@jevitate/cli 0.1.0 → 0.2.0

package/dist/findings-filing.js

@@ -0,0 +1,108 @@
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { DEFAULT_JEVITATE_REPO, fileDraft, } from "@jevitate/domain";
+import { resolveDataDir } from "./data-dir.js";
+export class FilingConfigError extends Error {
+    code = "E_FILING_CONFIG";
+}
+const REPO = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+/** `owner/name`, or a config error — a malformed repo is never silently used. */
+export function assertRepo(repo, where) {
+    if (!REPO.test(repo))
+        throw new FilingConfigError(`${where}: ${JSON.stringify(repo)} is not an owner/name repo`);
+    return repo;
+}
+/** Reads `~/.jevitate/filing.json`; a missing file is "no filing config". Anything malformed fails closed. */
+export function loadFilingFileConfig(path = resolveDataDir(["filing.json"])) {
+    let raw;
+    try {
+        raw = readFileSync(path, "utf8");
+    }
+    catch (e) {
+        if (typeof e === "object" && e !== null && "code" in e && e.code === "ENOENT")
+            return {};
+        throw new FilingConfigError(`cannot read ${path}: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new FilingConfigError(`${path} is not valid JSON`);
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new FilingConfigError(`${path} must be a JSON object`);
+    }
+    const o = parsed;
+    const out = {};
+    if (o.enabled !== undefined) {
+        if (typeof o.enabled !== "boolean")
+            throw new FilingConfigError(`${path}: enabled must be a boolean`);
+        out.enabled = o.enabled;
+    }
+    if (o.jevitateRepo !== undefined) {
+        if (typeof o.jevitateRepo !== "string")
+            throw new FilingConfigError(`${path}: jevitateRepo must be a string`);
+        out.jevitateRepo = assertRepo(o.jevitateRepo, `${path} jevitateRepo`);
+    }
+    if (o.targets !== undefined) {
+        if (o.targets === null || typeof o.targets !== "object" || Array.isArray(o.targets)) {
+            throw new FilingConfigError(`${path}: targets must be an object keyed by origin`);
+        }
+        const targets = {};
+        for (const [origin, v] of Object.entries(o.targets)) {
+            const repo = v !== null && typeof v === "object" && "repo" in v ? v.repo : undefined;
+            if (typeof repo !== "string")
+                throw new FilingConfigError(`${path}: targets[${origin}].repo must be a string`);
+            targets[origin] = { repo: assertRepo(repo, `${path} targets[${origin}]`) };
+        }
+        out.targets = targets;
+    }
+    return out;
+}
+/** Flags win over the file; the target repo is looked up by the run's origin. */
+export function resolveFilingConfig(file, flags, targetOrigin) {
+    const targetRepo = flags.issueRepo ?? file.targets?.[targetOrigin]?.repo;
+    return {
+        enabled: flags.fileIssues ?? file.enabled ?? false,
+        jevitateRepo: assertRepo(flags.jevitateRepo ?? file.jevitateRepo ?? DEFAULT_JEVITATE_REPO, "jevitate repo"),
+        ...(targetRepo === undefined ? {} : { targetRepo: assertRepo(targetRepo, "issue repo") }),
+    };
+}
+/** `<dir>/<stem>.json` → `<dir>/<stem>.issues/`. */
+export function issuesDirFor(recordingPath) {
+    return recordingPath.endsWith(".json") ? `${recordingPath.slice(0, -".json".length)}.issues` : `${recordingPath}.issues`;
+}
+/** Writes each draft as `<fingerprint>.md` (title heading + body) next to the Recording. */
+export function writeIssueDrafts(recordingPath, drafts) {
+    if (drafts.length === 0)
+        return [];
+    const dir = issuesDirFor(recordingPath);
+    mkdirSync(dir, { recursive: true });
+    return drafts.map((d) => {
+        const path = join(dir, `${d.fingerprint}.md`);
+        writeFileSync(path, `# ${d.title}\n\n${d.body}\n`, "utf8");
+        return { fingerprint: d.fingerprint, title: d.title, attribution: d.attribution, targets: d.targets, labels: d.labels, path };
+    });
+}
+/**
+ * Writes every draft, then files them per the config. The filer is created ONLY when filing is
+ * enabled (so a disabled run never even looks for `gh` or a token).
