@tradejs/cli 3.1.27-beta.249 → 3.1.27-beta.250

package/dist/scripts/runtimeEvidence.js

@@ -34,8 +34,8 @@ __export(runtimeEvidence_exports, {
   runtimeEvidence: () => runtimeEvidence
 });
 module.exports = __toCommonJS(runtimeEvidence_exports);
-var import_promises3 = __toESM(require("fs/promises"));
-var import_node_path3 = __toESM(require("path"));
+var import_promises4 = __toESM(require("fs/promises"));
+var import_node_path4 = __toESM(require("path"));
 var import_args = __toESM(require("args"));
 var import_chalk = __toESM(require("chalk"));
 
@@ -877,6 +877,11 @@ var discoverRuntimeEvidenceBundles = async (rootDir) => {
   return bundles.sort();
 };
 
+// src/lib/runtimeEvidenceCompositionSnapshots.ts
+var import_node_crypto3 = require("crypto");
+var import_promises3 = __toESM(require("fs/promises"));
+var import_node_path3 = __toESM(require("path"));
+
 // src/lib/runtimeEvidenceProducer.ts
 var import_node_crypto2 = require("crypto");
 var import_promises2 = __toESM(require("fs/promises"));
@@ -936,6 +941,77 @@ var resolveRuntimeEvidenceProducer = async ({
   };
 };
 
+// src/lib/runtimeEvidenceCompositionSnapshots.ts
+var SNAPSHOT_FILE = "snapshot.json";
+var MANIFEST_FILE = "manifest.json";
+var COMPLETE_FILE = ".complete";
+var isRecord3 = (value) => value != null && typeof value === "object" && !Array.isArray(value);
+var sha2563 = (value) => (0, import_node_crypto3.createHash)("sha256").update(value).digest("hex");
+var parseManifest2 = (value) => {
+  const manifest = isRecord3(value) ? value : null;
+  const payload = isRecord3(manifest?.payload) ? manifest.payload : null;
+  if (manifest?.schemaVersion !== 1 || manifest.reportType !== "runtime-evidence-composition-snapshot" || typeof manifest.createdAt !== "number" || typeof manifest.userName !== "string" || typeof manifest.deploymentId !== "string" || typeof manifest.deploymentCompositionId !== "string" || payload?.file !== SNAPSHOT_FILE || typeof payload.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(payload.sha256) || typeof payload.bytes !== "number") {
+    throw new Error("Invalid runtime evidence composition snapshot manifest");
+  }
+  return manifest;
+};
+var verifyRuntimeEvidenceCompositionSnapshot = async (bundleDir) => {
+  const [manifestText, payload, completeText] = await Promise.all([
+    import_promises3.default.readFile(import_node_path3.default.join(bundleDir, MANIFEST_FILE), "utf8"),
+    import_promises3.default.readFile(import_node_path3.default.join(bundleDir, SNAPSHOT_FILE)),
+    import_promises3.default.readFile(import_node_path3.default.join(bundleDir, COMPLETE_FILE), "utf8")
+  ]);
+  const manifest = parseManifest2(JSON.parse(manifestText));
+  if (completeText.trim() !== manifest.deploymentCompositionId) {
+    throw new Error(`Invalid completion marker in ${bundleDir}`);
+  }
+  if (payload.byteLength !== manifest.payload.bytes || sha2563(payload) !== manifest.payload.sha256) {
+    throw new Error(
+      `Runtime evidence snapshot checksum mismatch in ${bundleDir}`
+    );
+  }
+  const value = JSON.parse(payload.toString("utf8"));
+  const record = isRecord3(value) ? value : null;
+  if (record?.schemaVersion !== 1 || record.reportType !== "runtime-evidence-composition-snapshot" || record.userName !== manifest.userName) {
+    throw new Error(
+      `Invalid runtime evidence snapshot payload in ${bundleDir}`
+    );
+  }
+  const deployment = parseRuntimeEvidenceDeploymentSnapshot(record.deployment);
+  const producer = parseRuntimeEvidenceProducer(record.producer);
+  if (deployment.id !== manifest.deploymentId || deployment.deploymentCompositionId !== manifest.deploymentCompositionId) {
+    throw new Error(
