0sec-cli 0.15.0 → 0.18.0

package/chunks/chunk-6L26OBWI.js

@@ -0,0 +1,1094 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+import {
+  external_exports
+} from "./chunk-YLMN3N25.js";
+
+// packages/shared/dist/identity.js
+function defaultRoleFor(auth) {
+  return auth ? "user" : "anonymous";
+}
+function resolveIdentities(config) {
+  const raw = config.identities && config.identities.length > 0 ? config.identities : config.auth ? [{ label: "primary", auth: config.auth }] : [];
+  const seen = /* @__PURE__ */ new Map();
+  return raw.map((idn, i) => {
+    let label = (idn.label ?? "").trim() || `identity-${i + 1}`;
+    const prior = seen.get(label);
+    if (prior !== void 0) {
+      const next = prior + 1;
+      seen.set(label, next);
+      label = `${label}-${next}`;
+    } else {
+      seen.set(label, 1);
+    }
+    return {
+      label,
+      role: idn.role ?? defaultRoleFor(idn.auth),
+      auth: idn.auth
+    };
+  });
+}
+function hasMultipleIdentities(identities) {
+  return identities.length >= 2;
+}
+var ROLE_RANK = { anonymous: 0, user: 1, admin: 2 };
+function compareRoles(a, b) {
+  const ra = ROLE_RANK[a ?? "user"] ?? ROLE_RANK.user;
+  const rb = ROLE_RANK[b ?? "user"] ?? ROLE_RANK.user;
+  return ra - rb;
+}
+
+// packages/shared/dist/constants.js
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+function loadVersion() {
+  if (true) {
+    return "0.18.0";
+  }
+  try {
+    const here = dirname(fileURLToPath(import.meta.url));
+    const pkgPath = join(here, "..", "..", "..", "package.json");
+    const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+    return typeof pkg.version === "string" ? pkg.version : "0.0.0-dev";
+  } catch {
+    return "0.0.0-dev";
+  }
+}
+var VERSION = loadVersion();
+var DEFAULT_MODEL = "claude-sonnet-4-20250514";
+var DEFAULT_TIMEOUT_MS = 3e4;
+var DEFAULT_MAX_CONCURRENCY = 5;
+var DEPTH_CONFIG = {
+  quick: { maxTemplates: 5, maxPayloadsPerTemplate: 1, multiTurn: false },
+  default: { maxTemplates: 20, maxPayloadsPerTemplate: 3, multiTurn: false },
+  deep: { maxTemplates: Infinity, maxPayloadsPerTemplate: Infinity, multiTurn: true }
+};
+var SEVERITY_RANK = {
+  info: 0,
+  low: 1,
+  medium: 2,
+  high: 3,
+  critical: 4
+};
+var MAX_SEVERITY_RANK = Math.max(...Object.values(SEVERITY_RANK));
+var SEVERITY_ORDER = Object.fromEntries(Object.keys(SEVERITY_RANK).sort((a, b) => SEVERITY_RANK[b] - SEVERITY_RANK[a]).map((sev) => [sev, MAX_SEVERITY_RANK - SEVERITY_RANK[sev]]));
+var DEFAULT_SEVERITY_FLOOR = "medium";
+function severityRank(severity) {
+  const lower = severity.trim().toLowerCase();
+  const key = lower === "informational" ? "info" : lower;
+  return SEVERITY_RANK[key] ?? -1;
+}
+function meetsSeverityFloor(severity, floor = DEFAULT_SEVERITY_FLOOR) {
+  const floorRank = severityRank(floor);
+  const effectiveFloor = floorRank === -1 ? severityRank(DEFAULT_SEVERITY_FLOOR) : floorRank;
+  return severityRank(severity) >= effectiveFloor;
+}
+
+// packages/shared/dist/pricing.oss.generated.js
+var OSS_PRICING = {
+  "gpt-6-astra": { input: 10, output: 50, cachedInput: 1 },
+  "claude-fable-5-1": { input: 10, output: 50, cachedInput: 0.25 },
+  "claude-opus-5": { input: 5, output: 25, cachedInput: 0.5 },
+  "claude-sonnet-5": { input: 2, output: 10, cachedInput: 0.2 },
+  "gemini-3.8-flash": { input: 0.75, output: 3.75, cachedInput: 0.075 },
+  "gemini-3.7-flash": { input: 0.75, output: 3.75, cachedInput: 0.075 },
+  "gemini-3.6-flash": { input: 0.75, output: 3.75, cachedInput: 0.075 },
+  "gemini-3.5-flash": { input: 1.5, output: 9, cachedInput: 0.15 },
+  "gemini-3.5-flash-lite": { input: 0.3, output: 2.5, cachedInput: 0.03 },
+  "gemini-3.1-flash-lite": { input: 0.25, output: 1.5, cachedInput: 0.025 },
+  "gemini-3.1-pro-preview": { input: 2, output: 12, cachedInput: 0.2 },
+  "gpt-5.4": { input: 2.5, output: 15, cachedInput: 0.25 },
+  "gpt-5.5": { input: 5, output: 30, cachedInput: 0.5 },
+  "gpt-4o": { input: 2.5, output: 10, cachedInput: 1.25 },
+  "gpt-4o-mini": { input: 0.15, output: 0.6, cachedInput: 0.075 },
+  "gpt-4.1": { input: 2, output: 8, cachedInput: 0.5 },
+  "gpt-4.1-mini": { input: 0.4, output: 1.6, cachedInput: 0.1 },
+  "gpt-4.1-nano": { input: 0.1, output: 0.4, cachedInput: 0.025 },
+  "o3": { input: 2, output: 8, cachedInput: 0.5 },
+  "o3-mini": { input: 1.1, output: 4.4, cachedInput: 0.55 },
+  "o4-mini": { input: 1.1, output: 4.4, cachedInput: 0.275 },
+  "gemini-2.5-pro": { input: 1.25, output: 10, cachedInput: 0.125 },
+  "gemini-2.5-flash": { input: 0.3, output: 2.5, cachedInput: 0.03 },
+  "gemini-2.0-flash": { input: 0.1, output: 0.4, cachedInput: 0.025 },
+  "deepseek-chat": { input: 0.28, output: 0.42, cachedInput: 0.028 },
+  "deepseek-reasoner": { input: 0.28, output: 0.42, cachedInput: 0.028 }
+};
+
+// packages/shared/dist/pricing.js
+var PRICING_SNAPSHOT_DATE = "2026-09-11";
+var MANUAL_PRICING = {
+  // Anthropic (versioned; LiteLLM keys use different suffixes → keep manual)
+  "claude-opus-4-7": { input: 5, output: 25, cachedInput: 0.5 },
+  "claude-opus-4-6": { input: 15, output: 75, cachedInput: 1.5 },
+  "claude-sonnet-4-6": { input: 3, output: 15, cachedInput: 0.3 },
+  "claude-haiku-4-5": { input: 0.8, output: 4, cachedInput: 0.08 },
+  // OpenAI codex alias — mirrors gpt-5.5 (OSS feed has only the bare key)
+  "gpt-5.5-codex": { input: 5, output: 30 },
+  // Meta (hosted) — not in the OSS feed
+  "llama-4-maverick": { input: 0.5, output: 0.77 },
+  "llama-4-scout": { input: 0.2, output: 0.35 },
+  // Mistral — not in the OSS feed
+  "mistral-large": { input: 2, output: 6 },
+  "mistral-small": { input: 0.1, output: 0.3 },
+  // DeepSeek V4.1 Flash's stable API id (not yet in LiteLLM).
