@argusaudit/cli 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 the-mzakrzewski
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,64 @@
+# ARGUS CLI
+
+**SQL Stress-Test Auditor.** Your SQL is fast — and we have proof.
+
+ARGUS takes your schema and a query, generates realistic data at scale, benchmarks candidate optimizations against each other on your own machine, and reports which one actually wins — with hard numbers.
+
+ARGUS currently supports **PostgreSQL only**.
+
+## Install
+
+```bash
+npm install -g @argusaudit/cli
+```
+
+## Requirements
+
+- **Node.js >= 24**
+- **Docker** and **Docker Compose >= 2.20** — benchmarks run in local containers. Compose 2.20 is the floor because the CLI drives the stack with `docker compose wait`.
+
+## Usage
+
+```bash
+argus login                                   # authenticate via browser
+argus audit --ddl schema.sql --query slow.sql
+```
+
+The audit prints a link to your report when it finishes.
+
+### `argus audit`
+
+| Flag | Purpose |
+| --- | --- |
+| `--ddl <path>` | Path to your DDL/schema file. **Required.** |
+| `--query <path>` | Path to the query to optimize. **Required.** |
+| `--postgres-version <version>` | Benchmark against a specific Postgres, e.g. `17`, `17.5`, `17-bookworm`. Defaults to `18-alpine`. |
+| `--keep-containers` | Leave containers running after the benchmark instead of tearing them down. Useful for debugging. |
+
+### Other commands
+
+- `argus login` — authenticate via browser; credentials are stored in your OS keychain.
+- `argus logout` — remove stored credentials.
+
+## How it works
+
+1. Your DDL and query are sent to the ARGUS engine, which proposes optimization variants (index / query rewrite / schema change).
+2. The CLI starts an isolated Postgres via Docker Compose and pulls the `argusaudit/worker` image.
+3. The worker seeds data matching realistic distributions, then benchmarks each variant 5x with `ROLLBACK` between runs.
+4. Results are reported back and rendered at [argusaudit.dev](https://www.argusaudit.dev).
+
+**Your data never leaves your machine** — only the DDL and query go to the cloud. Benchmarking happens entirely in local containers.
+
+## Environment variables
+
+All optional — the defaults point at production.
+
+| Variable | Default | Purpose |
+| --- | --- | --- |
+| `ARGUS_API_URL` | `https://api.argusaudit.dev/api/v1` | Engine API base URL. |
+| `ARGUS_HUB_URL` | `https://www.argusaudit.dev` | Web app base URL, used for report links. |
+| `ARGUS_WORKER_IMAGE` | `argusaudit/worker:0.1.0` | Worker image to run. Pinned by default so benchmarks stay reproducible. |
+
+## License
+
+MIT — see [LICENSE](./LICENSE).

package/dist/bin/argus.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/bin/argus.js

@@ -0,0 +1,32 @@
+#!/usr/bin/env node
+import { program } from 'commander';
+import chalk from 'chalk';
+import { fileURLToPath } from 'node:url';
+import { dirname, resolve } from 'node:path';
+import { readFileSync } from 'node:fs';
+import { auditCommand } from '../src/commands/audit.js';
+import { loginCommand } from '../src/commands/login.js';
+import { logoutCommand } from '../src/commands/logout.js';
+process.on('uncaughtException', (error) => {
+    console.log(chalk.red('✖ Unexpected error: Something went wrong. Please try again.'));
+    console.error('[argus internal]', error);
+    process.exit(1);
+});
+process.on('unhandledRejection', (reason) => {
+    console.log(chalk.red('✖ Unexpected error: Something went wrong. Please try again.'));
+    console.error('[argus internal]', reason);
+    process.exit(1);
+});
+const __dirname = dirname(fileURLToPath(import.meta.url));
+// At runtime this file is at dist/bin/argus.js, so ../../package.json resolves to the project root
+const { version } = JSON.parse(readFileSync(resolve(__dirname, '../../package.json'), 'utf8'));
+program
+    .name('argus')
+    .description('ARGUS — SQL Stress-Test Auditor. Your SQL is fast — and we have proof.')
+    .version(version);
+program.addHelpText('after', chalk.dim('\nARGUS currently supports PostgreSQL only.'));
+program.addCommand(auditCommand());
+program.addCommand(loginCommand());
+program.addCommand(logoutCommand());
+program.parse(process.argv);
+//# sourceMappingURL=argus.js.map

package/dist/bin/argus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"argus.js","sourceRoot":"","sources":["../../bin/argus.ts"],"names":[],"mappings":";AACA,OAAO,EAAC,OAAO,EAAC,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAC,aAAa,EAAC,MAAM,UAAU,CAAC;AACvC,OAAO,EAAC,OAAO,EAAE,OAAO,EAAC,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAC,YAAY,EAAC,MAAM,SAAS,CAAC;AACrC,OAAO,EAAC,YAAY,EAAC,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAC,YAAY,EAAC,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAC,aAAa,EAAC,MAAM,2BAA2B,CAAC;AAExD,OAAO,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,KAAK,EAAE,EAAE;IACtC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC,CAAC;IACtF,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;IACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC,CAAC,CAAC;AAEH,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,MAAM,EAAE,EAAE;IACxC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC,CAAC;IACtF,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;IAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,mGAAmG;AACnG,MAAM,EAAC,OAAO,EAAC,GAAG,IAAI,CAAC,KAAK,CACxB,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,oBAAoB,CAAC,EAAE,MAAM,CAAC,CAC1C,CAAC;AAEzB,OAAO;KACF,IAAI,CAAC,OAAO,CAAC;KACb,WAAW,CAAC,wEAAwE,CAAC;KACrF,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtB,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC,CAAC;AAEvF,OAAO,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC;AACnC,OAAO,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC;AACnC,OAAO,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;AAEpC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1 @@
+export { audit, auditCommand } from './src/commands/audit.js';

package/dist/index.js

@@ -0,0 +1,2 @@
+export { audit, auditCommand } from './src/commands/audit.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,KAAK,EAAE,YAAY,EAAC,MAAM,yBAAyB,CAAC"}

package/dist/src/commands/audit.d.ts

@@ -0,0 +1,7 @@
+import { Command } from 'commander';
+import type { AuditCreateRequest } from '../types/audit.js';
+export declare function audit({ ddlPath, queryPath, keepContainers, postgresVersion }: AuditCreateRequest & {
+    keepContainers?: boolean;
+    postgresVersion?: string;
+}): Promise<void>;
+export declare function auditCommand(): Command;

