@telora/daemon 0.22.245 → 0.22.289

package/dist/verify/verification-config.d.ts

@@ -1,222 +0,0 @@
-/**
- * Resolve the default-on deterministic verification config.
- *
- * The deterministic verification method used to be opt-in (a delivery only ran
- * a check when it carried an explicit verification_method). This module makes
- * it the DEFAULT for every delivery entering verify, using a config-default
- * command run daemon-side at the coding->verify edge.
- *
- * Resolution precedence (env > operator file > repo manifest > typed default),
- * mirroring how resolveTelemetryConfig / resolveLacunaConfig work in the daemon:
- *   - command:      TELORA_DEFAULT_VERIFY_COMMAND    > config.defaultVerification.command    > telora.verify.json > '' (disabled)
- *   - timeoutMs:    TELORA_DEFAULT_VERIFY_TIMEOUT_MS > config.defaultVerification.timeoutMs   > telora.verify.json > 30 min
- *   - maxConcurrent:TELORA_DEFAULT_VERIFY_MAX_CONCURRENT > config.defaultVerification.maxConcurrent > telora.verify.json > 1
- *
- * The repo-manifest layer (`telora.verify.json`, see verification-manifest.ts)
- * is what lets a REPO declare its own gate: the two layers above it are both
- * per-workstation and untracked (`.gitignore:72` ignores `.telora/` wholesale;
- * cli/verify-setup.ts:218 writes to ~/.telora/daemon.json), so without it no PR
- * could arm the gate and a fresh clone was ungated by construction.
- *
- * WHERE the manifest layer is read. The verification tick resolves once per
- * product against `repoPath` -- the operator's checkout -- and that resolution
- * owns the posture and the daemon-wide concurrency cap, and arms the default-on
- * gate for every delivery when it resolves a command. When it resolves none, a
- * delivery is still armed by the manifest its own judged commit ships
- * (verify/verification-default-on.ts), unless the operator declined. The
- * command + timeout a run APPLIES are re-resolved at
- * dispatch against the code under verification, the detached checkout of the
- * focus HEAD (resolveAppliedVerificationConfig, called from
- * verify/verification-checkout.ts). Taking them from repoPath made a command or
- * timeout committed on the verified branch inert until it reached the operator's
- * checkout: full-suite runs were killed at a stale repoPath timeout while the
- * branch declared a longer one. The repoPath manifest stays a RECORDED fallback
- * for verified code that ships none; a malformed manifest in the verified code
- * never falls back.
- *
- * The seam stays OPT-IN: a repo shipping no manifest still resolves to ''
- * (disabled). No default command is ever hard-coded here -- the daemon manages
- * products that have no whole-repo verification command at all.
- *
- * The env knobs are read directly from `process.env` here rather than through
- * daemon-core's env-config Zod index: daemon-core is a registry-installed
- * dependency (not a workspace symlink), so an env-config edit there would not
- * take effect at runtime for this daemon. Reading process.env directly is the
- * same pattern buildEngineRuntimeConfig uses for telemetry/lacuna.
- *
- * @module verification-config
- */
-import type { DaemonConfig, DefaultVerificationConfig } from '../types/index.js';
-import { type VerifyManifestReader } from './verification-manifest.js';
-import type { StrategyResult } from './verification-deterministic.js';
-/** Default timeout for the default-on deterministic run: 30 min (full build+test sweep). */
-export declare const DEFAULT_VERIFY_TIMEOUT_MS: number;
-/** Default max concurrent daemon-side verification runs. */
-export declare const DEFAULT_VERIFY_MAX_CONCURRENT = 1;
-/** Env var names for the default-on verification knobs. */
-export declare const VERIFY_ENV: {
-    readonly COMMAND: "TELORA_DEFAULT_VERIFY_COMMAND";
-    readonly TIMEOUT_MS: "TELORA_DEFAULT_VERIFY_TIMEOUT_MS";
-    readonly MAX_CONCURRENT: "TELORA_DEFAULT_VERIFY_MAX_CONCURRENT";
-};
-/**
- * The layer a resolved verify value was read from.
