@vibe-agent-toolkit/cli 0.2.0-rc.10 → 0.2.0-rc.12

package/dist/utils/resource-loader.js

@@ -4,10 +4,45 @@
 import { buildLinkAuthEngineConfig, buildResourcePopulation, DEFAULT_RESOURCE_INCLUDE, gitExtentSelected, ResourceRegistry, } from '@vibe-agent-toolkit/resources';
 import { relativeEscapesRoot, safePath, toForwardSlash } from '@vibe-agent-toolkit/utils';
 import { GitTracker, gitTreeSnapshot } from '@vibe-agent-toolkit/utils/git';
+import { CommandRefusalError } from './command-refusal.js';
 import { loadConfig } from './config-loader.js';
 import { collectionsOption } from './population-wiring.js';
 import { assertDirectoryArgument } from './project-root-policy.js';
 import { withPopulationCache } from './projection-store.js';
+/**
+ * The published `population` an observation implies: `null` for the walk —
+ * offered no source, or declined the one it was offered — because nothing was
+ * populated from or into the store.
+ *
+ * @param observation - The load's one observation
+ * @returns `'store'`, `'derived'` or `null`
+ */
+export function publishedPopulation(observation) {
+    return observation.lane === 'walk' ? null : observation.outcome.population;
+}
+/**
+ * Which enumerator the projection lane used, or `null` when the walk ran and
+ * there was no extent to source.
+ *
+ * Reported for the same reason the lane is, one level down. The lane
+ * distinguishes the walk from the projection; it does NOT distinguish the
+ * projection's two enumerators, and `VAT_EXTENT_SOURCE` is exactly the axis a
+ * flip decision turns on. Without this, both arms of that A/B report
+ * `projection` and two identical populations mean either "the enumerators
+ * agree" or "the switch was ignored" — indistinguishable, and the second is
+ * reachable, because `crawlSourceFor` falls back to the walk without saying so
+ * when the root is not in a repository.
+ *
+ * 🪤 NOT a cache-hit marker: on a hit no enumerator runs and it still names the
+ * one this process selected, because the source is chosen before the store is
+ * asked.
+ *
+ * @param population - The load's population
+ * @returns The enumerator, or `null` for the walk
+ */
+export function extentSourceOf(population) {
+    return population.lane === 'walk' ? null : population.extentSource;
+}
 /**
  * Refuse a `resources.linkAuth` provider that cannot compile HERE, where the
  * config is loaded, so every verb that loads it answers the same way.
@@ -49,6 +84,29 @@ export function scopeIncludeToSubtree(include, relDir) {
     }
     return include.map((pattern) => `${relDir}/${pattern}`);
 }
+/**
+ * Refuse a `--collection` that names no collection the project declares.
+ *
+ * A typo'd filter used to run the verb over zero resources and answer with a
+ * run-integrity finding (or, in `scan`, a zero count under the typo'd name) —
+ * a report about a collection that does not exist. It is the invocation's
+ * mistake, and `resources validate` and `resources scan` refuse it the same way.
+ * A declared collection that matched no file is NOT refused here: that is a run
+ * over nothing, and the writer's run-integrity refusal says so.
+ *
+ * @param config - The loaded project config, when there is one
+ * @param collection - The `--collection` value, when one was passed
+ * @throws {CommandRefusalError} `USAGE_INVALID` naming the declared collections
+ */
+export function assertDeclaredCollection(config, collection) {
+    if (collection === undefined)
+        return;
+    const declared = Object.keys(config?.resources?.collections ?? {});
+    if (declared.includes(collection))
+        return;
+    throw new CommandRefusalError('USAGE_INVALID', `--collection ${collection} names no collection in resources.collections`
+        + ` (declared: ${declared.length === 0 ? 'none' : declared.join(', ')})`);
+}
 /**
  * Build the crawl options for an explicit path argument.
  *
@@ -74,7 +132,7 @@ function crawlOptionsForPath(pathArg, projectRoot, config, logger) {
         // them silently — silent dropping is the bug this function exists to fix.
         logger.warn(`${resolved} is outside projectRoot ${projectRoot}; ` +
             `resources include/exclude patterns from the config do not apply to it`);
-        return { baseDir: resolved, unreadable: RESOURCES_UNREADABLE };
+        return { baseDir: resolved, unreadable: RESOURCES_UNREADABLE, outputs: [] };
     }
     // The crawler used to perform this check itself, because it received the path
     // argument as its `baseDir`. Now that `baseDir` is the project root, a bad path
@@ -84,6 +142,8 @@ function crawlOptionsForPath(pathArg, projectRoot, config, logger) {
     return {
         baseDir: projectRoot,
         unreadable: RESOURCES_UNREADABLE,
+        // Every resources verb only reads the tree it crawls.
+        outputs: [],
         include: scopeIncludeToSubtree(DEFAULT_RESOURCE_INCLUDE, normalizedRelDir),
         ...(config?.resources?.exclude ? { exclude: config.resources.exclude } : {}),
     };
@@ -122,6 +182,21 @@ export const RESOURCES_CRAWL_PROJECTION = 'projection';
  * name it explicitly keep working and keep MEANING the same thing.
