@m2-ai/lattice-cli 0.0.0-stage → 0.8.7

package/dist/security/commands.js

@@ -0,0 +1,825 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runSecurityCommand = runSecurityCommand;
+exports.isSecurityRunMode = isSecurityRunMode;
+const node_crypto_1 = require("node:crypto");
+const node_path_1 = require("node:path");
+const inquirer_1 = __importDefault(require("inquirer"));
+const api_js_1 = require("./api.js");
+const artifact_js_1 = require("./artifact.js");
+const connection_js_1 = require("./connection.js");
+const journal_js_1 = require("./journal.js");
+const runtime_js_1 = require("./runtime.js");
+const RUN_COMMANDS = new Set(['scan', 'deep', 'release', 'report', 'publish']);
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const MAX_FINISH_BYTES = 1_048_576;
+function valueFor(args, flag) {
+    const indexes = args.map((value, index) => value === flag ? index : -1).filter((index) => index >= 0);
+    if (indexes.length > 1)
+        throw new Error(`${flag} may be supplied only once.`);
+    if (indexes.length === 0)
+        return undefined;
+    const value = args[indexes[0] + 1];
+    if (!value || value.startsWith('--'))
+        throw new Error(`${flag} requires a value.`);
+    return value;
+}
+function option(args, ...flags) {
+    const values = flags.map((flag) => valueFor(args, flag)).filter((value) => !!value);
+    if (values.length > 1 && new Set(values).size > 1)
+        throw new Error(`${flags.join('/')} values conflict.`);
+    return values[0];
+}
+function uuidOption(args, flag) {
+    const value = valueFor(args, flag);
+    if (value && !UUID.test(value))
+        throw new Error(`${flag} must be a UUID.`);
+    return value?.toLowerCase();
+}
+function printSecurityHelp(write) {
+    write('Lattice Security (customer-run VSG adapter)');
+    write('');
+    write('  lattice security connect --app <uuid> [--api-url <origin>]');
+    write('  lattice security status [--app <uuid>] [--json]');
+    write('  lattice security scan|deep|release|report [--publish] [--entitlement <uuid>]');
+    write('  lattice security publish --report <retained-vsg-output-directory> --parent-run <uuid>');
+    write('  lattice security publish --journal <uuid>');
+    write('  lattice security logout [--app <uuid>]');
+    write('');
+    write('deep/release project scripts require interactive consent or --allow-project-scripts.');
+    write('publish --report re-exports a retained VSG output directory through the artifact exporter, which verifies current source and runtime provenance; it does not upload arbitrary JSON.');
+    write('Tokens are entered through a masked prompt or LATTICE_SECURITY_TOKEN and are never accepted as command arguments.');
+}
+function statusLines(status) {
+    const lines = [
+        `Security app: ${status.app.name} (${status.app.id})`,
+        `Repository: ${status.app.repositoryIdentity}`,
+        `Publication: ${status.publicationEnabled ? 'enabled' : 'disabled'}`,
+    ];
+    if (status.releaseBlockers.length > 0)
+        lines.push(`Release blockers: ${status.releaseBlockers.join(', ')}`);
+    if (status.entitlements.length === 0)
+        lines.push('Entitlements: none');
+    for (const entitlement of status.entitlements) {
+        lines.push(`${entitlement.kind} ${entitlement.id}: ${entitlement.remainingUnits} remaining, ${entitlement.reservedUnits} reserved, artifact ${entitlement.artifactStatus}`);
+    }
+    return lines;
+}
+async function defaultPromptToken() {
+    const response = await inquirer_1.default.prompt([
+        { type: 'password', name: 'token', message: 'Paste the app-scoped Security token:', mask: '*' },
+    ]);
+    return response.token;
+}
+async function defaultConfirmProjectScripts() {
+    if (!process.stdin.isTTY)
+        return false;
+    const response = await inquirer_1.default.prompt([{
+            type: 'confirm', name: 'approved', default: false,
+            message: 'Allow VSG to run this project\'s own scripts with your local user permissions?',
+        }]);
+    return response.approved;
+}
+function connectionOptions(args, deps) {
+    return {
+        appId: option(args, '--app', '--app-id'),
+        apiUrl: valueFor(args, '--api-url'),
+        filePath: deps.connectionPath ?? (0, connection_js_1.defaultSecurityConnectionPath)(),
+    };
+}
+async function connect(args, deps) {
+    const env = deps.env ?? process.env;
+    const appId = (0, connection_js_1.validateSecurityAppId)(option(args, '--app', '--app-id') ?? env.LATTICE_SECURITY_APP_ID ?? '');
+    const apiUrl = (0, connection_js_1.normalizeSecurityApiUrl)(valueFor(args, '--api-url') ?? env.LATTICE_SECURITY_API_URL ?? env.LATTICE_API_URL ?? 'https://latticeai.app');
+    const token = (0, connection_js_1.validateSecurityToken)(env.LATTICE_SECURITY_TOKEN ?? await (deps.promptToken ?? defaultPromptToken)());
+    const connection = { apiUrl, appId, token, connectedAt: new Date().toISOString() };
+    const response = await (deps.getStatus ?? api_js_1.getSecurityStatus)(connection);
+    await (deps.saveConnection ?? connection_js_1.saveSecurityConnection)(connection, deps.connectionPath ?? (0, connection_js_1.defaultSecurityConnectionPath)());
+    (deps.stdout ?? console.log)(`Connected Security app ${response.app.name} (${response.app.id}).`);
+    return 0;
+}
+async function status(args, deps) {
+    const connection = await (deps.resolveConnection ?? connection_js_1.resolveSecurityConnection)(connectionOptions(args, deps));
+    const response = await (deps.getStatus ?? api_js_1.getSecurityStatus)(connection);