+      `Runtime evidence snapshot identity mismatch in ${bundleDir}`
+    );
+  }
+  return { bundleDir, deployment, producer };
+};
+var discoverRuntimeEvidenceCompositionSnapshots = async (evidenceRoot) => {
+  const rootDir = import_node_path3.default.join(evidenceRoot, "snapshots");
+  const bundleDirs = [];
+  let deployments;
+  try {
+    deployments = await import_promises3.default.readdir(rootDir, { withFileTypes: true });
+  } catch (error) {
+    if (error.code === "ENOENT") return [];
+    throw error;
+  }
+  for (const deployment of deployments.filter((entry) => entry.isDirectory())) {
+    const deploymentDir = import_node_path3.default.join(rootDir, deployment.name);
+    const compositions = await import_promises3.default.readdir(deploymentDir, {
+      withFileTypes: true
+    });
+    bundleDirs.push(
+      ...compositions.filter(
+        (entry) => entry.isDirectory() && !entry.name.startsWith(".") && !entry.name.includes(".tmp-")
+      ).map((entry) => import_node_path3.default.join(deploymentDir, entry.name))
+    );
+  }
+  return Promise.all(
+    bundleDirs.sort().map(verifyRuntimeEvidenceCompositionSnapshot)
+  );
+};
+
 // src/lib/runtimeEvidenceCompositions.ts
 var stableSnapshotIdentity = (deployment) => JSON.stringify({ ...deployment, tickers: void 0 });
 var producerIdentity = (producer) => JSON.stringify(producer);
@@ -955,6 +1031,14 @@ var loadRuntimeEvidenceCompositionSnapshots = async ({
     }
     snapshots.set(compositionId, snapshot);
   };
+  const compositionSnapshots = await discoverRuntimeEvidenceCompositionSnapshots(publishRoot);
+  for (const snapshot of compositionSnapshots) {
+    if (snapshot.deployment.id !== currentDeployment.id) continue;
+    register({
+      deployment: { ...snapshot.deployment, tickers: void 0 },
+      producer: snapshot.producer
+    });
+  }
   const bundleDirs = await discoverRuntimeEvidenceBundles(publishRoot);
   for (const bundleDir of bundleDirs) {
     const bundle = await verifyRuntimeEvidenceBundle(bundleDir);
@@ -1070,7 +1154,7 @@ var splitRuntimeEvidenceByComposition = ({
 };
 
 // src/lib/runtimeLineage.ts
-var import_node_crypto3 = require("crypto");
+var import_node_crypto4 = require("crypto");
 var normalizeForStableJson = (value) => {
   if (Array.isArray(value)) {
     return value.map(normalizeForStableJson);
@@ -1082,7 +1166,7 @@ var normalizeForStableJson = (value) => {
   }
   return value;
 };
-var fingerprintRuntimeValue = (value) => (0, import_node_crypto3.createHash)("sha256").update(JSON.stringify(normalizeForStableJson(value))).digest("hex").slice(0, 16);
+var fingerprintRuntimeValue = (value) => (0, import_node_crypto4.createHash)("sha256").update(JSON.stringify(normalizeForStableJson(value))).digest("hex").slice(0, 16);
 var runtimeLineageKey = (lineage) => [
   "v3",
   lineage.deploymentCompositionId,
@@ -1191,7 +1275,7 @@ var runtimeEvidence = async () => {
     deploymentId
   });
   const snapshots = publishDir && producer ? await loadRuntimeEvidenceCompositionSnapshots({
-    publishRoot: import_node_path3.default.resolve(projectRoot, publishDir),
+    publishRoot: import_node_path4.default.resolve(projectRoot, publishDir),
     currentDeployment: deploymentSnapshot,
     currentProducer: producer
   }) : /* @__PURE__ */ new Map([
@@ -1264,14 +1348,14 @@ var runtimeEvidence = async () => {
     throw new Error("Runtime evidence window has no versioned runtime rows");
   }
   const artifact = current.artifact;
-  const outPath = import_node_path3.default.resolve(projectRoot, String(flags.out));
-  await import_promises3.default.mkdir(import_node_path3.default.dirname(outPath), { recursive: true });
