modelrig 0.0.1 → 0.2.0

package/dist/types/route.d.ts

@@ -0,0 +1,205 @@
+/**
+ * Route bundle contract — spec §3. Loaded from modelrig/routes/*.yaml by
+ * routes/loader.ts; frozen after load.
+ */
+import type { FailureClass } from "./failures";
+import type { ProviderId, SamplingParams, ServiceTier, ToolCall, ToolChoice, ToolDefinition } from "./provider";
+export interface CandidateSpec {
+    readonly provider: ProviderId;
+    readonly model: string;
+}
+export type Requirement = "schema_conformant" | "grounded" | "zero_retention" | "trace_visible";
+export type Preference = "cost" | "latency";
+export interface RoutePolicy {
+    /** Per-class retry budgets — non-fungible. Missing class => 0 retries. */
+    readonly retries: Partial<Record<FailureClass, number>>;
+    readonly timeoutMs: number;
+    readonly tier: ServiceTier;
+    readonly json: "native" | "json_mode";
+    /**
+     * Declared sampling (CE-6, spec §2) — `temperature`/`top_p`/`max_output_tokens`
+     * the original call used, parsed+validated at bundle load (config errors,
+     * fail-loud). Optional & additive (S3): ABSENT ⇒ every adapter behaves exactly
+     * as pre-CE-6 (gemini keeps its ported constants, the rest send nothing). The
+     * block is threaded onto `AdapterRequest.sampling` for the primary AND repair
+     * attempts (repair/extractor followups inherit the route's sampling — one knob
+     * per route, not per rung). */
+    readonly sampling?: SamplingParams;
+}
+/** Repair rung config (Phase 3 WS2, ladder rung 4). */
+export interface RepairPolicy {
+    /** Total repair attempts on a schema-invalid output: attempt 1 re-asks the
+     * SAME model with the ajv error summary; attempt 2 (when maxRepairs ≥ 2 and
+     * repairModel is set) hands {invalid output, errors, schema} to the
+     * designated repair model. */
+    readonly maxRepairs: number;
+    /** Designated cheap repair model — must be one of the route's declared
+     * candidates (candidate-set invariant holds through repair). */
+    readonly repairModel?: CandidateSpec;
+}
+/** A named route variant (Phase 3 WS1, bundle format v2 — additive).
+ * Every field optional; an absent field inherits the route's base config. */
+export interface RouteVariant {
+    readonly name: string;
+    /** Candidate narrowing — MUST be a subset of the route's declared
+     * candidates (loader-enforced; the candidate-set invariant is unbreachable
+     * via variants). */
+    readonly candidates?: readonly CandidateSpec[];
+    /** Replaces the system template entirely (rendered with the same variables
+     * and capability conditionals). Mutually exclusive with promptAppend. */
+    readonly promptOverride?: string;
+    /** Appended to the rendered system prompt (after capability conditionals,
+     * before json coaching). */
+    readonly promptAppend?: string;
+    /** Reasoning scaffold (thinking directives; manual authoring this phase) —
+     * appended after promptAppend, before json coaching. */
+    readonly scaffold?: string;
+    /** JSON rung override for this variant. */
+    readonly json?: "native" | "json_mode";
+    readonly repair?: RepairPolicy;
+}
+export interface RouteBundle {
+    readonly route: string;
+    readonly version: number;
+    /** Resolved, parsed JSON Schema (null = unstructured route). */
+    readonly outputSchema: object | null;
+    readonly candidates: readonly CandidateSpec[];
+    readonly require: readonly Requirement[];
+    readonly prefer: readonly Preference[];
+    /** Raw template text with {{var}} and {{#if capability.X}} blocks. */
+    readonly systemTemplate: string;
+    readonly variables: readonly string[];
+    readonly policy: RoutePolicy;
+    /** Base-config repair rung (Phase 3 WS2) — variants may override. */
+    readonly repair?: RepairPolicy;
+    /** Named variants (Phase 3 WS1, bundle v2) — [] for v1 bundles. */
+    readonly variants: readonly RouteVariant[];
+    /** Local-only replay capture opt-in (Phase 3 WS4) — default false. */
+    readonly capture: boolean;
+    /** Request-path caching opt-in (cache-aware-routing WS-C, YAML `cache: auto`)
+     * — when true the run loop stamps `AdapterRequest.cache` (gated per provider
+     * cache policy) and the stable-prefix fingerprint onto telemetry. Optional &
+     * additive (S3): absent ⇒ false ⇒ pre-WS-C behavior (no cache stamping).
+     * Gemini candidates on a `cache: auto` route are excluded from request-path
+     * stamping and rely on implicit caching — enforced by the policy gate in
+     * cache-stamp.ts, not by prose. */
+    readonly cache?: boolean;
+    /** Grounding-inject search-query template (Phase 3 WS3) — rendered with
+     * the same variables as the system template; absent = the capped rendered
+     * prompt is used as the query (adequate only for short prompts). */
+    readonly groundingQuery?: string;
+    /** Schema-fingerprint cell key, computed at load from outputSchema
+     * (registry/fingerprint.ts); null for unstructured routes. */
+    readonly fingerprintCell: string | null;
+}
+export interface RunTags {
+    readonly run_id?: string;
+    readonly step?: string;
+    readonly [key: string]: string | undefined;
+}
+export interface RunOptions {
+    readonly input: Record<string, unknown>;
+    readonly tags: RunTags;
+    readonly budget?: {
+        readonly envelope: string;
+        /** Budget for this envelope when it is FIRST opened (open-or-get: the first
