@verax-ai/body 0.1.0

package/dist/desktop.js

@@ -0,0 +1,341 @@
+import { spawn, spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { createConnection } from "node:net";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+const here = dirname(fileURLToPath(import.meta.url));
+const repoRoot = join(here, "..", "..", "..");
+/** Newest modification time under a file or directory, ignoring build output. */
+function newestUnder(path, since) {
+    let entry;
+    try {
+        entry = statSync(path);
+    }
+    catch {
+        return false;
+    }
+    if (!entry.isDirectory())
+        return entry.mtimeMs > since;
+    let names;
+    try {
+        names = readdirSync(path, { withFileTypes: true });
+    }
+    catch {
+        return false;
+    }
+    for (const name of names) {
+        if (name.name === "node_modules" || name.name === "dist" || name.name.startsWith("."))
+            continue;
+        if (newestUnder(join(path, name.name), since))
+            return true;
+    }
+    return false;
+}
+/**
+ * True when the panel has no build, or when a watched source is newer than the
+ * one it has. The launcher used to skip the build whenever `dist/index.html`
+ * existed, so a session served whatever had been built once: editing the panel
+ * and reopening it showed the previous app, with no sign that it was stale.
+ */
+export function panelBuildNeeded(distIndex, sourceRoots) {
+    let builtAt;
+    try {
+        builtAt = statSync(distIndex).mtimeMs;
+    }
+    catch {
+        return true;
+    }
+    return sourceRoots.some((root) => newestUnder(root, builtAt));
+}
+export function parseDesktopArgs(argv) {
+    const rest = argv.slice(1);
+    let stateDir = "";
+    let panelPort = 5173;
+    let issuerPort = Number(process.env.VERAX_DEV_ISSUER_PORT ?? "8790");
+    let bodyPort = 8787;
+    let browser;
+    let inventoryFile;
+    for (let i = 0; i < rest.length; i += 1) {
+        const a = rest[i];
+        if (a === "--state") {
+            stateDir = rest[++i] ?? "";
+            continue;
+        }
+        if (a === "--port") {
+            panelPort = Number(rest[++i]);
+            continue;
+        }
+        if (a === "--issuer-port") {
+            issuerPort = Number(rest[++i]);
+            continue;
+        }
+        if (a === "--body-port") {
+            bodyPort = Number(rest[++i]);
+            continue;
+        }
+        if (a === "--browser") {
+            browser = rest[++i];
+            continue;
+        }
+        if (a === "--inventory") {
+            inventoryFile = rest[++i];
+            continue;
+        }
+        if (a.startsWith("-"))
+            return { error: `flag-unknown:${a}` };
+    }
+    if (!stateDir)
+        return { error: "usage" };
+    if (![panelPort, issuerPort, bodyPort].every((n) => Number.isInteger(n) && n > 0 && n < 65536)) {
+        return { error: "port-invalid" };
+    }
+    return { stateDir, panelPort, issuerPort, bodyPort, browser, inventoryFile };
+}
+export function portOpen(port, host = "127.0.0.1") {
+    return new Promise((resolve) => {
+        const sock = createConnection({ port, host });
+        sock.once("connect", () => {
+            sock.end();
+            resolve(true);
+        });
+        sock.once("error", () => resolve(false));
+    });
+}
+async function waitPort(port, ms) {
+    const start = Date.now();
+    while (Date.now() - start < ms) {
+        if (await portOpen(port))
+            return true;
+        await new Promise((r) => setTimeout(r, 100));
+    }
+    return false;
+}
+export function killTree(pid) {
+    if (pid == null)
+        return;
+    if (process.platform === "win32") {
+        spawnSync("taskkill", ["/T", "/PID", String(pid), "/F"], { windowsHide: true, stdio: "ignore" });
+        return;
+    }
+    try {
+        process.kill(-pid, "SIGTERM");
+    }
+    catch {
+        try {
+            process.kill(pid, "SIGTERM");
+        }
+        catch {
+            // gone
+        }
+    }
+}
+/** The panel's redirect is its own origin, so the issuer has to be told which port
+ *  this run put it on: the allow-list default only holds 5173 and 4173. */
+export function issuerEnv(base, opts, audience, issuerUrl) {
+    return {
+        ...base,
+        NODE_ENV: "development",
+        VERAX_STATE_DIR: opts.stateDir,
+        VERAX_DEV_ISSUER_PORT: String(opts.issuerPort),
+        VERAX_AUDIENCE: audience,
+        VERAX_ISSUER: issuerUrl,
+        VERAX_DEV_REDIRECT_URIS: `http://127.0.0.1:${opts.panelPort}/`,
+    };
+}
+function cleanEnv() {
+    const env = { ...process.env, NO_COLOR: "1", FORCE_COLOR: "0" };
+    delete env.VERAX_DEV_TOKEN;
+    return env;
+}
+/**
+ * `windowsHide` is right for the servers: it keeps a console window off the
+ * screen. It is wrong for the browser. On Windows the flag becomes SW_HIDE in
+ * the child's STARTUPINFO, and Chrome and Edge honour it for their first
+ * window: the process starts, renderers run, the panel answers on its port,
+ * and the app window is created hidden. That is the desktop app opening to
+ * nothing. The browser must be spawned with the flag off.