- *
- * Why it is carried at all: a verify run killed by its timeout used to name
- * neither the value applied nor where it came from, so a reader could not tell a
- * stale operator override from a manifest committed on the branch from the typed
- * default -- and each of those is fixed in a different place. `manifest_fallback`
- * is the recorded case where the verified commit shipped no manifest and the
- * product repoPath manifest was applied instead; `delivery` is an explicit-method
- * row's own config, which no resolver layer produced.
- */
-export type VerifyConfigSource = {
-    layer: 'env';
-    envVar: string;
-} | {
-    layer: 'daemon.json';
-} | {
-    layer: 'manifest';
-    path: string;
-} | {
-    layer: 'manifest_fallback';
-    path: string;
-    verifiedPath: string;
-} | {
-    layer: 'default';
-} | {
-    layer: 'delivery';
-};
-/**
- * A source as one human-readable label, the form every surface prints (gate
- * state, escalations, `telora-daemon status`), so the same layer reads the same
- * everywhere. A manifest names its absolute path, which also answers WHICH
- * checkout's manifest applied. The `default` label names the typed timeout
- * default: a defaulted command is '' (verification disabled), never printed.
- */
-export declare function formatVerifyConfigSource(src: VerifyConfigSource): string;
-/**
- * Fully-resolved default-on verification settings. `enabled` is a convenience
- * flag: true iff a non-empty command is configured (the default-on path only
- * runs for deliveries with no explicit method WHEN enabled).
- */
-export interface ResolvedDefaultVerification {
-    command: string;
-    timeoutMs: number;
-    maxConcurrent: number;
-    enabled: boolean;
-    /** Which layer supplied the command and the timeout (see VerifyConfigSource). */
-    sources: {
-        command: VerifyConfigSource;
-        timeoutMs: VerifyConfigSource;
-    };
-}
-/**
- * The config slice these resolvers need: the (already per-product-selected)
- * verification block, plus the product's repo root so the repo-manifest layer
- * can be read.
- *
- * `repoPath` is OPTIONAL rather than picked from DaemonConfig (where it is
- * required) so that callers holding only a scoped `{ defaultVerification }`
- * still typecheck; a missing repoPath simply means "no repo manifest layer".
- * A product-scoped config always carries it -- `configForProduct`
- * (config.ts:351) sets `repoPath` per product -- so the real daemon paths get
- * the manifest layer for free.
- */
-export type VerificationConfigScope = Pick<DaemonConfig, 'defaultVerification'> & {
-    /** Product repo root; the manifest is read from `<repoPath>/telora.verify.json`. */
-    repoPath?: string;
-};
-/**
- * Resolve the default-on verification config from
- * env > operator file > repo manifest > typed default.
- *
- * Pure w.r.t. its inputs: env is injectable, and the repo-manifest read is
- * injected via `readManifest` rather than touching fs inside this resolver, so
- * the whole precedence chain is assertable without a real repo.
- *
- * Env values are parsed by daemon-core's loadEnvConfig, so an invalid numeric
- * value fails loudly at daemon startup (naming the var) instead of silently
- * degrading mid-tick. A malformed repo manifest fails the same way (naming the
- * file) -- see verification-manifest.ts for why that is never degraded to
- * "disabled".
- *
- * The manifest is read whenever a repoPath is present, regardless of which
- * layer ultimately wins, so a broken repo declaration surfaces even on a
- * workstation whose env/operator file happens to override it.
- *
- * One asymmetry worth naming: an operator's explicit `declined: true` marker
- * SUPPRESSES the repo-manifest command. The marker is a recorded operator
- * decision to gate on AI review only, and the operator file outranks the repo
- * manifest -- so a repo declaring a command cannot silently overturn it. Env
- * still wins over both (an explicit env command beats a stale decline marker,
- * unchanged).
