@tradejs/cli 3.1.21 → 3.1.22

package/dist/scripts/runtimeFeedbackReplay.js

@@ -0,0 +1,850 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/scripts/runtimeFeedbackReplay.ts
+var runtimeFeedbackReplay_exports = {};
+__export(runtimeFeedbackReplay_exports, {
+  main: () => main,
+  runtimeFeedbackReplay: () => runtimeFeedbackReplay
+});
+module.exports = __toCommonJS(runtimeFeedbackReplay_exports);
+var import_node_path5 = __toESM(require("path"));
+var import_args = __toESM(require("args"));
+var import_chalk = __toESM(require("chalk"));
+
+// src/lib/runtimeFeedbackReplay.ts
+var import_node_child_process = require("child_process");
+var import_promises4 = __toESM(require("fs/promises"));
+var import_node_path4 = __toESM(require("path"));
+
+// src/lib/runtimeEvidenceDeployment.ts
+var import_runtimeStrategies = require("@tradejs/node/runtimeStrategies");
+var isRecord = (value) => value != null && typeof value === "object" && !Array.isArray(value);
+var isNonEmptyString = (value) => typeof value === "string" && value.trim().length > 0;
+var isPackageVersionMap = (value) => isRecord(value) && Object.keys(value).length > 0 && Object.entries(value).every(
+  ([name, version]) => name.startsWith("@tradejs/") && isNonEmptyString(version)
+);
+var INTERVALS = /* @__PURE__ */ new Set([
+  "1",
+  "3",
+  "5",
+  "15",
+  "30",
+  "60",
+  "120",
+  "240",
+  "360",
+  "720",
+  "D",
+  "W",
+  "M"
+]);
+var UNIVERSES = /* @__PURE__ */ new Set(["crypto", "tradfi"]);
+var isRuntimeStrategySelection = (value) => value === void 0 || isRecord(value) && Object.keys(value).length === 1 && Object.keys(value).every((key) => key === "tickers") && Array.isArray(value.tickers) && value.tickers.length > 0 && value.tickers.every((ticker) => isNonEmptyString(ticker));
+var samePackageVersions = (left, right) => {
+  if (!left || !right) return false;
+  const leftEntries = Object.entries(left).sort(
+    ([a], [b]) => a.localeCompare(b)
+  );
+  const rightEntries = Object.entries(right).sort(
+    ([a], [b]) => a.localeCompare(b)
+  );
+  return JSON.stringify(leftEntries) === JSON.stringify(rightEntries);
+};
+var runtimeLineageMatchesStrategySnapshot = ({
+  lineage,
+  deployment,
+  strategy
+}) => lineage?.schemaVersion === 3 && lineage.strategyRevision === strategy.strategyRevision && lineage.deploymentCompositionId === deployment.deploymentCompositionId && lineage.strategyPackageVersion === strategy.strategyPackageVersion && lineage.runtimePackageVersion === strategy.runtimePackageVersion && samePackageVersions(
+  lineage.strategyDependencyVersions,
+  strategy.strategyDependencyVersions
+);
+var parseRuntimeEvidenceDeploymentSnapshot = (value) => {
+  if (!isRecord(value) || value.schemaVersion !== 2 || !isNonEmptyString(value.id) || !isNonEmptyString(value.deploymentCompositionId) || !/^dc1:[a-f0-9]{16}$/.test(value.deploymentCompositionId) || !isNonEmptyString(value.label) || !isNonEmptyString(value.connectorName) || !isNonEmptyString(value.provider) || !isNonEmptyString(value.accountId) || typeof value.enabled !== "boolean" || !Array.isArray(value.strategies)) {
+    throw new Error(
+      "Runtime evidence deployment snapshot is missing or invalid"
+    );
+  }
+  const strategies = value.strategies.map((candidate) => {
+    if (!isRecord(candidate) || !isNonEmptyString(candidate.strategyName) || !isNonEmptyString(candidate.strategyRevision) || !/^sr1:[a-f0-9]{16}$/.test(candidate.strategyRevision) || typeof candidate.enabled !== "boolean" || !["active", "entries_paused"].includes(String(candidate.controlState)) || !INTERVALS.has(String(candidate.interval)) || !UNIVERSES.has(String(candidate.universe)) || !isNonEmptyString(candidate.strategyPackage) || !isNonEmptyString(candidate.strategyPackageVersion) || !isPackageVersionMap(candidate.strategyDependencyVersions) || !isNonEmptyString(candidate.runtimePackageVersion) || !isRecord(candidate.strategyConfig) || !isRuntimeStrategySelection(candidate.selection)) {
+      throw new Error(
+        "Runtime evidence deployment strategy snapshot is invalid"
+      );
+    }
+    if (String(candidate.strategyConfig.INTERVAL) !== String(candidate.interval) || String(candidate.strategyConfig.UNIVERSE) !== String(candidate.universe)) {