+    const write = deps.stdout ?? console.log;
+    if (args.includes('--json'))
+        write(JSON.stringify(response, null, 2));
+    else
+        statusLines(response).forEach((line) => write(line));
+    return 0;
+}
+async function logout(args, deps) {
+    const removed = await (deps.removeConnection ?? connection_js_1.removeSecurityConnection)(connectionOptions(args, deps));
+    (deps.stdout ?? console.log)(`Removed the local Security connection for app ${removed.appId}.`);
+    return 0;
+}
+function runtimeMatches(required, actual) {
+    return required !== null && Object.keys(actual).every((key) => (required[key] === actual[key]));
+}
+function matchingEntitlements(statusResponse, inspection) {
+    return statusResponse.entitlements.filter((item) => (item.providerStatus === 'active'
+        && item.artifactStatus === 'rights_cleared'
+        && runtimeMatches(item.requiredRuntime, inspection.manifest.identity)));
+}
+function assertLocalEntitlement(statusResponse, inspection, mode) {
+    if (!statusResponse.entitledModes.includes(mode))
+        throw new Error(`Security mode ${mode} is not entitled for this app.`);
+    if (matchingEntitlements(statusResponse, inspection).filter((item) => !(mode === 'scan' && item.kind === 'security_launch')).length === 0) {
+        throw new Error('No Security entitlement matches this exact commercial runtime.');
+    }
+}
+function selectEntitlement(statusResponse, inspection, args, mode) {
+    if (!statusResponse.publicationEnabled)
+        throw new Error('Security publication is disabled for this app.');
+    if (!statusResponse.entitledModes.includes(mode))
+        throw new Error(`Security mode ${mode} is not entitled for this app.`);
+    const requested = uuidOption(args, '--entitlement');
+    const candidates = matchingEntitlements(statusResponse, inspection).filter((item) => (item.remainingUnits > 0 && !(mode === 'scan' && item.kind === 'security_launch')));
+    if (requested) {
+        const selected = candidates.find((item) => item.id === requested);
+        if (!selected)
+            throw new Error('The selected Security entitlement is unavailable, exhausted, or not bound to a rights-cleared runtime.');
+        return selected.id;
+    }
+    if (candidates.length !== 1) {
+        throw new Error(candidates.length === 0
+            ? 'No publishable Security entitlement is available.'
+            : 'Multiple Security entitlements are available; select one with --entitlement.');
+    }
+    return candidates[0].id;
+}
+function exactFinishBody(report) {
+    const body = JSON.stringify({ outcome: 'completed', report });
+    if (Buffer.byteLength(body, 'utf8') > MAX_FINISH_BYTES)
+        throw new Error('Security publish request exceeds the 1 MiB wire limit.');
+    return body;
+}
+function syncFailureExit(localExit, error) {
+    if (localExit === 1 || localExit === 3)
+        return localExit;
+    if (error instanceof api_js_1.SecurityApiRequestError && error.status !== null && [401, 402, 403, 404, 429].includes(error.status))
+        return 3;
+    return 2;
+}
+function finishFailureMessage(journalId, error, pendingMessage, deps) {
+    if (!(error instanceof api_js_1.SecurityApiRequestError) || error.retryable)
+        return pendingMessage;
+    const code = boundedSecurityError(error.code, [], deps).replace(/[^a-zA-Z0-9_.-]/g, '_').slice(0, 80);
+    const status = error.status === null ? '' : ` HTTP ${error.status}`;
+    return `Security publication was refused by the service${status} (${code}): ${boundedSecurityError(error, [], deps)}. The local result and journal ${journalId} are retained.`;
+}
+function requiresLocalAgentReview(report) {
+    if (!report || typeof report !== 'object' || !Array.isArray(report.checks))
+        return false;
+    return report.checks.some((check) => (!!check && typeof check === 'object'
+        && 'id' in check && check.id === 'agent-review'
+        && 'status' in check && check.status === 'missing'
+        && 'required' in check && check.required === true));
+}
+function completedReportFromSavedRequest(body) {
+    try {
+        const request = JSON.parse(body);
+        if (!request || typeof request !== 'object'
+            || !('outcome' in request) || request.outcome !== 'completed'
+            || !('report' in request))
+            return null;
+        return request.report;
+    }
+    catch {
+        return null;
+    }
+}
+function quoteCommandPath(path) {
+    return process.platform === 'win32'
+        ? `'${path.replaceAll("'", "''")}'`
+        : `'${path.replaceAll("'", "'\\''")}'`;
+}
+function printLocalReviewContinuation(report, appId, repo, outDir, initialRunId, write) {
+    if (!requiresLocalAgentReview(report))
+        return;
+    const briefPath = (0, node_path_1.join)(outDir, 'agent', 'brief.md');
+    write(`VSG requires local agent review. Open ${quoteCommandPath(briefPath)} and complete the review with your chosen reviewer.`);
+    write('After review, generate a fresh report from the retained output:');
+    write(`  lattice security report --app ${appId} --repo ${quoteCommandPath(repo)} --out ${quoteCommandPath(outDir)}`);
+    if (initialRunId) {
+        write(`Publish that fresh report as a retest of initial cloud run ${initialRunId}:`);
+        write(`  lattice security publish --app ${appId} --repo ${quoteCommandPath(repo)} --report ${quoteCommandPath(outDir)} --parent-run ${initialRunId}`);
+    }
+    else {