-  await import_promises3.default.writeFile(outPath, `${JSON.stringify(artifact, null, 2)}
+  const outPath = import_node_path4.default.resolve(projectRoot, String(flags.out));
+  await import_promises4.default.mkdir(import_node_path4.default.dirname(outPath), { recursive: true });
+  await import_promises4.default.writeFile(outPath, `${JSON.stringify(artifact, null, 2)}
 `, "utf8");
   const published = publishDir ? await Promise.all(
     artifacts.map(
       ({ artifact: artifact2, composition }) => publishRuntimeEvidenceBundle({
-        publishRoot: import_node_path3.default.resolve(projectRoot, publishDir),
+        publishRoot: import_node_path4.default.resolve(projectRoot, publishDir),
         deploymentId,
         userName: String(flags.user),
         startTime,

package/dist/scripts/signals.js

@@ -51,7 +51,7 @@ var import_constants3 = require("@tradejs/core/constants");
 var import_time3 = require("@tradejs/core/time");
 var import_logger4 = require("@tradejs/infra/logger");
 var import_runtimeHeartbeats = require("@tradejs/infra/runtimeHeartbeats");
-var import_runtimeStrategies2 = require("@tradejs/node/runtimeStrategies");
+var import_runtimeStrategies3 = require("@tradejs/node/runtimeStrategies");
 
 // src/lib/marketData/windows.ts
 var import_indicators = require("@tradejs/core/indicators");
@@ -2150,27 +2150,27 @@ var createCoinMarketCapFetchStats = () => ({
   totalCredits: 0,
   byPath: /* @__PURE__ */ new Map()
 });
-var getCoinMarketCapPathLabel = (path) => {
-  if (path.includes("global-metrics")) return "global";
-  if (path.includes("cryptocurrency/quotes")) return "reference";
-  if (path.includes("exchange/quotes")) return "exchangeLiquidity";
-  if (path.includes("fear-and-greed")) return "fearGreed";
-  if (path.includes("cmc100")) return "cmc100";
-  if (path.includes("cmc20")) return "cmc20";
-  return path;
-};
-var recordCoinMarketCapFetchStats = (stats, path, creditCount) => {
+var getCoinMarketCapPathLabel = (path3) => {
+  if (path3.includes("global-metrics")) return "global";
+  if (path3.includes("cryptocurrency/quotes")) return "reference";
+  if (path3.includes("exchange/quotes")) return "exchangeLiquidity";
+  if (path3.includes("fear-and-greed")) return "fearGreed";
+  if (path3.includes("cmc100")) return "cmc100";
+  if (path3.includes("cmc20")) return "cmc20";
+  return path3;
+};
+var recordCoinMarketCapFetchStats = (stats, path3, creditCount) => {
   if (!stats) return;
-  const existing = stats.byPath.get(path) ?? { requests: 0, credits: 0 };
+  const existing = stats.byPath.get(path3) ?? { requests: 0, credits: 0 };
   existing.requests += 1;
   existing.credits += creditCount ?? 0;
   stats.requests += 1;
   stats.totalCredits += creditCount ?? 0;
-  stats.byPath.set(path, existing);
+  stats.byPath.set(path3, existing);
 };
 var formatCoinMarketCapFetchStats = (stats) => {
   const byPath = [...stats.byPath.entries()].map(
-    ([path, item]) => `${getCoinMarketCapPathLabel(path)}=${item.requests}req/${item.credits}cr`
+    ([path3, item]) => `${getCoinMarketCapPathLabel(path3)}=${item.requests}req/${item.credits}cr`
   ).join(" ");
   return `apiRequests=${stats.requests} apiCredits=${stats.totalCredits}${byPath ? ` ${byPath}` : ""}`;
 };
@@ -4931,6 +4931,368 @@ var buildConfiguredSignalsScopes = ({
   }));
 };
 
+// src/lib/runtimeEvidenceCompositionSnapshots.ts
+var import_node_crypto3 = require("crypto");
+var import_promises2 = __toESM(require("fs/promises"));
+var import_node_path2 = __toESM(require("path"));
+
+// src/lib/runtimeEvidenceDeployment.ts
+var import_runtimeStrategies2 = require("@tradejs/node/runtimeStrategies");
+var isRecord = (value) => value != null && typeof value === "object" && !Array.isArray(value);
