0sec-cli 0.18.0 → 0.21.4

package/chunks/{chunk-72CISA2D.js → chunk-WZISK5VC.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 import {
   homeStateDir,
   runStateDir
-} from "./chunk-6L26OBWI.js";
+} from "./chunk-PC6RCKQV.js";
 import {
   __export
-} from "./chunk-IR537GON.js";
+} from "./chunk-VCSFCHAJ.js";
 
 // packages/db/dist/wasm-shim.js
 import { BetterSQLiteSession } from "drizzle-orm/better-sqlite3/session";
@@ -99,7 +99,7 @@ var ShimmedDatabase = class {
    * only uses it as a setter ("journal_mode = WAL", "foreign_keys = ON"), so
    * we just `exec()` the pragma and swallow errors — some PRAGMAs (notably
    * WAL journal mode) are not supported by node-sqlite3-wasm's VFS and error
-   * here, but losing them is acceptable for 0sec's single-process workload.
+   * here, but losing them is acceptable for 0's single-process workload.
    */
   pragma(query, _opts) {
     try {
@@ -112,7 +112,7 @@ var ShimmedDatabase = class {
    * better-sqlite3's `db.transaction(fn)` returns a callable object with
    * `.deferred`, `.immediate`, `.exclusive`, and `.default` methods, each
    * running `fn` inside a BEGIN/COMMIT of the corresponding isolation level.
-   * All three variants are functionally equivalent for 0sec's single-writer
+   * All three variants are functionally equivalent for 0's single-writer
    * workload, so we wire them to the same underlying implementation.
    */
   transaction(fn) {
@@ -357,29 +357,29 @@ var findings = sqliteTable("findings", {
   evidenceResponse: text("evidenceResponse").notNull(),
   evidenceAnalysis: text("evidenceAnalysis"),
   /**
-   * JSON-stringified LayerVerdict[] (see @0sec/shared types). NULL until
+   * JSON-stringified LayerVerdict[] (see @0/shared types). NULL until
    * the triage stage runs. Stored as text rather than a join table because
    * the array is read-and-write together at finding-save time and we never
-   * query individual verdict rows. See 0sec#112.
+   * query individual verdict rows. See 0#112.
    */
   layerVerdicts: text("layerVerdicts"),
   impactAssessment: text("impactAssessment"),
   // JSON: ImpactAssessment (reachability/blast/weaponizability/business)
   /**
-   * JSON-stringified PocStep[] (see @0sec/shared types). NULL when the
+   * JSON-stringified PocStep[] (see @0/shared types). NULL when the
    * agent only produced prose evidence (the legacy default). Stored as
    * text rather than a join table because the array is read-and-write
    * together at finding-save time and we never query individual steps.
-   * See 0sec#170.
+   * See 0#170.
    */
   pocSteps: text("pocSteps"),
   /**
-   * JSON-stringified VerificationSpec (see @0sec/shared types). NULL
+   * JSON-stringified VerificationSpec (see @0/shared types). NULL
    * when the agent produced a finding without a deterministic re-check
    * contract — every reader must continue to work in that case. Stored
    * as text because the spec is an opaque blob that the verifier reads
-   * whole; we never query individual predicates. See 0sec#193 /
-   * 0sec-cloud#111.
+   * whole; we never query individual predicates. See 0#193 /
+   * 0-cloud#111.
    */
   verificationSpec: text("verificationSpec"),
   /**
@@ -395,11 +395,11 @@ var findings = sqliteTable("findings", {
   /**
    * JSON-stringified PocExecutionReport written when `disclose --target-url`
    * runs the step graph against a live target. NULL until that runs. See
-   * 0sec#171.
+   * 0#171.
    */
   pocExecution: text("pocExecution"),
   /**
-   * JSON-stringified VerificationResult (see @0sec/shared
+   * JSON-stringified VerificationResult (see @0/shared
    * `VerificationResultSchema`) — the last deterministic-replay result
    * attached to the finding. NULL when the finding was never verified;
    * readers MUST treat NULL / malformed / statusless payloads as
@@ -609,9 +609,9 @@ var trustGraphEdges = sqliteTable("trust_graph_edges", {
 