+        write('No initial cloud run ID is available for this local run; a parent-bound publication needs the actual initial run ID.');
+    }
+}
+function isSourceChangedError(error) {
+    return !!error && typeof error === 'object' && 'code' in error && error.code === 'source_changed';
+}
+function isJournalContentionError(error) {
+    if (!error || typeof error !== 'object')
+        return false;
+    if ('code' in error && ['ENOENT', 'EPERM', 'EACCES', 'EBUSY'].includes(String(error.code)))
+        return true;
+    if (!(error instanceof Error))
+        return false;
+    return [
+        'Security publish journal is not resumable.',
+        'Security publish journal is not awaiting begin.',
+        'Security publish journal is not awaiting acknowledgment.',
+        'Security publish journal cannot record this local result.',
+        'Security publish journal is not awaiting a finish request.',
+    ].includes(error.message);
+}
+async function verifyCommercialRuntime(args, statusResponse, deps) {
+    const root = valueFor(args, '--artifact') ?? deps.artifactRoot ?? (0, node_path_1.join)(__dirname, '..', 'security-runtime');
+    const inspection = await (deps.inspectArtifact ?? artifact_js_1.inspectSecurityArtifact)(root);
+    try {
+        (deps.assertArtifactEligible ?? artifact_js_1.assertCommercialArtifactEligible)(inspection);
+    }
+    catch (error) {
+        const server = statusResponse.releaseBlockers.length > 0 ? ` Server blockers: ${statusResponse.releaseBlockers.join(', ')}.` : '';
+        throw new Error(`${error instanceof Error ? error.message : String(error)}${server}`);
+    }
+    return inspection;
+}
+async function confirmScripts(mode, args, deps) {
+    if (mode !== 'deep' && mode !== 'release')
+        return;
+    if (args.includes('--allow-project-scripts'))
+        return;
+    if (!await (deps.confirmProjectScripts ?? defaultConfirmProjectScripts)()) {
+        throw new Error(`Security ${mode} requires consent to run project scripts. Re-run interactively or pass --allow-project-scripts.`);
+    }
+}
+function beginJournalInput(clientRequestId, connection, entitlementId, mode, parentRunId, context) {
+    return {
+        id: clientRequestId, apiUrl: connection.apiUrl, appId: connection.appId, clientRequestId,
+        entitlementId, mode, parentRunId, ...context,
+    };
+}
+async function cleanupAcknowledgedJournal(journal, deps) {
+    const root = deps.journalRoot ?? (0, journal_js_1.defaultSecurityJournalRoot)();
+    try {
+        await (deps.removeJournal ?? journal_js_1.removeSecurityPublishJournal)(journal.id, root);
+    }
+    catch {
+        (deps.stderr ?? console.error)(`Security cloud result was accepted; local journal cleanup remains for ${journal.id}.`);
+    }
+}
+function sameRecoveryOwner(parent, child) {
+    return child.recoveryParentId === parent.id && child.apiUrl === parent.apiUrl && child.appId === parent.appId
+        && child.recoveryRootId === (parent.recoveryRootId ?? parent.id)
+        && child.artifactRoot === parent.artifactRoot && child.artifactManifestSha256 === parent.artifactManifestSha256
+        && child.repositoryIdentity === parent.repositoryIdentity && child.repo === parent.repo && child.outDir === parent.outDir
+        && child.entitlementId === parent.entitlementId && child.mode === parent.mode
+        && child.parentRunId === parent.parentRunId && child.retainedCompleted && parent.retainedCompleted
+        && child.localExit === parent.localExit && child.reportPath === parent.reportPath;
+}
+async function cleanupReceiptPayloads(receipt, deps) {
+    const root = deps.journalRoot ?? (0, journal_js_1.defaultSecurityJournalRoot)();
+    try {
+        for (const journalId of receipt.journalIds) {
+            await (deps.removeJournal ?? journal_js_1.removeSecurityPublishJournal)(journalId, root, true);
+        }
+    }
+    catch {
+        (deps.stderr ?? console.error)(`Security cloud result was accepted; recovery journal cleanup remains for ${receipt.rootJournalId}.`);
+    }
+}
+async function cleanupAcknowledgedRecoveryGraph(final, deps) {
+    if (final.state !== 'acknowledged' || final.recoveryParentId === null || final.recoveryRootId === null
+        || !final.runId || final.localExit === null || final.acknowledgedExit === null) {
+        throw new Error('Security recovery acknowledgment is invalid.');
+    }
+    const root = deps.journalRoot ?? (0, journal_js_1.defaultSecurityJournalRoot)();
+    const existingReceipt = await (deps.readAcknowledgment ?? journal_js_1.readSecurityAcknowledgment)(final.recoveryRootId, root);
+    if (existingReceipt) {
+        await cleanupReceiptPayloads(existingReceipt, deps);
+        return;
+    }
+    const chain = [final];
+    let child = final;
+    try {
+        while (child.recoveryParentId !== null) {
+            const parent = await (deps.readAnyJournal ?? journal_js_1.readSecurityJournal)(child.recoveryParentId, root);
+            const link = await (deps.readRecovery ?? journal_js_1.readSecurityRecovery)(parent.id, root);
+            if (!link || link.childJournalId !== child.id || !sameRecoveryOwner(parent, child)) {
+                throw new Error('Security recovery graph ownership or lineage is invalid.');
+            }
+            chain.push(parent);
+            child = parent;
+        }
+    }
+    catch (error) {
+        const concurrentReceipt = await (deps.readAcknowledgment ?? journal_js_1.readSecurityAcknowledgment)(final.recoveryRootId, root);
+        if (!concurrentReceipt)
+            throw error;