  */
 export const RESOURCES_CRAWL_WALK = 'walk';
+/**
+ * The debug line naming the lane a crawl was offered, for every verb that
+ * offers one. Each lane says it — a marker only one lane emitted would make the
+ * other identifiable by ABSENCE, which is indistinguishable from a build too
+ * old to have either lane — and there is no source only when the walk was
+ * selected, so the walk's line names {@link RESOURCES_CRAWL_WALK}.
+ *
+ * @param populationSource - The source offered to the crawl, if any
+ * @returns The line to log
+ */
+export function crawlLaneDebugLine(populationSource) {
+    return populationSource === undefined
+        ? `Enumerating via the incumbent walk (${RESOURCES_CRAWL_ENV}=${RESOURCES_CRAWL_WALK})`
+        : `Enumerating via the projection lane (${RESOURCES_CRAWL_ENV}=${RESOURCES_CRAWL_PROJECTION})`;
+}
 /**
  * Whether this process should source the resources population from a projection.
  *
@@ -140,9 +215,12 @@ export const RESOURCES_CRAWL_WALK = 'walk';
  * `LINK_BROKEN_FILE` is not reported on this lane.** That is a real loss, it is
  * known, and it is the cost this default was accepted at; closing it is its own
  * change (teaching an extent to admit `120000` entries as their own paths).
- * The omission is no longer SILENT — each declined link is an `info`
- * `EXTENT_SYMLINK_NOT_REALIZED` row, and a dangling in-root target is named
- * there as unrealized — but that row is not a `LINK_BROKEN_FILE` finding.
+ * The omission is no longer SILENT — each declined link is an `info` row under
+ * one of the four declined-link codes (`EXTENT_SYMLINK_NOT_REALIZED`,
+ * `EXTENT_SYMLINK_TARGET_OUTSIDE_ROOT`, `EXTENT_SYMLINK_TARGET_UNRESOLVED` for a
+ * dangling in-root target, `EXTENT_SYMLINK_TARGET_UNREADABLE` for one the OS
+ * would not resolve) — but no such row is a `LINK_BROKEN_FILE`
+ * finding.
  * {@link RESOURCES_CRAWL_WALK} is the one-value escape hatch meanwhile.
  *
  * Read from the environment at each call rather than memoized at module load:
@@ -179,42 +257,39 @@ export function resourcesProjectionCrawlSelected() {
  * would admit the ignored half of a git tree rather than decline it. See
  * `buildResourcePopulation`.
  *
+ * The enumeration's outcome and enumerator travel back on what `enumerate`
+ * returns, and from there on what `ResourceRegistry.crawl` returns — never on a
+ * side channel this closure writes to.
+ *
  * @param root - The root this source may answer for, and no other
  * @param gitTracker - The run's ignore oracle
- * @param observeExtentSource - Called with the enumerator that actually ran,
- *   once per enumerated root. The value cannot be recovered afterwards by
- *   re-reading the environment — see {@link ResourceLoadResult.extentSource}.
- *   🪤 On a cache hit NO enumerator runs and this still reports the one this
- *   process selected, because the source is chosen before the store is asked
  * @param cache - The run's projection store, or `undefined` to enumerate every
  *   time. A SEPARATE selector from {@link RESOURCES_CRAWL_ENV}: which lane
  *   enumerates and whether its answer is cached are independent choices, and a
  *   cache folded into the lane switch could never be measured against it
  * @returns A population source, or `undefined` to use the walk
  */
-function populationSourceFor(root, gitTracker, observeExtentSource, cache) {
+function populationSourceFor(root, gitTracker, cache) {
     if (!resourcesProjectionCrawlSelected()) {
         return undefined;
     }
     return {
         root: safePath.resolve(root),
-        enumerate: async (enumeratedRoot) => {
-            const population = await buildResourcePopulation({
-                root: enumeratedRoot,
-                gitTracker,
-                ...(cache !== undefined && { cache }),
-                // `enumeratedRoot` and this source's own `root` are the SAME directory,
-                // always: `populationFrom` compares them and declines outright when they
-                // differ, so `enumerate` is never called for another tree. Reading the
-                // declarations off the root being enumerated is therefore not a guard
-                // against a second root — it is how the declaration and the enumeration
-                // are kept demonstrably on one tree at the point of use, with no second
-                // variable to fall out of step with the one that was checked.
-                ...collectionsOption(enumeratedRoot),
-            });
-            observeExtentSource(population.extentSource);
-            return { paths: population.paths, conditions: population.conditions };
-        },
+        // `outputs` come from the crawl that asks (the registry's one declaration of what its verb writes).
+        enumerate: (enumeratedRoot, outputs) => buildResourcePopulation({
+            root: enumeratedRoot,
+            outputs,
+            // `enumeratedRoot` and this source's own `root` are the SAME directory,
+            // always: `populationFrom` compares them and declines outright when they
+            // differ, so `enumerate` is never called for another tree. Reading the
+            // declarations off the root being enumerated is therefore not a guard
+            // against a second root — it is how the declaration and the enumeration
+            // are kept demonstrably on one tree at the point of use, with no second
+            // variable to fall out of step with the one that was checked.