package/dist/src/commands/audit.js

@@ -0,0 +1,179 @@
+import { Command } from 'commander';
+import path from 'node:path';
+import chalk from 'chalk';
+import ora from 'ora';
+import { assertComposeVersion, cleanupWorker, generateCompose, getContainerErrors, runWorker } from '../lib/docker.js';
+import { ApiError, get, post, postMultipart } from '../lib/api.js';
+import { refreshTokens, requireAuth } from '../lib/auth.js';
+import { resolvePostgresImage } from '../lib/registry.js';
+import { getRefreshToken } from '../lib/keychain.js';
+import { getEngineBaseUrl, getHubBaseUrl, getWorkerImage } from '../config.js';
+export async function audit({ ddlPath, queryPath, keepContainers = false, postgresVersion }) {
+    const resolvedDdl = path.resolve(ddlPath);
+    const resolvedQuery = path.resolve(queryPath);
+    const toFileField = (filePath) => ({ filePath, filename: path.basename(filePath) });
+    let activeSpinner;
+    let composePath;
+    let tmpTokenPath;
+    const startSpinner = (text) => {
+        activeSpinner = ora({ text, discardStdin: false }).start();
+        return activeSpinner;
+    };
+    process.on('SIGINT', () => {
+        activeSpinner?.stop();
+        console.log(chalk.yellow('\n✖ Interrupted — stopping containers…'));
+        if (composePath)
+            cleanupWorker({ composePath, tmpTokenPath });
+        process.exit(130);
+    });
+    // Step 0: preflight — ensure Docker Compose is new enough for `docker compose wait`
+    const composeSpinner = startSpinner('Checking Docker Compose version…');
+    try {
+        assertComposeVersion();
+        composeSpinner.succeed('Docker Compose version OK');
+    }
+    catch (err) {
+        composeSpinner.fail(err.message);
+        process.exit(1);
+    }
+    // Step 0: resolve the requested postgres version before anything is created
+    let postgresImage;
+    if (postgresVersion) {
+        const resolveSpinner = startSpinner(`Resolving postgres version ${chalk.cyan(postgresVersion)}…`);
+        try {
+            postgresImage = await resolvePostgresImage(postgresVersion);
+            resolveSpinner.succeed(`Postgres image resolved · ${chalk.cyan(postgresImage)}`);
+        }
+        catch (err) {
+            resolveSpinner.fail(err.message);
+            process.exit(1);
+        }
+    }
+    // Step 1: upload files
+    let spinner = startSpinner('Uploading schema & query, creating audit…');
+    let result;
+    try {
+        result = await postMultipart('/audits', {
+            ddl: toFileField(resolvedDdl),
+            query: toFileField(resolvedQuery),
+        });
+        spinner.succeed(`Audit created · ${chalk.cyan(result.public_id)}`);
+    }
+    catch (err) {
+        if (err instanceof ApiError && err.status === 402) {
+            spinner.fail('No audits remaining. Visit the Argus website to top up.');
+            process.exit(1);
+        }
+        spinner.fail(err.message);
+        throw err;
+    }
+    // Step 2: get a fresh token to pass to containers
+    spinner = startSpinner('Refreshing credentials…');
+    let authToken;
+    try {
+        const storedRefreshToken = await getRefreshToken();
+        if (storedRefreshToken) {
+            authToken = await refreshTokens(storedRefreshToken);
+        }
+        else {
+            // CI path: ARGUS_AUTH_TOKEN is set directly in env
+            authToken = await requireAuth();
+        }
+        spinner.succeed('Credentials refreshed');
+    }
+    catch (err) {
+        spinner.fail(err.message);
+        throw err;
+    }
+    // Step 3: prepare Docker environment
+    spinner = startSpinner('Preparing Docker environment…');
+    try {
+        ({ composePath, tmpTokenPath } = generateCompose({
+            ddlPath: resolvedDdl,
+            auditId: result.public_id,
+            apiUrl: getEngineBaseUrl(),
+            authToken,
+            workerImage: getWorkerImage(),
+            postgresImage,
+        }));
+        spinner.succeed('Docker environment ready');
+    }
+    catch (err) {
+        spinner.fail(err.message);
+        throw err;
+    }
+    try {
+        // Step 4: run benchmark
+        spinner = startSpinner('Running benchmark…');
+        try {
+            await runWorker({ composePath });
+            spinner.succeed('Benchmark complete');
+        }
+        catch (err) {
+            spinner.fail(err.message);
+            // best-effort: report each container's error to the API
+            const containerErrors = getContainerErrors(composePath);
+            if (containerErrors.length > 0) {
+                const reportSpinner = startSpinner('Reporting errors…');
+                try {
+                    await Promise.all(containerErrors.map((e) => post(`/audits/${result.public_id}/container-errors`, {
+                        container_name: e.containerName,
+                        error_details: e.errorDetails,
+                    })));
+                    reportSpinner.succeed('Errors reported');
+                }
+                catch {
+                    reportSpinner.warn('Could not report errors to API');
+                }
+            }
+            throw err;
+        }
+        // Step 5: fetch results
+        spinner = startSpinner('Fetching results…');
+        let recipe;
+        try {
+            recipe = await get(`/audits/${result.public_id}/recipe`);
+            spinner.succeed(`Report ready · ${chalk.cyan(`${getHubBaseUrl()}/audits/${recipe.public_id}`)}`);
+        }
+        catch (err) {
+            spinner.fail(err.message);
+            throw err;
+        }
+    }
+    finally {
+        if (!composePath) {
+            return;
+        }
+        if (keepContainers) {
+            console.log(chalk.yellow('\nContainers left running. To clean up manually:'));
+            console.log(chalk.dim(`  docker compose -f ${composePath} down -v`));
+        }
+        else {
+            cleanupWorker({ composePath, tmpTokenPath });
+        }
+    }
+}
+export function auditCommand() {
+    const cmd = new Command('audit');
+    cmd
+        .description('Run a benchmark audit on a SQL schema')
+        .requiredOption('--ddl <path>', 'Path to DDL file')
+        .requiredOption('--query <path>', 'Path to query file')
+        .option('--keep-containers', 'Skip docker compose down after benchmark (containers remain running)', false)
+        .option('--postgres-version <version>', 'PostgreSQL version to benchmark against (e.g. 17, 17.5, 17-bookworm); defaults to 18-alpine')
+        .action(async (options) => {
+        try {
+            await audit({
+                ddlPath: options.ddl,
+                queryPath: options.query,
+                keepContainers: options.keepContainers,
+                postgresVersion: options.postgresVersion,
+            });
+        }
+        catch (err) {
+            process.exit(1);
+        }
+    });
+    return cmd;
+}
+//# sourceMappingURL=audit.js.map

package/dist/src/commands/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/commands/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,OAAO,EAAC,MAAM,WAAW,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAe,MAAM,KAAK,CAAC;AAElC,OAAO,EAAC,oBAAoB,EAAE,aAAa,EAAE,eAAe,EAAE,kBAAkB,EAAE,SAAS,EAAC,MAAM,kBAAkB,CAAC;AACrH,OAAO,EAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAC,MAAM,eAAe,CAAC;AACjE,OAAO,EAAC,aAAa,EAAE,WAAW,EAAC,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAC,oBAAoB,EAAC,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAC,eAAe,EAAC,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAC,gBAAgB,EAAE,aAAa,EAAE,cAAc,EAAC,MAAM,cAAc,CAAC;AAS7E,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,EAAC,OAAO,EAAE,SAAS,EAAE,cAAc,GAAG,KAAK,EAAE,eAAe,EAGvF;IACG,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,CAAC,EAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAC,CAAC,CAAC;IAE1F,IAAI,aAA8B,CAAC;IACnC,IAAI,WAA+B,CAAC;IACpC,IAAI,YAAgC,CAAC;IAErC,MAAM,YAAY,GAAG,CAAC,IAAY,EAAO,EAAE;QACvC,aAAa,GAAG,GAAG,CAAC,EAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QACzD,OAAO,aAAa,CAAC;IACzB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;QACtB,aAAa,EAAE,IAAI,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,wCAAwC,CAAC,CAAC,CAAC;QACpE,IAAI,WAAW;YAAE,aAAa,CAAC,EAAC,WAAW,EAAE,YAAY,EAAC,CAAC,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,oFAAoF;IACpF,MAAM,cAAc,GAAG,YAAY,CAAC,kCAAkC,CAAC,CAAC;IACxE,IAAI,CAAC;QACD,oBAAoB,EAAE,CAAC;QACvB,cAAc,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,cAAc,CAAC,IAAI,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;QAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,4EAA4E;IAC5E,IAAI,aAAiC,CAAC;IACtC,IAAI,eAAe,EAAE,CAAC;QAClB,MAAM,cAAc,GAAG,YAAY,CAAC,8BAA8B,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAClG,IAAI,CAAC;YACD,aAAa,GAAG,MAAM,oBAAoB,CAAC,eAAe,CAAC,CAAC;YAC5D,cAAc,CAAC,OAAO,CAAC,6BAA6B,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QACrF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,cAAc,CAAC,IAAI,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;YAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACL,CAAC;IAED,uBAAuB;IACvB,IAAI,OAAO,GAAG,YAAY,CAAC,2CAA2C,CAAC,CAAC;IACxE,IAAI,MAA4B,CAAC;IACjC,IAAI,CAAC;QACD,MAAM,GAAG,MAAM,aAAa,CAAuB,SAAS,EAAE;YAC1D,GAAG,EAAE,WAAW,CAAC,WAAW,CAAC;YAC7B,KAAK,EAAE,WAAW,CAAC,aAAa,CAAC;SACpC,CAAC,CAAC;QACH,OAAO,CAAC,OAAO,CAAC,mBAAmB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,IAAI,GAAG,YAAY,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAChD,OAAO,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;YACxE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;QACD,OAAO,CAAC,IAAI,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,GAAG,CAAC;IACd,CAAC;IAED,kDAAkD;IAClD,OAAO,GAAG,YAAY,CAAC,yBAAyB,CAAC,CAAC;IAClD,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACD,MAAM,kBAAkB,GAAG,MAAM,eAAe,EAAE,CAAC;QACnD,IAAI,kBAAkB,EAAE,CAAC;YACrB,SAAS,GAAG,MAAM,aAAa,CAAC,kBAAkB,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACJ,mDAAmD;YACnD,SAAS,GAAG,MAAM,WAAW,EAAE,CAAC;QACpC,CAAC;QACD,OAAO,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,GAAG,CAAC;IACd,CAAC;IAED,qCAAqC;IACrC,OAAO,GAAG,YAAY,CAAC,+BAA+B,CAAC,CAAC;IACxD,IAAI,CAAC;QACD,CAAC,EAAC,WAAW,EAAE,YAAY,EAAC,GAAG,eAAe,CAAC;YAC3C,OAAO,EAAE,WAAW;YACpB,OAAO,EAAE,MAAM,CAAC,SAAS;YACzB,MAAM,EAAE,gBAAgB,EAAE;YAC1B,SAAS;YACT,WAAW,EAAE,cAAc,EAAE;YAC7B,aAAa;SAChB,CAAC,CAAC,CAAC;QACJ,OAAO,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,GAAG,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACD,wBAAwB;QACxB,OAAO,GAAG,YAAY,CAAC,oBAAoB,CAAC,CAAC;QAC7C,IAAI,CAAC;YACD,MAAM,SAAS,CAAC,EAAC,WAAW,EAAC,CAAC,CAAC;YAC/B,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;YACrC,wDAAwD;YACxD,MAAM,eAAe,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;YACxD,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,aAAa,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAC;gBACxD,IAAI,CAAC;oBACD,MAAM,OAAO,CAAC,GAAG,CACb,eAAe,CAAC,GAAG,CAAC,CAAC,CAAiB,EAAE,EAAE,CACtC,IAAI,CAAC,WAAW,MAAM,CAAC,SAAS,mBAAmB,EAAE;wBACjD,cAAc,EAAE,CAAC,CAAC,aAAa;wBAC/B,aAAa,EAAE,CAAC,CAAC,YAAY;qBAChC,CAAC,CACL,CACJ,CAAC;oBACF,aAAa,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;gBAC7C,CAAC;gBAAC,MAAM,CAAC;oBACL,aAAa,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;gBACzD,CAAC;YACL,CAAC;YACD,MAAM,GAAG,CAAC;QACd,CAAC;QAED,wBAAwB;QACxB,OAAO,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAC;QAC5C,IAAI,MAAmB,CAAC;QACxB,IAAI,CAAC;YACD,MAAM,GAAG,MAAM,GAAG,CAAc,WAAW,MAAM,CAAC,SAAS,SAAS,CAAC,CAAC;YACtE,OAAO,CAAC,OAAO,CAAC,kBAAkB,KAAK,CAAC,IAAI,CAAC,GAAG,aAAa,EAAE,WAAW,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;QACrG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;YACrC,MAAM,GAAG,CAAC;QACd,CAAC;IACL,CAAC;YAAS,CAAC;QACP,IAAI,CAAC,WAAW,EAAE,CAAC;YACf,OAAM;QACV,CAAC;QAED,IAAI,cAAc,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,kDAAkD,CAAC,CAAC,CAAC;YAC9E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,uBAAuB,WAAW,UAAU,CAAC,CAAC,CAAC;QACzE,CAAC;aAAM,CAAC;YACJ,aAAa,CAAC,EAAC,WAAW,EAAE,YAAY,EAAC,CAAC,CAAC;QAC/C,CAAC;IAEL,CAAC;AACL,CAAC;AAED,MAAM,UAAU,YAAY;IACxB,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAEjC,GAAG;SACE,WAAW,CAAC,uCAAuC,CAAC;SACpD,cAAc,CAAC,cAAc,EAAE,kBAAkB,CAAC;SAClD,cAAc,CAAC,gBAAgB,EAAE,oBAAoB,CAAC;SACtD,MAAM,CAAC,mBAAmB,EAAE,sEAAsE,EAAE,KAAK,CAAC;SAC1G,MAAM,CAAC,8BAA8B,EAAE,6FAA6F,CAAC;SACrI,MAAM,CAAC,KAAK,EAAE,OAA0F,EAAE,EAAE;QACzG,IAAI,CAAC;YACD,MAAM,KAAK,CAAC;gBACR,OAAO,EAAE,OAAO,CAAC,GAAG;gBACpB,SAAS,EAAE,OAAO,CAAC,KAAK;gBACxB,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,eAAe,EAAE,OAAO,CAAC,eAAe;aAC3C,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACL,CAAC,CAAC,CAAC;IAEP,OAAO,GAAG,CAAC;AACf,CAAC"}