+  // https://api-docs.deepseek.com/quick_start/pricing — checked 2026-09-11.
+  // Peak rates: off-peak is half price; this table cannot express time tiers.
+  "deepseek-flash": { input: 0.3, output: 1.2, cachedInput: 6e-3 },
+  // Z.AI (open-weight, hosted) — see provos.org "Finding Zero-Days with Any Model" (Apr 2026)
+  // https://docs.z.ai/guides/overview/pricing — checked 2026-09-11.
+  "glm-5.3-flash": { input: 0.15, output: 0.5, cachedInput: 0.03 },
+  "glm-5.3": { input: 1.4, output: 4.4, cachedInput: 0.26 },
+  "glm-5.2": { input: 1.4, output: 4.4, cachedInput: 0.26 },
+  "glm-5.1": { input: 1.4, output: 4.4, cachedInput: 0.26 },
+  "glm-4.5": { input: 0.6, output: 2.2, cachedInput: 0.11 },
+  // Moonshot Kimi K3 (open-weight, hosted) — not in the OSS feed; flat-rate
+  // coding-plan estimates (mirror the GLM manual-row style).
+  "k3": { input: 3, output: 15, cachedInput: 0.3 },
+  "k3[1m]": { input: 3, output: 15, cachedInput: 0.3 },
+  "kimi-for-coding": { input: 3, output: 15, cachedInput: 0.3 },
+  // Alibaba Model Studio Qwen — base PAYG list estimates, not Token Plan
+  // subscription charges. Models.dev's `alibaba` provider (checked 2026-09-11),
+  // not its zero-priced subscription rows: https://models.dev/api.json.
+  // Plus has a higher >256K input tier; this flat table cannot represent it.
+  // Preview ids without published PAYG rates remain unpriced in the picker.
+  // deepseek-v4-flash-0731 (Token Plan credit lane) is NOT pinned here on
+  // purpose: AZURE_DEPLOYMENT_PRICE_ALIASES already resolves it to the
+  // DeepSeek-V4-Flash list rate ($0.19/$0.51), the defensible anchor for a
+  // credit-billed variant whose per-credit rate Alibaba does not publish.
+  "qwen3.8-max": { input: 2, output: 6, cachedInput: 0.25 },
+  "qwen3.8-flash": { input: 0.15, output: 0.47, cachedInput: 0.016 },
+  "qwen3.7-max": { input: 2.5, output: 7.5, cachedInput: 0.5 },
+  "qwen3.7-plus": { input: 0.5, output: 3, cachedInput: 0.05 },
+  "qwen3.6-plus": { input: 0.5, output: 3, cachedInput: 0.05 },
+  "qwen3.6-flash": { input: 0.1875, output: 1.125 },
+  // OpenCode Zen free tier (https://opencode.ai/docs/zen/) — zero-rate gateway
+  // models; actual spend is $0 while the free period lasts.
+  "muse-spark-1.3-contributor-free": { input: 0, output: 0 },
+  "mimo-v2.5-free": { input: 0, output: 0 },
+  "ling-3.0-flash-fin-free": { input: 0, output: 0 },
+  "big-pickle": { input: 0, output: 0 },
+  "nemotron-3-ultra-free": { input: 0, output: 0 },
+  "nemotron-3.5-lightning-free": { input: 0, output: 0 },
+  // xAI Grok (docs.x.ai/developers/pricing, checked 2026-08-22) — SHORT-CONTEXT
+  // rates only. xAI charges a second, higher tier once a request's prompt
+  // crosses 200k tokens (grok-4.6: $4.00/$12.00 vs the $2.00/$6.00 below;
+  // grok-4.3 likewise), and this schema has no way to express a
+  // context-length-dependent rate. Long agent loops DO cross that line — the
+  // native loop only compacts at 150k prompt tokens — so treat Grok spend on
+  // long transcripts as a FLOOR and reconcile against the xAI console.
+  "grok-4.6": { input: 2, output: 6 },
+  "grok-4.5": { input: 2, output: 6 },
+  "grok-4.3": { input: 1.25, output: 2.5 },
+  // GitHub Copilot (device-code OAuth) — the `copilot/` prefix disambiguates
+  // routing/pricing (Copilot serves gpt-*/claude-*/gemini-* families). These are
+  // DISPLAY-ONLY estimates so the model picker can group and show these ids;
+  // Copilot subscription billing is per-seat, not metered per token, so the
+  // estimated spend against a Copilot key is not a real charge. v1 ships the
+  // gpt-* families (claude-*/gemini-* need a one-time model-policy enable —
+  // TODO). Rates mirror the underlying OpenAI list prices.
+  "copilot/gpt-4o": { input: 2.5, output: 10, cachedInput: 1.25 },
+  "copilot/gpt-4o-mini": { input: 0.15, output: 0.6, cachedInput: 0.075 },
+  "copilot/gpt-4.1": { input: 2, output: 8, cachedInput: 0.5 },
+  // Azure Foundry deployment names (verified 2026-07-25) — exact aliases
+  // forwarded by the engine. DeepSeek/gpt-oss rates use the Azure-specific `azure_ai/*` LiteLLM feed
+  // entries (not the cheaper direct-provider rates). Kimi is Microsoft's
+  // published Global Standard price for K2.7 Code. GPT-5.6 SOL, Luna, and
+  // Terra use Microsoft's Global Standard short-context rates; Azure Cost
+  // Management remains authoritative for cache writes and long-context usage,
+  // which this schema cannot represent.