+ */
+function spawnLogged(cmd, args, env, cwd, hideWindow = true) {
+    return spawn(cmd, args, {
+        cwd,
+        env,
+        stdio: ["ignore", "pipe", "pipe"],
+        windowsHide: hideWindow,
+        detached: process.platform !== "win32",
+    });
+}
+function defaultBrowser() {
+    const edge = [
+        "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
+        "C:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe",
+    ];
+    const chrome = [
+        "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
+        "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
+        "/usr/bin/google-chrome",
+    ];
+    for (const p of edge)
+        if (existsSync(p))
+            return p;
+    for (const p of chrome)
+        if (existsSync(p))
+            return p;
+    return null;
+}
+function collectOutput(child, sink) {
+    const feed = (c) => {
+        sink.text += String(c);
+    };
+    child.stdout?.on("data", feed);
+    child.stderr?.on("data", feed);
+}
+export async function runDesktop(opts, writeErr = (s) => process.stderr.write(s)) {
+    mkdirSync(opts.stateDir, { recursive: true });
+    const tokenPath = join(opts.stateDir, "dev-token");
+    const issuerScript = join(repoRoot, "scripts", "dev-issuer.mjs");
+    const mainTs = join(here, "main.ts");
+    const viteJs = join(repoRoot, "node_modules", "vite", "bin", "vite.js");
+    const panelDir = join(repoRoot, "apps", "panel");
+    const policy = join(repoRoot, "packages", "proxy", "policy", "default.json");
+    const audience = `http://127.0.0.1:${opts.bodyPort}`;
+    const issuerUrl = `http://127.0.0.1:${opts.issuerPort}`;
+    const kids = [];
+    const log = { text: "" };
+    const stopAll = () => {
+        for (const c of kids)
+            killTree(c.pid);
+    };
+    try {
+        const issuer = spawnLogged(process.execPath, ["--experimental-strip-types", issuerScript, "--out", tokenPath], issuerEnv(cleanEnv(), opts, audience, issuerUrl), repoRoot);
+        kids.push(issuer);
+        collectOutput(issuer, log);
+        if (!(await waitPort(opts.issuerPort, 15_000))) {
+            writeErr("desktop-issuer-timeout\n");
+            stopAll();
+            return 1;
+        }
+        const token = readFileSync(tokenPath, "utf8").trim();
+        if (token === "") {
+            writeErr("desktop-token-missing\n");
+            stopAll();
+            return 1;
+        }
+        const body = spawnLogged(process.execPath, ["--experimental-strip-types", mainTs], {
+            ...cleanEnv(),
+            VERAX_STATE_DIR: opts.stateDir,
+            VERAX_ISSUER: issuerUrl,
+            VERAX_JWKS_URL: `${issuerUrl}/.well-known/jwks.json`,
+            VERAX_AUDIENCE: audience,
+            VERAX_BIND: `127.0.0.1:${opts.bodyPort}`,
+            VERAX_POLICY_FILE: policy,
+            ...(opts.inventoryFile ? { VERAX_INVENTORY_FILE: opts.inventoryFile } : {}),
+        }, repoRoot);
+        kids.push(body);
+        collectOutput(body, log);
+        if (!(await waitPort(opts.bodyPort, 15_000))) {
+            writeErr("desktop-body-timeout\n");
+            stopAll();
+            return 1;
+        }
+        const panelSources = [
+            join(panelDir, "src"),
+            join(panelDir, "index.html"),
+            join(panelDir, "vite.config.ts"),
+            join(repoRoot, "packages"),
+        ];
+        if (panelBuildNeeded(join(panelDir, "dist", "index.html"), panelSources)) {
+            const built = spawnSync(process.execPath, [viteJs, "build"], {
+                cwd: panelDir,
+                env: { ...cleanEnv(), VERAX_BODY_URL: audience },
+                encoding: "utf8",
+                windowsHide: true,
+            });
+            if (built.status !== 0) {
+                const detail = `${built.stderr ?? ""}\n${built.stdout ?? ""}`.slice(0, 800);
+                writeErr(`desktop-panel-build-failed\n${detail}\n`);
+                stopAll();
+                return 1;
+            }
+        }
+        const panel = spawnLogged(process.execPath, [viteJs, "preview", "--host", "127.0.0.1", "--port", String(opts.panelPort), "--strictPort"], {
+            ...cleanEnv(),
+            VERAX_BODY_URL: audience,
+        }, panelDir);
+        kids.push(panel);
+        collectOutput(panel, log);
+        if (!(await waitPort(opts.panelPort, 20_000))) {