+ */
+export async function processIssueDrafts(recordingPath, drafts, config, makeFiler, nowIso) {
+    const written = writeIssueDrafts(recordingPath, drafts);
+    const filing = [];
+    const filer = config.enabled && drafts.length > 0 ? makeFiler() : null;
+    for (const d of drafts) {
+        const outcomes = filer === null
+            ? d.targets.map((target) => ({
+                target,
+                status: "draft-only",
+                reason: config.enabled ? "no filer" : "filing is disabled",
+            }))
+            : await fileDraft(filer, d, config, nowIso);
+        filing.push({ fingerprint: d.fingerprint, outcomes });
+    }
+    return { drafts: written, filing };
+}
+//# sourceMappingURL=findings-filing.js.map

package/dist/findings-filing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"findings-filing.js","sourceRoot":"","sources":["../src/findings-filing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,qBAAqB,EACrB,SAAS,GAKV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAuB/C,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,IAAI,GAAG,iBAA0B,CAAC;CAC5C;AAED,MAAM,IAAI,GAAG,oCAAoC,CAAC;AAElD,iFAAiF;AACjF,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,KAAa;IACpD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,KAAK,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACjH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8GAA8G;AAC9G,MAAM,UAAU,oBAAoB,CAAC,IAAI,GAAG,cAAc,CAAC,CAAC,aAAa,CAAC,CAAC;IACzE,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QACzF,MAAM,IAAI,iBAAiB,CAAC,eAAe,IAAI,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,iBAAiB,CAAC,GAAG,IAAI,wBAAwB,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,CAAC,GAAG,MAAiC,CAAC;IAC5C,MAAM,GAAG,GAA6F,EAAE,CAAC;IACzG,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,SAAS;YAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAC;QACtG,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;IAC1B,CAAC;IACD,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ;YAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,IAAI,iCAAiC,CAAC,CAAC;QAC9G,GAAG,CAAC,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,YAAY,EAAE,GAAG,IAAI,eAAe,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,iBAAiB,CAAC,GAAG,IAAI,6CAA6C,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,OAAO,GAAqC,EAAE,CAAC;QACrD,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAkC,CAAC,EAAE,CAAC;YAC/E,MAAM,IAAI,GAAG,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAE,CAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5G,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,IAAI,aAAa,MAAM,yBAAyB,CAAC,CAAC;YAC/G,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,GAAG,IAAI,YAAY,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7E,CAAC;QACD,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAWD,iFAAiF;AACjF,MAAM,UAAU,mBAAmB,CAAC,IAAsB,EAAE,KAAkB,EAAE,YAAoB;IAClG,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC;IACzE,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,IAAI,KAAK;QAClD,YAAY,EAAE,UAAU,CAAC,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,IAAI,qBAAqB,EAAE,eAAe,CAAC;QAC3G,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,CAAC;KAC1F,CAAC;AACJ,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,YAAY,CAAC,aAAqB;IAChD,OAAO,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,aAAa,SAAS,CAAC;AAC3H,CAAC;AAYD,4FAA4F;AAC5F,MAAM,UAAU,gBAAgB,CAAC,aAAqB,EAAE,MAA6B;IACnF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;IACxC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC;QAC9C,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,IAAI,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3D,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IAChI,CAAC,CAAC,CAAC;AACL,CAAC;AAOD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,aAAqB,EACrB,MAA6B,EAC7B,MAAoB,EACpB,SAA+B,EAC/B,MAAc;IAEd,MAAM,OAAO,GAAG,gBAAgB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACxD,MAAM,MAAM,GAA6B,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,QAAQ,GACZ,KAAK,KAAK,IAAI;YACZ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAiB,EAAE,CAAC,CAAC;gBACxC,MAAM;gBACN,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,oBAAoB;aAC3D,CAAC,CAAC;YACL,CAAC,CAAC,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACrC,CAAC"}

package/dist/fixture-auth.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Session-derived request auth for code-issued HTTP calls (mission fixtures, #140/#144) — the
+ * "#135-style" helper: authenticate a request exactly as the app's own page would, from the run's
+ * `--storage-state` (a bearer token the SPA keeps in localStorage, or the session cookies) or from a
+ * `--secret-field` binding. No browser is needed: the storageState JSON already holds what the page
+ * would read.
+ *
+ * Every value this module returns is a credential. Callers put it on the wire and NOWHERE else — it
+ * never reaches a model, a log line or an artifact (fixture step logs never include request headers).
+ *
+ * NOTE (coordination): #135 (authenticated invariant probes) needs the same thing; if it lands its
+ * own helper, fold one into the other.
+ */
+export type RequestAuth = 
+/** `<header>: <scheme> <localStorage[key]>` for the request's origin (default `Authorization: Bearer`). */
+{
+    readonly from: "localStorage";
+    readonly key: string;
+    readonly scheme?: string;
+    readonly header?: string;
+}
+/** The storageState cookies that match the request URL, as a `Cookie` header. */
+ | {
+    readonly from: "cookies";
+}
+/** `<header>: <scheme> <value>` from a `--secret-field` binding, named by its env variable. */
+ | {
+    readonly from: "secretField";
+    readonly name: string;
+    readonly scheme?: string;
+    readonly header?: string;
+};
+export interface AuthSources {
+    /** Path of the run's Playwright storageState JSON (`--storage-state`). */
+    readonly storageStatePath?: string;
+    /** `--secret-field` values by their env-variable name. */
+    readonly secretFields?: Readonly<Record<string, string>>;
+}
+export declare class FixtureAuthError extends Error {
+    constructor(message: string);
+}
+/**
+ * A storageState file's `localStorage[key]` for `origin` (or null) — the same lookup `authHeaders`
+ * does for its `localStorage` source, exposed on its own for #173: an observer's cross-actor probe
+ * authenticates from its OWN storageState file this way, with no browser and no navigation needed.
