agentfootprint 9.75.0 → 9.76.1

package/dist/types/core/flowchartAsTool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"flowchartAsTool.d.ts","sourceRoot":"","sources":["../../../src/core/flowchartAsTool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqHG;AAEH,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,eAAe,EACrB,MAAM,aAAa,CAAC;AAYrB,OAAO,KAAK,EAAE,IAAI,EAAwB,MAAM,YAAY,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACnF;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,QAAQ,EAAE,qBAAqB,KAAK,MAAM,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,yCAAyC;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACzD;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,qBAAqB,CAAC;IAC9C;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IACrD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,sBAAsB,GAAG,IAAI,CAqJlE"}
+{"version":3,"file":"flowchartAsTool.d.ts","sourceRoot":"","sources":["../../../src/core/flowchartAsTool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2HG;AAEH,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,eAAe,EACrB,MAAM,aAAa,CAAC;AAYrB,OAAO,KAAK,EAAE,IAAI,EAAwB,MAAM,YAAY,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACnF;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,QAAQ,EAAE,qBAAqB,KAAK,MAAM,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,yCAAyC;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACzD;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,qBAAqB,CAAC;IAC9C;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IACrD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,sBAAsB,GAAG,IAAI,CAsJlE"}

package/dist/types/core/runbook/coverage.d.ts

@@ -0,0 +1,70 @@
+/**
+ * runbook/coverage — the spine's ledger: inner folds + chart-declared
+ * entries + the bridge's own, and the sentence naming the rules.
+ *
+ * Pattern: pure fold over three sources, reusing the coverage primitives'
+ *          own recognizer and merge — no second grammar.
+ * Role:    core/runbook.
+ * Emits:   N/A.
+ *
+ * The three sources, in the order they land:
+ *   1. INNER LEDGERS — every recorded inner call's result is read by the
+ *      same `readCoverageResult` funnel the dispatch loop uses, and its
+ *      three lists fold upward. An inner tool's honesty is carried, never
+ *      re-authored.
+ *   2. THE CHART'S OWN — the procedure states run-specific coverage by
+ *      writing a `coverage` state key (`{ checked?, not_checked?,
+ *      cannot_cover? }`, items as `{what, why?}` bags or bare strings).
+ *      This is the app's vocabulary (which counters mean "not assessed" is
+ *      the chart's to know); the ENVELOPE is the bridge's.
+ *   3. THE BRIDGE'S OWN — one `checked` entry naming the procedure, its
+ *      recorded step count and the rule set it ran under; and, for a
+ *      verdict-shaped runbook, a `not_checked` entry counting DECLINED rows
+ *      (the three-outcome honesty: a row that reached no classification is
+ *      ground the answer does not cover).
+ */
+import type { CoverageItem } from '../agent/coverage/types.js';
+import type { InnerCallRecord } from './dispatch.js';
+import type { RunbookRules } from './types.js';
+/** The three lists, mid-fold. */
+export interface LedgerLists {
+    readonly checked: readonly CoverageItem[];
+    readonly notChecked: readonly CoverageItem[];
+    readonly cannotCover: readonly CoverageItem[];
+}
+/** Fold every recorded inner call's declared coverage upward. */
+export declare function foldInnerCoverage(records: readonly InnerCallRecord[]): LedgerLists;
+/** The chart-declared lists, read off the final state's `coverage` key.
+ *  Accepts both spellings of the two-word keys (state is often snake_case,
+ *  the declaration camelCase) — one reader, no drift. */
+export declare function chartCoverageOf(state: Readonly<Record<string, unknown>>): LedgerLists;
+/** What the composed ledger needs to know about this run. */
+export interface LedgerFacts {
+    readonly chartName: string;
+    readonly stepsExecuted: number;
+    readonly rules?: RunbookRules;
+    /** Rowset facts — present only for a verdict-shaped runbook. */
+    readonly rowsTotal?: number;
+    readonly declinedRows?: number;
+}
+/** The composed `af_coverage` value: three merged lists + the static law
+ *  note + this run's own sentence. */
+export interface ComposedLedger {
+    readonly checked?: readonly CoverageItem[];
+    readonly not_checked?: readonly CoverageItem[];
+    readonly cannot_cover?: readonly CoverageItem[];
+    readonly note: string;
+    readonly sentence: string;
+}
+/** Compose the whole ledger. Inner folds land first, chart-declared second,
+ *  the bridge's own last — provenance order, so a reader meets the sources
+ *  before the summary. */
+export declare function composeLedger(inner: LedgerLists, chart: LedgerLists, facts: LedgerFacts): ComposedLedger;
+/**
+ * The carried provenance stamp: the FIRST inner result that declared an
+ * `af_provenance` (on its unwrapped payload, or at its top level — both are
+ * read, in that order). A derived answer is still an answer, and a source's
+ * confession (`source: 'LOCAL SEED'`) must survive composition.
+ */
+export declare function carriedProvenanceOf(records: readonly InnerCallRecord[]): Record<string, unknown> | undefined;
+//# sourceMappingURL=coverage.d.ts.map