+        await cleanupReceiptPayloads(concurrentReceipt, deps);
+        return;
+    }
+    const rootJournal = chain.at(-1);
+    const receipt = {
+        version: 1,
+        rootJournalId: rootJournal.id,
+        finalJournalId: final.id,
+        finalRunId: final.runId,
+        journalIds: chain.map((journal) => journal.id),
+        apiUrl: final.apiUrl,
+        appId: final.appId,
+        localExit: final.acknowledgedExit,
+        acknowledgedAt: new Date().toISOString(),
+    };
+    await (deps.saveAcknowledgment ?? journal_js_1.saveSecurityAcknowledgment)(receipt, root);
+    await cleanupReceiptPayloads(receipt, deps);
+}
+async function finishJournal(journal, body, connection, localExit, deps) {
+    const root = deps.journalRoot ?? (0, journal_js_1.defaultSecurityJournalRoot)();
+    const pending = await (deps.setJournalRequest ?? journal_js_1.setSecurityPublishJournalRequest)({
+        ...journal,
+        acknowledgedExit: localExit,
+    }, body, root);
+    if (!pending.runId)
+        throw new Error('Security publish journal has no reserved run.');
+    if (pending.state === 'acknowledged') {
+        if (pending.recoveryParentId === null)
+            await cleanupAcknowledgedJournal(pending, deps);
+        else
+            await cleanupAcknowledgedRecoveryGraph(pending, deps);
+        return { exitCode: pending.acknowledgedExit ?? localExit, synchronized: true };
+    }
+    try {
+        await (deps.finishRun ?? api_js_1.finishSecurityRun)(connection, pending.runId, body);
+    }
+    catch (error) {
+        (deps.stderr ?? console.error)(finishFailureMessage(pending.id, error, `Security result is local; cloud sync is pending for app ${pending.appId} in journal ${pending.id}. Retry the exact saved request with lattice security publish --app ${pending.appId} --journal ${pending.id}. This replays the immutable request and does not include agent-review findings added afterward.`, deps));
+        return { exitCode: syncFailureExit(localExit, error), synchronized: false };
+    }
+    let acknowledged;
+    try {
+        acknowledged = await (deps.markJournalAcknowledged ?? journal_js_1.markSecurityJournalAcknowledged)(pending, root);
+    }
+    catch {
+        (deps.stderr ?? console.error)(`Security cloud result was accepted; local acknowledgment could not be recorded for journal ${pending.id}.`);
+        return { exitCode: localExit, synchronized: true };
+    }
+    if (acknowledged.recoveryParentId === null)
+        await cleanupAcknowledgedJournal(acknowledged, deps);
+    else
+        await cleanupAcknowledgedRecoveryGraph(acknowledged, deps);
+    return { exitCode: localExit, synchronized: true };
+}
+async function abortReservedRunResult(journal, connection, reason, deps, localExit = 2) {
+    return finishJournal(journal, JSON.stringify({ outcome: 'aborted', reason }), connection, localExit, deps);
+}
+async function abortReservedRun(journal, connection, reason, deps, localExit = 2) {
+    return (await abortReservedRunResult(journal, connection, reason, deps, localExit)).exitCode;
+}
+function reservationExpired(journal) {
+    return journal.reservationExpiresAt !== null && Date.parse(journal.reservationExpiresAt) <= Date.now();
+}
+function expiredLeaseError(error) {
+    return error instanceof api_js_1.SecurityApiRequestError
+        && (error.status === 409 || error.status === 410)
+        && /expired|lease|reservation/i.test(error.code);
+}
+async function exportRetainedJournal(journal, inspection, runId, writeLocalReport, deps) {
+    return (deps.exportReport ?? runtime_js_1.exportSecurityReport)({
+        inspection,
+        repo: journal.repo,
+        outDir: journal.outDir,
+        runId,
+        mode: journal.mode,
+        repositoryIdentity: journal.repositoryIdentity,
+        writeLocalReport,
+    });
+}
+async function completedRecoveryExit(journal, connection, deps) {
+    const root = deps.journalRoot ?? (0, journal_js_1.defaultSecurityJournalRoot)();
+    const recoveryRootId = journal.recoveryRootId ?? journal.id;
+    const receipt = await (deps.readAcknowledgment ?? journal_js_1.readSecurityAcknowledgment)(recoveryRootId, root);
+    if (!receipt)
+        return null;
+    if (receipt.apiUrl !== connection.apiUrl || receipt.appId !== connection.appId
+        || !receipt.journalIds.some((journalId) => journalId.toLowerCase() === journal.id.toLowerCase())) {
+        throw new Error('Security acknowledgment receipt belongs to a different app connection or recovery lineage.');
+    }
+    await cleanupReceiptPayloads(receipt, deps);
+    return receipt.localExit;
+}
+async function recoverExpiredJournal(parent, connection, deps) {
+    if (!parent.retainedCompleted || parent.localExit === null || !parent.reportPath) {
+        throw new Error(`Security journal ${parent.id} has no completed retained result to recover; run the scan again.`);
+    }
+    const completedExit = await completedRecoveryExit(parent, connection, deps);
+    if (completedExit !== null)
+        return { exitCode: completedExit, synchronized: true };
+    const root = deps.journalRoot ?? (0, journal_js_1.defaultSecurityJournalRoot)();
+    const existingRecovery = await (deps.readRecovery ?? journal_js_1.readSecurityRecovery)(parent.id, root);
+    let child = null;
+    if (existingRecovery) {
+        child = await (deps.readAnyJournal ?? journal_js_1.readSecurityJournal)(existingRecovery.childJournalId, root);
+        if (!sameRecoveryOwner(parent, child))
