opensip-cli 0.1.0

package/dist/bootstrap/baseline-seams.js

@@ -0,0 +1,156 @@
+/**
+ * baseline-seams — the host implementations behind the four `ToolCliContext`
+ * baseline/ratchet seams (ADR-0036): `saveBaseline`, `compareBaseline`,
+ * `exportBaselineSarif`, `exportBaselineFingerprints`.
+ *
+ * The host owns persistence (`BaselineRepo`), the pure diff (`diffBaseline` from
+ * `@opensip-cli/output`), SARIF re-render, and the git-trackable JSON export.
+ * The seams are **read-only** of `signal.fingerprint`: the tool stamps its
+ * envelope's signals (`stampFingerprints`) at envelope-construction time and the
+ * plane NEVER re-fingerprints. Factored out of `cli-context.ts` to keep that
+ * file within its size budget.
+ */
+import { mkdir, writeFile } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { ConfigurationError, SeverityPolicy, } from '@opensip-cli/core';
+import { BaselineRepo } from '@opensip-cli/datastore';
+import { diffBaseline } from '@opensip-cli/output';
+import { writeEnvelopeSarif } from './deliver-envelope.js';
+/** Thrown (→ exit 2) when a gate compare/export runs before any baseline was saved. */
+function missingBaseline(tool) {
+    return new ConfigurationError(`No baseline found for '${tool}' in the project SQLite store. If this is a first ` +
+        `run — or you upgraded across a release that changed the baseline schema (the ` +
+        `per-tool baseline tables were dropped and recaptured, ADR-0036) — run ` +
+        `\`opensip-cli ${tool} --gate-save\` to (re)capture one. The git-trackable ` +
+        `JSON fingerprint baseline (graph-baseline-export) is a file, not a DB row, and ` +
+        `is untouched.`, { code: 'CONFIGURATION.GATE.BASELINE_MISSING' });
+}
+/** Assert each signal carries a fingerprint — the plane never stamps (ADR-0036). */
+// @graph-ignore-next-line graph:always-throws-branch -- not throw-dominated: returns the mapped entries; the throw is a guard fired only when a tool hands unstamped signals (a contract violation the plane must surface).
+function requireStampedEntries(tool, signals) {
+    return signals.map((s) => {
+        if (!s.fingerprint) {
+            throw new ConfigurationError(`saveBaseline(${tool}): signal ${s.ruleId} is not fingerprint-stamped. The tool must ` +
+                `stamp its signals (stampFingerprints) before the seam — the plane never fingerprints.`, { code: 'CONFIGURATION.GATE.UNSTAMPED_SIGNAL' });
+        }
+        return { fingerprint: s.fingerprint, payload: s };
+    });
+}
+/**
+ * Build the four baseline seams over a lazy datastore resolver. `getDatastore`
+ * throws when accessed outside a project scope (the host's existing contract).
+ */
+export function buildBaselineSeams(deps) {
+    const { getDatastore, logger } = deps;
+    const repoFor = () => new BaselineRepo(getDatastore());
+    return {
+        // Sync-bodied (SQLite is synchronous) but typed Promise to match the seam
+        // contract; a sync throw still rejects for an `await`ing caller.
+        saveBaseline: (tool, envelope) => {
+            const env = envelope;
+            const entries = requireStampedEntries(tool, env.signals);
+            repoFor().save(tool, entries);
+            logger.info({
+                evt: 'cli.baseline.save.complete',
+                module: 'cli:baseline-seams',
+                tool,
+                count: entries.length,
+            });
+            return Promise.resolve();
+        },
+        compareBaseline: (tool, envelope) => {
+            const repo = repoFor();
+            if (!repo.exists(tool))
+                return Promise.reject(missingBaseline(tool));
+            const env = envelope;
+            return Promise.resolve(diffBaseline(env.signals, repo.load(tool)));
+        },
+        /** @throws {ConfigurationError} (→ exit 2) when no baseline exists for `tool`. */
+        // @fitness-ignore-next-line throws-documentation -- contract is in the @throws above + on the ToolCliContext.exportBaselineSarif seam; the check cannot read an object-property arrow's leading JSDoc.
+        exportBaselineSarif: async (tool, path) => {
+            const repo = repoFor();
+            if (!repo.exists(tool))
+                throw missingBaseline(tool);
+            const capturedAt = repo.capturedAt(tool);
+            /* v8 ignore next 3 -- defensive: exists() returned true above (same as fingerprints export) */
+            if (capturedAt === undefined) {
+                throw new ConfigurationError(`Baseline meta row for '${tool}' missing after exists() reported present.`, { code: 'CONFIGURATION.GATE.BASELINE_INCONSISTENT' });
+            }
+            const signals = repo
+                .load(tool)
+                .map((r) => r.payload)
+                .filter((s) => s !== null);
+            // Compute a minimal but truthful verdict/summary from the captured signals
+            // so that SARIF consumers (and any envelope-level logic) see consistent
+            // counts instead of an all-zeroes synthetic. This is a reconstruction of
+            // historical findings; "passed" here means "the captured set contained no
+            // error-severity findings" (matching the spirit of the run verdict).
+            let errors = 0;
+            let warnings = 0;
+            for (const s of signals) {
+                if (SeverityPolicy.isError(s.severity))
+                    errors += 1;
+                else
+                    warnings += 1;
+            }
+            const summary = {
+                total: signals.length,
+                passed: signals.length - errors,
+                failed: errors,
+                errors,
+                warnings,
+            };
+            // SARIF export RECONSTRUCTS (no stored envelope): formatSignalSarif derives
+            // results from `signals` + the driver name from `tool` only, so the other
+            // envelope fields are mostly inert filler. We now populate a plausible
+            // verdict so downstream SARIF or machine consumers are not misled.
+            // The runId/createdAt make it obvious this is a reconstruction from a
+            // previously captured baseline (units and per-unit facts like filesValidated
+            // are not recoverable without storing the full original envelope).
+            const synthetic = {
+                schemaVersion: 2,
+                tool: tool,
+                runId: `baseline:${tool}`,
+                createdAt: new Date(capturedAt).toISOString(),
+                verdict: {
+                    score: signals.length === 0 ? 1 : summary.passed / summary.total,
+                    passed: errors === 0,
+                    summary,
+                },
+                units: [],
+                signals,
+            };
+            await writeEnvelopeSarif(synthetic, path);
+        },
+        /** @throws {ConfigurationError} (→ exit 2) when no baseline exists for `tool`. */
+        // @fitness-ignore-next-line throws-documentation -- contract is in the @throws above + on the ToolCliContext.exportBaselineFingerprints seam; the check cannot read an object-property arrow's leading JSDoc.
+        exportBaselineFingerprints: async (tool, path) => {
+            const repo = repoFor();
+            if (!repo.exists(tool))
+                throw missingBaseline(tool);
+            const capturedAt = repo.capturedAt(tool);
+            /* v8 ignore next 3 -- defensive: exists() returned true above */
+            if (capturedAt === undefined) {
+                throw new ConfigurationError(`Baseline meta row for '${tool}' missing after exists() reported present.`, { code: 'CONFIGURATION.GATE.BASELINE_INCONSISTENT' });
+            }
+            const rows = repo.load(tool);
+            const fingerprints = rows.map((r) => r.fingerprint).sort((a, b) => a.localeCompare(b));
+            const file = {
+                version: '1',
+                tool,
+                capturedAt: new Date(capturedAt).toISOString(),
+                // Reconstruction note: this is a fingerprint list only. It does not
+                // contain the original per-unit (check/rule) metadata or validated counts.
+                // It is suitable for git-trackable ratchet comparison (graph) and for
+                // re-import via --gate-compare style flows that only need identities.
+                note: 'reconstructed from baseline entries; units and per-finding details are not preserved',
+                signalCount: fingerprints.length,
+                fingerprints,
+            };
+            const serialized = JSON.stringify(file, null, 2);
+            await mkdir(dirname(path), { recursive: true });
+            await writeFile(path, serialized, 'utf8');
+        },
+    };
+}
+//# sourceMappingURL=baseline-seams.js.map