+            gitTracker,
+            ...(cache !== undefined && { cache }),
+            ...collectionsOption(enumeratedRoot),
+        }),
     };
 }
 /**
@@ -248,29 +323,31 @@ function populationSourceFor(root, gitTracker, observeExtentSource, cache) {
  * @param options.gitTracker - An already-initialized tracker to reuse. Omit to
  *   have one built, which costs a `git ls-files` spawn — and only when the lane
  *   is actually selected
- * @param options.observeExtentSource - Called with the enumerator that ran, once
- *   per enumerated root. 🪤 NOT a cache-hit marker: on a hit no enumerator runs
- *   and this still reports the one this process selected
  * @param work - Given the source, or `undefined` when the walk stays selected
  * @returns Whatever `work` returned
  */
-export async function withResourcePopulationSource(options, work) {
-    // Checked before anything is built or opened: an unselected lane must cost
-    // nothing, or every command pays a tracker and a store to decline them.
-    if (!resourcesProjectionCrawlSelected()) {
-        return work(undefined);
-    }
-    const gitTracker = options.gitTracker ?? new GitTracker(options.root);
-    return withPopulationCache({ root: options.root }, async (cache) => {
-        // Initialized inside the bracket for the reason `loadResourcesWithConfig`
-        // gives at its own call: the store has already taken the snapshot that
-        // answers this tracker's question, so asking git again is a spawn spent
-        // rebuilding a set the process is holding.
-        if (options.gitTracker === undefined) {
-            await gitTracker.initialize();
+export function withResourcePopulationSource(options, work) {
+    try {
+        // Checked before anything is built or opened: an unselected lane must cost
+        // nothing, or every command pays a tracker and a store to decline them.
+        if (!resourcesProjectionCrawlSelected()) {
+            return work(undefined);
         }
-        return work(populationSourceFor(options.root, gitTracker, options.observeExtentSource ?? (() => undefined), cache));
-    });
+        const gitTracker = options.gitTracker ?? new GitTracker(options.root);
+        return withPopulationCache({ root: options.root }, async (cache) => {
+            // Initialized inside the bracket for the reason `loadResourcesWithConfig`
+            // gives at its own call: the store has already taken the snapshot that
+            // answers this tracker's question, so asking git again is a spawn spent
+            // rebuilding a set the process is holding.
+            if (options.gitTracker === undefined) {
+                await gitTracker.initialize();
+            }
+            return work(populationSourceFor(options.root, gitTracker, cache));
+        });
+    }
+    catch (error) {
+        return Promise.reject(error);
+    }
 }
 /**
  * Load resources from a path with config support
@@ -298,11 +375,12 @@ export async function withResourcePopulationSource(options, work) {
  * @param pathArg - Path argument from CLI (optional)
  * @param projectRoot - Pre-resolved project root from the CLI boundary
  * @param logger - Logger instance
- * @returns Resource load result with registry and metadata
+ * @returns Resource load result with registry, metadata and the population the
+ *   crawl returned
  */
 export async function loadResourcesWithConfig(pathArg, projectRoot, logger) {
     // Config lookup is anchored at the resolved projectRoot.
-    const config = loadConfig(projectRoot);
+    const config = loadConfig(projectRoot, 'source');
     if (config) {
         logger.debug(`Loaded config from ${projectRoot}`);
         assertLinkAuthProvidersCompile(config);
@@ -343,6 +421,7 @@ export async function loadResourcesWithConfig(pathArg, projectRoot, logger) {
         crawlOptions = {
             baseDir: projectRoot,
             unreadable: RESOURCES_UNREADABLE,
+            outputs: [],
             // Apply include patterns from config (if specified)
             ...(config?.resources?.include ? { include: config.resources.include } : {}),
             // Apply exclude patterns from config (if specified)
@@ -352,11 +431,10 @@ export async function loadResourcesWithConfig(pathArg, projectRoot, logger) {
     // Which lane enumerates. Applied to the options both branches above produced,
     // so the path-argument case and the whole-root case cannot end up on different
     // crawlers — the bug shape this file already carries one fix for.
-    let extentSource = null;
     // The store brackets the crawl and is closed however the crawl ends. Nothing
     // outside this bracket can reach it: the population source is called from
     // inside `registry.crawl` and nowhere else.