+      throw new Error(
+        `Runtime evidence strategy config does not match its scope: ${candidate.strategyName}`
+      );
+    }
+    if (candidate.accountId != null && (!isNonEmptyString(candidate.accountId) || candidate.accountId !== value.accountId)) {
+      throw new Error(
+        `Runtime evidence strategy account does not match deployment: ${candidate.strategyName}`
+      );
+    }
+    return candidate;
+  });
+  const identities = /* @__PURE__ */ new Set();
+  for (const strategy of strategies) {
+    if (identities.has(strategy.strategyName)) {
+      throw new Error(
+        `Duplicate runtime evidence strategy: ${strategy.strategyName}`
+      );
+    }
+    identities.add(strategy.strategyName);
+  }
+  return {
+    ...value,
+    strategies
+  };
+};
+var activeRuntimeEvidenceStrategies = (deployment) => deployment.enabled ? deployment.strategies.filter((strategy) => strategy.enabled) : [];
+var unwrapRuntimeEvidenceRows = (value, field) => (Array.isArray(value) ? value : []).map((candidate) => {
+  const record = isRecord(candidate) ? candidate : null;
+  const nested = record && isRecord(record[field]) ? record[field] : null;
+  return nested ?? record;
+}).filter((record) => record != null);
+var assertCurrentRuntimeEvidenceArtifact = (artifact) => {
+  if (!isRecord(artifact) || artifact.reportType !== "runtime-evidence") {
+    throw new Error("Invalid runtime evidence artifact");
+  }
+  const deployment = parseRuntimeEvidenceDeploymentSnapshot(
+    artifact.deployment
+  );
+  const activeStrategies = activeRuntimeEvidenceStrategies(deployment);
+  if (activeStrategies.length === 0) {
+    throw new Error("Runtime evidence deployment has no enabled strategies");
+  }
+  const runtime = isRecord(artifact.runtime) ? artifact.runtime : null;
+  if (!runtime) {
+    throw new Error("Runtime evidence payload is missing");
+  }
+  if ("strategyConfigs" in runtime) {
+    throw new Error(
+      "Runtime evidence payload contains removed strategyConfigs data"
+    );
+  }
+  if ("evaluationStatsBuckets" in runtime) {
+    throw new Error(
+      "Runtime evidence payload contains removed lineage-less evaluationStatsBuckets data"
+    );
+  }
+  const rowFields = [
+    "trades",
+    "signals",
+    "evaluations",
+    "lineageScopes"
+  ];
+  for (const field of rowFields) {
+    if (!Array.isArray(runtime[field])) {
+      throw new Error(`Runtime evidence payload ${field} must be an array`);
+    }
+  }
+  const snapshots = new Map(
+    activeStrategies.map((strategy) => [strategy.strategyName, strategy])
+  );
+  const assertRows = (label, rows, lineageField) => {
+    for (const row of rows) {
+      const strategyName = String(row.strategy ?? "").trim();
+      const strategy = snapshots.get(strategyName);
+      if (!strategy || row.deploymentId !== deployment.id || row.accountId !== deployment.accountId || !runtimeLineageMatchesStrategySnapshot({
+        lineage: isRecord(row[lineageField]) ? row[lineageField] : void 0,
+        deployment,
+        strategy
+      })) {
+        throw new Error(
+          `Runtime evidence ${label} row is outside the current embedded deployment lineage`
+        );
+      }
+    }
+  };
+  assertRows(
+    "trade",
+    unwrapRuntimeEvidenceRows(runtime.trades, "trade"),
+    "runtimeLineage"
+  );
+  assertRows(
+    "signal",
+    unwrapRuntimeEvidenceRows(runtime.signals, "signal"),
+    "runtimeLineage"
+  );
+  assertRows(
+    "evaluation",
+    unwrapRuntimeEvidenceRows(runtime.evaluations, "evaluation"),
+    "runtimeLineage"
+  );
+  assertRows(
+    "lineage scope",
+    unwrapRuntimeEvidenceRows(runtime.lineageScopes, "lineageScope"),
+    "lineage"
+  );
+  return deployment;
+};
+
+// src/lib/runtimeEvidenceArtifacts.ts
+var import_node_crypto = require("crypto");
+var import_promises = __toESM(require("fs/promises"));
+var import_node_path = __toESM(require("path"));
+var RUNTIME_EVIDENCE_MANIFEST_FILE = "manifest.json";
+var RUNTIME_EVIDENCE_PAYLOAD_FILE = "runtime-evidence.json";
+var RUNTIME_EVIDENCE_COMPLETE_FILE = ".complete";