package/dist/bootstrap/baseline-seams.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"baseline-seams.js","sourceRoot":"","sources":["../../src/bootstrap/baseline-seams.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EACL,kBAAkB,EAGlB,cAAc,GAEf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAkB,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAY3D,uFAAuF;AACvF,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,IAAI,kBAAkB,CAC3B,0BAA0B,IAAI,oDAAoD;QAChF,+EAA+E;QAC/E,wEAAwE;QACxE,iBAAiB,IAAI,uDAAuD;QAC5E,iFAAiF;QACjF,eAAe,EACjB,EAAE,IAAI,EAAE,qCAAqC,EAAE,CAChD,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,4NAA4N;AAC5N,SAAS,qBAAqB,CAC5B,IAAY,EACZ,OAA0B;IAE1B,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACvB,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACnB,MAAM,IAAI,kBAAkB,CAC1B,gBAAgB,IAAI,aAAa,CAAC,CAAC,MAAM,6CAA6C;gBACpF,uFAAuF,EACzF,EAAE,IAAI,EAAE,qCAAqC,EAAE,CAChD,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAGlC;IACC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACtC,MAAM,OAAO,GAAG,GAAiB,EAAE,CAAC,IAAI,YAAY,CAAC,YAAY,EAAE,CAAC,CAAC;IAErE,OAAO;QACL,0EAA0E;QAC1E,iEAAiE;QACjE,YAAY,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE;YAC/B,MAAM,GAAG,GAAG,QAA0B,CAAC;YACvC,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACzD,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC;gBACV,GAAG,EAAE,4BAA4B;gBACjC,MAAM,EAAE,oBAAoB;gBAC5B,IAAI;gBACJ,KAAK,EAAE,OAAO,CAAC,MAAM;aACtB,CAAC,CAAC;YACH,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;QAED,eAAe,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE;YAClC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,OAAO,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;YACrE,MAAM,GAAG,GAAG,QAA0B,CAAC;YACvC,OAAO,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrE,CAAC;QAED,kFAAkF;QAClF,uMAAuM;QACvM,mBAAmB,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YACxC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;YACpD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACzC,+FAA+F;YAC/F,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,MAAM,IAAI,kBAAkB,CAC1B,0BAA0B,IAAI,4CAA4C,EAC1E,EAAE,IAAI,EAAE,0CAA0C,EAAE,CACrD,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,IAAI;iBACjB,IAAI,CAAC,IAAI,CAAC;iBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;iBACrB,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;YAE1C,2EAA2E;YAC3E,wEAAwE;YACxE,yEAAyE;YACzE,0EAA0E;YAC1E,qEAAqE;YACrE,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,IAAI,QAAQ,GAAG,CAAC,CAAC;YACjB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;oBAAE,MAAM,IAAI,CAAC,CAAC;;oBAC/C,QAAQ,IAAI,CAAC,CAAC;YACrB,CAAC;YACD,MAAM,OAAO,GAAG;gBACd,KAAK,EAAE,OAAO,CAAC,MAAM;gBACrB,MAAM,EAAE,OAAO,CAAC,MAAM,GAAG,MAAM;gBAC/B,MAAM,EAAE,MAAM;gBACd,MAAM;gBACN,QAAQ;aACT,CAAC;YAEF,4EAA4E;YAC5E,0EAA0E;YAC1E,uEAAuE;YACvE,mEAAmE;YACnE,sEAAsE;YACtE,6EAA6E;YAC7E,mEAAmE;YACnE,MAAM,SAAS,GAAmB;gBAChC,aAAa,EAAE,CAAC;gBAChB,IAAI,EAAE,IAA8B;gBACpC,KAAK,EAAE,YAAY,IAAI,EAAE;gBACzB,SAAS,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE;gBAC7C,OAAO,EAAE;oBACP,KAAK,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK;oBAChE,MAAM,EAAE,MAAM,KAAK,CAAC;oBACpB,OAAO;iBACR;gBACD,KAAK,EAAE,EAAE;gBACT,OAAO;aACR,CAAC;YACF,MAAM,kBAAkB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC;QAED,kFAAkF;QAClF,8MAA8M;QAC9M,0BAA0B,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YAC/C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;YACpD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACzC,iEAAiE;YACjE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,MAAM,IAAI,kBAAkB,CAC1B,0BAA0B,IAAI,4CAA4C,EAC1E,EAAE,IAAI,EAAE,0CAA0C,EAAE,CACrD,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;YACvF,MAAM,IAAI,GAAG;gBACX,OAAO,EAAE,GAAG;gBACZ,IAAI;gBACJ,UAAU,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE;gBAC9C,oEAAoE;gBACpE,2EAA2E;gBAC3E,sEAAsE;gBACtE,sEAAsE;gBACtE,IAAI,EAAE,sFAAsF;gBAC5F,WAAW,EAAE,YAAY,CAAC,MAAM;gBAChC,YAAY;aACb,CAAC;YACF,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACjD,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,MAAM,SAAS,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QAC5C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/bootstrap/bootstrap-error.d.ts