package/dist/types/core/runbook/coverage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"coverage.d.ts","sourceRoot":"","sources":["../../../../src/core/runbook/coverage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAKH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,iCAAiC;AACjC,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;IAC1C,QAAQ,CAAC,UAAU,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C,QAAQ,CAAC,WAAW,EAAE,SAAS,YAAY,EAAE,CAAC;CAC/C;AAID,iEAAiE;AACjE,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,GAAG,WAAW,CAkBlF;AAwBD;;yDAEyD;AACzD,wBAAgB,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,WAAW,CASrF;AAED,6DAA6D;AAC7D,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;sCACsC;AACtC,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAC3C,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAOD;;0BAE0B;AAC1B,wBAAgB,aAAa,CAC3B,KAAK,EAAE,WAAW,EAClB,KAAK,EAAE,WAAW,EAClB,KAAK,EAAE,WAAW,GACjB,cAAc,CA8ChB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,SAAS,eAAe,EAAE,GAClC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAerC"}

package/dist/types/core/runbook/dispatch.d.ts

@@ -0,0 +1,70 @@
+/**
+ * runbook/dispatch — the bridge's wrapper over `ctx.tools`.
+ *
+ * Pattern: decorator over {@link ToolDispatch}. The RAW dispatch (delivered
+ *          by the agent) returns every result untouched; POLICY about what a
+ *          result means belongs to the consumer — and this is the runbook's
+ *          policy: every inner outcome is RECORDED (for the coverage fold and
+ *          the provenance carry), and an inner ABSENCE short-circuits the
+ *          procedure unless the call site declared it survivable.
+ * Role:    core/runbook, pure.
+ * Emits:   N/A.
+ *
+ * WHY an absence short-circuits: "the inventory found nothing" IS the
+ * runbook's answer, and it must go back EXACTLY as it arrived so the
+ * framework still reads it as an absence — a verdict reached over a source
+ * that answered "nothing here" would be the confident-partial-answer failure
+ * this whole envelope exists to prevent. A stage that can genuinely carry on
+ * without the source says so at the call site (`{ allowAbsent: true }`) and
+ * owns stating the gap (usually as a coverage entry).
+ */
+import type { ToolAbsence } from '../agent/coverage/types.js';
+import type { ToolDispatch } from '../tools.js';
+/** One inner call, as the bridge recorded it. */
+export interface InnerCallRecord {
+    readonly tool: string;
+    readonly outcome: 'ok' | 'absent' | 'error';
+    /** The raw returned value (`'ok'` and `'absent'` outcomes). */
+    readonly result?: unknown;
+}
+/** The marker property that survives any error wrapping between a stage and
+ *  the bridge's catch. */
+declare const ABSENCE_SIGNAL: "af_runbook_absence";
+/**
+ * The control signal an un-survivable inner absence throws through the
+ * chart. The engine commits staged state and rethrows (commit-on-error is
+ * the law upstream), so the bridge catches this at `executor.run` and
+ * returns the absence verbatim.
+ */
+export declare class RunbookAbsenceSignal extends Error {
+    readonly absence: ToolAbsence;
+    readonly [ABSENCE_SIGNAL] = true;
+    constructor(absence: ToolAbsence, innerTool: string);
+}
+/** Recognize the signal on an error OR anywhere down its `cause` chain — an
+ *  engine layer that wraps the stage's throw must not defeat the pass-through. */
+export declare function absenceSignalOf(err: unknown): RunbookAbsenceSignal | undefined;
+/** What `recordingDispatch` hands back: the dispatch the procedure closes
+ *  over, and the record the envelope folds. */
+export interface RecordedDispatch {
+    readonly tools: ToolDispatch;
+    readonly records: readonly InnerCallRecord[];
+}
+/**
+ * Wrap the delivered dispatch (or its absence) for one runbook invocation.
+ *
+ * With NO dispatch delivered (`ctx.tools` absent — a hand-built context, a
+ * door with no dispatch map) the wrapper is the fail-closed teacher: `has`
+ * answers false and `call` refuses naming the fix, so a procedure that needs
+ * inner tools fails loudly at its first call instead of half-running.
+ */
+export declare function recordingDispatch(delivered: ToolDispatch | undefined, runbookName: string): RecordedDispatch;
+/**
+ * The definition-time probe dispatch — handed to the procedure factory ONCE
+ * at `runbookAsTool(...)` so the bridge can read the chart's declared
+ * contract. Stage bodies do not run at build; a factory that calls tools at
+ * build time hears exactly why that cannot work.
+ */
+export declare function probeDispatch(runbookName: string): ToolDispatch;
+export {};
+//# sourceMappingURL=dispatch.d.ts.map