 // packages/db/dist/database.js
 var DEFAULT_DB_DIR = homeStateDir();
-var DEFAULT_DB_PATH = join(DEFAULT_DB_DIR, "0sec.db");
+var DEFAULT_DB_PATH = join(DEFAULT_DB_DIR, "0.db");
 function resolveOsecDbPath(dbPath) {
-  const configuredPath = process.env["0SEC_DB_PATH"]?.trim();
+  const configuredPath = process.env["ZERO_DB_PATH"]?.trim();
   return dbPath ?? (configuredPath ? configuredPath : DEFAULT_DB_PATH);
 }
 function resetOsecDatabase(dbPath) {
@@ -725,7 +725,7 @@ function migrateWalHeaderIfNeeded(path) {
     }
   }
   if (hadWalData) {
-    console.warn(`[0sec] Migrated ${path} from WAL mode to rollback mode for WASM engine compatibility. A non-empty WAL sidecar was present and has been removed; any uncommitted transactions from a prior crashed run were discarded.`);
+    console.warn(`[0] Migrated ${path} from WAL mode to rollback mode for WASM engine compatibility. A non-empty WAL sidecar was present and has been removed; any uncommitted transactions from a prior crashed run were discarded.`);
   }
 }
 function clearStaleLockIfAny(path) {
@@ -744,7 +744,7 @@ function clearStaleLockIfAny(path) {
     return;
   try {
     rmSync(lockPath, { recursive: true, force: true });
-    console.warn(`[0sec] Removed stale database lock at ${lockPath} (age ${Math.floor(ageMs / 1e3)}s \u2014 previous holder likely crashed).`);
+    console.warn(`[0] Removed stale database lock at ${lockPath} (age ${Math.floor(ageMs / 1e3)}s \u2014 previous holder likely crashed).`);
   } catch {
   }
 }
@@ -779,7 +779,7 @@ var osecDB = class {
         throw error;
       const backupPath = backupCorruptDatabase(path);
       this.initializeDatabase(path);
-      console.warn(backupPath ? `[0sec] Recovered malformed database at ${path}. Backup saved to ${backupPath}.` : `[0sec] Recovered malformed database state at ${path} by recreating a fresh database.`);
+      console.warn(backupPath ? `[0] Recovered malformed database at ${path}. Backup saved to ${backupPath}.` : `[0] Recovered malformed database state at ${path} by recreating a fresh database.`);
     }
   }
   initializeDatabase(path) {
@@ -787,9 +787,11 @@ var osecDB = class {
     this.sqlite.pragma("foreign_keys = ON");
     ensureDatabaseHealthy(this.sqlite);
     this.db = createDrizzleFromShim(this.sqlite, { schema: schema_exports });
-    this.sqlite.exec(SCHEMA_TABLES_SQL);
-    this.migrate();
-    this.sqlite.exec(SCHEMA_INDEXES_SQL);
+    this.sqlite.transaction(() => {
+      this.sqlite.exec(SCHEMA_TABLES_SQL);
+      this.migrate();
+      this.sqlite.exec(SCHEMA_INDEXES_SQL);
+    })();
   }
   initializeReadOnlyDatabase(path) {
     this.sqlite = createShimmedDatabase(path);
@@ -797,7 +799,7 @@ var osecDB = class {
     this.db = createDrizzleFromShim(this.sqlite, { schema: schema_exports });
   }
   /**
-   * Upgrade databases created by older 0sec versions.
+   * Upgrade databases created by older 0 versions.
    *
    * SCHEMA_TABLES_SQL (above) now contains every table and every column from
    * the drizzle schema, so fresh installs need no patching. This method only
@@ -806,7 +808,7 @@ var osecDB = class {
    * table_info is cached by SQLite) and the ALTERs are no-ops when the
    * column is already present, so running on a fresh DB is harmless.
    *
-   * See: https://github.com/0sec-labs/0sec/issues/420
+   * See: https://github.com/0sec-labs/0/issues/420
    */
   migrate() {
     const cols = this.sqlite.prepare("PRAGMA table_info(findings)").all();
@@ -1949,7 +1951,7 @@ var osecDB = class {
     const result = this.sqlite.prepare(`DELETE FROM workers WHERE status IN (${placeholders})`).run(...values);
