@orcareplay/core 0.3.1-main.g2d7bd68 → 0.4.0

package/dist/index.d.ts

@@ -2,6 +2,7 @@ export * from './blobs.js';
 export * from './fetch.js';
 export * from './graph.js';
 export * from './paths.js';
+export * from './private-files.js';
 export * from './reader.js';
 export * from './redaction.js';
 export * from './writer.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC"}

package/dist/index.js

@@ -2,6 +2,7 @@ export * from './blobs.js';
 export * from './fetch.js';
 export * from './graph.js';
 export * from './paths.js';
+export * from './private-files.js';
 export * from './reader.js';
 export * from './redaction.js';
 export * from './writer.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC"}

package/dist/paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,MAAM;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,wFAAwF;IACxF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE3C;AAED,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE3C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAYhE;AAED,yFAAyF;AACzF,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAG5D;AA6BD,yDAAyD;AACzD,wBAAsB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAc7D;AAaD;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAevF"}
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,MAAM;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,wFAAwF;IACxF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE3C;AAED,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE3C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA8ChE;AAED,yFAAyF;AACzF,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAG5D;AA6BD,yDAAyD;AACzD,wBAAsB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAc7D;AAaD;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAevF"}

package/dist/paths.js

@@ -1,6 +1,7 @@
 import { mkdir, readFile, readdir, stat, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { RUN_ID_PATTERN } from '@orcareplay/schema';
+import { assertPrivatePathIdentity, privatePathIdentity, restrictToOwner, } from './private-files.js';
 export function orcaDir(cwd) {
     return join(cwd, '.orca');
 }
@@ -23,8 +24,41 @@ export function runsDir(cwd) {
  */
 export async function ensureRunsDir(cwd) {
     const dir = runsDir(cwd);
-    await mkdir(dir, { recursive: true, mode: 0o700 });
-    const ignore = join(orcaDir(cwd), '.gitignore');
+    const orca = orcaDir(cwd);
+    if (process.platform === 'win32') {
+        // Secure the container before creating the store inside it. Ownership is checked as well:
+        // removing a foreign owner's ACE alone would leave it able to restore its own access.
+        await mkdir(orca, { recursive: true, mode: 0o700 });
+        const orcaWas = await privatePathIdentity(orca);
+        await restrictToOwner(orca, 0o700);
+        await assertPrivatePathIdentity(orca, orcaWas);
+        await mkdir(dir, { recursive: true, mode: 0o700 });
+        // Check again after making the container non-empty. These checks detect replacement during
+        // setup; they do not lock ancestors against an account that can keep replacing them later.
+        await assertPrivatePathIdentity(orca, orcaWas);
+        const dirWas = await privatePathIdentity(dir);
+        await restrictToOwner(dir, 0o700);
+        await assertPrivatePathIdentity(dir, dirWas);
+    }
+    else {
+        // POSIX, unchanged: only when this call created it, which is what passing `mode` to mkdir
+        // already meant. Every file beneath gets its own 0600 from the writer regardless, so the
+        // directory's mode is not load-bearing, and one the user has deliberately opened up is theirs
+        // to have opened up. `chmod` follows a symlink here, and pointing a store at another disk is
+        // an ordinary thing to do, so there is no link check either.
+        const created = (await mkdir(dir, { recursive: true, mode: 0o700 })) !== undefined;
+        // Swallowed, the way `sync.ts` swallows the same call three times over. `mkdir`'s mode is a
+        // request a filesystem without permissions ignores; `chmod` on that same filesystem fails. And
+        // `ensureRunsDir` is the first thing `record`, `attach`, `replay`, `pull` and `quickstart` all
+        // do, so making it fatal would abort every one of them on an exFAT or vfat workspace that
+        // worked before. What it buys is narrow enough to be worth losing there: umask can only clear
+        // bits, so `mkdir(0o700)` is already at most 0700 and this only restores what an exotic one
+        // took away. On Windows, where the mode is discarded and the ACL is the whole protection, the
+        // branch above stays fatal.
+        if (created)
+            await restrictToOwner(dir, 0o700).catch(() => undefined);
+    }
+    const ignore = join(orca, '.gitignore');
     if (!(await stat(ignore).catch(() => null))) {
         await writeFile(ignore, '# Recordings hold source, shell output and workspace snapshots. Not for committing.\n*\n', { mode: 0o600, flag: 'wx' }).catch(() => undefined);
     }

