opensip-cli 0.1.0

package/dist/bootstrap/build-targets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-targets.d.ts","sourceRoot":"","sources":["../../src/bootstrap/build-targets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AA4C5E;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE;IAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,GAAG,cAAc,GAAG,SAAS,CAqD7F"}

package/dist/bootstrap/build-targets.js

@@ -0,0 +1,117 @@
+/**
+ * build-targets — the host's once-per-run construction of `scope.targets`
+ * (ADR-0037, generic-targeting-runtime Phase 1).
+ *
+ * The composition root reads the already-resolved config document, parses the
+ * host-owned `targets:` / `globalExcludes:` blocks through the
+ * `@opensip-cli/config` Zod field schemas, registers each target into the
+ * substrate `TargetRegistry`, and returns a `TargetResolver` — the structural
+ * scope-slot shape `core` declares — wrapping the registry plus the bound
+ * `resolveTargets` / `applyGlobalExcludes` closures + the project
+ * `globalExcludes`. The CLI bootstrap attaches the result as `scope.targets`,
+ * mirroring how `composeAndValidateToolConfig` produces `scope.toolConfig`.
+ *
+ * The host build is the GENERIC half only: it does NOT validate `checkOverrides`
+ * (a check-slug concept) — that cross-validation stays in
+ * `@opensip-cli/fitness`'s loader (Phase 2). A run with no config document, or
+ * a config document with no `targets:` block, yields `undefined` — exactly like
+ * a config-less `toolConfig`.
+ */
+import { globalExcludesSchema, targetsRecordSchema } from '@opensip-cli/config';
+import { ConfigurationError } from '@opensip-cli/core';
+import { TargetRegistry, applyGlobalExcludes, resolveTargets } from '@opensip-cli/targeting';
+/**
+ * Default per-target exclusion globs, applied when a target declares no
+ * explicit `exclude`. Mirrors the fitness loader's fallback normalization so
+ * the host-built set and the scope-less fallback build (fitness
+ * `targets/loader.ts`, kept for programmatic/test use) stay byte-identical.
+ */
+const DEFAULT_EXCLUDES = ['**/node_modules/**', '**/dist/**'];
+/** A plain-object guard that treats arrays and null as non-objects. */
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * Normalize one parsed `targets.<name>` entry into the frozen `Target` shape
+ * the substrate registry holds — defaulting `exclude` to {@link DEFAULT_EXCLUDES}
+ * and freezing every array, matching the fitness loader's `buildFromParsed`.
+ */
+function toTarget(name, entry) {
+    const config = Object.freeze({
+        name,
+        description: entry.description,
+        include: Object.freeze([...entry.include]),
+        exclude: Object.freeze([...(entry.exclude ?? DEFAULT_EXCLUDES)]),
+        ...(entry.tags && { tags: Object.freeze([...entry.tags]) }),
+        ...(entry.languages && { languages: Object.freeze([...entry.languages]) }),
+        ...(entry.concerns && { concerns: Object.freeze([...entry.concerns]) }),
+    });
+    return Object.freeze({ config });
+}
+/**
+ * Build the host's `scope.targets` resolver from the validated config document.
+ *
+ * Takes the SAME validated document the single sanctioned reader
+ * (`composeAndValidateToolConfig`) already produced — this is a pure builder, it
+ * never reads the config file itself (ADR-0023: one reader). The host-owned
+ * `targets:` / `globalExcludes:` namespaces were strict-validated whole-document
+ * by the composed schema; they are re-parsed here through the same field schemas
+ * only to recover their narrowed types (idempotent on already-validated data, no
+ * I/O), then each target is registered into a substrate `TargetRegistry` and
+ * wrapped in a `TargetResolver` with the bound `resolveTargets` /
+ * `applyGlobalExcludes` closures.
+ *
+ * @param args.document The validated config document from
+ *   `composeAndValidateToolConfig`, or an empty object for a config-less run.
+ * @returns The `TargetResolver` to attach to `scope.targets`, or `undefined`
+ *   when there is no config document or no `targets:` block to resolve.
+ */
+export function buildTargets(args) {
+    const { document } = args;
+    if (!isPlainObject(document))
+        return undefined;
+    // No `targets:` block → no resolver. A document may carry only tool config
+    // (graph/sim namespaces) with no file targeting, exactly like a config-less run.
+    if (document.targets === undefined)
+        return undefined;
+    let targetsRecord;
+    try {
+        targetsRecord = targetsRecordSchema.parse(document.targets);
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        throw new ConfigurationError(`Invalid 'targets:' block in opensip-cli.config.yml: ${detail}`, {
+            code: 'CONFIGURATION.TARGETS.INVALID',
+        });
+    }
+    let globalExcludes;
+    try {
+        globalExcludes = Object.freeze(document.globalExcludes === undefined
+            ? []
+            : [...globalExcludesSchema.parse(document.globalExcludes)]);
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        throw new ConfigurationError(`Invalid 'globalExcludes:' block in opensip-cli.config.yml: ${detail}`, { code: 'CONFIGURATION.TARGETS.INVALID' });
+    }
+    const registry = new TargetRegistry();
+    for (const [name, entry] of Object.entries(targetsRecord)) {
+        registry.register(toTarget(name, entry));
+    }
+    return {
+        getByName: (name) => registry.getByName(name),
+        // @fitness-ignore-next-line batch-operation-limits -- getAll() over the project's declared target set (a handful of named file-sets per config document), bounded like core's tool registry getAll.
+        getAll: () => registry.getAll(),
+        getByTag: (tag) => registry.getByTag(tag),
+        has: (name) => registry.has(name),
+        resolveTargets: (names, rootDir) => {
+            const resolved = names
+                .map((name) => registry.getByName(name))
+                .filter((t) => t !== undefined);
+            return resolveTargets(resolved, rootDir, globalExcludes);
+        },
+        applyGlobalExcludes: (files, rootDir) => applyGlobalExcludes(files, rootDir, globalExcludes),
+        globalExcludes,
+    };
+}
+//# sourceMappingURL=build-targets.js.map