- */
-export declare function resolveDefaultVerification(config: VerificationConfigScope, env?: NodeJS.ProcessEnv, readManifest?: VerifyManifestReader): ResolvedDefaultVerification;
-/** What a deterministic run applied, and where it was read (StrategyResult.appliedConfig). */
-export type AppliedVerificationConfig = NonNullable<StrategyResult['appliedConfig']>;
-/**
- * Resolve the command + timeout a deterministic run APPLIES, from the code it
- * runs in: env > operator block > the manifest at `runPath` > the manifest at
- * `source.repoPath` (recorded fallback) > typed default.
- *
- * The fallback is taken ONLY when the code at `runPath` ships no manifest, and
- * it is recorded on the result (`manifestFallback`; `manifestPath` names the
- * repoPath manifest, `verifiedManifestPath` where the verified code was read), so
- * a value from another checkout is never applied silently. A MALFORMED manifest
- * at `runPath` throws (readVerifyManifest names the file) and never falls back:
- * the branch declared something unreadable, and substituting the operator
- * checkout's value is exactly the silent swap this resolution removes.
- */
-export declare function resolveAppliedVerificationConfig(source: VerificationConfigScope, runPath: string, env?: NodeJS.ProcessEnv, readManifest?: VerifyManifestReader): AppliedVerificationConfig;
-/**
- * Declarative verification posture, derived at read time from config (never a
- * filed event, so it cannot spam and self-clears once configured):
- *  - `configured`   -- a non-empty verification command resolves (env, operator
- *                      file, or the repo's committed `telora.verify.json`).
- *  - `declined`     -- no command resolves AND an explicit review-only decline
- *                      marker is recorded. Deliveries gate on AI review only,
- *                      by deliberate decision (not a gap).
- *  - `unconfigured` -- no command resolves and no decline recorded. Deliveries
- *                      gate on AI review only because setup is incomplete.
- */
-export type VerificationPosture = 'configured' | 'declined' | 'unconfigured';
-/**
- * Derive the verification posture for one (product-scoped) config.
- *
- * Pure w.r.t. its inputs (env is injectable for tests) and free of any
- * escalation/side-effect path -- posture is declarative state, surfaced on
- * ambient read surfaces, never a filed escalation. Callers pass a product-scoped
- * config (from `configForProduct`) so `config.defaultVerification` is already the
- * selected per-product-or-global block and `repoPath` points at that product's
- * repo -- which is what lets a repo-manifest-only command read `configured`.
- *
- * An explicitly resolved command wins over the decline marker: an operator who
- * sets a command (via env or file) has configured verification regardless of a
- * stale `declined` flag. The marker still suppresses the repo manifest (the
- * operator file outranks it), so `declined: true` keeps reading `declined`.
- */
-export declare function deriveVerificationPosture(config: VerificationConfigScope, env?: NodeJS.ProcessEnv, readManifest?: VerifyManifestReader): VerificationPosture;
-/** Structured posture for one product, published for app consumption. */
-export interface ProductVerificationPosture {
-    posture: VerificationPosture;
-    /** The resolved command; empty string unless posture is `configured`. */
-    command: string;
-    /** The resolved timeout (ms) for the command; meaningful when `configured`. */
-    timeoutMs: number;
-    /** Where that timeout was read (formatVerifyConfigSource label), resolved against the product repoPath. */
-    timeoutSource?: string;
-}
-/**
- * Build a `{ [productId]: { posture, command } }` map across products, applying
- * the per-product-override-else-global fallback (mirrors configForProduct) and
- * the global env command. Pure; the structured counterpart of
- * formatVerificationPostureLines, used to PUBLISH posture (e.g. in the daemon
- * heartbeat metadata) for the web app to read. Never files an escalation.