+ */
+export declare function localStorageValue(storageStatePath: string, origin: string, key: string): string | null;
+/**
+ * The header(s) `auth` adds to a request to `url`. Throws `FixtureAuthError` (naming the source,
+ * never a value) when the source is missing — a fixture never silently runs unauthenticated.
+ */
+export declare function authHeaders(auth: RequestAuth, url: string, sources: AuthSources): Record<string, string>;

package/dist/fixture-auth.js

@@ -0,0 +1,82 @@
+import { readFileSync } from "node:fs";
+export class FixtureAuthError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "FixtureAuthError";
+    }
+}
+function readStorageState(path) {
+    let raw;
+    try {
+        raw = JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch (e) {
+        // The message names the file only: its contents are credentials.
+        throw new FixtureAuthError(`cannot read storage state ${path}: ${e instanceof SyntaxError ? "not valid JSON" : "unreadable"}`);
+    }
+    const o = (raw ?? {});
+    const cookies = Array.isArray(o.cookies) ? o.cookies.filter((c) => typeof c?.name === "string" && typeof c.value === "string" && typeof c.domain === "string") : [];
+    const origins = Array.isArray(o.origins)
+        ? o.origins.filter((x) => typeof x?.origin === "string" && Array.isArray(x.localStorage))
+        : [];
+    return { cookies, origins };
+}
+const LOOPBACK = new Set(["localhost", "127.0.0.1", "[::1]"]);
+function cookieMatches(c, url, nowSec) {
+    const domain = c.domain.startsWith(".") ? c.domain.slice(1) : c.domain;
+    const host = url.hostname;
+    if (host !== domain && !(c.domain.startsWith(".") && host.endsWith(`.${domain}`)))
+        return false;
+    const path = c.path ?? "/";
+    if (!url.pathname.startsWith(path))
+        return false;
+    if (c.secure === true && url.protocol !== "https:" && !LOOPBACK.has(host))
+        return false;
+    if (typeof c.expires === "number" && c.expires > 0 && c.expires < nowSec)
+        return false;
+    return true;
+}
+function withScheme(scheme, value, fallback) {
+    const s = scheme ?? fallback;
+    return s === "" ? value : `${s} ${value}`;
+}
+/**
+ * A storageState file's `localStorage[key]` for `origin` (or null) — the same lookup `authHeaders`
+ * does for its `localStorage` source, exposed on its own for #173: an observer's cross-actor probe
+ * authenticates from its OWN storageState file this way, with no browser and no navigation needed.
+ */
+export function localStorageValue(storageStatePath, origin, key) {
+    const state = readStorageState(storageStatePath);
+    return state.origins.find((o) => o.origin === origin)?.localStorage.find((i) => i.name === key)?.value ?? null;
+}
+/**
+ * The header(s) `auth` adds to a request to `url`. Throws `FixtureAuthError` (naming the source,
+ * never a value) when the source is missing — a fixture never silently runs unauthenticated.
+ */
+export function authHeaders(auth, url, sources) {
+    const target = new URL(url);
+    if (auth.from === "secretField") {
+        const value = sources.secretFields?.[auth.name];
+        if (value === undefined || value === "") {
+            throw new FixtureAuthError(`auth needs the --secret-field bound to env:${auth.name}, which this run does not have`);
+        }
+        return { [auth.header ?? "authorization"]: withScheme(auth.scheme, value, "Bearer") };
+    }
+    if (sources.storageStatePath === undefined) {
+        throw new FixtureAuthError(`auth from ${auth.from} needs --storage-state`);
+    }
+    const state = readStorageState(sources.storageStatePath);
+    if (auth.from === "cookies") {
+        const nowSec = Date.now() / 1000;
+        const jar = state.cookies.filter((c) => cookieMatches(c, target, nowSec));
+        if (jar.length === 0)
+            throw new FixtureAuthError(`the storage state has no cookie for ${target.origin}`);
+        return { cookie: jar.map((c) => `${c.name}=${c.value}`).join("; ") };
+    }
+    const entry = state.origins.find((o) => o.origin === target.origin)?.localStorage.find((i) => i.name === auth.key);
+    if (entry === undefined || entry.value === "") {
+        throw new FixtureAuthError(`the storage state has no localStorage "${auth.key}" for ${target.origin}`);
+    }
+    return { [auth.header ?? "authorization"]: withScheme(auth.scheme, entry.value, "Bearer") };
+}
+//# sourceMappingURL=fixture-auth.js.map

package/dist/fixture-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fixture-auth.js","sourceRoot":"","sources":["../src/fixture-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AA+BvC,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAgBD,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,iEAAiE;QACjE,MAAM,IAAI,gBAAgB,CAAC,6BAA6B,IAAI,KAAK,CAAC,YAAY,WAAW,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;IACjI,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAA4B,CAAC;IACjD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,OAA0B,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxL,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QACtC,CAAC,CAAE,CAAC,CAAC,OAAmC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QACtH,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAE9D,SAAS,aAAa,CAAC,CAAe,EAAE,GAAQ,EAAE,MAAc;IAC9D,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACvE,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC1B,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAChG,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC;IAC3B,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACxF,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,GAAG,MAAM;QAAE,OAAO,KAAK,CAAC;IACvF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAC,MAA0B,EAAE,KAAa,EAAE,QAAgB;IAC7E,MAAM,CAAC,GAAG,MAAM,IAAI,QAAQ,CAAC;IAC7B,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,gBAAwB,EAAE,MAAc,EAAE,GAAW;IACrF,MAAM,KAAK,GAAG,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;IACjD,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;AACjH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAiB,EAAE,GAAW,EAAE,OAAoB;IAC9E,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,gBAAgB,CAAC,8CAA8C,IAAI,CAAC,IAAI,gCAAgC,CAAC,CAAC;QACtH,CAAC;QACD,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;IACxF,CAAC;IACD,IAAI,OAAO,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC3C,MAAM,IAAI,gBAAgB,CAAC,aAAa,IAAI,CAAC,IAAI,wBAAwB,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QACjC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1E,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,uCAAuC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACzG,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACvE,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC;IACnH,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,gBAAgB,CAAC,0CAA0C,IAAI,CAAC,GAAG,SAAS,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;AAC9F,CAAC"}

package/dist/fixture-cli.d.ts

@@ -0,0 +1,70 @@
+import type { Command } from "commander";
+import type { MissionFailure } from "@jevitate/domain";
+import type { SecretField } from "@jevitate/explore";
+import { FixtureSetupError, MissionFixtures, UnboundSetupRefError, type FixtureBindings, type FixtureRecord, type FixtureSpec } from "./mission-fixtures.js";
+/**
+ * The CLI side of mission fixtures (#140/#144): the shared flags, building the lifecycle from them
+ * (or from a target's `fixtures` in `~/.jevitate/targets.json`), the static `${setup.x}` checks that
+ * run before any browser or request, and the `inconclusive` result a failed setup ends a run with.
+ */
+export interface FixtureFlags {
+    readonly fixtures?: string;
+    readonly before?: string;
+    readonly after?: string;
+    readonly allowShellHooks?: boolean;
+    readonly hookTimeoutMs?: string;
+}
+/** Adds `--fixtures`, `--before`, `--after`, `--allow-shell-hooks` and `--hook-timeout-ms`. */
+export declare function withFixtureFlags(cmd: Command): Command;
+export interface FixtureContext {
+    readonly allowlist: readonly string[];
+    readonly baseUrl: string;
+    readonly storageState?: string;
+    readonly secretFields?: readonly SecretField[];
+    readonly secrets?: readonly string[];
+    /** A target's own fixtures file (`~/.jevitate/targets.json`), used when `--fixtures` is absent. */
+    readonly targetFixtures?: string;
+    /** A spec already validated elsewhere (a persisted mission result), used when no file is given. */
+    readonly spec?: FixtureSpec;
+}
+/** The run's fixture lifecycle, or `undefined` when none was asked for. Throws `FixtureSpecError`. */
+export declare function buildMissionFixtures(flags: FixtureFlags, ctx: FixtureContext): MissionFixtures | undefined;
+/**
+ * Before any browser or request: every `${setup.x}` in `texts` must be an output the fixture
+ * declares (unless a `--before` hook may bind it), and a run without fixtures may not reference one.
+ */
+export declare function checkSetupRefs(texts: Readonly<Record<string, string | readonly string[] | undefined>>, fx: MissionFixtures | undefined): void;
+/** Throws unless a `${setup.*}` reference in `url` leaves its origin fixed (the allowlist is decided before setup runs). */
+export declare function checkUrlRefOrigin(url: string): void;
+/** The `${setup.*}`-bearing strings of an invariants spec, keyed `--invariants <path>`, for {@link checkSetupRefs}. */
+export declare function invariantSetupTexts(spec: unknown): Record<string, string>;
+/**
+ * `${setup.x}` in an invariants spec (#187) — probe paths, `deniedAs.open`, capture routes — bound
+ * once setup ran. Origin-fixed like a fixture step: a bound value that moves a string off the origin
+ * it resolved to with the reference unfilled (`//evil.test/…`) is refused, never probed.
+ */
+export declare function substituteSpecSetupRefs<T>(spec: T, b: FixtureBindings, baseUrl: string): T;
+/** The typed result a run ends with when its fixture could not be set up: `inconclusive`, a configuration error. */
+export interface FixtureSetupFailedResult {
+    readonly outcome: "inconclusive";
+    readonly reason: string;
+    readonly failure: MissionFailure;
+    readonly attribution: "configuration";
+    readonly exitCode: 2;
+    readonly fixtures: FixtureRecord;
+}
+export declare function fixtureSetupFailedResult(err: FixtureSetupError | UnboundSetupRefError, fx: MissionFixtures): FixtureSetupFailedResult;
+/**
+ * Regression capture (#144): every reproduce/minimize replay restores + re-runs the fixture the
+ * failing Recording was made from. The spec is `--fixtures`, else the one saved in `--result`
+ * (re-validated against that mission's allowlist); shell hooks must be re-supplied (and match the
+ * mission's by hash). A Recording that carries a fixture identity is never replayed without one.