package/dist/paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"paths.js","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAYpD,MAAM,UAAU,OAAO,CAAC,GAAW;IACjC,OAAO,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,GAAW;IACjC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW;IAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC,CAAC;IAChD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC5C,MAAM,SAAS,CACb,MAAM,EACN,0FAA0F,EAC1F,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAC5B,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,SAAS,CAAC,GAAW,EAAE,KAAa;IAClD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjG,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;AACnC,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,OAAO,CAAC,GAAW;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAIxE,CAAC;QACF,MAAM,EAAE,GAAG,GAAG,CAAC,UAAU,CAAC;QAC1B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAC5D,OAAO;gBACL,SAAS,EAAE,EAAE;gBACb,GAAG,CAAC,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5E,GAAG,CAAC,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7E,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;IAC3C,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;AAC1E,CAAC;AAED,yDAAyD;AACzD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,GAAW;IACxC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,SAAS;QAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACxB,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS;QACzB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC;QAChC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAC3C,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC;AACpE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAW,EAAE,QAAgB;IACpE,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,uBAAuB,OAAO,CAAC,GAAG,CAAC,kDAAkD,CACtF,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAC/D,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,UAAU,QAAQ,OAAO,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IACjG,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAY5B,MAAM,UAAU,OAAO,CAAC,GAAW;IACjC,OAAO,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,GAAW;IACjC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW;IAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAE1B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,0FAA0F;QAC1F,sFAAsF;QACtF,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACnC,MAAM,yBAAyB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAE/C,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,2FAA2F;QAC3F,2FAA2F;QAC3F,MAAM,yBAAyB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAClC,MAAM,yBAAyB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,0FAA0F;QAC1F,yFAAyF;QACzF,8FAA8F;QAC9F,6FAA6F;QAC7F,6DAA6D;QAC7D,MAAM,OAAO,GAAG,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;QACnF,4FAA4F;QAC5F,+FAA+F;QAC/F,+FAA+F;QAC/F,0FAA0F;QAC1F,8FAA8F;QAC9F,4FAA4F;QAC5F,8FAA8F;QAC9F,4BAA4B;QAC5B,IAAI,OAAO;YAAE,MAAM,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACxC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC5C,MAAM,SAAS,CACb,MAAM,EACN,0FAA0F,EAC1F,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAC5B,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,SAAS,CAAC,GAAW,EAAE,KAAa;IAClD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjG,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;AACnC,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,OAAO,CAAC,GAAW;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAIxE,CAAC;QACF,MAAM,EAAE,GAAG,GAAG,CAAC,UAAU,CAAC;QAC1B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAC5D,OAAO;gBACL,SAAS,EAAE,EAAE;gBACb,GAAG,CAAC,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5E,GAAG,CAAC,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7E,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;IAC3C,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;AAC1E,CAAC;AAED,yDAAyD;AACzD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,GAAW;IACxC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,SAAS;QAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACxB,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS;QACzB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC;QAChC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAC3C,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC;AACpE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAW,EAAE,QAAgB;IACpE,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,uBAAuB,OAAO,CAAC,GAAG,CAAC,kDAAkD,CACtF,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAC/D,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,UAAU,QAAQ,OAAO,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IACjG,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/private-files.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Keep a path to its owner — in the currency the filesystem actually has.
+ *
+ * `chmod(path, 0o600)` on Windows sets the read-only attribute and nothing else. The mode bits are
+ * a POSIX idea; what the file really gets is the ACL it inherits from wherever it was written, and
+ * under a workspace on `C:\` that is:
+ *
+ * ```
+ * NT AUTHORITY\Authenticated Users:(I)(M)   ← any authenticated account may rewrite it
+ * BUILTIN\Users:(I)(RX)                     ← any local account may read it
+ * ```
+ *
+ * For a trace that is bad. For the run CA's private key it is the whole point of the feature
+ * undone: that key signs the certificates the agent has been told to trust for the life of the
+ * run, so whoever reads it can impersonate every intercepted host to that agent, and whoever
+ * writes it can substitute a CA of their own. For `config.json` it is a gateway API key sitting
+ * in a file the machine can read.
+ *
+ * So on Windows the promise is kept with an ACL: everything already on it is taken away — the
+ * inherited entries and the explicit ones alike — and the only trustees left are the owner,
+ * SYSTEM and Administrators. That is the rule OpenSSH for Windows enforces on its
+ * own private keys, and it is the closest the platform comes to 0600 — under which root can still
+ * read the file too.
+ *
+ * Callers keep whatever error policy they had: this throws where `chmod` threw.
+ */
+export declare function restrictToOwner(path: string, mode: 0o600 | 0o700): Promise<void>;
+/** The entry itself, without following a junction; bigint preserves the complete NTFS file ID. */
+export interface PrivatePathIdentity {
+    dev: bigint;
+    ino: bigint;
+}
+export declare function privatePathIdentity(path: string): Promise<PrivatePathIdentity>;
+export declare function assertPrivatePathIdentity(path: string, was: PrivatePathIdentity): Promise<void>;
+/** Never recursively clean up a replacement belonging to somebody else. */
+export declare function removePrivateDirectory(path: string, was: PrivatePathIdentity): Promise<void>;
+//# sourceMappingURL=private-files.d.ts.map