- */
-export declare function buildProductPostureMap(products: ReadonlyArray<{
-    id: string;
-    repoPath?: string;
-    defaultVerification?: DefaultVerificationConfig;
-}>, globalBlock: DefaultVerificationConfig | undefined, env?: NodeJS.ProcessEnv, readManifest?: VerifyManifestReader): Record<string, ProductVerificationPosture>;
-//# sourceMappingURL=verification-config.d.ts.map

package/dist/verify/verification-config.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"verification-config.d.ts","sourceRoot":"","sources":["../../src/verify/verification-config.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAEjF,OAAO,EAIL,KAAK,oBAAoB,EAC1B,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEtE,4FAA4F;AAC5F,eAAO,MAAM,yBAAyB,QAAiB,CAAC;AAExD,4DAA4D;AAC5D,eAAO,MAAM,6BAA6B,IAAI,CAAC;AAE/C,2DAA2D;AAC3D,eAAO,MAAM,UAAU;;;;CAIb,CAAC;AAEX;;;;;;;;;;GAUG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,KAAK,EAAE,aAAa,CAAA;CAAE,GACxB;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,KAAK,EAAE,mBAAmB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAClE;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,GACpB;IAAE,KAAK,EAAE,UAAU,CAAA;CAAE,CAAC;AAE1B;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,kBAAkB,GAAG,MAAM,CAexE;AAED;;;;GAIG;AACH,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;IACjB,iFAAiF;IACjF,OAAO,EAAE;QAAE,OAAO,EAAE,kBAAkB,CAAC;QAAC,SAAS,EAAE,kBAAkB,CAAA;KAAE,CAAC;CACzE;AAmBD;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,uBAAuB,GAAG,IAAI,CAAC,YAAY,EAAE,qBAAqB,CAAC,GAAG;IAChF,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,uBAAuB,EAC/B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,YAAY,GAAE,oBAAyC,GACtD,2BAA2B,CAyC7B;AAED,8FAA8F;AAC9F,MAAM,MAAM,yBAAyB,GAAG,WAAW,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC,CAAC;AAErF;;;;;;;;;;;;GAYG;AACH,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,uBAAuB,EAC/B,OAAO,EAAE,MAAM,EACf,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,YAAY,GAAE,oBAAyC,GACtD,yBAAyB,CAqC3B;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,mBAAmB,GAAG,YAAY,GAAG,UAAU,GAAG,cAAc,CAAC;AAE7E;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,uBAAuB,EAC/B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,YAAY,GAAE,oBAAyC,GACtD,mBAAmB,CAKrB;AAED,yEAAyE;AACzE,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,mBAAmB,CAAC;IAC7B,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,SAAS,EAAE,MAAM,CAAC;IAClB,2GAA2G;IAC3G,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,aAAa,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,mBAAmB,CAAC,EAAE,yBAAyB,CAAA;CAAE,CAAC,EAC3G,WAAW,EAAE,yBAAyB,GAAG,SAAS,EAClD,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,YAAY,GAAE,oBAAyC,GACtD,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAkB5C"}

package/dist/verify/verification-config.js

@@ -1,205 +0,0 @@
-// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
-// Pinned by: 21 tests -- run: npm run gen:pinned-by -- --list packages/daemon/src/verify/verification-config.ts
-// PINNED-BY-END
-import { loadEnvConfig } from '@telora/daemon-core';
-import { readVerifyManifest, resolveVerifyManifestPath, VERIFY_MANIFEST_FILENAME, } from './verification-manifest.js';
-/** Default timeout for the default-on deterministic run: 30 min (full build+test sweep). */
-export const DEFAULT_VERIFY_TIMEOUT_MS = 30 * 60 * 1000;
-/** Default max concurrent daemon-side verification runs. */
-export const DEFAULT_VERIFY_MAX_CONCURRENT = 1;
-/** Env var names for the default-on verification knobs. */
-export const VERIFY_ENV = {
-    COMMAND: 'TELORA_DEFAULT_VERIFY_COMMAND',
-    TIMEOUT_MS: 'TELORA_DEFAULT_VERIFY_TIMEOUT_MS',
-    MAX_CONCURRENT: 'TELORA_DEFAULT_VERIFY_MAX_CONCURRENT',
-};
-/**
- * A source as one human-readable label, the form every surface prints (gate
- * state, escalations, `telora-daemon status`), so the same layer reads the same
- * everywhere. A manifest names its absolute path, which also answers WHICH
- * checkout's manifest applied. The `default` label names the typed timeout
- * default: a defaulted command is '' (verification disabled), never printed.