+            throw new Error('Security recovery journal does not match its parent.');
+        if (child.state !== 'begin_pending')
+            return resumeJournal(child, connection, deps);
+    }
+    const statusResponse = await (deps.getStatus ?? api_js_1.getSecurityStatus)(connection);
+    if (statusResponse.app.repositoryIdentity !== parent.repositoryIdentity) {
+        throw new Error('Security journal repository identity no longer matches this app.');
+    }
+    const inspection = await (deps.inspectArtifact ?? artifact_js_1.inspectSecurityArtifact)(parent.artifactRoot);
+    (deps.assertArtifactEligible ?? artifact_js_1.assertCommercialArtifactEligible)(inspection);
+    if (inspection.manifestSha256 !== parent.artifactManifestSha256) {
+        throw new Error('Security journal requires a different commercial artifact.');
+    }
+    selectEntitlement(statusResponse, inspection, ['--entitlement', parent.entitlementId], parent.mode);
+    await exportRetainedJournal(parent, inspection, (0, node_crypto_1.randomUUID)(), false, deps);
+    const preCreateExit = await completedRecoveryExit(parent, connection, deps);
+    if (preCreateExit !== null)
+        return { exitCode: preCreateExit, synchronized: true };
+    if (!child) {
+        const recovery = await (deps.createOrReadRecovery ?? journal_js_1.createOrReadSecurityRecovery)(parent.id, root);
+        try {
+            child = await (deps.readAnyJournal ?? journal_js_1.readSecurityJournal)(recovery.childJournalId, root);
+        }
+        catch (error) {
+            if (!(error && typeof error === 'object' && 'code' in error && error.code === 'ENOENT'))
+                throw error;
+            try {
+                child = await (deps.createBeginJournal ?? journal_js_1.createSecurityBeginJournal)(beginJournalInput(recovery.childJournalId, connection, parent.entitlementId, parent.mode, parent.parentRunId, {
+                    recoveryParentId: parent.id,
+                    recoveryRootId: parent.recoveryRootId ?? parent.id,
+                    repo: parent.repo,
+                    outDir: parent.outDir,
+                    artifactRoot: parent.artifactRoot,
+                    artifactManifestSha256: parent.artifactManifestSha256,
+                    repositoryIdentity: parent.repositoryIdentity,
+                    retainedCompleted: true,
+                    localExit: parent.localExit,
+                    acknowledgedExit: null,
+                    reportPath: parent.reportPath,
+                }), root);
+            }
+            catch (createError) {
+                if (!(createError instanceof Error && /already exists/.test(createError.message)))
+                    throw createError;
+                child = await (deps.readAnyJournal ?? journal_js_1.readSecurityJournal)(recovery.childJournalId, root);
+            }
+        }
+    }
+    if (!sameRecoveryOwner(parent, child)) {
+        throw new Error('Security recovery journal does not match its parent.');
+    }
+    const preResumeExit = await completedRecoveryExit(child, connection, deps);
+    if (preResumeExit !== null)
+        return { exitCode: preResumeExit, synchronized: true };
+    return resumeJournal(child, connection, deps, inspection);
+}
+async function resumeJournal(initial, connection, deps, knownInspection) {
+    const root = deps.journalRoot ?? (0, journal_js_1.defaultSecurityJournalRoot)();
+    let journal = initial;
+    if (journal.state === 'acknowledged') {
+        if (journal.recoveryParentId === null)
+            await cleanupAcknowledgedJournal(journal, deps);
+        else
+            await cleanupAcknowledgedRecoveryGraph(journal, deps);
+        (deps.stdout ?? console.log)(`Security publish journal ${journal.id} is already synchronized.`);
+        return { exitCode: journal.acknowledgedExit ?? journal.localExit ?? 0, synchronized: true };
+    }
+    if (journal.state === 'pending_finish') {
+        if (reservationExpired(journal))
+            return recoverExpiredJournal(journal, connection, deps);
+        const retained = await (deps.readJournal ?? journal_js_1.readSecurityPublishJournal)(journal.id, root);
+        if (!retained.journal.runId)
+            throw new Error('Security publish journal has no reserved run.');
+        try {
+            await (deps.finishRun ?? api_js_1.finishSecurityRun)(connection, retained.journal.runId, retained.exactRequestBody);
+        }
+        catch (error) {
+            if (expiredLeaseError(error))
+                return recoverExpiredJournal(retained.journal, connection, deps);
+            (deps.stderr ?? console.error)(finishFailureMessage(journal.id, error, `Security cloud sync remains pending for app ${retained.journal.appId} in journal ${journal.id}. Retry the exact saved request with lattice security publish --app ${retained.journal.appId} --journal ${journal.id}. This replays the immutable request and does not include agent-review findings added afterward.`, deps));
+            return {
+                exitCode: syncFailureExit(retained.journal.acknowledgedExit ?? retained.journal.localExit ?? 0, error),
+                synchronized: false,
+            };
+        }
+        const acknowledged = await (deps.markJournalAcknowledged ?? journal_js_1.markSecurityJournalAcknowledged)(retained.journal, root);
+        if (acknowledged.recoveryParentId === null)
+            await cleanupAcknowledgedJournal(acknowledged, deps);
+        else
+            await cleanupAcknowledgedRecoveryGraph(acknowledged, deps);