+var asRecord = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;
+var sha256 = (value) => (0, import_node_crypto.createHash)("sha256").update(value).digest("hex");
+var assertFiniteTimestamp = (value, label) => {
+  if (typeof value !== "number" || !Number.isFinite(value)) {
+    throw new Error(`Invalid runtime evidence ${label}`);
+  }
+  return value;
+};
+var parseManifest = (value) => {
+  const manifest = asRecord(value);
+  const window = asRecord(manifest?.window);
+  const payload = asRecord(manifest?.payload);
+  const counts = asRecord(manifest?.counts);
+  if (manifest?.schemaVersion !== 1 || manifest.reportType !== "runtime-evidence" || typeof manifest.artifactId !== "string" || typeof manifest.deploymentId !== "string" || typeof manifest.userName !== "string" || typeof manifest.createdAt !== "number" || payload?.file !== RUNTIME_EVIDENCE_PAYLOAD_FILE || typeof payload.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(payload.sha256) || typeof payload.bytes !== "number" || !Array.isArray(manifest.lineageKeys)) {
+    throw new Error("Invalid runtime evidence manifest");
+  }
+  return {
+    schemaVersion: 1,
+    artifactId: manifest.artifactId,
+    reportType: "runtime-evidence",
+    deploymentId: manifest.deploymentId,
+    userName: manifest.userName,
+    createdAt: manifest.createdAt,
+    window: {
+      startTime: assertFiniteTimestamp(window?.startTime, "window.startTime"),
+      endTime: assertFiniteTimestamp(window?.endTime, "window.endTime")
+    },
+    payload: {
+      file: RUNTIME_EVIDENCE_PAYLOAD_FILE,
+      sha256: payload.sha256,
+      bytes: payload.bytes
+    },
+    counts: Object.fromEntries(
+      Object.entries(counts ?? {}).filter(
+        (entry) => typeof entry[1] === "number" && Number.isFinite(entry[1])
+      )
+    ),
+    lineageKeys: manifest.lineageKeys.filter(
+      (value2) => typeof value2 === "string" && value2.length > 0
+    )
+  };
+};
+var verifyRuntimeEvidenceBundle = async (bundleDir) => {
+  const manifestPath = import_node_path.default.join(bundleDir, RUNTIME_EVIDENCE_MANIFEST_FILE);
+  const payloadPath = import_node_path.default.join(bundleDir, RUNTIME_EVIDENCE_PAYLOAD_FILE);
+  const completePath = import_node_path.default.join(bundleDir, RUNTIME_EVIDENCE_COMPLETE_FILE);
+  const [manifestText, payload, completeText] = await Promise.all([
+    import_promises.default.readFile(manifestPath, "utf8"),
+    import_promises.default.readFile(payloadPath),
+    import_promises.default.readFile(completePath, "utf8")
+  ]);
+  const manifest = parseManifest(JSON.parse(manifestText));
+  if (completeText.trim() !== manifest.artifactId) {
+    throw new Error(`Invalid completion marker in ${bundleDir}`);
+  }
+  if (payload.byteLength !== manifest.payload.bytes) {
+    throw new Error(`Runtime evidence size mismatch in ${bundleDir}`);
+  }
+  if (sha256(payload) !== manifest.payload.sha256) {
+    throw new Error(`Runtime evidence checksum mismatch in ${bundleDir}`);
+  }
+  const artifact = asRecord(JSON.parse(payload.toString("utf8")));
+  const artifactWindow = asRecord(artifact?.window);
+  if (artifact?.reportType !== "runtime-evidence" || artifactWindow?.startTime !== manifest.window.startTime || artifactWindow.endTime !== manifest.window.endTime) {
+    throw new Error(`Runtime evidence payload mismatch in ${bundleDir}`);
+  }
+  const deployment = assertCurrentRuntimeEvidenceArtifact(artifact);
+  if (deployment.id !== manifest.deploymentId) {
+    throw new Error(`Runtime evidence deployment mismatch in ${bundleDir}`);
+  }
+  return {
+    bundleDir,
+    manifestPath,
+    payloadPath,
+    manifest,
+    artifact
+  };
+};
+
+// src/lib/runtimeEvidenceProducer.ts
+var import_node_crypto2 = require("crypto");
+var import_promises2 = __toESM(require("fs/promises"));
+var import_node_path2 = __toESM(require("path"));
+var isRecord2 = (value) => value != null && typeof value === "object" && !Array.isArray(value);
+var sha2562 = (value) => (0, import_node_crypto2.createHash)("sha256").update(value).digest("hex");
+var parseRuntimeEvidenceProducer = (value) => {
+  const producer = isRecord2(value) ? value : null;
