opensip-cli 0.1.12 → 0.1.13

package/dist/bootstrap/config-and-capabilities.js

@@ -26,84 +26,10 @@
  * config namespace (see `docs/public/10-concepts/03-modular-monolith.md`); at
  * run time they read the validated namespace off `scope.toolConfig`.
  */
-import { analyzeNamespaceClaims, composeConfigSchema, decorateToolConfigDeclarationsWithGateKeys, hostConfigDeclarations, jsonSchemaObjectToZod, resolveConfig, validateConfigDocument, } from '@opensip-cli/config';
+import { analyzeNamespaceClaims, composeConfigSchema, partitionUnclaimedNamespaces, resolveConfig, validateConfigDocument, } from '@opensip-cli/config';
 import { ConfigurationError, isPlainRecord, logger, readYamlFileOrThrow, resolveToolHooks, registerCapabilityDomainsFromManifest, } from '@opensip-cli/core';
-import { provenanceSourceFor, shouldRunHookInHost } from './tool-provenance.js';
-/**
- * Find the manifest config descriptor for a tool, matching by stable id then by
- * the manifest's human id. Returns `undefined` when no admitted manifest for the
- * tool declares a `config` descriptor.
- */
-function manifestDescriptorFor(tool, manifests) {
-    const manifest = manifests.find((m) => m.stableId !== undefined && m.stableId === tool.metadata.id) ??
-        manifests.find((m) => m.id === tool.metadata.name);
-    return manifest?.config;
-}
-/**
- * Collect the contributed config declarations from the registered tools —
- * provenance-aware (ADR-0054 M4-E Config two-pass).
- *
- *   - **Bundled** (trusted computing base) → fold the tool's runtime Zod
- *     `config` declaration host-side, exactly as before. A bundled tool's
- *     `config` slot is the kernel-side `ToolConfigContribution` carrier,
- *     structurally a `ToolConfigDeclaration` (schema `unknown` at the kernel
- *     boundary, a Zod schema at the config layer), so narrowing it here — the
- *     composition root, which DOES import `@opensip-cli/config` — is sound.
- *   - **External** (installed / project-local / user-global) → NEVER import the
- *     tool's Zod (executable code — the ADR-0054 load-time hole). Instead derive
- *     a COARSE declaration from the tool's serializable manifest descriptor
- *     ({@link ToolConfigManifestDescriptor}); the host validates the namespace's
- *     top-level shape as pure data. An external tool that ships NO descriptor
- *     contributes no declaration — its namespace (if present) passes through the
- *     document catchall (rule-2) and ALL of its validation defers to the worker
- *     deep pass.
- */
-function collectDeclarations(tools, provenance, manifests) {
-    const declarations = [];
-    for (const tool of tools.list()) {
-        if (provenanceSourceFor(tool, provenance) === 'bundled') {
-            const config = resolveToolHooks(tool).config;
-            if (config !== undefined) {
-                declarations.push(config);
-            }
-            continue;
-        }
-        // External: coarse, manifest-descriptor-derived schema only — no Zod import.
-        const descriptor = manifestDescriptorFor(tool, manifests);
-        if (descriptor !== undefined) {
-            declarations.push({
-                namespace: descriptor.namespace,
-                schema: jsonSchemaObjectToZod(descriptor.schema),
-            });
-        }
-        // No descriptor → defer entirely to the worker deep pass (catchall passes
-        // any present namespace block through; do NOT host-import its Zod to "help").
-    }
-    return declarations;
-}
-function addPluginConfigKey(keys, key, kind) {
-    if (key === undefined)
-        return;
-    const existing = keys.get(key);
-    if (existing !== undefined && existing !== kind) {
-        throw new ConfigurationError(`Plugin config key '${key}' is declared with conflicting value kinds (${existing}, ${kind}).`, { code: 'CONFIGURATION_ERROR', namespace: 'plugins' });
-    }
-    keys.set(key, kind);
-}
-function collectPluginConfigKeys(manifests) {
-    const keys = new Map();
-    for (const manifest of manifests) {
-        for (const capability of manifest.capabilities ?? []) {
-            const configKeys = capability.discovery?.configKeys;
-            if (configKeys === undefined)
-                continue;
-            addPluginConfigKey(keys, configKeys.packages, 'packages');
-            addPluginConfigKey(keys, configKeys.autoDiscover, 'autoDiscover');
-            addPluginConfigKey(keys, configKeys.scopes, 'scopes');
-        }
-    }
-    return [...keys.entries()].map(([key, kind]) => ({ key, kind }));
-}
+import { buildConfigDeclarations } from './config-declarations.js';
+import { shouldRunHookInHost } from './tool-provenance.js';
 /**
  * Project the validated document's per-namespace blocks into the `file`
  * precedence source (`namespace -> { key -> value }`). Only the declared
@@ -146,25 +72,18 @@ export function composeAndValidateToolConfig(args) {
     // host-side (trusted), external tools validate from their serializable
     // manifest descriptor (coarse, NO Zod import); the deep Zod pass runs in the
     // worker.
-    const toolDeclarations = decorateToolConfigDeclarationsWithGateKeys(collectDeclarations(tools, provenance, manifests));
+    const { declarations, hasToolNamespaces } = buildConfigDeclarations({
+        tools,
+        manifests,
+        provenance,
+    });
     // A run with no tools that declare config (e.g. a project-agnostic context)
     // carries no toolConfig — tools fall back to their in-tool defaults. The host
     // document-level blocks (cli/dashboard/schemaVersion) only need composing when
     // there is a tool dispatch to validate the document for; the real CLI always
     // registers fit/graph/sim, so they are always composed in practice.
-    if (toolDeclarations.length === 0)
+    if (!hasToolNamespaces)
         return { config: undefined, document: {} };
-    // Compose the host document-level declarations (cli/dashboard/schemaVersion,
-    // and from Phase 1 the targeting blocks) BESIDE the decorated tool
-    // declarations, so the whole document — not just the tool namespaces —
-    // validates STRICT through the one composed schema (ADR-0023, the launch seam).
-    // Gate keys are added only to tool namespaces; host blocks stay strict.
-    const declarations = [
-        ...hostConfigDeclarations({
-            pluginConfigKeys: collectPluginConfigKeys(manifests),
-        }),
-        ...toolDeclarations,
-    ];
     // When a configPath was resolved by the project context (i.e. a real
     // opensip-cli.config.yml or a package.json pointer), read it *strictly*.
     // Malformed YAML or unreadable file must fail before any dispatch (a
@@ -172,11 +91,10 @@ export function composeAndValidateToolConfig(args) {
     // When no configPath, fall back to defaults only (permissive discovery
     // paths elsewhere still use the non-throwing reader).
     const raw = configPath === undefined ? {} : readYamlFileOrThrow(configPath, { loader: 'project-config' });
-    const document = isPlainRecord(raw) ? raw : {};
     const schema = composeConfigSchema(declarations);
     // STRICT gate: a typo in any tool namespace throws ConfigurationError here,
     // before dispatch. The CLI error boundary maps it to CONFIGURATION_ERROR.
-    const validated = validateConfigDocument(schema, document);
+    const validated = validateConfigDocument(schema, raw);
     // ADR-0043: the composer TOLERATES unclaimed top-level namespaces (the
     // uninstalled-tool forward-compat contract) — but never silently. Two cases:
     //   - the namespace equals a LOADED tool's id → that tool declares no
@@ -215,13 +133,13 @@ function reportUnclaimedNamespaces(args) {
     if (report.unclaimed.length === 0)
         return;
     const loadedToolNames = new Set(args.tools.list().map((t) => t.metadata.name ?? t.metadata.id));
-    const toolBugs = report.unclaimed.filter((u) => loadedToolNames.has(u.namespace));
+    const { toolBugs, benign } = partitionUnclaimedNamespaces(report, loadedToolNames);
     if (toolBugs.length > 0) {
         const names = toolBugs.map((u) => `'${u.namespace}'`).join(', ');
         throw new ConfigurationError(`Config declares ${names} but the loaded tool(s) of the same id contribute no Tool.config — ` +
             `the block can never apply. Remove the block or fix the tool's config contribution. (ADR-0043)`, { code: 'CONFIGURATION_ERROR' });
     }
-    for (const u of report.unclaimed) {
+    for (const u of benign) {
         const didYouMean = u.suggestion === undefined ? '' : ` — did you mean '${u.suggestion}:'?`;
         logger.warn({
             evt: 'cli.config.unclaimed_namespace',