-    const lane = await withPopulationCache({ root: projectRoot }, async (cache) => {
+    const population = await withPopulationCache({ root: projectRoot }, async (cache) => {
         // The git enumerator takes a `gitTreeSnapshot` during the crawl below no matter
         // what. Taking it HERE instead is the same snapshot moved a few lines earlier —
         // the open bracket memoizes it, so the enumerator's own call becomes a lookup —
@@ -384,23 +462,14 @@ export async function loadResourcesWithConfig(pathArg, projectRoot, logger) {
         // no snapshot was taken the peek misses and it spawns exactly as before.
         await gitTracker.initialize();
         logger.debug(`GitTracker initialized with ${gitTracker.getStats().cacheSize} tracked files`);
-        const populationSource = populationSourceFor(projectRoot, gitTracker, (kind) => {
-            extentSource = kind;
-        }, cache);
-        const selected = populationSource ? 'projection' : 'walk';
+        const populationSource = populationSourceFor(projectRoot, gitTracker, cache);
+        logger.debug(crawlLaneDebugLine(populationSource));
         if (populationSource) {
-            logger.debug(`Enumerating via the projection lane (${RESOURCES_CRAWL_ENV}=${RESOURCES_CRAWL_PROJECTION})`);
             crawlOptions = { ...crawlOptions, populationSource };
         }
-        else {
-            // Said for the same reason the projection branch says it, and the symmetry
-            // is the point: a marker that only one lane emits makes the other lane
-            // identifiable by ABSENCE, which is indistinguishable from a build too old
-            // to have either lane.
-            logger.debug(`Enumerating via the incumbent walk (${RESOURCES_CRAWL_ENV} unset)`);
-        }
-        await registry.crawl(crawlOptions);
-        return selected;
+        // Read off what the crawl RETURNED, so a crawl that declined the source
+        // reports the walk it actually took — with no enumerator.
+        return (await registry.crawl(crawlOptions)).population;
     });
     return {
         scanPath: pathArg ?? projectRoot,
@@ -408,8 +477,7 @@ export async function loadResourcesWithConfig(pathArg, projectRoot, logger) {
         config,
         registry,
         gitTracker,
-        lane,
-        extentSource,
+        population,
     };
 }
 //# sourceMappingURL=resource-loader.js.map

package/dist/utils/resource-loader.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource-loader.js","sourceRoot":"","sources":["../../src/utils/resource-loader.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,iBAAiB,EACjB,gBAAgB,GAOjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC1F,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAE5E,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AA2C5D;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,8BAA8B,CAAC,MAAqB;IAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC;IAC5C,IAAI,QAAQ,KAAK,SAAS;QAAE,yBAAyB,CAAC,QAAQ,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAA0B,EAAE,MAAc;IAC9E,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,mBAAmB,CAC1B,OAAe,EACf,WAAmB,EACnB,MAAiC,EACjC,MAAc;IAEd,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,qEAAqE;IACrE,wEAAwE;IACxE,MAAM,gBAAgB,GAAG,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;IAElF,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC1C,2EAA2E;QAC3E,yEAAyE;QACzE,0EAA0E;QAC1E,MAAM,CAAC,IAAI,CACT,GAAG,QAAQ,2BAA2B,WAAW,IAAI;YACnD,uEAAuE,CAC1E,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,oBAAoB,EAAE,CAAC;IACjE,CAAC;IAED,8EAA8E;IAC9E,gFAAgF;IAChF,8EAA8E;IAC9E,mCAAmC;IACnC,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAElC,OAAO;QACL,OAAO,EAAE,WAAW;QACpB,UAAU,EAAE,oBAAoB;QAChC,OAAO,EAAE,qBAAqB,CAAC,wBAAwB,EAAE,gBAAgB,CAAC;QAC1E,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7E,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,oBAAoB,GAAG,QAAiB,CAAC;AAE/C;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAEzD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,0BAA0B,GAAG,YAAY,CAAC;AAEvD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAE3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,gCAAgC;IAC9C,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,KAAK,oBAAoB,CAAC;AACnE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,SAAS,mBAAmB,CAC1B,IAAY,EACZ,UAAsB,EACtB,mBAAoD,EACpD,KAAkC;IAElC,IAAI,CAAC,gCAAgC,EAAE,EAAE,CAAC;QACxC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;QAC5B,SAAS,EAAE,KAAK,EAAE,cAAsB,EAAE,EAAE;YAC1C,