+            writeErr("desktop-panel-timeout\n");
+            stopAll();
+            return 1;
+        }
+        const url = `http://127.0.0.1:${opts.panelPort}`;
+        const scriptBrowser = Boolean(opts.browser && /\.(mjs|js|ts)$/.test(opts.browser));
+        const browserBin = scriptBrowser ? process.execPath : (opts.browser ?? defaultBrowser());
+        if (!browserBin) {
+            writeErr("desktop-browser-missing\n");
+            stopAll();
+            return 1;
+        }
+        const profileDir = join(opts.stateDir, "browser-profile");
+        mkdirSync(profileDir, { recursive: true });
+        const browserArgv = scriptBrowser
+            ? [opts.browser, url]
+            : [
+                `--user-data-dir=${profileDir}`,
+                "--no-first-run",
+                "--no-default-browser-check",
+                `--app=${url}`,
+                "--window-size=1360,880",
+            ];
+        const browser = spawnLogged(browserBin, browserArgv, cleanEnv(), repoRoot, false);
+        kids.push(browser);
+        collectOutput(browser, log);
+        if (log.text.includes(token)) {
+            writeErr("desktop-token-leaked\n");
+            stopAll();
+            return 1;
+        }
+        process.stdout.write(`desktop-ready issuer=${opts.issuerPort} body=${opts.bodyPort} panel=${opts.panelPort}\n`);
+        const onSignal = () => {
+            stopAll();
+            process.exit(1);
+        };
+        process.once("SIGINT", onSignal);
+        process.once("SIGTERM", onSignal);
+        const closed = new Promise((resolve) => {
+            browser.once("close", () => resolve());
+        });
+        const exitedEarly = await Promise.race([
+            closed.then(() => true),
+            new Promise((resolve) => {
+                setTimeout(() => resolve(false), 3_000);
+            }),
+        ]);
+        if (exitedEarly) {
+            writeErr("desktop-browser-exited-early\n");
+            process.removeListener("SIGINT", onSignal);
+            process.removeListener("SIGTERM", onSignal);
+            stopAll();
+            return 1;
+        }
+        await closed;
+        process.removeListener("SIGINT", onSignal);
+        process.removeListener("SIGTERM", onSignal);
+        stopAll();
+        return 0;
+    }
+    catch (err) {
+        stopAll();
+        const msg = err instanceof Error ? err.message : "unknown";
+        writeErr(`desktop-failed:${msg}\n`);
+        return 1;
+    }
+}
+export async function desktopMain(argv) {
+    const parsed = parseDesktopArgs(argv);
+    if ("error" in parsed) {
+        process.stderr.write("verax desktop [--state <dir>] [--port 5173] [--browser <cmd>] [--inventory <file>]\n");
+        return 78;
+    }
+    return runDesktop(parsed);
+}

package/dist/doctor.d.ts

@@ -0,0 +1,8 @@
+export type DoctorLevel = "ok" | "warn" | "fail";
+export type DoctorCheck = {
+    id: string;
+    level: DoctorLevel;
+    detail: string;
+};
+export declare function runDoctor(env: NodeJS.ProcessEnv, argv: readonly string[]): DoctorCheck[];
+export declare function doctorExit(checks: readonly DoctorCheck[]): number;

package/dist/doctor.js

@@ -0,0 +1,342 @@
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { loadConfig, isLoopbackHost } from "./config.js";
+import { pidAlive, readLockFile } from "./unlock.js";
+const SECRET_RE = /sk-|-----BEGIN|Bearer |eyJ[A-Za-z0-9_-]{10,}\./;
+const SECRET_NAME = /^(VERAX_DEV_TOKEN|.*_(TOKEN|SECRET|KEY))$/;
+export function runDoctor(env, argv) {
+    const checks = [];
+    const issuer = Boolean(env.VERAX_ISSUER?.trim());
+    const jwks = Boolean(env.VERAX_JWKS_URL?.trim());
+    const audience = Boolean(env.VERAX_AUDIENCE?.trim());
+    checks.push({
+        id: "issuer-jwks-audience",
+        level: issuer && jwks && audience ? "ok" : "fail",
+        detail: issuer && jwks && audience
+            ? "VERAX_ISSUER, VERAX_JWKS_URL, and VERAX_AUDIENCE are set"
+            : "one of VERAX_ISSUER, VERAX_JWKS_URL, VERAX_AUDIENCE is missing",
+    });
+    const loaded = loadConfig({
+        ...env,
+        VERAX_STATE_DIR: env.VERAX_STATE_DIR || "placeholder",
+        VERAX_POLICY_FILE: env.VERAX_POLICY_FILE || "placeholder",
+    });
+    if (loaded.ok) {
+        const loop = isLoopbackHost(loaded.value.bindHost);
+        if (loop) {