+         * opener's budget wins; a pre-existing envelope is never resized). Omitted →
+         * the rig's default `envelopeBudgetUsd`. The hosted gateway's mirror lane
+         * sets this to the per-org daily cap so a customer's MANAGED spend is bounded
+         * independently of the deployment's own daily envelope (spend-safety). */
+        readonly budgetUsd?: number;
+    };
+    /** Named variant to serve (Phase 3 WS1); omitted = the default variant
+     * (the route's base config). Unknown names are config errors. */
+    readonly variant?: string;
+    /** Per-run data-governance opt-in (G-3). `true` demands zero-retention
+     * routing for THIS run — `zero_retention` is unioned into the run's effective
+     * `require`, so it routes only to ZDR-designated endpoints (empty set →
+     * the existing no-eligible-candidate error, fail-closed). Additive only: a run
+     * may opt INTO the requirement, never opt OUT of a route's declared one
+     * (opting out would be a governance downgrade). Absent/false = the route's
+     * declared `require` stands. */
+    readonly zeroRetention?: boolean;
+    /** Per-run price ceiling (G-2). Drops any candidate whose blended in+out
+     * snapshot rate exceeds this — the SAME rate `prefer:[cost]` sorts on, so
+     * filter and sort agree. Unknown cost + a ceiling set → dropped (fail-closed,
+     * like the envelope). Distinct from the per-run envelope, which caps total
+     * spend across attempts; this narrows WHICH models are eligible. */
+    readonly maxPriceUsdPerMTok?: number;
+    /** Per-run provider allow/deny (G-2), applied before capability + ZDR. */
+    readonly providers?: {
+        readonly only?: readonly ProviderId[];
+        readonly ignore?: readonly ProviderId[];
+    };
+    /** Unified tool-calling (G-1/G-5 Phase A, spec §4.4) — tools the model may
+     * call this run. Passed through to the adapter; a tool-call turn is surfaced
+     * on `RunMeta.toolCalls` and is NOT schema-validated. ModelRig normalizes the
+     * protocol only — the caller executes the tool. */
+    readonly tools?: readonly ToolDefinition[];
+    readonly toolChoice?: ToolChoice;
+    /**
+     * Customer-managed cache handle pass-through (CE-1, spec §2). A provider-native
+     * cache identifier the CUSTOMER created and OWNS — gemini `cachedContents/<id>`,
+     * or a `prompt_cache_key` value for key-hint providers. It rides straight to
+     * `AdapterRequest.cache` for the matching-provider candidate; ModelRig passes
+     * it through verbatim and **never creates, refreshes, or deletes the underlying
+     * resource** — long jobs that outlive the provider's default TTL need the
+     * customer's OWN heartbeat (see modelrig.dev/docs/caching-lifecycle). This wins
+     * over the WS-C `cache: auto` generated stamp; absent, WS-C behavior stands
+     * byte-for-byte.
+     */
+    readonly cache?: {
+        /** The provider-native cache identifier, forwarded unchanged. */
+        readonly key: string;
+        /** REQUIRED. The handle names a provider-scoped resource, so it is applied
+         * ONLY to candidates of this provider; other candidates (fallbacks) dispatch
+         * WITHOUT cache rather than with a handle their provider would reject. Note
+         * the model-version caveat: gemini caches bind to the exact model+version, so
+         * a same-provider fallback to a DIFFERENT gemini model may fail
+         * `cache_invalid` — the retry ladder then re-dispatches that candidate
+         * without the handle. */
+        readonly provider: ProviderId;
+        /** Optional TTL hint forwarded on `AdapterRequest.cache`; informational —
+         * the customer's own heartbeat governs the actual resource TTL. */
+        readonly ttlSeconds?: number;
+    };
+}
+export interface RunMeta {
+    /** Telemetry row id of the serving attempt — the handle rig.feedback()
+     * takes (Phase 4 WS2). */
+    readonly inferenceId: string;
+    readonly route: string;
+    readonly routeVersion: number;
+    readonly provider: ProviderId;
+    readonly model: string;
+    readonly requestedTier: ServiceTier;
+    readonly servedTier: ServiceTier;
+    readonly tokensIn: number;
+    readonly tokensOut: number;
+    readonly tokensCached: number;
+    readonly costEstimateUsd: number;
+    readonly latencyMs: number;
+    readonly validated: boolean;
+    readonly attemptsByClass: Partial<Record<FailureClass, number>>;
+    /** Variant that served this run — null = default variant (Phase 3 WS1). */
+    readonly servedVariant: string | null;
+    /** "provider/model" that repaired the output — null when unrepaired
+     * (Phase 3 WS2). */
+    readonly repairedBy: string | null;
+    /** Normalized url_citation annotations (Phase 3 WS3) — present when the
+     * grounding-inject rung served this run. */
+    readonly citations?: ReadonlyArray<{
+        readonly type: "url_citation";
+        readonly url: string;
+        readonly title?: string;
+    }>;
+    /** Normalized tool calls the model emitted (G-1/G-5 Phase A, spec §4.4) —
+     * present only on a tool-call turn, where `validated` is false and
+     * `RunResult.output` is null. The caller runs the tool(s) and continues. */
+    readonly toolCalls?: readonly ToolCall[];
+}
+export interface RunResult {
+    readonly output: unknown;
+    readonly meta: RunMeta;
+}
+//# sourceMappingURL=route.d.ts.map