+ */
+export declare function regressionFixtures(flags: FixtureFlags, recording: {
+    readonly site: string;
+    readonly fixture?: {
+        readonly identity: string;
+    };
+}, missionResult: unknown, 
+/** `--storage-state` (#129): wins over the one recorded with the mission. */
+storageState?: string): MissionFixtures | undefined;

package/dist/fixture-cli.js

@@ -0,0 +1,178 @@
+import { positiveIntArg } from "./cli-args.js";
+import { FixtureSetupError, FixtureSpecError, MissionFixtures, SETUP_REF, UnboundSetupRefError, hookHash, loadFixtureFile, parseFixtureSpec, referencedNames, substituteSetupRefs, } from "./mission-fixtures.js";
+/** Adds `--fixtures`, `--before`, `--after`, `--allow-shell-hooks` and `--hook-timeout-ms`. */
+export function withFixtureFlags(cmd) {
+    return cmd
+        .option("--fixtures <file>", "mission fixtures JSON {setup:[...], restore:[...]} (#140/#144): HTTP steps to an --allow origin, authenticated from " +
+        "--storage-state/--secret-field, run before the mission and restored after it — and around every replay. Outputs bind as ${setup.<name>}")
+        .option("--before <cmd>", "operator shell hook run before the mission and every replay (needs --allow-shell-hooks); may print {vars, secret}")
+        .option("--after <cmd>", "operator shell hook run after the mission and every replay (needs --allow-shell-hooks)")
+        .option("--allow-shell-hooks", "opt in to running --before/--after (operator commands; never model-chosen)", false)
+        .option("--hook-timeout-ms <ms>", "timeout for each --before/--after hook (default 60000; the process group is killed)", positiveIntArg);
+}
+function hooksOf(flags) {
+    if (flags.before === undefined && flags.after === undefined)
+        return undefined;
+    const timeoutMs = flags.hookTimeoutMs === undefined ? undefined : Number(flags.hookTimeoutMs);
+    if (timeoutMs !== undefined && !(Number.isInteger(timeoutMs) && timeoutMs > 0)) {
+        throw new FixtureSpecError("--hook-timeout-ms must be a positive integer");
+    }
+    return {
+        ...(flags.before === undefined ? {} : { before: flags.before }),
+        ...(flags.after === undefined ? {} : { after: flags.after }),
+        ...(timeoutMs === undefined ? {} : { timeoutMs }),
+    };
+}
+/** The run's fixture lifecycle, or `undefined` when none was asked for. Throws `FixtureSpecError`. */
+export function buildMissionFixtures(flags, ctx) {
+    const hooks = hooksOf(flags);
+    const file = flags.fixtures ?? ctx.targetFixtures;
+    const bounds = { allowlist: ctx.allowlist, baseUrl: ctx.baseUrl };
+    const spec = file !== undefined ? loadFixtureFile(file, bounds, { openRefs: hooks?.before !== undefined }) : ctx.spec;
+    if (spec === undefined && hooks === undefined)
+        return undefined;
+    const secretFields = Object.fromEntries((ctx.secretFields ?? []).filter((f) => f.kind === "value").map((f) => [f.name, f.secret]));
+    return new MissionFixtures({
+        ...bounds,
+        ...(spec === undefined ? {} : { spec }),
+        ...(hooks === undefined ? {} : { hooks }),
+        allowShellHooks: flags.allowShellHooks === true,
+        auth: { ...(ctx.storageState === undefined ? {} : { storageStatePath: ctx.storageState }), secretFields },
+        ...(ctx.secrets === undefined ? {} : { secrets: ctx.secrets }),
+    });
+}
+/**
+ * Before any browser or request: every `${setup.x}` in `texts` must be an output the fixture
+ * declares (unless a `--before` hook may bind it), and a run without fixtures may not reference one.
+ */
+export function checkSetupRefs(texts, fx) {
+    // `null`: a `--before` hook may bind more names at run time (still checked when substituted).
+    const declared = fx === undefined ? new Set() : fx.declaredOutputs();
+    const secret = fx?.declaredSecretOutputs() ?? new Set();
+    for (const [where, v] of Object.entries(texts)) {
+        for (const text of v === undefined ? [] : typeof v === "string" ? [v] : v) {
+            for (const name of referencedNames(text)) {
+                if (fx === undefined)
+                    throw new UnboundSetupRefError(`${where} references \${setup.${name}} but the run has no --fixtures/--before`);
+                if (secret.has(name)) {
+                    throw new UnboundSetupRefError(`${where} references the secret output \${setup.${name}}; secret outputs stay inside the fixture's own requests`);
+                }
+                if (declared !== null && !declared.has(name))
+                    throw new UnboundSetupRefError(`${where} references \${setup.${name}}, which the fixture does not output`);
+            }
+        }
+    }
+}
+/** Throws unless a `${setup.*}` reference in `url` leaves its origin fixed (the allowlist is decided before setup runs). */
+export function checkUrlRefOrigin(url) {
+    if (!url.includes("${setup."))