+            checks.push({ id: "bind", level: "ok", detail: `bind ${loaded.value.bindHost} is loopback` });
+        }
+        else if (loaded.value.tlsTerminated) {
+            checks.push({
+                id: "bind",
+                level: "ok",
+                detail: "non-loopback bind with VERAX_TLS_TERMINATED=1",
+            });
+        }
+        else {
+            checks.push({
+                id: "bind",
+                level: "fail",
+                detail: "non-loopback bind without VERAX_TLS_TERMINATED=1",
+            });
+        }
+    }
+    else if (loaded.reason.includes("non-loopback")) {
+        checks.push({ id: "bind", level: "fail", detail: loaded.reason });
+    }
+    else {
+        checks.push({ id: "bind", level: "warn", detail: "bind not judged; issuer triple incomplete" });
+    }
+    const stateDir = env.VERAX_STATE_DIR?.trim() ?? "";
+    if (stateDir === "" || !existsSync(stateDir)) {
+        checks.push({
+            id: "state-dir",
+            level: stateDir === "" ? "fail" : "warn",
+            detail: stateDir === "" ? "VERAX_STATE_DIR is missing" : "VERAX_STATE_DIR does not exist yet",
+        });
+    }
+    else if (process.platform === "win32") {
+        checks.push({
+            id: "state-dir",
+            level: "warn",
+            detail: "not checked on this platform",
+        });
+    }
+    else {
+        const mode = statSync(stateDir).mode & 0o777;
+        checks.push({
+            id: "state-dir",
+            level: (mode & 0o077) === 0 ? "ok" : "fail",
+            detail: (mode & 0o077) === 0
+                ? "VERAX_STATE_DIR is owner-only"
+                : `VERAX_STATE_DIR mode ${mode.toString(8)} is not 0700`,
+        });
+    }
+    if (stateDir !== "" && existsSync(stateDir)) {
+        if (existsSync(join(stateDir, "memory"))) {
+            checks.push({
+                id: "legacy-memory",
+                level: "warn",
+                detail: "legacy memory/ is present; reads do not merge it. Move records under tenants/<tenantKey>/memory/",
+            });
+        }
+        const lockPath = join(stateDir, "ledger.lock");
+        if (existsSync(lockPath)) {
+            const existing = readLockFile(lockPath);
+            if (!existing) {
+                checks.push({ id: "ledger-lock", level: "fail", detail: "ledger.lock is unreadable" });
+            }
+            else if (existing.pid === process.pid) {
+                checks.push({ id: "ledger-lock", level: "ok", detail: `ledger.lock is this process (${existing.pid})` });
+            }
+            else if (pidAlive(existing.pid)) {
+                checks.push({ id: "ledger-lock", level: "warn", detail: `ledger.lock is held by live pid ${existing.pid}` });
+            }
+            else {
+                checks.push({
+                    id: "ledger-lock",
+                    level: "fail",
+                    detail: `ledger.lock is held by dead pid ${existing.pid}; run: verax unlock ${stateDir}`,
+                });
+            }
+        }
+        checks.push(...evidenceChecks(stateDir, env));
+    }
+    const secretNames = Object.entries(env)
+        .filter(([k, v]) => Boolean(v) && (SECRET_NAME.test(k) || SECRET_RE.test(String(v))))
+        .map(([k]) => k);
+    const secretInArgv = argv.some((a) => SECRET_RE.test(a));
+    if (secretInArgv) {
+        checks.push({
+            id: "secrets-on-argv",
+            level: "fail",
+            detail: "process.argv matches sk-, PEM begin, Bearer, or JWT",
+        });
+    }
+    else if (secretNames.length > 0) {
+        checks.push({
+            id: "secrets-in-env",
+            level: "fail",
+            detail: `named env keys look secret: ${secretNames.join(", ")}`,
+        });
+    }
+    else {
+        checks.push({
+            id: "secrets-on-argv",
+            level: "ok",
+            detail: "no sk-, PEM, Bearer, or JWT pattern on argv or env",
+        });
+    }
+    const panelPort = panelPortOf(env);
+    const portSource = env.VERAX_PANEL_PORT?.trim() ? "VERAX_PANEL_PORT" : "the 5173 default, VERAX_PANEL_PORT unset";
+    const redirectUris = redirectAllowList(env);
+    const panelRedirect = `http://127.0.0.1:${panelPort}/`;
+    // Nothing here opens a port: the number comes from the environment, so both
+    // lines name where it came from and an ok cannot be read as a live check.