package/dist/src/commands/login.d.ts

@@ -0,0 +1,2 @@
+import { Command } from 'commander';
+export declare function loginCommand(): Command;

package/dist/src/commands/login.js

@@ -0,0 +1,102 @@
+// `argus login` command — opens a browser for OAuth-style CLI login via loopback callback.
+import { Command } from 'commander';
+import http from 'node:http';
+import net from 'node:net';
+import crypto from 'node:crypto';
+import { URL } from 'node:url';
+import open from 'open';
+import chalk from 'chalk';
+import { getAccessToken, setTokens } from '../lib/keychain.js';
+import { callbackPage } from '../lib/callback-page.js';
+import { getEngineBaseUrl, getHubBaseUrl } from '../config.js';
+async function findFreePort(start, end) {
+    for (let port = start; port <= end; port++) {
+        const available = await new Promise((resolve) => {
+            const server = net.createServer();
+            server.once('error', () => resolve(false));
+            server.once('listening', () => {
+                server.close(() => resolve(true));
+            });
+            server.listen(port, '127.0.0.1');
+        });
+        if (available)
+            return port;
+    }
+    throw new Error(`No free port found in range ${start}-${end}`);
+}
+function generateCodeVerifier() {
+    return crypto.randomBytes(32).toString('base64url');
+}
+function generateCodeChallenge(verifier) {
+    return crypto.createHash('sha256').update(verifier).digest('base64url');
+}
+async function login() {
+    const existing = await getAccessToken();
+    if (existing) {
+        console.log(chalk.yellow('Already logged in. Run `argus logout` to switch accounts.'));
+        return;
+    }
+    const port = await findFreePort(9000, 9100);
+    const redirectUri = `http://127.0.0.1:${port}`;
+    const state = crypto.randomBytes(16).toString('hex');
+    const codeVerifier = generateCodeVerifier();
+    const codeChallenge = generateCodeChallenge(codeVerifier);
+    const codeReceived = new Promise((resolve, reject) => {
+        const server = http.createServer((req, res) => {
+            try {
+                const reqUrl = new URL(req.url ?? '/', `http://127.0.0.1:${port}`);
+                const code = reqUrl.searchParams.get('code');
+                const returnedState = reqUrl.searchParams.get('state');
+                if (returnedState !== state) {
+                    res.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });
+                    res.end(callbackPage(false, 'Request rejected', 'The state parameter did not match, so this login attempt was rejected. Return to your terminal and run argus login again.'));
+                    return;
+                }
+                if (!code) {
+                    res.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });
+                    res.end(callbackPage(false, 'Login failed', 'No authorization code was received. Return to your terminal and run argus login again.'));
+                    return;
+                }
+                res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+                res.end(callbackPage(true, 'Login successful', 'You are all set. You can close this tab and return to your terminal.'));
+                server.close();
+                resolve({ code });
+            }
+            catch (err) {
+                reject(err);
+            }
+        });
+        server.listen(port, '127.0.0.1');
+    });
+    const loginUrl = `${getHubBaseUrl()}/auth/login?redirect_uri=${encodeURIComponent(redirectUri)}&state=${state}&code_challenge=${encodeURIComponent(codeChallenge)}`;
+    await open(loginUrl);
+    console.log(chalk.dim('Opening browser for login... (waiting for callback)'));
+    const { code } = await codeReceived;
+    const exchangeRes = await fetch(`${getEngineBaseUrl()}/auth/cli-token`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ code, code_verifier: codeVerifier }),
+    });
+    if (!exchangeRes.ok) {
+        throw new Error('Failed to exchange login code for tokens.');
+    }
+    const tokens = await exchangeRes.json();
+    await setTokens(tokens.access_token, tokens.refresh_token);
+    console.log(chalk.green('Logged in successfully.'));
+}
+export function loginCommand() {
+    const cmd = new Command('login');
+    cmd
+        .description('Authenticate with ARGUS via browser login')
+        .action(async () => {
+        try {
+            await login();
+        }
+        catch (err) {
+            console.error(chalk.red(`Login failed: ${err.message}`));
+            process.exit(1);
+        }
+    });
+    return cmd;
+}
+//# sourceMappingURL=login.js.map

package/dist/src/commands/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../../src/commands/login.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,OAAO,EAAC,OAAO,EAAC,MAAM,WAAW,CAAA;AACjC,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,GAAG,MAAM,UAAU,CAAA;AAC1B,OAAO,MAAM,MAAM,aAAa,CAAA;AAChC,OAAO,EAAC,GAAG,EAAC,MAAM,UAAU,CAAA;AAC5B,OAAO,IAAI,MAAM,MAAM,CAAA;AACvB,OAAO,KAAK,MAAM,OAAO,CAAA;AACzB,OAAO,EAAC,cAAc,EAAE,SAAS,EAAC,MAAM,oBAAoB,CAAA;AAC5D,OAAO,EAAC,YAAY,EAAC,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAC,gBAAgB,EAAE,aAAa,EAAC,MAAM,cAAc,CAAA;AAE5D,KAAK,UAAU,YAAY,CAAC,KAAa,EAAE,GAAW;IAClD,KAAK,IAAI,IAAI,GAAG,KAAK,EAAE,IAAI,IAAI,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,MAAM,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;YACrD,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,EAAE,CAAA;YACjC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;YAC1C,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE;gBAC1B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;YACrC,CAAC,CAAC,CAAA;YACF,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QACpC,CAAC,CAAC,CAAA;QACF,IAAI,SAAS;YAAE,OAAO,IAAI,CAAA;IAC9B,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,IAAI,GAAG,EAAE,CAAC,CAAA;AAClE,CAAC;AAED,SAAS,oBAAoB;IACzB,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AACvD,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAgB;IAC3C,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;AAC3E,CAAC;AAED,KAAK,UAAU,KAAK;IAChB,MAAM,QAAQ,GAAG,MAAM,cAAc,EAAE,CAAA;IACvC,IAAI,QAAQ,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,2DAA2D,CAAC,CAAC,CAAA;QACtF,OAAM;IACV,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAC3C,MAAM,WAAW,GAAG,oBAAoB,IAAI,EAAE,CAAA;IAE9C,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACpD,MAAM,YAAY,GAAG,oBAAoB,EAAE,CAAA;IAC3C,MAAM,aAAa,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAA;IAEzD,MAAM,YAAY,GAAG,IAAI,OAAO,CAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC1C,IAAI,CAAC;gBACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAA;gBAClE,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;gBAC5C,MAAM,aAAa,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;gBAEtD,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;oBAC1B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAC,cAAc,EAAE,0BAA0B,EAAC,CAAC,CAAA;oBAChE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,kBAAkB,EAAE,2HAA2H,CAAC,CAAC,CAAA;oBAC7K,OAAM;gBACV,CAAC;gBAED,IAAI,CAAC,IAAI,EAAE,CAAC;oBACR,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAC,cAAc,EAAE,0BAA0B,EAAC,CAAC,CAAA;oBAChE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,cAAc,EAAE,wFAAwF,CAAC,CAAC,CAAA;oBACtI,OAAM;gBACV,CAAC;gBAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAC,cAAc,EAAE,0BAA0B,EAAC,CAAC,CAAA;gBAChE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,kBAAkB,EAAE,sEAAsE,CAAC,CAAC,CAAA;gBAEvH,MAAM,CAAC,KAAK,EAAE,CAAA;gBACd,OAAO,CAAC,EAAC,IAAI,EAAC,CAAC,CAAA;YACnB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,MAAM,CAAC,GAAG,CAAC,CAAA;YACf,CAAC;QACL,CAAC,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;IACpC,CAAC,CAAC,CAAA;IAEF,MAAM,QAAQ,GAAG,GAAG,aAAa,EAAE,4BAA4B,kBAAkB,CAAC,WAAW,CAAC,UAAU,KAAK,mBAAmB,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAA;IACnK,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAA;IACpB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC,CAAA;IAE7E,MAAM,EAAC,IAAI,EAAC,GAAG,MAAM,YAAY,CAAA;IAEjC,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,GAAG,gBAAgB,EAAE,iBAAiB,EAAE;QACpE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAC,cAAc,EAAE,kBAAkB,EAAC;QAC7C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAC,IAAI,EAAE,aAAa,EAAE,YAAY,EAAC,CAAC;KAC5D,CAAC,CAAA;IACF,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;IAChE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,EAAqD,CAAA;IAC1F,MAAM,SAAS,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,aAAa,CAAC,CAAA;IAE1D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAA;AACvD,CAAC;AAED,MAAM,UAAU,YAAY;IACxB,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;IAEhC,GAAG;SACE,WAAW,CAAC,2CAA2C,CAAC;SACxD,MAAM,CAAC,KAAK,IAAI,EAAE;QACf,IAAI,CAAC;YACD,MAAM,KAAK,EAAE,CAAA;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAkB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;YACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACnB,CAAC;IACL,CAAC,CAAC,CAAA;IAEN,OAAO,GAAG,CAAA;AACd,CAAC"}