- */
-export function formatVerifyConfigSource(src) {
-    switch (src.layer) {
-        case 'env':
-            return `env ${src.envVar}`;
-        case 'daemon.json':
-            return 'daemon.json defaultVerification';
-        case 'manifest':
-            return src.path;
-        case 'manifest_fallback':
-            return `${src.path} (fallback: the verified commit ships no telora.verify.json)`;
-        case 'default':
-            return `default (${DEFAULT_VERIFY_TIMEOUT_MS}ms)`;
-        case 'delivery':
-            return 'delivery verification config';
-    }
-}
-/** The first layer that supplies a value, else the fallback -- precedence and provenance in one read. */
-function pickLayer(layers, fallback) {
-    for (const layer of layers) {
-        if (layer.value !== undefined)
-            return { value: layer.value, source: layer.source };
-    }
-    return fallback;
-}
-/**
- * Resolve the default-on verification config from
- * env > operator file > repo manifest > typed default.
- *
- * Pure w.r.t. its inputs: env is injectable, and the repo-manifest read is
- * injected via `readManifest` rather than touching fs inside this resolver, so
- * the whole precedence chain is assertable without a real repo.
- *
- * Env values are parsed by daemon-core's loadEnvConfig, so an invalid numeric
- * value fails loudly at daemon startup (naming the var) instead of silently
- * degrading mid-tick. A malformed repo manifest fails the same way (naming the
- * file) -- see verification-manifest.ts for why that is never degraded to
- * "disabled".
- *
- * The manifest is read whenever a repoPath is present, regardless of which
- * layer ultimately wins, so a broken repo declaration surfaces even on a
- * workstation whose env/operator file happens to override it.
- *
- * One asymmetry worth naming: an operator's explicit `declined: true` marker
- * SUPPRESSES the repo-manifest command. The marker is a recorded operator
- * decision to gate on AI review only, and the operator file outranks the repo
- * manifest -- so a repo declaring a command cannot silently overturn it. Env
- * still wins over both (an explicit env command beats a stale decline marker,
- * unchanged).
- */
-export function resolveDefaultVerification(config, env = process.env, readManifest = readVerifyManifest) {
-    const file = config.defaultVerification;
-    const envCfg = loadEnvConfig(env);
-    const manifest = readManifest(config.repoPath);
-    const envCommand = envCfg.TELORA_DEFAULT_VERIFY_COMMAND;
-    const fileCommand = typeof file?.command === 'string' && file.command.trim() !== ''
-        ? file.command
-        : undefined;
-    // An explicit operator decline outranks the repo manifest (see docstring).
-    const manifestCommand = file?.declined === true ? undefined : manifest?.command;
-    const daemonJson = { layer: 'daemon.json' };
-    const manifestSource = {
-        layer: 'manifest',
-        path: config.repoPath !== undefined ? resolveVerifyManifestPath(config.repoPath) : VERIFY_MANIFEST_FILENAME,
-    };
-    const command = pickLayer([
-        { value: envCommand !== undefined && envCommand.trim() !== '' ? envCommand : undefined, source: { layer: 'env', envVar: VERIFY_ENV.COMMAND } },
-        { value: fileCommand, source: daemonJson },
-        { value: manifestCommand, source: manifestSource },
-    ], { value: '', source: { layer: 'default' } });
-    const timeoutMs = pickLayer([
-        { value: envCfg.TELORA_DEFAULT_VERIFY_TIMEOUT_MS, source: { layer: 'env', envVar: VERIFY_ENV.TIMEOUT_MS } },
-        { value: typeof file?.timeoutMs === 'number' && file.timeoutMs > 0 ? file.timeoutMs : undefined, source: daemonJson },
-        { value: manifest?.timeoutMs, source: manifestSource },
-    ], { value: DEFAULT_VERIFY_TIMEOUT_MS, source: { layer: 'default' } });
-    const maxConcurrent = envCfg.TELORA_DEFAULT_VERIFY_MAX_CONCURRENT
-        ?? (typeof file?.maxConcurrent === 'number' && file.maxConcurrent > 0 ? file.maxConcurrent : undefined)
-        ?? manifest?.maxConcurrent
-        ?? DEFAULT_VERIFY_MAX_CONCURRENT;
-    return {
-        command: command.value,
-        timeoutMs: timeoutMs.value,
-        maxConcurrent,
-        enabled: command.value.trim().length > 0,
-        sources: { command: command.source, timeoutMs: timeoutMs.source },
-    };
-}
-/**
- * Resolve the command + timeout a deterministic run APPLIES, from the code it
- * runs in: env > operator block > the manifest at `runPath` > the manifest at
- * `source.repoPath` (recorded fallback) > typed default.