package/dist/types/route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../src/types/route.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEhH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,WAAW,GAAG,mBAAmB,GAAG,UAAU,GAAG,gBAAgB,GAAG,eAAe,CAAC;AAChG,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC;AAE5C,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,WAAW,CAAC;IACtC;;;;;;;mCAO+B;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;CACpC;AAED,uDAAuD;AACvD,MAAM,WAAW,YAAY;IAC3B;;;kCAG8B;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;oEACgE;IAChE,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC;CACtC;AAED;6EAC6E;AAC7E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;wBAEoB;IACpB,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IAC/C;6EACyE;IACzE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;gCAC4B;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;4DACwD;IACxD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,2CAA2C;IAC3C,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,GAAG,WAAW,CAAC;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gEAAgE;IAChE,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,SAAS,aAAa,EAAE,CAAC;IAC9C,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAC;IACvC,sEAAsE;IACtE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,qEAAqE;IACrE,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;IAC/B,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,EAAE,SAAS,YAAY,EAAE,CAAC;IAC3C,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;;;;;uCAMmC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB;;wEAEoE;IACpE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;kEAC8D;IAC9D,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CACzC;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CAC5C;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B;;;;kFAI0E;QAC1E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;IACF;qEACiE;IACjE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;oCAMgC;IAChC,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC;;;;wEAIoE;IACpE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,CAAC,EAAE;QACnB,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;QACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;KACzC,CAAC;IACF;;;uDAGmD;IACnD,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAC3C,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,iEAAiE;QACjE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB;;;;;;iCAMyB;QACzB,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC9B;2EACmE;QACnE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;KAC9B,CAAC;CACH;AAED,MAAM,WAAW,OAAO;IACtB;8BAC0B;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;IAChE,2EAA2E;IAC3E,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC;wBACoB;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;gDAC4C;IAC5C,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;QACjC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;QAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC,CAAC;IACH;;gFAE4E;IAC5E,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,QAAQ,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB"}

package/dist/types/route.js

@@ -0,0 +1,6 @@
+"use strict";
+/**
+ * Route bundle contract — spec §3. Loaded from modelrig/routes/*.yaml by
+ * routes/loader.ts; frozen after load.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/types/telemetry.d.ts

