baesian 0.0.0-stage → 1.0.1

package/dist/trailers.js

@@ -0,0 +1,121 @@
+import { execFileSync } from "node:child_process";
+import { CARD_ID } from "./ids.js";
+// D52: `Baesian-Card: <id>` (one per line) and `Baesian-Ack: <fact-id> <reason>`.
+export const CARD_TRAILER = "Baesian-Card";
+export const ACK_TRAILER = "Baesian-Ack";
+const FACT_ID = /^(dep|schema|infra|api):\S+$/;
+/** The message as git will record it: no `#` comment lines, nothing below a `--verbose` scissors line. */
+export function cleanMessage(raw) {
+    const lines = [];
+    for (const line of raw.split(/\r?\n/)) {
+        if (/^# -+ >8 -+$/.test(line))
+            break;
+        if (!line.startsWith("#"))
+            lines.push(line);
+    }
+    return lines.join("\n");
+}
+/** The trailers git has parsed out of a message, one `Key: value` per line, as `--parse` and `%(trailers:only,unfold)` print them. */
+function trailerLines(parsed) {
+    return parsed.split("\n").flatMap((line) => {
+        const m = /^([^:]+):\s*(.*)$/.exec(line);
+        return m ? [{ key: m[1].trim().toLowerCase(), value: m[2].trim() }] : [];
+    });
+}
+/** Parse the trailer block with git's own rules (`git interpret-trailers --parse`). */
+export function parseTrailers(message, cwd) {
+    const out = execFileSync("git", ["interpret-trailers", "--parse"], {
+        cwd,
+        input: cleanMessage(message),
+        encoding: "utf8",
+        stdio: ["pipe", "pipe", "ignore"],
+    });
+    const result = { cards: [], acks: new Map(), malformed: [] };
+    for (const { key, value } of trailerLines(out)) {
+        if (key === CARD_TRAILER.toLowerCase()) {
+            for (const id of value.split(/[\s,]+/).filter(Boolean)) {
+                if (CARD_ID.test(id))
+                    result.cards.push(id);
+                else
+                    result.malformed.push(`${CARD_TRAILER}: ${value} — "${id}" isn't a card ID, which looks like B-7f3kq`);
+            }
+        }
+        else if (key === ACK_TRAILER.toLowerCase()) {
+            const a = /^(\S+)\s+(.+)$/.exec(value);
+            if (!a || !FACT_ID.test(a[1])) {
+                result.malformed.push(`${ACK_TRAILER}: ${value} — expected "<fact-id> <reason>", e.g. "dep:httpx needed for the client"`);
+            }
+            else {
+                result.acks.set(a[1], a[2].trim());
+            }
+        }
+    }
+    result.cards = [...new Set(result.cards)];
+    return result;
+}
+const BRANCH_REFS = ["refs/heads", "refs/remotes"];
+const histories = new Map();
+function gitOut(cwd, args) {
+    try {
+        return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], maxBuffer: 256 * 1024 * 1024 });
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Search the history of every branch, local and remote-tracking, for `Baesian-Card` trailers (B-9v5xj), so the commits
+ * that built on a card are found after a rebase, or a squash that keeps the trailer, rewrites them. Trailers are read
+ * with git's own rules, as `parseTrailers` reads them: only from the message's last paragraph. A brief may ask about
+ * many cards, so the search is cached per process for as long as the branches point where they did.
+ */
+export function readHistory(cwd) {
+    const refs = gitOut(cwd, ["for-each-ref", "--format=%(objectname) %(refname)", ...BRANCH_REFS]) ?? "";
+    const cached = histories.get(cwd);
+    if (cached && cached.refs === refs)
+        return cached.history;
+    // Only commits that mention the trailer at all are parsed; git's grep reads every message faster than we could.