+var isNonEmptyString = (value) => typeof value === "string" && value.trim().length > 0;
+var isPackageVersionMap = (value) => isRecord(value) && Object.keys(value).length > 0 && Object.entries(value).every(
+  ([name, version]) => name.startsWith("@tradejs/") && isNonEmptyString(version)
+);
+var INTERVALS = /* @__PURE__ */ new Set([
+  "1",
+  "3",
+  "5",
+  "15",
+  "30",
+  "60",
+  "120",
+  "240",
+  "360",
+  "720",
+  "D",
+  "W",
+  "M"
+]);
+var UNIVERSES = /* @__PURE__ */ new Set(["crypto", "tradfi"]);
+var isRuntimeStrategySelection = (value) => value === void 0 || isRecord(value) && Object.keys(value).length === 1 && Object.keys(value).every((key) => key === "tickers") && Array.isArray(value.tickers) && value.tickers.length > 0 && value.tickers.every((ticker) => isNonEmptyString(ticker));
+var parseRuntimeEvidenceDeploymentSnapshot = (value) => {
+  if (!isRecord(value) || value.schemaVersion !== 2 || !isNonEmptyString(value.id) || !isNonEmptyString(value.deploymentCompositionId) || !/^dc1:[a-f0-9]{16}$/.test(value.deploymentCompositionId) || !isNonEmptyString(value.label) || !isNonEmptyString(value.connectorName) || !isNonEmptyString(value.provider) || !isNonEmptyString(value.accountId) || typeof value.enabled !== "boolean" || !Array.isArray(value.strategies)) {
+    throw new Error(
+      "Runtime evidence deployment snapshot is missing or invalid"
+    );
+  }
+  const strategies = value.strategies.map((candidate) => {
+    if (!isRecord(candidate) || !isNonEmptyString(candidate.strategyName) || !isNonEmptyString(candidate.strategyRevision) || !/^sr1:[a-f0-9]{16}$/.test(candidate.strategyRevision) || typeof candidate.enabled !== "boolean" || !["active", "entries_paused"].includes(String(candidate.controlState)) || !INTERVALS.has(String(candidate.interval)) || !UNIVERSES.has(String(candidate.universe)) || !isNonEmptyString(candidate.strategyPackage) || !isNonEmptyString(candidate.strategyPackageVersion) || !isPackageVersionMap(candidate.strategyDependencyVersions) || !isNonEmptyString(candidate.runtimePackageVersion) || !isRecord(candidate.strategyConfig) || !isRuntimeStrategySelection(candidate.selection)) {
+      throw new Error(
+        "Runtime evidence deployment strategy snapshot is invalid"
+      );
+    }
+    if (String(candidate.strategyConfig.INTERVAL) !== String(candidate.interval) || String(candidate.strategyConfig.UNIVERSE) !== String(candidate.universe)) {
+      throw new Error(
+        `Runtime evidence strategy config does not match its scope: ${candidate.strategyName}`
+      );
+    }
+    if (candidate.accountId != null && (!isNonEmptyString(candidate.accountId) || candidate.accountId !== value.accountId)) {
+      throw new Error(
+        `Runtime evidence strategy account does not match deployment: ${candidate.strategyName}`
+      );
+    }
+    return candidate;
+  });
+  const identities = /* @__PURE__ */ new Set();
+  for (const strategy of strategies) {
+    if (identities.has(strategy.strategyName)) {
+      throw new Error(
+        `Duplicate runtime evidence strategy: ${strategy.strategyName}`
+      );
+    }
+    identities.add(strategy.strategyName);
+  }
+  return {
+    ...value,
+    strategies
+  };
+};
+var resolveRuntimeEvidenceDeploymentSnapshot = async ({
+  userName,
+  projectRoot,
+  deploymentId
+}) => {
+  const [deployment, strategies] = await Promise.all([
+    (0, import_runtimeStrategies2.getRuntimeDeployment)({ userName, projectRoot, deploymentId }),
+    (0, import_runtimeStrategies2.loadResolvedRuntimeStrategies)({ userName, projectRoot, deploymentId })
+  ]);
+  if (!deployment) {
+    throw new Error(`Runtime deployment not found: ${deploymentId}`);