package/dist/src/commands/logout.d.ts

@@ -0,0 +1,2 @@
+import { Command } from 'commander';
+export declare function logoutCommand(): Command;

package/dist/src/commands/logout.js

@@ -0,0 +1,20 @@
+// `argus logout` command — clears stored tokens from the OS keychain.
+import { Command } from 'commander';
+import chalk from 'chalk';
+import { clearTokens, getAccessToken } from '../lib/keychain.js';
+export function logoutCommand() {
+    const cmd = new Command('logout');
+    cmd
+        .description('Log out and remove stored credentials')
+        .action(async () => {
+        const token = await getAccessToken();
+        if (!token) {
+            console.log(chalk.yellow('Not logged in.'));
+            return;
+        }
+        await clearTokens();
+        console.log(chalk.green('Logged out.'));
+    });
+    return cmd;
+}
+//# sourceMappingURL=logout.js.map

package/dist/src/commands/logout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../../src/commands/logout.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,OAAO,EAAC,OAAO,EAAC,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,MAAM,OAAO,CAAA;AACzB,OAAO,EAAC,WAAW,EAAE,cAAc,EAAC,MAAM,oBAAoB,CAAA;AAE9D,MAAM,UAAU,aAAa;IACzB,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAA;IAEjC,GAAG;SACE,WAAW,CAAC,uCAAuC,CAAC;SACpD,MAAM,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,KAAK,GAAG,MAAM,cAAc,EAAE,CAAA;QACpC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAA;YAC3C,OAAM;QACV,CAAC;QACD,MAAM,WAAW,EAAE,CAAA;QACnB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;IAEN,OAAO,GAAG,CAAA;AACd,CAAC"}

package/dist/src/config.d.ts

@@ -0,0 +1,3 @@
+export declare function getEngineBaseUrl(): string;
+export declare function getHubBaseUrl(): string;
+export declare function getWorkerImage(): string;

package/dist/src/config.js

@@ -0,0 +1,30 @@
+const DEFAULT_URL = 'https://api.argusaudit.dev/api/v1';
+const DEFAULT_HUB_URL = 'https://www.argusaudit.dev';
+// Pinned, not `latest`: a benchmarking tool must run a reproducible worker.
+// Bump in lockstep with argus-worker releases.
+const DEFAULT_WORKER_IMAGE = 'argusaudit/worker:0.1.0';
+function warnIfInsecure(url) {
+    if (!url.startsWith('http://'))
+        return;
+    try {
+        const { hostname } = new URL(url);
+        if (hostname !== 'localhost' && hostname !== '127.0.0.1') {
+            process.stderr.write('⚠ WARNING: ARGUS_API_URL uses insecure HTTP for a non-local address. Use HTTPS in production.\n');
+        }
+    }
+    catch {
+        // unparseable URL — let the request fail naturally
+    }
+}
+export function getEngineBaseUrl() {
+    const url = process.env['ARGUS_API_URL'] || DEFAULT_URL;
+    warnIfInsecure(url);
+    return url;
+}
+export function getHubBaseUrl() {
+    return process.env['ARGUS_HUB_URL'] || DEFAULT_HUB_URL;
+}
+export function getWorkerImage() {
+    return process.env['ARGUS_WORKER_IMAGE'] || DEFAULT_WORKER_IMAGE;
+}
+//# sourceMappingURL=config.js.map

package/dist/src/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,GAAG,mCAAmC,CAAC;AACxD,MAAM,eAAe,GAAG,4BAA4B,CAAC;AAErD,4EAA4E;AAC5E,+CAA+C;AAC/C,MAAM,oBAAoB,GAAG,yBAAyB,CAAC;AAEvD,SAAS,cAAc,CAAC,GAAW;IAC/B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO;IACvC,IAAI,CAAC;QACD,MAAM,EAAC,QAAQ,EAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,iGAAiG,CACpG,CAAC;QACN,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACL,mDAAmD;IACvD,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,WAAW,CAAC;IACxD,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,GAAG,CAAC;AACf,CAAC;AAED,MAAM,UAAU,aAAa;IACzB,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,eAAe,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,cAAc;IAC1B,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,oBAAoB,CAAC;AACrE,CAAC"}

package/dist/src/lib/api.d.ts

@@ -0,0 +1,12 @@
+export declare class ApiError extends Error {
+    readonly status: number;
+    constructor(status: number, message: string);
+}
+export interface FileField {
+    filePath: string;
+    filename: string;
+}
+export type MultipartField = string | FileField;
+export declare function get<T>(path: string): Promise<T>;
+export declare function post<T>(path: string, body: unknown): Promise<T>;
+export declare function postMultipart<T>(path: string, fields: Record<string, MultipartField>): Promise<T>;

package/dist/src/lib/api.js

@@ -0,0 +1,120 @@
+import fs from 'node:fs/promises';
+import { agent } from './http.js';
+import { getEngineBaseUrl } from '../config.js';
+import { refreshTokens, requireAuth } from './auth.js';
+import { getRefreshToken } from './keychain.js';
+// ─── Types ────────────────────────────────────────────────────────────────────
+export class ApiError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+        this.name = this.constructor.name;
+        Object.setPrototypeOf(this, new.target.prototype);
+        if (Error.captureStackTrace) {
+            Error.captureStackTrace(this, this.constructor);
+        }
+    }
+}
+// ─── Token refresh queue ──────────────────────────────────────────────────────
+//
+// Multiple concurrent requests may receive a 401 simultaneously. Instead of
+// each firing its own refresh call, they all share a single in-flight promise.
+// Once the refresh settles (success or failure) the promise is cleared so the
+// next token expiry starts fresh.
+let refreshPromise = null;
+function getRefreshedToken() {
+    if (!refreshPromise) {
+        refreshPromise = (async () => {
+            const refreshToken = await getRefreshToken();
+            if (!refreshToken)
+                return null;
+            try {
+                return await refreshTokens(refreshToken);
+            }
+            catch {
+                return null;
+            }
+        })().finally(() => {
+            refreshPromise = null;
+        });
+    }
+    return refreshPromise;
+}
+// ─── Core request ─────────────────────────────────────────────────────────────
+async function request(perform) {
+    const jwt = await requireAuth();
+    let response = await perform(jwt);
+    if (response.status === 401) {
+        const newJwt = await getRefreshedToken();
+        if (!newJwt)
+            throw new Error('Session expired. Run: argus login');
+        response = await perform(newJwt);
+    }
+    if (!response.ok) {
+        const body = await response.text();
+        let message = `API request failed [${response.status}]`;
+        try {
+            const json = JSON.parse(body);
+            if (json.detail?.message) {
+                message = json.detail.message;
+            }
+            else if (json.message) {
+                message = json.message;
+            }
+            else {
+                message = `${message}: ${body}`;
+            }
+        }
+        catch {
+            message = `${message}: ${body}`;
+        }
+        throw new ApiError(response.status, message);
+    }
+    return (response.status === 204 ? null : response.json());
+}
+// ─── Request helpers ──────────────────────────────────────────────────────────
+function isFileField(value) {
+    return typeof value === 'object' && 'filePath' in value;
+}
+async function buildForm(fields) {
+    const form = new FormData();
+    for (const [name, value] of Object.entries(fields)) {
+        if (isFileField(value)) {
+            const buffer = await fs.readFile(value.filePath);
+            form.append(name, new Blob([buffer]), value.filename);
+        }
+        else {
+            form.append(name, value);
+        }
+    }
+    return form;
+}
+// ─── Public API ───────────────────────────────────────────────────────────────
+export function get(path) {
+    const url = `${getEngineBaseUrl()}${path}`;
+    return request(jwt => fetch(url, {
+        headers: { Authorization: `Bearer ${jwt}` },
+        dispatcher: agent,
+    }));
+}
+export function post(path, body) {
+    const url = `${getEngineBaseUrl()}${path}`;
+    return request(jwt => fetch(url, {
+        method: 'POST',
+        body: JSON.stringify(body),
+        headers: { Authorization: `Bearer ${jwt}`, 'Content-Type': 'application/json' },
+        dispatcher: agent,
+    }));
+}
+export async function postMultipart(path, fields) {
+    const form = await buildForm(fields);
+    const url = `${getEngineBaseUrl()}${path}`;
+    return request(jwt => fetch(url, {
+        method: 'POST',
+        body: form,
+        headers: { Authorization: `Bearer ${jwt}` },
+        dispatcher: agent,
+    }));
+}
+//# sourceMappingURL=api.js.map