package/dist/bootstrap/build-targets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-targets.js","sourceRoot":"","sources":["../../src/bootstrap/build-targets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAe,MAAM,qBAAqB,CAAC;AAC7F,OAAO,EAAE,kBAAkB,EAAuB,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE7F;;;;;GAKG;AACH,MAAM,gBAAgB,GAAsB,CAAC,oBAAoB,EAAE,YAAY,CAAC,CAAC;AAEjF,uEAAuE;AACvE,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CACf,IAAY,EACZ,KAOC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC3B,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC,CAAC;QAChE,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;KACxE,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,YAAY,CAAC,IAAoC;IAC/D,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAC1B,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IAE/C,2EAA2E;IAC3E,iFAAiF;IACjF,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAErD,IAAI,aAAsC,CAAC;IAC3C,IAAI,CAAC;QACH,aAAa,GAAG,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,IAAI,kBAAkB,CAAC,uDAAuD,MAAM,EAAE,EAAE;YAC5F,IAAI,EAAE,+BAA+B;SACtC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,cAAiC,CAAC;IACtC,IAAI,CAAC;QACH,cAAc,GAAG,MAAM,CAAC,MAAM,CAC5B,QAAQ,CAAC,cAAc,KAAK,SAAS;YACnC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,GAAG,oBAAoB,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAC7D,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,IAAI,kBAAkB,CAC1B,8DAA8D,MAAM,EAAE,EACtE,EAAE,IAAI,EAAE,+BAA+B,EAAE,CAC1C,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,cAAc,EAAE,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QAC1D,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAuC,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO;QACL,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC;QAC7C,oMAAoM;QACpM,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE;QAC/B,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QACzC,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;QACjC,cAAc,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YACjC,MAAM,QAAQ,GAAG,KAAK;iBACnB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;iBACvC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;YAC/C,OAAO,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;QAC3D,CAAC;QACD,mBAAmB,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,cAAc,CAAC;QAC5F,cAAc;KACf,CAAC;AACJ,CAAC"}

package/dist/bootstrap/cli-defaults.d.ts

@@ -0,0 +1,35 @@
+/**
+ * cli-defaults — read the `cli:` block from
+ * `opensip-cli.config.yml` and merge it into Commander-parsed opts.
+ *
+ * Extracted from `index.ts` so the merge precedence is testable and the
+ * bootstrap module owns config-resolution end-to-end. Order is
+ * load → merge → derive (silent/debug) so flag-driven log mode reflects
+ * the merged opts (F10).
+ *
+ * The schema + loader live in `@opensip-cli/config`
+ * (`loadCliDefaults`, `cliConfigSchema`) — the `cli:` block is
+ * tool-agnostic and a project shipping only `simulation` shouldn't need
+ * fitness installed just to read its own CLI defaults. Relocated out of
+ * `@opensip-cli/contracts` in the launch contract (ADR-0023; restores contracts
+ * types-only). Audit 2026-05-23 G2.
+ */
+import type { CliDefaults } from '@opensip-cli/config';
+export type { CliDefaults } from '@opensip-cli/config';
+/**
+ * Best-effort load of the `cli:` block. Falls back to `{}` when the
+ * config is missing or malformed — config-presence is optional. The
+ * underlying loader (in `@opensip-cli/contracts`) is already
+ * permissive on every failure path; the wrapper here exists so the
+ * absence path emits a structured debug log keyed against `cli:` (the
+ * contracts loader stays dependency-light and doesn't reach for the
+ * logger).
+ */
+export declare function loadCliDefaults(cwd: string, explicitConfigPath?: string): CliDefaults;
+/**
+ * Apply the `cli:` defaults onto Commander-parsed opts when the
+ * corresponding flag wasn't supplied. Mutates `opts` in place — matches
+ * Commander's expectation that opts are the post-merge truth.
+ */
+export declare function mergeConfigDefaults(opts: Record<string, unknown>, config: CliDefaults): void;
+//# sourceMappingURL=cli-defaults.d.ts.map