+  "DeepSeek-V4-Pro": { input: 1.74, output: 3.48 },
+  "DeepSeek-V4-Flash": { input: 0.19, output: 0.51 },
+  "Kimi-K2.7-Code": { input: 0.95, output: 4, cachedInput: 0.19 },
+  "gpt-oss-120b": { input: 0.15, output: 0.6 },
+  "gpt-5.6-sol": { input: 5, output: 30, cachedInput: 0.5 },
+  "gpt-5.6-luna": { input: 1, output: 6, cachedInput: 0.1 },
+  "gpt-5.6-terra": { input: 2.5, output: 15, cachedInput: 0.25 },
+  default: { input: 3, output: 15 }
+};
+var MODEL_PRICING = {
+  ...MANUAL_PRICING,
+  ...OSS_PRICING
+};
+var AZURE_DEPLOYMENT_PRICE_ALIASES = /* @__PURE__ */ new Map([
+  ["deepseek-v4-pro", "DeepSeek-V4-Pro"],
+  ["deepseek-v4-flash", "DeepSeek-V4-Flash"],
+  ["kimi-k2.7-code", "Kimi-K2.7-Code"],
+  ["gpt-oss-120b", "gpt-oss-120b"],
+  ["gpt-5.6-sol", "gpt-5.6-sol"],
+  ["gpt-5.6-luna", "gpt-5.6-luna"],
+  ["gpt-5.6-terra", "gpt-5.6-terra"]
+]);
+function azureDeploymentPriceKey(model) {
+  const lower = model.toLowerCase();
+  for (const [alias, canonical] of AZURE_DEPLOYMENT_PRICE_ALIASES) {
+    if (lower === alias || lower.startsWith(`${alias}-`))
+      return canonical;
+  }
+  return null;
+}
+function normalizeModel(model) {
+  const prefixes = [
+    "openai/",
+    "anthropic/",
+    "google/",
+    "deepseek/",
+    "meta/",
+    "mistral/",
+    "z-ai/",
+    "zai/",
+    "kimi/",
+    "moonshot/",
+    "openrouter/",
+    "opencode/"
+  ];
+  for (const prefix of prefixes) {
+    if (model.startsWith(prefix))
+      return model.slice(prefix.length);
+  }
+  return model;
+}
+function getRates(model) {
+  const key = model ? normalizeModel(model) : "";
+  const aliasKey = azureDeploymentPriceKey(key);
+  const rates = MODEL_PRICING[key] ?? (aliasKey ? MODEL_PRICING[aliasKey] : void 0);
+  if (!rates) {
+    if (model)
+      console.warn(`[0sec] Unknown model for cost estimation: ${model}`);
+    return MODEL_PRICING.default;
+  }
+  return rates;
+}
+function estimateCost(usage, model) {
+  const rates = getRates(model);
+  const cachedInputRate = rates.cachedInput ?? rates.input;
+  const cached = usage.cachedInputTokens ?? 0;
+  const uncachedInput = Math.max(0, usage.inputTokens - cached);
+  return uncachedInput / 1e6 * rates.input + cached / 1e6 * cachedInputRate + usage.outputTokens / 1e6 * rates.output;
+}
+function priceRun(usage, model) {
+  return estimateCost(usage, model);
+}
+function modelProvider(model) {
+  if (!model)
+    return "unknown";
+  const lowered = model.toLowerCase();
+  if (lowered.startsWith("openai/"))
+    return "openai";
+  if (lowered.startsWith("anthropic/"))
+    return "anthropic";
+  if (lowered.startsWith("google/"))
+    return "google";
+  if (lowered.startsWith("deepseek/"))
+    return "deepseek";
+  if (lowered.startsWith("meta/"))
+    return "meta";
+  if (lowered.startsWith("mistral/"))
+    return "mistral";
+  if (lowered.startsWith("z-ai/") || lowered.startsWith("zai/"))
+    return "z-ai";
+  if (lowered.startsWith("kimi/") || lowered.startsWith("moonshot/"))
+    return "kimi";
+  if (lowered.startsWith("openrouter/"))
+    return "openrouter";
+  if (lowered.startsWith("opencode/"))
+    return "opencode";
+  if (lowered.startsWith("copilot/"))
+    return "copilot";
+  if (lowered.startsWith("xai/") || lowered.startsWith("x-ai/"))
+    return "xai";
+  const stripped = normalizeModel(model).toLowerCase();
+  if (stripped.startsWith("gpt-") || stripped.startsWith("o3") || stripped.startsWith("o4-"))
+    return "openai";
+  if (stripped.startsWith("claude-"))
+    return "anthropic";
+  if (stripped.startsWith("gemini-"))
+    return "google";
+  if (stripped.startsWith("deepseek-"))
+    return "deepseek";
+  if (stripped.startsWith("llama-"))
+    return "meta";
+  if (stripped.startsWith("mistral-"))
+    return "mistral";
+  if (stripped.startsWith("glm-"))
+    return "z-ai";
+  if (stripped.startsWith("k3") || stripped.startsWith("kimi"))
+    return "kimi";
+  if (stripped.startsWith("qwen"))
+    return "qwen";
+  if (stripped.startsWith("grok"))
+    return "xai";
+  if (/^(muse-spark|mimo|ling|big-pickle|nemotron|minimax)/.test(stripped))
+    return "opencode";
+  return "unknown";
+}
+function splitCost(usage, model) {
+  const rates = getRates(model);
+  const cachedInputRate = rates.cachedInput ?? rates.input;
+  const cached = usage.cachedInputTokens ?? 0;
+  const uncachedInput = Math.max(0, usage.inputTokens - cached);
+  const split = {
+    cost_in: uncachedInput / 1e6 * rates.input,
+    cost_out: usage.outputTokens / 1e6 * rates.output
+  };
+  if (usage.cachedInputTokens !== void 0) {
+    split.cost_cache_read = cached / 1e6 * cachedInputRate;
+  }
+  return split;
+}
+
+// packages/shared/dist/verification.js
+var VerificationStatusSchema = external_exports.enum([
+  "reproduced",
+  "not_reproduced",
+  "error",
+  "skipped"
+]);
+var VerificationModeSchema = external_exports.enum([
+  "deterministic_replay",
+  "agent_assisted"
+]);
+var RunnerKindSchema = external_exports.enum(["local", "docker", "qemu"]);
+var EngineMetadataSchema = external_exports.object({
+  os: external_exports.string(),
+  arch: external_exports.string(),
+  runner: RunnerKindSchema
+});
+var VerificationCommandSchema = external_exports.object({
+  argv: external_exports.array(external_exports.string()).min(1),
+  exit_code: external_exports.number().int().nullable(),
+  stdout_excerpt: external_exports.string().optional(),
+  stderr_excerpt: external_exports.string().optional(),
+  duration_ms: external_exports.number().nonnegative()
+});
+var AssertionKindSchema = external_exports.enum([
+  "file_exists",
+  "http_status",
+  "string_in_output",
+  "exit_code"
+]);
+var VerificationAssertionSchema = external_exports.object({
+  kind: AssertionKindSchema,
+  target: external_exports.string(),
+  expected: external_exports.union([external_exports.string(), external_exports.number(), external_exports.boolean()]),
+  actual: external_exports.union([external_exports.string(), external_exports.number(), external_exports.boolean(), external_exports.null()]),
+  passed: external_exports.boolean()
+});
+var EvidenceArtifactSchema = external_exports.object({
+  kind: external_exports.string().min(1),
+  path: external_exports.string().min(1),
+  sha256: external_exports.string().regex(/^[0-9a-f]{64}$/i, "sha256 must be 64 lowercase hex chars"),
+  bytes: external_exports.number().int().nonnegative().optional()
+});
+var VerificationResultSchema = external_exports.object({
+  status: VerificationStatusSchema,
+  mode: VerificationModeSchema,
+  finding_id: external_exports.string().min(1),
+  engine_version: external_exports.string().min(1),
+  started_at: external_exports.string().min(1),
+  completed_at: external_exports.string().min(1),
+  duration_ms: external_exports.number().nonnegative(),
+  commands: external_exports.array(VerificationCommandSchema),
+  assertions: external_exports.array(VerificationAssertionSchema),
+  evidence_artifacts: external_exports.array(EvidenceArtifactSchema),
+  engine_metadata: EngineMetadataSchema,
+  // Optional, additive fields. Existing producers can leave these undefined.