@@ -0,0 +1,206 @@
+/**
+ * Telemetry contracts — spec §5. SQLite-backed in Phase 1 (telemetry/store.ts);
+ * the interface exists so Phase 6 can add a remote control-plane sink.
+ */
+import type { FailureClass } from "./failures";
+import type { RunTags } from "./route";
+export interface TelemetryRow {
+    readonly id: string;
+    readonly ts: string;
+    readonly route: string;
+    readonly routeVersion: number;
+    readonly provider: string;
+    readonly model: string;
+    readonly requestedTier: string;
+    readonly servedTier: string;
+    /** Total input tokens. NORMALIZATION INVARIANT (WS-A / spec §2): INCLUDES
+     * `tokensCached` and `tokensCacheWrite` as subsets — mirrors
+     * {@link AdapterUsage.tokensIn}. */
+    readonly tokensIn: number;
+    readonly tokensOut: number;
+    /** Cache-READ input tokens (subset of `tokensIn`). */
+    readonly tokensCached: number;
+    /** Cache-CREATION (write) input tokens (subset of `tokensIn`) — WS-A. Mirrors
+     * {@link AdapterUsage.tokensCacheWrite}; 0 when the provider does not write
+     * cache or does not report it. Persisted to `inferences.tokens_cache_write`
+     * (migration 00049) and read back as 0 for rows recorded before it. OPTIONAL
+     * & additive: the store binds/reads `?? 0`, so a row that omits it is a
+     * zero-write row (the fail-closed default) — no construction site is forced
+     * to change. Every SDK write path (run loop, raw lane) sets it explicitly. */
+    readonly tokensCacheWrite?: number;
+    /** 1h-TTL portion of `tokensCacheWrite` (Anthropic; bills at the 2×
+     * multiplier). Subset of `tokensCacheWrite`; 0 = all 5m-tier. Optional/additive. */
+    readonly tokensCacheWrite1h?: number;
+    readonly costEstimateUsd: number;
+    readonly latencyMs: number;
+    /** Time to first body byte, ms (Phase 4 WS3) — null when nothing arrived
+     * or for rows recorded before the v6 migration. */
+    readonly ttfbMs: number | null;
+    readonly failureClass: FailureClass | null;
+    readonly attemptsJson: string;
+    readonly tagsJson: string;
+    /** Schema-fingerprint cell key (registry/fingerprint.ts) — null for
+     * unstructured routes and rows recorded before the v2 migration. */
+    readonly fingerprintCell: string | null;
+    /** Provider cache key / `prompt_cache_key` sent with the request, if any
+     * (WS-A substrate; the WS-C request-path opt-in fills it). null everywhere
+     * in WS-A — accounting ships dark, no request stamps a key yet. Optional &
+     * additive: the store binds/reads `?? null`. */
+    readonly cacheKey?: string | null;
+    /** Hash of the stable prompt prefix (WS-A substrate; WS-C fills it with
+     * `hash(route, template_version, toolschema_hash)`). null in WS-A. Optional. */
+    readonly prefixFingerprint?: string | null;
+    /** True when this attempt's model had no pricing entry (addendum A1):
+     * cost_estimate_usd stays 0 (no invented dollars) and any active envelope
+     * was charged the conservative unpriced rate instead. */
+    readonly pricingMissing: boolean;
+    /** Variant name this attempt served (Phase 3 WS1) — null = default variant
+     * and rows recorded before the v3 migration. */
+    readonly servedVariant: string | null;
+    /** "provider/model" of the repair model that produced this row's output
+     * (Phase 3 WS2) — null for unrepaired attempts. */
+    readonly repairedBy: string | null;
+}
+export interface EnvelopeRow {
+    readonly envelopeKey: string;
+    readonly budgetUsd: number;
+    readonly spentUsd: number;
+    readonly status: "open" | "exhausted";
+}
+/** One rig.feedback() judgment (Phase 4 WS2) — attached to a single
+ * inference OR an episode (= run-level key), or both. Local SQLite is the
+ * write path; the exporter mirrors (dual-store symmetry with inferences). */
+export interface FeedbackRow {
+    readonly id: string;
+    readonly ts: string;
+    readonly inferenceId: string | null;
+    readonly episodeKey: string | null;
+    readonly verdict: "up" | "down";
+    readonly score: number | null;
+    readonly note: string | null;
+    readonly source: string;
+    /**
+     * The org this verdict belongs to — Phase 6 WS2, and the reason this field
+     * exists at all.
+     *
+     * A verdict recorded through OUR hosted server belongs to the org of the
+     * person who recorded it, and one SQLite store serves every org that reaches
+     * that server. Without a per-row org the exporter stamps its OWN, which
+     * files a customer's judgment into somebody else's corpus — unrecomputable
+     * evidence, silently wrong. WS1 shipped a 409 refusal rather than misfile;
+     * this column is what replaces the refusal with routing (QA-P6-010).
+     *
+     * NULL is the ordinary case and means "whatever org this exporter is": a
+     * self-hosted rig has exactly one, and `rig.feedback()` from application
+     * code has no notion of orgs at all.
+     */
+    readonly orgId: string | null;