package/dist/bootstrap/cli-defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-defaults.d.ts","sourceRoot":"","sources":["../../src/bootstrap/cli-defaults.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAIvD,YAAY,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,kBAAkB,CAAC,EAAE,MAAM,GAAG,WAAW,CAarF;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,GAAG,IAAI,CAa5F"}

package/dist/bootstrap/cli-defaults.js

@@ -0,0 +1,65 @@
+/**
+ * cli-defaults — read the `cli:` block from
+ * `opensip-cli.config.yml` and merge it into Commander-parsed opts.
+ *
+ * Extracted from `index.ts` so the merge precedence is testable and the
+ * bootstrap module owns config-resolution end-to-end. Order is
+ * load → merge → derive (silent/debug) so flag-driven log mode reflects
+ * the merged opts (F10).
+ *
+ * The schema + loader live in `@opensip-cli/config`
+ * (`loadCliDefaults`, `cliConfigSchema`) — the `cli:` block is
+ * tool-agnostic and a project shipping only `simulation` shouldn't need
+ * fitness installed just to read its own CLI defaults. Relocated out of
+ * `@opensip-cli/contracts` in the launch contract (ADR-0023; restores contracts
+ * types-only). Audit 2026-05-23 G2.
+ */
+import { loadCliDefaults as loadCliDefaultsFromConfig, resolveApiKey } from '@opensip-cli/config';
+import { logger } from '@opensip-cli/core';
+/**
+ * Best-effort load of the `cli:` block. Falls back to `{}` when the
+ * config is missing or malformed — config-presence is optional. The
+ * underlying loader (in `@opensip-cli/contracts`) is already
+ * permissive on every failure path; the wrapper here exists so the
+ * absence path emits a structured debug log keyed against `cli:` (the
+ * contracts loader stays dependency-light and doesn't reach for the
+ * logger).
+ */
+export function loadCliDefaults(cwd, explicitConfigPath) {
+    try {
+        return loadCliDefaultsFromConfig(cwd, explicitConfigPath);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        logger.debug({
+            evt: 'cli.config.unavailable',
+            module: 'cli',
+            cwd,
+            error: message,
+        });
+        return {};
+    }
+}
+/**
+ * Apply the `cli:` defaults onto Commander-parsed opts when the
+ * corresponding flag wasn't supplied. Mutates `opts` in place — matches
+ * Commander's expectation that opts are the post-merge truth.
+ */
+export function mergeConfigDefaults(opts, config) {
+    // NOTE (ADR-0022): `recipe` is deliberately NOT a cli-wide default. Recipe
+    // defaults are tool-scoped — `fit`/`graph`/`sim` own disjoint recipe
+    // namespaces, so `opts.recipe` reflects only the explicit `--recipe` flag.
+    if (config.verbose && opts.verbose === false)
+        opts.verbose = config.verbose;
+    if (config.json && opts.json === false)
+        opts.json = config.json;
+    if (config.reportTo && opts.reportTo === undefined)
+        opts.reportTo = config.reportTo;
+    if (config.exclude && Array.isArray(opts.exclude) && opts.exclude.length === 0) {
+        opts.exclude.push(...config.exclude);
+    }
+    if (opts.apiKey === undefined) {
+        opts.apiKey = config.apiKey ?? resolveApiKey();
+    }
+}
+//# sourceMappingURL=cli-defaults.js.map

package/dist/bootstrap/cli-defaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-defaults.js","sourceRoot":"","sources":["../../src/bootstrap/cli-defaults.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,eAAe,IAAI,yBAAyB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAClG,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAQ3C;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,kBAA2B;IACtE,IAAI,CAAC;QACH,OAAO,yBAAyB,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,CAAC,KAAK,CAAC;YACX,GAAG,EAAE,wBAAwB;YAC7B,MAAM,EAAE,KAAK;YACb,GAAG;YACH,KAAK,EAAE,OAAO;SACf,CAAC,CAAC;QACH,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAA6B,EAAE,MAAmB;IACpF,2EAA2E;IAC3E,qEAAqE;IACrE,2EAA2E;IAC3E,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK;QAAE,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC5E,IAAI,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;QAAE,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IAChE,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;QAAE,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACpF,IAAI,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAK,IAAI,CAAC,OAAoB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5F,IAAI,CAAC,OAAoB,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,aAAa,EAAE,CAAC;IACjD,CAAC;AACH,CAAC"}

