create-principles-disciple 1.121.8 → 1.121.10

package/console/dist/ui/utils/validators.js

@@ -1,3 +1,9 @@
+// PRI-613: feedback submit-ladder data shapes derive from the canonical shared
+// schema contract via `import type` ONLY — a runtime import would bundle
+// @sinclair/typebox into the browser (~850KB, measured; SPEC §10.5 stop
+// condition). The runtime const FEEDBACK_CHANNEL_IDS lives in a separate
+// dependency-free module so browser code can check channel IDs safely.
+import { FEEDBACK_CHANNEL_IDS } from '../../shared/feedback-channel-ids.js';
 // ── Primitive guards ──────────────────────────────────────────────────────────
 function isString(v) {
     return typeof v === 'string';
@@ -124,6 +130,101 @@ function isOwnerGovernanceView(value) {
 export function validateOwnerGovernanceView(value) {
     return isOwnerGovernanceView(value) ? value : null;
 }
+// ── PRI-586: Governance Experience Snapshot v1.5.1 (browser-local validator) ──
+// Mirrors the authoritative TypeBox contract in principles-core
+// (governance-experience-contract.ts). Type-only import above keeps the client
+// bundle free of the Node-oriented core barrel (ERR-100).
+const governancePrimaryAttentions = new Set(['setup_required', 'owner_decision_required', 'recovery_required', 'degraded', 'background_processing', 'all_clear']);
+const governanceExperienceReasonCodes = new Set([
+    'governance.exp.reason.owner_identity_missing', 'governance.exp.reason.approval_pending',
+    'governance.exp.reason.rulecode_owner_decision', 'governance.exp.reason.no_pending_decision',
+    'governance.exp.reason.owner_decision_available', 'governance.exp.reason.break_glass_entry',
+    'governance.exp.reason.recovery_required', 'governance.exp.reason.source_unavailable',
+    'governance.exp.reason.config_invalid', 'governance.exp.reason.processing',
+    'governance.exp.reason.workspace_clear', 'governance.exp.reason.workspace_empty',
+]);
+const governanceExperienceNextActionCodes = new Set([
+    'governance.exp.next.configure_owner', 'governance.exp.next.review_approvals',
+    'governance.exp.next.inspect_recovery', 'governance.exp.next.inspect_sources',
+    'governance.exp.next.fix_config', 'governance.exp.next.monitor', 'governance.exp.next.none',
+]);
+const governanceObservedAuthorities = new Set(['operator_legacy', 'configured_owner', 'break_glass']);
+const governanceActionKinds = new Set(['principle_approval', 'rulecode_owner_decision', 'emergency_pause']);
+const governanceActivityCategories = new Set(['blocked', 'needs_recovery', 'needs_decision', 'processing']);
+const governanceEnvironmentValues = new Set(['production', 'development', 'demo', 'test', 'unknown']);
+const governanceEnvironmentSources = new Set(['workspace_config', 'missing']);
+const governanceIssueGroupSources = new Set(['ledger', 'artifact', 'task', 'approval', 'activation', 'trajectory', 'lineage', 'workspace']);
+function isGovernanceActivityItem(value) {
+    return isObject(value) && hasOwnFields(value, ['category', 'reasonCode', 'sourceRefs'])
+        && isStringEnum(value.category, governanceActivityCategories)
+        && typeof value.reasonCode === 'string' && value.reasonCode.length > 0
+        && isGovernanceSourceRefs(value.sourceRefs)
+        && (!Object.hasOwn(value, 'principleId') || (typeof value.principleId === 'string' && value.principleId.length > 0));
+}
+function isGovernanceActionReadiness(value) {
+    return isObject(value) && hasOwnFields(value, ['kind', 'observedAuthority', 'status', 'reasonCode', 'nextActionCode'])
+        && isStringEnum(value.kind, governanceActionKinds)
+        && isStringEnum(value.observedAuthority, governanceObservedAuthorities)
+        && isStringEnum(value.status, new Set(['entry_conditions_met', 'blocked']))
+        && isStringEnum(value.reasonCode, governanceExperienceReasonCodes)
+        && isStringEnum(value.nextActionCode, governanceExperienceNextActionCodes);
+}
+function isEnvironmentContext(value) {
+    return isObject(value) && hasOwnFields(value, ['environment', 'source'])
+        && isStringEnum(value.environment, governanceEnvironmentValues)
+        && isStringEnum(value.source, governanceEnvironmentSources)
+        && (!Object.hasOwn(value, 'configIssue') || (typeof value.configIssue === 'string' && value.configIssue.length > 0));
+}
+function isGovernanceExperienceSnapshot(value) {
+    if (!isObject(value) || !hasOwnFields(value, ['schemaVersion', 'snapshotId', 'asOf', 'summary', 'readiness', 'activity', 'trustContext', 'dataQuality']))
+        return false;
+    if (value.schemaVersion !== '1' || typeof value.snapshotId !== 'string' || value.snapshotId.length === 0 || !isGovernanceTimestamp(value.asOf))
+        return false;
+    const { summary, readiness, activity, trustContext, dataQuality } = value;