package/dist/types/core/runbook/dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../../../src/core/runbook/dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAA2B,MAAM,aAAa,CAAC;AAEzE,iDAAiD;AACjD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,IAAI,GAAG,QAAQ,GAAG,OAAO,CAAC;IAC5C,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;0BAC0B;AAC1B,QAAA,MAAM,cAAc,sBAAgC,CAAC;AAErD;;;;;GAKG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAEjC,QAAQ,CAAC,OAAO,EAAE,WAAW;IADzC,QAAQ,CAAC,CAAC,cAAc,CAAC,QAAQ;gBACZ,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM;CAQ7D;AAED;kFACkF;AAClF,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,oBAAoB,GAAG,SAAS,CAS9E;AAED;+CAC+C;AAC/C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,CAAC;CAC9C;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,YAAY,GAAG,SAAS,EACnC,WAAW,EAAE,MAAM,GAClB,gBAAgB,CAiClB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,YAAY,CAW/D"}

package/dist/types/core/runbook/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * runbook — the standard bridge from a footprintjs procedure to an Agent
+ * tool with the mandatory honesty spine. See README.md in this folder.
+ */
+export { runbookAsTool } from './runbookAsTool.js';
+export { absenceSignalOf, probeDispatch, recordingDispatch, RunbookAbsenceSignal, type InnerCallRecord, type RecordedDispatch, } from './dispatch.js';
+export { DECLINED_VERDICT, DEFAULT_MAX_ROWS, renderVerdictTable, VERDICT_RENDER_NOTE, verdictRowsOf, } from './verdicts.js';
+export { DEFAULT_WALK_CAP, projectWalk, type ProjectedWalk, type WalkRow } from './walk.js';
+export type { RunbookAsToolOptions, RunbookEnvelope, RunbookProcedure, RunbookRules, RunbookVerdictsOptions, RunbookWalkOptions, VerdictRow, WalkDescriptor, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/types/core/runbook/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/runbook/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EACL,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,oBAAoB,EACpB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,KAAK,aAAa,EAAE,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AAC5F,YAAY,EACV,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,EAClB,UAAU,EACV,cAAc,GACf,MAAM,YAAY,CAAC"}

package/dist/types/core/runbook/report.d.ts

@@ -0,0 +1,53 @@
+/**
+ * runbook/report — the chart's own `report` bag, admitted UNDER the envelope.
+ *
+ * Pattern: one pure partition (admitted fields / refused names) plus the
+ *          sentence that names what was refused. No behavior beyond the law.
+ * Role:    core/runbook. `runbookAsTool.ts` consumes at assembly time.
+ * Emits:   N/A.
+ *
+ * THE PRECEDENCE LAW: the names the envelope itself assembles — the honesty
+ * spine, and the projection keys this run actually produced — are RESERVED.
+ * A chart's `report` may add fields BESIDE them; it may never replace one.
+ * The spine is the boundary of the answer, and a boundary a chart can
+ * overwrite is a boundary that reports whatever the chart says about itself:
+ * a seeded number could arrive stamped as a sourced one, or an answer
+ * produced under one reading of the rules could name a version it never ran.
+ * A `report` key spelled `af_coverage` is refused too — it lands one level
+ * under the real ledger, which is exactly where a decoy would want to sit.
+ *
+ * AND WHY THE REFUSAL IS SPOKEN, not silent: every other reduction this
+ * envelope performs is declared out loud — the walk's `projection`, the
+ * rowset's `rows_complete`, declined rows counted into the ledger. Dropping
+ * a field the chart wrote with no trace would be the one silent edit in an
+ * envelope whose whole argument is that reductions are declared, and the
+ * author would debug "where did my field go?" against a shape that never
+ * mentions it. So a collision costs one `report_note` naming every refused
+ * field — present ONLY when something was actually refused, so the clean
+ * path (every real runbook) pays nothing.
+ */
+/** The ledger's key. It lives at the ENVELOPE's top level, and is reserved
+ *  inside `result` too — see the module header. */
+export declare const LEDGER_KEY = "af_coverage";
+/** The key the refusal note ships under — itself reserved, because a
+ *  chart-authored `report_note` is a forged receipt for a refusal that
+ *  never happened. */
+export declare const REPORT_NOTE_KEY = "report_note";
+/** The chart's `report`, partitioned against the names the envelope owns. */
+export interface AdmittedReport {
+    /** The fields that may be spread into `result`, in the chart's own order. */
+    readonly fields: Record<string, unknown>;
+    /** The names refused, in the chart's own order — empty on the clean path. */
+    readonly refused: readonly string[];
+}
+/**
+ * Partition the chart's `report` against the names this envelope assembled.
+ * `assembled` is read from the actual spine and projection objects, never
+ * from a hand-listed copy — a spine field added later is protected the day
+ * it lands.
+ */
+export declare function admitReport(report: Readonly<Record<string, unknown>>, assembled: Iterable<string>): AdmittedReport;
+/** The sentence for a refused collision: which fields were discarded, whose
+ *  the surviving values are, and what is safe to read. */
+export declare function shadowedFieldsNote(refused: readonly string[]): string;
+//# sourceMappingURL=report.d.ts.map