@@ -0,0 +1,41 @@
+/**
+ * BootstrapError — a typed pre-handler failure thrown by the `preAction` guards
+ * instead of writing to a stream + `process.exit()` (launch, §4.7).
+ *
+ * Bootstrap failures (no project, schema-too-old, config-resolve, tool-init) used
+ * to bypass the central renderer: each guard wrote its own message and called
+ * `process.exit(n)`, so `--json` produced nothing structured for exactly the
+ * highest-friction failures. Now each guard THROWS a `BootstrapError`, and one
+ * top-level boundary (the `parseAsync().catch`) renders it through the same
+ * `CommandOutcome` seam as every other result — `--json` emits a structured,
+ * suggestion-bearing `bootstrap.error` outcome; human mode writes the unchanged
+ * formatted message to stderr (byte-identical to the legacy bytes).
+ *
+ * The error carries BOTH a clean `message` (for the `--json` `errors[].message`)
+ * and the original multi-line `humanMessage` (for the byte-identical stderr path),
+ * plus an explicit `exitCode` — schema/no-project/config are `2`, a tool-init
+ * failure is `1` — so the boundary sets the exit code from the error itself rather
+ * than re-deriving it.
+ */
+import { ToolError } from '@opensip-cli/core';
+export interface BootstrapErrorInput {
+    /** Clean, single-line message for the structured `--json` outcome. */
+    readonly message: string;
+    /**
+     * The exact multi-line text the guard used to write to stderr. The human
+     * boundary writes `${humanMessage}\n` verbatim — preserving the legacy
+     * bytes — instead of routing through the Ink error renderer.
+     */
+    readonly humanMessage: string;
+    /** Actionable next step surfaced in the structured outcome's `errors[].suggestion`. */
+    readonly suggestion?: string;
+    /** Process exit code (2 for config/no-project, 1 for a tool-init failure). */
+    readonly exitCode: number;
+}
+export declare class BootstrapError extends ToolError {
+    readonly humanMessage: string;
+    readonly suggestion: string | undefined;
+    readonly exitCode: number;
+    constructor(input: BootstrapErrorInput);
+}
+//# sourceMappingURL=bootstrap-error.d.ts.map

package/dist/bootstrap/bootstrap-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap-error.d.ts","sourceRoot":"","sources":["../../src/bootstrap/bootstrap-error.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,MAAM,WAAW,mBAAmB;IAClC,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,uFAAuF;IACvF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,qBAAa,cAAe,SAAQ,SAAS;IAC3C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBAEd,KAAK,EAAE,mBAAmB;CAOvC"}

package/dist/bootstrap/bootstrap-error.js

@@ -0,0 +1,33 @@
+/**
+ * BootstrapError — a typed pre-handler failure thrown by the `preAction` guards
+ * instead of writing to a stream + `process.exit()` (launch, §4.7).
+ *
+ * Bootstrap failures (no project, schema-too-old, config-resolve, tool-init) used
+ * to bypass the central renderer: each guard wrote its own message and called
+ * `process.exit(n)`, so `--json` produced nothing structured for exactly the
+ * highest-friction failures. Now each guard THROWS a `BootstrapError`, and one
+ * top-level boundary (the `parseAsync().catch`) renders it through the same
+ * `CommandOutcome` seam as every other result — `--json` emits a structured,
+ * suggestion-bearing `bootstrap.error` outcome; human mode writes the unchanged
+ * formatted message to stderr (byte-identical to the legacy bytes).
+ *
+ * The error carries BOTH a clean `message` (for the `--json` `errors[].message`)
+ * and the original multi-line `humanMessage` (for the byte-identical stderr path),
+ * plus an explicit `exitCode` — schema/no-project/config are `2`, a tool-init
+ * failure is `1` — so the boundary sets the exit code from the error itself rather
+ * than re-deriving it.
+ */
+import { ToolError } from '@opensip-cli/core';
+export class BootstrapError extends ToolError {
+    humanMessage;
+    suggestion;
+    exitCode;
+    constructor(input) {
+        super(input.message, 'CONFIGURATION.BOOTSTRAP');
+        this.name = 'BootstrapError';
+        this.humanMessage = input.humanMessage;
+        this.suggestion = input.suggestion;
+        this.exitCode = input.exitCode;
+    }
+}
+//# sourceMappingURL=bootstrap-error.js.map