+    const out = gitOut(cwd, ["log", "--branches", "--remotes", "--source", "--reverse", "-i", `--grep=${CARD_TRAILER}`, "--format=%x1e%H%x00%at%x00%S%x00%(trailers:only,unfold)"]) ?? "";
+    const citing = new Map();
+    const found = new Set();
+    for (const record of out.split("\x1e").slice(1)) {
+        const [commit, at, source, trailers = ""] = record.split("\0");
+        if (!commit || !at)
+            continue;
+        found.add(commit);
+        const branch = (source ?? "").replace(/^refs\/(heads|remotes)\//, "");
+        const ids = new Set(trailerLines(trailers)
+            .filter((t) => t.key === CARD_TRAILER.toLowerCase())
+            .flatMap((t) => t.value.split(/[\s,]+/).filter((id) => CARD_ID.test(id))));
+        for (const id of ids)
+            citing.set(id, [...(citing.get(id) ?? []), { commit, branch, authored: Number(at) * 1000 }]);
+    }
+    const memo = new Map();
+    const onBranch = (commit) => {
+        if (found.has(commit))
+            return true;
+        if (!/^[0-9a-f]{4,64}$/i.test(commit))
+            return false;
+        if (!memo.has(commit))
+            memo.set(commit, gitOut(cwd, ["cat-file", "-e", `${commit}^{commit}`]) === undefined || !!gitOut(cwd, ["for-each-ref", "--count=1", `--contains=${commit}`, "--format=%(refname)", ...BRANCH_REFS])?.trim());
+        return memo.get(commit);
+    };
+    const history = { citing, onBranch };
+    histories.set(cwd, { refs, history });
+    return history;
+}
+/**
+ * The cards one commit's message cites, by its `Baesian-Card` trailers, read with git's own trailer rules as
+ * `readHistory()` reads them, and git's time for it. Only the IDs leave this function, never the message.
+ */
+export function citedIn(cwd, commit) {
+    const out = gitOut(cwd, ["log", "-1", "--format=%cI%x00%(trailers:only,unfold)", commit]);
+    if (!out)
+        return undefined;
+    const [at = "", trailers = ""] = out.split("\0");
+    const cards = new Set(trailerLines(trailers)
+        .filter((t) => t.key === CARD_TRAILER.toLowerCase())
+        .flatMap((t) => t.value.split(/[\s,]+/).filter((id) => CARD_ID.test(id))));
+    return { cards: [...cards], at: at.trim() };
+}
+//# sourceMappingURL=trailers.js.map

package/dist/trust.js

@@ -0,0 +1,222 @@
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { Told, cite } from "./cite.js";
+import { BadSignature, DRAW_NAMESPACE, NAMESPACE, parseSignature, publicKeyBlob, signatureMatches } from "./sshsig.js";
+import { NewerFormat, PasskeyKey, PinnedProject, ServiceKey, ServiceKeyRevocation, asWritten, describeError, newestFormat, upgradeFile } from "./schema.js";
+// The keys `baesian verify` and the commit gate trust in a hosted repo (D138, D142, D159), and the checks made with them.
+// In CI, the keys are pinned in CI's own settings, outside the repo, where a commit can't change them, with the repo's
+// project beside them (B-mar8x); the record keeps a copy of the keys for checks on your machine, and the two must agree.
+// docs/vault/Modules/src-trust.md describes it.
+/** CI's pin: the trust files' JSON, one per line (D142, D159), and the line naming the repo's project (B-mar8x). */
+export const TRUST_ENV = "BAESIAN_TRUST";
+/** Or a path to a file of the same lines, for a protected file on a CI runner. */
+export const TRUST_FILE_ENV = "BAESIAN_TRUST_FILE";
+/** The pinned keys are unreadable: CI is misconfigured, and that must stop the check, never switch it off. */
+export class BadTrust extends Told {
+}
+const KINDS = {
+    "service-key": { kind: "service-key", schema: ServiceKey },
+    "service-key-revocation": { kind: "service-key-revocation", schema: ServiceKeyRevocation },
+    "passkey-key": { kind: "passkey-key", schema: PasskeyKey },
+};
+/** One trust file's fields, read as its kind (D156), or why not. A newer format throws `NewerFormat` (D157). */
+export function readTrustFile(fields, where) {
+    const type = typeof fields === "object" && fields !== null ? fields.type : undefined;
+    const k = typeof type === "string" ? KINDS[type] : undefined;
+    if (!k)
+        throw new BadTrust(`${where} isn't a service key, a revocation or a passkey key`);
+    const parsed = k.schema.safeParse(upgradeFile(k.kind, fields, where));
+    if (!parsed.success)
+        throw new BadTrust(`${where} is not valid:\n${describeError(parsed.error)}`);
+    return parsed.data;
+}
+/** Add a trust file to a root, by its kind. */
+export function addTo(root, f) {
+    if (f.type === "service-key")
+        root.service.push(f);
+    else if (f.type === "service-key-revocation")
+        root.revoked.push(f);
+    else
+        root.passkeys.push(f);
+}
+/** What to do about a pin that's empty, or lacks a line it needs: `baesian ci` prints every line (B-pt52b). */
+export const RUN_CI = "run `baesian ci` in the linked repo, and set it to the lines it prints";
+/** The pin's line naming the repo's project (B-mar8x), as `baesian ci` prints it: compact JSON, as each key's line is. */
+export function projectLine(project) {
+    return JSON.stringify(asWritten("project", PinnedProject.parse({ type: "project", format: newestFormat("project"), project })));
+}
+/** Set a pin's project from one of its lines: a pin names one project, however many of its lines name it. */
+function pinProject(root, project, where) {
+    if (root.project !== undefined && root.project !== project) {
+        throw new BadTrust(`${where} names project ${project}, but the pin already names ${root.project}: a pin names one project, the repo's${cite("B-mar8x")}`);
+    }
+    root.project = project;
+}
+/**
+ * A pin from text: one trust file's JSON per line, and the line naming the repo's project (`PinnedProject`, B-mar8x);
+ * blank lines and lines starting with `#` are skipped.
