@elie-laloum/outpost 2.0.0 → 4.0.0

package/dist/cli/recovery-command.d.ts

@@ -0,0 +1,2 @@
+import type { CliInvocation } from "./main.types.ts";
+export declare function recoveryCommand({ values, positionals, }: CliInvocation): Promise<void>;

package/dist/cli/recovery-command.js

@@ -0,0 +1,93 @@
+import { recoveryRestoreCommand } from "./recovery-restore-command.js";
+import { recoveryPruneCommand } from "./recovery-prune-command.js";
+import { recoveryVerifyCommand } from "./recovery-verify-command.js";
+import { inspectRecovery } from "../application/recovery-inspection.js";
+import { invariant, positive } from "../domain/errors.js";
+export async function recoveryCommand({ values, positionals, }) {
+    if (positionals[1] === "restore")
+        return recoveryRestoreCommand({ values, positionals });
+    if (positionals[1] === "prune")
+        return recoveryPruneCommand({ values, positionals });
+    if (positionals[1] === "verify")
+        return recoveryVerifyCommand({ values, positionals });
+    invariant(positionals.length === 2 && positionals[1] === "inspect", "Usage: outpost recovery inspect [--repository PATH] [--max-entries NUMBER] [--git] [--locks] [--resources] [--json]");
+    for (const key of Object.keys(values))
+        invariant([
+            "repository",
+            "max-entries",
+            "git",
+            "locks",
+            "resources",
+            "json",
+        ].includes(key), `Unsupported recovery option: --${key}`);
+    const maxEntries = values["max-entries"] === undefined
+        ? undefined
+        : positive(Number(values["max-entries"]), "max-entries");
+    const report = await inspectRecovery({
+        ...(values.repository !== undefined
+            ? { repository: values.repository }
+            : {}),
+        ...(maxEntries !== undefined ? { maxEntries } : {}),
+        ...(values.git ? { git: true } : {}),
+        ...(values.resources ? { resources: true } : {}),
+        ...(values.locks ? { locks: true } : {}),
+    });
+    if (values.json)
+        process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+    else {
+        process.stdout.write(`Outpost recovery inspection — ${JSON.stringify(report.repository)}\n`);
+        for (const category of report.categories) {
+            process.stdout.write(`${category.name}: ${category.entries.length} listed entries\n`);
+            for (const entry of category.entries)
+                process.stdout.write(`  ${JSON.stringify(entry.name)} | ${entry.kind} | ${entry.bytes} bytes | ${entry.files} files | ${entry.symlinks} symlinks | ${entry.modifiedAt ?? "unknown time"} | ${entry.complete ? "complete" : "partial"}\n`);
+        }
+        if (report.git) {
+            process.stdout.write(`Workspace Git inspection: ${report.git.complete ? "complete for listed entries" : "partial"}\n`);
+            for (const workspace of report.git.workspaces) {
+                const detail = workspace.state === "registered"
+                    ? `${workspace.branch === null ? "detached HEAD" : JSON.stringify(workspace.branch)} | ${workspace.dirty ? "dirty" : "clean"} | ${workspace.head}${workspace.locked ? " | Git locked" : ""}`
+                    : workspace.state;
+                process.stdout.write(`  ${JSON.stringify(workspace.name)} | ${detail}\n`);
+            }
+            for (const issue of report.git.issues)
+                process.stdout.write(`[PARTIAL] ${issue.code}: ${JSON.stringify(issue.path)}\n`);
+            process.stdout.write("Git status excludes ignored files. Clean does not mean safe to delete.\n");
+        }
+        if (report.locks) {
+            process.stdout.write(`Lock PID inspection (local host): ${report.locks.complete ? "complete for listed entries" : "partial"}\n`);
+            for (const lock of report.locks.entries) {
+                const pid = "pid" in lock ? ` | PID ${lock.pid}` : "";
+                const reason = "reason" in lock ? ` | ${lock.reason}` : "";
+                process.stdout.write(`  ${JSON.stringify(lock.name)} | ${lock.state}${pid}${reason}${lock.ownership ? ` | ownership ${lock.ownership.status}: ${lock.ownership.reason}` : ""}\n`);
+            }
+            for (const issue of report.locks.issues)
+                process.stdout.write(`[PARTIAL] ${issue.code}: ${JSON.stringify(issue.path)}\n`);
+            process.stdout.write("PID presence does not prove lock ownership; PID absence does not authorize deletion.\n");
+        }
+        if (report.resources) {
+            process.stdout.write(`Recorded sandbox activity: ${report.resources.complete ? "complete for listed records" : "partial"}\n`);
+            for (const entry of report.resources.entries) {
+                const detail = entry.record
+                    ? `${JSON.stringify(entry.record.provider)} | ${entry.record.phase} | ${entry.record.operations.map((operation) => `${operation.kind} (${operation.count})`).join(", ") || "idle"}`
+                    : "unreadable";
+                process.stdout.write(`  ${JSON.stringify(entry.path)} | ${detail} | ownership ${entry.ownership.status}: ${entry.ownership.reason}\n`);
+            }
+            for (const issue of report.resources.issues)
+                process.stdout.write(`[PARTIAL] ${issue.code}: ${JSON.stringify(issue.path)}\n`);
+            process.stdout.write("Recorded activity is a snapshot; stale or unknown ownership does not authorize resource deletion. Provider resources are not queried.\n");
+        }
+        for (const issue of report.issues)
+            process.stdout.write(`[PARTIAL] ${issue.code}: ${JSON.stringify(issue.path)}\n`);
+        process.stdout.write(`Total observed: ${report.usage.bytes} bytes in ${report.usage.files} files; ${report.scannedEntries}/${report.maxEntries} entries scanned.\n`);
+        process.stdout.write(`${report.complete ? "Inventory complete." : "Inventory incomplete; totals are partial."} File sizes are logical bytes; symlink targets are excluded.\n`);
+        process.stdout.write(report.git || report.locks || report.resources
+            ? "Activity and recovery integrity are unverified. No raw file contents were displayed or files removed.\n"
+            : "Activity and recovery integrity are unverified. No files were read for content or removed.\n");
+    }
+    if (!report.complete ||
+        report.git?.complete === false ||
+        report.locks?.complete === false ||
+        report.resources?.complete === false)
+        process.exitCode = 1;
+}
+//# sourceMappingURL=recovery-command.js.map