package/dist/bootstrap/config-and-capabilities.d.ts

@@ -0,0 +1,74 @@
+/**
+ * config-and-capabilities — the pre-dispatch composition seam for the
+ * capability-configuration release (ADR-0023 / §5.3, Phase 4).
+ *
+ * Two host responsibilities the composition root owns once per run, extracted
+ * from the pre-action-hook to keep that hook within its complexity budget:
+ *
+ *   1. {@link composeAndValidateToolConfig} — gather every registered tool's
+ *      contributed `ToolConfigDeclaration`, compose them into ONE strict
+ *      whole-document schema, validate the parsed `opensip-cli.config.yml`
+ *      STRICT before any command runs (a typo in ANY tool namespace throws a
+ *      single `ConfigurationError` → `CONFIGURATION_ERROR` exit through the
+ *      existing error boundary), then resolve precedence (flag > env > file >
+ *      defaults) and return the resolved config to attach to the scope.
+ *
+ *   2. {@link wireCapabilityRegistry} — construct the per-run capability
+ *      registry, register every admitted manifest's declared domains (each
+ *      seeded with a DEFERRED placeholder registrar), then replace each
+ *      placeholder with the owning tool's REAL registrar
+ *      (`tool.capabilityRegistrars`). The host routes by domain; the tool owns
+ *      the registrar.
+ *
+ * This module is the ONE place the CLI imports `@opensip-cli/config` (the
+ * composer + precedence resolver). Tools never import it; they read their
+ * validated namespace off `scope.toolConfig`.
+ */
+import { type CapabilityRegistry, type ResolvedToolConfig, type ToolPluginManifest, type ToolRegistry } from '@opensip-cli/core';
+/**
+ * Compose + strict-validate the config document, then resolve precedence.
+ *
+ * Reads the project config file (when one exists), composes the registered
+ * tools' schemas, validates STRICT (rejecting a typo inside any tool
+ * namespace), and resolves precedence. Returns `undefined` when there is no
+ * config document to validate (a project-agnostic command or a config-less
+ * project) — the scope then carries no `toolConfig` and tools fall back to
+ * their in-tool defaults.
+ *
+ * @param tools The per-run tool registry (supplies the contributed schemas).
+ * @param configPath The resolved path to `opensip-cli.config.yml`, or
+ *   `undefined` when the run has no config document.
+ * @param env The environment map for env-binding precedence (typically
+ *   `process.env`).
+ * @returns The resolved tool config to attach to the scope, or `undefined`.
+ * @throws {ConfigurationError} (`CONFIGURATION_ERROR`) when the document fails
+ *   strict validation in ANY tool namespace.
+ */
+export declare function composeAndValidateToolConfig(args: {
+    readonly tools: ToolRegistry;
+    readonly manifests?: readonly ToolPluginManifest[];
+    readonly configPath: string | undefined;
+    readonly env: Readonly<Record<string, string | undefined>>;
+}): {
+    readonly config: ResolvedToolConfig | undefined;
+    readonly document: unknown;
+};
+/**
+ * Construct + populate the per-run capability registry (§5.3, Phase 4).
+ *
+ * Registers every admitted manifest's declared capability domains (each with
+ * a deferred placeholder registrar), then replaces each placeholder with the
+ * owning tool's REAL registrar from `tool.capabilityRegistrars`. A registrar
+ * for a domain the tool's manifest did not declare is skipped (the host only
+ * wires registrars for declared domains).
+ *
+ * @param tools The per-run tool registry (supplies each tool's real registrars).
+ * @param manifests The admitted manifests (supply the declared domains).
+ * @returns The populated registry, ready to attach to `scope.capabilities`.
+ */
+export declare function wireCapabilityRegistry(args: {
+    readonly tools: ToolRegistry;
+    readonly manifests: readonly ToolPluginManifest[];
+    readonly registry: CapabilityRegistry;
+}): CapabilityRegistry;
+//# sourceMappingURL=config-and-capabilities.d.ts.map

package/dist/bootstrap/config-and-capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-and-capabilities.d.ts","sourceRoot":"","sources":["../../src/bootstrap/config-and-capabilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAWH,OAAO,EACL,KAAK,kBAAkB,EAIvB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EAElB,MAAM,mBAAmB,CAAC;AA2E3B;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE;IACjD,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACnD,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;CAC5D,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAuDlF;AA2CD;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAClD,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;CACvC,GAAG,kBAAkB,CAuBrB"}

