agentfootprint 9.76.1 → 9.78.0

package/dist/esm/integrity/column-types/check.js

@@ -0,0 +1,363 @@
+/**
+ * column-types — the tool declared what its rows contain, and the rows say
+ * otherwise. Filed at the WRITE seam, at the moment the tool answers.
+ *
+ * Pattern: pure function over (one declaration, one finished rowset); the
+ *          SHAPE check, one storey below `empty-lookup` — that one asks
+ *          whether the answer had any rows, this one asks what is in them.
+ * Role:    the decidable fragment of "is this rowset the rowset it claims to
+ *          be?".
+ *
+ * ── THE MEASURED FAILURES. Three, and they are one shape ────────────────
+ *
+ *  1. A mapping report wrote `str(m.get("logical_unit_number") or "")`. LUN 0
+ *     is falsy, so on 2,094 mappings LUN 0 was stored as an EMPTY STRING —
+ *     and a host group missing the LUN an initiator probes first became
+ *     indistinguishable from one that had it. The column was numeric; the
+ *     value was `''`; nothing anywhere disagreed.
+ *  2. A capacity view rendered `round(mib / 1024, 1)`, so an 8 MiB disk came
+ *     out as `0.0 GB` — which reads as NO DISK, i.e. a provisioning failure,
+ *     during a live desktop-fleet incident.
+ *  3. Earlier in the same application, a whole family of tools returned their
+ *     numbers as quoted strings (`"1240"`). Every chart silently went blank,
+ *     because nothing downstream could tell a measure from a label.
+ *
+ * All three are "a number became something else, and nothing noticed at the
+ * seam". The library already lets a tool declare what its result IS
+ * (`resultKind`, 9.70.0). It did not let a tool declare what its result
+ * CONTAINS, so there was nothing for a rowset to be wrong against.
+ *
+ * ── THE CEILING, and case 2 is the whole argument for stating it ────────
+ * This judges TYPE, never MEANING. It can see that a column declared
+ * `number` holds a string. It can NEVER see that the string should have been
+ * `0`, or that `0.0` should have been `0.0078`. Case 2 above passes this
+ * check cleanly — `0.0` is a perfectly good number — and the check says so
+ * out loud rather than letting a green row imply otherwise. The ceiling ships
+ * as {@link COLUMN_TYPE_CEILING} and is quoted verbatim into every finding,
+ * the `EMPTY_LOOKUP_CEILING` law: one owner for the bound, so it cannot drift
+ * out of a message and leave a reader believing the library knows more than
+ * it does.
+ *
+ * ── TWO FINDINGS, because the field bug turned on the difference ────────
+ *   • `column-type-mismatch` — the column is THERE and holds the wrong thing.
+ *     Cases 1 and 3.
+ *   • `missing-column` — the column the author declared is in NO row of the
+ *     result. Nothing to type-check; the promise was broken one level up.
+ * Collapsing them would recreate the exact ambiguity the LUN report died of:
+ * "the value is not what it should be" and "the value is not there" send a
+ * person to two different files, and a checker that says only "something is
+ * off with logical_unit_number" has helped with neither.
+ *
+ * ── DECLARED, NEVER INFERRED ────────────────────────────────────────────
+ * A tool is this check's subject only because its author wrote
+ * `resultColumns`. Nothing here sniffs a type off the data — sniffing is
+ * precisely what the consumers do today, and precisely what produced the
+ * failures above: one stray `''` demotes a numeric column to text, and the
+ * demotion is silent.
+ *
+ * ── WHAT IS NOT JUDGED ──────────────────────────────────────────────────
+ * See {@link readRowset}. A result is read only when it is an array of plain
+ * objects with at least one row. Everything else — prose, a `null`, a bespoke
+ * `{ rows: [...] }` wrapper, a claim ticket, AND the zero-row result — is
+ * `not-applicable`, filed as a ROW. The zero-row case belongs to the
+ * neighbour (`empty-lookup`) and is deliberately not stolen: an empty result
+ * has no columns to be wrong about, and filing `missing-column` for every
+ * declared column of an empty answer would turn one honest emptiness into a
+ * pile of false accusations.
+ */
+import { MAX_QUOTED_CHARS, clipValue } from '../argumentLeaves.js';
+import { normalizeColumns } from './types.js';
+/**
+ * THE CEILING, as one string with one owner.
+ *
+ * Quoted verbatim into every finding's message, into this folder's README and
+ * into the docs page, so the bound cannot drift out of one of them.
+ */
+export const COLUMN_TYPE_CEILING = 'This judges TYPE, never MEANING — it can see that a column declared `number` holds a ' +
+    'string, and it can never see that the string should have been 0, or that a 0.0 should ' +
+    'have been an 8; a column whose every value has its declared type passes here and can ' +
+    'still be wrong.';
+/**
+ * READ a finished result as a rowset, or decline to.
+ *
+ * The one readable shape, and why only this one: an ARRAY OF PLAIN OBJECTS
+ * with at least one row. That is what a rowset is on this wire, it is what
+ * every consumer named in the docs page already expects, and it is the same
+ * `Array.isArray` law the neighbouring check reads by — the two must never
+ * disagree about what a rowset is.