package/dist/cli/recovery-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-command.js","sourceRoot":"","sources":["../../src/cli/recovery-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AACxE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAG1D,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,MAAM,EACN,WAAW,GACG;IACd,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,SAAS;QAC9B,OAAO,sBAAsB,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACzD,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,OAAO;QAC5B,OAAO,oBAAoB,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACvD,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,QAAQ;QAC7B,OAAO,qBAAqB,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACxD,SAAS,CACP,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,SAAS,EACxD,qHAAqH,CACtH,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QACnC,SAAS,CACP;YACE,YAAY;YACZ,aAAa;YACb,KAAK;YACL,OAAO;YACP,WAAW;YACX,MAAM;SACP,CAAC,QAAQ,CAAC,GAAG,CAAC,EACf,kCAAkC,GAAG,EAAE,CACxC,CAAC;IACJ,MAAM,UAAU,GACd,MAAM,CAAC,aAAa,CAAC,KAAK,SAAS;QACjC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;QACnC,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS;YACjC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE;YACnC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;SACzE,CAAC;QACJ,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iCAAiC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CACvE,CAAC;QACF,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACzC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,OAAO,CAAC,MAAM,mBAAmB,CAChE,CAAC;YACF,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,OAAO;gBAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,QAAQ,eAAe,KAAK,CAAC,UAAU,IAAI,cAAc,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,IAAI,CACpN,CAAC;QACN,CAAC;QACD,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,6BAA6B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,SAAS,IAAI,CACjG,CAAC;YACF,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;gBAC9C,MAAM,MAAM,GACV,SAAS,CAAC,KAAK,KAAK,YAAY;oBAC9B,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,MAAM,SAAS,CAAC,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE;oBAC5L,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC;gBACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,MAAM,IAAI,CACpD,CAAC;YACJ,CAAC;YACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM;gBACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,aAAa,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAC3D,CAAC;YACJ,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0EAA0E,CAC3E,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,qCAAqC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,SAAS,IAAI,CAC3G,CAAC;YACF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBACxC,MAAM,GAAG,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtD,MAAM,MAAM,GAAG,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,GAAG,GAAG,GAAG,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAC5J,CAAC;YACJ,CAAC;YACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM;gBACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,aAAa,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAC3D,CAAC;YACJ,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,wFAAwF,CACzF,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,8BAA8B,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,SAAS,IAAI,CACxG,CAAC;YACF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;gBAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM;oBACzB,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,MAAM,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE;oBACnL,CAAC,CAAC,YAAY,CAAC;gBACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,MAAM,gBAAgB,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,KAAK,CAAC,SAAS,CAAC,MAAM,IAAI,CACjH,CAAC;YACJ,CAAC;YACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM;gBACzC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,aAAa,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAC3D,CAAC;YACJ,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,yIAAyI,CAC1I,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM;YAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,aAAa,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAC3D,CAAC;QACJ,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mBAAmB,MAAM,CAAC,KAAK,CAAC,KAAK,aAAa,MAAM,CAAC,KAAK,CAAC,KAAK,WAAW,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,UAAU,qBAAqB,CAC/I,CAAC;QACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,2CAA2C,gEAAgE,CACzJ,CAAC;QACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,SAAS;YAC5C,CAAC,CAAC,yGAAyG;YAC3G,CAAC,CAAC,8FAA8F,CACnG,CAAC;IACJ,CAAC;IACD,IACE,CAAC,MAAM,CAAC,QAAQ;QAChB,MAAM,CAAC,GAAG,EAAE,QAAQ,KAAK,KAAK;QAC9B,MAAM,CAAC,KAAK,EAAE,QAAQ,KAAK,KAAK;QAChC,MAAM,CAAC,SAAS,EAAE,QAAQ,KAAK,KAAK;QAEpC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACzB,CAAC","sourcesContent":["import { recoveryRestoreCommand } from \"./recovery-restore-command.ts\";\nimport { recoveryPruneCommand } from \"./recovery-prune-command.ts\";\nimport { recoveryVerifyCommand } from \"./recovery-verify-command.ts\";\nimport { inspectRecovery } from \"../application/recovery-inspection.ts\";\nimport { invariant, positive } from \"../domain/errors.ts\";\nimport type { CliInvocation } from \"./main.types.ts\";\n\nexport async function recoveryCommand({\n  values,\n  positionals,\n}: CliInvocation): Promise<void> {\n  if (positionals[1] === \"restore\")\n    return recoveryRestoreCommand({ values, positionals });\n  if (positionals[1] === \"prune\")\n    return recoveryPruneCommand({ values, positionals });\n  if (positionals[1] === \"verify\")\n    return recoveryVerifyCommand({ values, positionals });\n  invariant(\n    positionals.length === 2 && positionals[1] === \"inspect\",\n    \"Usage: outpost recovery inspect [--repository PATH] [--max-entries NUMBER] [--git] [--locks] [--resources] [--json]\",\n  );\n  for (const key of Object.keys(values))\n    invariant(\n      [\n        \"repository\",\n        \"max-entries\",\n        \"git\",\n        \"locks\",\n        \"resources\",\n        \"json\",\n      ].includes(key),\n      `Unsupported recovery option: --${key}`,\n    );\n  const maxEntries =\n    values[\"max-entries\"] === undefined\n      ? undefined\n      : positive(Number(values[\"max-entries\"]), \"max-entries\");\n  const report = await inspectRecovery({\n    ...(values.repository !== undefined\n      ? { repository: values.repository }\n      : {}),\n    ...(maxEntries !== undefined ? { maxEntries } : {}),\n    ...(values.git ? { git: true } : {}),\n    ...(values.resources ? { resources: true } : {}),\n    ...(values.locks ? { locks: true } : {}),\n  });\n  if (values.json) process.stdout.write(`${JSON.stringify(report, null, 2)}\\n`);\n  else {\n    process.stdout.write(\n      `Outpost recovery inspection — ${JSON.stringify(report.repository)}\\n`,\n    );\n    for (const category of report.categories) {\n      process.stdout.write(\n        `${category.name}: ${category.entries.length} listed entries\\n`,\n      );\n      for (const entry of category.entries)\n        process.stdout.write(\n          `  ${JSON.stringify(entry.name)} | ${entry.kind} | ${entry.bytes} bytes | ${entry.files} files | ${entry.symlinks} symlinks | ${entry.modifiedAt ?? \"unknown time\"} | ${entry.complete ? \"complete\" : \"partial\"}\\n`,\n        );\n    }\n    if (report.git) {\n      process.stdout.write(\n        `Workspace Git inspection: ${report.git.complete ? \"complete for listed entries\" : \"partial\"}\\n`,\n      );\n      for (const workspace of report.git.workspaces) {\n        const detail =\n          workspace.state === \"registered\"\n            ? `${workspace.branch === null ? \"detached HEAD\" : JSON.stringify(workspace.branch)} | ${workspace.dirty ? \"dirty\" : \"clean\"} | ${workspace.head}${workspace.locked ? \" | Git locked\" : \"\"}`\n            : workspace.state;\n        process.stdout.write(\n          `  ${JSON.stringify(workspace.name)} | ${detail}\\n`,\n        );\n      }\n      for (const issue of report.git.issues)\n        process.stdout.write(\n          `[PARTIAL] ${issue.code}: ${JSON.stringify(issue.path)}\\n`,\n        );\n      process.stdout.write(\n        \"Git status excludes ignored files. Clean does not mean safe to delete.\\n\",\n      );\n    }\n    if (report.locks) {\n      process.stdout.write(\n        `Lock PID inspection (local host): ${report.locks.complete ? \"complete for listed entries\" : \"partial\"}\\n`,\n      );\n      for (const lock of report.locks.entries) {\n        const pid = \"pid\" in lock ? ` | PID ${lock.pid}` : \"\";\n        const reason = \"reason\" in lock ? ` | ${lock.reason}` : \"\";\n        process.stdout.write(\n          `  ${JSON.stringify(lock.name)} | ${lock.state}${pid}${reason}${lock.ownership ? ` | ownership ${lock.ownership.status}: ${lock.ownership.reason}` : \"\"}\\n`,\n        );\n      }\n      for (const issue of report.locks.issues)\n        process.stdout.write(\n          `[PARTIAL] ${issue.code}: ${JSON.stringify(issue.path)}\\n`,\n        );\n      process.stdout.write(\n        \"PID presence does not prove lock ownership; PID absence does not authorize deletion.\\n\",\n      );\n    }\n    if (report.resources) {\n      process.stdout.write(\n        `Recorded sandbox activity: ${report.resources.complete ? \"complete for listed records\" : \"partial\"}\\n`,\n      );\n      for (const entry of report.resources.entries) {\n        const detail = entry.record\n          ? `${JSON.stringify(entry.record.provider)} | ${entry.record.phase} | ${entry.record.operations.map((operation) => `${operation.kind} (${operation.count})`).join(\", \") || \"idle\"}`\n          : \"unreadable\";\n        process.stdout.write(\n          `  ${JSON.stringify(entry.path)} | ${detail} | ownership ${entry.ownership.status}: ${entry.ownership.reason}\\n`,\n        );\n      }\n      for (const issue of report.resources.issues)\n        process.stdout.write(\n          `[PARTIAL] ${issue.code}: ${JSON.stringify(issue.path)}\\n`,\n        );\n      process.stdout.write(\n        \"Recorded activity is a snapshot; stale or unknown ownership does not authorize resource deletion. Provider resources are not queried.\\n\",\n      );\n    }\n    for (const issue of report.issues)\n      process.stdout.write(\n        `[PARTIAL] ${issue.code}: ${JSON.stringify(issue.path)}\\n`,\n      );\n    process.stdout.write(\n      `Total observed: ${report.usage.bytes} bytes in ${report.usage.files} files; ${report.scannedEntries}/${report.maxEntries} entries scanned.\\n`,\n    );\n    process.stdout.write(\n      `${report.complete ? \"Inventory complete.\" : \"Inventory incomplete; totals are partial.\"} File sizes are logical bytes; symlink targets are excluded.\\n`,\n    );\n    process.stdout.write(\n      report.git || report.locks || report.resources\n        ? \"Activity and recovery integrity are unverified. No raw file contents were displayed or files removed.\\n\"\n        : \"Activity and recovery integrity are unverified. No files were read for content or removed.\\n\",\n    );\n  }\n  if (\n    !report.complete ||\n    report.git?.complete === false ||\n    report.locks?.complete === false ||\n    report.resources?.complete === false\n  )\n    process.exitCode = 1;\n}\n"]}

package/dist/cli/recovery-prune-command.d.ts

@@ -0,0 +1,2 @@
+import type { CliInvocation } from "./main.types.ts";
+export declare function recoveryPruneCommand({ values, positionals, }: CliInvocation): Promise<void>;

package/dist/cli/recovery-prune-command.js

@@ -0,0 +1,34 @@
+import { recoveryRetentionLimits } from "../application/recovery-retention.constants.js";
+import { planRecoveryRetention, pruneRecoveryRetention, } from "../application/recovery-retention.js";
+import { retentionPolicy } from "../application/recovery-retention-policy.js";
+import { invariant } from "../domain/errors.js";
+import { readInspectionFile } from "../infrastructure/inspection-file.js";
+import { resolve } from "node:path";
+export async function recoveryPruneCommand({ values, positionals, }) {
+    invariant(positionals.length === 2 && !!values.policy, "Usage: outpost recovery prune --policy FILE [--repository PATH] [--apply] [--json]");
+    for (const key of Object.keys(values))
+        invariant(["policy", "repository", "apply", "json"].includes(key), `Unsupported recovery prune option: --${key}`);
+    const policy = JSON.parse((await readInspectionFile(resolve(values.policy), recoveryRetentionLimits.maxPolicyBytes)).toString("utf8"));
+    retentionPolicy(policy);
+    const plan = await planRecoveryRetention({
+        policy,
+        ...(values.repository ? { repository: values.repository } : {}),
+    });
+    const result = values.apply ? await pruneRecoveryRetention(plan) : undefined;
+    const after = result?.after ?? plan;
+    if (values.json)
+        process.stdout.write(`${JSON.stringify({ dryRun: !values.apply, plan, ...(result ? { result } : {}) }, null, 2)}\n`);
+    else {
+        process.stdout.write(`Outpost retention ${values.apply ? "apply" : "dry run"} — ${JSON.stringify(plan.repository)}\n`);
+        for (const entry of plan.entries)
+            process.stdout.write(`${entry.eligible ? "CANDIDATE" : "RETAIN"} ${JSON.stringify(entry.path)} | ${entry.reason} | ${entry.bytes} bytes\n`);
+        for (const path of result?.removed ?? [])
+            process.stdout.write(`REMOVED ${JSON.stringify(path)}\n`);
+        for (const entry of result?.retained ?? [])
+            process.stdout.write(`RETAIN ${JSON.stringify(entry.path)} | ${entry.reason}\n`);
+        process.stdout.write(`Observed ${after.usageBytes} logical bytes; projected ${after.projectedBytes}; projected quota ${after.quota}. Branches and recovery artifacts are retained.\n`);
+    }
+    if (!after.complete || after.quota !== "within" || result?.retained.length)
+        process.exitCode = 1;
+}
+//# sourceMappingURL=recovery-prune-command.js.map