+  }
+  return {
+    schemaVersion: 2,
+    id: deployment.id,
+    deploymentCompositionId: deployment.deploymentCompositionId,
+    label: deployment.label,
+    connectorName: deployment.connectorName,
+    provider: deployment.provider,
+    accountId: deployment.accountId,
+    enabled: deployment.enabled,
+    strategies: strategies.map(
+      ({
+        strategyName,
+        strategyRevision,
+        enabled,
+        controlState,
+        interval,
+        universe,
+        accountId,
+        strategyPackage,
+        strategyPackageVersion,
+        strategyDependencyVersions,
+        runtimePackageVersion,
+        strategyConfig,
+        selection
+      }) => ({
+        strategyName,
+        strategyRevision,
+        enabled,
+        controlState,
+        interval,
+        universe,
+        ...accountId ? { accountId } : {},
+        strategyPackage,
+        strategyPackageVersion,
+        strategyDependencyVersions,
+        runtimePackageVersion,
+        strategyConfig,
+        ...selection ? { selection } : {}
+      })
+    ),
+    ...deployment.assetClasses ? { assetClasses: [...deployment.assetClasses] } : {},
+    ...deployment.tickers ? { tickers: [...deployment.tickers] } : {}
+  };
+};
+
+// src/lib/runtimeEvidenceProducer.ts
+var import_node_crypto2 = require("crypto");
+var import_promises = __toESM(require("fs/promises"));
+var import_node_path = __toESM(require("path"));
+var isRecord2 = (value) => value != null && typeof value === "object" && !Array.isArray(value);
+var sha256 = (value) => (0, import_node_crypto2.createHash)("sha256").update(value).digest("hex");
+var parseRuntimeEvidenceProducer = (value) => {
+  const producer = isRecord2(value) ? value : null;
+  const runtimePackageManifest = isRecord2(producer?.runtimePackageManifest) ? producer.runtimePackageManifest : null;
+  if (producer?.schemaVersion !== 1 || typeof producer.projectSha !== "string" || !/^[a-f0-9]{40}$/.test(producer.projectSha) || typeof producer.imageDigest !== "string" || !/^sha256:[a-f0-9]{64}$/.test(producer.imageDigest) || runtimePackageManifest?.file !== "runtime-package-manifest.json" || typeof runtimePackageManifest.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(runtimePackageManifest.sha256)) {
+    throw new Error("Runtime evidence producer image identity is invalid");
+  }
+  return producer;
+};
+var resolveRuntimeEvidenceProducer = async ({
+  projectRoot,
+  required
+}) => {
+  const projectSha = String(process.env.TRADEJS_PROJECT_SHA ?? "").trim();
+  const imageDigest = String(
+    process.env.TRADEJS_PROJECT_IMAGE_DIGEST ?? ""
+  ).trim();
+  if (!projectSha && !imageDigest && !required) {
+    return null;
+  }
+  if (!/^[a-f0-9]{40}$/.test(projectSha)) {
+    throw new Error(
+      "TRADEJS_PROJECT_SHA must be a full lowercase Git SHA before publishing runtime evidence"
+    );
+  }
+  if (!/^sha256:[a-f0-9]{64}$/.test(imageDigest)) {
+    throw new Error(
+      "TRADEJS_PROJECT_IMAGE_DIGEST must be an immutable sha256 digest before publishing runtime evidence"
+    );
+  }
+  const manifestPath = import_node_path.default.join(projectRoot, "runtime-package-manifest.json");
+  let manifest;
+  try {
+    manifest = await import_promises.default.readFile(manifestPath);
+  } catch (error) {
+    if (!required && error.code === "ENOENT") {
+      return null;
+    }
+    throw new Error(
+      `Runtime package manifest is required for runtime evidence: ${manifestPath}`,
+      { cause: error }
+    );
+  }
+  return {
+    schemaVersion: 1,
+    projectSha,
+    imageDigest,
+    runtimePackageManifest: {
+      file: "runtime-package-manifest.json",