+ */
+export function parseTrust(text, where) {
+    const root = { service: [], revoked: [], passkeys: [] };
+    text.split(/\r?\n/).forEach((line, i) => {
+        const l = line.trim();
+        if (!l || l.startsWith("#"))
+            return;
+        const at = `${where}, line ${i + 1}`;
+        let fields;
+        try {
+            fields = JSON.parse(l);
+        }
+        catch {
+            throw new BadTrust(`${at}, isn't JSON: each line is one trust file's JSON, or the project's`);
+        }
+        if (typeof fields === "object" && fields !== null && fields.type === "project") {
+            const parsed = PinnedProject.safeParse(upgradeFile("project", fields, at));
+            if (!parsed.success)
+                throw new BadTrust(`${at} is not valid:\n${describeError(parsed.error)}`);
+            pinProject(root, parsed.data.project, at);
+            return;
+        }
+        addTo(root, readTrustFile(fields, at));
+    });
+    return root;
+}
+/**
+ * A pin must hold the service's key, since one with only passkeys would check nothing the service signs; and the repo's
+ * project, since a commit can name another in its config (B-mar8x).
+ */
+export function pinComplete(root, where) {
+    if (!root.service.length)
+        throw new BadTrust(`${where} pins no service key: give at least the service's key${cite("D142")}; ${RUN_CI}`);
+    if (root.project === undefined) {
+        throw new BadTrust(`${where} pins no project: CI must pin the repo's project beside its keys, so a commit can't link the repo to another${cite("B-mar8x")}; ${RUN_CI}`);
+    }
+    return root;
+}
+/**
+ * CI's pin (D142, D159): the service's keys and passkey keys, and the repo's project beside them (B-mar8x), from
+ * `BAESIAN_TRUST` or the file `BAESIAN_TRUST_FILE` names, or both; undefined when neither is set. Set but empty or
+ * unreadable throws, as does a pin with no service key or no project: a misconfigured pin must fail the check, not quietly
+ * turn it off.
+ */
+export function pinnedTrust(env = process.env) {
+    const inline = env[TRUST_ENV];
+    const path = env[TRUST_FILE_ENV];
+    if (inline === undefined && path === undefined)
+        return undefined;
+    const parts = [];
+    if (inline !== undefined) {
+        // GitHub Actions gives a repository variable that isn't set as an empty string.
+        if (!inline.trim())
+            throw new BadTrust(`${TRUST_ENV} is set but empty, as GitHub Actions gives a variable that isn't set: ${RUN_CI}; or, in a repo that isn't linked, unset it`);
+        parts.push(parseTrust(inline, TRUST_ENV));
+    }
+    if (path !== undefined) {
+        let text;
+        try {
+            text = readFileSync(path, "utf8");
+        }
+        catch (e) {
+            throw new BadTrust(`${TRUST_FILE_ENV} names ${path}, which can't be read (${e instanceof Error ? e.message : String(e)})`);
+        }
+        parts.push(parseTrust(text, path));
+    }
+    const where = [inline !== undefined ? TRUST_ENV : "", path ?? ""].filter(Boolean).join(" and ");
+    const root = { service: parts.flatMap((p) => p.service), revoked: parts.flatMap((p) => p.revoked), passkeys: parts.flatMap((p) => p.passkeys) };
+    for (const p of parts)
+        if (p.project !== undefined)
+            pinProject(root, p.project, where);
+    return pinComplete(root, where);
+}
+/** Why `key` couldn't sign at `at`: before it was valid, after it expired, or once it was revoked. */
+function invalidAt(root, key, at) {
+    const t = Date.parse(at);
+    if (t < Date.parse(key.valid_after))
+        return `before key ${key.key} was valid`;
+    if (key.valid_before && t >= Date.parse(key.valid_before))
+        return `after key ${key.key} expired`;
+    const gone = root.revoked.find((r) => r.key === key.key && Date.parse(r.at) <= t);
+    if (gone)
+        return `after key ${key.key} was revoked`;
+    return undefined;
+}
+/**
+ * Whether a file counts as the service's word (D138, D160): `sigText` is an OpenSSH signature over `bytes` in the
+ * `baesian` namespace, by a trusted service key that was valid at `at`, the file's own time, and not revoked by then.