- *
- * The fallback is taken ONLY when the code at `runPath` ships no manifest, and
- * it is recorded on the result (`manifestFallback`; `manifestPath` names the
- * repoPath manifest, `verifiedManifestPath` where the verified code was read), so
- * a value from another checkout is never applied silently. A MALFORMED manifest
- * at `runPath` throws (readVerifyManifest names the file) and never falls back:
- * the branch declared something unreadable, and substituting the operator
- * checkout's value is exactly the silent swap this resolution removes.
- */
-export function resolveAppliedVerificationConfig(source, runPath, env = process.env, readManifest = readVerifyManifest) {
-    const verifiedManifestPath = resolveVerifyManifestPath(runPath);
-    const read = { fallback: false };
-    const readVerifiedThenFallback = (path) => {
-        const own = readManifest(path);
-        if (own !== undefined) {
-            read.manifestPath = verifiedManifestPath;
-            return own;
-        }
-        if (!source.repoPath || resolveVerifyManifestPath(source.repoPath) === verifiedManifestPath)
-            return undefined;
-        const fallback = readManifest(source.repoPath);
-        if (fallback !== undefined) {
-            read.manifestPath = resolveVerifyManifestPath(source.repoPath);
-            read.fallback = true;
-        }
-        return fallback;
-    };
-    const resolved = resolveDefaultVerification({ defaultVerification: source.defaultVerification, repoPath: runPath }, env, readVerifiedThenFallback);
-    // The resolver named the manifest it was ASKED for (the verified checkout's);
-    // when the fallback answered instead, the label must name the repoPath manifest
-    // that actually supplied the timeout.
-    const timeoutSource = resolved.sources.timeoutMs.layer === 'manifest' && read.fallback && read.manifestPath !== undefined
-        ? { layer: 'manifest_fallback', path: read.manifestPath, verifiedPath: verifiedManifestPath }
-        : resolved.sources.timeoutMs;
-    return {
-        command: resolved.command,
-        timeoutMs: resolved.timeoutMs,
-        timeoutSource: formatVerifyConfigSource(timeoutSource),
-        verifiedManifestPath,
-        ...(read.manifestPath !== undefined ? { manifestPath: read.manifestPath } : {}),
-        ...(read.fallback ? { manifestFallback: true } : {}),
-    };
-}
-/**
- * Derive the verification posture for one (product-scoped) config.
- *
- * Pure w.r.t. its inputs (env is injectable for tests) and free of any
- * escalation/side-effect path -- posture is declarative state, surfaced on
- * ambient read surfaces, never a filed escalation. Callers pass a product-scoped
- * config (from `configForProduct`) so `config.defaultVerification` is already the
- * selected per-product-or-global block and `repoPath` points at that product's
- * repo -- which is what lets a repo-manifest-only command read `configured`.
- *
- * An explicitly resolved command wins over the decline marker: an operator who
- * sets a command (via env or file) has configured verification regardless of a
- * stale `declined` flag. The marker still suppresses the repo manifest (the
- * operator file outranks it), so `declined: true` keeps reading `declined`.