package/dist/private-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-files.d.ts","sourceRoot":"","sources":["../src/private-files.ts"],"names":[],"mappings":"AAUA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,GAAG,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAuDtF;AAED,kGAAkG;AAClG,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAKpF;AAED,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,2EAA2E;AAC3E,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,IAAI,CAAC,CAOf"}

package/dist/private-files.js

@@ -0,0 +1,349 @@
+import { execFile } from 'node:child_process';
+import { randomBytes } from 'node:crypto';
+import { lstatSync, rmSync } from 'node:fs';
+import { chmod, lstat, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { isAbsolute, join } from 'node:path';
+import { promisify } from 'node:util';
+const run = promisify(execFile);
+/**
+ * Keep a path to its owner — in the currency the filesystem actually has.
+ *
+ * `chmod(path, 0o600)` on Windows sets the read-only attribute and nothing else. The mode bits are
+ * a POSIX idea; what the file really gets is the ACL it inherits from wherever it was written, and
+ * under a workspace on `C:\` that is:
+ *
+ * ```
+ * NT AUTHORITY\Authenticated Users:(I)(M)   ← any authenticated account may rewrite it
+ * BUILTIN\Users:(I)(RX)                     ← any local account may read it
+ * ```
+ *
+ * For a trace that is bad. For the run CA's private key it is the whole point of the feature
+ * undone: that key signs the certificates the agent has been told to trust for the life of the
+ * run, so whoever reads it can impersonate every intercepted host to that agent, and whoever
+ * writes it can substitute a CA of their own. For `config.json` it is a gateway API key sitting
+ * in a file the machine can read.
+ *
+ * So on Windows the promise is kept with an ACL: everything already on it is taken away — the
+ * inherited entries and the explicit ones alike — and the only trustees left are the owner,
+ * SYSTEM and Administrators. That is the rule OpenSSH for Windows enforces on its
+ * own private keys, and it is the closest the platform comes to 0600 — under which root can still
+ * read the file too.
+ *
+ * Callers keep whatever error policy they had: this throws where `chmod` threw.
+ */
+export async function restrictToOwner(path, mode) {
+    if (process.platform !== 'win32') {
+        await chmod(path, mode);
+        return;
+    }
+    const icacls = system32('icacls.exe');
+    const inherit = mode === 0o700 ? '(OI)(CI)' : '';
+    const was = await privatePathIdentity(path);
+    // Finish the ownership and descriptor lookups before changing permissions. A lookup failure
+    // leaves the original ACL intact; a verification failure below refuses to use the narrowed path.
+    const keep = [await currentAccountSid(), SYSTEM, ADMINISTRATORS];
+    const ours = await requireTrustedOwner(path, keep);
+    await assertPrivatePathIdentity(path, was);
+    const foreign = (await explicitTrustees(icacls, path)).filter((trustee) => !ours.has(trustee));
+    // One invocation, and every part of it narrows.
+    //
+    // `/inheritance:r` removes only the ACEs carrying the inherited flag, and `/grant:r` replaces
+    // previously granted explicit permissions *for the trustees it names* — so an explicit ACE for
+    // anybody else survives both, keeping its `(OI)(CI)` on a directory and passing itself to
+    // everything written afterwards. Measured: grant BUILTIN\Users explicitly, then restrict, and
+    // `(A;;FA;;;BU)` is still on the DACL. "Replace all child object permissions" turns inherited
+    // ACEs into explicit ones, and so do `robocopy /SEC` and a tree carried between machines, so
+    // this is an ordinary shape rather than an exotic one. Hence naming them for removal.
+    //
