAAO,wEAAwE,CAAA;gBACjF,CAAC;gBACD,OAAO,IAAI,CAAA;YACb,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,8BAA8B,CAAA;YACvC,CAAC;QACH,CAAC;QACD,OAAO,UAAU;YACf,CAAC,CAAC,yBAAyB;YAC3B,CAAC,CAAC,6EAA6E,CAAA;IACnF,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAa;IACxD,MAAM,QAAQ,GAAwB,EAAE,CAAA;IACxC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAA;IACxB,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAS,IAAI,CAAC,KAAc,EAAE,IAAuB,EAAE,QAA6B;IAClF,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;QACxD,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;QACtD,IAAI,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;QAC3E,OAAM;IACR,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAA;QAChF,OAAM;IACR,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAA;QACvC,CAAC;IACH,CAAC;AACH,CAAC"}