package/dist/bootstrap/config-and-capabilities.js.map

@@ -1 +1 @@
-{"version":3,"file":"config-and-capabilities.js","sourceRoot":"","sources":["../../src/bootstrap/config-and-capabilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,0CAA0C,EAC1C,sBAAsB,EACtB,qBAAqB,EACrB,aAAa,EACb,sBAAsB,GAGvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAGL,kBAAkB,EAClB,aAAa,EACb,MAAM,EACN,mBAAmB,EACnB,gBAAgB,EAMhB,qCAAqC,GACtC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhF;;;;GAIG;AACH,SAAS,qBAAqB,CAC5B,IAAU,EACV,SAAwC;IAExC,MAAM,QAAQ,GACZ,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClF,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACrD,OAAO,QAAQ,EAAE,MAAM,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,mBAAmB,CAC1B,KAAmB,EACnB,UAAqC,EACrC,SAAwC;IAExC,MAAM,YAAY,GAA4B,EAAE,CAAC;IACjD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,IAAI,mBAAmB,CAAC,IAAI,EAAE,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;YACxD,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;YAC7C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,YAAY,CAAC,IAAI,CAAC,MAA+B,CAAC,CAAC;YACrD,CAAC;YACD,SAAS;QACX,CAAC;QACD,6EAA6E;QAC7E,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC1D,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,YAAY,CAAC,IAAI,CAAC;gBAChB,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,MAAM,EAAE,qBAAqB,CAAC,UAAU,CAAC,MAAM,CAAC;aACjD,CAAC,CAAC;QACL,CAAC;QACD,0EAA0E;QAC1E,8EAA8E;IAChF,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,kBAAkB,CACzB,IAAqD,EACrD,GAAuB,EACvB,IAAwC;IAExC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO;IAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,GAAG,+CAA+C,QAAQ,KAAK,IAAI,IAAI,EAC7F,EAAE,IAAI,EAAE,qBAAqB,EAAE,SAAS,EAAE,SAAS,EAAE,CACtD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,uBAAuB,CAC9B,SAAwC;IAExC,MAAM,IAAI,GAAG,IAAI,GAAG,EAA8C,CAAC;IACnE,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;YACrD,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC;YACpD,IAAI,UAAU,KAAK,SAAS;gBAAE,SAAS;YACvC,kBAAkB,CAAC,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC1D,kBAAkB,CAAC,IAAI,EAAE,UAAU,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;YAClE,kBAAkB,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CACpB,YAA8C,EAC9C,SAAkB;IAElB,MAAM,IAAI,GAA4C,EAAE,CAAC;IACzD,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,aAAa,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAO5C;IAIC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,GAAG,EAAE,EAAE,UAAU,GAAG,EAAE,EAAE,oBAAoB,EAAE,GAAG,IAAI,CAAC;IAC/F,wEAAwE;IACxE,uEAAuE;IACvE,6EAA6E;IAC7E,UAAU;IACV,MAAM,gBAAgB,GAAG,0CAA0C,CACjE,mBAAmB,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,CAAC,CAClD,CAAC;IACF,4EAA4E;IAC5E,8EAA8E;IAC9E,+EAA+E;IAC/E,6EAA6E;IAC7E,oEAAoE;IACpE,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAE9E,6EAA6E;IAC7E,mEAAmE;IACnE,uEAAuE;IACvE,gFAAgF;IAChF,wEAAwE;IACxE,MAAM,YAAY,GAAqC;QACrD,GAAG,sBAAsB,CAAC;YACxB,gBAAgB,EAAE,uBAAuB,CAAC,SAAS,CAAC;SACrD,CAAC;QACF,GAAG,gBAAgB;KACpB,CAAC;IAEF,qEAAqE;IACrE,yEAAyE;IACzE,qEAAqE;IACrE,kEAAkE;IAClE,uEAAuE;IACvE,sDAAsD;IACtD,MAAM,GAAG,GACP,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAChG,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAE/C,MAAM,MAAM,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAC;IACjD,4EAA4E;IAC5E,0EAA0E;IAC1E,MAAM,SAAS,GAAG,sBAAsB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAE3D,uEAAuE;IACvE,6EAA6E;IAC7E,sEAAsE;IACtE,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,yBAAyB,CAAC;QACxB,YAAY;QACZ,QAAQ,EAAE,SAAS;QACnB,KAAK;QACL,oBAAoB;KACrB,CAAC,CAAC;IAEH,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,2EAA2E;IAC3E,sEAAsE;IACtE,OAAO;QACL,MAAM,EAAE,aAAa,CAAC;YACpB,YAAY;YACZ,IAAI,EAAE,aAAa,CAAC,YAAY,EAAE,SAAS,CAAC;YAC5C,GAAG;SACJ,CAAC;QACF,QAAQ,EAAE,SAAS;KACpB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,yBAAyB,CAAC,IAKlC;IACC,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxE,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAE1C,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAChG,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAClF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,IAAI,kBAAkB,CAC1B,mBAAmB,KAAK,qEAAqE;YAC3F,+FAA+F,EACjG,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAChC,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACjC,MAAM,UAAU,GAAG,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,UAAU,KAAK,CAAC;QAC3F,MAAM,CAAC,IAAI,CAAC;YACV,GAAG,EAAE,gCAAgC;YACrC,MAAM,EAAE,eAAe;YACvB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,UAAU,EAAE,CAAC,CAAC,UAAU;SACzB,CAAC,CAAC;QACH,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC;YAChC,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,oCAAoC;YAC1C,QAAQ,EAAE,eAAe;YACzB,OAAO,EACL,qBAAqB,CAAC,CAAC,SAAS,uCAAuC,UAAU,GAAG;gBACpF,0DAA0D;YAC5D,MAAM,EAAE,8CAA8C;SACvD,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAKtC;IACC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC;IAE7D,yEAAyE;IACzE,2DAA2D;IAC3D,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,qCAAqC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC5D,CAAC;IAED,8EAA8E;IAC9E,8EAA8E;IAC9E,4EAA4E;IAC5E,+EAA+E;IAC/E,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,UAAU,CAAC;YAAE,SAAS;QACrD,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAAC;QAC/D,IAAI,UAAU,KAAK,SAAS;YAAE,SAAS;QACvC,KAAK,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