+        return;
+    try {
+        if (new URL(url.replace(SETUP_REF, "0")).origin !== new URL(url.replace(SETUP_REF, "x.evil.test")).origin)
+            throw new Error("origin");
+    }
+    catch {
+        throw new UnboundSetupRefError("--url: a ${setup.*} reference may fill the path or query, never the origin — put it after a `/` (e.g. `http://host:8093/${setup.path}` with a path value that has no leading `/`, or `http://host:8093/projects/${setup.id}`)");
+    }
+}
+/** Every string inside an invariants spec (#187), with the JSON path it sits at. */
+function specStrings(v, path, out) {
+    if (typeof v === "string")
+        out.push([path, v]);
+    else if (Array.isArray(v))
+        v.forEach((x, i) => specStrings(x, `${path}[${i}]`, out));
+    else if (v !== null && typeof v === "object")
+        for (const [k, x] of Object.entries(v))
+            specStrings(x, path === "" ? k : `${path}.${k}`, out);
+    return out;
+}
+/** The `${setup.*}`-bearing strings of an invariants spec, keyed `--invariants <path>`, for {@link checkSetupRefs}. */
+export function invariantSetupTexts(spec) {
+    return Object.fromEntries(specStrings(spec, "", []).filter(([, s]) => s.includes("${setup.")).map(([p, s]) => [`--invariants ${p}`, s]));
+}
+/**
+ * `${setup.x}` in an invariants spec (#187) — probe paths, `deniedAs.open`, capture routes — bound
+ * once setup ran. Origin-fixed like a fixture step: a bound value that moves a string off the origin
+ * it resolved to with the reference unfilled (`//evil.test/…`) is refused, never probed.
+ */
+export function substituteSpecSetupRefs(spec, b, baseUrl) {
+    const walk = (v, path) => {
+        if (typeof v === "string") {
+            if (!v.includes("${setup."))
+                return v;
+            const where = `--invariants ${path}`;
+            const out = substituteSetupRefs(v, b, { where });
+            let before = null;
+            let after = null;
+            try {
+                before = new URL(v.replace(SETUP_REF, "0"), baseUrl).origin;
+                after = new URL(out, baseUrl).origin;
+            }
+            catch {
+                // not a URL — nothing to keep on an origin
+            }
+            if (before !== after)
+                throw new UnboundSetupRefError(`${where}: a \${setup.*} value may fill the path or query, never the origin`);
+            return out;
+        }
+        if (Array.isArray(v))
+            return v.map((x, i) => walk(x, `${path}[${i}]`));
+        if (v !== null && typeof v === "object")
+            return Object.fromEntries(Object.entries(v).map(([k, x]) => [k, walk(x, path === "" ? k : `${path}.${k}`)]));
+        return v;
+    };
+    return walk(spec, "");
+}
+export function fixtureSetupFailedResult(err, fx) {
+    const reason = err instanceof FixtureSetupError ? err.message : `fixture setup failed: ${err.message}`;
+    return {
+        outcome: "inconclusive",
+        reason,
+        failure: { kind: "configuration", message: reason },
+        attribution: "configuration",
+        exitCode: 2,
+        fixtures: fx.record(),
+    };
+}
+/**
+ * Regression capture (#144): every reproduce/minimize replay restores + re-runs the fixture the
+ * failing Recording was made from. The spec is `--fixtures`, else the one saved in `--result`
+ * (re-validated against that mission's allowlist); shell hooks must be re-supplied (and match the
+ * mission's by hash). A Recording that carries a fixture identity is never replayed without one.