+    /** Authenticated user who recorded it (00017's `feedback.created_by`), or
+     * null for an SDK-recorded verdict — which is a fact about the row, not
+     * missing data, and is never backfilled. */
+    readonly createdBy: string | null;
+}
+/** One execution of a customer pipeline (Expansion E2 chunk A). Local SQLite is
+ * the write path (run.start/run.end); the exporter mirrors it to `public.runs`
+ * on its own watermark. A mutable projection: start → end. `source_id`/`org_id`
+ * are stamped at export from the principal, never held locally (one rig = one
+ * source). */
+export interface RunRow {
+    readonly id: string;
+    readonly pipeline: string;
+    readonly pipelineVersion: string | null;
+    readonly environment: string | null;
+    readonly episodeKey: string | null;
+    readonly startedAt: string;
+    readonly endedAt: string | null;
+    readonly status: "running" | "succeeded" | "failed" | "abandoned";
+}
+/** One ATTEMPT of one operation within a run (Expansion E2 chunk A, ruling c).
+ * A fact — one row per attempt, PK (run_id, step_key, attempt_no). Provenance is
+ * ground-truth (an inference reference) XOR attested (a foreign OTLP span);
+ * nothing writes attested rows this mission. */
+export interface StepRow {
+    readonly runId: string;
+    readonly stepKey: string;
+    readonly attemptNo: number;
+    readonly task: string | null;
+    readonly provenance: "ground-truth" | "attested";
+    readonly inferenceId: string | null;
+    readonly spanTraceId: string | null;
+    readonly spanId: string | null;
+    readonly startedAt: string;
+    readonly endedAt: string | null;
+    readonly failureClass: string | null;
+}
+/** Artifact METADATA (Expansion E2 chunk B). Content is never held — contentRef
+ * is the customer's opaque URI, contentHash a sha256 of bytes hashed-then-
+ * discarded. A fact; local SQLite write path (artifact.save), exporter mirrors. */
+export interface ArtifactRow {
+    readonly id: string;
+    readonly runId: string | null;
+    readonly stepKey: string | null;
+    readonly attemptNo: number | null;
+    readonly task: string | null;
+    readonly name: string;
+    readonly type: string;
+    readonly version: number;
+    readonly supersedesArtifactId: string | null;
+    readonly declaredSchema: unknown;
+    readonly fingerprintCell: string | null;
+    readonly contentRef: string | null;
+    readonly contentHash: string | null;
+    readonly contentBytes: number | null;
+    readonly dataClassification: string | null;
+    readonly expiresAt: string | null;
+    /** Per-row scrub findings (E4 chunk 0, migration 00039) — the `ScrubSummary`
+     * shape `{mode, blocked, findings:[{type,count}]}`, COUNTS never values.
+     * Absent/null ⇒ scrub did not run for this artifact (custody off, caller-
+     * supplied contentRef, or a pre-E4 row). Opaque here (T7). */
+    readonly scrub?: unknown;
+}
+/** A lineage edge between two artifacts (chunk B). */
+export interface ArtifactEdgeRow {
+    readonly fromArtifactId: string;
+    readonly toArtifactId: string;
+    readonly kind: "consumed" | "derived_from";
+}
+/** An evaluation recorded against an artifact (chunk B). */
+export interface ArtifactEvaluationRow {
+    readonly id: string;
+    /** The artifact subject — null when this evaluates a whole run (E5 chunk V). */
+    readonly artifactId: string | null;
+    /** The run subject (E5 chunk V) — null when this evaluates an artifact.
+     * Exactly one of artifactId / runId is set. */
+    readonly runId: string | null;
+    readonly evaluator: string;
+    readonly evaluatorKind: "deterministic" | "model-judge" | "human";
+    readonly score: number | null;
+    readonly passed: boolean | null;
+    readonly label: string | null;
+    readonly explanation: string | null;
+    readonly createdBy: string | null;
+}
+/** How a case entered the eval suite (E4 chunk A, migration 00040 CHECK). */
+export type EvalCaseOrigin = "promoted-failure" | "human-corrected" | "manual";
+/** A per-org regression/golden eval case (E4 chunk A). `correctedArtifactId`
+ * null ⇒ a failure-case; set ⇒ a golden-corrected pair. A fact on ingest
+ * (created via promote); edits/deletes are server-side, not on this stream. */
+export interface EvalCaseRow {
+    readonly id: string;
+    readonly task: string;
+    readonly sourceArtifactId: string;
+    readonly correctedArtifactId: string | null;
+    readonly origin: EvalCaseOrigin;
+    readonly note: string | null;
+    readonly createdBy: string | null;
+}
+export interface TelemetryStore {
+    record(row: TelemetryRow): void;
+    recordFeedback(row: FeedbackRow): void;
+    queryByTag(tag: keyof RunTags & string, value: string): TelemetryRow[];
+    getEnvelope(key: string): EnvelopeRow | null;
+    accrue(key: string, usd: number): EnvelopeRow;
+    openEnvelope(key: string, budgetUsd: number): EnvelopeRow;
+    close(): void;
+}
+//# sourceMappingURL=telemetry.d.ts.map