+ *
+ * `undefined` (⇒ `not-applicable`, a ROW) for everything else:
+ *   • a non-array — prose, a `null`, a `{ rows: [...] }` wrapper, a ticket;
+ *   • an array holding anything that is not a plain object — a list of
+ *     strings has no columns, and inventing some is how a checker starts
+ *     lying;
+ *   • an array of ZERO rows — an empty answer has no columns to be wrong
+ *     about, and it is the neighbour's subject, not this one's.
+ */
+export function readRowset(value) {
+    if (!Array.isArray(value) || value.length === 0)
+        return undefined;
+    for (const row of value) {
+        if (typeof row !== 'object' || row === null || Array.isArray(row))
+            return undefined;
+    }
+    return { rows: value };
+}
+/** Most columns named in one refusal sentence — a 200-column declaration
+ *  must not be able to write the context window. */
+const MAX_NAMED_IN_REFUSAL = 5;
+/**
+ * Judge one finished call to a tool that declared its result's columns.
+ *
+ * @param call the call, the declaration, and what the library could read of
+ *   the result. The caller has already established the tool declared
+ *   `resultColumns` and that the dial is on; nothing here re-decides arming.
+ * @param epoch the run iteration, stamped on every witness.
+ */
+export function columnTypesOf(call, epoch) {
+    // A shape the library cannot read as a rowset is not a pass and not a
+    // fail. It is the check meeting a subject that is out of its scope BY
+    // RULE, which is what `not-applicable` was minted for.
+    if (call.reading === undefined)
+        return { findings: [], disposition: 'not-applicable' };
+    const rows = call.reading.rows;
+    const subject = { kind: 'tool', id: call.toolName };
+    const findings = [];
+    const violations = [];
+    const missing = [];
+    for (const column of normalizeColumns(call.columns)) {
+        // ABSENT FROM EVERY ROW is its own finding, and it is checked FIRST so a
+        // column nobody delivered can never also be reported as mistyped. The
+        // two would be counting the same silence twice, and a reader chasing
+        // both would find one bug.
+        if (rows.every((row) => !(column.name in row))) {
+            missing.push(column.name);
+            findings.push({
+                kind: 'missing-column',
+                seam: 'write',
+                subjects: [subject],
+                // The column name IS the discriminator: two columns of one result
+                // are two findings, exactly as two arguments of one call are at the
+                // choice seam.
+                predicate: column.name,
+                witnesses: [
+                    {
+                        subject,
+                        predicate: column.name,
+                        value: `declared ${column.type}`,
+                        epoch,
+                        stratum: 'asserted',
+                        provenance: `Tool.resultColumns on '${call.toolName}', as its author wrote it`,
+                    },
+                    {
+                        subject,
+                        predicate: column.name,
+                        value: 'present in no row',
+                        epoch,
+                        stratum: 'asserted',
+                        provenance: `tool call ${call.toolCallId}: the result, as the tool returned it (${rows.length} row${rows.length === 1 ? '' : 's'})`,
+                    },
+                ],
+                epoch,
+                message: `'${call.toolName}' declares a column '${column.name}' (${column.type}) that is in ` +
+                    `NONE of the ${rows.length} row${rows.length === 1 ? '' : 's'} it returned. This is ` +
+                    `not a mistyped value — the column is simply not there, so anything downstream that ` +
+                    `keys on it reads a rowset that cannot answer, and a row missing the column is ` +
+                    `indistinguishable from a row whose value is nothing. ${COLUMN_TYPE_CEILING} ` +
+                    `Call id ${call.toolCallId}. ${outcomeClause(call.mode)}`,
+            });
+            continue;
+        }
+        const violation = judgeColumn(rows, column.name, column.type, column.nullable);
+        if (violation === undefined)
+            continue;
+        violations.push(violation);
+        findings.push({
+            kind: 'column-type-mismatch',
+            seam: 'write',
+            subjects: [subject],
+            predicate: column.name,
+            witnesses: [
+                {
+                    subject,
+                    predicate: column.name,
+                    value: `declared ${column.type}${column.nullable ? ' (nullable)' : ''}`,
+                    epoch,
+                    stratum: 'asserted',
+                    provenance: `Tool.resultColumns on '${call.toolName}', as its author wrote it`,
+                },
+                {
+                    subject,
+                    predicate: column.name,
+                    value: `${violation.rows} of ${violation.ofRows} rows hold ${violation.got} — first: ${violation.sample}`,
+                    epoch,
+                    stratum: 'asserted',
+                    provenance: `tool call ${call.toolCallId}: the result, as the tool returned it`,
+                },
+            ],
+            epoch,
+            message: `'${call.toolName}' declares column '${column.name}' as ${column.type}, and ` +
+                `${violation.rows} of ${violation.ofRows} row${violation.ofRows === 1 ? '' : 's'} hold ` +
+                `something else — the first is ${violation.sample} (${violation.got}). ` +
+                `${nullableHint(column.nullable, violation.got)}${COLUMN_TYPE_CEILING} ` +
+                `Call id ${call.toolCallId}. ${outcomeClause(call.mode)}`,
+        });
+    }
+    if (findings.length === 0)
+        return { findings, disposition: 'checked-pass' };
+    return {
+        findings,
+        disposition: 'checked-fail',
+        ...(call.mode === 'enforce' && {
+            refusal: refusalSentence(call.toolName, violations, missing),
+        }),
+    };
+}
+// ─── Judging one column ────────────────────────────────────────────
+/**
+ * Walk every row of one declared column and answer with the disagreement, or
+ * `undefined` when there is none.