+    if (!isObject(summary) || !hasOwnFields(summary, ['primaryAttention', 'headlineCode', 'reasonCode', 'nextActionCode'])
+        || !isStringEnum(summary.primaryAttention, governancePrimaryAttentions)
+        || typeof summary.headlineCode !== 'string' || summary.headlineCode.length === 0
+        || !isStringEnum(summary.reasonCode, governanceExperienceReasonCodes)
+        || !isStringEnum(summary.nextActionCode, governanceExperienceNextActionCodes))
+        return false;
+    if (!isObject(readiness) || !hasOwnFields(readiness, ['authenticationMode', 'ownerIdentityConfiguration', 'governanceActions'])
+        || !isStringEnum(readiness.authenticationMode, new Set(['authenticated', 'no_auth']))
+        || !isStringEnum(readiness.ownerIdentityConfiguration, new Set(['configured', 'missing']))
+        || !Array.isArray(readiness.governanceActions) || readiness.governanceActions.length !== 3
+        || !readiness.governanceActions.every(isGovernanceActionReadiness))
+        return false;
+    if (!isObject(activity) || !hasOwnFields(activity, ['primaryAttention', 'categories'])
+        || !isStringEnum(activity.primaryAttention, governancePrimaryAttentions)
+        || !Array.isArray(activity.categories)
+        || !activity.categories.every((category) => isObject(category)
+            && hasOwnFields(category, ['category', 'count', 'items', 'hasMore'])
+            && isStringEnum(category.category, governanceActivityCategories)
+            && typeof category.count === 'number' && Number.isInteger(category.count) && category.count >= 0
+            && Array.isArray(category.items) && category.items.length <= 10 && category.items.every(isGovernanceActivityItem)
+            && typeof category.hasMore === 'boolean'))
+        return false;
+    if (!isObject(trustContext) || !hasOwnFields(trustContext, ['environmentContext', 'lineageTransparency'])
+        || !isEnvironmentContext(trustContext.environmentContext)
+        || !isObject(trustContext.lineageTransparency)
+        || !hasOwnFields(trustContext.lineageTransparency, ['confidence', 'strongViewCount', 'weakViewCount', 'unknownViewCount'])
+        || !isStringEnum(trustContext.lineageTransparency.confidence, lineageConfidences)
+        || [trustContext.lineageTransparency.strongViewCount, trustContext.lineageTransparency.weakViewCount, trustContext.lineageTransparency.unknownViewCount]
+            .some(count => typeof count !== 'number' || !Number.isInteger(count) || count < 0))
+        return false;
+    return isObject(dataQuality) && hasOwnFields(dataQuality, ['degraded', 'issueGroups', 'hasMore'])
+        && typeof dataQuality.degraded === 'boolean' && typeof dataQuality.hasMore === 'boolean'
+        && Array.isArray(dataQuality.issueGroups) && dataQuality.issueGroups.length <= 10
+        && dataQuality.issueGroups.every((group) => isObject(group)
+            && hasOwnFields(group, ['source', 'reasonCode', 'nextActionCode', 'count', 'sampleRefs'])
+            && isStringEnum(group.source, governanceIssueGroupSources)
+            && typeof group.reasonCode === 'string' && group.reasonCode.length > 0
+            && typeof group.nextActionCode === 'string' && group.nextActionCode.length > 0
+            && typeof group.count === 'number' && Number.isInteger(group.count) && group.count >= 1
+            && isGovernanceSourceRefs(group.sampleRefs));
+}
+export function validateGovernanceExperienceSnapshot(value) {
+    return isGovernanceExperienceSnapshot(value) ? value : null;
+}
 export function validateErrorResponse(v) {
     if (!isObject(v))
         return null;
@@ -211,35 +312,37 @@ export function validateDeleteEnvelope(v) {
         return null;
     return { deleted: v.deleted };
 }
-const CHANNEL_IDS = ['ingest', 'github', 'email', 'file'];
+function isValidChannelStatus(item) {
+    if (!Object.hasOwn(item, 'id') || !isString(item.id) || !FEEDBACK_CHANNEL_IDS.includes(item.id))
+        return null;
+    if (!Object.hasOwn(item, 'available') || !isBoolean(item.available))
+        return null;
+    const reason = readNullableString(item, 'reason');
+    const nextAction = readNullableString(item, 'nextAction');
+    if (!reason.valid || !nextAction.valid)
+        return null;
+    const status = { id: item.id, available: item.available };
+    if (reason.value !== null)
+        status.reason = reason.value;
+    if (nextAction.value !== null)
+        status.nextAction = nextAction.value;
+    return status;
+}
 export function validateFeedbackChannels(v) {
     if (!isObject(v))
         return null;
     if (!Object.hasOwn(v, 'channels') || !Array.isArray(v.channels))
         return null;
+    // Per-item leniency preserved: invalid channel entries are skipped, the
+    // envelope is not rejected (legacy behavior — a bad single probe must not
+    // hide the other channels).