package/dist/bootstrap/config-and-capabilities.js

@@ -0,0 +1,224 @@
+/**
+ * config-and-capabilities — the pre-dispatch composition seam for the
+ * capability-configuration release (ADR-0023 / §5.3, Phase 4).
+ *
+ * Two host responsibilities the composition root owns once per run, extracted
+ * from the pre-action-hook to keep that hook within its complexity budget:
+ *
+ *   1. {@link composeAndValidateToolConfig} — gather every registered tool's
+ *      contributed `ToolConfigDeclaration`, compose them into ONE strict
+ *      whole-document schema, validate the parsed `opensip-cli.config.yml`
+ *      STRICT before any command runs (a typo in ANY tool namespace throws a
+ *      single `ConfigurationError` → `CONFIGURATION_ERROR` exit through the
+ *      existing error boundary), then resolve precedence (flag > env > file >
+ *      defaults) and return the resolved config to attach to the scope.
+ *
+ *   2. {@link wireCapabilityRegistry} — construct the per-run capability
+ *      registry, register every admitted manifest's declared domains (each
+ *      seeded with a DEFERRED placeholder registrar), then replace each
+ *      placeholder with the owning tool's REAL registrar
+ *      (`tool.capabilityRegistrars`). The host routes by domain; the tool owns
+ *      the registrar.
+ *
+ * This module is the ONE place the CLI imports `@opensip-cli/config` (the
+ * composer + precedence resolver). Tools never import it; they read their
+ * validated namespace off `scope.toolConfig`.
+ */
+import { analyzeNamespaceClaims, composeConfigSchema, hostConfigDeclarations, resolveConfig, validateConfigDocument, } from '@opensip-cli/config';
+import { ConfigurationError, logger, readYamlFileOrThrow, registerCapabilityDomainsFromManifest, } from '@opensip-cli/core';
+/** A plain-object guard that treats arrays and null as non-objects. */
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * Collect the contributed config declarations from the registered tools. A
+ * tool's `config` slot is the kernel-side `ToolConfigContribution` carrier; it
+ * is structurally a `ToolConfigDeclaration` (the schema is `unknown` at the
+ * kernel boundary, a Zod schema at the config layer), so narrowing it here —
+ * the composition root, which DOES import `@opensip-cli/config` — is sound.
+ */
+function collectDeclarations(tools) {
+    const declarations = [];
+    for (const tool of tools.list()) {
+        if (tool.config !== undefined) {
+            declarations.push(tool.config);
+        }
+    }
+    return declarations;
+}
+function addPluginConfigKey(keys, key, kind) {
+    if (key === undefined)
+        return;
+    const existing = keys.get(key);
+    if (existing !== undefined && existing !== kind) {
+        throw new ConfigurationError(`Plugin config key '${key}' is declared with conflicting value kinds (${existing}, ${kind}).`, { code: 'CONFIGURATION_ERROR', namespace: 'plugins' });
+    }
+    keys.set(key, kind);
+}
+function collectPluginConfigKeys(manifests) {
+    const keys = new Map();
+    for (const manifest of manifests) {
+        for (const capability of manifest.capabilities ?? []) {
+            const configKeys = capability.discovery?.configKeys;
+            if (configKeys === undefined)
+                continue;
+            addPluginConfigKey(keys, configKeys.packages, 'packages');
+            addPluginConfigKey(keys, configKeys.autoDiscover, 'autoDiscover');
+            addPluginConfigKey(keys, configKeys.scopes, 'scopes');
+        }
+    }
+    return [...keys.entries()].map(([key, kind]) => ({ key, kind }));
+}
+/**
+ * Project the validated document's per-namespace blocks into the `file`
+ * precedence source (`namespace -> { key -> value }`). Only the declared
+ * namespaces are read; unclaimed top-level keys (cli/targets/globalExcludes)
+ * are not this resolver's concern.
+ */
+function fileBlocksFor(declarations, validated) {
+    const file = {};
+    if (!isPlainObject(validated))
+        return file;
+    for (const decl of declarations) {
+        const block = validated[decl.namespace];
+        if (isPlainObject(block))
+            file[decl.namespace] = block;
+    }
+    return file;
+}
+/**
+ * Compose + strict-validate the config document, then resolve precedence.
+ *
+ * Reads the project config file (when one exists), composes the registered
+ * tools' schemas, validates STRICT (rejecting a typo inside any tool
+ * namespace), and resolves precedence. Returns `undefined` when there is no
+ * config document to validate (a project-agnostic command or a config-less
+ * project) — the scope then carries no `toolConfig` and tools fall back to
+ * their in-tool defaults.
+ *
+ * @param tools The per-run tool registry (supplies the contributed schemas).
+ * @param configPath The resolved path to `opensip-cli.config.yml`, or
+ *   `undefined` when the run has no config document.
+ * @param env The environment map for env-binding precedence (typically
+ *   `process.env`).
+ * @returns The resolved tool config to attach to the scope, or `undefined`.
+ * @throws {ConfigurationError} (`CONFIGURATION_ERROR`) when the document fails
+ *   strict validation in ANY tool namespace.
+ */
+export function composeAndValidateToolConfig(args) {
+    const { tools, configPath, env, manifests = [] } = args;
+    const toolDeclarations = collectDeclarations(tools);
+    // A run with no tools that declare config (e.g. a project-agnostic context)
+    // carries no toolConfig — tools fall back to their in-tool defaults. The host
+    // document-level blocks (cli/dashboard/schemaVersion) only need composing when
+    // there is a tool dispatch to validate the document for; the real CLI always
+    // registers fit/graph/sim, so they are always composed in practice.
+    if (toolDeclarations.length === 0)