+      sha256: sha256(manifest)
+    }
+  };
+};
+
+// src/lib/runtimeEvidenceCompositionSnapshots.ts
+var SNAPSHOT_FILE = "snapshot.json";
+var MANIFEST_FILE = "manifest.json";
+var COMPLETE_FILE = ".complete";
+var createRuntimeEvidenceCompositionSnapshotRecorder = ({
+  persist,
+  onError
+}) => {
+  const completed = /* @__PURE__ */ new Set();
+  const inFlight = /* @__PURE__ */ new Set();
+  return {
+    observe(compositionId) {
+      if (completed.has(compositionId) || inFlight.has(compositionId)) return;
+      inFlight.add(compositionId);
+      void Promise.resolve().then(() => persist(compositionId)).then(() => completed.add(compositionId)).catch((error) => onError(compositionId, error)).finally(() => inFlight.delete(compositionId));
+    }
+  };
+};
+var isRecord3 = (value) => value != null && typeof value === "object" && !Array.isArray(value);
+var sha2562 = (value) => (0, import_node_crypto3.createHash)("sha256").update(value).digest("hex");
+var safeSegment = (value, label) => {
+  const normalized = value.trim();
+  if (!normalized || !/^[a-zA-Z0-9._:-]+$/.test(normalized)) {
+    throw new Error(`Invalid runtime evidence snapshot ${label}`);
+  }
+  return normalized;
+};
+var isExistingDestinationError = (error) => {
+  const code = error.code;
+  return code === "EEXIST" || code === "ENOTEMPTY";
+};
+var parseManifest = (value) => {
+  const manifest = isRecord3(value) ? value : null;
+  const payload = isRecord3(manifest?.payload) ? manifest.payload : null;
+  if (manifest?.schemaVersion !== 1 || manifest.reportType !== "runtime-evidence-composition-snapshot" || typeof manifest.createdAt !== "number" || typeof manifest.userName !== "string" || typeof manifest.deploymentId !== "string" || typeof manifest.deploymentCompositionId !== "string" || payload?.file !== SNAPSHOT_FILE || typeof payload.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(payload.sha256) || typeof payload.bytes !== "number") {
+    throw new Error("Invalid runtime evidence composition snapshot manifest");
+  }
+  return manifest;
+};
+var verifyRuntimeEvidenceCompositionSnapshot = async (bundleDir) => {
+  const [manifestText, payload, completeText] = await Promise.all([
+    import_promises2.default.readFile(import_node_path2.default.join(bundleDir, MANIFEST_FILE), "utf8"),
+    import_promises2.default.readFile(import_node_path2.default.join(bundleDir, SNAPSHOT_FILE)),
+    import_promises2.default.readFile(import_node_path2.default.join(bundleDir, COMPLETE_FILE), "utf8")
+  ]);
+  const manifest = parseManifest(JSON.parse(manifestText));
+  if (completeText.trim() !== manifest.deploymentCompositionId) {
+    throw new Error(`Invalid completion marker in ${bundleDir}`);
+  }
+  if (payload.byteLength !== manifest.payload.bytes || sha2562(payload) !== manifest.payload.sha256) {
+    throw new Error(
+      `Runtime evidence snapshot checksum mismatch in ${bundleDir}`
+    );
+  }
+  const value = JSON.parse(payload.toString("utf8"));
+  const record = isRecord3(value) ? value : null;
+  if (record?.schemaVersion !== 1 || record.reportType !== "runtime-evidence-composition-snapshot" || record.userName !== manifest.userName) {
+    throw new Error(
+      `Invalid runtime evidence snapshot payload in ${bundleDir}`
+    );
+  }
+  const deployment = parseRuntimeEvidenceDeploymentSnapshot(record.deployment);
+  const producer = parseRuntimeEvidenceProducer(record.producer);
+  if (deployment.id !== manifest.deploymentId || deployment.deploymentCompositionId !== manifest.deploymentCompositionId) {
+    throw new Error(
+      `Runtime evidence snapshot identity mismatch in ${bundleDir}`
+    );
+  }
+  return { bundleDir, deployment, producer };