     return result.changes;
   }
-  // ── Persistent credential store (0sec#771) ──
+  // ── Persistent credential store (0#771) ──
   /**
    * Upsert a discovered foothold keyed by (credentialKind, valueHash). First
    * write records the discovery attribution (target/finding/scan/turn);
@@ -2019,7 +2021,7 @@ var osecDB = class {
     const limit = query.limit ?? 500;
     return this.sqlite.prepare(`SELECT * FROM persistent_credentials ${whereSql} ORDER BY lastSeenAt DESC LIMIT ${limit}`).all(...params);
   }
-  // ── Trust graph edges (0sec#771) ──
+  // ── Trust graph edges (0#771) ──
   /**
    * Upsert a directed trust edge keyed by
    * (srcKind, srcId, dstKind, dstId, relation). Re-observing an edge refreshes
@@ -2484,24 +2486,24 @@ var STATE_DB_FILE = "state.db";
 var REPORT_FILE = "report.json";
 function normalizeRunId(value) {
   if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(value)) {
-    throw new Error(`Invalid 0sec run id ${JSON.stringify(value)}.`);
+    throw new Error(`Invalid 0 run id ${JSON.stringify(value)}.`);
   }
   return value;
 }
 function resolveOsecRunStorage(options = {}) {
   const env = options.env ?? process.env;
-  const cloudRunId = env["0SEC_CLOUD_SCAN_ID"]?.trim() || void 0;
+  const cloudRunId = env["ZERO_CLOUD_SCAN_ID"]?.trim() || void 0;
   let runId = normalizeRunId(options.runId ?? cloudRunId ?? randomUUID2());
   const stateDir = homeStateDir(options.homeDir);
-  const configuredRunDir = env["0SEC_RUN_DIR"]?.trim() || void 0;
-  const configuredDbPath = options.dbPath ?? (env["0SEC_DB_PATH"]?.trim() || void 0);
+  const configuredRunDir = env["ZERO_RUN_DIR"]?.trim() || void 0;
+  const configuredDbPath = options.dbPath ?? (env["ZERO_DB_PATH"]?.trim() || void 0);
   let runDir = configuredRunDir ? resolve(configuredRunDir) : runStateDir(runId, options.homeDir);
   if (options.resume && !configuredRunDir && !configuredDbPath && !existsSync2(runDir)) {
     const runsDir = join2(stateDir, "runs");
     if (existsSync2(runsDir)) {
       const matches = readdirSync(runsDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && entry.name.startsWith(runId));
       if (matches.length > 1) {
-        throw new Error(`0sec run id prefix '${runId}' is ambiguous.`);
+        throw new Error(`0 run id prefix '${runId}' is ambiguous.`);
       }
       const match = matches[0];
       if (match) {
@@ -2511,13 +2513,13 @@ function resolveOsecRunStorage(options = {}) {
     }
   }
   if (!isAbsolute(runDir)) {
-    throw new Error(`0sec run directory must be absolute: ${JSON.stringify(runDir)}.`);
+    throw new Error(`0 run directory must be absolute: ${JSON.stringify(runDir)}.`);
   }
   let dbPath = configuredDbPath ? configuredDbPath === ":memory:" ? configuredDbPath : resolve(configuredDbPath) : join2(runDir, STATE_DB_FILE);
-  const configuredReportPath = env["0SEC_REPORT_PATH"]?.trim() || void 0;
+  const configuredReportPath = env["ZERO_REPORT_PATH"]?.trim() || void 0;
   const reportPath = configuredReportPath ? resolve(configuredReportPath) : !configuredDbPath || configuredRunDir ? join2(runDir, REPORT_FILE) : void 0;
   if (options.resume && !configuredDbPath && !existsSync2(dbPath)) {
-    const legacyDbPath = join2(stateDir, "0sec.db");
+    const legacyDbPath = join2(stateDir, "0.db");
     if (existsSync2(legacyDbPath))
       dbPath = legacyDbPath;
   }

package/chunks/{chunk-CMKXP5RR.js → chunk-Y5H6E24H.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 import {
   jitterFor
-} from "./chunk-YYRBQVFE.js";
+} from "./chunk-SBMB4OL3.js";
 
 // packages/core/dist/scope/rate-limit.js
 var TokenBucket = class {