/D,IAAI,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjC,QAAQ,CAAC,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"config-and-capabilities.js","sourceRoot":"","sources":["../../src/bootstrap/config-and-capabilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,4BAA4B,EAC5B,aAAa,EACb,sBAAsB,GAEvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAGL,kBAAkB,EAClB,aAAa,EACb,MAAM,EACN,mBAAmB,EACnB,gBAAgB,EAKhB,qCAAqC,GACtC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D;;;;;GAKG;AACH,SAAS,aAAa,CACpB,YAA8C,EAC9C,SAAkB;IAElB,MAAM,IAAI,GAA4C,EAAE,CAAC;IACzD,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,aAAa,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAO5C;IAIC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,GAAG,EAAE,EAAE,UAAU,GAAG,EAAE,EAAE,oBAAoB,EAAE,GAAG,IAAI,CAAC;IAC/F,wEAAwE;IACxE,uEAAuE;IACvE,6EAA6E;IAC7E,UAAU;IACV,MAAM,EAAE,YAAY,EAAE,iBAAiB,EAAE,GAAG,uBAAuB,CAAC;QAClE,KAAK;QACL,SAAS;QACT,UAAU;KACX,CAAC,CAAC;IACH,4EAA4E;IAC5E,8EAA8E;IAC9E,+EAA+E;IAC/E,6EAA6E;IAC7E,oEAAoE;IACpE,IAAI,CAAC,iBAAiB;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAEnE,qEAAqE;IACrE,yEAAyE;IACzE,qEAAqE;IACrE,kEAAkE;IAClE,uEAAuE;IACvE,sDAAsD;IACtD,MAAM,GAAG,GACP,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAEhG,MAAM,MAAM,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAC;IACjD,4EAA4E;IAC5E,0EAA0E;IAC1E,MAAM,SAAS,GAAG,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAEtD,uEAAuE;IACvE,6EAA6E;IAC7E,sEAAsE;IACtE,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,yBAAyB,CAAC;QACxB,YAAY;QACZ,QAAQ,EAAE,SAAS;QACnB,KAAK;QACL,oBAAoB;KACrB,CAAC,CAAC;IAEH,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,2EAA2E;IAC3E,sEAAsE;IACtE,OAAO;QACL,MAAM,EAAE,aAAa,CAAC;YACpB,YAAY;YACZ,IAAI,EAAE,aAAa,CAAC,YAAY,EAAE,SAAS,CAAC;YAC5C,GAAG;SACJ,CAAC;QACF,QAAQ,EAAE,SAAS;KACpB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,yBAAyB,CAAC,IAKlC;IACC,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxE,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAE1C,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAChG,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,4BAA4B,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACnF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,IAAI,kBAAkB,CAC1B,mBAAmB,KAAK,qEAAqE;YAC3F,+FAA+F,EACjG,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAChC,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,UAAU,KAAK,CAAC;QAC3F,MAAM,CAAC,IAAI,CAAC;YACV,GAAG,EAAE,gCAAgC;YACrC,MAAM,EAAE,eAAe;YACvB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,UAAU,EAAE,CAAC,CAAC,UAAU;SACzB,CAAC,CAAC;QACH,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC;YAChC,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,oCAAoC;YAC1C,QAAQ,EAAE,eAAe;YACzB,OAAO,EACL,qBAAqB,CAAC,CAAC,SAAS,uCAAuC,UAAU,GAAG;gBACpF,0DAA0D;YAC5D,MAAM,EAAE,8CAA8C;SACvD,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAKtC;IACC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC;IAE7D,yEAAyE;IACzE,2DAA2D;IAC3D,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,qCAAqC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC5D,CAAC;IAED,8EAA8E;IAC9E,8EAA8E;IAC9E,4EAA4E;IAC5E,+EAA+E;IAC/E,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,UAAU,CAAC;YAAE,SAAS;QACrD,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAAC;QAC/D,IAAI,UAAU,KAAK,SAAS;YAAE,SAAS;QACvC,KAAK,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/D,IAAI,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjC,QAAQ,CAAC,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/bootstrap/config-declarations.d.ts

@@ -0,0 +1,23 @@
+/**
+ * config-declarations — shared config declaration assembly for the dispatcher
+ * and `opensip config validate|schema` operator commands.
+ *
+ * Extracted from `config-and-capabilities.ts` so schema composition uses the
+ * same declaration set without duplicating provenance/manifest folding logic.
+ */
+import { type ToolConfigDeclaration } from '@opensip-cli/config';
+import { type ToolPluginManifest, type ToolProvenance, type ToolRegistry } from '@opensip-cli/core';
+export interface ConfigDeclarationBundle {
+    readonly declarations: readonly ToolConfigDeclaration[];
+    /** True when at least one registered tool contributed a config namespace. */
+    readonly hasToolNamespaces: boolean;
+}
+/**
+ * Build the ordered declaration array the dispatcher and config commands use.
+ */
+export declare function buildConfigDeclarations(args: {
+    readonly tools: ToolRegistry;
+    readonly manifests?: readonly ToolPluginManifest[];
+    readonly provenance?: readonly ToolProvenance[];
+}): ConfigDeclarationBundle;
+//# sourceMappingURL=config-declarations.d.ts.map

package/dist/bootstrap/config-declarations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-declarations.d.ts","sourceRoot":"","sources":["../../src/bootstrap/config-declarations.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAKL,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAIL,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,YAAY,EAClB,MAAM,mBAAmB,CAAC;AAuE3B,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,YAAY,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACxD,6EAA6E;IAC7E,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;CACrC;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACnD,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;CACjD,GAAG,uBAAuB,CAY1B"}