package/dist/cli/recovery-prune-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-prune-command.js","sourceRoot":"","sources":["../../src/cli/recovery-prune-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAC;AACzF,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,6CAA6C,CAAC;AAC9E,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,MAAM,EACN,WAAW,GACG;IACd,SAAS,CACP,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,EAC3C,oFAAoF,CACrF,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QACnC,SAAS,CACP,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EACvD,wCAAwC,GAAG,EAAE,CAC9C,CAAC;IACJ,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAChC,CACE,MAAM,kBAAkB,CACtB,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EACtB,uBAAuB,CAAC,cAAc,CACvC,CACF,CAAC,QAAQ,CAAC,MAAM,CAAC,CACnB,CAAC;IACF,eAAe,CAAC,MAAM,CAAC,CAAC;IACxB,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC;QACvC,MAAM;QACN,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,MAAM,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,IAAI,CAAC;IACpC,IAAI,MAAM,CAAC,IAAI;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAC/F,CAAC;SACC,CAAC;QACJ,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,qBAAqB,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CACjG,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO;YAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,MAAM,MAAM,KAAK,CAAC,KAAK,UAAU,CACtH,CAAC;QACJ,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,OAAO,IAAI,EAAE;YACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,EAAE;YACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,UAAU,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,MAAM,IAAI,CAC3D,CAAC;QACJ,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,YAAY,KAAK,CAAC,UAAU,6BAA6B,KAAK,CAAC,cAAc,qBAAqB,KAAK,CAAC,KAAK,mDAAmD,CACjK,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,EAAE,QAAQ,CAAC,MAAM;QACxE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACzB,CAAC","sourcesContent":["import { recoveryRetentionLimits } from \"../application/recovery-retention.constants.ts\";\nimport {\n  planRecoveryRetention,\n  pruneRecoveryRetention,\n} from \"../application/recovery-retention.ts\";\nimport { retentionPolicy } from \"../application/recovery-retention-policy.ts\";\nimport { invariant } from \"../domain/errors.ts\";\nimport { readInspectionFile } from \"../infrastructure/inspection-file.ts\";\nimport { resolve } from \"node:path\";\nimport type { CliInvocation } from \"./main.types.ts\";\n\nexport async function recoveryPruneCommand({\n  values,\n  positionals,\n}: CliInvocation): Promise<void> {\n  invariant(\n    positionals.length === 2 && !!values.policy,\n    \"Usage: outpost recovery prune --policy FILE [--repository PATH] [--apply] [--json]\",\n  );\n  for (const key of Object.keys(values))\n    invariant(\n      [\"policy\", \"repository\", \"apply\", \"json\"].includes(key),\n      `Unsupported recovery prune option: --${key}`,\n    );\n  const policy: unknown = JSON.parse(\n    (\n      await readInspectionFile(\n        resolve(values.policy),\n        recoveryRetentionLimits.maxPolicyBytes,\n      )\n    ).toString(\"utf8\"),\n  );\n  retentionPolicy(policy);\n  const plan = await planRecoveryRetention({\n    policy,\n    ...(values.repository ? { repository: values.repository } : {}),\n  });\n  const result = values.apply ? await pruneRecoveryRetention(plan) : undefined;\n  const after = result?.after ?? plan;\n  if (values.json)\n    process.stdout.write(\n      `${JSON.stringify({ dryRun: !values.apply, plan, ...(result ? { result } : {}) }, null, 2)}\\n`,\n    );\n  else {\n    process.stdout.write(\n      `Outpost retention ${values.apply ? \"apply\" : \"dry run\"} — ${JSON.stringify(plan.repository)}\\n`,\n    );\n    for (const entry of plan.entries)\n      process.stdout.write(\n        `${entry.eligible ? \"CANDIDATE\" : \"RETAIN\"} ${JSON.stringify(entry.path)} | ${entry.reason} | ${entry.bytes} bytes\\n`,\n      );\n    for (const path of result?.removed ?? [])\n      process.stdout.write(`REMOVED ${JSON.stringify(path)}\\n`);\n    for (const entry of result?.retained ?? [])\n      process.stdout.write(\n        `RETAIN ${JSON.stringify(entry.path)} | ${entry.reason}\\n`,\n      );\n    process.stdout.write(\n      `Observed ${after.usageBytes} logical bytes; projected ${after.projectedBytes}; projected quota ${after.quota}. Branches and recovery artifacts are retained.\\n`,\n    );\n  }\n  if (!after.complete || after.quota !== \"within\" || result?.retained.length)\n    process.exitCode = 1;\n}\n"]}

package/dist/cli/recovery-restore-command.d.ts

@@ -0,0 +1,2 @@
+import type { CliInvocation } from "./main.types.ts";
+export declare function recoveryRestoreCommand({ values, positionals, }: CliInvocation): Promise<void>;

package/dist/cli/recovery-restore-command.js

@@ -0,0 +1,34 @@
+import { planRecoveryRestore, restoreRecoveryTransfer, } from "../application/recovery-restore.js";
+import { invariant, positive } from "../domain/errors.js";
+export async function recoveryRestoreCommand({ values, positionals, }) {
+    invariant(positionals.length === 2 &&
+        !!values.directory &&
+        !!values.repository &&
+        !!values.destination &&
+        (values.side === "previous" || values.side === "incoming"), "Usage: outpost recovery restore --directory TRANSFER_PATH --repository PATH --destination NEW_PATH --side previous|incoming [--max-bytes NUMBER] [--apply] [--json]");
+    for (const key of Object.keys(values))
+        invariant([
+            "directory",
+            "repository",
+            "destination",
+            "side",
+            "max-bytes",
+            "apply",
+            "json",
+        ].includes(key), `Unsupported recovery restore option: --${key}`);
+    const plan = await planRecoveryRestore({
+        directory: values.directory,
+        repository: values.repository,
+        destination: values.destination,
+        side: values.side,
+        ...(values["max-bytes"] === undefined
+            ? {}
+            : { maxBytes: positive(Number(values["max-bytes"]), "max-bytes") }),
+    });
+    const result = values.apply ? await restoreRecoveryTransfer(plan) : plan;
+    if (values.json)
+        process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+    else
+        process.stdout.write(`${values.apply ? "Restored" : "Planned"} ${plan.side} recovery at ${JSON.stringify(plan.destination)}\nCommit: ${plan.commit}; staging: ${plan.staging}. Source retained.\n${values.apply ? "Review the detached checkout before explicitly integrating it.\n" : "No destination created. Use --apply to restore into this new directory.\n"}`);
+}
+//# sourceMappingURL=recovery-restore-command.js.map

package/dist/cli/recovery-restore-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-restore-command.js","sourceRoot":"","sources":["../../src/cli/recovery-restore-command.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAG1D,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,MAAM,EACN,WAAW,GACG;IACd,SAAS,CACP,WAAW,CAAC,MAAM,KAAK,CAAC;QACtB,CAAC,CAAC,MAAM,CAAC,SAAS;QAClB,CAAC,CAAC,MAAM,CAAC,UAAU;QACnB,CAAC,CAAC,MAAM,CAAC,WAAW;QACpB,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,EAC5D,qKAAqK,CACtK,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QACnC,SAAS,CACP;YACE,WAAW;YACX,YAAY;YACZ,aAAa;YACb,MAAM;YACN,WAAW;YACX,OAAO;YACP,MAAM;SACP,CAAC,QAAQ,CAAC,GAAG,CAAC,EACf,0CAA0C,GAAG,EAAE,CAChD,CAAC;IACJ,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC;QACrC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,SAAS;YACnC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,WAAW,CAAC,EAAE,CAAC;KACtE,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzE,IAAI,MAAM,CAAC,IAAI;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;;QAE5E,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,gBAAgB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,aAAa,IAAI,CAAC,MAAM,cAAc,IAAI,CAAC,OAAO,uBAAuB,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,kEAAkE,CAAC,CAAC,CAAC,2EAA2E,EAAE,CAChV,CAAC;AACN,CAAC","sourcesContent":["import {\n  planRecoveryRestore,\n  restoreRecoveryTransfer,\n} from \"../application/recovery-restore.ts\";\nimport { invariant, positive } from \"../domain/errors.ts\";\nimport type { CliInvocation } from \"./main.types.ts\";\n\nexport async function recoveryRestoreCommand({\n  values,\n  positionals,\n}: CliInvocation): Promise<void> {\n  invariant(\n    positionals.length === 2 &&\n      !!values.directory &&\n      !!values.repository &&\n      !!values.destination &&\n      (values.side === \"previous\" || values.side === \"incoming\"),\n    \"Usage: outpost recovery restore --directory TRANSFER_PATH --repository PATH --destination NEW_PATH --side previous|incoming [--max-bytes NUMBER] [--apply] [--json]\",\n  );\n  for (const key of Object.keys(values))\n    invariant(\n      [\n        \"directory\",\n        \"repository\",\n        \"destination\",\n        \"side\",\n        \"max-bytes\",\n        \"apply\",\n        \"json\",\n      ].includes(key),\n      `Unsupported recovery restore option: --${key}`,\n    );\n  const plan = await planRecoveryRestore({\n    directory: values.directory,\n    repository: values.repository,\n    destination: values.destination,\n    side: values.side,\n    ...(values[\"max-bytes\"] === undefined\n      ? {}\n      : { maxBytes: positive(Number(values[\"max-bytes\"]), \"max-bytes\") }),\n  });\n  const result = values.apply ? await restoreRecoveryTransfer(plan) : plan;\n  if (values.json) process.stdout.write(`${JSON.stringify(result, null, 2)}\\n`);\n  else\n    process.stdout.write(\n      `${values.apply ? \"Restored\" : \"Planned\"} ${plan.side} recovery at ${JSON.stringify(plan.destination)}\\nCommit: ${plan.commit}; staging: ${plan.staging}. Source retained.\\n${values.apply ? \"Review the detached checkout before explicitly integrating it.\\n\" : \"No destination created. Use --apply to restore into this new directory.\\n\"}`,\n    );\n}\n"]}