+  error_reason: external_exports.string().nullable().optional(),
+  summary: external_exports.string().optional(),
+  // #659 / #1278 — evidence provenance surfaced to the cloud verify writeback.
+  //
+  // `evidence_kind` mirrors the cloud contract's VerifyEvidenceKind (0cloud
+  // `@0cloud/cloud-contracts`): a reproduced kind promotes the finding to
+  // in_scope, `source-only` never does. Producers that actually reproduced a
+  // PoC set it; leave it undefined to let the consumer keep its own default
+  // (the cloud maps a `reproduced` replay to `reproduced-poc` on its own, so
+  // an undefined kind never downgrades a genuine replay). We only ever emit a
+  // REPRODUCED kind here — never `source-only` — for exactly that reason.
+  //
+  // `oast_confirmed` is the out-of-band signal: true when a token-matched OAST
+  // (interactsh-style DNS/HTTP) callback proved a blind class (SSRF / OOB-RCE /
+  // OOB-SQLi / blind XSS). Its proof lives OUTSIDE the request/response the
+  // deterministic replay can see, so the cloud promotes it even when the
+  // in-band replay predicates left the status at `not_reproduced` / `skipped`.
+  evidence_kind: external_exports.enum(["reproduced-poc", "source-only", "reproduced-memcorruption-poc"]).optional(),
+  oast_confirmed: external_exports.boolean().optional()
+});
+
+// packages/shared/dist/finding-schemas.js
+var severityEnum = external_exports.enum(["critical", "high", "medium", "low", "info"]);
+var attackCategoryEnum = external_exports.enum([
+  "prompt-injection",
+  "jailbreak",
+  "system-prompt-extraction",
+  "data-exfiltration",
+  "tool-misuse",
+  "output-manipulation",
+  "encoding-bypass",
+  "multi-turn",
+  "prototype-pollution",
+  "path-traversal",
+  "command-injection",
+  "code-injection",
+  "regex-dos",
+  "unsafe-deserialization",
+  "information-disclosure",
+  "ssrf",
+  "sql-injection",
+  "xss",
+  "cors",
+  "security-misconfiguration",
+  "missing-validation",
+  "crypto-misuse",
+  "heap-overflow",
+  "out-of-bounds-read",
+  "out-of-bounds-write",
+  "use-after-free",
+  "stack-buffer-overflow",
+  "null-pointer-deref",
+  "null-deref",
+  "integer-overflow",
+  "integer-truncation",
+  "race-condition",
+  "toctou",
+  "type-confusion",
+  "double-free",
+  "format-string",
+  "uninitialized-memory",
+  "denial-of-service",
+  "known-vulnerable-package",
+  "supply-chain",
+  "other"
+]);
+var findingStatusEnum = external_exports.enum([
+  "discovered",
+  "verified",
+  "confirmed",
+  "scored",
+  "reported",
+  "fixed",
+  "false-positive"
+]);
+var pocStepKindEnum = external_exports.enum([
+  "setup",
+  "auth",
+  "prerequisite",
+  "exploit",
+  "verify"
+]);
+var pocStepActionSchema = external_exports.discriminatedUnion("type", [
+  external_exports.object({
+    type: external_exports.literal("shell"),
+    cmd: external_exports.string(),
+    cwd: external_exports.string().optional()
+  }),
+  external_exports.object({
+    type: external_exports.literal("http"),
+    method: external_exports.string(),
+    url: external_exports.string(),
+    headers: external_exports.record(external_exports.string()).optional(),
+    body: external_exports.string().optional()
+  }),
+  external_exports.object({
+    type: external_exports.literal("docker"),
+    image: external_exports.string(),
+    args: external_exports.array(external_exports.string())
+  }),
+  external_exports.object({
+    type: external_exports.literal("note"),
+    text: external_exports.string()
+  })
+]);
+var pocStepExpectSchema = external_exports.discriminatedUnion("type", [
+  external_exports.object({ type: external_exports.literal("exit-zero") }),
+  external_exports.object({
+    type: external_exports.literal("http-status"),
+    status: external_exports.union([external_exports.number(), external_exports.array(external_exports.number())])
+  }),
+  external_exports.object({ type: external_exports.literal("body-contains"), text: external_exports.string() }),
+  external_exports.object({ type: external_exports.literal("body-matches"), pattern: external_exports.string() }),
+  external_exports.object({ type: external_exports.literal("file-exists"), path: external_exports.string() })
+]);
+var pocStepSchema = external_exports.object({
+  id: external_exports.string(),
+  kind: pocStepKindEnum,
+  summary: external_exports.string(),
+  action: pocStepActionSchema,
+  expect: pocStepExpectSchema.optional()
+});
+var pocStepArraySchema = external_exports.array(pocStepSchema);
+var evidenceSchema = external_exports.object({
+  request: external_exports.string(),
+  response: external_exports.string(),
+  analysis: external_exports.string().optional()
+});
+var findingSchema = external_exports.object({
+  id: external_exports.string().min(1),
+  templateId: external_exports.string(),
+  title: external_exports.string(),
+  description: external_exports.string(),
+  severity: severityEnum,
+  category: attackCategoryEnum,
+  status: findingStatusEnum,
+  evidence: evidenceSchema,
+  fingerprint: external_exports.string().optional(),
+  triageStatus: external_exports.enum(["new", "accepted", "suppressed"]).optional(),
+  triageNote: external_exports.string().optional(),
+  layerVerdicts: external_exports.array(external_exports.unknown()).optional(),
+  workflowStatus: external_exports.string().optional(),
+  workflowAssignee: external_exports.string().nullable().optional(),
+  confidence: external_exports.number().optional(),
+  cvssVector: external_exports.string().optional(),
+  cvssScore: external_exports.number().optional(),
+  remediation: external_exports.unknown().optional(),
+  pocSteps: pocStepArraySchema.optional(),
+  verificationSpec: external_exports.unknown().optional(),
+  timestamp: external_exports.number()
+}).passthrough();
+var nonNegativeIntCounter = external_exports.number().int().nonnegative();
+var reportSummarySchema = external_exports.object({
+  totalAttacks: nonNegativeIntCounter,
+  totalFindings: nonNegativeIntCounter,
+  critical: nonNegativeIntCounter,
+  high: nonNegativeIntCounter,
+  medium: nonNegativeIntCounter,
+  low: nonNegativeIntCounter,
+  info: nonNegativeIntCounter
+}).passthrough();
+function formatZodError(err, label) {
+  const issue = err.issues[0];
+  if (!issue)
+    return `${label} failed validation`;
+  const path = issue.path.length > 0 ? issue.path.join(".") : "<root>";
+  return `${label} failed validation at ${path}: ${issue.message}`;
+}
+
+// packages/shared/dist/workflow.js
+var conditionCmpOpSchema = external_exports.enum(["==", "!=", ">=", "<=", ">", "<", "in"]);
+var conditionLhsSchema = external_exports.enum([
+  // Most-recent journal entry kind: "finding" | "decision" | "error" | etc.