+  const runtimePackageManifest = isRecord2(producer?.runtimePackageManifest) ? producer.runtimePackageManifest : null;
+  if (producer?.schemaVersion !== 1 || typeof producer.projectSha !== "string" || !/^[a-f0-9]{40}$/.test(producer.projectSha) || typeof producer.imageDigest !== "string" || !/^sha256:[a-f0-9]{64}$/.test(producer.imageDigest) || runtimePackageManifest?.file !== "runtime-package-manifest.json" || typeof runtimePackageManifest.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(runtimePackageManifest.sha256)) {
+    throw new Error("Runtime evidence producer image identity is invalid");
+  }
+  return producer;
+};
+var resolveRuntimeEvidenceProducer = async ({
+  projectRoot: projectRoot2,
+  required
+}) => {
+  const projectSha = String(process.env.TRADEJS_PROJECT_SHA ?? "").trim();
+  const imageDigest = String(
+    process.env.TRADEJS_PROJECT_IMAGE_DIGEST ?? ""
+  ).trim();
+  if (!projectSha && !imageDigest && !required) {
+    return null;
+  }
+  if (!/^[a-f0-9]{40}$/.test(projectSha)) {
+    throw new Error(
+      "TRADEJS_PROJECT_SHA must be a full lowercase Git SHA before publishing runtime evidence"
+    );
+  }
+  if (!/^sha256:[a-f0-9]{64}$/.test(imageDigest)) {
+    throw new Error(
+      "TRADEJS_PROJECT_IMAGE_DIGEST must be an immutable sha256 digest before publishing runtime evidence"
+    );
+  }
+  const manifestPath = import_node_path2.default.join(projectRoot2, "runtime-package-manifest.json");
+  let manifest;
+  try {
+    manifest = await import_promises2.default.readFile(manifestPath);
+  } catch (error) {
+    if (!required && error.code === "ENOENT") {
+      return null;
+    }
+    throw new Error(
+      `Runtime package manifest is required for runtime evidence: ${manifestPath}`,
+      { cause: error }
+    );
+  }
+  return {
+    schemaVersion: 1,
+    projectSha,
+    imageDigest,
+    runtimePackageManifest: {
+      file: "runtime-package-manifest.json",
+      sha256: sha2562(manifest)
+    }
+  };
+};
+
+// src/lib/runtimeFeedbackArtifacts.ts
+var import_node_crypto3 = require("crypto");
+var import_promises3 = __toESM(require("fs/promises"));
+var import_node_path3 = __toESM(require("path"));
+var RUNTIME_FEEDBACK_MANIFEST_FILE = "manifest.json";
+var RUNTIME_FEEDBACK_REPLAY_FILE = "replay-runtime-evidence.json";
+var RUNTIME_FEEDBACK_LOG_FILE = "replay.log";
+var RUNTIME_FEEDBACK_COMPLETE_FILE = ".complete";
+var isRecord3 = (value) => value != null && typeof value === "object" && !Array.isArray(value);
+var sha2563 = (value) => (0, import_node_crypto3.createHash)("sha256").update(value).digest("hex");
+var safeSegment = (value, fallback) => {
+  const normalized = value.trim().replace(/[^a-zA-Z0-9._-]+/g, "-");
+  return normalized && normalized !== "." && normalized !== ".." ? normalized : fallback;
+};
+var parsePayload = (value, expectedFile) => {
+  const payload = isRecord3(value) ? value : null;
+  if (payload?.file !== expectedFile || typeof payload.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(payload.sha256) || typeof payload.bytes !== "number" || !Number.isFinite(payload.bytes) || payload.bytes < 0) {
+    throw new Error(`Invalid runtime feedback payload: ${expectedFile}`);
+  }
+  return payload;
+};
+var parseManifest2 = (value) => {
+  const manifest = isRecord3(value) ? value : null;
+  const window = isRecord3(manifest?.window) ? manifest.window : null;
+  const runtimeEvidence = isRecord3(manifest?.runtimeEvidence) ? manifest.runtimeEvidence : null;
+  const safety = isRecord3(manifest?.safety) ? manifest.safety : null;
+  const payloads = isRecord3(manifest?.payloads) ? manifest.payloads : null;
+  if (manifest?.schemaVersion !== 1 || manifest.reportType !== "runtime-feedback-replay" || typeof manifest.artifactId !== "string" || !manifest.artifactId.trim() || typeof manifest.runId !== "string" || !manifest.runId.trim() || typeof manifest.deploymentId !== "string" || !manifest.deploymentId.trim() || typeof manifest.deploymentCompositionId !== "string" || !/^dc1:[a-f0-9]{16}$/.test(manifest.deploymentCompositionId) || typeof manifest.userName !== "string" || !manifest.userName.trim() || typeof manifest.createdAt !== "number" || typeof window?.startTime !== "number" || typeof window.endTime !== "number" || typeof runtimeEvidence?.artifactId !== "string" || typeof runtimeEvidence.payloadSha256 !== "string" || !/^[a-f0-9]{64}$/.test(runtimeEvidence.payloadSha256) || !Array.isArray(manifest.activeStrategies) || manifest.activeStrategies.length === 0 || !manifest.activeStrategies.every(