package/dist/bootstrap/config-declarations.js

@@ -0,0 +1,73 @@
+/**
+ * config-declarations — shared config declaration assembly for the dispatcher
+ * and `opensip config validate|schema` operator commands.
+ *
+ * Extracted from `config-and-capabilities.ts` so schema composition uses the
+ * same declaration set without duplicating provenance/manifest folding logic.
+ */
+import { decorateToolConfigDeclarationsWithGateKeys, hostConfigDeclarations, jsonSchemaObjectToZod, } from '@opensip-cli/config';
+import { ConfigurationError, resolveToolHooks, } from '@opensip-cli/core';
+import { provenanceSourceFor } from './tool-provenance.js';
+function manifestDescriptorFor(tool, manifests) {
+    const manifest = manifests.find((m) => m.stableId !== undefined && m.stableId === tool.metadata.id) ??
+        manifests.find((m) => m.id === tool.metadata.name);
+    return manifest?.config;
+}
+function collectDeclarations(tools, provenance, manifests) {
+    const declarations = [];
+    for (const tool of tools.list()) {
+        if (provenanceSourceFor(tool, provenance) === 'bundled') {
+            const config = resolveToolHooks(tool).config;
+            if (config !== undefined) {
+                declarations.push(config);
+            }
+            continue;
+        }
+        const descriptor = manifestDescriptorFor(tool, manifests);
+        if (descriptor !== undefined) {
+            declarations.push({
+                namespace: descriptor.namespace,
+                schema: jsonSchemaObjectToZod(descriptor.schema),
+            });
+        }
+    }
+    return declarations;
+}
+function addPluginConfigKey(keys, key, kind) {
+    if (key === undefined)
+        return;
+    const existing = keys.get(key);
+    if (existing !== undefined && existing !== kind) {
+        throw new ConfigurationError(`Plugin config key '${key}' is declared with conflicting value kinds (${existing}, ${kind}).`, { code: 'CONFIGURATION_ERROR', namespace: 'plugins' });
+    }
+    keys.set(key, kind);
+}
+function collectPluginConfigKeys(manifests) {
+    const keys = new Map();
+    for (const manifest of manifests) {
+        for (const capability of manifest.capabilities ?? []) {
+            const configKeys = capability.discovery?.configKeys;
+            if (configKeys === undefined)
+                continue;
+            addPluginConfigKey(keys, configKeys.packages, 'packages');
+            addPluginConfigKey(keys, configKeys.autoDiscover, 'autoDiscover');
+            addPluginConfigKey(keys, configKeys.scopes, 'scopes');
+        }
+    }
+    return [...keys.entries()].map(([key, kind]) => ({ key, kind }));
+}
+/**
+ * Build the ordered declaration array the dispatcher and config commands use.
+ */
+export function buildConfigDeclarations(args) {
+    const { tools, manifests = [], provenance = [] } = args;
+    const toolDeclarations = decorateToolConfigDeclarationsWithGateKeys(collectDeclarations(tools, provenance, manifests));
+    const declarations = [
+        ...hostConfigDeclarations({
+            pluginConfigKeys: collectPluginConfigKeys(manifests),
+        }),
+        ...toolDeclarations,
+    ];
+    return { declarations, hasToolNamespaces: toolDeclarations.length > 0 };
+}
+//# sourceMappingURL=config-declarations.js.map

package/dist/bootstrap/config-declarations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-declarations.js","sourceRoot":"","sources":["../../src/bootstrap/config-declarations.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,0CAA0C,EAC1C,sBAAsB,EACtB,qBAAqB,GAGtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,kBAAkB,EAClB,gBAAgB,GAKjB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D,SAAS,qBAAqB,CAC5B,IAAU,EACV,SAAwC;IAExC,MAAM,QAAQ,GACZ,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClF,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACrD,OAAO,QAAQ,EAAE,MAAM,CAAC;AAC1B,CAAC;AAED,SAAS,mBAAmB,CAC1B,KAAmB,EACnB,UAAqC,EACrC,SAAwC;IAExC,MAAM,YAAY,GAA4B,EAAE,CAAC;IACjD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,IAAI,mBAAmB,CAAC,IAAI,EAAE,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;YACxD,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;YAC7C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,YAAY,CAAC,IAAI,CAAC,MAA+B,CAAC,CAAC;YACrD,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC1D,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,YAAY,CAAC,IAAI,CAAC;gBAChB,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,MAAM,EAAE,qBAAqB,CAAC,UAAU,CAAC,MAAM,CAAC;aACjD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,kBAAkB,CACzB,IAAqD,EACrD,GAAuB,EACvB,IAAwC;IAExC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO;IAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,GAAG,+CAA+C,QAAQ,KAAK,IAAI,IAAI,EAC7F,EAAE,IAAI,EAAE,qBAAqB,EAAE,SAAS,EAAE,SAAS,EAAE,CACtD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,uBAAuB,CAC9B,SAAwC;IAExC,MAAM,IAAI,GAAG,IAAI,GAAG,EAA8C,CAAC;IACnE,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;YACrD,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC;YACpD,IAAI,UAAU,KAAK,SAAS;gBAAE,SAAS;YACvC,kBAAkB,CAAC,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC1D,kBAAkB,CAAC,IAAI,EAAE,UAAU,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;YAClE,kBAAkB,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACnE,CAAC;AAQD;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAIvC;IACC,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,EAAE,EAAE,UAAU,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC;IACxD,MAAM,gBAAgB,GAAG,0CAA0C,CACjE,mBAAmB,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,CAAC,CAClD,CAAC;IACF,MAAM,YAAY,GAAG;QACnB,GAAG,sBAAsB,CAAC;YACxB,gBAAgB,EAAE,uBAAuB,CAAC,SAAS,CAAC;SACrD,CAAC;QACF,GAAG,gBAAgB;KACpB,CAAC;IACF,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;AAC1E,CAAC"}

package/dist/bootstrap/deliver-envelope.d.ts

@@ -24,6 +24,7 @@
  * engines return envelopes, and the composition root owns formatting,
  * delivery, and report-upload exit-code policy.
  */
+import type { ArtifactWriteContext } from './atomic-artifact-write.js';
 import type { SignalEnvelope } from '@opensip-cli/contracts';
 import type { Logger, RepoIdentity, SignalBatch, SignalDeliveryResult } from '@opensip-cli/core';
 /** Options the root supplies when delivering a tool's envelope. */
@@ -83,5 +84,7 @@ export declare function deliverEnvelope(envelope: SignalEnvelope, opts: DeliverE
  * `@opensip-cli/output` itself. The formatter is pure; this function owns
  * the effect (fs write).
  */
-export declare function writeEnvelopeSarif(envelope: SignalEnvelope, path: string): Promise<void>;
+export declare function writeEnvelopeSarif(envelope: SignalEnvelope, path: string, artifactCtx?: Partial<ArtifactWriteContext> & {
+    readonly logger?: ArtifactWriteContext['logger'];
+}): Promise<void>;
 //# sourceMappingURL=deliver-envelope.d.ts.map