+};
+var sameSnapshot = (snapshot, deployment, producer) => JSON.stringify(snapshot.deployment) === JSON.stringify(deployment) && JSON.stringify(snapshot.producer) === JSON.stringify(producer);
+var publishRuntimeEvidenceCompositionSnapshot = async ({
+  evidenceRoot,
+  userName,
+  deployment,
+  producer
+}) => {
+  const deploymentId = safeSegment(deployment.id, "deployment id");
+  const compositionId = safeSegment(
+    deployment.deploymentCompositionId,
+    "composition id"
+  );
+  const createdAt = Date.now();
+  const snapshot = {
+    schemaVersion: 1,
+    reportType: "runtime-evidence-composition-snapshot",
+    createdAt,
+    userName,
+    deployment,
+    producer
+  };
+  const payload = `${JSON.stringify(snapshot, null, 2)}
+`;
+  const manifest = {
+    schemaVersion: 1,
+    reportType: "runtime-evidence-composition-snapshot",
+    createdAt,
+    userName,
+    deploymentId,
+    deploymentCompositionId: compositionId,
+    payload: {
+      file: SNAPSHOT_FILE,
+      sha256: sha2562(payload),
+      bytes: Buffer.byteLength(payload)
+    }
+  };
+  const snapshotsRoot = import_node_path2.default.join(evidenceRoot, "snapshots", deploymentId);
+  const bundleDir = import_node_path2.default.join(snapshotsRoot, compositionId);
+  const temporaryDir = import_node_path2.default.join(
+    evidenceRoot,
+    "incoming",
+    `snapshot-${compositionId}.tmp-${(0, import_node_crypto3.randomUUID)()}`
+  );
+  await import_promises2.default.mkdir(temporaryDir, { recursive: true });
+  try {
+    await Promise.all([
+      import_promises2.default.writeFile(import_node_path2.default.join(temporaryDir, SNAPSHOT_FILE), payload, "utf8"),
+      import_promises2.default.writeFile(
+        import_node_path2.default.join(temporaryDir, MANIFEST_FILE),
+        `${JSON.stringify(manifest, null, 2)}
+`,
+        "utf8"
+      )
+    ]);
+    await import_promises2.default.writeFile(
+      import_node_path2.default.join(temporaryDir, COMPLETE_FILE),
+      `${compositionId}
+`,
+      "utf8"
+    );
+    await import_promises2.default.mkdir(snapshotsRoot, { recursive: true });
+    try {
+      await import_promises2.default.rename(temporaryDir, bundleDir);
+    } catch (error) {
+      if (!isExistingDestinationError(error)) throw error;
+      await import_promises2.default.rm(temporaryDir, { recursive: true, force: true });
+    }
+  } catch (error) {
+    await import_promises2.default.rm(temporaryDir, { recursive: true, force: true });
+    throw error;
+  }
+  const verified = await verifyRuntimeEvidenceCompositionSnapshot(bundleDir);
+  if (!sameSnapshot(verified, deployment, producer)) {
+    throw new Error(
+      `Conflicting runtime evidence snapshot for composition ${compositionId}`
+    );
+  }
+  return verified;
+};
+var captureRuntimeEvidenceCompositionSnapshot = async ({
+  projectRoot,
+  userName,
+  deploymentId,
+  expectedCompositionId
+}) => {
+  const [deployment, producer] = await Promise.all([
+    resolveRuntimeEvidenceDeploymentSnapshot({
+      userName,
+      projectRoot,
+      deploymentId
+    }),
+    resolveRuntimeEvidenceProducer({ projectRoot, required: true })
+  ]);
+  if (!producer) {
+    throw new Error("Runtime evidence producer identity is required");
+  }
+  if (deployment.deploymentCompositionId !== expectedCompositionId) {
+    throw new Error(
+      `Runtime deployment composition changed while capturing snapshot: expected ${expectedCompositionId}, received ${deployment.deploymentCompositionId}`
+    );
+  }
+  await publishRuntimeEvidenceCompositionSnapshot({
+    evidenceRoot: import_node_path2.default.join(projectRoot, "data", "runtime-evidence"),
+    userName,
+    deployment,
