/** * The `senpi validate` finding model — the shape every check speaks. * * A finding is the unit of feedback. It is consumed by an agent operating in a self-fixing loop, * so it carries four things a bare message does not: WHAT happened, WHY it matters in production, * the FIX to apply, and the raw EVIDENCE behind it. It also carries who can act (`actor`) and what * shape the action takes (`fix_kind`), so a caller can route or filter without parsing prose. * * Field naming is snake_case because a finding is a WIRE shape — it is serialized verbatim into * `--json` output that agents parse. Matches `runtime-api/routes/signals.schema.ts`, which is * snake_case for the same reason. Internal-only types in this module use camelCase as usual. */ /** * The check depth a finding came from. Also the grouping used to enable coverage assertions * layer-by-layer while the feature is being built: a stage whose checks do not exist yet has no * producing tests, so it is excluded from the coverage set until it lands. * * `invocation` precedes the depths proper — it covers "you pointed at the wrong thing", which is * resolved before any recipe is read. */ export type ValidationStage = "invocation" | "static" | "import" | "live" | "proof"; /** * How deep a run goes. Each depth includes the ones before it. * * A subset of {@link ValidationStage}: every depth is a stage a finding can come from, but * `invocation` and `proof` are not depths — the first happens before a depth is chosen, the second * after the run is over. * * The ordering is a dependency, not a preference: a recipe that will not parse cannot produce a * launch configuration, and a module that will not import cannot be executed. */ export type Depth = "static" | "import" | "live"; /** Depths in the order they run, so a caller can expand a requested depth to everything it implies. */ export declare const DEPTH_ORDER: readonly Depth[]; /** Every depth up to and including `depth`. */ export declare function depthsUpTo(depth: Depth): Depth[]; /** Count findings by severity. Defined here so the verdict rule has one place to read from. */ export declare function severityOfFindings(findings: readonly { severity: Severity; }[]): { errors: number; warnings: number; }; /** `error` fails the run; `warning` is reported and only fails under `--strict`. */ export type Severity = "error" | "warning"; /** * Who can actually resolve this. * * Load-bearing for loop control, not documentation: an agent that keeps editing `scan.py` to fix * absent credentials will loop until something else stops it. A finding whose actor is not `agent` * forces the loop to stop rather than retry. */ export type Actor = /** Fixable by changing the strategy package. */ "agent" /** Needs a human decision or a value only the user has. */ | "user" /** Environment, not the package — credentials, dependencies, disk. */ | "ops"; /** * The shape of the remedy. Lets a caller check that a fix is actually actionable, and lets tests * assert the right *kind* of guidance was produced rather than merely that some string exists. */ export type FixKind = /** Change a specific file at a specific place. */ "edit" /** Run a specific command. */ | "command" /** Pick from options enumerated from what is really present. */ | "choice" /** Read the correct value from an authoritative source. */ | "lookup" /** * The failure can be located but not authored — a genuine defect in strategy logic. Held to a * weaker bar than the others: name the failing line exactly, do not pretend to know the fix. */ | "locate-only"; /** Where a finding points. All fields optional — an environment fault has no location. */ export interface FindingLocation { /** Package-relative path, e.g. `scanners/universe.py`. Never absolute. */ file?: string; /** 1-indexed. */ line?: number; /** Dotted path into the recipe, e.g. `strategy.margin_pct` or `scanners.0.entrypoint`. */ yaml_path?: string; } /** * One reported problem. * * `fix` MUST be computed against the actual state of this package, never rendered from a template. * This is not stylistic: a templated next-step instruction once fired at a strategy it did not * apply to, and following it destroyed a live position. If a fix cannot be computed, the code * belongs to `fix_kind: "locate-only"` and should say where the failure is rather than guess. */ export interface Finding { code: string; severity: Severity; stage: ValidationStage; actor: Actor; fix_kind: FixKind; where?: FindingLocation; /** The specific thing that happened, at the specific place. */ what: string; /** The consequence in production — why this is worth acting on. */ why: string; /** The concrete next action, derived from this package's real state. */ fix: string; /** * Raw material for whoever is fixing it: the full error chain, captured output, observed data * shapes. Never summarized away. Bounded with an explicit truncation marker when large — see the * evidence-bounding rule; unbounded capture is a memory fault, silent clipping is a lying one. */ evidence?: Record; } //# sourceMappingURL=types.d.ts.map