+ */
+export function regressionFixtures(flags, recording, missionResult, 
+/** `--storage-state` (#129): wins over the one recorded with the mission. */
+storageState) {
+    const result = isObject(missionResult) && isObject(missionResult.result) ? missionResult.result : undefined;
+    const target = isObject(result?.target) ? result.target : undefined;
+    const saved = isObject(result?.fixtures) ? result.fixtures : undefined;
+    const allowlist = Array.isArray(target?.allowlist) ? target.allowlist.filter((a) => typeof a === "string") : [recording.site];
+    const baseUrl = typeof target?.seedUrl === "string" ? target.seedUrl : recording.site;
+    const savedHooks = isObject(saved?.hooks) ? saved.hooks : {};
+    if ((savedHooks.before !== undefined || savedHooks.after !== undefined) &&
+        ((flags.before === undefined ? undefined : hookHash(flags.before)) !== savedHooks.before ||
+            (flags.after === undefined ? undefined : hookHash(flags.after)) !== savedHooks.after)) {
+        throw new FixtureSpecError("the mission ran with --before/--after shell hooks: re-supply the SAME commands with --allow-shell-hooks");
+    }
+    const spec = flags.fixtures === undefined && saved?.spec !== undefined
+        ? parseFixtureSpec(saved.spec, { allowlist, baseUrl }, { openRefs: flags.before !== undefined })
+        : undefined;
+    const fx = buildMissionFixtures(flags, {
+        allowlist,
+        baseUrl,
+        ...(storageState !== undefined
+            ? { storageState }
+            : typeof target?.storageStatePath === "string"
+                ? { storageState: target.storageStatePath }
+                : {}),
+        ...(spec === undefined ? {} : { spec }),
+    });
+    if (fx === undefined && recording.fixture !== undefined) {
+        throw new FixtureSpecError(`this Recording started from fixture ${recording.fixture.identity}: pass --fixtures (or --result with its saved fixture) so every replay restores the same state`);
+    }
+    return fx;
+}
+function isObject(v) {
+    return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+//# sourceMappingURL=fixture-cli.js.map

package/dist/fixture-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fixture-cli.js","sourceRoot":"","sources":["../src/fixture-cli.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAG/C,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,SAAS,EACT,oBAAoB,EACpB,QAAQ,EACR,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,mBAAmB,GAKpB,MAAM,uBAAuB,CAAC;AAgB/B,+FAA+F;AAC/F,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,OAAO,GAAG;SACP,MAAM,CACL,mBAAmB,EACnB,sHAAsH;QACpH,yIAAyI,CAC5I;SACA,MAAM,CAAC,gBAAgB,EAAE,mHAAmH,CAAC;SAC7I,MAAM,CAAC,eAAe,EAAE,wFAAwF,CAAC;SACjH,MAAM,CAAC,qBAAqB,EAAE,4EAA4E,EAAE,KAAK,CAAC;SAClH,MAAM,CAAC,wBAAwB,EAAE,qFAAqF,EAAE,cAAc,CAAC,CAAC;AAC7I,CAAC;AAcD,SAAS,OAAO,CAAC,KAAmB;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC9E,MAAM,SAAS,GAAG,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC9F,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,gBAAgB,CAAC,8CAA8C,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO;QACL,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAC/D,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QAC5D,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,oBAAoB,CAAC,KAAmB,EAAE,GAAmB;IAC3E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,IAAI,GAAG,CAAC,cAAc,CAAC;IAClD,MAAM,MAAM,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IAClE,MAAM,IAAI,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACtH,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAChE,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACnI,OAAO,IAAI,eAAe,CAAC;QACzB,GAAG,MAAM;QACT,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACvC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QACzC,eAAe,EAAE,KAAK,CAAC,eAAe,KAAK,IAAI;QAC/C,IAAI,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,EAAE,YAAY,EAAE;QACzG,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;KAC/D,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAAuE,EAAE,EAA+B;IACrI,8FAA8F;IAC9F,MAAM,QAAQ,GAAG,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,EAAU,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC;IAC7E,MAAM,MAAM,GAAG,EAAE,EAAE,qBAAqB,EAAE,IAAI,IAAI,GAAG,EAAU,CAAC;IAChE,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,KAAK,MAAM,IAAI,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzC,IAAI,EAAE,KAAK,SAAS;oBAAE,MAAM,IAAI,oBAAoB,CAAC,GAAG,KAAK,wBAAwB,IAAI,0CAA0C,CAAC,CAAC;gBACrI,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACrB,MAAM,IAAI,oBAAoB,CAAC,GAAG,KAAK,0CAA0C,IAAI,0DAA0D,CAAC,CAAC;gBACnJ,CAAC;gBACD,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,oBAAoB,CAAC,GAAG,KAAK,wBAAwB,IAAI,sCAAsC,CAAC,CAAC;YAC3J,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,4HAA4H;AAC5H,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO;IACtC,IAAI,CAAC;QACH,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvI,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oBAAoB,CAC5B,+NAA+N,CAChO,CAAC;IACJ,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,SAAS,WAAW,CAAC,CAAU,EAAE,IAAY,EAAE,GAAuB;IACpE,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;SAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;SAChF,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,WAAW,CAAC,CAAC,EAAE,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5I,OAAO,GAAG,CAAC;AACb,CAAC;AAED,uHAAuH;AACvH,MAAM,UAAU,mBAAmB,CAAC,IAAa;IAC/C,OAAO,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3I,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAI,IAAO,EAAE,CAAkB,EAAE,OAAe;IACrF,