+ *
+ * COUNTED, not sampled: the row count is what turns "somebody's data is odd"
+ * into "2,094 mappings are wrong", which is the sentence that got the field
+ * bug fixed. The value ECHOED is the first offender only — one is enough to
+ * recognize the shape, and echoing every one would put a tool's whole result
+ * into a finding message.
+ */
+function judgeColumn(rows, name, type, nullable) {
+    let count = 0;
+    let sample;
+    let got = '';
+    for (const row of rows) {
+        const present = name in row;
+        const value = present ? row[name] : undefined;
+        // "No value" is one idea with three spellings, and they are judged
+        // identically: an absent key, a `null` and an `undefined` all say the
+        // row has nothing here. `nullable` is the author's word for "that is
+        // fine"; without it, nothing is a violation like any other, because the
+        // recorded failure was a value that went missing and left a placeholder.
+        const empty = !present || value === null || value === undefined;
+        if (empty) {
+            if (nullable)
+                continue;
+            count += 1;
+            if (sample === undefined) {
+                sample = present ? String(value) : 'no such key';
+                got = present ? (value === null ? 'null' : 'undefined') : 'missing';
+            }
+            continue;
+        }
+        if (matchesType(value, type))
+            continue;
+        count += 1;
+        if (sample === undefined) {
+            sample = renderValue(value);
+            got = typeName(value);
+        }
+    }
+    if (count === 0 || sample === undefined)
+        return undefined;
+    return { column: name, declared: type, rows: count, ofRows: rows.length, sample, got };
+}
+/**
+ * Does one value have the declared type?
+ *
+ * The bias is the evidence gate's bias, for the evidence gate's reason: a
+ * missed mismatch is a miss, a false accusation costs a real person a real
+ * investigation. So `date` accepts anything `Date.parse` accepts, which is
+ * permissive enough that a `'2024'` passes — a known, stated false negative,
+ * and the right direction to be wrong in.
+ */
+function matchesType(value, type) {
+    switch (type) {
+        case 'number':
+            // FINITE. `NaN` and the infinities are numbers that mean "no number",
+            // they serialize to `null` over JSON, and an axis handed one draws
+            // nothing — which is failure 3's symptom exactly.
+            return typeof value === 'number' && Number.isFinite(value);
+        case 'string':
+            return typeof value === 'string';
+        case 'boolean':
+            return typeof value === 'boolean';
+        case 'date':
+            if (value instanceof Date)
+                return !Number.isNaN(value.getTime());
+            return typeof value === 'string' && !Number.isNaN(Date.parse(value));
+    }
+}
+/** What a value IS, in the words a person would use. */
+function typeName(value) {
+    if (Array.isArray(value))
+        return 'array';
+    if (value instanceof Date)
+        return 'an invalid Date';
+    if (typeof value === 'number')
+        return Number.isFinite(value) ? 'number' : `the number ${value}`;
+    if (typeof value === 'object')
+        return 'object';
+    return typeof value;
+}
+/** One value, quoted the way a person would recognize it and clipped so a
+ *  5 MB cell cannot ride a finding into the record. */
+function renderValue(value) {
+    if (typeof value === 'string')
+        return `"${clipValue(value)}"`;
+    if (typeof value === 'number' || typeof value === 'boolean')
+        return String(value);
+    if (value instanceof Date)
+        return `a Date`;
+    let text;
+    try {
+        text = JSON.stringify(value) ?? String(value);
+    }
+    catch {
+        text = String(value);
+    }
+    return text.length > MAX_QUOTED_CHARS ? `${text.slice(0, MAX_QUOTED_CHARS - 1)}…` : text;
+}
+/**
+ * The one-word fix, named in the message that reports the problem.
+ *
+ * Only when the offender is an ABSENCE — that is the case where the author
+ * may simply have meant "this column can be empty", and a finding that
+ * reports a legitimate null without naming the word that legitimizes it is
+ * the noise that gets a check switched off.
+ */
+function nullableHint(nullable, got) {
+    if (nullable)
+        return '';
+    if (got !== 'null' && got !== 'undefined' && got !== 'missing')
+        return '';
+    return ('If this column may legitimately carry no value, say so once — ' +
+        "`{ type: '…', nullable: true }` — and rows with nothing in them stop being violations. ");
+}
+/** What the boundary did, stated in the finding rather than assumed by it. */
+function outcomeClause(mode) {
+    return mode === 'enforce'
+        ? 'The result was REFUSED: the model reads a teaching sentence instead of these rows.'