package/dist/types/telemetry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.d.ts","sourceRoot":"","sources":["../../src/types/telemetry.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEvC,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;wCAEoC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,sDAAsD;IACtD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;;;;;kFAM8E;IAC9E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;wFACoF;IACpF,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;uDACmD;IACnD,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,YAAY,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;wEACoE;IACpE,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC;;;oDAGgD;IAChD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC;oFACgF;IAChF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C;;6DAEyD;IACzD,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;oDACgD;IAChD,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC;uDACmD;IACnD,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,CAAC;CACvC;AAED;;6EAE6E;AAC7E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,IAAI,GAAG,MAAM,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B;;gDAE4C;IAC5C,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED;;;;cAIc;AACd,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAC;CACnE;AAED;;;gDAGgD;AAChD,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,cAAc,GAAG,UAAU,CAAC;IACjD,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAED;;mFAEmF;AACnF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7C,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC;;;kEAG8D;IAC9D,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,sDAAsD;AACtD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,cAAc,CAAC;CAC5C;AAED,4DAA4D;AAC5D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;mDAC+C;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,eAAe,GAAG,aAAa,GAAG,OAAO,CAAC;IAClE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,6EAA6E;AAC7E,MAAM,MAAM,cAAc,GAAG,kBAAkB,GAAG,iBAAiB,GAAG,QAAQ,CAAC;AAE/E;;+EAE+E;AAC/E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,GAAG,EAAE,YAAY,GAAG,IAAI,CAAC;IAChC,cAAc,CAAC,GAAG,EAAE,WAAW,GAAG,IAAI,CAAC;IACvC,UAAU,CAAC,GAAG,EAAE,MAAM,OAAO,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,YAAY,EAAE,CAAC;IACvE,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAAC;IAC7C,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,WAAW,CAAC;IAC9C,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,WAAW,CAAC;IAC1D,KAAK,IAAI,IAAI,CAAC;CACf"}