- */
-export function deriveVerificationPosture(config, env = process.env, readManifest = readVerifyManifest) {
-    const resolved = resolveDefaultVerification(config, env, readManifest);
-    if (resolved.enabled)
-        return 'configured';
-    if (config.defaultVerification?.declined === true)
-        return 'declined';
-    return 'unconfigured';
-}
-/**
- * Build a `{ [productId]: { posture, command } }` map across products, applying
- * the per-product-override-else-global fallback (mirrors configForProduct) and
- * the global env command. Pure; the structured counterpart of
- * formatVerificationPostureLines, used to PUBLISH posture (e.g. in the daemon
- * heartbeat metadata) for the web app to read. Never files an escalation.
- */
-export function buildProductPostureMap(products, globalBlock, env = process.env, readManifest = readVerifyManifest) {
-    const map = {};
-    for (const p of products) {
-        // repoPath is carried through so each product's own committed manifest is
-        // the layer below its operator block (mirrors configForProduct).
-        const scoped = {
-            defaultVerification: p.defaultVerification ?? globalBlock,
-            ...(p.repoPath !== undefined ? { repoPath: p.repoPath } : {}),
-        };
-        const resolved = resolveDefaultVerification(scoped, env, readManifest);
-        map[p.id] = {
-            posture: deriveVerificationPosture(scoped, env, readManifest),
-            command: resolved.command,
-            timeoutMs: resolved.timeoutMs,
-            timeoutSource: formatVerifyConfigSource(resolved.sources.timeoutMs),
-        };
-    }
-    return map;
-}
-//# sourceMappingURL=verification-config.js.map

package/dist/verify/verification-config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"verification-config.js","sourceRoot":"","sources":["../../src/verify/verification-config.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,gHAAgH;AAChH,gBAAgB;AAoDhB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,wBAAwB,GAEzB,MAAM,4BAA4B,CAAC;AAGpC,4FAA4F;AAC5F,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAExD,4DAA4D;AAC5D,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC;AAE/C,2DAA2D;AAC3D,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,OAAO,EAAE,+BAA+B;IACxC,UAAU,EAAE,kCAAkC;IAC9C,cAAc,EAAE,sCAAsC;CAC9C,CAAC;AAqBX;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAuB;IAC9D,QAAQ,GAAG,CAAC,KAAK,EAAE,CAAC;QAClB,KAAK,KAAK;YACR,OAAO,OAAO,GAAG,CAAC,MAAM,EAAE,CAAC;QAC7B,KAAK,aAAa;YAChB,OAAO,iCAAiC,CAAC;QAC3C,KAAK,UAAU;YACb,OAAO,GAAG,CAAC,IAAI,CAAC;QAClB,KAAK,mBAAmB;YACtB,OAAO,GAAG,GAAG,CAAC,IAAI,8DAA8D,CAAC;QACnF,KAAK,SAAS;YACZ,OAAO,YAAY,yBAAyB,KAAK,CAAC;QACpD,KAAK,UAAU;YACb,OAAO,8BAA8B,CAAC;IAC1C,CAAC;AACH,CAAC;AAsBD,yGAAyG;AACzG,SAAS,SAAS,CAChB,MAAwC,EACxC,QAAkD;IAElD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IACrF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAmBD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAA+B,EAC/B,MAAyB,OAAO,CAAC,GAAG,EACpC,eAAqC,kBAAkB;IAEvD,MAAM,IAAI,GAAG,MAAM,CAAC,mBAAmB,CAAC;IACxC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE/C,MAAM,UAAU,GAAG,MAAM,CAAC,6BAA6B,CAAC;IACxD,MAAM,WAAW,GAAG,OAAO,IAAI,EAAE,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE;QACjF,CAAC,CAAC,IAAI,CAAC,OAAO;QACd,CAAC,CAAC,SAAS,CAAC;IACd,2EAA2E;IAC3E,MAAM,eAAe,GAAG,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC;IAChF,MAAM,UAAU,GAAuB,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;IAChE,MAAM,cAAc,GAAuB;QACzC,KAAK,EAAE,UAAU;QACjB,IAAI,EAAE,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,yBAAyB