+    if (redirectUris.some((u) => sameRedirect(u, panelRedirect))) {
+        checks.push({
+            id: "panel-redirect-uri",
+            level: "ok",
+            detail: `panel port ${panelPort} (${portSource}) is on the issuer redirect allow-list`,
+        });
+    }
+    else {
+        checks.push({
+            id: "panel-redirect-uri",
+            level: "warn",
+            detail: `panel port ${panelPort} (${portSource}) is not on the issuer redirect allow-list; set VERAX_DEV_REDIRECT_URIS=${panelRedirect} or run verax desktop so it passes the panel port`,
+        });
+    }
+    const configuredIssuer = stripSlash(env.VERAX_ISSUER?.trim() ?? "");
+    const panelIssuer = stripSlash(env.VITE_VERAX_ISSUER?.trim() || "http://127.0.0.1:8790");
+    if (configuredIssuer !== "" && configuredIssuer === panelIssuer) {
+        checks.push({
+            id: "panel-issuer",
+            level: "ok",
+            detail: "panel last-resort issuer matches VERAX_ISSUER",
+        });
+    }
+    else if (configuredIssuer !== "") {
+        checks.push({
+            id: "panel-issuer",
+            level: "warn",
+            detail: `panel last-resort issuer ${panelIssuer} differs from VERAX_ISSUER ${configuredIssuer}; the session reads authorization_servers from resource metadata — if that document is unreachable the panel will not start`,
+        });
+    }
+    const tokenScope = scopeFromDevToken(env.VERAX_DEV_TOKEN);
+    const mintScope = env.VERAX_DEV_SCOPE?.trim() ?? "";
+    const seenScope = tokenScope ?? (mintScope !== "" ? mintScope : null);
+    if (seenScope !== null) {
+        const parts = seenScope.split(/\s+/).filter((s) => s !== "");
+        if (parts.includes("verax:audit")) {
+            checks.push({
+                id: "dev-token-audit",
+                level: "ok",
+                detail: "development token scope includes verax:audit",
+            });
+        }
+        else {
+            checks.push({
+                id: "dev-token-audit",
+                level: "warn",
+                detail: "development token scope lacks verax:audit; the panel cannot read /api/ledger or /healthz counts",
+            });
+        }
+    }
+    return checks;
+}
+const DEFAULT_REDIRECTS = ["http://127.0.0.1:5173/", "http://127.0.0.1:4173/"];
+function stripSlash(s) {
+    return s.replace(/\/$/, "");
+}
+function panelPortOf(env) {
+    const raw = env.VERAX_PANEL_PORT?.trim() ?? "";
+    const n = Number(raw);
+    if (Number.isInteger(n) && n > 0 && n < 65536)
+        return n;
+    return 5173;
+}
+function redirectAllowList(env) {
+    const raw = env.VERAX_DEV_REDIRECT_URIS ?? "";
+    const listed = raw
+        .split(",")
+        .map((s) => s.trim())
+        .filter((s) => s !== "");
+    return listed.length > 0 ? listed : DEFAULT_REDIRECTS;
+}
+function sameRedirect(a, b) {
+    try {
+        const na = new URL(a);
+        const nb = new URL(b);
+        const pa = na.pathname === "" ? "/" : na.pathname;
+        const pb = nb.pathname === "" ? "/" : nb.pathname;
+        return `${na.origin}${pa}` === `${nb.origin}${pb}`;
+    }
+    catch {
+        return false;
+    }
+}
+function scopeFromDevToken(raw) {
+    if (!raw || raw.trim() === "")
+        return null;
+    const parts = raw.trim().split(".");
+    if (parts.length < 2)
+        return null;
+    try {
+        const json = Buffer.from(parts[1], "base64url").toString("utf8");
+        const payload = JSON.parse(json);
+        return typeof payload.scope === "string" ? payload.scope : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function doctorExit(checks) {
+    return checks.some((c) => c.level === "fail") ? 1 : 0;
+}
+function countJsonl(path) {
+    if (!existsSync(path))
+        return { lines: 0, corrupt: false };