+        : 'Nothing here blocked the call, changed the result, or retried anything — the model reads the rows exactly as the tool returned them.';
+}
+/**
+ * The teaching refusal, for `enforce`.
+ *
+ * The `applyResultCeiling` sentence shape, deliberately: what was wrong, what
+ * to do about it, and "No data was returned" — because a model that is handed
+ * a partial or truncated answer cannot tell the data ends where the cut
+ * happened, and fabricates from the part it saw.
+ */
+function refusalSentence(toolName, violations, missing) {
+    const parts = [];
+    for (const v of violations.slice(0, MAX_NAMED_IN_REFUSAL)) {
+        parts.push(`'${v.column}' is declared ${v.declared} and ${v.rows} of ${v.ofRows} rows hold ` +
+            `${v.got} (first: ${v.sample})`);
+    }
+    for (const name of missing.slice(0, Math.max(0, MAX_NAMED_IN_REFUSAL - parts.length))) {
+        parts.push(`'${name}' is declared but present in no row`);
+    }
+    const more = violations.length + missing.length - parts.length;
+    const tail = more > 0 ? `, and ${more} more` : '';
+    return (`Result rejected: ${toolName} returned rows that disagree with the columns it declares — ` +
+        `${parts.join('; ')}${tail}. Fix the tool so the column holds what it declares, or change ` +
+        `the declaration. No data was returned.`);
+}
+//# sourceMappingURL=check.js.map

package/dist/esm/integrity/column-types/check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.js","sourceRoot":"","sources":["../../../../src/integrity/column-types/check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAInE,OAAO,EAAE,gBAAgB,EAA2C,MAAM,YAAY,CAAC;AAEvF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAC9B,uFAAuF;IACvF,wFAAwF;IACxF,uFAAuF;IACvF,iBAAiB,CAAC;AAepB;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAClE,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;IACtF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAqD,EAAE,CAAC;AACzE,CAAC;AA8CD;oDACoD;AACpD,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAE/B;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,IAAqB,EAAE,KAAa;IAChE,sEAAsE;IACtE,sEAAsE;IACtE,uDAAuD;IACvD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAEvF,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC/B,MAAM,OAAO,GAAe,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;IAChE,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,MAAM,UAAU,GAAsB,EAAE,CAAC;IACzC,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,MAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,yEAAyE;QACzE,sEAAsE;QACtE,qEAAqE;QACrE,2BAA2B;QAC3B,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC;YAC/C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,gBAAgB;gBACtB,IAAI,EAAE,OAAO;gBACb,QAAQ,EAAE,CAAC,OAAO,CAAC;gBACnB,kEAAkE;gBAClE,oEAAoE;gBACpE,eAAe;gBACf,SAAS,EAAE,MAAM,CAAC,IAAI;gBACtB,SAAS,EAAE;oBACT;wBACE,OAAO;wBACP,SAAS,EAAE,MAAM,CAAC,IAAI;wBACtB,KAAK,EAAE,YAAY,MAAM,CAAC,IAAI,EAAE;wBAChC,KAAK;wBACL,OAAO,EAAE,UAAU;wBACnB,UAAU,EAAE,0BAA0B,IAAI,CAAC,QAAQ,2BAA2B;qBAC/E;oBACD;wBACE,OAAO;wBACP,SAAS,EAAE,MAAM,CAAC,IAAI;wBACtB,KAAK,EAAE,mBAAmB;wBAC1B,KAAK;wBACL,OAAO,EAAE,UAAU;wBACnB,UAAU,EAAE,aAAa,IAAI,CAAC,UAAU,0CACtC,IAAI,CAAC,MACP,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG;qBACvC;iBACF;gBACD,KAAK;gBACL,OAAO,EACL,IAAI,IAAI,CAAC,QAAQ,wBAAwB,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,IAAI,eAAe;oBACpF,eAAe,IAAI,CAAC,MAAM,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,wBAAwB;oBACrF,qFAAqF;oBACrF,gFAAgF;oBAChF,wDAAwD,mBAAmB,GAAG;oBAC9E,WAAW,IAAI,CAAC,UAAU,KAAK,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aAC5D,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/E,IAAI,SAAS,KAAK,SAAS;YAAE,SAAS;QACtC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,sBAAsB;YAC5B,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE,CAAC,OAAO,CAAC;YACnB,SAAS,EAAE,MAAM,CAAC,IAAI;YACtB,SAAS,EAAE;gBACT;oBACE,OAAO;oBACP,SAAS,EAAE,MAAM,CAAC,IAAI;oBACtB,KAAK,EAAE,YAAY,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE;oBACvE,KAAK;oBACL,OAAO,EAAE,UAAU;oBACnB,UAAU,EAAE,0BAA0B,IAAI,CAAC,QAAQ,2BAA2B;iBAC/E;gBACD;oBACE,OAAO;oBACP,SAAS,EAAE,MAAM,CAAC,IAAI;oBACtB,KAAK,EAAE,GAAG,SAAS,CAAC,IAAI,OAAO,SAAS,CAAC,MAAM,cAAc,SAAS,CAAC,GAAG,aAAa,SAAS,CAAC,MAAM,EAAE;oBACzG,KAAK;oBACL,OAAO,EAAE,UAAU;oBACnB,UAAU,EAAE,aAAa,IAAI,CAAC,UAAU,uCAAuC;iBAChF;aACF;YACD,KAAK;YACL,OAAO,EACL,IAAI,IAAI,CAAC,QAAQ,sBAAsB,MAAM,CAAC,IAAI,