package/dist/src/lib/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../../src/lib/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAC,KAAK,EAAC,MAAM,WAAW,CAAC;AAChC,OAAO,EAAC,gBAAgB,EAAC,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAC,aAAa,EAAE,WAAW,EAAC,MAAM,WAAW,CAAC;AACrD,OAAO,EAAC,eAAe,EAAC,MAAM,eAAe,CAAC;AAE9C,iFAAiF;AAEjF,MAAM,OAAO,QAAS,SAAQ,KAAK;IACH;IAA5B,YAA4B,MAAc,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QADS,WAAM,GAAN,MAAM,CAAQ;QAEtC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;QAClC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAC1B,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACpD,CAAC;IACL,CAAC;CACJ;AASD,iFAAiF;AACjF,EAAE;AACF,4EAA4E;AAC5E,+EAA+E;AAC/E,8EAA8E;AAC9E,kCAAkC;AAElC,IAAI,cAAc,GAAkC,IAAI,CAAC;AAEzD,SAAS,iBAAiB;IACtB,IAAI,CAAC,cAAc,EAAE,CAAC;QAClB,cAAc,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,YAAY,GAAG,MAAM,eAAe,EAAE,CAAC;YAC7C,IAAI,CAAC,YAAY;gBAAE,OAAO,IAAI,CAAC;YAC/B,IAAI,CAAC;gBACD,OAAO,MAAM,aAAa,CAAC,YAAY,CAAC,CAAC;YAC7C,CAAC;YAAC,MAAM,CAAC;gBACL,OAAO,IAAI,CAAC;YAChB,CAAC;QACL,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACd,cAAc,GAAG,IAAI,CAAC;QAC1B,CAAC,CAAC,CAAC;IACP,CAAC;IACD,OAAO,cAAc,CAAC;AAC1B,CAAC;AAED,iFAAiF;AAEjF,KAAK,UAAU,OAAO,CAAI,OAA2C;IACjE,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE,CAAC;IAChC,IAAI,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;IAElC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC;QACzC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAClE,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,OAAO,GAAG,uBAAuB,QAAQ,CAAC,MAAM,GAAG,CAAC;QACxD,IAAI,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBACvB,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;YAClC,CAAC;iBAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACtB,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACJ,OAAO,GAAG,GAAG,OAAO,KAAK,IAAI,EAAE,CAAC;YACpC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,GAAG,GAAG,OAAO,KAAK,IAAI,EAAE,CAAC;QACpC,CAAC;QACD,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAe,CAAC;AAC5E,CAAC;AAED,iFAAiF;AAEjF,SAAS,WAAW,CAAC,KAAqB;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,UAAU,IAAI,KAAK,CAAC;AAC5D,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,MAAsC;IAC3D,MAAM,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACjD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC1D,CAAC;aAAM,CAAC;YACJ,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC7B,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,iFAAiF;AAEjF,MAAM,UAAU,GAAG,CAAI,IAAY;IAC/B,MAAM,GAAG,GAAG,GAAG,gBAAgB,EAAE,GAAG,IAAI,EAAE,CAAC;IAC3C,OAAO,OAAO,CAAI,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;QAChC,OAAO,EAAE,EAAC,aAAa,EAAE,UAAU,GAAG,EAAE,EAAC;QACzC,UAAU,EAAE,KAAK;KACL,CAAC,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,IAAI,CAAI,IAAY,EAAE,IAAa;IAC/C,MAAM,GAAG,GAAG,GAAG,gBAAgB,EAAE,GAAG,IAAI,EAAE,CAAC;IAC3C,OAAO,OAAO,CAAI,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,EAAC,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAC;QAC7E,UAAU,EAAE,KAAK;KACL,CAAC,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAC/B,IAAY,EACZ,MAAsC;IAEtC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,GAAG,gBAAgB,EAAE,GAAG,IAAI,EAAE,CAAC;IAC3C,OAAO,OAAO,CAAI,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,EAAC,aAAa,EAAE,UAAU,GAAG,EAAE,EAAC;QACzC,UAAU,EAAE,KAAK;KACL,CAAC,CAAC,CAAC;AACvB,CAAC"}

package/dist/src/lib/auth.d.ts

@@ -0,0 +1,2 @@
+export declare function refreshTokens(refreshToken: string): Promise<string>;
+export declare function requireAuth(): Promise<string>;

package/dist/src/lib/auth.js

@@ -0,0 +1,33 @@
+// Core authentication logic: token retrieval and silent refresh on 401.
+import { clearTokens, getAccessToken, setTokens } from './keychain.js';
+import { getEngineBaseUrl } from '../config.js';
+import { agent } from './http.js';
+export async function refreshTokens(refreshToken) {
+    const url = `${getEngineBaseUrl()}/auth/refresh`;
+    const response = await fetch(url, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ refresh_token: refreshToken }),
+        dispatcher: agent,
+    });
+    if (!response.ok) {
+        await clearTokens();
+        throw new Error('Session expired. Run: argus login');
+    }
+    const data = await response.json();
+    await setTokens(data.access_token, data.refresh_token);
+    return data.access_token;
+}
+export async function requireAuth() {
+    // CI path: honour explicit token override
+    const envToken = process.env['ARGUS_AUTH_TOKEN'];
+    if (envToken) {
+        return envToken;
+    }
+    const accessToken = await getAccessToken();
+    if (!accessToken) {
+        throw new Error('Not authenticated. Run: argus login');
+    }
+    return accessToken;
+}
+//# sourceMappingURL=auth.js.map

package/dist/src/lib/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/lib/auth.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,OAAO,EAAC,WAAW,EAAE,cAAc,EAAE,SAAS,EAAC,MAAM,eAAe,CAAA;AACpE,OAAO,EAAC,gBAAgB,EAAC,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAC,KAAK,EAAC,MAAM,WAAW,CAAA;AAE/B,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,YAAoB;IACpD,MAAM,GAAG,GAAG,GAAG,gBAAgB,EAAE,eAAe,CAAA;IAChD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC9B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAC,cAAc,EAAE,kBAAkB,EAAC;QAC7C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAC,aAAa,EAAE,YAAY,EAAC,CAAC;QACnD,UAAU,EAAE,KAAK;KACL,CAAC,CAAA;IAEjB,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,WAAW,EAAE,CAAA;QACnB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;IACxD,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAqD,CAAA;IACrF,MAAM,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,CAAC,CAAA;IACtD,OAAO,IAAI,CAAC,YAAY,CAAA;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAC7B,0CAA0C;IAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;IAChD,IAAI,QAAQ,EAAE,CAAC;QACX,OAAO,QAAQ,CAAA;IACnB,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,cAAc,EAAE,CAAA;IAC1C,IAAI,CAAC,WAAW,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IAC1D,CAAC;IAED,OAAO,WAAW,CAAA;AACtB,CAAC"}

package/dist/src/lib/callback-page.d.ts

@@ -0,0 +1 @@
+export declare function callbackPage(success: boolean, title: string, message: string): string;