package/dist/types/core/runbook/report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../../../src/core/runbook/report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH;mDACmD;AACnD,eAAO,MAAM,UAAU,gBAAgB,CAAC;AAExC;;sBAEsB;AACtB,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAE7C,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,GAC1B,cAAc,CAUhB;AAED;0DAC0D;AAC1D,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAUrE"}

package/dist/types/core/runbook/runbookAsTool.d.ts

@@ -0,0 +1,91 @@
+/**
+ * runbookAsTool — turn a written operational procedure into a tool whose
+ * every answer is EVIDENCE: who decided what, against which threshold, on
+ * which rule version, with the recorded walk to check it against.
+ *
+ * The standard bridge from a footprintjs chart to the Agent's tool surface.
+ * Where `flowchartAsTool` returns bare `JSON.stringify(values)`,
+ * runbookAsTool supplies the missing middle — the honesty envelope every
+ * hand-rolled triage tool was building for itself:
+ *
+ *   THE MANDATORY SPINE (every runbook, whatever its shape):
+ *     - `af_coverage` — the three-list ledger, with every INNER tool's own
+ *       ledger folded upward through the run's dispatch, plus the sentence
+ *       naming the rule set and version;
+ *     - `result.af_provenance` — re-emitted FIRST (a carried `LOCAL SEED`
+ *       confession survives composition);
+ *     - `result.rule_version` — the declared rules' version, or the honest
+ *       `'undeclared'`;
+ *     - `result.walk` — the recorded walk's descriptor. The walk itself
+ *       ships as an artifact ticket (kind `recording/chart-walk`), never as
+ *       bytes; when it does not fit, the CONTROL FLOW survives and the
+ *       projection is declared.
+ *
+ *   THE OPTIONAL PROJECTION (selected by `resultKind: 'verdict/*'`):
+ *     verdict rows off the chart's `verdicts` state key, capped with
+ *     truthful counters, a pre-rendered table over the SAME rows, and
+ *     `verdict_meanings` GENERATED from the decider's declared branches +
+ *     the rule labels this run's decide() evidence carried.
+ *
+ *   THREE OUTCOMES, honestly: a clean envelope; an inner ABSENCE passed
+ *   through verbatim (the framework still reads it as an absence); and
+ *   DECLINED rows counted into the ledger as not-checked ground.
+ *
+ * The procedure is a FACTORY invoked per call with the run's own tool
+ * dispatch (`ctx.tools`) — fresh chart every run, stages close over the
+ * dispatch, and every inner tool's honesty ledger folds into this tool's
+ * answer.
+ *
+ * Reserved state keys the bridge reads off the final scope:
+ *   - `verdicts` — the rowset (verdict projection only);
+ *   - `coverage` — chart-declared coverage entries (`{checked?, not_checked?,
+ *     cannot_cover?}`);
+ *   - `report`  — the app's own result fields, spread into `result` verbatim
+ *     BESIDE the spine, never over it: the envelope's own names (the spine
+ *     plus the projection this run assembled) are reserved, and a report
+ *     field spelling one of them is discarded and NAMED in `report_note`.
+ *
+ * Pause: NOT yet bridged. A paused inner chart throws with the checkpoint
+ * attached, exactly like `flowchartAsTool` — the approval-gate integration
+ * is the next phase of the runbook program.
+ *
+ * @example the smallest legal call — still yields the honest spine
+ *   const tool = runbookAsTool({
+ *     name: 'restart_check',
+ *     description: 'Run the restart-safety procedure.',
+ *     procedure: () =>
+ *       flowChart<{ safe: boolean }>('restart-safety', (scope) => {
+ *         scope.safe = true;
+ *       }, 'check').build(),
+ *   });
+ *
+ * @example a triage runbook with rules, verdicts, and an inner tool
+ *   const triage = runbookAsTool({
+ *     name: 'backup_triage',
+ *     description: 'Assess backup protection posture for every subject.',
+ *     resultKind: 'verdict/backup-posture',
+ *     rules: { name: 'health-signal', version: 'v1' },
+ *     verdicts: { decider: 'posture' },
+ *     composedOf: ['backup_inventory'],
+ *     procedure: (tools) =>
+ *       flowChart<TriageState>('backup-triage', async (scope) => {
+ *         const inner = (await tools.call('backup_inventory', {})) as InventoryResult;
+ *         scope.subjects = inner.result.rows;
+ *       }, 'inventory')
+ *         .addDeciderFunction('Posture', postureDecider, 'posture')
+ *           .addFunctionBranch('protected', 'Protected', landProtected)
+ *           .addFunctionBranch('unprotected', 'Unprotected', landUnprotected)
+ *           .end()
+ *         .build(),
+ *   });
+ */
+import { type Tool } from '../tools.js';
+import type { RunbookAsToolOptions } from './types.js';
+/**
+ * Wrap a footprintjs procedure as a `Tool` whose every answer carries the
+ * honesty spine. See the module header for the envelope; see
+ * {@link RunbookAsToolOptions} for the full options bag. The smallest legal
+ * call is `{ name, description, procedure }`.
+ */
+export declare function runbookAsTool(opts: RunbookAsToolOptions): Tool;
+//# sourceMappingURL=runbookAsTool.d.ts.map