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,IAAY,EAAW,EAAE;QACjD,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAAE,OAAO,CAAC,CAAC;YACtC,MAAM,KAAK,GAAG,gBAAgB,IAAI,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,mBAAmB,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACjD,IAAI,MAAM,GAAkB,IAAI,CAAC;YACjC,IAAI,KAAK,GAAkB,IAAI,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC;gBAC5D,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,2CAA2C;YAC7C,CAAC;YACD,IAAI,MAAM,KAAK,KAAK;gBAAE,MAAM,IAAI,oBAAoB,CAAC,GAAG,KAAK,oEAAoE,CAAC,CAAC;YACnI,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACtJ,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,OAAO,IAAI,CAAC,IAAI,EAAE,EAAE,CAAM,CAAC;AAC7B,CAAC;AAYD,MAAM,UAAU,wBAAwB,CAAC,GAA6C,EAAE,EAAmB;IACzG,MAAM,MAAM,GAAG,GAAG,YAAY,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB,GAAG,CAAC,OAAO,EAAE,CAAC;IACvG,OAAO;QACL,OAAO,EAAE,cAAc;QACvB,MAAM;QACN,OAAO,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE;QACnD,WAAW,EAAE,eAAe;QAC5B,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,EAAE,CAAC,MAAM,EAAE;KACtB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAmB,EACnB,SAAsF,EACtF,aAAsB;AACtB,6EAA6E;AAC7E,YAAqB;IAErB,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5G,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC3I,MAAM,OAAO,GAAG,OAAO,MAAM,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC;IACtF,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,IACE,CAAC,UAAU,CAAC,MAAM,KAAK,SAAS,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS,CAAC;QACnE,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,UAAU,CAAC,MAAM;YACtF,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,UAAU,CAAC,KAAK,CAAC,EACvF,CAAC;QACD,MAAM,IAAI,gBAAgB,CAAC,yGAAyG,CAAC,CAAC;IACxI,CAAC;IACD,MAAM,IAAI,GACR,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,EAAE,IAAI,KAAK,SAAS;QACvD,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChG,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,EAAE,GAAG,oBAAoB,CAAC,KAAK,EAAE;QACrC,SAAS;QACT,OAAO;QACP,GAAG,CAAC,YAAY,KAAK,SAAS;YAC5B,CAAC,CAAC,EAAE,YAAY,EAAE;YAClB,CAAC,CAAC,OAAO,MAAM,EAAE,gBAAgB,KAAK,QAAQ;gBAC5C,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,gBAAgB,EAAE;gBAC3C,CAAC,CAAC,EAAE,CAAC;QACT,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;KACxC,CAAC,CAAC;IACH,IAAI,EAAE,KAAK,SAAS,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACxD,MAAM,IAAI,gBAAgB,CACxB,uCAAuC,SAAS,CAAC,OAAO,CAAC,QAAQ,gGAAgG,CAClK,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC"}

package/dist/github-issue-filer.d.ts

@@ -0,0 +1,62 @@
+import { type CredentialStore, type RetryDeps } from "@jevitate/ai-core";
+import type { IssueFilerPort, IssueRef, NewIssue } from "@jevitate/domain";
+/**
+ * The GitHub adapter for the domain's `IssueFilerPort` (owner ruling 3). It prefers the `gh` CLI
+ * when it is installed (the user's own authenticated session); otherwise it uses the REST API with
+ * `GITHUB_TOKEN` from jevitate's credential store. The token goes ONLY into the Authorization
+ * header — never into a message, a log line, an error, or an issue — and any error text is
+ * scrubbed of it before it leaves this module.
+ *
+ * Both transports are injectable so tests exercise the exact commands/requests without ever
+ * talking to GitHub.
+ */
+export interface ExecResult {
+    readonly code: number;
+    readonly stdout: string;
+    readonly stderr: string;
+}
+/** Runs a command with optional stdin. No shell — arguments are passed verbatim (portable). */
+export type Exec = (cmd: string, args: readonly string[], stdin?: string) => Promise<ExecResult>;
+export type FetchLike = (url: string, init: {
+    method: string;
+    headers: Record<string, string>;
+    body?: string;
+}) => Promise<{
+    readonly status: number;
+    text(): Promise<string>;
+}>;
+export declare const defaultExec: Exec;
+export interface GitHubIssueFilerDeps {
+    readonly store: CredentialStore;
+    readonly exec?: Exec;
+    readonly fetch?: FetchLike;
+    readonly apiBase?: string;
+    /** Backoff for transient REST failures (injected clock in tests). */
+    readonly retry?: RetryDeps;
+}
+export declare class GitHubFilingError extends Error {
+    readonly code: "E_ISSUE_FILING";
+    /** The HTTP status, for a REST failure (drives the transient-retry decision). */
+    readonly status?: number;
+    constructor(message: string, status?: number);
+}
+export declare class GitHubIssueFiler implements IssueFilerPort {
+    #private;
+    constructor(deps: GitHubIssueFilerDeps);
+    /** `gh` when it is installed and runnable, else REST (which needs `GITHUB_TOKEN`). */
+    mode(): Promise<"gh" | "rest">;
+    findOpenByMarker(repo: string, marker: string): Promise<IssueRef | null>;
+    /**
+     * Creating an issue is NOT idempotent, so it is never blindly retried: a "failed" create (a 502,
+     * a dropped connection) may well have persisted. After a transient failure the fingerprint
+     * search runs again — if the issue now exists it IS the one this call created and is returned;
+     * only if it is still absent is the create tried again, on the backoff schedule. A body without a
+     * fingerprint marker cannot be checked, so it gets exactly one attempt. Same for both transports.
+     */
+    create(repo: string, issue: NewIssue): Promise<IssueRef>;
+    /**
+     * An occurrence comment is not idempotent either: it gets exactly one attempt (a duplicate
+     * comment is worse than a missing one — the draft on disk keeps the occurrence either way).
+     */
+    comment(repo: string, number: number, body: string): Promise<IssueRef>;
+}