package/dist/bootstrap/deliver-envelope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deliver-envelope.d.ts","sourceRoot":"","sources":["../../src/bootstrap/deliver-envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAcH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAIjG,mEAAmE;AACnE,MAAM,WAAW,sBAAsB;IACrC,uEAAuE;IACvE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,kDAAkD;IAClD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,sDAAsD;IACtD,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9C,oEAAoE;IACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,+DAA+D;IAC/D,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CACnC;AAED;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAAG,oBAAoB,CAAC;AAEzD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,YAAY,GAAG,WAAW,CAS/F;AAmED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,aAAa,EAAE,OAAO,EACtB,SAAS,EAAE,OAAO,GACjB,MAAM,GAAG,SAAS,CAMpB;AAyBD;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,qBAAqB,CAAC,CA2EhC;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI9F"}
+{"version":3,"file":"deliver-envelope.d.ts","sourceRoot":"","sources":["../../src/bootstrap/deliver-envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAcH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAIjG,mEAAmE;AACnE,MAAM,WAAW,sBAAsB;IACrC,uEAAuE;IACvE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,kDAAkD;IAClD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,sDAAsD;IACtD,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9C,oEAAoE;IACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,+DAA+D;IAC/D,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CACnC;AAED;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAAG,oBAAoB,CAAC;AAEzD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,YAAY,GAAG,WAAW,CAS/F;AAmED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,aAAa,EAAE,OAAO,EACtB,SAAS,EAAE,OAAO,GACjB,MAAM,GAAG,SAAS,CAMpB;AAyBD;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,qBAAqB,CAAC,CA2EhC;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,MAAM,EACZ,WAAW,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG;IAC5C,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC;CAClD,GACA,OAAO,CAAC,IAAI,CAAC,CAWf"}

package/dist/bootstrap/deliver-envelope.js

@@ -24,11 +24,11 @@
  * engines return envelopes, and the composition root owns formatting,
  * delivery, and report-upload exit-code policy.
  */
-import { mkdir, writeFile } from 'node:fs/promises';
-import { dirname } from 'node:path';
 import { EXIT_CODES } from '@opensip-cli/contracts';
 import { buildSignalBatch, currentScope, logger as defaultLogger } from '@opensip-cli/core';
 import { formatSignalSarif, postChunked, resolveRepoIdentity, } from '@opensip-cli/output';
+import { writeArtifactAtomically } from './atomic-artifact-write.js';
+import { resolveStateLockPolicy } from './state-lock-policy.js';
 const MODULE_TAG = 'cli:bootstrap';
 /**
  * Map a {@link SignalEnvelope} to the cloud {@link SignalBatch} wire shape:
@@ -201,9 +201,16 @@ export async function deliverEnvelope(envelope, opts) {
  * `@opensip-cli/output` itself. The formatter is pure; this function owns
  * the effect (fs write).
  */
-export async function writeEnvelopeSarif(envelope, path) {
+export function writeEnvelopeSarif(envelope, path, artifactCtx) {
     const sarif = formatSignalSarif(envelope);
-    await mkdir(dirname(path), { recursive: true });
-    await writeFile(path, sarif);
+    const ctx = {
+        policy: artifactCtx?.policy ?? resolveStateLockPolicy(),
+        logger: artifactCtx?.logger ?? defaultLogger,
+        runId: artifactCtx?.runId,
+        command: artifactCtx?.command,
+        cwdBasename: artifactCtx?.cwdBasename,
+    };
+    writeArtifactAtomically(path, sarif, ctx);
+    return Promise.resolve();
 }
 //# sourceMappingURL=deliver-envelope.js.map