package/dist/src/lib/callback-page.js

@@ -0,0 +1,48 @@
+// HTML page rendered in the browser after the OAuth loopback callback (`argus login`).
+export function callbackPage(success, title, message) {
+    const accent = success ? '#4ade80' : '#f87171';
+    const mark = success
+        ? '<path class="mark" d="M15 25.5l6.5 6.5L34 19"/>'
+        : '<path class="mark" d="M17.5 17.5l13 13m0-13l-13 13"/>';
+    return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>ARGUS CLI — ${title}</title>
+<style>
+:root{color-scheme:dark}
+*{margin:0;box-sizing:border-box}
+body{min-height:100vh;display:grid;place-items:center;padding:24px;background:#0a0a0a;background-image:radial-gradient(640px 320px at 50% -10%,${accent}14,transparent 70%);font-family:ui-monospace,'SF Mono',SFMono-Regular,Menlo,Consolas,'Liberation Mono',monospace;color:#e5e5e5}
+main{width:100%;max-width:26rem;background:#171717;border:1px solid #262626;border-radius:12px;padding:40px 36px;text-align:center;animation:rise .5s cubic-bezier(.22,1,.36,1) both}
+.brand{display:flex;align-items:center;justify-content:center;gap:10px;margin-bottom:32px;animation:fade .6s .05s both}
+.brand span{font-size:13px;letter-spacing:.35em;color:#a3a3a3}
+.brand em{font-style:normal;font-size:10px;letter-spacing:.15em;color:#737373;border:1px solid #333;border-radius:4px;padding:2px 6px}
+svg{display:block;margin:0 auto 24px;color:${accent}}
+.ring{stroke-dasharray:139;stroke-dashoffset:139;animation:draw .6s .15s ease-out forwards}
+.mark{stroke-dasharray:40;stroke-dashoffset:40;animation:draw .35s .6s ease-out forwards}
+h1{font-size:20px;font-weight:600;letter-spacing:-.01em;animation:fade .6s .25s both}
+p{margin-top:12px;font-size:13px;line-height:1.7;color:#a3a3a3;animation:fade .6s .35s both}
+.prompt{margin-top:28px;padding-top:20px;border-top:1px solid #262626;font-size:12px;color:#525252;animation:fade .6s .45s both}
+.prompt b{font-weight:400;color:${accent}}
+@keyframes rise{from{opacity:0;transform:translateY(12px) scale(.98)}to{opacity:1;transform:none}}
+@keyframes fade{from{opacity:0;transform:translateY(6px)}to{opacity:1;transform:none}}
+@keyframes draw{to{stroke-dashoffset:0}}
+@media (prefers-reduced-motion:reduce){*{animation:none!important}.ring,.mark{stroke-dashoffset:0}}
+</style>
+</head>
+<body>
+<main>
+<div class="brand"><span>ARGUS</span><em>CLI</em></div>
+<svg width="48" height="48" viewBox="0 0 48 48" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
+<circle class="ring" cx="24" cy="24" r="22"/>
+${mark}
+</svg>
+<h1>${title}</h1>
+<p>${message}</p>
+<p class="prompt">$ argus login <b>${success ? '✓' : '✗'}</b></p>
+</main>
+</body>
+</html>`;
+}
+//# sourceMappingURL=callback-page.js.map

package/dist/src/lib/callback-page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback-page.js","sourceRoot":"","sources":["../../../src/lib/callback-page.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,MAAM,UAAU,YAAY,CAAC,OAAgB,EAAE,KAAa,EAAE,OAAe;IACzE,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;IAC9C,MAAM,IAAI,GAAG,OAAO;QAChB,CAAC,CAAC,iDAAiD;QACnD,CAAC,CAAC,uDAAuD,CAAA;IAC7D,OAAO;;;;;qBAKU,KAAK;;;;iJAIuH,MAAM;;;;;6CAK1G,MAAM;;;;;;kCAMjB,MAAM;;;;;;;;;;;;EAYtC,IAAI;;MAEA,KAAK;KACN,OAAO;qCACyB,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;;;QAGhD,CAAA;AACR,CAAC"}

package/dist/src/lib/docker.d.ts

@@ -0,0 +1,33 @@
+interface GenerateComposeOptions {
+    ddlPath: string;
+    auditId: string;
+    apiUrl: string;
+    authToken: string;
+    workerImage: string;
+    postgresImage?: string;
+}
+interface WorkerOptions {
+    composePath: string;
+    tmpTokenPath?: string;
+}
+export declare const MIN_COMPOSE_VERSION = "2.20.0";
+/**
+ * Verify the installed Docker Compose is >= MIN_COMPOSE_VERSION.
+ *
+ * Runs `docker compose version --short`, parses the `major.minor.patch` it prints,
+ * and throws a clear, actionable Error when Docker/Compose is missing, the version
+ * cannot be parsed, or it is older than the minimum. Returns nothing on success.
+ */
+export declare function assertComposeVersion(): void;
+export declare function generateCompose({ ddlPath, auditId, apiUrl, authToken, workerImage, postgresImage }: GenerateComposeOptions): {
+    composePath: string;
+    tmpTokenPath: string;
+};
+export declare function runWorker({ composePath }: WorkerOptions): Promise<void>;
+export declare function cleanupWorker({ composePath, tmpTokenPath }: WorkerOptions): void;
+export interface ContainerError {
+    containerName: string;
+    errorDetails: string;
+}
+export declare function getContainerErrors(composePath: string): ContainerError[];
+export {};

package/dist/src/lib/docker.js

@@ -0,0 +1,139 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { spawn, spawnSync } from 'node:child_process';
+import yaml from 'js-yaml';
+const COMPOSE_TEMPLATE_PATH = path.join(import.meta.dirname, 'worker-compose.yml');
+// `docker compose ... wait` requires Compose v2.20.0+, so audits cannot run below it.
+export const MIN_COMPOSE_VERSION = '2.20.0';
+const MIN_COMPOSE_PARTS = MIN_COMPOSE_VERSION.split('.').map(Number);
+/**
+ * Verify the installed Docker Compose is >= MIN_COMPOSE_VERSION.
+ *
+ * Runs `docker compose version --short`, parses the `major.minor.patch` it prints,
+ * and throws a clear, actionable Error when Docker/Compose is missing, the version
+ * cannot be parsed, or it is older than the minimum. Returns nothing on success.
+ */
+export function assertComposeVersion() {
+    const result = spawnSync('docker', ['compose', 'version', '--short'], { stdio: 'pipe', encoding: 'utf8' });
+    if (result.error || result.status !== 0) {
+        throw new Error(`Docker Compose not found. Install Docker Compose >= ${MIN_COMPOSE_VERSION} to run audits.`);
+    }
+    const match = result.stdout.match(/(\d+)\.(\d+)\.(\d+)/);
+    if (!match) {
+        throw new Error(`Could not determine the Docker Compose version. Ensure Docker Compose >= ${MIN_COMPOSE_VERSION} is installed.`);
+    }
+    const found = [Number(match[1]), Number(match[2]), Number(match[3])];
+    for (let i = 0; i < MIN_COMPOSE_PARTS.length; i++) {
+        if (found[i] > MIN_COMPOSE_PARTS[i])
+            break;
+        if (found[i] < MIN_COMPOSE_PARTS[i]) {
+            throw new Error(`Docker Compose ${found.join('.')} is too old. Argus requires Docker Compose >= ${MIN_COMPOSE_VERSION}. Please upgrade Docker Compose.`);
+        }
+    }
+}
+function toContainerUrl(apiUrl) {
+    return apiUrl.replace(/^(https?:\/\/)(localhost|127\.0\.0\.1)(:\d+)/, '$1host.docker.internal$3');
+}
+function sanitizeLogs(raw) {
+    return raw
+        .split('\n')
+        .slice(0, 50)
+        .join('\n')
+        .replace(/(password|secret|token|key)=[^\s&]*/gi, '$1=[REDACTED]')
+        .replace(/:\/\/[^:]+:[^@]+@/g, '://[REDACTED]:[REDACTED]@');
+}
+export function generateCompose({ ddlPath, auditId, apiUrl, authToken, workerImage, postgresImage }) {
+    const runId = Date.now().toString();
+    const composePath = path.join(os.tmpdir(), `argus-compose-${runId}.yml`);
+    const tmpTokenPath = path.join(os.tmpdir(), `argus-token-${runId}`);
+    fs.writeFileSync(tmpTokenPath, authToken, { mode: 0o600 });
+    const resolvedDdlPath = path.resolve(ddlPath);
+    const ddlFilename = path.basename(ddlPath);
+    const template = fs.readFileSync(COMPOSE_TEMPLATE_PATH, 'utf8').replaceAll('__RUN_ID__', runId);
+    const compose = yaml.load(template);
+    const services = compose.services;
+    if (postgresImage) {
+        services.postgres.image = postgresImage;
+    }
+    services.seeder.image = workerImage;
+    services.worker.image = workerImage;
+    const containerTokenPath = '/run/secrets/auth_token';
+    const auditEnv = {
+        ARGUS_API_URL: toContainerUrl(apiUrl),
+        ARGUS_AUDIT_ID: auditId,
+        ARGUS_AUTH_TOKEN_FILE: containerTokenPath,
+    };
+    const seeder = services.seeder;
+    seeder.volumes = [
+        `${resolvedDdlPath}:/test/${ddlFilename}:ro`,
+        `${tmpTokenPath}:${containerTokenPath}:ro`,
+    ];
+    Object.assign(seeder.environment, { DDL_FILE: `/test/${ddlFilename}`, ...auditEnv });
+    const worker = services.worker;
+    worker.volumes = [
+        `${tmpTokenPath}:${containerTokenPath}:ro`,
+    ];
+    Object.assign(worker.environment, auditEnv);
+    fs.writeFileSync(composePath, yaml.dump(compose));
+    return { composePath, tmpTokenPath };
+}
+function spawnAsync(cmd, args) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(cmd, args, { stdio: 'pipe' });
+        child.on('close', (code) => {
+            if (code !== 0)
+                reject(new Error(`${cmd} ${args.slice(0, 3).join(' ')} failed`));
+            else
+                resolve();
+        });
+        child.on('error', reject);
+    });
+}
+export async function runWorker({ composePath }) {
+    await spawnAsync('docker', ['compose', '-f', composePath, 'up', '-d']);
+    await spawnAsync('docker', ['compose', '-f', composePath, 'wait', 'worker']);
+}
+export function cleanupWorker({ composePath, tmpTokenPath }) {
+    try {
+        spawnSync('docker', ['compose', '-f', composePath, 'down', '-v'], { stdio: 'pipe' });
+        fs.unlinkSync(composePath);
+    }
+    catch {
+        // best-effort cleanup
+    }
+    if (tmpTokenPath) {
+        try {
+            fs.unlinkSync(tmpTokenPath);
+        }
+        catch {
+            // best-effort cleanup
+        }
+    }
+}
+export function getContainerErrors(composePath) {
+    try {
+        const ps = spawnSync('docker', ['compose', '-f', composePath, 'ps', '--format', 'json'], { stdio: 'pipe', encoding: 'utf8' });
+        if (ps.status !== 0)
+            return [];
+        const containers = ps.stdout
+            .trim()
+            .split('\n')
+            .filter(Boolean)
+            .map((line) => JSON.parse(line));
+        return containers
+            .filter((c) => c.ExitCode !== 0)
+            .map((c) => {
+            const logsResult = spawnSync('docker', ['compose', '-f', composePath, 'logs', c.Service, '--no-color', '--tail', '50'], { stdio: 'pipe', encoding: 'utf8' });
+            if (logsResult.status !== 0) {
+                return { containerName: c.Service, errorDetails: `exited with code ${c.ExitCode}` };
+            }
+            const raw = logsResult.stdout.trim() || `exited with code ${c.ExitCode}`;
+            return { containerName: c.Service, errorDetails: sanitizeLogs(raw) };
+        });
+    }
+    catch {
+        return [];
+    }
+}
+//# sourceMappingURL=docker.js.map