     const channels = [];
     for (const item of v.channels) {
         if (!isObject(item))
             continue;
-        if (!Object.hasOwn(item, 'id') || !isString(item.id) || !CHANNEL_IDS.includes(item.id))
-            continue;
-        if (!Object.hasOwn(item, 'available') || !isBoolean(item.available))
-            continue;
-        const status = {
-            id: item.id,
-            available: item.available,
-        };
-        const reason = readNullableString(item, 'reason');
-        const nextAction = readNullableString(item, 'nextAction');
-        if (!reason.valid)
-            return null;
-        if (!nextAction.valid)
-            return null;
-        if (reason.value !== null)
-            status.reason = reason.value;
-        if (nextAction.value !== null)
-            status.nextAction = nextAction.value;
-        channels.push(status);
+        const status = isValidChannelStatus(item);
+        if (status !== null)
+            channels.push(status);
     }
     return { channels };
 }
@@ -648,6 +751,11 @@ export function validateRecoveryResult(v) {
         newStatus: v.newStatus,
         result: v.result,
     };
+    if (Object.hasOwn(v, 'forceApplied')) {
+        if (!isBoolean(v.forceApplied))
+            return null;
+        result.forceApplied = v.forceApplied;
+    }
     if (Object.hasOwn(v, 'nextAction')) {
         if (!isString(v.nextAction))
             return null;
@@ -1004,6 +1112,19 @@ export function validateUpdateStatus(v) {
     }
     return result;
 }
+export const UPDATE_HISTORY_KINDS = [
+    'update',
+    'reinstall',
+    'legacy_migration',
+    'rollback',
+    'refusal',
+    'failure',
+    'recovery',
+    'unknown',
+];
+function isUpdateHistoryKind(value) {
+    return typeof value === 'string' && UPDATE_HISTORY_KINDS.includes(value);
+}
 export function validateUpdateHistoryEntry(v) {
     if (!isObject(v))
         return null;
@@ -1017,10 +1138,25 @@ export function validateUpdateHistoryEntry(v) {
         return null;
     if (!Object.hasOwn(v, 'success') || !isBoolean(v.success))
         return null;
-    const entry = { id: v.id, timestamp: v.timestamp, fromVersion: v.fromVersion, toVersion: v.toVersion, success: v.success };
+    if (!Object.hasOwn(v, 'kind') || !isUpdateHistoryKind(v.kind))
+        return null;
+    const entry = {
+        id: v.id,
+        timestamp: v.timestamp,
+        fromVersion: v.fromVersion,
+        toVersion: v.toVersion,
+        success: v.success,
+        kind: v.kind,
+    };
     if (Object.hasOwn(v, 'backupPath') && isString(v.backupPath)) {
         entry.backupPath = v.backupPath;
     }
+    if (Object.hasOwn(v, 'reason') && isString(v.reason)) {
+        entry.reason = v.reason;
+    }
+    if (Object.hasOwn(v, 'nextAction') && isString(v.nextAction)) {
+        entry.nextAction = v.nextAction;
+    }
     return entry;
 }
 export function validateUpdateHistory(v) {
@@ -2099,3 +2235,94 @@ export function validateIntentVersions(v) {
         return null;
     return { versions };
 }
+function parseOwnerGovernanceReadiness(v) {
+    if (!isObject(v))
+        return null;
+    if (!Object.hasOwn(v, 'authenticationMode') || (v.authenticationMode !== 'authenticated' && v.authenticationMode !== 'no_auth'))
+        return null;
+    if (!Object.hasOwn(v, 'ownerIdentityConfiguration') || (v.ownerIdentityConfiguration !== 'configured' && v.ownerIdentityConfiguration !== 'missing'))
+        return null;
+    return { authenticationMode: v.authenticationMode, ownerIdentityConfiguration: v.ownerIdentityConfiguration };
+}
+function parseOwnerIdentityRecordData(v) {
+    if (v === undefined || v === null)