QAAQ,MAAM,CAAC,IAAI,QAAQ;gBAC7E,GAAG,SAAS,CAAC,IAAI,OAAO,SAAS,CAAC,MAAM,OAAO,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,QAAQ;gBACxF,iCAAiC,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,GAAG,KAAK;gBACxE,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,mBAAmB,GAAG;gBACxE,WAAW,IAAI,CAAC,UAAU,KAAK,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC5D,CAAC,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;IAC5E,OAAO;QACL,QAAQ;QACR,WAAW,EAAE,cAAc;QAC3B,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI;YAC7B,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC;SAC7D,CAAC;KACH,CAAC;AACJ,CAAC;AAED,sEAAsE;AAEtE;;;;;;;;;GASG;AACH,SAAS,WAAW,CAClB,IAAkD,EAClD,IAAY,EACZ,IAAgB,EAChB,QAAiB;IAEjB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,MAA0B,CAAC;IAC/B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,IAAI,IAAI,GAAG,CAAC;QAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9C,mEAAmE;QACnE,sEAAsE;QACtE,qEAAqE;QACrE,wEAAwE;QACxE,yEAAyE;QACzE,MAAM,KAAK,GAAG,CAAC,OAAO,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,CAAC;QAChE,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,QAAQ;gBAAE,SAAS;YACvB,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;gBACjD,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACtE,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC;YAAE,SAAS;QACvC,KAAK,IAAI,CAAC,CAAC;QACX,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YAC5B,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,IAAI,KAAK,KAAK,CAAC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1D,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AACzF,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,WAAW,CAAC,KAAc,EAAE,IAAgB;IACnD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,sEAAsE;YACtE,mEAAmE;YACnE,kDAAkD;YAClD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC7D,KAAK,QAAQ;YACX,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC;QACnC,KAAK,SAAS;YACZ,OAAO,OAAO,KAAK,KAAK,SAAS,CAAC;QACpC,KAAK,MAAM;YACT,IAAI,KAAK,YAAY,IAAI;gBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACjE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,wDAAwD;AACxD,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IACzC,IAAI,KAAK,YAAY,IAAI;QAAE,OAAO,iBAAiB,CAAC;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,KAAK,EAAE,CAAC;IAChG,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC/C,OAAO,OAAO,KAAK,CAAC;AACtB,CAAC;AAED;uDACuD;AACvD,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC;IAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAClF,IAAI,KAAK,YAAY,IAAI;QAAE,OAAO,QAAQ,CAAC;IAC3C,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3F,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,QAAiB,EAAE,GAAW;IAClD,IAAI,QAAQ;QAAE,OAAO,EAAE,CAAC;IACxB,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAC1E,OAAO,CACL,gEAAgE;QAChE,yFAAyF,CAC1F,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,aAAa,CAAC,IAAqB;IAC1C,OAAO,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,oFAAoF;QACtF,CAAC,CAAC,sIAAsI,CAAC;AAC7I,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CACtB,QAAgB,EAChB,UAAsC,EACtC,OAA0B;IAE1B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,EAAE,CAAC;QAC1D,KAAK,CAAC,IAAI,CACR,IAAI,CAAC,CAAC,MAAM,iBAAiB,CAAC,CAAC,QAAQ,QAAQ,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,aAAa;YAC/E,GAAG,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,MAAM,GAAG,CAClC,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,oBAAoB,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACtF,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,qCAAqC,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAClD,OAAO,CACL,oBAAoB,QAAQ,8DAA8D;QAC1F,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,iEAAiE;QAC3F,wCAAwC,CACzC,CAAC;AACJ,CAAC"}

package/dist/esm/integrity/column-types/types.d.ts

@@ -0,0 +1,121 @@
+/**
+ * The COLUMN-TYPE CONTRACT's vocabulary — what a tool may say about the
+ * columns of the rowset it returns, and the one rule that judges the saying.
+ *
+ * Pattern: closed vocabulary + definition-time assert (the `resultCeiling` /
+ *          `resultClass` law: a declaration this library cannot honour fails
+ *          at `defineTool`, never at the first row of the first run).
+ * Role:    leaf. `src/integrity/` imports nothing outside itself, so the
+ *          vocabulary lives HERE and `core/tools.ts` reaches in for it —
+ *          never the other way round.