+    try {
+        const text = readFileSync(path, "utf8");
+        let lines = 0;
+        for (const line of text.split("\n")) {
+            if (line === "")
+                continue;
+            lines += 1;
+            try {
+                JSON.parse(line);
+            }
+            catch {
+                return { lines, corrupt: true };
+            }
+        }
+        return { lines, corrupt: false };
+    }
+    catch {
+        return { lines: 0, corrupt: true };
+    }
+}
+function heartbeatMaxMs(env) {
+    const n = Number(env.VERAX_HEARTBEAT_MAX_MS ?? "30000");
+    return Number.isFinite(n) && n > 0 ? n : 30_000;
+}
+function evidenceChecks(stateDir, env) {
+    const checks = [];
+    const src = countJsonl(join(stateDir, "decisions.jsonl"));
+    const hbPath = join(stateDir, "heartbeat.json");
+    let hb = null;
+    if (existsSync(hbPath)) {
+        try {
+            hb = JSON.parse(readFileSync(hbPath, "utf8"));
+        }
+        catch {
+            hb = null;
+        }
+    }
+    if (src.lines > 0 || hb) {
+        if (!hb || typeof hb.atMs !== "number") {
+            checks.push({
+                id: "heartbeat",
+                level: "fail",
+                detail: "ledger has rows but no readable heartbeat; the evidence service looks silent",
+            });
+        }
+        else if (Date.now() - hb.atMs > heartbeatMaxMs(env)) {
+            checks.push({
+                id: "heartbeat",
+                level: "fail",
+                detail: `heartbeat is silent; last pulse ${hb.atMs} lastDecisionN ${String(hb.lastDecisionN ?? "?")}`,
+            });
+        }
+        else {
+            checks.push({
+                id: "heartbeat",
+                level: "ok",
+                detail: `heartbeat live; lastDecisionN ${String(hb.lastDecisionN ?? "?")}`,
+            });
+        }
+    }
+    // Both halves of the evidence are mirrored, so both are compared: an effects
+    // copy that quietly drops rows is the same silence as a missing decision copy.
+    const srcEffects = countJsonl(join(stateDir, "effects.jsonl"));
+    const copy = countJsonl(join(stateDir, "evidence-copy", "decisions.jsonl"));
+    const copyEffects = countJsonl(join(stateDir, "evidence-copy", "effects.jsonl"));
+    const anything = src.lines > 0 ||
+        srcEffects.lines > 0 ||
+        copy.lines > 0 ||
+        copyEffects.lines > 0 ||
+        copy.corrupt ||
+        copyEffects.corrupt;
+    if (anything) {
+        if (copy.corrupt || copyEffects.corrupt) {
+            checks.push({
+                id: "evidence-copy",
+                level: "fail",
+                detail: `evidence-copy/${copy.corrupt ? "decisions" : "effects"}.jsonl is corrupt`,
+            });
+        }
+        else if (copy.lines < src.lines) {
+            checks.push({
+                id: "evidence-copy",
+                level: "fail",
+                detail: `evidence copy is stale: ${copy.lines} lines behind source ${src.lines}`,
+            });
+        }
+        else if (copyEffects.lines < srcEffects.lines) {
+            checks.push({
+                id: "evidence-copy",
+                level: "fail",
+                detail: `evidence copy is stale on effects: ${copyEffects.lines} effect line(s) behind source ${srcEffects.lines}`,
+            });
+        }
+        else {
+            checks.push({
+                id: "evidence-copy",
+                level: "ok",
+                detail: `evidence copy has ${copy.lines} decision line(s) and ${copyEffects.lines} effect line(s)`,
+            });
+        }
+    }
+    return checks;
+}

package/dist/halt.d.ts

@@ -0,0 +1 @@
+export declare function runHalt(stateDir: string, writeErr?: (s: string) => void): number;