package/dist/cli/recovery-verify-command.d.ts

@@ -0,0 +1,2 @@
+import type { CliInvocation } from "./main.types.ts";
+export declare function recoveryVerifyCommand({ values, positionals, }: CliInvocation): Promise<void>;

package/dist/cli/recovery-verify-command.js

@@ -0,0 +1,43 @@
+import { verifyRecoveryTransfer } from "../application/recovery-verification.js";
+import { invariant, positive } from "../domain/errors.js";
+export async function recoveryVerifyCommand({ values, positionals, }) {
+    invariant(positionals.length === 2 && !!values.directory, "Usage: outpost recovery verify --directory TRANSFER_PATH [--checksums] [--max-bytes NUMBER] [--restorability --repository PATH] [--json]");
+    for (const key of Object.keys(values))
+        invariant([
+            "directory",
+            "checksums",
+            "max-bytes",
+            "json",
+            "restorability",
+            "repository",
+        ].includes(key), `Unsupported recovery verify option: --${key}`);
+    invariant(values["max-bytes"] === undefined || values.checksums, "--max-bytes requires --checksums");
+    invariant(!values.repository || values.restorability, "--repository requires --restorability");
+    const report = await verifyRecoveryTransfer(values.directory, {
+        ...(values.restorability ? { restorability: true } : {}),
+        ...(values.repository ? { repository: values.repository } : {}),
+        ...(values.checksums ? { checksums: true } : {}),
+        ...(values["max-bytes"] !== undefined
+            ? { maxBytes: positive(Number(values["max-bytes"]), "max-bytes") }
+            : {}),
+    });
+    if (values.json)
+        process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+    else {
+        process.stdout.write(`Outpost recovery structure verification — ${JSON.stringify(report.directory)}\n`);
+        for (const check of report.checks)
+            process.stdout.write(`[${check.status.toUpperCase()}] ${check.code}: ${JSON.stringify(check.path)}\n`);
+        process.stdout.write(`${report.complete ? "Requested transfer checks passed." : "Transfer checks failed or are incomplete."}\n`);
+        if (values.restorability)
+            process.stdout.write("Restorability scope: commit objects, bundle validity and three transfer patches applied independently in a temporary clone. Payload restoration, original staging/worktree consistency, session patches, submodules and external dependencies are outside this scope. Target repository unchanged.\n");
+        if (values.checksums) {
+            process.stdout.write(`Checksums: ${report.integrity}; ${report.checksums?.bytesChecked ?? 0} bytes checked.\n`);
+            process.stdout.write("Checksums compare against an unsigned manifest. Activity and full restoration remain unverified. No files were changed.\n");
+        }
+        if (!values.checksums && !values.restorability)
+            process.stdout.write("Patch and bundle contents, commit availability, activity and restorability are unverified. No files were changed.\n");
+    }
+    if (!report.complete)
+        process.exitCode = 1;
+}
+//# sourceMappingURL=recovery-verify-command.js.map

package/dist/cli/recovery-verify-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-verify-command.js","sourceRoot":"","sources":["../../src/cli/recovery-verify-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAG1D,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,EAC1C,MAAM,EACN,WAAW,GACG;IACd,SAAS,CACP,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,EAC9C,0IAA0I,CAC3I,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QACnC,SAAS,CACP;YACE,WAAW;YACX,WAAW;YACX,WAAW;YACX,MAAM;YACN,eAAe;YACf,YAAY;SACb,CAAC,QAAQ,CAAC,GAAG,CAAC,EACf,yCAAyC,GAAG,EAAE,CAC/C,CAAC;IACJ,SAAS,CACP,MAAM,CAAC,WAAW,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,EACrD,kCAAkC,CACnC,CAAC;IACF,SAAS,CACP,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,aAAa,EAC1C,uCAAuC,CACxC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,MAAM,CAAC,SAAS,EAAE;QAC5D,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,SAAS;YACnC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,WAAW,CAAC,EAAE;YAClE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;SACzE,CAAC;QACJ,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,6CAA6C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAClF,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM;YAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CACjF,CAAC;QACJ,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,2CAA2C,IAAI,CAC3G,CAAC;QACF,IAAI,MAAM,CAAC,aAAa;YACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sSAAsS,CACvS,CAAC;QACJ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,cAAc,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,EAAE,YAAY,IAAI,CAAC,mBAAmB,CAC1F,CAAC;YACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,2HAA2H,CAC5H,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,aAAa;YAC5C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,qHAAqH,CACtH,CAAC;IACN,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ;QAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AAC7C,CAAC","sourcesContent":["import { verifyRecoveryTransfer } from \"../application/recovery-verification.ts\";\nimport { invariant, positive } from \"../domain/errors.ts\";\nimport type { CliInvocation } from \"./main.types.ts\";\n\nexport async function recoveryVerifyCommand({\n  values,\n  positionals,\n}: CliInvocation): Promise<void> {\n  invariant(\n    positionals.length === 2 && !!values.directory,\n    \"Usage: outpost recovery verify --directory TRANSFER_PATH [--checksums] [--max-bytes NUMBER] [--restorability --repository PATH] [--json]\",\n  );\n  for (const key of Object.keys(values))\n    invariant(\n      [\n        \"directory\",\n        \"checksums\",\n        \"max-bytes\",\n        \"json\",\n        \"restorability\",\n        \"repository\",\n      ].includes(key),\n      `Unsupported recovery verify option: --${key}`,\n    );\n  invariant(\n    values[\"max-bytes\"] === undefined || values.checksums,\n    \"--max-bytes requires --checksums\",\n  );\n  invariant(\n    !values.repository || values.restorability,\n    \"--repository requires --restorability\",\n  );\n  const report = await verifyRecoveryTransfer(values.directory, {\n    ...(values.restorability ? { restorability: true } : {}),\n    ...(values.repository ? { repository: values.repository } : {}),\n    ...(values.checksums ? { checksums: true } : {}),\n    ...(values[\"max-bytes\"] !== undefined\n      ? { maxBytes: positive(Number(values[\"max-bytes\"]), \"max-bytes\") }\n      : {}),\n  });\n  if (values.json) process.stdout.write(`${JSON.stringify(report, null, 2)}\\n`);\n  else {\n    process.stdout.write(\n      `Outpost recovery structure verification — ${JSON.stringify(report.directory)}\\n`,\n    );\n    for (const check of report.checks)\n      process.stdout.write(\n        `[${check.status.toUpperCase()}] ${check.code}: ${JSON.stringify(check.path)}\\n`,\n      );\n    process.stdout.write(\n      `${report.complete ? \"Requested transfer checks passed.\" : \"Transfer checks failed or are incomplete.\"}\\n`,\n    );\n    if (values.restorability)\n      process.stdout.write(\n        \"Restorability scope: commit objects, bundle validity and three transfer patches applied independently in a temporary clone. Payload restoration, original staging/worktree consistency, session patches, submodules and external dependencies are outside this scope. Target repository unchanged.\\n\",\n      );\n    if (values.checksums) {\n      process.stdout.write(\n        `Checksums: ${report.integrity}; ${report.checksums?.bytesChecked ?? 0} bytes checked.\\n`,\n      );\n      process.stdout.write(\n        \"Checksums compare against an unsigned manifest. Activity and full restoration remain unverified. No files were changed.\\n\",\n      );\n    }\n    if (!values.checksums && !values.restorability)\n      process.stdout.write(\n        \"Patch and bundle contents, commit availability, activity and restorability are unverified. No files were changed.\\n\",\n      );\n  }\n  if (!report.complete) process.exitCode = 1;\n}\n"]}

package/dist/cli/scaffold-files.js

@@ -1,12 +1,12 @@
 import { readFile } from "node:fs/promises";
-import { imageRecipe, providerPackages } from "./scaffold.constants.js";
+import { agentEnvironment, imageRecipe, providerPackages, } from "./scaffold.constants.js";
 import { starter } from "./starters.js";
 export async function scaffoldFiles(options, hasPackage, extension) {
     const agent = options.agent ?? "codex", provider = options.provider ?? "docker";
     const files = {
         [`run.${extension}`]: starter(options),
         "brief.md": "Objective: {{OBJECTIVE}}\n\nWork on {{WORK_BRANCH}} from {{BASE_BRANCH}}. Inspect the repository, implement the objective, run relevant tests and commit your changes. When finished, write <outpost>done</outpost>.\n",
-        ".env.example": agent === "codex" ? "OPENAI_API_KEY=\n" : "ANTHROPIC_API_KEY=\n",
+        ".env.example": agentEnvironment[agent],
         ".gitignore": "node_modules/\n.env\n.outpost/workspaces/\n.outpost/locks/\n.outpost/recovery/\n.outpost/logs/\n",
     };
     if (provider === "docker" || provider === "podman")