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,wBAAwB;KAC5G,CAAC;IACF,MAAM,OAAO,GAAG,SAAS,CAAS;QAChC,EAAE,KAAK,EAAE,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,OAAO,EAAE,EAAE;QAC9I,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE;QAC1C,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,cAAc,EAAE;KACnD,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAEhD,MAAM,SAAS,GAAG,SAAS,CAAS;QAClC,EAAE,KAAK,EAAE,MAAM,CAAC,gCAAgC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,UAAU,EAAE,EAAE;QAC3G,EAAE,KAAK,EAAE,OAAO,IAAI,EAAE,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE;QACrH,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE;KACvD,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAEvE,MAAM,aAAa,GACjB,MAAM,CAAC,oCAAoC;WACxC,CAAC,OAAO,IAAI,EAAE,aAAa,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;WACpG,QAAQ,EAAE,aAAa;WACvB,6BAA6B,CAAC;IAEnC,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,KAAK;QACtB,SAAS,EAAE,SAAS,CAAC,KAAK;QAC1B,aAAa;QACb,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACxC,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE;KAClE,CAAC;AACJ,CAAC;AAKD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gCAAgC,CAC9C,MAA+B,EAC/B,OAAe,EACf,MAAyB,OAAO,CAAC,GAAG,EACpC,eAAqC,kBAAkB;IAEvD,MAAM,oBAAoB,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAChE,MAAM,IAAI,GAAiD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC/E,MAAM,wBAAwB,GAAyB,CAAC,IAAI,EAAE,EAAE;QAC9D,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,IAAI,CAAC,YAAY,GAAG,oBAAoB,CAAC;YACzC,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,yBAAyB,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,oBAAoB;YAAE,OAAO,SAAS,CAAC;QAC9G,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,YAAY,GAAG,yBAAyB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC/D,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,0BAA0B,CACzC,EAAE,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,EAAE,QAAQ,EAAE,OAAO,EAAE,EACtE,GAAG,EACH,wBAAwB,CACzB,CAAC;IACF,8EAA8E;IAC9E,gFAAgF;IAChF,sCAAsC;IACtC,MAAM,aAAa,GACjB,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,KAAK,UAAU,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;QACjG,CAAC,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,EAAE,oBAAoB,EAAE;QAC7F,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;IACjC,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,aAAa,EAAE,wBAAwB,CAAC,aAAa,CAAC;QACtD,oBAAoB;QACpB,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,CAAC;AACJ,CAAC;AAeD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAA+B,EAC/B,MAAyB,OAAO,CAAC,GAAG,EACpC,eAAqC,kBAAkB;IAEvD,MAAM,QAAQ,GAAG,0BAA0B,CAAC,MAAM,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;IACvE,IAAI,QAAQ,CAAC,OAAO;QAAE,OAAO,YAAY,CAAC;IAC1C,IAAI,MAAM,CAAC,mBAAmB,EAAE,QAAQ,KAAK,IAAI;QAAE,OAAO,UAAU,CAAC;IACrE,OAAO,cAAc,CAAC;AACxB,CAAC;AAaD;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAA2G,EAC3G,WAAkD,EAClD,MAAyB,OAAO,CAAC,GAAG,EACpC,eAAqC,kBAAkB;IAEvD,MAAM,GAAG,GAA+C,EAAE,CAAC;IAC3D,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,0EAA0E;QAC1E,iEAAiE;QACjE,MAAM,MAAM,GAA4B;YACtC,mBAAmB,EAAE,CAAC,CAAC,mBAAmB,IAAI,WAAW;YACzD,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC;QACF,MAAM,QAAQ,GAAG,0BAA0B,CAAC,MAAM,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;QACvE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG;YACV,OAAO,EAAE,yBAAyB,CAAC,MAAM,EAAE,GAAG,EAAE,YAAY,CAAC;YAC7D,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,aAAa,EAAE,wBAAwB,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;SACpE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}