package/dist/src/lib/docker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker.js","sourceRoot":"","sources":["../../../src/lib/docker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAC,KAAK,EAAE,SAAS,EAAC,MAAM,oBAAoB,CAAC;AACpD,OAAO,IAAI,MAAM,SAAS,CAAC;AAgB3B,MAAM,qBAAqB,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;AAEnF,sFAAsF;AACtF,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AAC5C,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAA6B,CAAC;AAEjG;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB;IAChC,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,EAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAC,CAAC,CAAC;IAEzG,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACX,uDAAuD,mBAAmB,iBAAiB,CAC9F,CAAC;IACN,CAAC;IAED,MAAM,KAAK,GAAI,MAAM,CAAC,MAAiB,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACrE,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACX,4EAA4E,mBAAmB,gBAAgB,CAClH,CAAC;IACN,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAA6B,CAAC;IACjG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,iBAAiB,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChD,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC;YAAE,MAAM;QAC3C,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACX,kBAAkB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,iDAAiD,mBAAmB,kCAAkC,CAC1I,CAAC;QACN,CAAC;IACL,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,MAAc;IAClC,OAAO,MAAM,CAAC,OAAO,CAAC,8CAA8C,EAAE,0BAA0B,CAAC,CAAC;AACtG,CAAC;AAGD,SAAS,YAAY,CAAC,GAAW;IAC7B,OAAO,GAAG;SACL,KAAK,CAAC,IAAI,CAAC;SACX,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;SACZ,IAAI,CAAC,IAAI,CAAC;SACV,OAAO,CAAC,uCAAuC,EAAE,eAAe,CAAC;SACjE,OAAO,CAAC,oBAAoB,EAAE,2BAA2B,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,EAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAyB;IAIrH,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IACpC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,iBAAiB,KAAK,MAAM,CAAC,CAAC;IAGzE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,eAAe,KAAK,EAAE,CAAC,CAAC;IACpE,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,SAAS,EAAE,EAAC,IAAI,EAAE,KAAK,EAAC,CAAC,CAAC;IAEzD,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAE3C,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAEhG,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAA4B,CAAC;IAC/D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAmD,CAAC;IAE7E,IAAI,aAAa,EAAE,CAAC;QAChB,QAAQ,CAAC,QAAQ,CAAC,KAAK,GAAG,aAAa,CAAC;IAC5C,CAAC;IAED,QAAQ,CAAC,MAAM,CAAC,KAAK,GAAG,WAAW,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,KAAK,GAAG,WAAW,CAAC;IAEpC,MAAM,kBAAkB,GAAG,yBAAyB,CAAC;IACrD,MAAM,QAAQ,GAAG;QACb,aAAa,EAAE,cAAc,CAAC,MAAM,CAAC;QACrC,cAAc,EAAE,OAAO;QACvB,qBAAqB,EAAE,kBAAkB;KAC5C,CAAC;IAEF,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAE/B,MAAM,CAAC,OAAO,GAAG;QACb,GAAG,eAAe,UAAU,WAAW,KAAK;QAC5C,GAAG,YAAY,IAAI,kBAAkB,KAAK;KAC7C,CAAC;IACF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAqC,EAAE,EAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,EAAE,GAAG,QAAQ,EAAC,CAAC,CAAC;IAE7G,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAE/B,MAAM,CAAC,OAAO,GAAG;QACb,GAAG,YAAY,IAAI,kBAAkB,KAAK;KAC7C,CAAC;IACF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAqC,EAAE,QAAQ,CAAC,CAAC;IAEtE,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,OAAO,EAAC,WAAW,EAAE,YAAY,EAAC,CAAC;AACvC,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,IAAc;IAC3C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAC,KAAK,EAAE,MAAM,EAAC,CAAC,CAAC;QAChD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACvB,IAAI,IAAI,KAAK,CAAC;gBAAE,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;;gBAC5E,OAAO,EAAE,CAAC;QACnB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAAC,WAAW,EAAgB;IACxD,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IACvE,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,EAAC,WAAW,EAAE,YAAY,EAAgB;IACpE,IAAI,CAAC;QAED,SAAS,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAC,KAAK,EAAE,MAAM,EAAC,CAAC,CAAC;QACnF,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACL,sBAAsB;IAC1B,CAAC;IACD,IAAI,YAAY,EAAE,CAAC;QACf,IAAI,CAAC;YACD,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACL,sBAAsB;QAC1B,CAAC;IACL,CAAC;AACL,CAAC;AAOD,MAAM,UAAU,kBAAkB,CAAC,WAAmB;IAClD,IAAI,CAAC;QACD,MAAM,EAAE,GAAG,SAAS,CAChB,QAAQ,EACR,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,EACxD,EAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAC,CACpC,CAAC;QACF,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAE/B,MAAM,UAAU,GAAkD,EAAE,CAAC,MAAiB;aACjF,IAAI,EAAE;aACN,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAErC,OAAO,UAAU;aACZ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC;aAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACP,MAAM,UAAU,GAAG,SAAS,CACxB,QAAQ,EACR,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,EAC/E,EAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAC,CACpC,CAAC;YACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,EAAC,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,oBAAoB,CAAC,CAAC,QAAQ,EAAE,EAAC,CAAC;YACtF,CAAC;YACD,MAAM,GAAG,GAAI,UAAU,CAAC,MAAiB,CAAC,IAAI,EAAE,IAAI,oBAAoB,CAAC,CAAC,QAAQ,EAAE,CAAC;YACrF,OAAO,EAAC,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,YAAY,CAAC,GAAG,CAAC,EAAC,CAAC;QACvE,CAAC,CAAC,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,EAAE,CAAC;IACd,CAAC;AACL,CAAC"}

package/dist/src/lib/http.d.ts

@@ -0,0 +1,2 @@
+import { Agent } from 'undici';
+export declare const agent: Agent;

package/dist/src/lib/http.js

@@ -0,0 +1,4 @@
+import { Agent } from 'undici';
+// Keep idle sockets for 10s (reuse within a command), prune before they go stale.
+export const agent = new Agent({ keepAliveTimeout: 10_000, keepAliveMaxTimeout: 30_000 });
+//# sourceMappingURL=http.js.map

package/dist/src/lib/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/lib/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,KAAK,EAAC,MAAM,QAAQ,CAAC;AAE7B,kFAAkF;AAClF,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,EAAC,gBAAgB,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,EAAC,CAAC,CAAC"}

package/dist/src/lib/keychain.d.ts

@@ -0,0 +1,4 @@
+export declare function getAccessToken(): Promise<string | null>;
+export declare function getRefreshToken(): Promise<string | null>;
+export declare function setTokens(accessToken: string, refreshToken: string): Promise<void>;
+export declare function clearTokens(): Promise<void>;

package/dist/src/lib/keychain.js

@@ -0,0 +1,46 @@
+// Thin wrapper around @napi-rs/keyring for secure OS-level token storage.
+import { Entry } from '@napi-rs/keyring';
+const SERVICE = 'argus-cli';
+const ACCESS_TOKEN_ACCOUNT = 'access_token';
+const REFRESH_TOKEN_ACCOUNT = 'refresh_token';
+export async function getAccessToken() {
+    try {
+        const entry = new Entry(SERVICE, ACCESS_TOKEN_ACCOUNT);
+        return entry.getPassword() ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+export async function getRefreshToken() {
+    try {
+        const entry = new Entry(SERVICE, REFRESH_TOKEN_ACCOUNT);
+        return entry.getPassword() ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+export async function setTokens(accessToken, refreshToken) {
+    const accessEntry = new Entry(SERVICE, ACCESS_TOKEN_ACCOUNT);
+    accessEntry.setPassword(accessToken);
+    const refreshEntry = new Entry(SERVICE, REFRESH_TOKEN_ACCOUNT);
+    refreshEntry.setPassword(refreshToken);
+}
+export async function clearTokens() {
+    try {
+        const accessEntry = new Entry(SERVICE, ACCESS_TOKEN_ACCOUNT);
+        accessEntry.deletePassword();
+    }
+    catch {
+        // ignore if already absent
+    }
+    try {
+        const refreshEntry = new Entry(SERVICE, REFRESH_TOKEN_ACCOUNT);
+        refreshEntry.deletePassword();
+    }
+    catch {
+        // ignore if already absent
+    }
+}
+//# sourceMappingURL=keychain.js.map