package/dist/types/telemetry.js

@@ -0,0 +1,6 @@
+"use strict";
+/**
+ * Telemetry contracts — spec §5. SQLite-backed in Phase 1 (telemetry/store.ts);
+ * the interface exists so Phase 6 can add a remote control-plane sink.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/validate-cli.d.ts

@@ -0,0 +1,12 @@
+/**
+ * `modelrig validate` (CE-6, spec §1, walkthrough §8.7a) — extracted from
+ * cli.ts to keep it under the 700-LOC cap. Structurally loads rig.yaml + every
+ * route bundle and reports per-route OK / config error, exiting nonzero on any
+ * failure. Requires NO provider key: this bypasses the serveable-candidate gate
+ * (which needs keys and stays fail-closed for SERVING) so a newbie can check
+ * their authoring before wiring credentials. A bare
+ * `createRig(loadConfigFromEnv())` fail-closes keyless with "no serveable
+ * candidate" — this is the dry structural check that doesn't.
+ */
+export declare function runValidateCli(): number;
+//# sourceMappingURL=validate-cli.d.ts.map

package/dist/validate-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-cli.d.ts","sourceRoot":"","sources":["../src/validate-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,wBAAgB,cAAc,IAAI,MAAM,CAmCvC"}

package/dist/validate-cli.js

@@ -0,0 +1,57 @@
+"use strict";
+/**
+ * `modelrig validate` (CE-6, spec §1, walkthrough §8.7a) — extracted from
+ * cli.ts to keep it under the 700-LOC cap. Structurally loads rig.yaml + every
+ * route bundle and reports per-route OK / config error, exiting nonzero on any
+ * failure. Requires NO provider key: this bypasses the serveable-candidate gate
+ * (which needs keys and stays fail-closed for SERVING) so a newbie can check
+ * their authoring before wiring credentials. A bare
+ * `createRig(loadConfigFromEnv())` fail-closes keyless with "no serveable
+ * candidate" — this is the dry structural check that doesn't.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runValidateCli = runValidateCli;
+const node_path_1 = require("node:path");
+const config_1 = require("./config");
+const loader_1 = require("./routes/loader");
+const manifest_1 = require("./routes/manifest");
+function runValidateCli() {
+    const config = (0, config_1.loadConfigFromEnv)();
+    const rigDir = (0, node_path_1.dirname)(config.routesDir);
+    let failures = 0;
+    // rig.yaml (manifest) — absence is fine (never gates); a malformed one is a
+    // config error surfaced like any route.
+    try {
+        const manifest = (0, manifest_1.loadManifest)(rigDir);
+        console.log(manifest === null ? `—  rig.yaml (none at ${rigDir})` : "OK rig.yaml");
+    }
+    catch (err) {
+        failures += 1;
+        console.error(`FAIL rig.yaml: ${configErrorText(err)}`);
+    }
+    // Every route bundle — one bad file never hides the rest.
+    const results = (0, loader_1.validateRoutesDir)(config.routesDir);
+    if (results.length === 0) {
+        console.log(`(no route bundles in ${config.routesDir})`);
+    }
+    for (const r of results) {
+        if (r.ok) {
+            console.log(`OK ${r.route}  (${r.file})`);
+        }
+        else {
+            failures += 1;
+            console.error(`FAIL ${r.route ?? r.file}: ${r.problems.join("; ")}`);
+        }
+    }
+    if (failures === 0) {
+        console.log(`\n${results.length} route(s) valid — no provider key required for this check.`);
+        return 0;
+    }
+    console.error(`\n${failures} problem(s) found.`);
+    return 1;
+}
+function configErrorText(err) {
+    if (err instanceof loader_1.RouteConfigError && err.problems.length > 0)
+        return err.problems.join("; ");
+    return err instanceof Error ? err.message : String(err);
+}