package/dist/bootstrap/bootstrap-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap-error.js","sourceRoot":"","sources":["../../src/bootstrap/bootstrap-error.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAiB9C,MAAM,OAAO,cAAe,SAAQ,SAAS;IAClC,YAAY,CAAS;IACrB,UAAU,CAAqB;IAC/B,QAAQ,CAAS;IAE1B,YAAY,KAA0B;QACpC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;QACvC,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QACnC,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IACjC,CAAC;CACF"}

package/dist/bootstrap/build-command-registration-input.d.ts

@@ -0,0 +1,34 @@
+/**
+ * build-command-registration-input — thin builder for the data needed by
+ * `registerCliCommands` after tool mounting.
+ *
+ * Extracted from the top-level composition root in `index.ts` (roadmap item 2)
+ * to further reduce inline logic in the bootstrap sequencer. This follows the
+ * same pattern as `build-per-run-scope.ts`.
+ *
+ * The host owns "pluginLayouts", "toolScaffolds", "sessionReplayRegistry", and
+ * "toolCommandSpecs" preparation so the main entry point stays focused on
+ * sequencing (registries, bootstrap, mounting, registration, dispatch).
+ */
+import { SessionReplayRegistry } from '../session-replay-registry.js';
+import type { CommandSpec, PluginLayout, ScaffoldContext, ScaffoldFile, ToolCliContext, ToolRegistry } from '@opensip-cli/core';
+/** The structured input consumed by `registerCliCommands`. */
+export interface CommandRegistrationInput {
+    readonly pluginLayouts: readonly NonNullable<PluginLayout>[];
+    readonly toolScaffolds: readonly {
+        readonly layout: PluginLayout;
+        readonly scaffoldExamples: ((ctx: ScaffoldContext) => readonly ScaffoldFile[]) | undefined;
+        readonly stableExampleIds: (() => readonly string[]) | undefined;
+        readonly scaffoldConfigBlock: (() => string) | undefined;
+    }[];
+    readonly sessionReplayRegistry: SessionReplayRegistry;
+    readonly toolCommandSpecs: readonly CommandSpec<unknown, ToolCliContext>[];
+}
+/**
+ * Collects the registry-derived data needed for CLI command registration.
+ * Emits the ADR-0038 back-compat diagnostic for expected bundled tools that
+ * are absent (this warning is intentionally loud when a bundled tool is
+ * missing, as it affects `init` scaffolding).
+ */
+export declare function buildCommandRegistrationInput(registry: ToolRegistry): CommandRegistrationInput;
+//# sourceMappingURL=build-command-registration-input.d.ts.map

package/dist/bootstrap/build-command-registration-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-command-registration-input.d.ts","sourceRoot":"","sources":["../../src/bootstrap/build-command-registration-input.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAItE,OAAO,KAAK,EACV,WAAW,EACX,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,cAAc,EACd,YAAY,EACb,MAAM,mBAAmB,CAAC;AAE3B,8DAA8D;AAC9D,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,aAAa,EAAE,SAAS,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;IAC7D,QAAQ,CAAC,aAAa,EAAE,SAAS;QAC/B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;QAC9B,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE,eAAe,KAAK,SAAS,YAAY,EAAE,CAAC,GAAG,SAAS,CAAC;QAC3F,QAAQ,CAAC,gBAAgB,EAAE,CAAC,MAAM,SAAS,MAAM,EAAE,CAAC,GAAG,SAAS,CAAC;QACjE,QAAQ,CAAC,mBAAmB,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;KAC1D,EAAE,CAAC;IACJ,QAAQ,CAAC,qBAAqB,EAAE,qBAAqB,CAAC;IACtD,QAAQ,CAAC,gBAAgB,EAAE,SAAS,WAAW,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,CAAC;CAC5E;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,YAAY,GAAG,wBAAwB,CAsD9F"}