package/dist/types/core/runbook/runbookAsTool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runbookAsTool.d.ts","sourceRoot":"","sources":["../../../../src/core/runbook/runbookAsTool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgFG;AAaH,OAAO,EAAc,KAAK,IAAI,EAA6B,MAAM,aAAa,CAAC;AAS/E,OAAO,KAAK,EAAE,oBAAoB,EAA+B,MAAM,YAAY,CAAC;AAuCpF;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,oBAAoB,GAAG,IAAI,CAsS9D"}

package/dist/types/core/runbook/types.d.ts

@@ -0,0 +1,204 @@
+/**
+ * runbook/types — the vocabulary of the runbook bridge.
+ *
+ * Pattern: one options bag, four concerns (declarations, procedure, evidence
+ *          policy, walk policy) + one envelope type split into a MANDATORY
+ *          SPINE and an OPTIONAL projection. Pure data, no behavior.
+ * Role:    core/ layer. `runbookAsTool.ts` consumes; consumers read the
+ *          envelope types when they assert on results.
+ * Emits:   N/A.
+ *
+ * The SPINE / PROJECTION split is load-bearing honesty, not taste: the spine
+ * (coverage, provenance, rule version, the recorded walk) is what EVERY
+ * runbook ships whatever its shape, so an answer can never arrive without its
+ * boundary; the verdict/rowset projection is one shape of answer (a triage),
+ * selected by `resultKind: 'verdict/*'` — an action-taking runbook ships the
+ * spine plus its own `report` payload and no rowset. The spine's wire shape
+ * is explicitly PROVISIONAL until a second, differently-shaped consumer has
+ * shipped through it.
+ */
+import type { CombinedRecorder, FlowChart, RedactionPolicy } from 'footprintjs';
+import type { CoverageItem } from '../agent/coverage/types.js';
+import type { ToolDispatch, ToolOwner, ToolResultCeiling } from '../tools.js';
+import type { ToolResultClass } from '../../lib/semantics/types.js';
+import type { ToolWants } from '../../artifacts/wants.js';
+/**
+ * The procedure: a factory invoked PER CALL with the run's own tool dispatch
+ * (`ctx.tools`), returning a FRESH chart whose stages close over it.
+ *
+ * Per call for two reasons that are really one: a chart shared between two
+ * runs is a chart whose closures belong to whichever run built it last, and
+ * the dispatch only exists at execute time — so the factory is both the
+ * fresh-chart law and the delivery mechanism.
+ *
+ * It is ALSO invoked once at definition time, with a probe dispatch whose
+ * `has` answers false and whose `call` refuses — to read the chart's declared
+ * contract (input schema, the named decider's branches). Stage bodies do not
+ * run at build, so a well-formed factory pays nothing; a factory with side
+ * effects at build time is a factory that lies about being a declaration.
+ */
+export type RunbookProcedure = (tools: ToolDispatch) => FlowChart;
+/** Rule provenance — threaded bridge → envelope → coverage sentence, so an
+ *  answer produced under one reading of the rules can be told apart from an
+ *  answer produced under the next. */
+export interface RunbookRules {
+    /** The rule set's name ('health-signal'). Non-empty. */
+    readonly name: string;
+    /** Its version stamp ('v1'). Non-empty; bump when the READING changes,
+     *  never for wording. */
+    readonly version: string;
+}
+/** The verdict/rowset projection's dials. */
+export interface RunbookVerdictsOptions {
+    /**
+     * The decider stage (by id or name) whose declared branch labels generate
+     * `verdict_meanings`. Branch descriptions come from the chart's own
+     * structure when the decider is statically declared; rule labels observed
+     * in this run's decide() evidence refine them (and are the only source
+     * when the decider lives inside a dynamically generated fan-out branch,
+     * where build-time structure cannot see it).
+     */
+    readonly decider: string;
+    /** Cap on `verdicts` rows AND the rendered table — ONE number for both
+     *  halves (a longer list beside a shorter table is an invitation to retype
+     *  identifiers). Default 50. */
+    readonly maxRows?: number;
+}
+/** The walk policy. */
+export interface RunbookWalkOptions {
+    /** Row cap on the minted walk (default 500). When the full walk does not
+     *  fit, the CONTROL FLOW survives — see `walk.ts` for the projection law. */
+    readonly cap?: number;
+}
+/** Everything `runbookAsTool` accepts. Smallest legal call:
+ *  `{ name, description, procedure }` — and it still yields the spine. */
+export interface RunbookAsToolOptions {
+    /** Tool name the LLM dispatches by. */
+    readonly name: string;
+    /** REQUIRED — a description-less tool is invisible to the model. */
+    readonly description: string;
+    /** The procedure factory — see {@link RunbookProcedure}. */
+    readonly procedure: RunbookProcedure;