package/dist/bootstrap/deliver-envelope.js.map

@@ -1 +1 @@
-{"version":3,"file":"deliver-envelope.js","sourceRoot":"","sources":["../../src/bootstrap/deliver-envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC5F,OAAO,EACL,iBAAiB,EACjB,WAAW,EACX,mBAAmB,GAEpB,MAAM,qBAAqB,CAAC;AAK7B,MAAM,UAAU,GAAG,eAAe,CAAC;AAkCnC;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAwB,EAAE,IAAkB;IAChF,OAAO,gBAAgB,CAAC;QACtB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,IAAI;QACJ,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,SAAS,EAAE,QAAQ,CAAC,SAAS;KAC9B,CAAC,CAAC;AACL,CAAC;AAQD;;;;;;;;;GASG;AACH,KAAK,UAAU,WAAW,CACxB,QAAwB,EACxB,IAAkB,EAClB,GAAW;IAEX,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;QAC7B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,IAAI,CAAC;gBACP,GAAG,EAAE,sBAAsB;gBAC3B,MAAM,EAAE,UAAU;aACnB,CAAC,CAAC;YACH,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;QACjD,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC;QAC9B,uEAAuE;QACvE,kEAAkE;QAClE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,qBAAqB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,MAAM,CAAC,QAAQ,IAAI,IAAI,qBAAqB,CAAC,CAAC;YAC7E,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QACvC,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACvD,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,OAAO,CAAC;QACtD,kEAAkE;QAClE,6EAA6E;QAC7E,0EAA0E;QAC1E,+EAA+E;QAC/E,IAAI,aAAa,KAAK,OAAO,EAAE,CAAC;YAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,qEAAqE;gBACnE,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,gCAAgC;gBACvD,gEAAgE,CACnE,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,IAAI,CAAC;YACP,GAAG,EAAE,yBAAyB;YAC9B,MAAM,EAAE,UAAU;YAClB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;IACjD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAA4B,EAC5B,aAAsB,EACtB,SAAkB;IAElB,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACtE,IAAI,CAAC,aAAa,IAAI,CAAC,SAAS,EAAE,CAAC;QACjC,OAAO,UAAU,CAAC,aAAa,CAAC;IAClC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,uFAAuF;AACvF,KAAK,UAAU,WAAW,CACxB,QAAwB,EACxB,GAAW,EACX,MAA0B,EAC1B,SAAmC;IAEnC,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC1C,2EAA2E;IAC3E,wDAAwD;IACxD,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,QAAQ,CAAC;IAC7D,OAAO,WAAW,CAAC;QACjB,GAAG,EAAE,MAAM;QACX,MAAM;QACN,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAC;QACtC,iBAAiB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,KAAK,WAAW,CAAC,EAAE;QACzD,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC;QAC3E,MAAM,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,iBAAiB,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE;QAC7E,SAAS,EAAE,YAAY;QACvB,SAAS;KACV,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAwB,EACxB,IAA4B;IAE5B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAExD,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,IAAI,CAAC;YACP,GAAG,EAAE,sBAAsB;YAC3B,MAAM,EAAE,UAAU;SACnB,CAAC,CAAC;IACL,CAAC;IAED,iFAAiF;IACjF,8EAA8E;IAC9E,mFAAmF;IACnF,KAAK,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,qBAAqB,QAAQ,CAAC,IAAI,EAAE,EAAE;QACtF,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM;QACpC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ;KAC1B,CAAC,CAAC;IAEH,gFAAgF;IAChF,gFAAgF;IAChF,gFAAgF;IAChF,gFAAgF;IAChF,8EAA8E;IAC9E,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7D,IAAI,SAAS;QAAE,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IAE5D,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACrD,MAAM,aAAa,GAAG,KAAK,CAAC,QAAQ,CAAC;IACrC,MAAM,QAAQ,GAAG;QACf,aAAa;QACb,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;KAC1F,CAAC;IAEF,MAAM,WAAW,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,KAAK,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACnF,KAAK,KAAK,EAAE,WAAW,CAAC,KAAK,CAC3B,SAAS,EACT,OAAO,EACP,0BAA0B,aAAa,GAAG,WAAW,EAAE,CACxD,CAAC;IAEF,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACvF,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;IAC9C,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,gCAAgC,IAAI,CAAC,QAAQ,KAAK;YAChD,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,IAAI,CAC/E,CAAC;IACJ,CAAC;IACD,4EAA4E;IAC5E,+EAA+E;IAC/E,yEAAyE;IACzE,MAAM,UAAU,GAAG,wBAAwB,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;IACrF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,KAAK,EAAE,WAAW,CAAC,KAAK,CAC3B,SAAS,EACT,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAC/B,aAAa,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,EACrD;QACE,GAAG,EAAE,IAAI,CAAC,QAAQ;QAClB,OAAO,EAAE,aAAa;KACvB,CACF,CAAC;IAEF,OAAO,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;AAClE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAwB,EAAE,IAAY;IAC7E,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"deliver-envelope.js","sourceRoot":"","sources":["../../src/bootstrap/deliver-envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC5F,OAAO,EACL,iBAAiB,EACjB,WAAW,EACX,mBAAmB,GAEpB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAMhE,MAAM,UAAU,GAAG,eAAe,CAAC;AAkCnC;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAwB,EAAE,IAAkB;IAChF,OAAO,gBAAgB,CAAC;QACtB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,IAAI;QACJ,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,SAAS,EAAE,QAAQ,CAAC,SAAS;KAC9B,CAAC,CAAC;AACL,CAAC;AAQD;;;;;;;;;GASG;AACH,KAAK,UAAU,WAAW,CACxB,QAAwB,EACxB,IAAkB,EAClB,GAAW;IAEX,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;QAC7B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,IAAI,CAAC;gBACP,GAAG,EAAE,sBAAsB;gBAC3B,MAAM,EAAE,UAAU;aACnB,CAAC,CAAC;YACH,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;QACjD,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC;QAC9B,uEAAuE;QACvE,kEAAkE;QAClE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,qBAAqB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,MAAM,CAAC,QAAQ,IAAI,IAAI,qBAAqB,CAAC,CAAC;YAC7E,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QACvC,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACvD,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,OAAO,CAAC;QACtD,kEAAkE;QAClE,6EAA6E;QAC7E,0EAA0E;QAC1E,+EAA+E;QAC/E,IAAI,aAAa,KAAK,OAAO,EAAE,CAAC;YAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,qEAAqE;gBACnE,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,gCAAgC;gBACvD,gEAAgE,CACnE,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,IAAI,CAAC;YACP,GAAG,EAAE,yBAAyB;YAC9B,MAAM,EAAE,UAAU;YAClB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;IACjD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAA4B,EAC5B,aAAsB,EACtB,SAAkB;IAElB,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACtE,IAAI,CAAC,aAAa,IAAI,CAAC,SAAS,EAAE,CAAC;QACjC,OAAO,UAAU,CAAC,aAAa,CAAC;IAClC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,uFAAuF;AACvF,KAAK,UAAU,WAAW,CACxB,QAAwB,EACxB,GAAW,EACX,MAA0B,EAC1B,SAAmC;IAEnC,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC1C,2EAA2E;IAC3E,wDAAwD;IACxD,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,QAAQ,CAAC;IAC7D,OAAO,WAAW,CAAC;QACjB,GAAG,EAAE,MAAM;QACX,MAAM;QACN,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAC;QACtC,iBAAiB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,KAAK,WAAW,CAAC,EAAE;QACzD,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC;QAC3E,MAAM,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,iBAAiB,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE;QAC7E,SAAS,EAAE,YAAY;QACvB,SAAS;KACV,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAwB,EACxB,IAA4B;IAE5B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAExD,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,IAAI,CAAC;YACP,GAAG,EAAE,sBAAsB;YAC3B,MAAM,EAAE,UAAU;SACnB,CAAC,CAAC;IACL,CAAC;IAED,iFAAiF;IACjF,8EAA8E;IAC9E,mFAAmF;IACnF,KAAK,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,qBAAqB,QAAQ,CAAC,IAAI,EAAE,EAAE;QACtF,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM;QACpC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ;KAC1B,CAAC,CAAC;IAEH,gFAAgF;IAChF,gFAAgF;IAChF,gFAAgF;IAChF,gFAAgF;IAChF,8EAA8E;IAC9E,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7D,IAAI,SAAS;QAAE,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IAE5D,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACrD,MAAM,aAAa,GAAG,KAAK,CAAC,QAAQ,CAAC;IACrC,MAAM,QAAQ,GAAG;QACf,aAAa;QACb,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;KAC1F,CAAC;IAEF,MAAM,WAAW,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,KAAK,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACnF,KAAK,KAAK,EAAE,WAAW,CAAC,KAAK,CAC3B,SAAS,EACT,OAAO,EACP,0BAA0B,aAAa,GAAG,WAAW,EAAE,CACxD,CAAC;IAEF,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACvF,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;IAC9C,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,gCAAgC,IAAI,CAAC,QAAQ,KAAK;YAChD,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,IAAI,CAC/E,CAAC;IACJ,CAAC;IACD,4EAA4E;IAC5E,+EAA+E;IAC/E,yEAAyE;IACzE,MAAM,UAAU,GAAG,wBAAwB,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;IACrF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,KAAK,EAAE,WAAW,CAAC,KAAK,CAC3B,SAAS,EACT,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAC/B,aAAa,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,EACrD;QACE,GAAG,EAAE,IAAI,CAAC,QAAQ;QAClB,OAAO,EAAE,aAAa;KACvB,CACF,CAAC;IAEF,OAAO,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;AAClE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAwB,EACxB,IAAY,EACZ,WAEC;IAED,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAyB;QAChC,MAAM,EAAE,WAAW,EAAE,MAAM,IAAI,sBAAsB,EAAE;QACvD,MAAM,EAAE,WAAW,EAAE,MAAM,IAAI,aAAa;QAC5C,KAAK,EAAE,WAAW,EAAE,KAAK;QACzB,OAAO,EAAE,WAAW,EAAE,OAAO;QAC7B,WAAW,EAAE,WAAW,EAAE,WAAW;KACtC,CAAC;IACF,uBAAuB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1C,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;AAC3B,CAAC"}