package/dist/cli/scaffold-files.js.map

@@ -1 +1 @@
-{"version":3,"file":"scaffold-files.js","sourceRoot":"","sources":["../../src/cli/scaffold-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAExE,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAoB,EACpB,UAAmB,EACnB,SAAuB;IAEvB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,EACpC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC;IAC1C,MAAM,KAAK,GAA2B;QACpC,CAAC,OAAO,SAAS,EAAE,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC;QACtC,UAAU,EACR,wNAAwN;QAC1N,cAAc,EACZ,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,sBAAsB;QAClE,YAAY,EACV,kGAAkG;KACrG,CAAC;IACF,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,QAAQ;QAChD,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,WAAW,CAAC;IAE9E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CACzB,MAAM,QAAQ,CAAC,IAAI,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CACvE,CAAC;QACF,KAAK,CAAC,cAAc,CAAC;YACnB,IAAI,CAAC,SAAS,CACZ;gBACE,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,EAAE,KAAK,EAAE,YAAY,SAAS,EAAE,EAAE;gBAC3C,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;gBACzB,eAAe,EAAE;oBACf,sBAAsB,EAAE,IAAI,QAAQ,CAAC,OAAO,EAAE;oBAC9C,GAAG,MAAM,CAAC,WAAW,CACnB,gBAAgB,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;wBACvC,IAAI;wBACJ,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC;qBAChC,CAAC,CACH;iBACF;aACF,EACD,IAAI,EACJ,CAAC,CACF,GAAG,IAAI,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["import { readFile } from \"node:fs/promises\";\nimport { imageRecipe, providerPackages } from \"./scaffold.constants.ts\";\nimport type { InitOptions } from \"./scaffold.types.ts\";\nimport { starter } from \"./starters.ts\";\n\nexport async function scaffoldFiles(\n  options: InitOptions,\n  hasPackage: boolean,\n  extension: \"ts\" | \"mts\",\n): Promise<Record<string, string>> {\n  const agent = options.agent ?? \"codex\",\n    provider = options.provider ?? \"docker\";\n  const files: Record<string, string> = {\n    [`run.${extension}`]: starter(options),\n    \"brief.md\":\n      \"Objective: {{OBJECTIVE}}\\n\\nWork on {{WORK_BRANCH}} from {{BASE_BRANCH}}. Inspect the repository, implement the objective, run relevant tests and commit your changes. When finished, write <outpost>done</outpost>.\\n\",\n    \".env.example\":\n      agent === \"codex\" ? \"OPENAI_API_KEY=\\n\" : \"ANTHROPIC_API_KEY=\\n\",\n    \".gitignore\":\n      \"node_modules/\\n.env\\n.outpost/workspaces/\\n.outpost/locks/\\n.outpost/recovery/\\n.outpost/logs/\\n\",\n  };\n  if (provider === \"docker\" || provider === \"podman\")\n    files[provider === \"docker\" ? \"Dockerfile\" : \"Containerfile\"] = imageRecipe;\n\n  if (!hasPackage) {\n    const manifest = JSON.parse(\n      await readFile(new URL(\"../../package.json\", import.meta.url), \"utf8\"),\n    );\n    files[\"package.json\"] =\n      JSON.stringify(\n        {\n          private: true,\n          type: \"module\",\n          scripts: { start: `node run.${extension}` },\n          engines: { node: \">=24\" },\n          devDependencies: {\n            \"@elie-laloum/outpost\": `^${manifest.version}`,\n            ...Object.fromEntries(\n              providerPackages[provider].map((name) => [\n                name,\n                manifest.peerDependencies[name],\n              ]),\n            ),\n          },\n        },\n        null,\n        2,\n      ) + \"\\n\";\n  }\n  return files;\n}\n"]}
+{"version":3,"file":"scaffold-files.js","sourceRoot":"","sources":["../../src/cli/scaffold-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAoB,EACpB,UAAmB,EACnB,SAAuB;IAEvB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,EACpC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC;IAC1C,MAAM,KAAK,GAA2B;QACpC,CAAC,OAAO,SAAS,EAAE,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC;QACtC,UAAU,EACR,wNAAwN;QAC1N,cAAc,EAAE,gBAAgB,CAAC,KAAK,CAAC;QACvC,YAAY,EACV,kGAAkG;KACrG,CAAC;IACF,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,QAAQ;QAChD,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,WAAW,CAAC;IAE9E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CACzB,MAAM,QAAQ,CAAC,IAAI,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CACvE,CAAC;QACF,KAAK,CAAC,cAAc,CAAC;YACnB,IAAI,CAAC,SAAS,CACZ;gBACE,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,EAAE,KAAK,EAAE,YAAY,SAAS,EAAE,EAAE;gBAC3C,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;gBACzB,eAAe,EAAE;oBACf,sBAAsB,EAAE,IAAI,QAAQ,CAAC,OAAO,EAAE;oBAC9C,GAAG,MAAM,CAAC,WAAW,CACnB,gBAAgB,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;wBACvC,IAAI;wBACJ,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC;qBAChC,CAAC,CACH;iBACF;aACF,EACD,IAAI,EACJ,CAAC,CACF,GAAG,IAAI,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["import { readFile } from \"node:fs/promises\";\nimport {\n  agentEnvironment,\n  imageRecipe,\n  providerPackages,\n} from \"./scaffold.constants.ts\";\nimport type { InitOptions } from \"./scaffold.types.ts\";\nimport { starter } from \"./starters.ts\";\n\nexport async function scaffoldFiles(\n  options: InitOptions,\n  hasPackage: boolean,\n  extension: \"ts\" | \"mts\",\n): Promise<Record<string, string>> {\n  const agent = options.agent ?? \"codex\",\n    provider = options.provider ?? \"docker\";\n  const files: Record<string, string> = {\n    [`run.${extension}`]: starter(options),\n    \"brief.md\":\n      \"Objective: {{OBJECTIVE}}\\n\\nWork on {{WORK_BRANCH}} from {{BASE_BRANCH}}. Inspect the repository, implement the objective, run relevant tests and commit your changes. When finished, write <outpost>done</outpost>.\\n\",\n    \".env.example\": agentEnvironment[agent],\n    \".gitignore\":\n      \"node_modules/\\n.env\\n.outpost/workspaces/\\n.outpost/locks/\\n.outpost/recovery/\\n.outpost/logs/\\n\",\n  };\n  if (provider === \"docker\" || provider === \"podman\")\n    files[provider === \"docker\" ? \"Dockerfile\" : \"Containerfile\"] = imageRecipe;\n\n  if (!hasPackage) {\n    const manifest = JSON.parse(\n      await readFile(new URL(\"../../package.json\", import.meta.url), \"utf8\"),\n    );\n    files[\"package.json\"] =\n      JSON.stringify(\n        {\n          private: true,\n          type: \"module\",\n          scripts: { start: `node run.${extension}` },\n          engines: { node: \">=24\" },\n          devDependencies: {\n            \"@elie-laloum/outpost\": `^${manifest.version}`,\n            ...Object.fromEntries(\n              providerPackages[provider].map((name) => [\n                name,\n                manifest.peerDependencies[name],\n              ]),\n            ),\n          },\n        },\n        null,\n        2,\n      ) + \"\\n\";\n  }\n  return files;\n}\n"]}

package/dist/cli/scaffold-validation.js

@@ -2,7 +2,7 @@ import { invariant } from "../domain/errors.js";
 import { supportedAgents, supportedProviders } from "./scaffold.constants.js";
 export function validateInitialization(options) {
     const agent = options.agent ?? "codex", provider = options.provider ?? "docker";
-    invariant(supportedAgents.includes(agent), "Choose codex or claude");
+    invariant(supportedAgents.includes(agent), "Choose codex, claude or gemini");
     invariant(supportedProviders.includes(provider), "Unknown sandbox provider");
 }
 //# sourceMappingURL=scaffold-validation.js.map

package/dist/cli/scaffold-validation.js.map

@@ -1 +1 @@
-{"version":3,"file":"scaffold-validation.js","sourceRoot":"","sources":["../../src/cli/scaffold-validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAG9E,MAAM,UAAU,sBAAsB,CAAC,OAAoB;IACzD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,EACpC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC;IAC1C,SAAS,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,wBAAwB,CAAC,CAAC;IACrE,SAAS,CAAC,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,0BAA0B,CAAC,CAAC;AAC/E,CAAC","sourcesContent":["import { invariant } from \"../domain/errors.ts\";\nimport { supportedAgents, supportedProviders } from \"./scaffold.constants.ts\";\nimport type { InitOptions } from \"./scaffold.types.ts\";\n\nexport function validateInitialization(options: InitOptions): void {\n  const agent = options.agent ?? \"codex\",\n    provider = options.provider ?? \"docker\";\n  invariant(supportedAgents.includes(agent), \"Choose codex or claude\");\n  invariant(supportedProviders.includes(provider), \"Unknown sandbox provider\");\n}\n"]}
+{"version":3,"file":"scaffold-validation.js","sourceRoot":"","sources":["../../src/cli/scaffold-validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAG9E,MAAM,UAAU,sBAAsB,CAAC,OAAoB;IACzD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,EACpC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC;IAC1C,SAAS,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,gCAAgC,CAAC,CAAC;IAC7E,SAAS,CAAC,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,0BAA0B,CAAC,CAAC;AAC/E,CAAC","sourcesContent":["import { invariant } from \"../domain/errors.ts\";\nimport { supportedAgents, supportedProviders } from \"./scaffold.constants.ts\";\nimport type { InitOptions } from \"./scaffold.types.ts\";\n\nexport function validateInitialization(options: InitOptions): void {\n  const agent = options.agent ?? \"codex\",\n    provider = options.provider ?? \"docker\";\n  invariant(supportedAgents.includes(agent), \"Choose codex, claude or gemini\");\n  invariant(supportedProviders.includes(provider), \"Unknown sandbox provider\");\n}\n"]}