+    // `/reset` would be the obvious way to clear them and is the wrong one: it replaces the DACL
+    // with whatever the *parent* hands down, so between it and the grant the path holds the
+    // parent's ACL — and a parent is not something this function gets to assume anything about. On
+    // every Windows command the store root would spend that window readable by whoever the
+    // workspace allowed, and anything created inside it would keep that permanently, since icacls
+    // does not re-propagate to children later. Measured too, on a real store.
+    await run(icacls, [
+        path,
+        '/inheritance:r',
+        ...foreign.flatMap((trustee) => ['/remove', `*${trustee}`]),
+        '/grant:r',
+        ...grantsFor(keep, inherit),
+        '/q',
+    ]);
+    // And then read it back, because everything above rests on having understood a descriptor that
+    // this file's own parser has now been wrong about twice. The check is deliberately not that
+    // parser: it matches the whole descriptor, anchored, against the shape this function writes, so
+    // an ACE of a type nobody anticipated fails it rather than being skipped by it.
+    //
+    // Nothing is escaped into the pattern because nothing needs to be — a trustee here is a SID or
+    // one of SDDL's two-letter abbreviations, and both are `[A-Za-z0-9-]`.
+    const written = await descriptorOf(icacls, path);
+    if (!asWritten(ours).test(written)) {
+        throw new Error(`the ACL orca wrote to ${path} is not the one it asked for: ${JSON.stringify(written)}`);
+    }
+    await assertPrivatePathIdentity(path, was);
+}
+export async function privatePathIdentity(path) {
+    const entry = await lstat(path, { bigint: true });
+    if (entry.isSymbolicLink())
+        throw new Error(`${path} is a link, refusing to secure its target`);
+    if (entry.ino === 0n)
+        throw new Error(`${path} has no usable file identity`);
+    return { dev: entry.dev, ino: entry.ino };
+}
+export async function assertPrivatePathIdentity(path, was) {
+    const now = await privatePathIdentity(path);
+    if (now.dev !== was.dev || now.ino !== was.ino) {
+        throw new Error(`${path} was replaced while orca was securing it`);
+    }
+}
+/** Never recursively clean up a replacement belonging to somebody else. */
+export async function removePrivateDirectory(path, was) {
+    try {
+        await assertPrivatePathIdentity(path, was);
+        await rm(path, { recursive: true, force: true });
+    }
+    catch {
+        // A missing or substituted entry is no longer ours to remove.
+    }
+}
+/**
+ * A foreign owner retains WRITE_DAC even after its last ACE is removed. Read the actual owner,
+ * not the DACL's trustees. Windows PowerShell's .NET API works without Get-Acl/module autoload,
+ * elevation, or localized account names. The path is data in the child environment, never code.
+ */
+async function requireTrustedOwner(path, trusted) {
+    const script = `
+$ErrorActionPreference = 'Stop'
+$acl = [System.IO.File]::GetAccessControl($env:ORCA_PRIVATE_PATH, [System.Security.AccessControl.AccessControlSections]::Owner)
+$acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value
+$descriptor = [System.Security.AccessControl.RawSecurityDescriptor]::new('D:(A;;FA;;;' + $env:ORCA_PRIVATE_SID + ')')
+$descriptor.GetSddlForm([System.Security.AccessControl.AccessControlSections]::Access)
+`;
+    const { stdout } = await run(system32('WindowsPowerShell/v1.0/powershell.exe'), [
+        '-NoLogo',
+        '-NoProfile',
+        '-NonInteractive',
+        '-EncodedCommand',
+        Buffer.from(script, 'utf16le').toString('base64'),
+    ], {
+        env: { ...process.env, ORCA_PRIVATE_PATH: path, ORCA_PRIVATE_SID: trusted[0] },
+        windowsHide: true,
+    });
+    const [owner = '', accountDescriptor = ''] = stdout.trim().split(/\r?\n/);
+    if (!trusted.includes(owner)) {