package/dist/verify/capture.d.ts

@@ -0,0 +1,66 @@
+/**
+ * The capture step — records N invocations of the ORIGINAL call site's
+ * inputs/outputs LOCALLY (spec §9 Tier-2 verify). Two surfaces:
+ *
+ *  - `captureOriginal(site, originalFn, inputs)` — invoke the original call
+ *    (a black-box function the skill/harness wraps around the customer's real
+ *    call) once per input and record the I/O into a fixture. Honest refusal is
+ *    built in: a streaming or dynamically-assembled-prompt call site is REFUSED
+ *    up front (those are T0/T1 territory), and an input the original throws on
+ *    is recorded as a per-input refusal, never a lost sample.
+ *  - `openShadowCaptureStore(dbPath)` — a durable local SQLite buffer for the
+ *    same captures, the same posture as telemetry/capture.ts: a plain
+ *    better-sqlite3 handle with record/readAll/close and NO network or upload
+ *    accessor. Captures stay in the SDK process; nothing here uploads.
+ *
+ * The portable `ShadowCaptureFixture` (JSON) is the hand-off the CLI reads and
+ * the skill embeds context from — the only thing that leaves this module, and
+ * only to local disk.
+ */
+import type { CandidateSpec } from "../types/route";
+import type { ShadowCapture, ShadowCaptureFixture } from "./types";
+/** A call site being captured. `streaming`/`dynamicPrompt` are the skill's
+ * honest declarations that this site cannot be captured/replayed as a
+ * task-shaped bundle — refusing is the correct output. */
+export interface OriginalCallSite {
+    readonly callSiteId: string;
+    /** provider+model of the original call — the route must pin exactly this. */
+    readonly original: CandidateSpec;
+    readonly streaming?: boolean;
+    readonly dynamicPrompt?: boolean;
+    readonly nondeterministicPaths?: readonly string[];
+}
+/** The original call, wrapped as a pure input→output-text function. */
+export type OriginalCallFn = (input: Record<string, unknown>) => Promise<string>;
+export interface CaptureOptions {
+    readonly now?: () => string;
+}
+/**
+ * Capture N original invocations into a fixture. Streaming/dynamic sites are
+ * refused before any call; per-input failures become `uncapturable` refusals.
+ */
+export declare function captureOriginal(site: OriginalCallSite, originalFn: OriginalCallFn, inputs: readonly Record<string, unknown>[], opts?: CaptureOptions): Promise<ShadowCaptureFixture>;
+export interface ShadowCaptureRecord {
+    readonly callSiteId: string;
+    readonly provider: string;
+    readonly model: string;
+    readonly input: Record<string, unknown>;
+    readonly output: string;
+}
+export interface ShadowCaptureStore {
+    record(row: ShadowCaptureRecord): void;
+    /** Captures for a call site, in insertion order (the replay input set). */
+    readAll(callSiteId: string): ShadowCapture[];
+    close(): void;
+}
+/**
+ * A separate better-sqlite3 handle — deliberately NOT wired to any exporter or
+ * upload path. Shadow captures are original-call outputs used only to prove
+ * equivalence locally; nothing here ever leaves the machine (the SDK's
+ * export-isolation posture, extended to the verifier).
+ */
+export declare function openShadowCaptureStore(dbPath: string): ShadowCaptureStore;
+export declare function serializeFixture(fixture: ShadowCaptureFixture): string;
+/** Parse + shape-validate a fixture (errors teach — the CLI surfaces them). */
+export declare function parseFixture(json: string): ShadowCaptureFixture;
+//# sourceMappingURL=capture.d.ts.map

package/dist/verify/capture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capture.d.ts","sourceRoot":"","sources":["../../src/verify/capture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAkB,aAAa,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAEnF;;0DAE0D;AAC1D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpD;AAED,uEAAuE;AACvE,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAEjF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,gBAAgB,EACtB,UAAU,EAAE,cAAc,EAC1B,MAAM,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAC1C,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,oBAAoB,CAAC,CAwC/B;AAwBD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,GAAG,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACvC,2EAA2E;IAC3E,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,aAAa,EAAE,CAAC;IAC7C,KAAK,IAAI,IAAI,CAAC;CACf;AAmBD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,kBAAkB,CAuCzE;AAID,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM,CAEtE;AAOD,+EAA+E;AAC/E,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,CA0B/D"}