package/dist/bootstrap/dispatch-fork-core.d.ts

@@ -44,5 +44,5 @@ export declare function runWorkerSpec(args: {
     readonly timeoutMs?: number;
 }): Promise<ToolCommandResult>;
 /** Build a structured supervisor-side dispatch error, logged with its failure class. */
-export declare function dispatchError(spec: ToolCommandWorkerSpec, message: string, failureClass: string): ToolError;
+export declare function dispatchError(spec: ToolCommandWorkerSpec, message: string, failureClass: string, stderrTail?: string): ToolError;
 //# sourceMappingURL=dispatch-fork-core.d.ts.map

package/dist/bootstrap/dispatch-fork-core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dispatch-fork-core.d.ts","sourceRoot":"","sources":["../../src/bootstrap/dispatch-fork-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAOH,OAAO,EAIL,KAAK,SAAS,EACd,KAAK,cAAc,EAEpB,MAAM,mBAAmB,CAAC;AAI3B,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAGnE,OAAO,KAAK,EAGV,iBAAiB,EACjB,qBAAqB,EACtB,MAAM,kCAAkC,CAAC;AAE1C,4EAA4E;AAC5E,eAAO,MAAM,2BAA2B,SAAU,CAAC;AAEnD,+EAA+E;AAC/E,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AAQzD,qFAAqF;AACrF,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,cAAc,GAAG,MAAM,CASpE;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE;IACxC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAoB7B;AA4JD,wFAAwF;AACxF,wBAAgB,aAAa,CAC3B,IAAI,EAAE,qBAAqB,EAC3B,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,GACnB,SAAS,CAoBX"}
+{"version":3,"file":"dispatch-fork-core.d.ts","sourceRoot":"","sources":["../../src/bootstrap/dispatch-fork-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAOH,OAAO,EAOL,KAAK,SAAS,EACd,KAAK,cAAc,EAEpB,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAEnE,OAAO,KAAK,EAGV,iBAAiB,EACjB,qBAAqB,EACtB,MAAM,kCAAkC,CAAC;AAE1C,4EAA4E;AAC5E,eAAO,MAAM,2BAA2B,SAAU,CAAC;AAEnD,+EAA+E;AAC/E,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AAQzD,qFAAqF;AACrF,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,cAAc,GAAG,MAAM,CASpE;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE;IACxC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAoB7B;AAqKD,wFAAwF;AACxF,wBAAgB,aAAa,CAC3B,IAAI,EAAE,qBAAqB,EAC3B,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,UAAU,CAAC,EAAE,MAAM,GAClB,SAAS,CAqBX"}