+ * Returns the key, for a passkey proof's origin, or why not. A signature in a newer format throws `NewerFormat` (D157).
+ */
+export function checkSigned(root, bytes, sigText, at, file) {
+    let sig;
+    try {
+        sig = parseSignature(sigText, `${file}.sig`);
+    }
+    catch (e) {
+        if (e instanceof NewerFormat)
+            throw e;
+        return { problem: `its signature can't be read (${e instanceof Error ? e.message : String(e)})` };
+    }
+    if (sig.namespace !== NAMESPACE)
+        return { problem: `it's signed for ${JSON.stringify(sig.namespace)}, not ${JSON.stringify(NAMESPACE)}` };
+    const keys = root.service.filter((k) => sameKey(k.public_key, sig.publicKey));
+    if (!keys.length)
+        return { problem: "it's signed by a key that isn't trusted" };
+    if (!signatureMatches(sig, bytes, NAMESPACE))
+        return { problem: "its signature doesn't match its bytes" };
+    const valid = keys.find((k) => !invalidAt(root, k, at));
+    return valid ? { key: valid } : { problem: `it was signed ${invalidAt(root, keys[0], at)}` };
+}
+function sameKey(openssh, blob) {
+    try {
+        return publicKeyBlob(openssh).equals(blob);
+    }
+    catch (e) {
+        if (e instanceof BadSignature)
+            return false;
+        throw e;
+    }
+}
+/** A file's fields in one order, so two copies of a trust file compare by content. */
+const canonical = (f) => JSON.stringify(Object.fromEntries(Object.entries(f).sort(([a], [b]) => a.localeCompare(b))));
+/**
+ * The record's keys that CI doesn't pin, or pins differently (D142, D159). A key in the record that CI doesn't pin fails
+ * the run: the commit gate on your machine trusts the record's copy, so an added key could pass forged answers there.
+ * Revocations only take trust away, so the record's apply whether or not CI pins them.
+ */
+export function pinProblems(pinned, record) {
+    const pins = new Set([...pinned.service, ...pinned.passkeys].map(canonical));
+    return record
+        .filter(({ key }) => !pins.has(canonical(key)))
+        .map(({ file, key }) => key.type === "service-key"
+        ? `${file} isn't pinned in CI, or differs from the pinned copy${cite("D142")}. If the service rotated its key, add its line to ${TRUST_ENV}; if not, someone else added it: remove it and find out how. Its line: ${JSON.stringify(key)}`
+        : `${file}, ${key.handle}'s passkey, isn't pinned in CI, or differs from the pinned copy${cite("D159")}. If you enrolled it, add its line to ${TRUST_ENV}; if not, someone else added it: remove it and find out how. Its line: ${JSON.stringify(key)}`);
+}
+/** What the relay signs for a card revision's draw (P16 section 3): its ID, revision and file digest. */
+export function drawMessage(id, revision, card) {
+    return Buffer.from(`${id} r${revision} ${createHash("sha256").update(card).digest("hex")}\n`);
+}
+/**
+ * A relay's draw for audit, from its proof (D158): the proof must be a trusted service key's signature, in the
+ * `baesian-draw` namespace, over the card revision's ID, revision and file digest, made while the key was valid at
+ * `at`. Ed25519 signatures are deterministic, so the relay can't redraw, and nobody without its key can predict one.
+ * The draw is the signature's SHA-256 digest, its first six bytes read as a number from 0 to 1, as the CLI's is.