+    (strategy) => typeof strategy === "string" && strategy.trim()
+  ) || typeof manifest.cycleCount !== "number" || !Number.isFinite(manifest.cycleCount) || manifest.cycleCount <= 0 || safety?.cacheOnly !== true || safety.externalOrderPlacement !== false || safety.redis !== "isolated" || safety.timescale !== "read_only") {
+    throw new Error("Invalid runtime feedback replay manifest");
+  }
+  const replayEvidence = parsePayload(
+    payloads?.replayEvidence,
+    RUNTIME_FEEDBACK_REPLAY_FILE
+  );
+  const log = parsePayload(payloads?.log, RUNTIME_FEEDBACK_LOG_FILE);
+  return {
+    ...manifest,
+    producer: parseRuntimeEvidenceProducer(manifest.producer),
+    payloads: {
+      replayEvidence: {
+        ...replayEvidence,
+        file: RUNTIME_FEEDBACK_REPLAY_FILE
+      },
+      log: { ...log, file: RUNTIME_FEEDBACK_LOG_FILE }
+    }
+  };
+};
+var assertReplayMatchesRuntimeEvidence = ({
+  replayEvidence,
+  runtimeEvidence
+}) => {
+  if (replayEvidence.reportType !== "replay-runtime-evidence") {
+    throw new Error("Runtime feedback replay payload has the wrong reportType");
+  }
+  const replayWindow = isRecord3(replayEvidence.window) ? replayEvidence.window : null;
+  if (replayWindow?.startTime !== runtimeEvidence.manifest.window.startTime || replayWindow.endTime !== runtimeEvidence.manifest.window.endTime) {
+    throw new Error("Runtime feedback replay window does not match evidence");
+  }
+  const runtimeDeployment = parseRuntimeEvidenceDeploymentSnapshot(
+    runtimeEvidence.artifact.deployment
+  );
+  const replayDeployment = parseRuntimeEvidenceDeploymentSnapshot(
+    replayEvidence.deployment
+  );
+  if (replayDeployment.id !== runtimeDeployment.id || replayDeployment.deploymentCompositionId !== runtimeDeployment.deploymentCompositionId) {
+    throw new Error(
+      "Runtime feedback replay deployment does not match evidence"
+    );
+  }
+};
+var sealRuntimeFeedbackReplayBundle = async ({
+  bundleDir,
+  runId,
+  runtimeEvidenceBundle
+}) => {
+  const replayEvidencePath = import_node_path3.default.join(bundleDir, RUNTIME_FEEDBACK_REPLAY_FILE);
+  const logPath = import_node_path3.default.join(bundleDir, RUNTIME_FEEDBACK_LOG_FILE);
+  const [replayPayload, logPayload] = await Promise.all([
+    import_promises3.default.readFile(replayEvidencePath),
+    import_promises3.default.readFile(logPath)
+  ]);
+  const replayEvidence = JSON.parse(replayPayload.toString("utf8"));
+  assertReplayMatchesRuntimeEvidence({
+    replayEvidence,
+    runtimeEvidence: runtimeEvidenceBundle
+  });
+  const replay = isRecord3(replayEvidence.replay) ? replayEvidence.replay : null;
+  const cycleCount = Number(replay?.cycleCount);
+  if (!Number.isFinite(cycleCount) || cycleCount <= 0) {
+    throw new Error(
+      `Runtime feedback replay produced no comparable cycles: ${String(replay?.cycleCount ?? "missing")}`
+    );
+  }
+  const deployment = parseRuntimeEvidenceDeploymentSnapshot(
+    runtimeEvidenceBundle.artifact.deployment
+  );
+  const producer = parseRuntimeEvidenceProducer(
+    runtimeEvidenceBundle.artifact.producer
+  );
+  const safeRunId = safeSegment(runId, "run");
+  const artifactId = `${runtimeEvidenceBundle.manifest.artifactId}_${safeRunId}`;
+  const manifest = {
+    schemaVersion: 1,
+    reportType: "runtime-feedback-replay",
+    artifactId,
+    runId: safeRunId,
+    deploymentId: deployment.id,
+    deploymentCompositionId: deployment.deploymentCompositionId,
+    userName: runtimeEvidenceBundle.manifest.userName,
+    createdAt: Date.now(),
+    window: { ...runtimeEvidenceBundle.manifest.window },
+    runtimeEvidence: {
+      artifactId: runtimeEvidenceBundle.manifest.artifactId,
+      payloadSha256: runtimeEvidenceBundle.manifest.payload.sha256
+    },
+    producer,