package/dist/cli/scaffold.constants.d.ts

@@ -1,4 +1,9 @@
 export declare const imageRecipe: string;
+export declare const agentEnvironment: {
+    readonly codex: "OPENAI_API_KEY=\n";
+    readonly claude: "ANTHROPIC_API_KEY=\n";
+    readonly gemini: "GEMINI_API_KEY=\n";
+};
 export declare const supportedAgents: readonly string[];
 export declare const supportedProviders: readonly string[];
 export declare const supportedManagers: readonly string[];

package/dist/cli/scaffold.constants.js

@@ -3,14 +3,19 @@ export const imageRecipe = `FROM node:24-bookworm-slim
 ARG AGENT_UID=1000
 ARG AGENT_GID=1000
 RUN apt-get update && apt-get install -y --no-install-recommends git openssh-client ca-certificates curl procps util-linux python3 && rm -rf /var/lib/apt/lists/*
-RUN npm install -g --allow-scripts=@anthropic-ai/claude-code @openai/codex@${agentVersions.codex} @anthropic-ai/claude-code@${agentVersions.claude}
+RUN npm install -g --allow-scripts=@anthropic-ai/claude-code @openai/codex@${agentVersions.codex} @anthropic-ai/claude-code@${agentVersions.claude} @google/gemini-cli@${agentVersions.gemini}
 RUN groupmod -o -g "$AGENT_GID" node && usermod -o -u "$AGENT_UID" -g "$AGENT_GID" node
 RUN mkdir -p /home/agent && chown "$AGENT_UID:$AGENT_GID" /home/agent && chmod 700 /home/agent
 ENV HOME=/home/agent
 USER $AGENT_UID:$AGENT_GID
 WORKDIR /workspace
 `;
-export const supportedAgents = ["codex", "claude"];
+export const agentEnvironment = {
+    codex: "OPENAI_API_KEY=\n",
+    claude: "ANTHROPIC_API_KEY=\n",
+    gemini: "GEMINI_API_KEY=\n",
+};
+export const supportedAgents = ["codex", "claude", "gemini"];
 export const supportedProviders = [
     "docker",
     "podman",

package/dist/cli/scaffold.constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"scaffold.constants.js","sourceRoot":"","sources":["../../src/cli/scaffold.constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEzD,MAAM,CAAC,MAAM,WAAW,GAAG;;;;6EAIkD,aAAa,CAAC,KAAK,8BAA8B,aAAa,CAAC,MAAM;;;;;;CAMjJ,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AACtE,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,OAAO;CACR,CAAC;AACF,MAAM,CAAC,MAAM,iBAAiB,GAAsB;IAClD,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;CACN,CAAC;AACF,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAC1B,CAAC,WAAW,EAAE,MAAM,CAAC;IACrB,CAAC,UAAU,EAAE,KAAK,CAAC;IACnB,CAAC,WAAW,EAAE,KAAK,CAAC;CACZ,CAAC;AACX,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,MAAM,EAAE,EAAE;IACV,MAAM,EAAE,EAAE;IACV,KAAK,EAAE,EAAE;IACT,MAAM,EAAE,CAAC,iBAAiB,CAAC;IAC3B,OAAO,EAAE,CAAC,cAAc,CAAC;CACjB,CAAC","sourcesContent":["import { agentVersions } from \"../providers/versions.ts\";\n\nexport const imageRecipe = `FROM node:24-bookworm-slim\nARG AGENT_UID=1000\nARG AGENT_GID=1000\nRUN apt-get update && apt-get install -y --no-install-recommends git openssh-client ca-certificates curl procps util-linux python3 && rm -rf /var/lib/apt/lists/*\nRUN npm install -g --allow-scripts=@anthropic-ai/claude-code @openai/codex@${agentVersions.codex} @anthropic-ai/claude-code@${agentVersions.claude}\nRUN groupmod -o -g \"$AGENT_GID\" node && usermod -o -u \"$AGENT_UID\" -g \"$AGENT_GID\" node\nRUN mkdir -p /home/agent && chown \"$AGENT_UID:$AGENT_GID\" /home/agent && chmod 700 /home/agent\nENV HOME=/home/agent\nUSER $AGENT_UID:$AGENT_GID\nWORKDIR /workspace\n`;\n\nexport const supportedAgents: readonly string[] = [\"codex\", \"claude\"];\nexport const supportedProviders: readonly string[] = [\n  \"docker\",\n  \"podman\",\n  \"vercel\",\n  \"daytona\",\n  \"local\",\n];\nexport const supportedManagers: readonly string[] = [\n  \"npm\",\n  \"pnpm\",\n  \"yarn\",\n  \"bun\",\n];\nexport const managerLocks = [\n  [\"pnpm-lock.yaml\", \"pnpm\"],\n  [\"yarn.lock\", \"yarn\"],\n  [\"bun.lock\", \"bun\"],\n  [\"bun.lockb\", \"bun\"],\n] as const;\nexport const providerPackages = {\n  docker: [],\n  podman: [],\n  local: [],\n  vercel: [\"@vercel/sandbox\"],\n  daytona: [\"@daytona/sdk\"],\n} as const;\n"]}
+{"version":3,"file":"scaffold.constants.js","sourceRoot":"","sources":["../../src/cli/scaffold.constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEzD,MAAM,CAAC,MAAM,WAAW,GAAG;;;;6EAIkD,aAAa,CAAC,KAAK,8BAA8B,aAAa,CAAC,MAAM,uBAAuB,aAAa,CAAC,MAAM;;;;;;CAM5L,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,KAAK,EAAE,mBAAmB;IAC1B,MAAM,EAAE,sBAAsB;IAC9B,MAAM,EAAE,mBAAmB;CACnB,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAsB,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAChF,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,OAAO;CACR,CAAC;AACF,MAAM,CAAC,MAAM,iBAAiB,GAAsB;IAClD,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;CACN,CAAC;AACF,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAC1B,CAAC,WAAW,EAAE,MAAM,CAAC;IACrB,CAAC,UAAU,EAAE,KAAK,CAAC;IACnB,CAAC,WAAW,EAAE,KAAK,CAAC;CACZ,CAAC;AACX,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,MAAM,EAAE,EAAE;IACV,MAAM,EAAE,EAAE;IACV,KAAK,EAAE,EAAE;IACT,MAAM,EAAE,CAAC,iBAAiB,CAAC;IAC3B,OAAO,EAAE,CAAC,cAAc,CAAC;CACjB,CAAC","sourcesContent":["import { agentVersions } from \"../providers/versions.ts\";\n\nexport const imageRecipe = `FROM node:24-bookworm-slim\nARG AGENT_UID=1000\nARG AGENT_GID=1000\nRUN apt-get update && apt-get install -y --no-install-recommends git openssh-client ca-certificates curl procps util-linux python3 && rm -rf /var/lib/apt/lists/*\nRUN npm install -g --allow-scripts=@anthropic-ai/claude-code @openai/codex@${agentVersions.codex} @anthropic-ai/claude-code@${agentVersions.claude} @google/gemini-cli@${agentVersions.gemini}\nRUN groupmod -o -g \"$AGENT_GID\" node && usermod -o -u \"$AGENT_UID\" -g \"$AGENT_GID\" node\nRUN mkdir -p /home/agent && chown \"$AGENT_UID:$AGENT_GID\" /home/agent && chmod 700 /home/agent\nENV HOME=/home/agent\nUSER $AGENT_UID:$AGENT_GID\nWORKDIR /workspace\n`;\n\nexport const agentEnvironment = {\n  codex: \"OPENAI_API_KEY=\\n\",\n  claude: \"ANTHROPIC_API_KEY=\\n\",\n  gemini: \"GEMINI_API_KEY=\\n\",\n} as const;\n\nexport const supportedAgents: readonly string[] = [\"codex\", \"claude\", \"gemini\"];\nexport const supportedProviders: readonly string[] = [\n  \"docker\",\n  \"podman\",\n  \"vercel\",\n  \"daytona\",\n  \"local\",\n];\nexport const supportedManagers: readonly string[] = [\n  \"npm\",\n  \"pnpm\",\n  \"yarn\",\n  \"bun\",\n];\nexport const managerLocks = [\n  [\"pnpm-lock.yaml\", \"pnpm\"],\n  [\"yarn.lock\", \"yarn\"],\n  [\"bun.lock\", \"bun\"],\n  [\"bun.lockb\", \"bun\"],\n] as const;\nexport const providerPackages = {\n  docker: [],\n  podman: [],\n  local: [],\n  vercel: [\"@vercel/sandbox\"],\n  daytona: [\"@daytona/sdk\"],\n} as const;\n"]}

package/dist/cli/scaffold.types.d.ts

@@ -1,7 +1,7 @@
 export interface InitOptions {
     readonly directory?: string;
     readonly repository?: string;
-    readonly agent?: "claude" | "codex";
+    readonly agent?: "claude" | "codex" | "gemini";
     readonly provider?: "docker" | "podman" | "vercel" | "daytona" | "local";
     readonly manager?: "npm" | "pnpm" | "yarn" | "bun";
     readonly model?: string;