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC;gBAC/C,IAAI,EAAE,cAAc;gBACpB,UAAU;gBACV,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC;gBACrC,wEAAwE;gBACxE,yEAAyE;gBACzE,uEAAuE;gBACvE,sEAAsE;gBACtE,wEAAwE;gBACxE,wEAAwE;gBACxE,8DAA8D;gBAC9D,GAAG,iBAAiB,CAAC,cAAc,CAAC;aACrC,CAAC,CAAC;YACH,mBAAmB,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;YAC7C,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC;QACxE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAIC,EACD,IAA4E;IAE5E,2EAA2E;IAC3E,wEAAwE;IACxE,IAAI,CAAC,gCAAgC,EAAE,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtE,OAAO,mBAAmB,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACjE,0EAA0E;QAC1E,uEAAuE;QACvE,wEAAwE;QACxE,2CAA2C;QAC3C,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,UAAU,CAAC,UAAU,EAAE,CAAC;QAChC,CAAC;QAED,OAAO,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,mBAAmB,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IACtH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAA2B,EAC3B,WAAmB,EACnB,MAAc;IAEd,yDAAyD;IACzD,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IAEvC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,KAAK,CAAC,sBAAsB,WAAW,EAAE,CAAC,CAAC;QAClD,8BAA8B,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC;IAE/C,4BAA4B;IAC5B,qEAAqE;IACrE,EAAE;IACF,+EAA+E;IAC/E,6EAA6E;IAC7E,+EAA+E;IAC/E,6EAA6E;IAC7E,sEAAsE;IACtE,6EAA6E;IAC7E,2EAA2E;IAC3E,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,eAAe,GAA4B;QAC/C,OAAO,EAAE,WAAW;QACpB,UAAU;QACV,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;KAC5C,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAC;IAEvD,IAAI,YAA0B,CAAC;IAE/B,IAAI,OAAO,EAAE,CAAC;QACZ,wEAAwE;QACxE,wDAAwD;QACxD,MAAM,CAAC,KAAK,CAAC,2BAA2B,OAAO,EAAE,CAAC,CAAC;QACnD,YAAY,GAAG,mBAAmB,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACzE,MAAM,CAAC,KAAK,CAAC,YAAY,YAAY,CAAC,OAAO,kBAAkB,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACzG,CAAC;SAAM,CAAC;QACN,gEAAgE;QAChE,MAAM,CAAC,KAAK,CAAC,4BAA4B,WAAW,EAAE,CAAC,CAAC;QAExD,YAAY,GAAG;YACb,OAAO,EAAE,WAAW;YACpB,UAAU,EAAE,oBAAoB;YAChC,oDAAoD;YACpD,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,oDAAoD;YACpD,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7E,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,+EAA+E;IAC/E,kEAAkE;IAClE,IAAI,YAAY,GAA2B,IAAI,CAAC;IAChD,6EAA6E;IAC7E,0EAA0E;IAC1E,4CAA4C;IAC5C,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QAC5E,gFAAgF;QAChF,gFAAgF;QAChF,gFAAgF;QAChF,uEAAuE;QACvE,EAAE;QACF,+EAA+E;QAC/E,0EAA0E;QAC1E,8EAA8E;QAC9E,yDAAyD;QACzD,EAAE;QACF,6EAA6E;QAC7E,0EAA0E;QAC1E,6EAA6E;QAC7E,6EAA6E;QAC7E,6EAA6E;QAC7E,6EAA6E;QAC7E,wDAAwD;QACxD,IAAI,gCAAgC,EAAE,IAAI,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;YACzE,eAAe,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC;QACxC,CAAC;QAED,2EAA2E;QAC3E,2EAA2E;QAC3E,+EAA+E;QAC/E,8EAA8E;QAC9E,yEAAyE;QACzE,MAAM,UAAU,CAAC,UAAU,EAAE,CAAC;QAC9B,MAAM,CAAC,KAAK,CAAC,+BAA+B,UAAU,CAAC,QAAQ,EAAE,CAAC,SAAS,gBAAgB,CAAC,CAAC;QAE7F,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,WAAW,EAAE,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;YAC7E,YAAY,GAAG,IAAI,CAAC;QACtB,CAAC,EAAE,KAAK,CAAC,CAAC;QACV,MAAM,QAAQ,GAAsB,gBAAgB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;QAC7E,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,CAAC,KAAK,CAAC,wCAAwC,mBAAmB,IAAI,0BAA0B,GAAG,CAAC,CAAC;YAC3G,YAAY,GAAG,EAAE,GAAG,YAAY,EAAE,gBAAgB,EAAE,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,2EAA2E;YAC3E,uEAAuE;YACvE,2EAA2E;YAC3E,uBAAuB;YACvB,MAAM,CAAC,KAAK,CAAC,uCAAuC,mBAAmB,SAAS,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACnC,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ,EAAE,OAAO,IAAI,WAAW;QAChC,WAAW;QACX,MAAM;QACN,QAAQ;QACR,UAAU;QACV,IAAI;QACJ,YAAY;KACb,CAAC;AACJ,CAAC"}
+{"version":3,"file":"resource-loader.js","sourceRoot":"","sources":["../../src/utils/resource-loader.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,iBAAiB,EACjB,gBAAgB,GASjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC1F,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAE5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAU5D;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAA4B;IAC9D,OAAO,WAAW,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,cAAc,CAAC,UAA2B;IACxD,OAAO,UAAU,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC;AACrE,CAAC;AAyBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,8BAA8B,CAAC,MAAqB;IAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC;IAC5C,IAAI,QAAQ,KAAK,SAAS;QAAE,yBAAyB,CAAC,QAAQ,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAA0B,EAAE,MAAc;IAC9E,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAiC,EAAE,UAA8B;IACxG,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO;IACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO;IAC1C,MAAM,IAAI,mBAAmB,CAC3B,eAAe,EACf,gBAAgB,UAAU,+CAA+C;UACrE,eAAe,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC3E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,mBAAmB,CAC1B,OAAe,EACf,WAAmB,EACnB,MAAiC,EACjC,MAAc;IAEd,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,qEAAqE;IACrE,wEAAwE;IACxE,MAAM,gBAAgB,GAAG,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;IAElF,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC1C,2EAA2E;QAC3E,yEAAyE;QACzE,0EAA0E;QAC1E,MAAM,CAAC,IAAI,CACT,GAAG,QAAQ,2BAA2B,WAAW,IAAI;YACnD,uEAAuE,CAC1E,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,oBAAoB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC9E,CAAC;IAED,8EAA8E;IAC9E,gFAAgF;IAChF,8EAA8E;IAC9E,mCAAmC;IACnC,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAElC,OAAO;QACL,OAAO,EAAE,WAAW;QACpB,UAAU,EAAE,oBAAoB;QAChC,sDAAsD;QACtD,OAAO,EAAE,EAAE;QACX,OAAO,EAAE,qBAAqB,CAAC,wBAAwB,EAAE,gBAAgB,CAAC;QAC1E,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7E,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,oBAAoB,GAAG,QAAiB,CAAC;AAE/C;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAEzD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,0BAA0B,GAAG,YAAY,CAAC;AAEvD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAE3C;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,gBAAsD;IACvF,OAAO,gBAAgB,KAAK,SAAS;QACnC,CAAC,CAAC,uCAAuC,mBAAmB,IAAI,oBAAoB,GAAG;QACvF,CAAC,CAAC,wCAAwC,mBAAmB,IAAI,0BAA0B,GAAG,CAAC;AACnG,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,UAAU,gCAAgC;IAC9C,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,KAAK,oBAAoB,CAAC;AACnE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,SAAS,mBAAmB,CAC1B,IAAY,EACZ,UAAsB,EACtB,KAAkC;IAElC,IAAI,CAAC,gCAAgC,EAAE,EAAE,CAAC;QACxC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;QAC5B,oGAAoG;QACpG,SAAS,EAAE,CAAC,cAAsB,EAAE,OAA0B,EAAE,EAAE,CAChE,uBAAuB,CAAC;YACtB,IAAI,EAAE,cAAc;YACpB,OAAO;YACP,wEAAwE;YACxE,yEAAyE;YACzE,uEAAuE;YACvE,sEAAsE;YACtE,wEAAwE;YACxE,wEAAwE;YACxE,8DAA8D;YAC9D,UAAU;YACV,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC;YACrC,GAAG,iBAAiB,CAAC,cAAc,CAAC;SACrC,CAAC;KACL,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAGC,EACD,IAA4E;IAE5E,IAAI,CAAC;QACH,2EAA2E;QAC3E,wEAAwE;QACxE,IAAI,CAAC,gCAAgC,EAAE,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC;QACzB,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEtE,OAAO,mBAAmB,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YACjE,0EAA0E;YAC1E,uEAAuE;YACvE,wEAAwE;YACxE,2CAA2C;YAC3C,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBACrC,MAAM,UAAU,CAAC,UAAU,EAAE,CAAC;YAChC,CAAC;YAED,OAAO,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,OAAO,CAAC,MAAM,CAAC,KAAc,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAA2B,EAC3B,WAAmB,EACnB,MAAc;IAEd,yDAAyD;IACzD,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAEjD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,KAAK,CAAC,sBAAsB,WAAW,EAAE,CAAC,CAAC;QAClD,8BAA8B,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC;IAE/C,4BAA4B;IAC5B,qEAAqE;IACrE,EAAE;IACF,+EAA+E;IAC/E,6EAA6E;IAC7E,+EAA+E;IAC/E,6EAA6E;IAC7E,sEAAsE;IACtE,6EAA6E;IAC7E,2EAA2E;IAC3E,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,eAAe,GAA4B;QAC/C,OAAO,EAAE,WAAW;QACpB,UAAU;QACV,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;KAC5C,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAC;IAEvD,IAAI,YAA0B,CAAC;IAE/B,IAAI,OAAO,EAAE,CAAC;QACZ,wEAAwE;QACxE,wDAAwD;QACxD,MAAM,CAAC,KAAK,CAAC,2BAA2B,OAAO,EAAE,CAAC,CAAC;QACnD,YAAY,GAAG,mBAAmB,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACzE,MAAM,CAAC,KAAK,CAAC,YAAY,YAAY,CAAC,OAAO,kBAAkB,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACzG,CAAC;SAAM,CAAC;QACN,gEAAgE;QAChE,MAAM,CAAC,KAAK,CAAC,4BAA4B,WAAW,EAAE,CAAC,CAAC;QAExD,YAAY,GAAG;YACb,OAAO,EAAE,WAAW;YACpB,UAAU,EAAE,oBAAoB;YAChC,OAAO,EAAE,EAAE;YACX,oDAAoD;YACpD,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,oDAAoD;YACpD,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7E,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,+EAA+E;IAC/E,kEAAkE;IAClE,6EAA6E;IAC7E,0EAA0E;IAC1E,4CAA4C;IAC5C,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QAClF,gFAAgF;QAChF,gFAAgF;QAChF,gFAAgF;QAChF,uEAAuE;QACvE,EAAE;QACF,+EAA+E;QAC/E,0EAA0E;QAC1E,8EAA8E;QAC9E,yDAAyD;QACzD,EAAE;QACF,6EAA6E;QAC7E,0EAA0E;QAC1E,6EAA6E;QAC7E,6EAA6E;QAC7E,6EAA6E;QAC7E,6EAA6E;QAC7E,wDAAwD;QACxD,IAAI,gCAAgC,EAAE,IAAI,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;YACzE,eAAe,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC;QACxC,CAAC;QAED,2EAA2E;QAC3E,2EAA2E;QAC3E,+EAA+E;QAC/E,8EAA8E;QAC9E,yEAAyE;QACzE,MAAM,UAAU,CAAC,UAAU,EAAE,CAAC;QAC9B,MAAM,CAAC,KAAK,CAAC,+BAA+B,UAAU,CAAC,QAAQ,EAAE,CAAC,SAAS,gBAAgB,CAAC,CAAC;QAE7F,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,WAAW,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;QAC7E,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACnD,IAAI,gBAAgB,EAAE,CAAC;YACrB,YAAY,GAAG,EAAE,GAAG,YAAY,EAAE,gBAAgB,EAAE,CAAC;QACvD,CAAC;QAED,wEAAwE;QACxE,0DAA0D;QAC1D,OAAO,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ,EAAE,OAAO,IAAI,WAAW;QAChC,WAAW;QACX,MAAM;QACN,QAAQ;QACR,UAAU;QACV,UAAU;KACX,CAAC;AACJ,CAAC"}

package/dist/utils/run-integrity.d.ts

@@ -26,27 +26,32 @@
  * 1. **Code {@link RUN_INTEGRITY_CODE} — `RESOURCE_CHECK_BROKEN` — and never a
  *    sibling per site.** It is the registry's one run-integrity claim — *these
  *    assertions did not execute meaningfully, so the green means nothing* — and
- *    `ValidationConfigSchema` refuses it as a `severity` key, which is what makes
- *    it non-overridable by construction. A code per site would buy a consumer
+ *    it is a registered REFUSAL code, which `ValidationConfigSchema` refuses as a
+ *    `severity` or `allow` key — what makes it non-overridable by construction. A code per site would buy a consumer
  *    nothing the message does not already say while adding one more thing an
  *    adopter's CI has to know to look for.
  * 2. **Severity `error`, and not a parameter.** The one thing that must never be
  *    configurable about "the gate did not do its job" is whether it gates.
- * 3. **Derived inside the DOCUMENT builder, never asserted in a handler.** The
- *    builder is the one function every lane's document passes through, so
- *    deriving the refusal there lands it after `resolveIssueSeverity` and
- *    `applyAllowFilter` and makes "denominator zero, status clean"
- *    unrepresentable rather than merely unwritten. A pure function, unit-testable
- *    without I/O.
- * 4. **ONE finding per run**, however many things went unmatched. The claim is
- *    about the RUN; one per argument is per-finding duplication.
+ * 3. **Derived once, in the writer, from the verb's declared denominator.**
+ *    {@link withRunIntegrity} is the one function every lane's `Report` passes
+ *    through on its way out, so deriving the refusal there lands it after
+ *    `resolveIssueSeverity` and `applyAllowFilter` and makes "denominator zero,
+ *    status clean" unrepresentable rather than merely unwritten. A pure
+ *    function, unit-testable without I/O — no verb decides this at its own site.
+ *    An orchestrated PHASE passes through the same function, with its verb's own
+ *    declaration, before it is folded (`phaseVerdict` in `commands/phase-utils.ts`):
+ *    judged on the orchestrator's sum alone, a configured phase that examined
+ *    nothing was hidden by a healthy phase beside it — the tenth instance.
+ * 4. **ONE finding per run of a verb**, however many things went unmatched. The
+ *    claim is about the RUN; one per argument is per-finding duplication. An
+ *    orchestrator carries each phase's own, at most one per phase.
  * 5. **The message says what did not run and what the operator can do.** It
  *    must not claim the corpus is broken — it claims the run is not a verdict.
  * 6. **stderr may still carry a human warning; the document and the exit code
  *    must agree with it.** The human channel and the machine channel were what
  *    disagreed in every shipped instance, and only the machine channel gates.
  */
-import type { ValidationIssue } from '@vibe-agent-toolkit/schema';
+import { type Report, type ValidationIssue } from '@vibe-agent-toolkit/schema';
 /**
  * The code every run-integrity refusal carries.
  *
@@ -54,8 +59,8 @@ import type { ValidationIssue } from '@vibe-agent-toolkit/schema';
  * compile, a corpus with no members, a run with no rules, a run that was killed,
  * a scan that matched no file, a walk that missed a declared plugin, a phase that
  * found no bundle — all are the same claim to a consumer, and they need the
- * identical non-overridability, which
- * `ValidationConfigSchema` grants by refusing this code as a `severity` key.
+ * identical non-overridability, which the registry grants by registering it as
+ * a REFUSAL — a kind `ValidationConfigSchema` refuses as a `severity` or `allow` key.