package/dist/src/lib/keychain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../../../src/lib/keychain.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,OAAO,EAAC,KAAK,EAAC,MAAM,kBAAkB,CAAA;AAEtC,MAAM,OAAO,GAAG,WAAW,CAAA;AAC3B,MAAM,oBAAoB,GAAG,cAAc,CAAA;AAC3C,MAAM,qBAAqB,GAAG,eAAe,CAAA;AAE7C,MAAM,CAAC,KAAK,UAAU,cAAc;IAChC,IAAI,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAA;QACtD,OAAO,KAAK,CAAC,WAAW,EAAE,IAAI,IAAI,CAAA;IACtC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAA;IACf,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACjC,IAAI,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAA;QACvD,OAAO,KAAK,CAAC,WAAW,EAAE,IAAI,IAAI,CAAA;IACtC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAA;IACf,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,WAAmB,EAAE,YAAoB;IACrE,MAAM,WAAW,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAA;IAC5D,WAAW,CAAC,WAAW,CAAC,WAAW,CAAC,CAAA;IACpC,MAAM,YAAY,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAA;IAC9D,YAAY,CAAC,WAAW,CAAC,YAAY,CAAC,CAAA;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAC7B,IAAI,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAA;QAC5D,WAAW,CAAC,cAAc,EAAE,CAAA;IAChC,CAAC;IAAC,MAAM,CAAC;QACL,2BAA2B;IAC/B,CAAC;IACD,IAAI,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAA;QAC9D,YAAY,CAAC,cAAc,EAAE,CAAA;IACjC,CAAC;IAAC,MAAM,CAAC;QACL,2BAA2B;IAC/B,CAAC;AACL,CAAC"}

package/dist/src/lib/registry.d.ts

@@ -0,0 +1 @@
+export declare function resolvePostgresImage(version: string): Promise<string>;

package/dist/src/lib/registry.js

@@ -0,0 +1,31 @@
+import { request } from 'undici';
+import { agent } from './http.js';
+const DOCKER_HUB_TAGS_URL = 'https://hub.docker.com/v2/repositories/library/postgres/tags';
+// Debian/Alpine flavor suffixes published for the official postgres image.
+const FLAVOR_PATTERN = /-(alpine|bookworm|bullseye|trixie|slim)/;
+async function tagExists(tag) {
+    let statusCode;
+    try {
+        const response = await request(`${DOCKER_HUB_TAGS_URL}/${encodeURIComponent(tag)}`, { dispatcher: agent });
+        statusCode = response.statusCode;
+        await response.body.dump();
+    }
+    catch (err) {
+        throw new Error(`Could not verify postgres version against Docker Hub: ${err.message}`);
+    }
+    if (statusCode === 200)
+        return true;
+    if (statusCode === 404)
+        return false;
+    throw new Error(`Could not verify postgres version against Docker Hub: unexpected HTTP ${statusCode}`);
+}
+export async function resolvePostgresImage(version) {
+    const candidates = FLAVOR_PATTERN.test(version) ? [version] : [`${version}-alpine`, version];
+    for (const tag of candidates) {
+        if (await tagExists(tag)) {
+            return `postgres:${tag}`;
+        }
+    }
+    throw new Error(`Postgres version '${version}' does not exist on Docker Hub (tried tags: ${candidates.join(', ')})`);
+}
+//# sourceMappingURL=registry.js.map

package/dist/src/lib/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/lib/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,OAAO,EAAC,MAAM,QAAQ,CAAC;AAC/B,OAAO,EAAC,KAAK,EAAC,MAAM,WAAW,CAAC;AAEhC,MAAM,mBAAmB,GAAG,8DAA8D,CAAC;AAE3F,2EAA2E;AAC3E,MAAM,cAAc,GAAG,yCAAyC,CAAC;AAEjE,KAAK,UAAU,SAAS,CAAC,GAAW;IAChC,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,mBAAmB,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,EAAE,EAAC,UAAU,EAAE,KAAK,EAAC,CAAC,CAAC;QACzG,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;QACjC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,yDAA0D,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,UAAU,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,UAAU,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,IAAI,KAAK,CAAC,yEAAyE,UAAU,EAAE,CAAC,CAAC;AAC3G,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAe;IACtD,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,SAAS,EAAE,OAAO,CAAC,CAAC;IAE7F,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,MAAM,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,YAAY,GAAG,EAAE,CAAC;QAC7B,CAAC;IACL,CAAC;IAED,MAAM,IAAI,KAAK,CACX,qBAAqB,OAAO,+CAA+C,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACtG,CAAC;AACN,CAAC"}

package/dist/src/lib/worker-compose.yml

@@ -0,0 +1,80 @@
+version: '3.9'
+
+name: argus-__RUN_ID__
+
+services:
+  postgres:
+    container_name: argus-postgres-__RUN_ID__
+    image: postgres:18-alpine
+    restart: "no"
+    shm_size: '1gb'
+    ulimits:
+      nofile:
+        soft: 65536
+        hard: 65536
+    environment:
+      POSTGRES_USER: argus
+      POSTGRES_PASSWORD: argus
+      POSTGRES_DB: argus
+    volumes:
+      - pg_data:/var/lib/postgresql/data
+    healthcheck:
+      test: [ "CMD-SHELL", "pg_isready -U argus" ]
+      interval: 2s
+      timeout: 5s
+      retries: 10
+    deploy:
+      resources:
+        limits:
+          cpus: '2.0'
+          memory: 2G
+          pids: 200
+        reservations:
+          memory: 512M
+
+  seeder:
+    container_name: argus-seeder-__RUN_ID__
+    # Placeholder — always overwritten by generateCompose from config.ts
+    image: argus-worker:placeholder
+    command: argus-seeder
+    restart: "no"
+    ulimits:
+      nofile:
+        soft: 65536
+        hard: 65536
+    depends_on:
+      postgres:
+        condition: service_healthy
+    environment:
+      DATABASE_URL: postgres://argus:argus@postgres:5432/argus?sslmode=disable
+    deploy:
+      resources:
+        limits:
+          cpus: '1.0'
+          memory: 512M
+          pids: 100
+
+  worker:
+    container_name: argus-worker-__RUN_ID__
+    # Placeholder — always overwritten by generateCompose from config.ts
+    image: argus-worker:placeholder
+    command: argus-worker
+    restart: "no"
+    ulimits:
+      nofile:
+        soft: 65536
+        hard: 65536
+    environment:
+      DATABASE_URL: postgres://argus:argus@postgres:5432/argus?sslmode=disable
+    depends_on:
+      seeder:
+        condition: service_completed_successfully
+    deploy:
+      resources:
+        limits:
+          cpus: '1.0'
+          memory: 1G
+          pids: 100
+
+volumes:
+  pg_data:

package/dist/src/types/audit.d.ts

@@ -0,0 +1,8 @@
+export interface AuditCreateRequest {
+    ddlPath: string;
+    queryPath: string;
+}
+export interface AuditCreatedResponse {
+    public_id: string;
+    status: string;
+}

package/dist/src/types/audit.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=audit.js.map

package/dist/src/types/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/types/audit.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,62 @@
+{
+  "name": "@argusaudit/cli",
+  "version": "0.1.0",
+  "description": "ARGUS — SQL Stress-Test Auditor. Benchmark-as-a-Service CLI tool that proves SQL optimizations with hard numbers.",
+  "type": "module",
+  "main": "dist/index.js",
+  "exports": {
+    ".": "./dist/index.js"
+  },
+  "bin": {
+    "argus": "./dist/bin/argus.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc && cp src/lib/worker-compose.yml dist/src/lib/worker-compose.yml",
+    "prepublishOnly": "pnpm run build",
+    "test": "node --test",
+    "lint": "eslint ."
+  },
+  "keywords": [
+    "sql",
+    "benchmark",
+    "performance",
+    "postgres",
+    "audit",
+    "optimization"
+  ],
+  "author": "the-mzakrzewski",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/the-mzakrzewski/argus-cli.git"
+  },
+  "homepage": "https://github.com/the-mzakrzewski/argus-cli#readme",
+  "bugs": {
+    "url": "https://github.com/the-mzakrzewski/argus-cli/issues"
+  },
+  "engines": {
+    "node": ">=24.0.0"
+  },
+  "packageManager": "pnpm@10.7.0",
+  "dependencies": {
+    "@napi-rs/keyring": "1.2.0",
+    "chalk": "5.6.2",
+    "commander": "14.0.3",
+    "js-yaml": "4.1.1",
+    "open": "11.0.0",
+    "ora": "9.3.0",
+    "undici": "7.24.5"
+  },
+  "devDependencies": {
+    "@types/js-yaml": "4.0.9",
+    "@types/node": "25.5.0",
+    "eslint": "10.0.3",
+    "typescript": "5.9.3"
+  }
+}