package/dist/cli/scaffold.types.js.map

@@ -1 +1 @@
-{"version":3,"file":"scaffold.types.js","sourceRoot":"","sources":["../../src/cli/scaffold.types.ts"],"names":[],"mappings":"","sourcesContent":["export interface InitOptions {\n  readonly directory?: string;\n  readonly repository?: string;\n  readonly agent?: \"claude\" | \"codex\";\n  readonly provider?: \"docker\" | \"podman\" | \"vercel\" | \"daytona\" | \"local\";\n  readonly manager?: \"npm\" | \"pnpm\" | \"yarn\" | \"bun\";\n  readonly model?: string;\n  readonly install?: boolean;\n  readonly build?: boolean;\n  readonly image?: string;\n}\n\nexport interface PackageManifest {\n  readonly type?: string;\n  readonly packageManager?: string;\n}\nexport interface ProjectSettings {\n  readonly extension: \"ts\" | \"mts\";\n  readonly hasPackage: boolean;\n  readonly manager: string;\n}\nexport interface ScaffoldResult {\n  files: readonly string[];\n  run: string;\n}\n"]}
+{"version":3,"file":"scaffold.types.js","sourceRoot":"","sources":["../../src/cli/scaffold.types.ts"],"names":[],"mappings":"","sourcesContent":["export interface InitOptions {\n  readonly directory?: string;\n  readonly repository?: string;\n  readonly agent?: \"claude\" | \"codex\" | \"gemini\";\n  readonly provider?: \"docker\" | \"podman\" | \"vercel\" | \"daytona\" | \"local\";\n  readonly manager?: \"npm\" | \"pnpm\" | \"yarn\" | \"bun\";\n  readonly model?: string;\n  readonly install?: boolean;\n  readonly build?: boolean;\n  readonly image?: string;\n}\n\nexport interface PackageManifest {\n  readonly type?: string;\n  readonly packageManager?: string;\n}\nexport interface ProjectSettings {\n  readonly extension: \"ts\" | \"mts\";\n  readonly hasPackage: boolean;\n  readonly manager: string;\n}\nexport interface ScaffoldResult {\n  files: readonly string[];\n  run: string;\n}\n"]}

package/dist/domain/agent.types.d.ts

@@ -67,6 +67,8 @@ export interface AgentInput {
 }
 export interface AgentAdapter {
     readonly name: string;
+    readonly bootstrap?: string;
+    readonly requiresFinishedEvent?: boolean;
     readonly variables?: Variables;
     readonly conversations?: "claude" | "codex";
     readonly storage?: ConversationStore;

package/dist/domain/agent.types.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent.types.js","sourceRoot":"","sources":["../../src/domain/agent.types.ts"],"names":[],"mappings":"","sourcesContent":["import type { Command, Variables } from \"./command.types.ts\";\nimport type { ConversationStore } from \"./conversation.types.ts\";\n\nexport interface Usage {\n  readonly input: number;\n  readonly cached: number;\n  readonly cacheCreated?: number;\n  readonly output: number;\n}\n\nexport type AgentEvent =\n  | {\n      readonly kind: \"phase\";\n      readonly name: string;\n      readonly agent?: string;\n      readonly branch?: string;\n      readonly directory?: string;\n    }\n  | {\n      readonly kind: \"summary\";\n      readonly durationMs: number;\n      readonly status: number;\n      readonly tokens: Usage;\n    }\n  | { readonly kind: \"warning\"; readonly message: string }\n  | { readonly kind: \"text\"; readonly text: string }\n  | { readonly kind: \"result\"; readonly text: string }\n  | { readonly kind: \"prompt\"; readonly text: string }\n  | { readonly kind: \"tool\"; readonly name: string; readonly input: unknown }\n  | { readonly kind: \"conversation\"; readonly id: string }\n  | { readonly kind: \"usage\"; readonly tokens: Usage }\n  | { readonly kind: \"failure\"; readonly message: string }\n  | { readonly kind: \"finished\" }\n  | { readonly kind: \"raw\"; readonly value: unknown };\n\nexport type AgentObservation = AgentEvent & {\n  readonly pass: number;\n  readonly at: string;\n};\n\nexport type AgentEventHandlers = {\n  readonly [Kind in AgentEvent[\"kind\"]]?: (\n    event: Extract<AgentEvent, { kind: Kind }>,\n  ) => void;\n};\n\nexport interface AgentInput {\n  readonly text?: string;\n  readonly interactive?: boolean;\n  readonly continuation?: { readonly id: string; readonly fork?: boolean };\n}\n\nexport interface AgentAdapter {\n  readonly name: string;\n  readonly variables?: Variables;\n  readonly conversations?: \"claude\" | \"codex\";\n  readonly storage?: ConversationStore;\n  readonly capture?: boolean;\n  readonly resumable?: boolean;\n  transcriptUsage?(text: string): Usage | undefined;\n  request(input: AgentInput): Command;\n  events(line: string): readonly AgentEvent[];\n}\n\nexport interface RequiredAgent {\n  readonly agent: AgentAdapter;\n}\n"]}
+{"version":3,"file":"agent.types.js","sourceRoot":"","sources":["../../src/domain/agent.types.ts"],"names":[],"mappings":"","sourcesContent":["import type { Command, Variables } from \"./command.types.ts\";\nimport type { ConversationStore } from \"./conversation.types.ts\";\n\nexport interface Usage {\n  readonly input: number;\n  readonly cached: number;\n  readonly cacheCreated?: number;\n  readonly output: number;\n}\n\nexport type AgentEvent =\n  | {\n      readonly kind: \"phase\";\n      readonly name: string;\n      readonly agent?: string;\n      readonly branch?: string;\n      readonly directory?: string;\n    }\n  | {\n      readonly kind: \"summary\";\n      readonly durationMs: number;\n      readonly status: number;\n      readonly tokens: Usage;\n    }\n  | { readonly kind: \"warning\"; readonly message: string }\n  | { readonly kind: \"text\"; readonly text: string }\n  | { readonly kind: \"result\"; readonly text: string }\n  | { readonly kind: \"prompt\"; readonly text: string }\n  | { readonly kind: \"tool\"; readonly name: string; readonly input: unknown }\n  | { readonly kind: \"conversation\"; readonly id: string }\n  | { readonly kind: \"usage\"; readonly tokens: Usage }\n  | { readonly kind: \"failure\"; readonly message: string }\n  | { readonly kind: \"finished\" }\n  | { readonly kind: \"raw\"; readonly value: unknown };\n\nexport type AgentObservation = AgentEvent & {\n  readonly pass: number;\n  readonly at: string;\n};\n\nexport type AgentEventHandlers = {\n  readonly [Kind in AgentEvent[\"kind\"]]?: (\n    event: Extract<AgentEvent, { kind: Kind }>,\n  ) => void;\n};\n\nexport interface AgentInput {\n  readonly text?: string;\n  readonly interactive?: boolean;\n  readonly continuation?: { readonly id: string; readonly fork?: boolean };\n}\n\nexport interface AgentAdapter {\n  readonly name: string;\n  readonly bootstrap?: string;\n  readonly requiresFinishedEvent?: boolean;\n  readonly variables?: Variables;\n  readonly conversations?: \"claude\" | \"codex\";\n  readonly storage?: ConversationStore;\n  readonly capture?: boolean;\n  readonly resumable?: boolean;\n  transcriptUsage?(text: string): Usage | undefined;\n  request(input: AgentInput): Command;\n  events(line: string): readonly AgentEvent[];\n}\n\nexport interface RequiredAgent {\n  readonly agent: AgentAdapter;\n}\n"]}

package/dist/domain/artifact-reference.d.ts

@@ -0,0 +1,4 @@
+import type { ArtifactReference } from "./artifact.types.ts";
+export declare function artifactDigest(bytes: Uint8Array | string): string;
+export declare function artifactId(reference: Omit<ArtifactReference, "id">): string;
+export declare function validateArtifactReference(value: unknown): ArtifactReference;

package/dist/domain/artifact-reference.js

@@ -0,0 +1,90 @@
+import { artifactDigestPattern, artifactLabelMaxLength, } from "./artifact.constants.js";
+import { createHash } from "node:crypto";
+export function artifactDigest(bytes) {
+    return createHash("sha256").update(bytes).digest("hex");
+}
+export function artifactId(reference) {
+    return artifactDigest(JSON.stringify([
+        reference.format,
+        reference.digest,
+        reference.size,
+        reference.contract.name,
+        reference.contract.version,
+        reference.contract.encoding,
+        reference.producer.executionId,
+        reference.producer.taskKey,
+        reference.producer.attempt,
+        reference.parents,
+    ]));
+}
+export function validateArtifactReference(value) {
+    const invalid = () => new Error("Invalid artifact reference or lineage");
+    if (!value ||
+        typeof value !== "object" ||
+        !("format" in value) ||
+        value.format !== 1 ||
+        !("id" in value) ||
+        !digest(value.id) ||
+        !("digest" in value) ||
+        !digest(value.digest) ||
+        !("size" in value) ||
+        typeof value.size !== "number" ||
+        !Number.isSafeInteger(value.size) ||
+        value.size < 0 ||
+        !("contract" in value) ||
+        !value.contract ||
+        typeof value.contract !== "object" ||
+        !("producer" in value) ||
+        !value.producer ||
+        typeof value.producer !== "object" ||
+        !("parents" in value) ||
+        !Array.isArray(value.parents) ||
+        !value.parents.every(digest) ||
+        new Set(value.parents).size !== value.parents.length)
+        throw invalid();
+    const contract = value.contract, producer = value.producer;
+    if (!("name" in contract) ||
+        !label(contract.name) ||
+        !("version" in contract) ||
+        !label(contract.version) ||
+        !("encoding" in contract) ||
+        (contract.encoding !== "json" && contract.encoding !== "binary") ||
+        !("executionId" in producer) ||
+        !label(producer.executionId) ||
+        !("taskKey" in producer) ||
+        !label(producer.taskKey) ||
+        !("attempt" in producer) ||
+        typeof producer.attempt !== "number" ||
+        !Number.isSafeInteger(producer.attempt) ||
+        producer.attempt < 1)
+        throw invalid();
+    const reference = Object.freeze({
+        format: 1,
+        id: value.id,
+        digest: value.digest,
+        size: value.size,
+        contract: Object.freeze({
+            name: contract.name,
+            version: contract.version,
+            encoding: contract.encoding,
+        }),
+        producer: Object.freeze({
+            executionId: producer.executionId,
+            taskKey: producer.taskKey,
+            attempt: producer.attempt,
+        }),
+        parents: Object.freeze([...value.parents]),
+    });
+    if (artifactId(reference) !== reference.id)
+        throw invalid();
+    return reference;
+}
+function digest(value) {
+    return typeof value === "string" && artifactDigestPattern.test(value);
+}
+function label(value) {
+    return (typeof value === "string" &&
+        value.trim().length > 0 &&
+        value.length <= artifactLabelMaxLength);
+}
+//# sourceMappingURL=artifact-reference.js.map