+    activeStrategies: activeRuntimeEvidenceStrategies(deployment).map(
+      ({ strategyName }) => strategyName
+    ),
+    cycleCount,
+    safety: {
+      cacheOnly: true,
+      externalOrderPlacement: false,
+      redis: "isolated",
+      timescale: "read_only"
+    },
+    payloads: {
+      replayEvidence: {
+        file: RUNTIME_FEEDBACK_REPLAY_FILE,
+        sha256: sha2563(replayPayload),
+        bytes: replayPayload.byteLength
+      },
+      log: {
+        file: RUNTIME_FEEDBACK_LOG_FILE,
+        sha256: sha2563(logPayload),
+        bytes: logPayload.byteLength
+      }
+    }
+  };
+  await import_promises3.default.writeFile(
+    import_node_path3.default.join(bundleDir, RUNTIME_FEEDBACK_MANIFEST_FILE),
+    `${JSON.stringify(manifest, null, 2)}
+`,
+    "utf8"
+  );
+  await import_promises3.default.writeFile(
+    import_node_path3.default.join(bundleDir, RUNTIME_FEEDBACK_COMPLETE_FILE),
+    `${artifactId}
+`,
+    "utf8"
+  );
+  return verifyRuntimeFeedbackReplayBundle(bundleDir);
+};
+var verifyRuntimeFeedbackReplayBundle = async (bundleDir) => {
+  const manifestPath = import_node_path3.default.join(bundleDir, RUNTIME_FEEDBACK_MANIFEST_FILE);
+  const replayEvidencePath = import_node_path3.default.join(bundleDir, RUNTIME_FEEDBACK_REPLAY_FILE);
+  const logPath = import_node_path3.default.join(bundleDir, RUNTIME_FEEDBACK_LOG_FILE);
+  const completePath = import_node_path3.default.join(bundleDir, RUNTIME_FEEDBACK_COMPLETE_FILE);
+  const [manifestText, replayPayload, logPayload, completeText] = await Promise.all([
+    import_promises3.default.readFile(manifestPath, "utf8"),
+    import_promises3.default.readFile(replayEvidencePath),
+    import_promises3.default.readFile(logPath),
+    import_promises3.default.readFile(completePath, "utf8")
+  ]);
+  const manifest = parseManifest2(JSON.parse(manifestText));
+  if (completeText.trim() !== manifest.artifactId) {
+    throw new Error(`Invalid runtime feedback completion marker: ${bundleDir}`);
+  }
+  for (const [payload, descriptor] of [
+    [replayPayload, manifest.payloads.replayEvidence],
+    [logPayload, manifest.payloads.log]
+  ]) {
+    if (payload.byteLength !== descriptor.bytes) {
+      throw new Error(
+        `Runtime feedback payload size mismatch: ${descriptor.file}`
+      );
+    }
+    if (sha2563(payload) !== descriptor.sha256) {
+      throw new Error(
+        `Runtime feedback payload checksum mismatch: ${descriptor.file}`
+      );
+    }
+  }
+  const replayEvidence = JSON.parse(replayPayload.toString("utf8"));
+  if (replayEvidence.reportType !== "replay-runtime-evidence") {
+    throw new Error("Invalid runtime feedback replay evidence payload");
+  }
+  const replayWindow = isRecord3(replayEvidence.window) ? replayEvidence.window : null;
+  const replay = isRecord3(replayEvidence.replay) ? replayEvidence.replay : null;
+  const replayDeployment = parseRuntimeEvidenceDeploymentSnapshot(
+    replayEvidence.deployment
+  );
+  const replayStrategies = activeRuntimeEvidenceStrategies(replayDeployment).map(({ strategyName }) => strategyName).sort();
+  if (replayEvidence.userName !== manifest.userName || replayWindow?.startTime !== manifest.window.startTime || replayWindow.endTime !== manifest.window.endTime || replayDeployment.id !== manifest.deploymentId || replayDeployment.deploymentCompositionId !== manifest.deploymentCompositionId || Number(replay?.cycleCount) !== manifest.cycleCount || JSON.stringify(replayStrategies) !== JSON.stringify([...manifest.activeStrategies].sort())) {
+    throw new Error("Runtime feedback replay payload does not match manifest");
+  }
+  return {
+    bundleDir,
+    manifestPath,
+    replayEvidencePath,
+    logPath,
+    manifest,
+    replayEvidence
+  };
+};
+
+// src/lib/runtimeFeedbackReplay.ts
+var REQUIRED_ENV = {
+  RUNTIME_FEEDBACK_ISOLATED_REDIS: "true",
+  MAKE_ORDERS: "false",
+  TRADEJS_EXTERNAL_ORDER_PLACEMENT: "false"
+};
+var FORBIDDEN_SECRET_ENV = [
+  "AGENT_GITHUB_TOKEN",
+  "AI_API_KEY",
+  "ANTHROPIC_API_KEY",
+  "AUTH_SECRET",
+  "BYBIT_API_KEY",
+  "BYBIT_API_SECRET",
+  "COINALYZE_API_KEY",
+  "COINMARKETCAP_API_KEY",
+  "GITHUB_TOKEN",
+  "GIT_SSH_PRIVATE_KEY",