+ */
+export function drawOfProof(root, proof, id, revision, card, at) {
+    let sig;
+    try {
+        sig = parseSignature(proof, `${id}'s draw proof`);
+    }
+    catch (e) {
+        if (e instanceof NewerFormat)
+            throw e;
+        return { problem: `its draw proof can't be read (${e instanceof Error ? e.message : String(e)})` };
+    }
+    const keys = root.service.filter((k) => sameKey(k.public_key, sig.publicKey));
+    if (!keys.length)
+        return { problem: "its draw proof is signed by a key that isn't trusted" };
+    if (!signatureMatches(sig, drawMessage(id, revision, card), DRAW_NAMESPACE))
+        return { problem: "its draw proof isn't the service's signature over this card revision" };
+    if (!keys.some((k) => !invalidAt(root, k, at)))
+        return { problem: `its draw proof was signed ${invalidAt(root, keys[0], at)}` };
+    return { draw: createHash("sha256").update(sig.signature).digest().readUIntBE(0, 6) / 2 ** 48 };
+}
+//# sourceMappingURL=trust.js.map

package/dist/usage-fields.js

@@ -0,0 +1,161 @@
+// What the hosted service counts of its use (B-7nq85, "Ten kinds of event, fixed values only"; D141, "everyone, with an
+// opt-out"). One list, shared: the service records an event only if it passes `usageProblem()` against it, and the
+// website's public page (/counts) lists it, so the page and what's kept can't drift apart. Every value is from a fixed
+// list, a number or yes/no, so no field can carry text. No imports: the website's build takes this file as it is.
+export const USAGE_LEVELS = ["provisional", "blocking", "hard"];
+export const USAGE_RESPONSES = ["accept", "alternative", "correction", "reject", "question", "need_context", "see_it_run", "not_my_area", "defer"];
+export const USAGE_FACTS = ["schema", "public-api", "dependency", "user-facing", "publishes", "security", "privacy", "money", "data-loss", "infra"];
+export const USAGE_REVERSE = ["cheap", "moderate", "one-way"];
+/** The service's addresses, by name, for errors: a project's (`/v1/projects/{project}/…`) and the rest of `/v1/`. */
+export const USAGE_ROUTES = [
+    "log",
+    "state",
+    "presets",
+    "live",
+    "pushes",
+    "upload",
+    "stop-waiting",
+    "verdicts",
+    "aliases",
+    "preferences",
+    "presence",
+    "proofs",
+    "config",
+    "signup",
+    "signin",
+    "recover",
+    "account",
+    "globus",
+    "machines",
+    "usage",
+    "other",
+];
+const oneOf = (values) => ({ type: "one-of", values });
+const NUMBER = { type: "number" };
+const YES_NO = { type: "yes-no" };
+/** The ten kinds (B-7nq85), with their fields. */
+export const USAGE_KINDS = {
+    account_created: {
+        when: "an account is made",
+        why: "how many people sign up, and whether they come through Globus",
+        fields: { via: { value: oneOf(["email", "globus"]), what: "how they signed up" } },
+        ids: true,
+    },
+    machine_approved: {
+        when: "a machine is approved to sign in to a project",
+        why: "how many machines and repos people link",
+        fields: { new_project: { value: YES_NO, what: "whether approving it made a new project" } },
+        ids: true,
+    },
+    card_filed: {
+        when: "a machine sends a card, or a revision of one, to the service",
+        why: "what agents ask about, how often the gate holds cards back, and which harnesses are used",
+        fields: {
+            revision: { value: NUMBER, what: "which revision of its card it is: 1 for a new card" },
+            level: { value: oneOf(USAGE_LEVELS), what: "its level in force" },
+            gate: { value: oneOf(["shown", "held", "shadow"]), what: "whether the gate showed it, held it back, or would have in shadow" },
+            touches: { value: { type: "any-of", values: USAGE_FACTS }, what: "which of the ten facts it says it touches" },
+            reverse: { value: oneOf(USAGE_REVERSE), what: "how costly it says it is to undo" },
+            harness: { value: oneOf(["claude-code", "codex", "other"]), what: "which harness filed it; any other agent's name is kept only as other" },
+            by_baesian: { value: YES_NO, what: "whether Baesian filed it itself (a proposal from your answers)" },
+        },
+        ids: true,
+    },
+    card_answered: {
+        when: "you answer a card on the website",
+        why: "how often answers overturn the agent's pick or ask for more context, how long cards wait, and whether you answer from a phone",
+        fields: {
+            response: { value: oneOf(USAGE_RESPONSES), what: "which answer it was" },
+            client: { value: oneOf(["desktop", "phone"]), what: "the desktop layout or the phone's" },
+            level: { value: oneOf(USAGE_LEVELS), what: "the card's level in force" },