package/dist/bootstrap/dispatch-fork-core.js

@@ -21,14 +21,13 @@
  * structured parent-side {@link ToolError} — the host never crashes and external
  * runtime NEVER falls back to in-host execution (ADR-0054 trust tier).
  */
-import { fork } from 'node:child_process';
 import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { ConfigurationError, currentScope, SystemError, } from '@opensip-cli/core';
+import { ConfigurationError, currentScope, currentTraceparent, forkAndSettle, getWorkerLimits, SystemError, } from '@opensip-cli/core';
+import { buildExternalWorkerChildEnv } from './build-external-worker-child-env.js';
 import { BOOTSTRAP_MODULE } from './constants.js';
 import { handleHostRpc } from './dispatch-host-rpc-handler.js';
-import { IN_TOOL_WORKER_ENV } from './tool-provenance.js';
 /** Default supervisor wall-clock timeout for one forked worker run (ms). */
 export const DEFAULT_DISPATCH_TIMEOUT_MS = 120_000;
 /** The internal worker subcommand the supervisor forks the CLI binary into. */
@@ -70,81 +69,79 @@ export async function runWorkerSpec(args) {
 function forkAndAwait({ cliScript, specPath, cwd, spec, timeoutMs, ctx, }) {
     return new Promise((resolve, reject) => {
         const runId = currentScope()?.runId;
-        // ADR-0054 M4-F: the child IS the isolation boundary. OPENSIP_CLI_IN_TOOL_WORKER
-        // tells the worker bootstrap to RUN the dispatched external tool's lifecycle
-        // hooks worker-local (the host-skip is disabled there). OPENSIP_RUN_ID stitches
-        // the worker's logs to the parent run. fork() with `env` set REPLACES the child
-        // env, so the parent env is spread in first to preserve PATH/HOME/etc.
-        // @fitness-ignore-next-line env-secret-exposure -- spreading process.env preserves PATH/HOME for the child; only OPENSIP_RUN_ID (no secret) + the OPENSIP_CLI_IN_TOOL_WORKER marker are added; this object is passed to fork, never logged (parity with subprocess-transport's childEnv).
-        const childEnv = { ...process.env, [IN_TOOL_WORKER_ENV]: '1' };
-        if (runId !== undefined && runId.length > 0)
-            childEnv.OPENSIP_RUN_ID = runId;
-        // Fork the CLI binary into the internal worker subcommand. The full bootstrap
-        // (preAction) re-builds the per-run scope in the worker before the worker
-        // handler runs.
-        //
-        // `cwd` is set on the CHILD PROCESS (not only passed as `--cwd`): the CLI
-        // bootstrap anchors TOOL DISCOVERY on `process.cwd()`, while the `--cwd` flag
-        // only steers later PROJECT resolution in the pre-action hook. Pinning the
-        // child cwd to the same project keeps discovery and project resolution
-        // coherent — the worker bootstraps exactly as an in-project invocation would.
-        const child = fork(cliScript, [WORKER_SUBCOMMAND, specPath, '--cwd', cwd], {
+        const traceparent = currentTraceparent();
+        let inFlightRpc = 0;
+        let totalRpc = 0;
+        const handle = forkAndSettle({
+            command: cliScript,
+            argv: [WORKER_SUBCOMMAND, specPath, '--cwd', cwd],
             cwd,
-            stdio: ['ignore', 'ignore', 'inherit', 'ipc'],
-            serialization: 'advanced',
-            env: childEnv,
-        });
-        let settled = false;
-        const done = (apply) => {
-            if (settled)
-                return;
-            settled = true;
-            clearTimeout(timer);
-            apply();
-            child.kill();
-        };
-        const timer = setTimeout(() => {
-            done(() => {
-                child.kill('SIGKILL');
-                reject(dispatchError(spec, `worker timed out after ${String(timeoutMs)}ms`, 'timeout'));
-            });
-        }, timeoutMs);
-        timer.unref?.();
-        // M4-C: serve one host-RPC upcall against the REAL host ctx and reply. A
-        // host-side fault is folded into a structured `{ ok: false }` reply by
-        // handleHostRpc — never an unhandled host crash. If the child has already
-        // settled (raced a result/exit), the reply is dropped (the worker is gone).
+            timeoutMs,
+            enableHeartbeat: true,
+            enableSigintCancellation: true,
+            buildChildEnv: (parentEnv) => buildExternalWorkerChildEnv({ parentEnv, runId, traceparent }),
+            onMessage: (msg) => {
+                const typed = msg;
+                if (typed.kind === 'progress') {
+                    serveRpc(typed.event);
+                }
+                else if (typed.kind === 'result') {
+                    handle.done(() => {
+                        resolve(typed.value);
+                    });
+                }
+                else if (typed.kind === 'error') {
+                    handle.done(() => {
+                        reject(workerErrorToToolError(spec, typed, handle.getStderrTail()));
+                    });
+                }
+            },
+            onLimitFailure: (failureClass, detail) => {
+                reject(dispatchError(spec, detail === undefined
+                    ? `worker failed: ${failureClass}`
+                    : `worker failed: ${failureClass} (${detail})`, failureClass, handle.getStderrTail()));
+            },
+        }, { runId });
         const serveRpc = (request) => {
-            void handleHostRpc(request, ctx).then((reply) => {
-                if (!settled)
-                    sendRpcReply(child, reply, spec);
-            });
-        };
-        child.on('message', (msg) => {
-            if (msg.kind === 'progress') {
-                serveRpc(msg.event);
-            }
-            else if (msg.kind === 'result') {
-                done(() => {
-                    resolve(msg.value);
+            const workerLimits = getWorkerLimits();
+            totalRpc += 1;
+            if (totalRpc > workerLimits.maxTotalRpc) {
+                handle.killTree('SIGKILL');
+                handle.done(() => {
+                    reject(dispatchError(spec, 'host-RPC upcall flood (total cap exceeded)', 'rpc_flood'));
                 });
+                return;
             }
-            else {
-                done(() => {
-                    reject(workerErrorToToolError(spec, msg));
+            if (inFlightRpc >= workerLimits.maxConcurrentRpc) {
+                handle.killTree('SIGKILL');
+                handle.done(() => {
+                    reject(dispatchError(spec, 'host-RPC upcall flood (concurrency cap exceeded)', 'rpc_flood'));
                 });
+                return;
             }
-        });
+            inFlightRpc += 1;
+            void handleHostRpc(request, ctx)
+                .then((reply) => {
+                inFlightRpc -= 1;
+                if (!handle.isSettled())
+                    sendRpcReply(handle.child, reply, spec);
+            })
+                .catch(() => {
+                inFlightRpc -= 1;
+            });
+        };
         /* v8 ignore next 16 -- defensive isolation-safety arm: `child.on('error')` fires only on a node-executable SPAWN failure (ENOENT on the runtime, EACCES), which is only reachable via impractical fault injection — node always exists in a normal run, so a bad worker entry surfaces via `child.on('exit')` (the covered sibling arm) instead. ADR-0054 trust tier: an external tool that cannot fork is a HARD error, NEVER an in-host fallback (that would run untrusted code in the kernel process). A future explicitly-named developer override (OPENSIP_CLI_DANGEROUSLY_RUN_EXTERNAL_IN_HOST) is reserved, not built. */
-        child.on('error', (err) => {
-            done(() => {
+        handle.child.on('error', (err) => {
+            handle.done(() => {
                 reject(dispatchError(spec, `cannot isolate external tool '${spec.toolId}' (worker fork failed: ${err.message}); ` +
                     'refusing to run it in-process', 'spawn'));
             });
         });
-        child.on('exit', (code) => {
-            done(() => {
-                reject(dispatchError(spec, `worker exited (code ${code ?? 'null'}) before producing a result`, 'exit_nonzero'));
+        handle.child.on('exit', (code) => {
+            if (handle.isSettled())
+                return;
+            handle.done(() => {
+                reject(dispatchError(spec, `worker exited (code ${code ?? 'null'}) before producing a result`, 'exit_nonzero', handle.getStderrTail()));
             });
         });
     });
@@ -180,7 +177,7 @@ function specLabel(spec) {
     return spec.commandName ?? spec.hook ?? 'unknown';
 }
 /** Build a structured supervisor-side dispatch error, logged with its failure class. */
-export function dispatchError(spec, message, failureClass) {
+export function dispatchError(spec, message, failureClass, stderrTail) {
     const label = specLabel(spec);
     currentScope()?.logger.error({
         evt: 'cli.tool.dispatch_failed',
@@ -189,20 +186,21 @@ export function dispatchError(spec, message, failureClass) {
         command: label,
         failureClass,
     });
-    // ADR-0054 M4-E single config-error contract: a worker DEEP-pass config failure
-    // (`config-invalid`) maps to the SAME typed error + exit code (ConfigurationError
-    // → CONFIGURATION_ERROR, exit 2) the host COARSE pass throws, so the user sees a
-    // consistent "Invalid configuration …" regardless of which pass caught it.
     if (failureClass === 'config-invalid') {
-        return new ConfigurationError(message, { code: 'CONFIGURATION_ERROR', failureClass });
+        return new ConfigurationError(message, {
+            code: 'CONFIGURATION_ERROR',
+            failureClass,
+            stderrTail,
+        });
     }
     return new SystemError(`external tool '${spec.toolId}' ${label} failed: ${message}`, {
         code: 'SYSTEM.DISPATCH.WORKER_FAILED',
         failureClass,
+        stderrTail,
     });
 }
 /** Convert a worker `error` IPC message into a logged, structured {@link ToolError}. */
-function workerErrorToToolError(spec, msg) {
-    return dispatchError(spec, msg.message, msg.failureClass ?? 'ipc_error');
+function workerErrorToToolError(spec, msg, stderrTail) {
+    return dispatchError(spec, msg.message, msg.failureClass ?? 'ipc_error', stderrTail);
 }
 //# sourceMappingURL=dispatch-fork-core.js.map