+ *
+ * ── Why the words are these words ───────────────────────────────────────
+ * They are NOT invented. `number | string | boolean | date` is the vocabulary
+ * this ecosystem's rowset consumers already speak — a column-type union with
+ * exactly these members is what the visualization layer sniffs its way to
+ * today. Declaring in the consumer's own words is the `resultKind` law
+ * (9.70.0) restated one level down: the tool's result in the CONSUMER's
+ * vocabulary, not the framework's.
+ *
+ * The one member deliberately NOT carried over is `unknown`. A sniffer needs
+ * that word — it is what "I looked at the values and could not tell" sounds
+ * like. A DECLARATION has no use for it: an author who does not know what a
+ * column holds should not name the column, and `columns: { x: 'unknown' }`
+ * would be a promise about nothing that the checker would then have to
+ * pretend to verify.
+ *
+ * ── Two spellings, one meaning ──────────────────────────────────────────
+ * A column maps to a bare type (`lun: 'number'`) or to an object form
+ * (`note: { type: 'string', nullable: true }`). That is this library's house
+ * pattern for exactly this shape — `CostBudget` takes a bare number or
+ * `{ usd, onExceed }`, `artifacts` takes a bare store or `{ store, placement }`
+ * — and it is normalized ONCE, here, so every reader downstream sees one
+ * shape and no downstream file learns that there were two.
+ */
+/**
+ * What a declared column holds.
+ *
+ * | word | what a value must be |
+ * | --- | --- |
+ * | `number` | a JavaScript number that is FINITE — `NaN` and the infinities are a number that means "no number", and a chart handed one draws nothing |
+ * | `string` | a JavaScript string, including the empty one (emptiness is meaning, and meaning is above this check's ceiling) |
+ * | `boolean` | `true` or `false` — never `'true'`, never `0`, never `1` |
+ * | `date` | a valid `Date` instance, or a string `Date.parse` accepts (an epoch NUMBER is a `number`; say so and the axis picker stops guessing) |
+ */
+export type ColumnType = 'number' | 'string' | 'boolean' | 'date';
+/** The closed set, in one place, for the assert and for its own error message. */
+export declare const COLUMN_TYPES: readonly ColumnType[];
+/** The object spelling of one column's declaration. */
+export interface ColumnDeclaration {
+    /** What the column holds. */
+    readonly type: ColumnType;
+    /**
+     * `true` — a row of this column may legitimately carry NO VALUE (`null`,
+     * `undefined`, or the key simply not set on that row), and such a row is
+     * never a type violation.
+     *
+     * Default `false`, and the default is the strict one ON PURPOSE. The field
+     * failure this check is built from was a value that went missing and left
+     * an empty string behind; had the same code left a `null` behind, the
+     * defect would have been identical and a lenient default would have waved
+     * it through. One word turns it off, and every finding names that word — so
+     * a legitimate null column costs a one-word edit, while a silent default
+     * would cost the bug.
+     *
+     * `nullable` is a promise about VALUES. It is NOT a promise about the
+     * column's existence: a declared column that appears in no row at all is a
+     * `missing-column` finding whether or not it is nullable, because the
+     * declaration named a column and the result has no such column. The valve
+     * for "this column may or may not be there" is to not declare it —
+     * unlisted columns are allowed and unjudged.
+     */
+    readonly nullable?: boolean;
+}
+/**
+ * What a tool declares about the columns of its rowset — column name to type.
+ *
+ * OPEN, NEVER CLOSED. A declaration is a promise about what it NAMES, not a
+ * schema of everything the result may contain: a column nobody listed is
+ * allowed and is never judged. Two reasons, and both are the same reason.
+ *
+ *   • A closed schema punishes the wrong party. The day the backend adds a
+ *     column, every one of these tools starts filing findings about a change
+ *     that broke nothing — and a check that cries about correct behaviour is
+ *     a check people switch off, which is how the failure it exists to catch
+ *     gets back in.
+ *   • It is the rule the neighbouring boundary already keeps.
+ *     `toolArgsValidation` is permissive on keywords it does not know and
+ *     enforces `additionalProperties: false` only when an author explicitly
+ *     asks for it. Two validators at one seam disagreeing about whether
+ *     silence means "allowed" would be a worse defect than either could
+ *     catch.
+ */
+export type ToolResultColumns = Readonly<Record<string, ColumnType | ColumnDeclaration>>;
+/** One column's declaration after normalization — the ONLY shape any reader
+ *  downstream of `normalizeColumns` ever sees. */
+export interface NormalizedColumn {
+    readonly name: string;
+    readonly type: ColumnType;
+    readonly nullable: boolean;
+}
+/**
+ * Both spellings into one list, in declaration order.
+ *
+ * Order is kept because it is the author's order, and a finding that names
+ * columns in the order the author wrote them is a finding they can scan
+ * against their own source.
+ */
+export declare function normalizeColumns(columns: ToolResultColumns): readonly NormalizedColumn[];
+/**
+ * Refuse a `resultColumns` this library cannot honour, at definition time —
+ * naming the tool, the column and the fix.