+        return null;
+    if (!isObject(v))
+        return null;
+    const rec = v;
+    if (!Object.hasOwn(rec, 'schemaVersion') || !isNumber(rec.schemaVersion))
+        return null;
+    if (!Object.hasOwn(rec, 'ownerId') || !isString(rec.ownerId))
+        return null;
+    if (!Object.hasOwn(rec, 'credentialId') || !isString(rec.credentialId))
+        return null;
+    if (!Object.hasOwn(rec, 'registeredAt') || !isString(rec.registeredAt))
+        return null;
+    return { schemaVersion: rec.schemaVersion, ownerId: rec.ownerId, credentialId: rec.credentialId, registeredAt: rec.registeredAt };
+}
+export function validateOwnerIdentityView(v) {
+    if (!isObject(v))
+        return null;
+    if (!Object.hasOwn(v, 'resolved') || !isObject(v.resolved))
+        return null;
+    const r = v.resolved;
+    if (!Object.hasOwn(r, 'ownerId') || (r.ownerId !== null && !isString(r.ownerId)))
+        return null;
+    if (!Object.hasOwn(r, 'credentialId') || (r.credentialId !== null && !isString(r.credentialId)))
+        return null;
+    if (!Object.hasOwn(r, 'source') || (r.source !== 'env' && r.source !== 'file' && r.source !== 'none' && r.source !== 'invalid_env'))
+        return null;
+    const governance = parseOwnerGovernanceReadiness(v.governance);
+    if (governance === null)
+        return null;
+    const out = {
+        resolved: {
+            ownerId: r.ownerId,
+            credentialId: r.credentialId,
+            source: r.source,
+            ...(Object.hasOwn(r, 'error') && isString(r.error) ? { error: r.error } : {}),
+        },
+        fileRecord: parseOwnerIdentityRecordData(v.fileRecord),
+        governance,
+    };
+    if (Object.hasOwn(v, 'fileError') && isString(v.fileError))
+        out.fileError = v.fileError;
+    return out;
+}
+export function validateOwnerIdentityRegister(v) {
+    if (!isObject(v))
+        return null;
+    if (!Object.hasOwn(v, 'source') || v.source !== 'file')
+        return null;
+    if (!Object.hasOwn(v, 'record') || !isObject(v.record))
+        return null;
+    const rec = v.record;
+    if (!Object.hasOwn(rec, 'schemaVersion') || !isNumber(rec.schemaVersion))
+        return null;
+    if (!Object.hasOwn(rec, 'ownerId') || !isString(rec.ownerId))
+        return null;
+    if (!Object.hasOwn(rec, 'credentialId') || !isString(rec.credentialId))
+        return null;
+    if (!Object.hasOwn(rec, 'registeredAt') || !isString(rec.registeredAt))
+        return null;
+    const governance = parseOwnerGovernanceReadiness(v.governance);
+    if (governance === null)
+        return null;
+    return {
+        source: 'file',
+        record: { schemaVersion: rec.schemaVersion, ownerId: rec.ownerId, credentialId: rec.credentialId, registeredAt: rec.registeredAt },
+        governance,
+    };
+}
+export function validateOwnerIdentityUnregister(v) {
+    if (!isObject(v))
+        return null;
+    if (!Object.hasOwn(v, 'ok') || !isBoolean(v.ok) || v.ok !== true)
+        return null;
+    if (!Object.hasOwn(v, 'source') || v.source !== 'none')
+        return null;
+    const governance = parseOwnerGovernanceReadiness(v.governance);
+    if (governance === null)
+        return null;
+    return { ok: true, source: 'none', governance };
+}

package/console/dist/web/assets/app.css

@@ -457,6 +457,9 @@
   .mr-2 {
     margin-right: calc(var(--spacing) * 2);
   }
+  .mr-4 {
+    margin-right: calc(var(--spacing) * 4);
+  }
   .mb-0\.5 {
     margin-bottom: calc(var(--spacing) * 0.5);
   }
@@ -1779,6 +1782,9 @@
   .pt-0 {
     padding-top: 0px;
   }
+  .pt-0\.5 {
+    padding-top: calc(var(--spacing) * 0.5);
+  }
   .pt-1 {
     padding-top: var(--spacing);
   }