package/dist/bootstrap/build-command-registration-input.js

@@ -0,0 +1,73 @@
+/**
+ * build-command-registration-input — thin builder for the data needed by
+ * `registerCliCommands` after tool mounting.
+ *
+ * Extracted from the top-level composition root in `index.ts` (roadmap item 2)
+ * to further reduce inline logic in the bootstrap sequencer. This follows the
+ * same pattern as `build-per-run-scope.ts`.
+ *
+ * The host owns "pluginLayouts", "toolScaffolds", "sessionReplayRegistry", and
+ * "toolCommandSpecs" preparation so the main entry point stays focused on
+ * sequencing (registries, bootstrap, mounting, registration, dispatch).
+ */
+import { logger } from '@opensip-cli/core';
+import { SessionReplayRegistry } from '../session-replay-registry.js';
+import { EXPECTED_SCAFFOLDING_TOOL_IDS } from './register-tools.js';
+/**
+ * Collects the registry-derived data needed for CLI command registration.
+ * Emits the ADR-0038 back-compat diagnostic for expected bundled tools that
+ * are absent (this warning is intentionally loud when a bundled tool is
+ * missing, as it affects `init` scaffolding).
+ */
+export function buildCommandRegistrationInput(registry) {
+    // Source the plugin-supporting domains from the registered tools'
+    // declared layouts — the kernel never enumerates them (ADR-0009).
+    const pluginLayouts = registry
+        .list()
+        .map((t) => t.pluginLayout)
+        .filter((l) => l !== undefined);
+    // ADR-0038: the per-tool `init`-scaffold contributions, sourced from the same
+    // registry. `init` iterates these (each tool's pluginLayout + scaffoldExamples)
+    // instead of hardcoding fit/sim. A tool with no pluginLayout contributes nothing.
+    const toolScaffolds = registry.list().flatMap((t) => {
+        const layout = t.pluginLayout;
+        if (layout === undefined)
+            return [];
+        return [
+            {
+                layout,
+                scaffoldExamples: t.scaffoldExamples,
+                stableExampleIds: t.stableExampleIds,
+                scaffoldConfigBlock: t.scaffoldConfigBlock,
+            },
+        ];
+    });
+    // Back-compat diagnostic (ADR-0038): the old init always scaffolded fit/sim;
+    // the registry-driven init scaffolds FEWER dirs if one of those is absent. A
+    // loud warning makes a silent under-scaffold observable; a genuinely
+    // uninstalled third-party tool stays silent (correct). The expected-id pin
+    // lives beside BUNDLED_TOOL_PACKAGES (register-tools.ts) — see its JSDoc for
+    // why it is a historical constant rather than derived from loaded manifests.
+    for (const expectedId of EXPECTED_SCAFFOLDING_TOOL_IDS) {
+        if (!registry.list().some((t) => (t.metadata.name ?? t.metadata.id) === expectedId)) {
+            logger.warn({
+                evt: 'cli.tool.expected_bundled_absent',
+                module: 'cli:bootstrap',
+                tool: expectedId,
+                msg: `Expected bundled tool '${expectedId}' is absent from the registry — its init scaffold dirs will not be created.`,
+            });
+        }
+    }
+    const sessionReplayRegistry = SessionReplayRegistry.fromTools(registry);
+    // The live tool command surface, sourced from the populated registry so the
+    // `completion` command derives its flags from the same specs the runtime
+    // mounts (no hand-maintained flag list to drift).
+    const toolCommandSpecs = registry.list().flatMap((t) => t.commandSpecs ?? []);
+    return {
+        pluginLayouts,
+        toolScaffolds,
+        sessionReplayRegistry,
+        toolCommandSpecs,
+    };
+}
+//# sourceMappingURL=build-command-registration-input.js.map

package/dist/bootstrap/build-command-registration-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-command-registration-input.js","sourceRoot":"","sources":["../../src/bootstrap/build-command-registration-input.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAEtE,OAAO,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AAwBpE;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAAC,QAAsB;IAClE,kEAAkE;IAClE,kEAAkE;IAClE,MAAM,aAAa,GAAG,QAAQ;SAC3B,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;SAC1B,MAAM,CAAC,CAAC,CAAC,EAA8B,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IAE9D,8EAA8E;IAC9E,gFAAgF;IAChF,kFAAkF;IAClF,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;QAClD,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,CAAC;QAC9B,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QACpC,OAAO;YACL;gBACE,MAAM;gBACN,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;gBACpC,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;gBACpC,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;aAC3C;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,6EAA6E;IAC7E,qEAAqE;IACrE,2EAA2E;IAC3E,6EAA6E;IAC7E,6EAA6E;IAC7E,KAAK,MAAM,UAAU,IAAI,6BAA6B,EAAE,CAAC;QACvD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,UAAU,CAAC,EAAE,CAAC;YACpF,MAAM,CAAC,IAAI,CAAC;gBACV,GAAG,EAAE,kCAAkC;gBACvC,MAAM,EAAE,eAAe;gBACvB,IAAI,EAAE,UAAU;gBAChB,GAAG,EAAE,0BAA0B,UAAU,6EAA6E;aACvH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,qBAAqB,GAAG,qBAAqB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAExE,4EAA4E;IAC5E,yEAAyE;IACzE,kDAAkD;IAClD,MAAM,gBAAgB,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IAE9E,OAAO;QACL,aAAa;QACb,aAAa;QACb,qBAAqB;QACrB,gBAAgB;KACjB,CAAC;AACJ,CAAC"}

package/dist/bootstrap/build-per-run-scope.d.ts

@@ -0,0 +1,62 @@
+/**
+ * build-per-run-scope — thin, pure(ish) builder for the per-invocation RunScope.
+ *
+ * Extracted from pre-action-hook (and cli-context assembly) to address
+ * composition-root concentration (GA architectural blocker #2).
+ *
+ * The hook remains the sequencer of high-level steps (project resolution,
+ * bailouts, logger config, update nag). This builder owns the exact
+ * scope-construction + wiring of:
+ *   - signalSink (cloud)
+ *   - toolConfig + configDocument (ADR-0023 one-reader)
+ *   - targets (ADR-0037)
+ *   - contributeScope from all registered tools
+ *   - capability registry wiring
+ *   - RunScope construction with explicit inputs
+ *
+ * Inputs are explicit so the builder is testable in isolation and the
+ * hook stays focused on orchestration.
+ */
+import { type LanguageRegistry, type Logger, type ProjectContext, RunScope, type ToolPluginManifest, type ToolProvenance, type ToolRegistry } from '@opensip-cli/core';
+import type { loadCliDefaults } from './cli-defaults.js';
+/** Inputs required to build a fully wired per-run scope. */
+export interface BuildPerRunScopeInput {
+    readonly project: ProjectContext;
+    readonly runId: string;
+    readonly cwd: string;
+    readonly cliDefaults: ReturnType<typeof loadCliDefaults>;
+    readonly registries: {
+        readonly languages: LanguageRegistry;
+        readonly tools: ToolRegistry;
+    };
+    readonly manifests: readonly ToolPluginManifest[];
+    /**
+     * Provenance of the tools admitted this run, recorded by the bootstrap and
+     * stamped onto the scope (paired index-wise with `manifests`) so host
+     * commands read it via `currentScope()` rather than a module global.
+     */
+    readonly provenance: readonly ToolProvenance[];
+    readonly apiKey?: string;
+    readonly noCloud?: boolean;
+    readonly logger: Logger;
+    /**
+     * Presentation state resolved by the hook before the scope is built:
+     * the CLI package version and the cached newer-version string (if any).
+     * Passed in — NOT derivable from `cliDefaults` (the `cli:` config block
+     * carries no package version).
+     */
+    readonly ui: {
+        readonly version: string;
+        readonly update: string | undefined;
+    };
+}
+/**
+ * Build the per-run RunScope + perform the post-construction wiring
+ * (contributeScope, capabilities, toolConfig, targets).
+ *
+ * This is the extracted builder. It is intentionally not 100% pure
+ * (it calls into config resolution, signal sink selection, etc.)
+ * but all inputs are explicit and side effects are contained.
+ */
+export declare function buildPerRunScope(input: BuildPerRunScopeInput): RunScope;
+//# sourceMappingURL=build-per-run-scope.d.ts.map