+ *
+ * Exported beside {@link ColumnType} and called from `defineTool`, so a
+ * misspelled type fails on the line that wrote it rather than at the first
+ * rowset of the first armed run. Also called by the MCP ingest
+ * (`readToolExtras`) on a bag from a server this process does not control —
+ * which is why every read below goes through a fallback: a `null`, a number
+ * or an array must reach the teaching refusal, never blow up on the way to
+ * it.
+ */
+export declare function assertResultColumns(toolName: string, columns: unknown): void;

package/dist/esm/integrity/column-types/types.js

@@ -0,0 +1,107 @@
+/**
+ * The COLUMN-TYPE CONTRACT's vocabulary — what a tool may say about the
+ * columns of the rowset it returns, and the one rule that judges the saying.
+ *
+ * Pattern: closed vocabulary + definition-time assert (the `resultCeiling` /
+ *          `resultClass` law: a declaration this library cannot honour fails
+ *          at `defineTool`, never at the first row of the first run).
+ * Role:    leaf. `src/integrity/` imports nothing outside itself, so the
+ *          vocabulary lives HERE and `core/tools.ts` reaches in for it —
+ *          never the other way round.
+ *
+ * ── Why the words are these words ───────────────────────────────────────
+ * They are NOT invented. `number | string | boolean | date` is the vocabulary
+ * this ecosystem's rowset consumers already speak — a column-type union with
+ * exactly these members is what the visualization layer sniffs its way to
+ * today. Declaring in the consumer's own words is the `resultKind` law
+ * (9.70.0) restated one level down: the tool's result in the CONSUMER's
+ * vocabulary, not the framework's.
+ *
+ * The one member deliberately NOT carried over is `unknown`. A sniffer needs
+ * that word — it is what "I looked at the values and could not tell" sounds
+ * like. A DECLARATION has no use for it: an author who does not know what a
+ * column holds should not name the column, and `columns: { x: 'unknown' }`
+ * would be a promise about nothing that the checker would then have to
+ * pretend to verify.
+ *
+ * ── Two spellings, one meaning ──────────────────────────────────────────
+ * A column maps to a bare type (`lun: 'number'`) or to an object form
+ * (`note: { type: 'string', nullable: true }`). That is this library's house
+ * pattern for exactly this shape — `CostBudget` takes a bare number or
+ * `{ usd, onExceed }`, `artifacts` takes a bare store or `{ store, placement }`
+ * — and it is normalized ONCE, here, so every reader downstream sees one
+ * shape and no downstream file learns that there were two.
+ */
+/** The closed set, in one place, for the assert and for its own error message. */
+export const COLUMN_TYPES = ['number', 'string', 'boolean', 'date'];
+/**
+ * Both spellings into one list, in declaration order.
+ *
+ * Order is kept because it is the author's order, and a finding that names
+ * columns in the order the author wrote them is a finding they can scan
+ * against their own source.
+ */
+export function normalizeColumns(columns) {
+    const out = [];
+    for (const [name, declared] of Object.entries(columns)) {
+        if (typeof declared === 'string') {
+            out.push({ name, type: declared, nullable: false });
+            continue;
+        }
+        out.push({ name, type: declared.type, nullable: declared.nullable === true });
+    }
+    return out;
+}
+/**
+ * Refuse a `resultColumns` this library cannot honour, at definition time —
+ * naming the tool, the column and the fix.
+ *
+ * Exported beside {@link ColumnType} and called from `defineTool`, so a
+ * misspelled type fails on the line that wrote it rather than at the first
+ * rowset of the first armed run. Also called by the MCP ingest
+ * (`readToolExtras`) on a bag from a server this process does not control —
+ * which is why every read below goes through a fallback: a `null`, a number
+ * or an array must reach the teaching refusal, never blow up on the way to
+ * it.