+  "NEXTAUTH_SECRET",
+  "NPM_TOKEN",
+  "OPENAI_API_KEY",
+  "OPENROUTER_API_KEY",
+  "SSH_PRIVATE_KEY",
+  "TG_BOT_TOKEN"
+];
+var unsafeRedisHosts = /* @__PURE__ */ new Set([
+  "127.0.0.1",
+  "::1",
+  "inv-redis",
+  "localhost",
+  "redis"
+]);
+var safeSegment2 = (value, fallback) => {
+  const normalized = value.trim().replace(/[^a-zA-Z0-9._-]+/g, "-");
+  return normalized && normalized !== "." && normalized !== ".." ? normalized : fallback;
+};
+var assertRuntimeFeedbackReplaySafety = (env) => {
+  for (const [name, expected] of Object.entries(REQUIRED_ENV)) {
+    if (env[name] !== expected) {
+      throw new Error(`Runtime feedback replay requires ${name}=${expected}`);
+    }
+  }
+  const redisHost = String(env.REDIS_HOST ?? "").trim().toLowerCase();
+  if (!redisHost || unsafeRedisHosts.has(redisHost)) {
+    throw new Error(
+      `Runtime feedback replay requires a named isolated Redis host, received ${redisHost || "[missing]"}`
+    );
+  }
+  const pgOptions = String(env.PGOPTIONS ?? "");
+  if (!/default_transaction_read_only\s*=\s*on/i.test(pgOptions)) {
+    throw new Error(
+      "Runtime feedback replay requires PGOPTIONS with default_transaction_read_only=on"
+    );
+  }
+  if (env.TRADEJS_TIMESCALE_READ_ONLY !== "true") {
+    throw new Error(
+      "Runtime feedback replay requires TRADEJS_TIMESCALE_READ_ONLY=true"
+    );
+  }
+  const exposedSecrets = FORBIDDEN_SECRET_ENV.filter(
+    (name) => String(env[name] ?? "").trim()
+  );
+  if (exposedSecrets.length) {
+    throw new Error(
+      `Runtime feedback replay received forbidden credentials: ${exposedSecrets.join(", ")}`
+    );
+  }
+};
+var buildRuntimeFeedbackReplayCommands = ({
+  cliPath,
+  runtimeEvidencePath,
+  replayEvidencePath,
+  userName,
+  connectorName,
+  deploymentId,
+  interval,
+  startTime,
+  endTime
+}) => [
+  [
+    cliPath,
+    "replay",
+    "--user",
+    userName,
+    "--connector",
+    connectorName,
+    "--deployment",
+    deploymentId,
+    "--timeframe",
+    interval,
+    "--startTime",
+    String(startTime),
+    "--endTime",
+    String(endTime),
+    "--runtimeEvidence",
+    runtimeEvidencePath,
+    "--cacheOnly"
+  ],
+  [
+    cliPath,
+    "replay-runtime-evidence",
+    "--user",
+    userName,
+    "--runtimeEvidence",
+    runtimeEvidencePath,
+    "--startTime",
+    String(startTime),
+    "--endTime",
+    String(endTime),
+    "--out",
+    replayEvidencePath
+  ]
+];
+var runLoggedCommand = async ({
+  executable,
+  command,
+  cwd,
+  env,
+  logHandle
+}) => {
+  await logHandle.write(`
+$ ${[executable, ...command].join(" ")}
+`);
+  await new Promise((resolve, reject) => {
+    let pendingLogWrite = Promise.resolve();
+    const appendLog = (chunk) => {
+      pendingLogWrite = pendingLogWrite.then(async () => {
+        await logHandle.write(chunk);
+      });
+    };
+    const child = (0, import_node_child_process.spawn)(executable, command, {
+      cwd,
+      env,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    child.stdout.on("data", (chunk) => {
+      process.stdout.write(chunk);
+      appendLog(chunk);
+    });
+    child.stderr.on("data", (chunk) => {
+      process.stderr.write(chunk);
+      appendLog(chunk);
+    });
+    child.once("error", reject);
+    child.once("close", (code, signal) => {
+      void pendingLogWrite.then(() => {
+        if (code === 0) {
+          resolve();
+          return;
+        }
+        reject(
+          new Error(
+            `Runtime feedback command failed: exit=${String(code)} signal=${String(signal)}`
+          )
+        );
+      }, reject);
+    });
+  });
+};
+var runRuntimeFeedbackReplay = async ({
+  runtimeEvidencePath,
+  outDir,
+  runId = `${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}-${process.pid}`,
+  projectRoot: projectRoot2,
+  env = process.env,
+  executable = process.execPath,
+  cliPath = process.argv[1]
+}) => {
+  assertRuntimeFeedbackReplaySafety(env);
+  if (!cliPath) {
+    throw new Error("Cannot resolve the TradeJS CLI executable path");
+  }
+  const runtimeEvidenceBundle = await verifyRuntimeEvidenceBundle(
+    import_node_path4.default.dirname(runtimeEvidencePath)