+        return { config: undefined, document: {} };
+    // Compose the host document-level declarations (cli/dashboard/schemaVersion,
+    // and from Phase 1 the targeting blocks) BESIDE the tool declarations, so the
+    // whole document — not just the tool namespaces — validates STRICT through the
+    // one composed schema (ADR-0023, the launch seam).
+    const declarations = [
+        ...hostConfigDeclarations({ pluginConfigKeys: collectPluginConfigKeys(manifests) }),
+        ...toolDeclarations,
+    ];
+    // When a configPath was resolved by the project context (i.e. a real
+    // opensip-cli.config.yml or a package.json pointer), read it *strictly*.
+    // Malformed YAML or unreadable file must fail before any dispatch (a
+    // silent `{}` would bypass targets, gates, cloud settings, etc.).
+    // When no configPath, fall back to defaults only (permissive discovery
+    // paths elsewhere still use the non-throwing reader).
+    const raw = configPath === undefined ? {} : readYamlFileOrThrow(configPath, { loader: 'project-config' });
+    const document = isPlainObject(raw) ? raw : {};
+    const schema = composeConfigSchema(declarations);
+    // STRICT gate: a typo in any tool namespace throws ConfigurationError here,
+    // before dispatch. The CLI error boundary maps it to CONFIGURATION_ERROR.
+    const validated = validateConfigDocument(schema, document);
+    // ADR-0043: the composer TOLERATES unclaimed top-level namespaces (the
+    // uninstalled-tool forward-compat contract) — but never silently. Two cases:
+    //   - the namespace equals a LOADED tool's id → that tool declares no
+    //     Tool.config yet its block exists: a tool-authoring bug, hard-reject;
+    //   - otherwise → warn loudly (structured event + stderr for CI), with a
+    //     did-you-mean when the key is edit-distance-close to a claimed one.
+    reportUnclaimedNamespaces({ declarations, document: validated, tools });
+    // The validated document is returned alongside the resolved config so the
+    // host can build the targeting substrate (`buildTargets`) from the SAME
+    // single validated read — no second `readYamlFile` (ADR-0023 one-reader).
+    // `targets`/`globalExcludes` are host namespaces validated by the composed
+    // schema; `buildTargets` is a pure builder over them, never a reader.
+    return {
+        config: resolveConfig({
+            declarations,
+            file: fileBlocksFor(declarations, validated),
+            env,
+        }),
+        document: validated,
+    };
+}
+/**
+ * The ADR-0043 unclaimed-namespace policy: reject a LOADED tool's undeclared
+ * block; warn (event + stderr, once per namespace per run) on the rest.
+ *
+ * @throws {ConfigurationError} when an unclaimed namespace equals a loaded
+ *   tool's id — the block exists but the tool cannot consume it.
+ */
+function reportUnclaimedNamespaces(args) {
+    const report = analyzeNamespaceClaims(args.declarations, args.document);
+    if (report.unclaimed.length === 0)
+        return;
+    const loadedToolNames = new Set(args.tools.list().map((t) => t.metadata.name ?? t.metadata.id));
+    const toolBugs = report.unclaimed.filter((u) => loadedToolNames.has(u.namespace));
+    if (toolBugs.length > 0) {
+        const names = toolBugs.map((u) => `'${u.namespace}'`).join(', ');
+        throw new ConfigurationError(`Config declares ${names} but the loaded tool(s) of the same id contribute no Tool.config — ` +
+            `the block can never apply. Remove the block or fix the tool's config contribution. (ADR-0043)`, { code: 'CONFIGURATION_ERROR' });
+    }
+    for (const u of report.unclaimed) {
+        const didYouMean = u.suggestion === undefined ? '' : ` — did you mean '${u.suggestion}:'?`;
+        logger.warn({
+            evt: 'cli.config.unclaimed_namespace',
+            module: 'cli:bootstrap',
+            namespace: u.namespace,
+            suggestion: u.suggestion,
+        });
+        process.stderr.write(`opensip: config namespace '${u.namespace}:' is not claimed by any loaded tool${didYouMean} ` +
+            `(expected if that tool isn't installed in this project)\n`);
+    }
+}
+/**
+ * Construct + populate the per-run capability registry (§5.3, Phase 4).
+ *
+ * Registers every admitted manifest's declared capability domains (each with
+ * a deferred placeholder registrar), then replaces each placeholder with the
+ * owning tool's REAL registrar from `tool.capabilityRegistrars`. A registrar
+ * for a domain the tool's manifest did not declare is skipped (the host only
+ * wires registrars for declared domains).
+ *
+ * @param tools The per-run tool registry (supplies each tool's real registrars).
+ * @param manifests The admitted manifests (supply the declared domains).
+ * @returns The populated registry, ready to attach to `scope.capabilities`.
+ */
+export function wireCapabilityRegistry(args) {
+    const { tools, manifests, registry } = args;
+    // 1. Register every manifest-declared domain with a deferred placeholder.
+    for (const manifest of manifests) {
+        registerCapabilityDomainsFromManifest(manifest, registry);
+    }
+    // 2. Replace each placeholder with the owning tool's real registrar. A
+    //    registrar whose domain id was not declared in any manifest is skipped
+    //    (hasDomain false) — the host never invents a domain a tool didn't
+    //    declare.
+    for (const tool of tools.list()) {
+        const registrars = tool.capabilityRegistrars;
+        if (registrars === undefined)
+            continue;
+        for (const [domainId, registrar] of Object.entries(registrars)) {
+            if (registry.hasDomain(domainId)) {
+                registry.setRegistrar(domainId, registrar);
+            }
+        }
+    }
+    return registry;
+}
+//# sourceMappingURL=config-and-capabilities.js.map