package/dist/bootstrap/build-per-run-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-per-run-scope.d.ts","sourceRoot":"","sources":["../../src/bootstrap/build-per-run-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAKH,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,MAAM,EACX,KAAK,cAAc,EAEnB,QAAQ,EACR,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,YAAY,EAClB,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzD,4DAA4D;AAC5D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC;IACzD,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;QACrC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;KAC9B,CAAC;IACF,QAAQ,CAAC,SAAS,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAClD;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,cAAc,EAAE,CAAC;IAC/C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,EAAE;QACX,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;KACrC,CAAC;CACH;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,QAAQ,CAqIvE"}

package/dist/bootstrap/build-per-run-scope.js

@@ -0,0 +1,152 @@
+/**
+ * build-per-run-scope — thin, pure(ish) builder for the per-invocation RunScope.
+ *
+ * Extracted from pre-action-hook (and cli-context assembly) to address
+ * composition-root concentration (GA architectural blocker #2).
+ *
+ * The hook remains the sequencer of high-level steps (project resolution,
+ * bailouts, logger config, update nag). This builder owns the exact
+ * scope-construction + wiring of:
+ *   - signalSink (cloud)
+ *   - toolConfig + configDocument (ADR-0023 one-reader)
+ *   - targets (ADR-0037)
+ *   - contributeScope from all registered tools
+ *   - capability registry wiring
+ *   - RunScope construction with explicit inputs
+ *
+ * Inputs are explicit so the builder is testable in isolation and the
+ * hook stays focused on orchestration.
+ */
+import { join } from 'node:path';
+import { resolveEffectiveCloudConfig } from '@opensip-cli/config';
+import { createCapabilityRegistry, resolveUserPaths, RunScope, } from '@opensip-cli/core';
+import { resolveSignalSink } from '@opensip-cli/output';
+import { buildDatastoreThunk } from '../cli-context.js';
+import { buildTargets } from './build-targets.js';
+import { composeAndValidateToolConfig, wireCapabilityRegistry } from './config-and-capabilities.js';
+/**
+ * Build the per-run RunScope + perform the post-construction wiring
+ * (contributeScope, capabilities, toolConfig, targets).
+ *
+ * This is the extracted builder. It is intentionally not 100% pure
+ * (it calls into config resolution, signal sink selection, etc.)
+ * but all inputs are explicit and side effects are contained.
+ */
+export function buildPerRunScope(input) {
+    const { project, runId, cliDefaults, registries, manifests, provenance, apiKey, noCloud, logger, ui, } = input;
+    const { languages, tools } = registries;
+    // ADR-0008: select the cloud signal sink for this run.
+    const signalSink = resolveSignalSink({
+        apiKey,
+        cloud: resolveEffectiveCloudConfig(cliDefaults.cloud),
+        noCloud,
+        cacheDir: join(resolveUserPaths().userHomeDir, 'cache'), // note: resolveUserPaths is from core
+    });
+    // ADR-0023 Phase 4: compose + STRICT-validate config before building the
+    // scope (a typo in any tool namespace → CONFIGURATION_ERROR); resolved
+    // config rides the scope (tools read scope.toolConfig.<namespace>).
+    const { config: toolConfig, document: configDocument } = composeAndValidateToolConfig({
+        tools,
+        manifests,
+        configPath: project.scope === 'project' ? project.configPath : undefined,
+        env: process.env,
+    });
+    // ADR-0037: build the host file-targeting accessor from the SAME single
+    // validated config document the composer already read (ADR-0023: one
+    // reader — `buildTargets` is a pure builder, never a second `readYamlFile`).
+    const targets = buildTargets({ document: configDocument });
+    const scope = new RunScope({
+        logger,
+        projectContext: project,
+        languages,
+        tools,
+        signalSink,
+        runId,
+        // Closure-based lazy datastore. SQLite is materialised only on
+        // first access. The thunk captures `project` so non-action paths
+        // (post-action handlers, error printers) that read via
+        // `getOrOpenDatastore()` find the same instance.
+        datastore: buildDatastoreThunk(project, logger),
+        // Presentation settings the render paths read via currentScope()?.ui.