+    /** Selects the envelope projection (`'verdict/*'` gets the rowset) AND is
+     *  the artifact kind a placed result is minted under. */
+    readonly resultKind?: string;
+    readonly resultClass?: ToolResultClass;
+    readonly owner?: ToolOwner;
+    readonly resultCeiling?: ToolResultCeiling;
+    readonly wants?: ToolWants;
+    readonly argumentsFrom?: readonly string[];
+    /** The named ingredient tools the procedure calls through `ctx.tools` —
+     *  drift-checked at agent build. */
+    readonly composedOf?: readonly string[];
+    /** Explicit input schema wins; otherwise the chart's `.contract()` input
+     *  is lifted when it is a plain JSON-Schema object (a parseable schema —
+     *  zod et al. — cannot be serialized for the model and falls back to the
+     *  empty-object default). */
+    readonly inputSchema?: Readonly<Record<string, unknown>>;
+    /** Rule provenance — see {@link RunbookRules}. */
+    readonly rules?: RunbookRules;
+    /** The verdict projection's dials — see {@link RunbookVerdictsOptions}. */
+    readonly verdicts?: RunbookVerdictsOptions;
+    /** The walk policy — see {@link RunbookWalkOptions}. */
+    readonly walk?: RunbookWalkOptions;
+    /** Observers attached to each invocation's fresh inner executor. */
+    readonly recorders?: ReadonlyArray<CombinedRecorder>;
+    /** Keep each invocation's inner record for `inspect_tool_run` descent. */
+    readonly keepRecord?: boolean;
+    /** Bounded LRU size for kept records (requires `keepRecord: true`). */
+    readonly keepRecordLimit?: number;
+    /** Redaction policy for the inner run (commit-time scrub). */
+    readonly redact?: RedactionPolicy;
+}
+/**
+ * The recorded-walk descriptor — ALWAYS on the spine. The walk itself ships
+ * as an artifact ticket (`ref`), never as bytes in the envelope; with no
+ * store attached (or a failed mint) the descriptor still states its
+ * counters and the `note` names why there is no ticket — a missing walk must
+ * never be mistaken for a short run.
+ */
+export interface WalkDescriptor {
+    /** The claim-ticket ref of the minted walk artifact. Absent when no store
+     *  is attached or the mint failed — `note` says which. */
+    readonly ref?: string;
+    /** The artifact kind (`'recording/chart-walk'`). Present with `ref`. */
+    readonly kind?: string;
+    /** Rows in the minted artifact. */
+    readonly rows: number;
+    /** Total execution steps the narrative recorder counted — spans isolated
+     *  subflow logs, which the root commit log cannot. */
+    readonly steps_executed: number;
+    /** `'full'` — every narrative entry fit under the cap; `'control-flow'` —
+     *  it did not, and the stages/forks/subflows/decisions survived while the
+     *  per-key reads and writes were dropped. */
+    readonly projection: 'full' | 'control-flow';
+    readonly shown: number;
+    readonly total: number;
+    readonly complete: boolean;
+    /**
+     * WHICH SEGMENT of the run this walk covers. `'full'` for an un-gated run
+     * (all of phase 1). When approval gates land, a resumed run's recorders
+     * start empty on the fresh executor — its walk will say `'post-resume'`
+     * and its counters will count only that segment; the discriminant ships
+     * NOW so the wire does not break then.
+     */
+    readonly walk_segment: 'full' | 'pre-pause' | 'post-resume';
+    /** The human sentence: what the walk is, and (when projected) what the
+     *  control-flow projection kept and dropped, or why there is no ticket. */
+    readonly note: string;
+}
+/** One verdict row, as the chart wrote it. The bridge reads rows from the
+ *  final state's `verdicts` key and requires only `verdict`; every other
+ *  column is the app's own vocabulary. */
+export interface VerdictRow {
+    readonly verdict: string;
+    readonly [column: string]: unknown;
+}
+/** The mandatory-spine + optional-projection envelope every runbook returns
+ *  (unless an inner absence passed through — then the answer IS that absence,
+ *  verbatim). Recognized by the framework's coverage funnel at the dispatch
+ *  boundary like any `coverage()` ledger. */
+export interface RunbookEnvelope {
+    readonly af_coverage: {
+        readonly checked?: readonly CoverageItem[];
+        readonly not_checked?: readonly CoverageItem[];
+        readonly cannot_cover?: readonly CoverageItem[];
+        /** The static coverage law sentence (the `coverage()` note). */
+        readonly note: string;
+        /** The run's own sentence — names the rule set and version. */
+        readonly sentence: string;
+    };
+    readonly result: {
+        /** Re-emitted FIRST: the carried inner provenance stamp (if any inner
+         *  tool declared one — a LOCAL SEED confession survives composition)