  */
 export declare const RUN_INTEGRITY_CODE = "RESOURCE_CHECK_BROKEN";
 /**
@@ -70,26 +75,54 @@ export declare const RUN_INTEGRITY_CODE = "RESOURCE_CHECK_BROKEN";
  */
 export declare function runIntegrityFinding(message: string): ValidationIssue;
 /**
- * The refusal for a run whose denominator is zero — nothing was checked.
+ * What a report's `examined` counts, and what an operator should check when
+ * it is zero — the two facts only the verb knows, so {@link withRunIntegrity}
+ * can name them without asking WHY the denominator is zero — an absent config
+ * block, a filter that matched nothing and a typo'd glob all arrive as zero.
+ */
+export interface ExaminedDeclaration {
+    /** What `examined` counts, plural noun: 'files', 'skills', 'rows of the population', 'search roots'. */
+    readonly unit: string;
+    /** What an operator should check when it is zero — the site-specific remedy. */
+    readonly whenZero: string;
+}
+/**
+ * The single point every completed {@link Report} passes through on its way
+ * out: adds the one `RESOURCE_CHECK_BROKEN` refusal-as-finding when `examined`
+ * is zero, so no verb decides this at its own site (invariant 3 above).
  *
- * 🪤 **It asks the DENOMINATOR, never the config.** A builder cannot see why
- * nothing ran and deliberately does not ask. An absent config block, a filter
- * that matched nothing, a glob with a typo, a directory that was never built —
- * all arrive as the same document, and all of them are a gate that asserted
- * nothing. The message is where a site names the likely causes and the remedy.
+ * Stands down (returns `report` unchanged) in three cases: `status: 'error'`
+ * — a run that did not finish is not a run that examined nothing, and its own
+ * `error` already carries the refusal; `examined > 0` — the positive control;
+ * and a findings list that already carries a refusal-kind code (invariant 4 —
+ * one refusal per run, whichever the site already published wins over the
+ * generic one).
  *
- * 🪤 **One report per situation.** A run that already carries a run-integrity
- * finding (an interrupted run, say) has the more specific of the two claims on
- * the document, so this stands down rather than handing the operator two reports
- * about one situation. Nothing weaker is needed: every such finding is `error`,
- * so the status is already refused.
+ * @param report - The completed or failed report, as the verb built it
+ * @param examined - What `examined` counts and the remedy for zero
+ * @returns `report` unchanged, or rebuilt with the one refusal finding added
+ */
+export declare function withRunIntegrity<T>(report: Report<T>, examined: ExaminedDeclaration): Report<T>;
+/**
+ * The success line a verb may print over its run — invariant 6's stderr half,
+ * and the one rule for it: `success` when the run examined something, a
+ * not-a-verdict line otherwise. Every shipped instance of the class printed a
+ * green line directly above the refusal its own document carried.
+ *
+ * @param examined - The run's `examined`, as its report counts it
+ * @param success - The verb's own success line; its leading whitespace is kept
+ * @returns The line to print
+ */
+export declare function verdictBanner(examined: number, success: string): string;
+/**
+ * The human half of a run-integrity refusal: each `RESOURCE_CHECK_BROKEN`
+ * finding's message, on stderr. It decides nothing — the document is what
+ * gates — but a refusal only in the document never reached the operator
+ * reading the terminal.
  *
- * @param denominator - How many things the run actually checked
- * @param issues - What the run already found, so an existing run-integrity
- *   report is not duplicated
- * @param message - The site's own account of what did not run and what to do;
- *   evaluated lazily so a populated run pays nothing for it
- * @returns The one finding, or nothing when at least one thing was checked
+ * A command lane calls it with the writer's published report when the writer
+ * ADDED the refusal (`publishedReport(verb, report) !== report`); a phase warns
+ * its own site-specific refusal where every lane sees it.
  */
-export declare function nothingCheckedFinding(denominator: number, issues: readonly ValidationIssue[], message: () => string): readonly ValidationIssue[];
+export declare function warnRunIntegrity(report: Report<unknown>): void;
 //# sourceMappingURL=run-integrity.d.ts.map

package/dist/utils/run-integrity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-integrity.d.ts","sourceRoot":"","sources":["../../src/utils/run-integrity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAElE;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,0BAA0B,CAAC;AAE1D;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,CAEpE;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,SAAS,eAAe,EAAE,EAClC,OAAO,EAAE,MAAM,MAAM,GACpB,SAAS,eAAe,EAAE,CAI5B"}
+{"version":3,"file":"run-integrity.d.ts","sourceRoot":"","sources":["../../src/utils/run-integrity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,EAML,KAAK,MAAM,EACX,KAAK,eAAe,EACrB,MAAM,4BAA4B,CAAC;AAEpC;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,0BAAgD,CAAC;AAEhF;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,CAEpE;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,wGAAwG;IACxG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gFAAgF;IAChF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,mBAAmB,GAAG,MAAM,CAAC,CAAC,CAAC,CAkB/F;AAKD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,CAI9D"}