+        (deps.stdout ?? console.log)(`Security publish journal ${journal.id} synchronized.`);
+        if (retained.journal.mode === 'deep' || retained.journal.mode === 'release') {
+            printLocalReviewContinuation(completedReportFromSavedRequest(retained.exactRequestBody), retained.journal.appId, retained.journal.repo, retained.journal.outDir, retained.journal.runId, deps.stdout ?? console.log);
+        }
+        return { exitCode: journal.acknowledgedExit ?? journal.localExit ?? 0, synchronized: true };
+    }
+    if (journal.state === 'begin_pending') {
+        const begin = await (deps.beginRun ?? api_js_1.beginSecurityRun)(connection, {
+            clientRequestId: journal.clientRequestId,
+            entitlementId: journal.entitlementId,
+            mode: journal.mode,
+            parentRunId: journal.parentRunId,
+        });
+        if (begin.state === 'expired') {
+            if (journal.retainedCompleted)
+                return recoverExpiredJournal(journal, connection, deps);
+            throw new Error(`Security journal ${journal.id} expired before a completed result was retained; run the scan again.`);
+        }
+        if (begin.state !== 'reserved')
+            throw new Error(`Security journal ${journal.id} cannot resume from server state ${begin.state}.`);
+        journal = await (deps.setJournalReservation ?? journal_js_1.setSecurityJournalReservation)(journal, begin, root);
+    }
+    if (!['reserved', 'result_ready'].includes(journal.state))
+        throw new Error('Security publish journal is not resumable.');
+    if (reservationExpired(journal)) {
+        if (journal.retainedCompleted)
+            return recoverExpiredJournal(journal, connection, deps);
+        throw new Error(`Security journal ${journal.id} expired before a completed result was retained; run the scan again.`);
+    }
+    if (!journal.retainedCompleted || journal.localExit === null || !journal.reportPath) {
+        throw new Error(`Security journal ${journal.id} has no completed retained result to resume; run the scan again.`);
+    }
+    const localExit = journal.localExit;
+    const inspection = knownInspection ?? await (deps.inspectArtifact ?? artifact_js_1.inspectSecurityArtifact)(journal.artifactRoot);
+    (deps.assertArtifactEligible ?? artifact_js_1.assertCommercialArtifactEligible)(inspection);
+    if (inspection.manifestSha256 !== journal.artifactManifestSha256 || !journal.runId) {
+        throw new Error('Security recovery journal requires a different commercial artifact.');
+    }
+    let exported;
+    try {
+        exported = await exportRetainedJournal(journal, inspection, journal.runId, true, deps);
+    }
+    catch (error) {
+        const reason = isSourceChangedError(error) ? 'source_changed' : 'publisher_failed';
+        const abortResult = await abortReservedRunResult(journal, connection, reason, deps, localExit === 1 ? 1 : 2);
+        (deps.stderr ?? console.error)(`Security retained report export failed: ${boundedSecurityError(error, [], deps)}`);
+        return abortResult;
+    }
+    if (journal.state === 'reserved') {
+        journal = await (deps.setJournalResult ?? journal_js_1.setSecurityJournalResult)(journal, {
+            reportPath: exported.reportPath,
+            localExit,
+        }, root);
+    }
+    else {
+        journal = { ...journal, reportPath: exported.reportPath };
+    }
+    if (journal.state === 'pending_finish' || journal.state === 'acknowledged') {
+        return resumeJournal(journal, connection, deps, inspection);
+    }
+    const result = await finishJournal(journal, exactFinishBody(exported.compactReport), connection, localExit, deps);
+    if (result.synchronized)
+        (deps.stdout ?? console.log)(`Security publish journal ${journal.id} synchronized.`);
+    return result;
+}
+async function retryJournal(args, connection, deps) {
+    const id = uuidOption(args, '--journal');
+    if (!id)
+        throw new Error('security publish --journal requires a journal UUID.');
+    const root = deps.journalRoot ?? (0, journal_js_1.defaultSecurityJournalRoot)();
+    const readReceipt = deps.readAcknowledgment ?? journal_js_1.readSecurityAcknowledgment;
+    const finishFromReceipt = async (receipt, requestedId) => {
+        if (receipt.apiUrl !== connection.apiUrl || receipt.appId !== connection.appId
+            || !receipt.journalIds.some((journalId) => journalId.toLowerCase() === requestedId.toLowerCase())) {
+            throw new Error('Security acknowledgment receipt belongs to a different app connection or recovery lineage.');
+        }
+        await cleanupReceiptPayloads(receipt, deps);
+        (deps.stdout ?? console.log)(`Security publish journal ${requestedId} is already synchronized.`);
+        return receipt.localExit;
+    };
+    const existingReceipt = await readReceipt(id, root);
+    if (existingReceipt)
+        return finishFromReceipt(existingReceipt, id);
+    let initial;
+    try {
+        initial = await (deps.readAnyJournal ?? journal_js_1.readSecurityJournal)(id, root);
+    }
+    catch (error) {
+        const concurrentReceipt = await readReceipt(id, root);
+        if (!concurrentReceipt)
+            throw error;
+        return finishFromReceipt(concurrentReceipt, id);
+    }
+    const recoveryRootId = initial.recoveryRootId ?? initial.id;
+    const concurrentReceipt = await readReceipt(recoveryRootId, root);
+    if (concurrentReceipt)
+        return finishFromReceipt(concurrentReceipt, id);
+    if (initial.apiUrl !== connection.apiUrl || initial.appId !== connection.appId) {