package/dist/domain/artifact-reference.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-reference.js","sourceRoot":"","sources":["../../src/domain/artifact-reference.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,MAAM,UAAU,cAAc,CAAC,KAA0B;IACvD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,SAAwC;IACjE,OAAO,cAAc,CACnB,IAAI,CAAC,SAAS,CAAC;QACb,SAAS,CAAC,MAAM;QAChB,SAAS,CAAC,MAAM;QAChB,SAAS,CAAC,IAAI;QACd,SAAS,CAAC,QAAQ,CAAC,IAAI;QACvB,SAAS,CAAC,QAAQ,CAAC,OAAO;QAC1B,SAAS,CAAC,QAAQ,CAAC,QAAQ;QAC3B,SAAS,CAAC,QAAQ,CAAC,WAAW;QAC9B,SAAS,CAAC,QAAQ,CAAC,OAAO;QAC1B,SAAS,CAAC,QAAQ,CAAC,OAAO;QAC1B,SAAS,CAAC,OAAO;KAClB,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACzE,IACE,CAAC,KAAK;QACN,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC;QACpB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC;QAChB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACjB,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC;QACpB,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QACrB,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC;QAClB,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;QACjC,KAAK,CAAC,IAAI,GAAG,CAAC;QACd,CAAC,CAAC,UAAU,IAAI,KAAK,CAAC;QACtB,CAAC,KAAK,CAAC,QAAQ;QACf,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,CAAC,CAAC,UAAU,IAAI,KAAK,CAAC;QACtB,CAAC,KAAK,CAAC,QAAQ;QACf,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC;QACrB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QAC7B,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QAC5B,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,CAAC,MAAM;QAEpD,MAAM,OAAO,EAAE,CAAC;IAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAC7B,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAC5B,IACE,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC;QACrB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QACrB,CAAC,CAAC,SAAS,IAAI,QAAQ,CAAC;QACxB,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QACxB,CAAC,CAAC,UAAU,IAAI,QAAQ,CAAC;QACzB,CAAC,QAAQ,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAChE,CAAC,CAAC,aAAa,IAAI,QAAQ,CAAC;QAC5B,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC5B,CAAC,CAAC,SAAS,IAAI,QAAQ,CAAC;QACxB,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QACxB,CAAC,CAAC,SAAS,IAAI,QAAQ,CAAC;QACxB,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ;QACpC,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC;QACvC,QAAQ,CAAC,OAAO,GAAG,CAAC;QAEpB,MAAM,OAAO,EAAE,CAAC;IAClB,MAAM,SAAS,GAAsB,MAAM,CAAC,MAAM,CAAC;QACjD,MAAM,EAAE,CAAC;QACT,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;YACtB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;SAC5B,CAAC;QACF,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;YACtB,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;SAC1B,CAAC;QACF,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;KAC3C,CAAC,CAAC;IACH,IAAI,UAAU,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,EAAE;QAAE,MAAM,OAAO,EAAE,CAAC;IAC5D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,KAAK,CAAC,KAAc;IAC3B,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACvB,KAAK,CAAC,MAAM,IAAI,sBAAsB,CACvC,CAAC;AACJ,CAAC","sourcesContent":["import {\n  artifactDigestPattern,\n  artifactLabelMaxLength,\n} from \"./artifact.constants.ts\";\nimport { createHash } from \"node:crypto\";\nimport type { ArtifactReference } from \"./artifact.types.ts\";\n\nexport function artifactDigest(bytes: Uint8Array | string): string {\n  return createHash(\"sha256\").update(bytes).digest(\"hex\");\n}\n\nexport function artifactId(reference: Omit<ArtifactReference, \"id\">): string {\n  return artifactDigest(\n    JSON.stringify([\n      reference.format,\n      reference.digest,\n      reference.size,\n      reference.contract.name,\n      reference.contract.version,\n      reference.contract.encoding,\n      reference.producer.executionId,\n      reference.producer.taskKey,\n      reference.producer.attempt,\n      reference.parents,\n    ]),\n  );\n}\n\nexport function validateArtifactReference(value: unknown): ArtifactReference {\n  const invalid = () => new Error(\"Invalid artifact reference or lineage\");\n  if (\n    !value ||\n    typeof value !== \"object\" ||\n    !(\"format\" in value) ||\n    value.format !== 1 ||\n    !(\"id\" in value) ||\n    !digest(value.id) ||\n    !(\"digest\" in value) ||\n    !digest(value.digest) ||\n    !(\"size\" in value) ||\n    typeof value.size !== \"number\" ||\n    !Number.isSafeInteger(value.size) ||\n    value.size < 0 ||\n    !(\"contract\" in value) ||\n    !value.contract ||\n    typeof value.contract !== \"object\" ||\n    !(\"producer\" in value) ||\n    !value.producer ||\n    typeof value.producer !== \"object\" ||\n    !(\"parents\" in value) ||\n    !Array.isArray(value.parents) ||\n    !value.parents.every(digest) ||\n    new Set(value.parents).size !== value.parents.length\n  )\n    throw invalid();\n  const contract = value.contract,\n    producer = value.producer;\n  if (\n    !(\"name\" in contract) ||\n    !label(contract.name) ||\n    !(\"version\" in contract) ||\n    !label(contract.version) ||\n    !(\"encoding\" in contract) ||\n    (contract.encoding !== \"json\" && contract.encoding !== \"binary\") ||\n    !(\"executionId\" in producer) ||\n    !label(producer.executionId) ||\n    !(\"taskKey\" in producer) ||\n    !label(producer.taskKey) ||\n    !(\"attempt\" in producer) ||\n    typeof producer.attempt !== \"number\" ||\n    !Number.isSafeInteger(producer.attempt) ||\n    producer.attempt < 1\n  )\n    throw invalid();\n  const reference: ArtifactReference = Object.freeze({\n    format: 1,\n    id: value.id,\n    digest: value.digest,\n    size: value.size,\n    contract: Object.freeze({\n      name: contract.name,\n      version: contract.version,\n      encoding: contract.encoding,\n    }),\n    producer: Object.freeze({\n      executionId: producer.executionId,\n      taskKey: producer.taskKey,\n      attempt: producer.attempt,\n    }),\n    parents: Object.freeze([...value.parents]),\n  });\n  if (artifactId(reference) !== reference.id) throw invalid();\n  return reference;\n}\n\nfunction digest(value: unknown): value is string {\n  return typeof value === \"string\" && artifactDigestPattern.test(value);\n}\n\nfunction label(value: unknown): value is string {\n  return (\n    typeof value === \"string\" &&\n    value.trim().length > 0 &&\n    value.length <= artifactLabelMaxLength\n  );\n}\n"]}

package/dist/domain/artifact.constants.d.ts

@@ -0,0 +1,2 @@
+export declare const artifactLabelMaxLength = 1024;
+export declare const artifactDigestPattern: RegExp;

package/dist/domain/artifact.constants.js

@@ -0,0 +1,3 @@
+export const artifactLabelMaxLength = 1024;
+export const artifactDigestPattern = /^[a-f0-9]{64}$/;
+//# sourceMappingURL=artifact.constants.js.map

package/dist/domain/artifact.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact.constants.js","sourceRoot":"","sources":["../../src/domain/artifact.constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAC3C,MAAM,CAAC,MAAM,qBAAqB,GAAG,gBAAgB,CAAC","sourcesContent":["export const artifactLabelMaxLength = 1024;\nexport const artifactDigestPattern = /^[a-f0-9]{64}$/;\n"]}

package/dist/domain/artifact.d.ts

@@ -0,0 +1,7 @@
+import type { ArtifactContract, ArtifactContractOptions, ArtifactReference, ArtifactStore, JsonArtifactOptions, PublishArtifactOptions, ReadArtifactOptions } from "./artifact.types.ts";
+export declare const artifact: {
+    json<T>(options: JsonArtifactOptions<T>): ArtifactContract<T>;
+    binary(options: ArtifactContractOptions): ArtifactContract<Uint8Array>;
+};
+export declare function publishArtifact<T>(store: ArtifactStore, contract: ArtifactContract<T>, value: T, options: PublishArtifactOptions): Promise<ArtifactReference>;
+export declare function readStoredArtifact<T>(store: ArtifactStore, contract: ArtifactContract<T>, value: unknown, options?: ReadArtifactOptions): Promise<T>;