+ */
+export function assertResultColumns(toolName, columns) {
+    if (columns === undefined)
+        return;
+    if (typeof columns !== 'object' || columns === null || Array.isArray(columns)) {
+        throw new Error(`defineTool: tool '${toolName}' declares resultColumns ${JSON.stringify(columns)}, which ` +
+            `is not a map of column name to type. Write it as ` +
+            `{ logical_unit_number: 'number', host_group: 'string' } — or omit the field, which ` +
+            `means this tool promises nothing about its columns and none are ever judged.`);
+    }
+    const entries = Object.entries(columns);
+    if (entries.length === 0) {
+        throw new Error(`defineTool: tool '${toolName}' declares an EMPTY resultColumns. A declaration that names ` +
+            `no column promises nothing, and omitting the field is how "nothing promised" is said ` +
+            `— the two must not be different spellings of the same silence.`);
+    }
+    for (const [name, declared] of entries) {
+        if (name.trim().length === 0) {
+            throw new Error(`defineTool: tool '${toolName}' declares a resultColumns entry with a blank column ` +
+                `name. A column name is what a finding points at, and a blank one points nowhere.`);
+        }
+        const type = typeof declared === 'string' ? declared : declared?.type;
+        if (typeof declared === 'object' && declared !== null && !Array.isArray(declared)) {
+            const nullable = declared.nullable;
+            if (nullable !== undefined && typeof nullable !== 'boolean') {
+                throw new Error(`defineTool: tool '${toolName}' declares resultColumns['${name}'].nullable = ` +
+                    `${JSON.stringify(nullable)}, which is not a boolean. \`true\` says a row of this ` +
+                    `column may carry no value; omit it (or \`false\`) and a missing value is a ` +
+                    `violation like any other.`);
+            }
+        }
+        if (typeof type !== 'string' || !COLUMN_TYPES.includes(type)) {
+            throw new Error(`defineTool: tool '${toolName}' declares column '${name}' as ${JSON.stringify(type)}, ` +
+                `which is not a column type this library has. The types are: ` +
+                `${COLUMN_TYPES.join(', ')} — a bare word ('number') or the object form ` +
+                `({ type: 'number', nullable: true }). There is deliberately no 'unknown': a column ` +
+                `whose type you do not know is a column to leave undeclared, and unlisted columns ` +
+                `are allowed and never judged.`);
+        }
+    }
+}
+//# sourceMappingURL=types.js.map

package/dist/esm/integrity/column-types/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/integrity/column-types/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAcH,kFAAkF;AAClF,MAAM,CAAC,MAAM,YAAY,GAA0B,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;AA0D3F;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAA0B;IACzD,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YACpD,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,OAAgB;IACpE,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO;IAClC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CACb,qBAAqB,QAAQ,4BAA4B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU;YACxF,mDAAmD;YACnD,qFAAqF;YACrF,8EAA8E,CACjF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAkC,CAAC,CAAC;IACnE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,qBAAqB,QAAQ,8DAA8D;YACzF,uFAAuF;YACvF,gEAAgE,CACnE,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,qBAAqB,QAAQ,uDAAuD;gBAClF,kFAAkF,CACrF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAE,QAA8B,EAAE,IAAI,CAAC;QAC7F,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClF,MAAM,QAAQ,GAAI,QAA8B,CAAC,QAAQ,CAAC;YAC1D,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC5D,MAAM,IAAI,KAAK,CACb,qBAAqB,QAAQ,6BAA6B,IAAI,gBAAgB;oBAC5E,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,wDAAwD;oBACnF,6EAA6E;oBAC7E,2BAA2B,CAC9B,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAkB,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,KAAK,CACb,qBAAqB,QAAQ,sBAAsB,IAAI,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI;gBACrF,8DAA8D;gBAC9D,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,+CAA+C;gBACzE,qFAAqF;gBACrF,mFAAmF;gBACnF,+BAA+B,CAClC,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/esm/integrity/disposition/lifecycle.d.ts

@@ -10,7 +10,14 @@
  *          compose-invariant: a mount kernel is configured; dangling: at
  *          least one tool declared `argumentsFrom`, which arms BOTH the
  *          compose-seam dangling-reference check and the choice-seam
- *          unsupported-argument check off the same declaration).
+ *          unsupported-argument check off the same declaration;
+ *          empty-lookup: that same declaration AND the operator's
+ *          `noticeEmptyLookups` dial — two halves, because an advisory that
+ *          armed itself off a declaration made for something else would not
+ *          be opt-in at all; column-types: `Tool.resultColumns` AND the
+ *          operator's `checkColumnTypes` dial off `'off'` — the same two
+ *          halves, arming BOTH `column-type-mismatch` and `missing-column`
+ *          off the one declaration).
  *          Registration is what makes silence auditable — an unregistered
  *          check is honest
  *          absence, a registered one that never notes is the wiring rot
@@ -45,6 +52,29 @@ export interface IntegrityChecksPresent {
     readonly dangling: boolean;
     /** A `.claims()` contract is declared (9.61.0). */
     readonly claim?: boolean;
+    /**
+     * The write seam's `empty-lookup` notice (9.77.0) — armed only when BOTH
+     * halves are true: the operator turned `noticeEmptyLookups` on AND at least
+     * one tool declared `argumentsFrom`. Deliberately NOT armed by the
+     * declaration alone, unlike its two siblings: this check would otherwise
+     * start filing advisories in every app that already declares
+     * `argumentsFrom` for the other two, and an absent dial must leave a run
+     * byte-identical. Absent → a registered `not-applicable` ROW, never
+     * silence.
+     */
+    readonly emptyLookup?: boolean;
+    /**
+     * The write seam's COLUMN-TYPE CONTRACT (9.78.0) — armed only when BOTH
+     * halves are true: the operator set `checkColumnTypes` to something other
+     * than `'off'` AND at least one tool declared `resultColumns`. The same
+     * two-halves law as `empty-lookup`, for the same reason: a declaration is
+     * a promise a consumer may already be reading for its own purposes, and
+     * arming a boundary check off it alone would make an absent dial change a
+     * run's bytes. ONE FLAG, TWO CHECKS — `column-type-mismatch` and
+     * `missing-column` are the same declaration read two ways, and nothing can
+     * arm one without arming the other.
+     */
+    readonly columnTypes?: boolean;
 }
 /**
  * Start one run's ledger: register the present checks and, in dev posture,