+        throw new Error('Security publish journal belongs to a different app connection.');
+    }
+    const requiresRecoveryReceipt = initial.recoveryRootId !== null
+        || (initial.retainedCompleted && reservationExpired(initial));
+    for (let attempt = 0;; attempt += 1) {
+        const terminalReceipt = await readReceipt(recoveryRootId, root);
+        if (terminalReceipt)
+            return finishFromReceipt(terminalReceipt, id);
+        try {
+            const result = await resumeJournal(initial, connection, deps);
+            if (!requiresRecoveryReceipt || !result.synchronized)
+                return result.exitCode;
+            const receiptAfterResume = await readReceipt(recoveryRootId, root);
+            if (receiptAfterResume)
+                return finishFromReceipt(receiptAfterResume, id);
+            if (attempt >= 49)
+                throw new Error('Security recovery acknowledgment was not recorded; retry this journal.');
+        }
+        catch (error) {
+            if (!isJournalContentionError(error))
+                throw error;
+            const receiptAfterFailure = await readReceipt(recoveryRootId, root);
+            if (receiptAfterFailure)
+                return finishFromReceipt(receiptAfterFailure, id);
+            if (attempt >= 49)
+                throw error;
+        }
+        await new Promise((resolveDelay) => setTimeout(resolveDelay, 10));
+        initial = await (deps.readAnyJournal ?? journal_js_1.readSecurityJournal)(id, root).catch(() => initial);
+    }
+}
+async function executeCommercialCommand(command, args, deps) {
+    for (const flag of ['--fix', '--install-hook', '--allowlist'])
+        if (args.includes(flag))
+            throw new Error(`${flag} cannot be combined with the paid VSG adapter.`);
+    const connection = await (deps.resolveConnection ?? connection_js_1.resolveSecurityConnection)(connectionOptions(args, deps));
+    if (command === 'publish' && args.includes('--journal'))
+        return retryJournal(args, connection, deps);
+    const statusResponse = await (deps.getStatus ?? api_js_1.getSecurityStatus)(connection);
+    const inspection = await verifyCommercialRuntime(args, statusResponse, deps);
+    const retainedReport = command === 'publish' ? valueFor(args, '--report') : undefined;
+    const mode = retainedReport ? 'report' : command;
+    if (!['scan', 'deep', 'release', 'report'].includes(mode))
+        throw new Error('security publish requires --report or --journal.');
+    await confirmScripts(mode, args, deps);
+    const publish = command === 'publish' || args.includes('--publish');
+    const parentRunId = uuidOption(args, '--parent-run') ?? null;
+    if (mode === 'report' && publish && !parentRunId)
+        throw new Error('Published report retests require --parent-run <uuid>.');
+    const repo = (0, node_path_1.resolve)(deps.cwd ?? process.cwd(), valueFor(args, '--repo') ?? '.');
+    const runtimeOptions = {
+        inspection, repo, mode,
+        repositoryIdentity: statusResponse.app.repositoryIdentity,
+        validateCredentials: args.includes('--validate-credentials'),
+        releaseUrl: valueFor(args, '--url'), base: valueFor(args, '--base'), compare: valueFor(args, '--compare'),
+    };
+    const retainedOutDir = retainedReport ? (0, node_path_1.resolve)(repo, retainedReport) : null;
+    if (!publish) {
+        assertLocalEntitlement(statusResponse, inspection, mode);
+        const runId = (0, node_crypto_1.randomUUID)();
+        const outDir = (0, node_path_1.resolve)(repo, valueFor(args, '--out') ?? (0, node_path_1.join)('.vsg', 'security', runId));
+        let result;
+        try {
+            result = await (deps.runRuntime ?? runtime_js_1.runSecurityRuntime)({ ...runtimeOptions, outDir, runId });
+        }
+        catch (error) {
+            (deps.stderr ?? console.error)(`Security scanner failed: ${boundedSecurityError(error, args, deps)}`);
+            return 2;
+        }
+        const write = deps.stdout ?? console.log;
+        if (result.reportPath)
+            write(`Security result retained locally at ${result.reportPath}.`);
+        if (mode === 'deep' || mode === 'release') {
+            printLocalReviewContinuation(result.report, connection.appId, repo, outDir, null, write);
+        }
+        return result.exitCode;
+    }
+    let retainedReportPath = null;
+    if (retainedOutDir) {
+        const preflight = await (deps.exportReport ?? runtime_js_1.exportSecurityReport)({
+            ...runtimeOptions,
+            outDir: retainedOutDir,
+            runId: (0, node_crypto_1.randomUUID)(),
+            writeLocalReport: false,
+        });
+        retainedReportPath = preflight.reportPath;
+    }
+    const entitlementId = selectEntitlement(statusResponse, inspection, args, mode);
+    const clientRequestId = (0, node_crypto_1.randomUUID)();
+    const outDir = retainedOutDir ?? (0, node_path_1.resolve)(repo, valueFor(args, '--out') ?? (0, node_path_1.join)('.vsg', 'security', clientRequestId));
+    const journalRoot = deps.journalRoot ?? (0, journal_js_1.defaultSecurityJournalRoot)();
+    let journal = await (deps.createBeginJournal ?? journal_js_1.createSecurityBeginJournal)(beginJournalInput(clientRequestId, connection, entitlementId, mode, parentRunId, {
+        recoveryParentId: null,
+        recoveryRootId: null,
+        repo,
+        outDir,
+        artifactRoot: inspection.artifactRoot,
+        artifactManifestSha256: inspection.manifestSha256,