+            minutes_waiting: { value: NUMBER, what: "minutes from the card's filing to the answer" },
+            blind_match: { value: YES_NO, what: "whether your choice before the agent's pick was shown matched it; left out for a card you'd answered in chat first" },
+            switched: { value: YES_NO, what: "whether you changed your choice after seeing the agent's pick" },
+            was_held: { value: YES_NO, what: "whether the gate had held the card back" },
+            made_rule: { value: YES_NO, what: "whether you asked for a rule from it" },
+        },
+        ids: true,
+    },
+    preferences_changed: {
+        when: "you change your preferences",
+        why: "whether the preference sliders are used",
+        fields: {
+            mode: { value: oneOf(["shadow", "on"]), what: "whether holding back is in shadow or on" },
+            loosening: { value: YES_NO, what: "whether the change lets more cards past you" },
+            rows_changed: { value: NUMBER, what: "how many rows changed" },
+        },
+        ids: true,
+    },
+    topic_merged: {
+        when: "you merge two topics",
+        why: "whether merging topics is used",
+        fields: {},
+        ids: true,
+    },
+    push_sent: {
+        when: "the service sends a notification",
+        why: "how often notifications go, and whether they arrive",
+        fields: {
+            reason: { value: oneOf(["at once", "digest"]), what: "a blocking or hard card at once, or a digest" },
+            urgency: { value: oneOf(["high", "normal"]), what: "the urgency the push service was given" },
+            cards: { value: NUMBER, what: "how many cards it counted" },
+            result: { value: oneOf(["delivered", "gone", "failed"]), what: "what the push services answered" },
+        },
+        ids: true,
+    },
+    push_opened: {
+        when: "you open a notification",
+        why: "how long after a notification you open it",
+        fields: { minutes_after: { value: NUMBER, what: "minutes from the notification to opening it" } },
+        ids: true,
+    },
+    visit: {
+        when: "you open a project's page, the first time each day on each kind of screen",
+        why: "how many people answer each day, and on which kind of screen",
+        fields: { client: { value: oneOf(["desktop", "phone"]), what: "the desktop layout or the phone's" } },
+        ids: true,
+    },
+    error: {
+        when: "the service fails to answer a request",
+        why: "where the service fails",
+        fields: {
+            route: { value: oneOf(USAGE_ROUTES), what: "which of the service's addresses failed, by name" },
+            status: { value: NUMBER, what: "the error's status code" },
+        },
+        ids: false,
+    },
+};
+/** What's never counted, in words, as the public page says it. */
+export const NEVER_COUNTED = [
+    "what a card says: its title, question, options, crux, body or comments",
+    "topics, deck names, project names and repo names or addresses",
+    "branch names, file paths and code",
+    "handles, email addresses, machine names and agents' own names",
+    "card IDs, project IDs and account IDs",
+    "network addresses, locations and browsers' names",
+    "the exact time anything happened: only its hour",
+];
+/** Raw events are kept this many days, then only daily counts with no ID, key or hour. */
+export const USAGE_RAW_DAYS = 90;
+/** The fields an event of a kind may record, checked: undefined if they pass, otherwise why not. Nothing else is kept. */
+export function usageProblem(kind, fields) {
+    const k = Object.hasOwn(USAGE_KINDS, kind) ? USAGE_KINDS[kind] : undefined;
+    if (!k)
+        return `${kind} isn't a kind of event the service counts`;
+    for (const [name, v] of Object.entries(fields)) {
+        const f = Object.hasOwn(k.fields, name) ? k.fields[name] : undefined;
+        if (!f)
+            return `${kind} has no field ${name}`;
+        const spec = f.value;
+        if (spec.type === "number" && !(typeof v === "number" && Number.isInteger(v) && v >= 0 && v <= 10_000_000))
+            return `${kind}.${name} is a whole number`;
+        if (spec.type === "yes-no" && typeof v !== "boolean")
+            return `${kind}.${name} is yes or no`;
+        if (spec.type === "one-of" && !(typeof v === "string" && spec.values.includes(v)))
+            return `${kind}.${name} is one of ${spec.values.join(", ")}`;
+        if (spec.type === "any-of" && !(Array.isArray(v) && v.every((x) => typeof x === "string" && spec.values.includes(x)) && new Set(v).size === v.length))
+            return `${kind}.${name} is a list from ${spec.values.join(", ")}`;
+    }
+    return undefined;
+}
+//# sourceMappingURL=usage-fields.js.map