+  "last_entry_kind",
+  // Confidence on the most-recent finding/decision entry (0–1).
+  "confidence",
+  // Total entry count seen so far.
+  "entry_count",
+  // True iff at least one finding has been recorded.
+  "has_finding",
+  // True iff the most-recent entry was an error.
+  "last_error"
+]);
+var conditionRhsSchema = external_exports.union([
+  external_exports.string(),
+  external_exports.number(),
+  external_exports.boolean(),
+  external_exports.array(external_exports.string())
+]);
+var conditionCmpSchema = external_exports.object({
+  kind: external_exports.literal("cmp"),
+  lhs: conditionLhsSchema,
+  op: conditionCmpOpSchema,
+  rhs: conditionRhsSchema
+});
+var conditionExprSchema = external_exports.lazy(() => external_exports.union([
+  conditionCmpSchema,
+  external_exports.object({
+    kind: external_exports.literal("and"),
+    clauses: external_exports.array(conditionExprSchema).min(1)
+  }),
+  external_exports.object({
+    kind: external_exports.literal("or"),
+    clauses: external_exports.array(conditionExprSchema).min(1)
+  })
+]));
+var HALT_STATE = "__end__";
+var transitionTargetSchema = external_exports.string().min(1).regex(/^[A-Za-z_][A-Za-z0-9_-]*$/, "state names must be identifier-shaped");
+var transitionRefSchema = external_exports.object({
+  to: transitionTargetSchema
+});
+var transitionRuleSchema = external_exports.object({
+  when: conditionExprSchema,
+  to: transitionTargetSchema
+});
+var stateDefSchema = external_exports.object({
+  // Named specialist this state invokes. The string is resolved at
+  // orchestrator dispatch time (#249); this schema only validates the
+  // shape, not the existence of the specialist.
+  specialist: external_exports.string().min(1),
+  // Default-happy-path transition. Optional — a state can rely entirely
+  // on `transitions[].when` rules or terminate via `__end__`.
+  on_success: transitionRefSchema.optional(),
+  // Default-error transition. When omitted, the orchestrator surfaces
+  // the error per its own policy (today: halt with status `failed`).
+  on_failure: transitionRefSchema.optional(),
+  // Ordered rule list. Evaluated top-to-bottom by the orchestrator; the
+  // first rule whose `when` matches wins. Falls through to on_success /
+  // on_failure when no rule matches.
+  transitions: external_exports.array(transitionRuleSchema).optional()
+});
+var specialistRefSchema = external_exports.object({
+  ref: external_exports.string().min(1),
+  description: external_exports.string().optional()
+});
+var workflowDefinitionSchema = external_exports.object({
+  name: external_exports.string().min(1).regex(/^[A-Za-z][A-Za-z0-9_-]*$/, "workflow name must be identifier-shaped"),
+  version: external_exports.number().int().positive(),
+  description: external_exports.string().min(1),
+  initial_state: transitionTargetSchema,
+  states: external_exports.record(external_exports.string(), stateDefSchema).refine((v) => Object.keys(v).length > 0, {
+    message: "workflow must declare at least one state"
+  }),
+  specialists: external_exports.record(external_exports.string(), specialistRefSchema).optional()
+}).superRefine((wf, ctx) => {
+  const stateNames = new Set(Object.keys(wf.states));
+  const targetOk = (t) => t === HALT_STATE || stateNames.has(t);
+  if (!targetOk(wf.initial_state)) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["initial_state"],
+      message: `initial_state '${wf.initial_state}' is not declared in states`
+    });
+  }
+  for (const [stateName, state] of Object.entries(wf.states)) {
+    if (state.on_success && !targetOk(state.on_success.to)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["states", stateName, "on_success", "to"],
+        message: `on_success.to '${state.on_success.to}' references an unknown state`
+      });
+    }
+    if (state.on_failure && !targetOk(state.on_failure.to)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["states", stateName, "on_failure", "to"],
+        message: `on_failure.to '${state.on_failure.to}' references an unknown state`
+      });
+    }
+    state.transitions?.forEach((rule, idx) => {
+      if (!targetOk(rule.to)) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["states", stateName, "transitions", idx, "to"],
+          message: `transitions[${idx}].to '${rule.to}' references an unknown state`
+        });
+      }
+    });
+  }
+});
+
+// packages/shared/dist/research-evidence.js
+var GRADE_ORDER = {
+  candidate: 0,
+  reachable: 1,
+  observed: 2,
+  reproduced: 3,
+  "impact-proven": 4
+};
+function researchGradeAtLeast(actual, required) {
+  return GRADE_ORDER[actual] >= GRADE_ORDER[required];
+}
+function normalizeResearchNovelty(receipt) {
+  if (receipt.state === "novel" && (!receipt.sources?.length || (receipt.scanned ?? 0) <= 0)) {
+    return { ...receipt, state: "unchecked" };
+  }
+  return receipt;
+}
+function researchDisclosureReady(envelope) {
+  const novelty = normalizeResearchNovelty(envelope.novelty);
+  return researchGradeAtLeast(envelope.grade, "reproduced") && novelty.state === "novel";
+}
+function researchZeroCapProven(envelope) {
+  const context = envelope.executionContext;
+  return (context?.platform === void 0 || context.platform === "linux") && context?.privilege === "zero-cap" && context.basis === "runtime-attested" && researchGradeAtLeast(envelope.grade, "reproduced") && Number.isSafeInteger(context.realUid) && (context.realUid ?? 0) > 0 && Number.isSafeInteger(context.effectiveUid) && (context.effectiveUid ?? 0) > 0 && /^[0]{16}$/.test(context.effectiveCapabilities ?? "") && context.noNewPrivileges === true && Boolean(context.attestationArtifact?.ref) && /^[a-f0-9]{64}$/.test(context.attestationArtifact?.sha256 ?? "");
+}
+function researchLpeDisclosureReady(envelope) {
+  return researchDisclosureReady(envelope) && researchZeroCapProven(envelope);
+}
+var SHA256 = /^[a-f0-9]{64}$/;
+function retainedArtifact(envelope, artifact, expectedKind) {
+  if (typeof artifact !== "object" || artifact === null || typeof artifact.ref !== "string" || !artifact.ref || typeof artifact.sha256 !== "string" || !SHA256.test(artifact.sha256) || !Array.isArray(envelope.artifacts))
+    return false;
+  const candidates = envelope.artifacts.filter((candidate) => typeof candidate === "object" && candidate !== null && typeof candidate.path === "string" && typeof candidate.sha256 === "string" && typeof candidate.kind === "string");
+  const matchingPath = candidates.filter((candidate) => candidate.path === artifact.ref);