+        repositoryIdentity: statusResponse.app.repositoryIdentity,
+        retainedCompleted: retainedOutDir !== null,
+        localExit: retainedOutDir ? 0 : null,
+        acknowledgedExit: null,
+        reportPath: retainedReportPath,
+    }), journalRoot);
+    let begin;
+    try {
+        begin = await (deps.beginRun ?? api_js_1.beginSecurityRun)(connection, { clientRequestId, entitlementId, mode, parentRunId });
+    }
+    catch (error) {
+        if (error instanceof api_js_1.SecurityApiRequestError && error.status !== null && error.status !== 409 && error.status < 500) {
+            await (deps.removeJournal ?? journal_js_1.removeSecurityPublishJournal)(journal.id, journalRoot);
+        }
+        else {
+            (deps.stderr ?? console.error)(`Security begin is pending in journal ${journal.id}; retry with security publish --journal ${journal.id}.`);
+        }
+        return syncFailureExit(0, error);
+    }
+    if (begin.state !== 'reserved') {
+        (deps.stderr ?? console.error)(`Security begin returned ${begin.state}; journal ${journal.id} cannot continue without a new completed local result.`);
+        return 3;
+    }
+    journal = await (deps.setJournalReservation ?? journal_js_1.setSecurityJournalReservation)(journal, begin, journalRoot);
+    let report = null;
+    try {
+        let compactReport;
+        let reportPath;
+        let localExit = 0;
+        if (retainedOutDir) {
+            const exported = await (deps.exportReport ?? runtime_js_1.exportSecurityReport)({
+                ...runtimeOptions,
+                outDir: retainedOutDir,
+                runId: begin.runId,
+                writeLocalReport: true,
+            });
+            compactReport = exported.compactReport;
+            reportPath = exported.reportPath;
+        }
+        else {
+            const result = await (deps.runRuntime ?? runtime_js_1.runSecurityRuntime)({ ...runtimeOptions, outDir, runId: begin.runId });
+            localExit = result.exitCode;
+            if (!result.compactReport || !result.reportPath)
+                return abortReservedRun(journal, connection, 'scanner_failed', deps, result.exitCode);
+            compactReport = result.compactReport;
+            reportPath = result.reportPath;
+            report = result.report;
+        }
+        journal = await (deps.setJournalResult ?? journal_js_1.setSecurityJournalResult)(journal, { reportPath, localExit }, journalRoot);
+        const finish = await finishJournal(journal, exactFinishBody(compactReport), connection, localExit, deps);
+        if (finish.synchronized)
+            (deps.stdout ?? console.log)(`Security result published from ${reportPath}.`);
+        if (finish.synchronized && (mode === 'deep' || mode === 'release')) {
+            printLocalReviewContinuation(report, connection.appId, repo, outDir, begin.runId, deps.stdout ?? console.log);
+        }
+        return finish.exitCode;
+    }
+    catch (error) {
+        const reason = isSourceChangedError(error) ? 'source_changed' : retainedOutDir ? 'publisher_failed' : 'scanner_failed';
+        const abortExit = await abortReservedRun(journal, connection, reason, deps);
+        (deps.stderr ?? console.error)(`Security scanner/export failed: ${boundedSecurityError(error, args, deps)}`);
+        return abortExit;
+    }
+}
+async function runSecurityCommandImpl(args, deps) {
+    const command = args[0];
+    const rest = args.slice(1);
+    if (!command || command === 'help' || command === '--help' || command === '-h') {
+        printSecurityHelp(deps.stdout ?? console.log);
+        return 0;
+    }
+    if (command === 'connect')
+        return connect(rest, deps);
+    if (command === 'status')
+        return status(rest, deps);
+    if (command === 'logout')
+        return logout(rest, deps);
+    if (RUN_COMMANDS.has(command))
+        return executeCommercialCommand(command, rest, deps);
+    throw new Error(`Unknown Security command: ${command}. Run "lattice security help" for usage.`);
+}
+function forbiddenTokenArgument(args) {
+    return args.some((value) => value === '--token' || value.startsWith('--token='));
+}
+function boundedSecurityError(error, args, deps) {
+    let message = error instanceof Error ? error.message : String(error);
+    const secrets = [
+        deps.env?.LATTICE_SECURITY_TOKEN,
+        ...args.flatMap((value, index) => {
+            if (value === '--token')
+                return args[index + 1] ? [args[index + 1]] : [];
+            if (value.startsWith('--token='))
+                return [value.slice('--token='.length)];
+            return [];
+        }),
+    ].filter((value) => !!value);
+    for (const secret of secrets)
+        message = message.split(secret).join('[REDACTED]');
+    return message.slice(0, 2_000);
+}
+async function runSecurityCommand(args, deps = {}) {
+    const writeError = deps.stderr ?? console.error;
+    if (forbiddenTokenArgument(args)) {
+        writeError('Security error: --token is forbidden because command arguments can be logged. Use the masked prompt or LATTICE_SECURITY_TOKEN.');
+        return 3;
+    }
+    try {
+        return await runSecurityCommandImpl(args, deps);
+    }
+    catch (error) {
+        writeError(`Security error: ${boundedSecurityError(error, args, deps)}`);
+        return 3;
+    }
+}
+function isSecurityRunMode(value) {
+    return value === 'scan' || value === 'deep' || value === 'release' || value === 'report';
+}
+//# sourceMappingURL=commands.js.map