+        // bannerSize stays an untyped string at the kernel boundary; the
+        // cli-ui render sites narrow it with normalizeBannerSize.
+        // bannerSize stays derivable from config; version/update are resolved by
+        // the hook (package version + cached update-check result) and passed in.
+        ui: {
+            bannerSize: cliDefaults.ui?.banner ?? 'mini',
+            version: ui.version,
+            update: ui.update,
+        },
+        // Per-run admitted-tool facts, recorded by the bootstrap. Stamped here (not
+        // a module global) so host commands (`plugin list`, `tools list`, `tools
+        // uninstall`) read them via `currentScope()` — the single source of truth.
+        toolManifests: manifests,
+        toolProvenance: provenance,
+    });
+    // Lifecycle diagnostics: record wiring steps (contributeScope + capabilities)
+    // on the bus *before* enterScope. These ride the eventual CommandOutcome so
+    // --json consumers and the uniform diagnostics snapshot see the full
+    // per-run construction (addresses architecture review findings on observability
+    // of steps 6/7 and blast-radius files).
+    const contributing = tools.list().filter((t) => !!t.contributeScope);
+    scope.diagnostics.event('load', 'debug', `${contributing.length} tool(s) contributed subscope`, {
+        tools: contributing.map((t) => t.metadata.id ?? t.metadata.name),
+    });
+    scope.diagnostics.counter('tools.subscope_contributions', contributing.length);
+    // D7: each registered tool contributes its tool-specific subscope (e.g.
+    // `scope.simulation`, `scope.graph`) BEFORE the scope is entered. IoC (M4):
+    // the tool RETURNS its slot via `contributeScope()`; the kernel installs it
+    // with `Object.assign` (registration order; a tool with no hook is skipped).
+    for (const tool of tools.list()) {
+        const contribution = tool.contributeScope?.();
+        if (contribution)
+            Object.assign(scope, contribution);
+    }
+    // §5.3 Phase 4: per-run capability registry (manifest domains → real registrars).
+    const capabilities = wireCapabilityRegistry({
+        tools,
+        manifests,
+        registry: createCapabilityRegistry(logger),
+    });
+    const wired = capabilities.listDomains().map((d) => d.id);
+    scope.diagnostics.event('load', 'debug', `wired ${wired.length} capability domain(s)`, {
+        domains: wired,
+    });
+    scope.diagnostics.counter('capabilities.wired', wired.length);
+    // Host-resolved verdict policies (ADR-0035) are derived once from the fully
+    // precedence-resolved toolConfig (flag > env > file > defaults) and stamped
+    // onto the scope. All readers (result builders, gate compare, internal "is
+    // error?" logic) inside this run must use the stamped value (or a helper that
+    // reads it) so the numbers that drove `envelope.verdict.passed` and the exit
+    // code are identical everywhere. See fitness `resolveFitVerdictPolicy`.
+    const fitnessBlock = toolConfig
+        ? toolConfig.fitness
+        : undefined;
+    const fitnessVerdictPolicy = {
+        failOnErrors: typeof fitnessBlock?.failOnErrors === 'number' ? fitnessBlock.failOnErrors : 1,
+        failOnWarnings: typeof fitnessBlock?.failOnWarnings === 'number' ? fitnessBlock.failOnWarnings : 0,
+    };
+    Object.assign(scope, {
+        capabilities,
+        toolConfig,
+        targets,
+        fitnessVerdictPolicy,
+        ...configDocumentSlot(project, configDocument),
+    });
+    // Also surface the config validation result for the uniform lifecycle view.
+    const toolConfigNamespaces = tools.list().filter((t) => !!t.config).length;
+    scope.diagnostics.event('validate', 'debug', `config composed for ${toolConfigNamespaces} tool namespace(s)`);
+    return scope;
+}
+// Helper duplicated from pre-action-hook for now (small, can be shared later if it grows).
+function configDocumentSlot(project, configDocument) {
+    return project.scope === 'project' && project.configPath !== undefined
+        ? { configDocument: configDocument }
+        : {};
+}
+// Note: resolveUserPaths is used above but was in the original hook import from core.
+// In real extraction we would import it here. For this focused GA step we keep the
+// construction close to original to minimize diff while still thinning the hook.
+// The important win is that pre-action-hook no longer contains the 60+ lines of
+// scope assembly + wiring.
+//# sourceMappingURL=build-per-run-scope.js.map