package/dist/bootstrap/config-and-capabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-and-capabilities.js","sourceRoot":"","sources":["../../src/bootstrap/config-and-capabilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,EACtB,aAAa,EACb,sBAAsB,GAGvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAEL,kBAAkB,EAClB,MAAM,EACN,mBAAmB,EAInB,qCAAqC,GACtC,MAAM,mBAAmB,CAAC;AAE3B,uEAAuE;AACvE,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,KAAmB;IAC9C,MAAM,YAAY,GAA4B,EAAE,CAAC;IACjD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAA+B,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,kBAAkB,CACzB,IAAqD,EACrD,GAAuB,EACvB,IAAwC;IAExC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO;IAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,GAAG,+CAA+C,QAAQ,KAAK,IAAI,IAAI,EAC7F,EAAE,IAAI,EAAE,qBAAqB,EAAE,SAAS,EAAE,SAAS,EAAE,CACtD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,uBAAuB,CAC9B,SAAwC;IAExC,MAAM,IAAI,GAAG,IAAI,GAAG,EAA8C,CAAC;IACnE,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;YACrD,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC;YACpD,IAAI,UAAU,KAAK,SAAS;gBAAE,SAAS;YACvC,kBAAkB,CAAC,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC1D,kBAAkB,CAAC,IAAI,EAAE,UAAU,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;YAClE,kBAAkB,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CACpB,YAA8C,EAC9C,SAAkB;IAElB,MAAM,IAAI,GAA4C,EAAE,CAAC;IACzD,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,aAAa,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAK5C;IACC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC;IACxD,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACpD,4EAA4E;IAC5E,8EAA8E;IAC9E,+EAA+E;IAC/E,6EAA6E;IAC7E,oEAAoE;IACpE,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAE9E,6EAA6E;IAC7E,8EAA8E;IAC9E,+EAA+E;IAC/E,mDAAmD;IACnD,MAAM,YAAY,GAAqC;QACrD,GAAG,sBAAsB,CAAC,EAAE,gBAAgB,EAAE,uBAAuB,CAAC,SAAS,CAAC,EAAE,CAAC;QACnF,GAAG,gBAAgB;KACpB,CAAC;IAEF,qEAAqE;IACrE,yEAAyE;IACzE,qEAAqE;IACrE,kEAAkE;IAClE,uEAAuE;IACvE,sDAAsD;IACtD,MAAM,GAAG,GACP,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAChG,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAE/C,MAAM,MAAM,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAC;IACjD,4EAA4E;IAC5E,0EAA0E;IAC1E,MAAM,SAAS,GAAG,sBAAsB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAE3D,uEAAuE;IACvE,6EAA6E;IAC7E,sEAAsE;IACtE,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,yBAAyB,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IAExE,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,2EAA2E;IAC3E,sEAAsE;IACtE,OAAO;QACL,MAAM,EAAE,aAAa,CAAC;YACpB,YAAY;YACZ,IAAI,EAAE,aAAa,CAAC,YAAY,EAAE,SAAS,CAAC;YAC5C,GAAG;SACJ,CAAC;QACF,QAAQ,EAAE,SAAS;KACpB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,yBAAyB,CAAC,IAIlC;IACC,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxE,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAE1C,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAChG,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAClF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,IAAI,kBAAkB,CAC1B,mBAAmB,KAAK,qEAAqE;YAC3F,+FAA+F,EACjG,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAChC,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACjC,MAAM,UAAU,GAAG,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,UAAU,KAAK,CAAC;QAC3F,MAAM,CAAC,IAAI,CAAC;YACV,GAAG,EAAE,gCAAgC;YACrC,MAAM,EAAE,eAAe;YACvB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,UAAU,EAAE,CAAC,CAAC,UAAU;SACzB,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,8BAA8B,CAAC,CAAC,SAAS,uCAAuC,UAAU,GAAG;YAC3F,2DAA2D,CAC9D,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAItC;IACC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAE5C,0EAA0E;IAC1E,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,qCAAqC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC5D,CAAC;IAED,uEAAuE;IACvE,2EAA2E;IAC3E,uEAAuE;IACvE,cAAc;IACd,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC;QAC7C,IAAI,UAAU,KAAK,SAAS;YAAE,SAAS;QACvC,KAAK,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/D,IAAI,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjC,QAAQ,CAAC,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/bootstrap/deliver-envelope.d.ts