+         *  plus this call's own `{tool, toolCallId}`. */
+        readonly af_provenance: Readonly<Record<string, unknown>>;
+        /** `rules.version`, or the honest `'undeclared'` when no rules were
+         *  declared — the field never silently vanishes. */
+        readonly rule_version: string;
+        /** The recorded walk — always present. */
+        readonly walk: WalkDescriptor;
+        readonly verdicts?: readonly VerdictRow[];
+        readonly rows_shown?: number;
+        readonly rows_total?: number;
+        readonly rows_complete?: boolean;
+        /** Pre-rendered markdown table over the SAME rows as `verdicts`. */
+        readonly table?: string;
+        /** The render law, stated to the model. Present with `table`. */
+        readonly render_note?: string;
+        /** branch → meaning, GENERATED from the decider's declared branches and
+         *  the rule labels this run's evidence carried — never hand-restated. */
+        readonly verdict_meanings?: Readonly<Record<string, string>>;
+        /** Present ONLY when the chart's `report` spelled one of the envelope's
+         *  own names: it names every discarded field and says the values under
+         *  those names are the bridge's. Absent on the clean path. */
+        readonly report_note?: string;
+        /** Everything the chart put in its `report` state key — the app's own
+         *  result fields, spread here verbatim BESIDE the spine. Spine keys win:
+         *  a report field spelling `af_coverage`, `af_provenance`, `rule_version`,
+         *  `walk`, `report_note`, or a projection key this run assembled is
+         *  discarded and named in `report_note`. */
+        readonly [appField: string]: unknown;
+    };
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types/core/runbook/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/runbook/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAE1D;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,YAAY,KAAK,SAAS,CAAC;AAElE;;sCAEsC;AACtC,MAAM,WAAW,YAAY;IAC3B,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;6BACyB;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,6CAA6C;AAC7C,MAAM,WAAW,sBAAsB;IACrC;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;oCAEgC;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,uBAAuB;AACvB,MAAM,WAAW,kBAAkB;IACjC;iFAC6E;IAC7E,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;0EAC0E;AAC1E,MAAM,WAAW,oBAAoB;IACnC,uCAAuC;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IAGrC;6DACyD;IACzD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;wCACoC;IACpC,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC;;;iCAG6B;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAGzD,kDAAkD;IAClD,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC;IAC9B,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,CAAC,EAAE,sBAAsB,CAAC;IAC3C,wDAAwD;IACxD,QAAQ,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC;IAGnC,oEAAoE;IACpE,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IACrD,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,uEAAuE;IACvE,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;CACnC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B;8DAC0D;IAC1D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,mCAAmC;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;0DACsD;IACtD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;iDAE6C;IAC7C,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,cAAc,CAAC;IAC7C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,WAAW,GAAG,aAAa,CAAC;IAC5D;+EAC2E;IAC3E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;0CAE0C;AAC1C,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;CACpC;AAED;;;6CAG6C;AAC7C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,WAAW,EAAE;QACpB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;QAC3C,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;QAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;QAChD,gEAAgE;QAChE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,+DAA+D;QAC/D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF,QAAQ,CAAC,MAAM,EAAE;QACf;;yDAEiD;QACjD,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1D;4DACoD;QACpD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,0CAA0C;QAC1C,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;QAE9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;QAC1C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;QACjC,oEAAoE;QACpE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QACxB,iEAAiE;QACjE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAC9B;iFACyE;QACzE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7D;;sEAE8D;QAC9D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAC9B;;;;oDAI4C;QAC5C,QAAQ,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;KACtC,CAAC;CACH"}