+  return matchingPath.length === 1 && matchingPath[0].sha256.toLowerCase() === artifact.sha256 && (expectedKind === void 0 || matchingPath[0].kind === expectedKind) && candidates.filter((candidate) => candidate.sha256.toLowerCase() === artifact.sha256).length === 1;
+}
+var SID = /^S-1-(?:0|[1-9][0-9]*)(?:-(?:0|[1-9][0-9]*)){1,15}$/;
+var TOKEN_ID = /^[A-Za-z0-9_-]{16,128}$/;
+var RUN_NONCE = /^[A-Za-z0-9_-]{32,128}$/;
+var PRIVILEGE = /^Se[A-Za-z0-9]+Privilege$/;
+var DANGEROUS_WINDOWS_PRIVILEGES = /* @__PURE__ */ new Set([
+  "SeDebugPrivilege",
+  "SeImpersonatePrivilege",
+  "SeAssignPrimaryTokenPrivilege",
+  "SeCreateTokenPrivilege",
+  "SeRelabelPrivilege",
+  "SeTcbPrivilege",
+  "SeBackupPrivilege",
+  "SeRestorePrivilege",
+  "SeTakeOwnershipPrivilege",
+  "SeLoadDriverPrivilege"
+]);
+function coherentTokenSnapshot(token) {
+  if (typeof token !== "object" || token === null)
+    return false;
+  const candidate = token;
+  return TOKEN_ID.test(candidate.tokenId) && SID.test(candidate.userSid) && Number.isSafeInteger(candidate.integrityRid) && candidate.integrityRid >= 0 && ["default", "limited", "full"].includes(candidate.elevationType) && typeof candidate.elevated === "boolean" && ["absent", "deny-only", "enabled"].includes(candidate.adminGroup) && typeof candidate.appContainer === "boolean" && Number.isSafeInteger(candidate.restrictedSidCount) && candidate.restrictedSidCount >= 0 && Array.isArray(candidate.enabledPrivileges) && candidate.enabledPrivileges.length <= 128 && candidate.enabledPrivileges.every((privilege) => typeof privilege === "string" && PRIVILEGE.test(privilege)) && new Set(candidate.enabledPrivileges).size === candidate.enabledPrivileges.length;
+}
+function equalTokenSnapshot(left, right) {
+  return left.tokenId === right.tokenId && left.userSid === right.userSid && left.integrityRid === right.integrityRid && left.elevationType === right.elevationType && left.elevated === right.elevated && left.adminGroup === right.adminGroup && left.appContainer === right.appContainer && left.restrictedSidCount === right.restrictedSidCount && left.enabledPrivileges.length === right.enabledPrivileges.length && left.enabledPrivileges.every((privilege, index) => privilege === right.enabledPrivileges[index]);
+}
+function unprivilegedWindowsToken(token) {
+  return token.integrityRid <= 8448 && !token.elevated && token.elevationType !== "full" && token.adminGroup !== "enabled" && (token.appContainer || token.restrictedSidCount > 0 || token.adminGroup === "absent") && !token.enabledPrivileges.some((privilege) => DANGEROUS_WINDOWS_PRIVILEGES.has(privilege));
+}
+function validWindowsStart(startingContext, token) {
+  if (startingContext === "lpac")
+    return false;
+  if (startingContext === "standard-user") {
+    return !token.appContainer && token.restrictedSidCount === 0;
+  }
+  if (startingContext === "appcontainer")
+    return token.appContainer;
+  return token.appContainer || token.restrictedSidCount > 0;
+}
+function validWindowsFinish(principal, start, finish) {
+  if (finish.appContainer || finish.restrictedSidCount !== 0)
+    return false;
+  if (principal === "local-system") {
+    return finish.userSid === "S-1-5-18" && finish.integrityRid >= 16384 && finish.elevated && finish.elevationType === "default";
+  }
+  return finish.userSid === start.userSid && finish.integrityRid >= 12288 && finish.elevated && finish.elevationType === "full" && finish.adminGroup === "enabled";
+}
+function researchWindowsTokenTransitionProven(envelope) {
+  const context = envelope.executionContext;
+  const transition = context?.windowsTokenTransition;
+  if (context?.platform !== "windows" || context.privilege !== "windows-restricted" || context.basis !== "runtime-attested" || !researchGradeAtLeast(envelope.grade, "reproduced") || typeof transition !== "object" || transition === null || transition.claimEligible !== true || transition.fixture !== false || !envelope.target.kind.startsWith("windows.") || !context.campaignId || transition.campaignId !== context.campaignId || !SHA256.test(context.configDigest ?? "") || envelope.target.configDigest !== context.configDigest || typeof transition.buildLabEx !== "string" || !transition.buildLabEx.trim() || transition.buildLabEx.length > 256 || transition.buildLabEx !== envelope.target.buildId || typeof transition.workerId !== "string" || !transition.workerId.trim() || transition.workerId.length > 256 || !["standard-user", "appcontainer", "lpac", "eligible-sandbox"].includes(transition.startingContext) || !["elevated-user", "local-system"].includes(transition.finishingPrincipal) || !SHA256.test(transition.scopeManifestSha256) || !Number.isSafeInteger(transition.targetTrials) || transition.targetTrials < 2 || !Number.isSafeInteger(transition.cleanControls) || transition.cleanControls < 2 || !Array.isArray(transition.runCaptures) || transition.runCaptures.length < 4 || transition.runCaptures.length > 128 || !coherentTokenSnapshot(transition.startToken) || !coherentTokenSnapshot(transition.finishToken) || transition.startToken.tokenId === transition.finishToken.tokenId || context.attestationArtifact?.ref === transition.receiptArtifact?.ref || context.attestationArtifact?.ref === transition.workerAcceptanceArtifact?.ref || transition.receiptArtifact?.ref === transition.workerAcceptanceArtifact?.ref || !retainedArtifact(envelope, context.attestationArtifact, "windows_token_transition") || !retainedArtifact(envelope, transition.receiptArtifact, "windows_evidence_receipt") || !retainedArtifact(envelope, transition.workerAcceptanceArtifact, "windows_worker_acceptance")) {
+    return false;
+  }
+  const start = transition.startToken;
+  const finish = transition.finishToken;
+  const runNonces = /* @__PURE__ */ new Set();
+  const captureNonces = /* @__PURE__ */ new Set();
+  const tokenIds = /* @__PURE__ */ new Set();
+  const captureDigests = /* @__PURE__ */ new Set();
+  const caseTrials = /* @__PURE__ */ new Set();
+  let targetTrials = 0;
+  let cleanControls = 0;
+  let acceptanceSha = "";
+  let acceptanceNonce = "";
+  let grantNonce = "";
+  for (const rawCapture of transition.runCaptures) {
+    if (typeof rawCapture !== "object" || rawCapture === null)
+      return false;
+    const capture = rawCapture;