@@ -0,0 +1,80 @@
+/**
+ * deliver-envelope — the composition root's signal-delivery step (ADR-0011,
+ * Phase 3).
+ *
+ * After a tool returns its {@link SignalEnvelope}, the root — not the tool —
+ * delivers it to the effectful sinks:
+ *
+ *   1. **Cloud sync (best-effort).** Map the envelope → `SignalBatch`
+ *      (`@opensip-cli/core` `buildSignalBatch`, adding repo identity and
+ *      preserving the envelope's `runId`/`createdAt`; dropping `verdict`/`units`
+ *      — the cloud wire shape stays `schemaVersion: 1`) and emit it through the
+ *      run's `scope.signalSink`. The sink is a no-op for the keyless / not-
+ *      entitled majority. NEVER throws, NEVER affects the exit code (ADR-0008).
+ *      Ships the envelope's signals as-is — **no SARIF detour** on this path.
+ *
+ *   2. **`--report-to` (owns exit code 4).** When `reportTo` is set, format the
+ *      envelope to SARIF via the single shared `formatSignalSarif` formatter and
+ *      POST it through the shared chunked transport (`postChunked`). An upload
+ *      failure exits `EXIT_CODES.REPORT_FAILED` (4) — but only when the run
+ *      otherwise passed; a real check/gate failure (`runFailed`) dominates and
+ *      is never masked by a reporting failure (ADR-0008).
+ *
+ * This is the seam that keeps tool engines free of `@opensip-cli/output`:
+ * engines return envelopes, and the composition root owns formatting,
+ * delivery, and report-upload exit-code policy.
+ */
+import type { SignalEnvelope } from '@opensip-cli/contracts';
+import type { Logger, RepoIdentity, SignalBatch, SignalDeliveryResult } from '@opensip-cli/core';
+/** Options the root supplies when delivering a tool's envelope. */
+export interface DeliverEnvelopeOptions {
+    /** Project / repo working directory — the repo-identity probe root. */
+    readonly cwd: string;
+    /** `--report-to <url>` target, when requested. */
+    readonly reportTo?: string;
+    /** Cloud API key for `--report-to` (read off the same flag as cloud sync). */
+    readonly apiKey?: string;
+    /**
+     * Optional override for the findings-failure decision (ADR-0035). Normal runs
+     * OMIT this — the host derives the findings exit from `envelope.verdict.passed`
+     * (the single verdict). The gate-COMPARE modes pass their baseline-diff
+     * predicate (`degraded`): "net-new findings since baseline" is NOT expressible
+     * over the run's own verdict, so the host honours the override for that mode.
+     */
+    readonly runFailed?: boolean;
+    /** Exit-code setter (the CLI's single write path). */
+    readonly setExitCode?: (code: number) => void;
+    /** Pre-resolved repo identity; resolved from `cwd` when omitted. */
+    readonly repo?: RepoIdentity;
+    readonly logger?: Logger;
+    /** Injectable `fetch` for the `--report-to` upload (tests). */
+    readonly fetchImpl?: typeof fetch;
+}
+/**
+ * Outcome of an envelope delivery. The canonical shape is core's
+ * {@link SignalDeliveryResult} (the `ToolCliContext.deliverSignals` return);
+ * this alias keeps the historical local name for existing imports.
+ */
+export type DeliverEnvelopeResult = SignalDeliveryResult;
+/**
+ * Map a {@link SignalEnvelope} to the cloud {@link SignalBatch} wire shape:
+ * add repo identity, preserve the run identity, drop `verdict`/`units`.
+ */
+export declare function envelopeToSignalBatch(envelope: SignalEnvelope, repo: RepoIdentity): SignalBatch;
+/**
+ * The root's post-run signal-delivery step. Emits the envelope to the cloud
+ * sink (best-effort) and, when `--report-to` is set, uploads its SARIF
+ * (owning exit code 4). Never throws.
+ */
+export declare function deliverEnvelope(envelope: SignalEnvelope, opts: DeliverEnvelopeOptions): Promise<DeliverEnvelopeResult>;
+/**
+ * Root-owned SARIF-**file** sink (ADR-0011): format the envelope to SARIF via
+ * the single shared `formatSignalSarif` formatter and write the bytes to
+ * `path`, creating parent directories as needed. This is the seam behind
+ * `ToolCliContext.writeSarif` — a tool that exports SARIF to a file (e.g.
+ * `graph sarif-export`) routes through it instead of importing
+ * `@opensip-cli/output` itself. The formatter is pure; this function owns
+ * the effect (fs write).
+ */
+export declare function writeEnvelopeSarif(envelope: SignalEnvelope, path: string): Promise<void>;
+//# sourceMappingURL=deliver-envelope.d.ts.map

package/dist/bootstrap/deliver-envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deliver-envelope.d.ts","sourceRoot":"","sources":["../../src/bootstrap/deliver-envelope.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAcH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAIjG,mEAAmE;AACnE,MAAM,WAAW,sBAAsB;IACrC,uEAAuE;IACvE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,kDAAkD;IAClD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,sDAAsD;IACtD,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9C,oEAAoE;IACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,+DAA+D;IAC/D,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CACnC;AAED;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAAG,oBAAoB,CAAC;AAEzD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,YAAY,GAAG,WAAW,CAS/F;AA0FD;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,qBAAqB,CAAC,CA0EhC;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI9F"}