+    producer
+  });
+};
+
 // src/lib/signals/runner.ts
 var SLOW_SIGNALS_WARNING_MS = 10 * 6e4;
 var formatDuration2 = (durationMs) => `${(durationMs / 1e3).toFixed(1)}s`;
@@ -4952,6 +5314,19 @@ var resolveNonNegativeInteger = (value, fallback) => {
 var createSignalsRunner = (config2) => {
   const interval = config2.interval;
   const projectRoot = config2.projectRoot?.trim() || String(process.env.PROJECT_CWD || process.cwd()).trim() || process.cwd();
+  const compositionSnapshotRecorder = process.env.TRADEJS_PROJECT_SHA && process.env.TRADEJS_PROJECT_IMAGE_DIGEST && config2.deploymentId ? createRuntimeEvidenceCompositionSnapshotRecorder({
+    persist: (compositionId) => captureRuntimeEvidenceCompositionSnapshot({
+      projectRoot,
+      userName: config2.userName,
+      deploymentId: config2.deploymentId,
+      expectedCompositionId: compositionId
+    }),
+    onError: (compositionId, error) => import_logger4.logger.warn(
+      "runtime evidence snapshot unavailable; trading continues and the next cycle will retry (composition=%s): %s",
+      compositionId,
+      error instanceof Error ? error.message : String(error)
+    )
+  }) : null;
   const resolveSignalsDaemonMaxLiveBars = (runtimeInterval = interval) => {
     const intervalMinutes = Number(runtimeInterval);
     const preloadBars = Math.ceil(
@@ -4993,7 +5368,7 @@ var createSignalsRunner = (config2) => {
     return connectorName;
   };
   const createSignalsSession2 = async (lifecycle, scope = {}) => {
-    const deployment = config2.deploymentId ? await (0, import_runtimeStrategies2.getRuntimeDeployment)({
+    const deployment = config2.deploymentId ? await (0, import_runtimeStrategies3.getRuntimeDeployment)({
       userName: config2.userName,
       projectRoot,
       deploymentId: config2.deploymentId
@@ -5494,7 +5869,7 @@ var createSignalsRunner = (config2) => {
     if (!config2.deploymentId) {
       throw new Error("Runtime deployment id is required");
     }
-    const configuredDeployment = await (0, import_runtimeStrategies2.getRuntimeDeployment)({
+    const configuredDeployment = await (0, import_runtimeStrategies3.getRuntimeDeployment)({
       userName: config2.userName,
       projectRoot,
       deploymentId: config2.deploymentId
@@ -5528,7 +5903,7 @@ var createSignalsRunner = (config2) => {
       throw new Error("Runtime deployment id is required");
     }
     const deploymentId = config2.deploymentId;
-    const initialDeployment = await (0, import_runtimeStrategies2.getRuntimeDeployment)({
+    const initialDeployment = await (0, import_runtimeStrategies3.getRuntimeDeployment)({
       userName: config2.userName,
       projectRoot,
       deploymentId
@@ -5553,7 +5928,7 @@ var createSignalsRunner = (config2) => {
         settleDelayMs: resolveNonNegativeInteger(config2.settleDelayMs, 5e3),
         signal: abortController.signal,
         runCycle: async () => {
-          const currentDeployment = await (0, import_runtimeStrategies2.getRuntimeDeployment)({
+          const currentDeployment = await (0, import_runtimeStrategies3.getRuntimeDeployment)({
             userName: config2.userName,
             projectRoot,
             deploymentId
@@ -5561,6 +5936,9 @@ var createSignalsRunner = (config2) => {
           if (!currentDeployment) {
             throw new Error(`Runtime deployment not found: ${deploymentId}`);
           }
+          compositionSnapshotRecorder?.observe(
+            currentDeployment.deploymentCompositionId
+          );
           const scopes = await loadConfiguredSignalsScopes(currentDeployment);
           for (const [key, staleSession] of sessions) {
             if (scopes.has(key)) continue;