+    if (!(capture.case === "target" || capture.case === "control") || !Number.isSafeInteger(capture.trial) || capture.trial < 1 || !RUN_NONCE.test(capture.runNonce) || !RUN_NONCE.test(capture.captureNonce) || !RUN_NONCE.test(capture.workerAcceptanceNonce) || !RUN_NONCE.test(capture.executionGrantNonce) || capture.runNonce === capture.captureNonce || capture.workerAcceptanceNonce === capture.executionGrantNonce || capture.runNonce === capture.workerAcceptanceNonce || capture.runNonce === capture.executionGrantNonce || capture.captureNonce === capture.workerAcceptanceNonce || capture.captureNonce === capture.executionGrantNonce || capture.buildLabEx !== transition.buildLabEx || capture.campaignId !== transition.campaignId || capture.workerId !== transition.workerId || capture.configDigest !== context.configDigest || capture.scopeManifestSha256 !== transition.scopeManifestSha256 || capture.workerAcceptanceSha256 !== transition.workerAcceptanceArtifact.sha256 || !coherentTokenSnapshot(capture.startToken) || !coherentTokenSnapshot(capture.finishToken) || capture.startToken.tokenId === capture.finishToken.tokenId || !retainedArtifact(envelope, capture.captureArtifact, "windows_token_capture") || runNonces.has(capture.runNonce) || runNonces.has(capture.captureNonce) || captureNonces.has(capture.captureNonce) || captureNonces.has(capture.runNonce) || captureDigests.has(capture.captureArtifact.sha256) || caseTrials.has(`${capture.case}:${capture.trial}`) || tokenIds.has(capture.startToken.tokenId) || tokenIds.has(capture.finishToken.tokenId) || !validWindowsStart(transition.startingContext, capture.startToken) || !unprivilegedWindowsToken(capture.startToken)) {
+      return false;
+    }
+    if (acceptanceSha && acceptanceSha !== capture.workerAcceptanceSha256)
+      return false;
+    if (acceptanceNonce && acceptanceNonce !== capture.workerAcceptanceNonce)
+      return false;
+    if (grantNonce && grantNonce !== capture.executionGrantNonce)
+      return false;
+    acceptanceSha = capture.workerAcceptanceSha256;
+    acceptanceNonce = capture.workerAcceptanceNonce;
+    grantNonce = capture.executionGrantNonce;
+    runNonces.add(capture.runNonce);
+    captureNonces.add(capture.captureNonce);
+    captureDigests.add(capture.captureArtifact.sha256);
+    caseTrials.add(`${capture.case}:${capture.trial}`);
+    tokenIds.add(capture.startToken.tokenId);
+    tokenIds.add(capture.finishToken.tokenId);
+    if (capture.case === "target") {
+      if (!validWindowsFinish(transition.finishingPrincipal, capture.startToken, capture.finishToken))
+        return false;
+      targetTrials += 1;
+    } else {
+      if (!validWindowsStart(transition.startingContext, capture.finishToken) || !unprivilegedWindowsToken(capture.finishToken) || capture.finishToken.userSid !== capture.startToken.userSid)
+        return false;
+      cleanControls += 1;
+    }
+  }
+  const targets = transition.runCaptures.filter((capture) => capture.case === "target").sort((left, right) => left.trial - right.trial);
+  const controls = transition.runCaptures.filter((capture) => capture.case === "control").sort((left, right) => left.trial - right.trial);
+  if (!targets.every((capture, index) => capture.trial === index + 1) || !controls.every((capture, index) => capture.trial === index + 1))
+    return false;
+  const firstTarget = targets[0];
+  return targetTrials === transition.targetTrials && cleanControls === transition.cleanControls && targetTrials >= 2 && cleanControls >= 2 && Boolean(firstTarget) && equalTokenSnapshot(start, firstTarget.startToken) && equalTokenSnapshot(finish, firstTarget.finishToken);
+}
+function researchWindowsLpeDisclosureReady(envelope) {
+  const policy = envelope.reportingPolicy;
+  return researchDisclosureReady(envelope) && researchWindowsTokenTransitionProven(envelope) && policy?.automaticDisclosure === false && policy.humanReviewRequired === true && policy.benchmarkCase === false;
+}
+function researchPlatformLpeDisclosureReady(envelope, platform) {
+  if (platform !== envelope.executionContext?.platform)
+    return false;
+  if (platform === "linux")
+    return researchLpeDisclosureReady(envelope);
+  if (platform === "windows")
+    return researchWindowsLpeDisclosureReady(envelope);
+  return false;
+}
+
+// packages/shared/dist/paths.js
+import { homedir } from "node:os";
+import { join as join2 } from "node:path";
+function homeStateDir(home = homedir()) {
+  return join2(home, ".0sec");
+}
+function runStateDir(runId, home) {
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(runId)) {
+    throw new Error(`Invalid 0sec run id ${JSON.stringify(runId)}.`);
+  }
+  return join2(homeStateDir(home), "runs", runId);
+}
+
+// packages/shared/dist/agent-assurance.js
+var AGENT_ACTION_ASSURANCE_SCHEMA_VERSION = "0sec.agent-action-assurance/v1";
+var AgentInjectionVectorSchema = external_exports.enum([
+  "readme",
+  "code-comment",
+  "issue-or-pr",
+  "web-content",
+  "tool-output",
+  "support-doc",
+  "email",
+  "forum-post",
+  "rules-file"
+]);
+var AgentActionScenarioSchema = external_exports.object({
+  id: external_exports.string().min(1),
+  title: external_exports.string().min(1),
+  injection_vector: AgentInjectionVectorSchema,
+  benign_task: external_exports.string().min(1),
+  payload: external_exports.string().min(1),
+  prohibited_action: external_exports.string().min(1)
+}).strict();
+var Sha256Schema = external_exports.string().regex(/^[a-f0-9]{64}$/, "sha256 must be 64 lowercase hex characters");
+var IsoTimestampSchema = external_exports.string().datetime({ offset: true });
+var AgentActionOutcomeSchema = external_exports.enum([
+  "observed",
+  "not_observed",
+  "inconclusive",
+  "error"
+]);
+var AgentActionTargetMetadataSchema = external_exports.object({
+  scope_sha256: Sha256Schema,
+  environment: external_exports.enum(["local", "test", "staging"]),
+  agent_endpoint: external_exports.string().url(),
+  mcp_endpoint: external_exports.string().url(),
+  oracle_endpoint: external_exports.string().url(),
+  target_version: external_exports.string().min(1),
+  policy_version: external_exports.string().min(1),
+  model_version: external_exports.string().min(1),
+  tool_versions: external_exports.record(external_exports.string().min(1)),
+  configuration_sha256: Sha256Schema
+}).strict();
+var AgentActionToolCallSchema = external_exports.object({
+  name: external_exports.string().min(1),
+  args_sha256: Sha256Schema
+}).strict();
+var AgentActionRedactionSchema = external_exports.object({
+  strategy: external_exports.literal("sensitive-text-v1"),
+  redacted_fields: external_exports.array(external_exports.string().min(1)),
+  /** Customer-facing bundles never include unredacted execution bytes. */
+  raw_artifacts: external_exports.literal(false)
+}).strict();
+var AgentActionRetestSchema = external_exports.object({
+  previous_run_id: external_exports.string().uuid(),
+  previous_manifest_sha256: Sha256Schema,
+  configuration_changed: external_exports.boolean()