+  );
+  if (import_node_path4.default.resolve(runtimeEvidenceBundle.payloadPath) !== runtimeEvidencePath) {
+    throw new Error(
+      `Runtime evidence must be the verified bundle payload: ${runtimeEvidenceBundle.payloadPath}`
+    );
+  }
+  const deployedProducer = parseRuntimeEvidenceProducer(
+    runtimeEvidenceBundle.artifact.producer
+  );
+  const currentProducer = await resolveRuntimeEvidenceProducer({
+    projectRoot: projectRoot2,
+    required: true
+  });
+  if (!currentProducer || currentProducer.projectSha !== deployedProducer.projectSha || currentProducer.imageDigest !== deployedProducer.imageDigest || currentProducer.runtimePackageManifest.sha256 !== deployedProducer.runtimePackageManifest.sha256) {
+    throw new Error(
+      "Runtime feedback replay image identity does not match runtime evidence"
+    );
+  }
+  const deployment = parseRuntimeEvidenceDeploymentSnapshot(
+    runtimeEvidenceBundle.artifact.deployment
+  );
+  const activeStrategies = activeRuntimeEvidenceStrategies(deployment);
+  const intervals = new Set(
+    activeStrategies.map(({ interval }) => String(interval))
+  );
+  if (intervals.size !== 1) {
+    throw new Error(
+      `Runtime feedback replay requires one interval, received ${[...intervals].join(",")}`
+    );
+  }
+  await import_promises4.default.mkdir(outDir, { recursive: true });
+  const existing = await import_promises4.default.readdir(outDir);
+  if (existing.length) {
+    throw new Error(
+      `Runtime feedback output directory must be empty: ${outDir}`
+    );
+  }
+  const replayEvidencePath = import_node_path4.default.join(outDir, RUNTIME_FEEDBACK_REPLAY_FILE);
+  const logHandle = await import_promises4.default.open(
+    import_node_path4.default.join(outDir, RUNTIME_FEEDBACK_LOG_FILE),
+    "wx"
+  );
+  const commands = buildRuntimeFeedbackReplayCommands({
+    cliPath,
+    runtimeEvidencePath,
+    replayEvidencePath,
+    userName: runtimeEvidenceBundle.manifest.userName,
+    connectorName: deployment.connectorName,
+    deploymentId: deployment.id,
+    interval: [...intervals][0],
+    startTime: runtimeEvidenceBundle.manifest.window.startTime,
+    endTime: runtimeEvidenceBundle.manifest.window.endTime
+  });
+  try {
+    for (const command of commands) {
+      await runLoggedCommand({
+        executable,
+        command,
+        cwd: projectRoot2,
+        env,
+        logHandle
+      });
+    }
+  } finally {
+    await logHandle.close();
+  }
+  return sealRuntimeFeedbackReplayBundle({
+    bundleDir: outDir,
+    runId: safeSegment2(runId, "run"),
+    runtimeEvidenceBundle
+  });
+};
+
+// src/scripts/runtimeFeedbackReplay.ts
+import_args.default.option("runtimeEvidence", "Verified runtime evidence JSON");
+import_args.default.option("outDir", "New writable directory for replay output");
+import_args.default.option("runId", "Stable identifier for this replay attempt");
+var flags = import_args.default.parse(process.argv);
+var projectRoot = String(process.env.PROJECT_CWD || process.cwd()).trim() || process.cwd();
+var runtimeFeedbackReplay = async () => {
+  const runtimeEvidence = String(flags.runtimeEvidence ?? "").trim();
+  const outDir = String(flags.outDir ?? "").trim();
+  if (!runtimeEvidence || !outDir) {
+    throw new Error(
+      "Provide --runtimeEvidence and --outDir for runtime feedback replay."
+    );
+  }
+  const verified = await runRuntimeFeedbackReplay({
+    runtimeEvidencePath: import_node_path5.default.resolve(projectRoot, runtimeEvidence),
+    outDir: import_node_path5.default.resolve(projectRoot, outDir),
+    runId: String(flags.runId ?? "").trim() || void 0,
+    projectRoot
+  });
+  console.log(
+    import_chalk.default.green(
+      `Runtime feedback replay sealed: ${verified.manifest.artifactId}`
+    )
+  );
+  console.log(
+    JSON.stringify(
+      {
+        bundleDir: verified.bundleDir,
+        manifestPath: verified.manifestPath,
+        replayEvidencePath: verified.replayEvidencePath
+      },
+      null,
+      2
+    )
+  );
+};
+var main = runtimeFeedbackReplay;
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  main,
+  runtimeFeedbackReplay
+});