package/dist/types/core/runbook/verdicts.d.ts

@@ -0,0 +1,79 @@
+/**
+ * runbook/verdicts — the OPTIONAL verdict/rowset projection.
+ *
+ * Pattern: pure selection + rendering over the run's final state, plus one
+ *          tiny recorder that harvests decide() evidence for generated
+ *          meanings. Selected by `resultKind: 'verdict/*'`; a runbook of any
+ *          other kind never sees this module.
+ * Role:    core/runbook.
+ * Emits:   N/A.
+ *
+ * THE ONE-NUMBER LAW: the rendered table and the structured `verdicts` list
+ * show the SAME rows under the SAME cap. A rendered table beside a longer
+ * structured list is an invitation that gets accepted — rows come back
+ * retyped with subtly wrong identifiers.
+ *
+ * GENERATED MEANINGS, never hand-restated: `verdict_meanings` is composed
+ * from (a) the named decider's declared branches in the chart's own structure
+ * (branch description, falling back to branch name), overlaid by (b) the rule
+ * LABELS this run's decide() evidence carried — the rule speaking for itself.
+ * A decider inside a dynamically generated fan-out branch is invisible to (a)
+ * by construction (the branch chart does not exist at build time); (b) still
+ * covers every verdict an executed rule produced.
+ */
+import type { CombinedRecorder } from 'footprintjs';
+import type { FlowChart } from 'footprintjs';
+import type { VerdictRow } from './types.js';
+/** Default cap on `verdicts` rows and the rendered table. */
+export declare const DEFAULT_MAX_ROWS = 50;
+/** The render law, stated to the model beside every table. */
+export declare const VERDICT_RENDER_NOTE: string;
+/** The reserved verdict word for "no classification was reached" — rows
+ *  carrying it are counted into the coverage ledger as not-checked ground
+ *  (the three-outcome honesty: reached, reached-and-clear, DECLINED). */
+export declare const DECLINED_VERDICT = "declined";
+/** Read the rowset off the final state's `verdicts` key — an array of bags
+ *  each carrying a string `verdict`. Anything else reads as "no rowset". */
+export declare function verdictRowsOf(state: Readonly<Record<string, unknown>>): VerdictRow[];
+/**
+ * Render the shown rows as one markdown table. Columns are the FIRST row's
+ * own keys in declaration order — the chart writes its rows, so the chart
+ * owns the column vocabulary; the bridge only renders it.
+ */
+export declare function renderVerdictTable(rows: readonly VerdictRow[]): string;
+/** The two spellings of the configured decider, once the static walk has
+ *  (maybe) resolved it — flow events report the decider by name. */
+export interface DeciderIdentity {
+    readonly spellings: ReadonlySet<string>;
+    /** branch → declared meaning, from the chart's own structure. */
+    readonly declared: ReadonlyMap<string, string>;
+}
+/**
+ * Find the named decider in the chart's static structure (root graph plus
+ * statically declared subflows) and read its branches. Loop-ref stubs are
+ * skipped FIRST — they deliberately violate node-id uniqueness.
+ */
+export declare function resolveDecider(chart: FlowChart, decider: string): DeciderIdentity;
+/** The evidence harvest: rule labels observed in this run, branch → label. */
+export interface MeaningsHarvest {
+    readonly recorder: CombinedRecorder;
+    readonly observed: ReadonlyMap<string, string>;
+}
+/**
+ * A tiny flow recorder capturing the named decider's decide() evidence as it
+ * fires — collected DURING the traversal, never reconstructed after. Rule
+ * labels are harvested for every rule the evidence lists (matched or not):
+ * a rule that was evaluated has spoken its label, whichever branch won.
+ *
+ * A decider inside a subflow (including a generated fan-out branch) reports
+ * itself PATH-PREFIXED (`per-subject~0/Protection posture`), so the match is
+ * on the LAST `/`-segment — the same last-delimiter reading every upstream
+ * parser of these paths uses, which is what keeps the generated-branch
+ * marker opaque here.
+ */
+export declare function meaningsRecorder(identity: DeciderIdentity): MeaningsHarvest;
+/** Compose the final meanings: declared branches first, observed rule labels
+ *  winning where both speak (the rule is the sharper sentence). Undefined
+ *  when neither source produced anything — absent, never `{}`. */
+export declare function composeMeanings(identity: DeciderIdentity, observed: ReadonlyMap<string, string>): Record<string, string> | undefined;
+//# sourceMappingURL=verdicts.d.ts.map

package/dist/types/core/runbook/verdicts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verdicts.d.ts","sourceRoot":"","sources":["../../../../src/core/runbook/verdicts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAqB,MAAM,aAAa,CAAC;AACvE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,6DAA6D;AAC7D,eAAO,MAAM,gBAAgB,KAAK,CAAC;AAEnC,8DAA8D;AAC9D,eAAO,MAAM,mBAAmB,QAGoB,CAAC;AAErD;;yEAEyE;AACzE,eAAO,MAAM,gBAAgB,aAAa,CAAC;AAE3C;4EAC4E;AAC5E,wBAAgB,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,UAAU,EAAE,CAUpF;AAWD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,SAAS,UAAU,EAAE,GAAG,MAAM,CAStE;AAgBD;oEACoE;AACpE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACxC,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChD;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,eAAe,CAyBjF;AAED,8EAA8E;AAC9E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,eAAe,GAAG,eAAe,CAkB3E;AAED;;kEAEkE;AAClE,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,eAAe,EACzB,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GACpC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAKpC"}