+}).strict();
+var AgentActionEvidenceManifestSchema = external_exports.object({
+  schema_version: external_exports.literal(AGENT_ACTION_ASSURANCE_SCHEMA_VERSION),
+  run_id: external_exports.string().uuid(),
+  created_at: IsoTimestampSchema,
+  target: AgentActionTargetMetadataSchema,
+  scenario: external_exports.object({
+    id: external_exports.string().min(1),
+    title: external_exports.string().min(1),
+    injection_vector: AgentInjectionVectorSchema,
+    payload_sha256: Sha256Schema,
+    prohibited_action: external_exports.string().min(1)
+  }).strict(),
+  execution: external_exports.object({
+    request_sha256: Sha256Schema,
+    response_sha256: Sha256Schema,
+    transcript_sha256: Sha256Schema,
+    mcp_tools_sha256: Sha256Schema,
+    tool_calls: external_exports.array(AgentActionToolCallSchema)
+  }).strict(),
+  oracle: external_exports.object({
+    name: external_exports.string().min(1),
+    outcome: AgentActionOutcomeSchema,
+    complete: external_exports.boolean(),
+    observation_sha256: Sha256Schema,
+    observed_at: IsoTimestampSchema.optional(),
+    summary: external_exports.string().optional()
+  }).strict(),
+  redaction: AgentActionRedactionSchema,
+  retest: AgentActionRetestSchema.optional(),
+  artifacts: external_exports.array(EvidenceArtifactSchema)
+}).strict().superRefine((manifest, ctx) => {
+  const requiresCompleteOracle = manifest.oracle.outcome === "observed" || manifest.oracle.outcome === "not_observed";
+  if (requiresCompleteOracle && !manifest.oracle.complete) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["oracle", "complete"],
+      message: "observed and not_observed outcomes require a complete action-oracle observation"
+    });
+  }
+  if (manifest.oracle.outcome === "inconclusive" && manifest.oracle.complete) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["oracle", "complete"],
+      message: "an inconclusive outcome cannot claim a complete action-oracle observation"
+    });
+  }
+  for (const [field, endpoint] of Object.entries({
+    agent_endpoint: manifest.target.agent_endpoint,
+    mcp_endpoint: manifest.target.mcp_endpoint,
+    oracle_endpoint: manifest.target.oracle_endpoint
+  })) {
+    const parsed = new URL(endpoint);
+    if (parsed.username || parsed.password) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["target", field],
+        message: "endpoint URLs must not embed credentials"
+      });
+    }
+  }
+  for (const [index, artifact] of manifest.artifacts.entries()) {
+    if (/^(?:\/|[A-Za-z]:[\\/])/.test(artifact.path) || /(?:^|[\\/])\.\.(?:[\\/]|$)/.test(artifact.path)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["artifacts", index, "path"],
+        message: "artifact paths must be relative and must not escape the evidence bundle"
+      });
+    }
+  }
+});
+function parseAgentActionEvidenceManifest(value) {
+  return AgentActionEvidenceManifestSchema.parse(value);
+}
+
+// packages/shared/dist/presentation.js
+var PRESENTATION_PROTOCOL = "0sec.presentation/v1";
+function createTranscriptDocument(entries) {
+  return {
+    protocol: PRESENTATION_PROTOCOL,
+    kind: "document",
+    documentType: "transcript",
+    entries
+  };
+}
+function createPresentationEvent(options) {
+  return {
+    protocol: PRESENTATION_PROTOCOL,
+    kind: "event",
+    source: options.source,
+    sequence: options.sequence,
+    at: options.at,
+    eventType: options.eventType,
+    payload: options.payload,
+    ...options.scanId ? { scanId: options.scanId } : {},
+    ...options.sessionId ? { sessionId: options.sessionId } : {}
+  };
+}
+function createScanReportDocument(report) {
+  return { protocol: PRESENTATION_PROTOCOL, kind: "document", documentType: "scan-report", report };
+}
+function createAuditReportDocument(report) {
+  return { protocol: PRESENTATION_PROTOCOL, kind: "document", documentType: "audit-report", report };
+}
+function createReviewReportDocument(report) {
+  return { protocol: PRESENTATION_PROTOCOL, kind: "document", documentType: "review-report", report };
+}
+function isPresentationEvent(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return false;
+  const candidate = value;
+  return candidate.protocol === PRESENTATION_PROTOCOL && candidate.kind === "event" && typeof candidate.source === "string" && typeof candidate.sequence === "number" && typeof candidate.at === "string" && typeof candidate.eventType === "string" && typeof candidate.payload === "object" && candidate.payload !== null && !Array.isArray(candidate.payload);
+}
+
+// packages/shared/dist/desktop-console.js
+var DESKTOP_CONSOLE_SCHEMA_VERSION = 1;
+var DEFAULT_AUTONOMY_MODE = "yolo";
+var DEFAULT_ALLOW_MODEL_SELF_EXTENSION = true;
+
+export {
+  defaultRoleFor,
+  resolveIdentities,
+  hasMultipleIdentities,
+  compareRoles,
+  VERSION,
+  DEFAULT_MODEL,
+  DEFAULT_TIMEOUT_MS,
+  DEFAULT_MAX_CONCURRENCY,
+  DEPTH_CONFIG,
+  SEVERITY_RANK,
+  SEVERITY_ORDER,
+  DEFAULT_SEVERITY_FLOOR,
+  severityRank,
+  meetsSeverityFloor,
+  PRICING_SNAPSHOT_DATE,
+  MANUAL_PRICING,
+  MODEL_PRICING,
+  getRates,
+  estimateCost,
+  priceRun,
+  modelProvider,
+  splitCost,
+  VerificationStatusSchema,
+  VerificationModeSchema,
+  RunnerKindSchema,
+  EngineMetadataSchema,
+  VerificationCommandSchema,
+  AssertionKindSchema,
+  VerificationAssertionSchema,
+  EvidenceArtifactSchema,
+  VerificationResultSchema,
+  pocStepSchema,
+  pocStepArraySchema,
+  findingSchema,
+  reportSummarySchema,
+  formatZodError,
+  conditionCmpOpSchema,
+  conditionLhsSchema,
+  conditionRhsSchema,
+  conditionCmpSchema,
+  conditionExprSchema,
+  HALT_STATE,
+  transitionTargetSchema,
+  transitionRefSchema,
+  transitionRuleSchema,
+  stateDefSchema,
+  specialistRefSchema,
+  workflowDefinitionSchema,
+  researchGradeAtLeast,
+  normalizeResearchNovelty,
+  researchDisclosureReady,
+  researchZeroCapProven,
+  researchLpeDisclosureReady,
+  researchWindowsTokenTransitionProven,
+  researchWindowsLpeDisclosureReady,
+  researchPlatformLpeDisclosureReady,
+  homeStateDir,
+  runStateDir,
+  AGENT_ACTION_ASSURANCE_SCHEMA_VERSION,
+  AgentInjectionVectorSchema,
+  AgentActionScenarioSchema,
+  AgentActionOutcomeSchema,
+  AgentActionTargetMetadataSchema,
+  AgentActionEvidenceManifestSchema,
+  parseAgentActionEvidenceManifest,
+  PRESENTATION_PROTOCOL,
+  createTranscriptDocument,
+  createPresentationEvent,
+  createScanReportDocument,
+  createAuditReportDocument,
+  createReviewReportDocument,
+  isPresentationEvent,
+  DESKTOP_CONSOLE_SCHEMA_VERSION,
+  DEFAULT_AUTONOMY_MODE,
+  DEFAULT_ALLOW_MODEL_SELF_EXTENSION
+};