package/dist/bootstrap/build-per-run-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-per-run-scope.js","sourceRoot":"","sources":["../../src/bootstrap/build-per-run-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EACL,wBAAwB,EAIxB,gBAAgB,EAChB,QAAQ,GAIT,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAExD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,4BAA4B,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAoCpG;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAA4B;IAC3D,MAAM,EACJ,OAAO,EACP,KAAK,EACL,WAAW,EACX,UAAU,EACV,SAAS,EACT,UAAU,EACV,MAAM,EACN,OAAO,EACP,MAAM,EACN,EAAE,GACH,GAAG,KAAK,CAAC;IAEV,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC;IAExC,uDAAuD;IACvD,MAAM,UAAU,GAAG,iBAAiB,CAAC;QACnC,MAAM;QACN,KAAK,EAAE,2BAA2B,CAAC,WAAW,CAAC,KAAK,CAAC;QACrD,OAAO;QACP,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,sCAAsC;KAChG,CAAC,CAAC;IAEH,yEAAyE;IACzE,uEAAuE;IACvE,oEAAoE;IACpE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,4BAA4B,CAAC;QACpF,KAAK;QACL,SAAS;QACT,UAAU,EAAE,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;QACxE,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IAEH,wEAAwE;IACxE,qEAAqE;IACrE,6EAA6E;IAC7E,MAAM,OAAO,GAAG,YAAY,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC;IAE3D,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC;QACzB,MAAM;QACN,cAAc,EAAE,OAAO;QACvB,SAAS;QACT,KAAK;QACL,UAAU;QACV,KAAK;QACL,+DAA+D;QAC/D,iEAAiE;QACjE,uDAAuD;QACvD,iDAAiD;QACjD,SAAS,EAAE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC;QAC/C,sEAAsE;QACtE,iEAAiE;QACjE,0DAA0D;QAC1D,yEAAyE;QACzE,yEAAyE;QACzE,EAAE,EAAE;YACF,UAAU,EAAE,WAAW,CAAC,EAAE,EAAE,MAAM,IAAI,MAAM;YAC5C,OAAO,EAAE,EAAE,CAAC,OAAO;YACnB,MAAM,EAAE,EAAE,CAAC,MAAM;SAClB;QACD,4EAA4E;QAC5E,yEAAyE;QACzE,2EAA2E;QAC3E,aAAa,EAAE,SAAS;QACxB,cAAc,EAAE,UAAU;KAC3B,CAAC,CAAC;IAEH,8EAA8E;IAC9E,4EAA4E;IAC5E,qEAAqE;IACrE,gFAAgF;IAChF,wCAAwC;IACxC,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;IACrE,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,MAAM,+BAA+B,EAAE;QAC9F,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;KACjE,CAAC,CAAC;IACH,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,8BAA8B,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;IAE/E,wEAAwE;IACxE,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;QAC9C,IAAI,YAAY;YAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACvD,CAAC;IAED,kFAAkF;IAClF,MAAM,YAAY,GAAG,sBAAsB,CAAC;QAC1C,KAAK;QACL,SAAS;QACT,QAAQ,EAAE,wBAAwB,CAAC,MAAM,CAAC;KAC3C,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1D,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,KAAK,CAAC,MAAM,uBAAuB,EAAE;QACrF,OAAO,EAAE,KAAK;KACf,CAAC,CAAC;IACH,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAE9D,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,8EAA8E;IAC9E,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM,YAAY,GAAwC,UAAU;QAClE,CAAC,CAAG,UAAsC,CAAC,OAA+C;QAC1F,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,oBAAoB,GAAG;QAC3B,YAAY,EAAE,OAAO,YAAY,EAAE,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC5F,cAAc,EACZ,OAAO,YAAY,EAAE,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;KACrF,CAAC;IAEF,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE;QACnB,YAAY;QACZ,UAAU;QACV,OAAO;QACP,oBAAoB;QACpB,GAAG,kBAAkB,CAAC,OAAO,EAAE,cAAc,CAAC;KAC/C,CAAC,CAAC;IAEH,4EAA4E;IAC5E,MAAM,oBAAoB,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IAC3E,KAAK,CAAC,WAAW,CAAC,KAAK,CACrB,UAAU,EACV,OAAO,EACP,uBAAuB,oBAAoB,oBAAoB,CAChE,CAAC;IAEF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,2FAA2F;AAC3F,SAAS,kBAAkB,CACzB,OAA4E,EAC5E,cAAuB;IAEvB,OAAO,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;QACpE,CAAC,CAAC,EAAE,cAAc,EAAE,cAAyC,EAAE;QAC/D,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,sFAAsF;AACtF,mFAAmF;AACnF,iFAAiF;AACjF,gFAAgF;AAChF,2BAA2B"}

package/dist/bootstrap/build-targets.d.ts

@@ -0,0 +1,42 @@
+/**
+ * build-targets — the host's once-per-run construction of `scope.targets`
+ * (ADR-0037, generic-targeting-runtime Phase 1).
+ *
+ * The composition root reads the already-resolved config document, parses the
+ * host-owned `targets:` / `globalExcludes:` blocks through the
+ * `@opensip-cli/config` Zod field schemas, registers each target into the
+ * substrate `TargetRegistry`, and returns a `TargetResolver` — the structural
+ * scope-slot shape `core` declares — wrapping the registry plus the bound
+ * `resolveTargets` / `applyGlobalExcludes` closures + the project
+ * `globalExcludes`. The CLI bootstrap attaches the result as `scope.targets`,
+ * mirroring how `composeAndValidateToolConfig` produces `scope.toolConfig`.
+ *
+ * The host build is the GENERIC half only: it does NOT validate `checkOverrides`
+ * (a check-slug concept) — that cross-validation stays in
+ * `@opensip-cli/fitness`'s loader (Phase 2). A run with no config document, or
+ * a config document with no `targets:` block, yields `undefined` — exactly like
+ * a config-less `toolConfig`.
+ */
+import { type TargetResolver } from '@opensip-cli/core';
+/**
+ * Build the host's `scope.targets` resolver from the validated config document.
+ *
+ * Takes the SAME validated document the single sanctioned reader
+ * (`composeAndValidateToolConfig`) already produced — this is a pure builder, it
+ * never reads the config file itself (ADR-0023: one reader). The host-owned
+ * `targets:` / `globalExcludes:` namespaces were strict-validated whole-document
+ * by the composed schema; they are re-parsed here through the same field schemas
+ * only to recover their narrowed types (idempotent on already-validated data, no
+ * I/O), then each target is registered into a substrate `TargetRegistry` and
+ * wrapped in a `TargetResolver` with the bound `resolveTargets` /
+ * `applyGlobalExcludes` closures.
+ *
+ * @param args.document The validated config document from
+ *   `composeAndValidateToolConfig`, or an empty object for a config-less run.
+ * @returns The `TargetResolver` to attach to `scope.targets`, or `undefined`
+ *   when there is no config document or no `targets:` block to resolve.
+ */
+export declare function buildTargets(args: {
+    readonly document: unknown;
+}): TargetResolver | undefined;
+//# sourceMappingURL=build-targets.d.ts.map