+        throw new Error(`${path} has an untrusted owner (${owner}); refusing to store private data`);
+    }
+    // Windows may serialize the current account as an abbreviation, e.g. LA for the built-in
+    // Administrator. Ask Windows for this SID's spelling; accepting LA for every user would grant
+    // trust to a different account, and guessing from an RID alone would confuse local/domain SIDs.
+    const spelling = /^D:\(A;;FA;;;([A-Z]{2}|S-1-[\d-]+)\)$/.exec(accountDescriptor)?.[1];
+    if (!spelling)
+        throw new Error(`could not read the SDDL spelling of ${trusted[0]}`);
+    return new Set([...trusted, 'SY', 'BA', spelling]);
+}
+/**
+ * The grants a narrowing asks for, and the shape its result has to come back in.
+ *
+ * Shared by `restrictToOwner` and `aclScratch` because they are the same job and drifted apart
+ * once already: the second was written with `/inheritance:r` and `/grant:r` and neither the
+ * read-back nor the reasoning eighty lines above about why exiting 0 is not an answer.
+ *
+ * Nothing is escaped into the pattern because nothing needs to be — a trustee here is a SID or one
+ * of SDDL's two-letter abbreviations, and both are `[A-Za-z0-9-]`.
+ */
+function grantsFor(trustees, inherit) {
+    return trustees.map((sid) => `*${sid}:${inherit}(F)`);
+}
+function asWritten(trustees) {
+    return new RegExp('^D:[A-Z]*P[A-Z]*(?:\\(A;[A-Z]*;[^;]*;;;(?:' + [...trustees].join('|') + ')\\))+$');
+}
+/**
+ * Who a path grants or denies *explicitly*, in whatever spelling icacls itself uses.
+ *
+ * Explicit only, because the inherited ones are already `/inheritance:r`'s job — and naming one of
+ * those alongside it fails the whole invocation. A directory under `%TEMP%` here carries inherited
+ * ACEs for accounts that no longer exist, and `/remove` on such a SID after inheritance has been
+ * stripped cannot map it to a name: `icacls … /inheritance:r /remove *<orphan>` exits 1332 and
+ * applies nothing. Removing only what `/inheritance:r` will leave behind avoids that by being the
+ * more accurate thing to ask for.
+ *
+ * As SDDL, via `/save`, because the names `icacls <path>` prints are localized. Returned verbatim
+ * rather than expanded to SIDs: `/remove` accepts `*BU` as readily as `*S-1-5-32-545`, and a
+ * lookup table of well-known abbreviations would silently pass through any entry it had missed —
+ * which for this function means a trustee that keeps its access.
+ */
+async function explicitTrustees(icacls, path) {
+    const descriptor = await descriptorOf(icacls, path);
+    // (type;flags;rights;object_guid;inherit_object_guid;trustee[;condition]) — `ID` in the flags
+    // marks it inherited. The type is read as a field rather than as one character: `XA`/`XD` are
+    // conditional ACEs, `OA`/`OD` object ones, `AU`/`AL` audits, and a single-character type class
+    // matched none of them. The trustee stops at `;` as well as `)`, because a conditional ACE
+    // carries its expression after the trustee.
+    const aces = [...descriptor.matchAll(/\(([^;]*);([^;]*);[^;]*;[^;]*;[^;]*;([^;)]+)/g)];
+    return [...new Set(aces.filter((ace) => !ace[2].includes('ID')).map((ace) => ace[3]))];
+}
+/** The path's security descriptor, as SDDL. */
+async function descriptorOf(icacls, path) {
+    const saved = join(await aclScratch(icacls), randomBytes(8).toString('hex'));
+    try {
+        await run(icacls, [path, '/save', saved]);
+        return await readDescriptor(saved, path);
+    }
+    finally {
+        await rm(saved, { force: true }).catch(() => undefined);
+    }
+}
+/**
+ * The descriptor out of what `icacls /save` wrote.
+ *
+ * UTF-16LE, and the descriptor is the last line: two lines for an ordinary path — the entry's
+ * name, then its descriptor — and one for a path with no name to give, such as a drive root.
+ *
+ * By position rather than by scanning for a `D:` prefix. A name line cannot carry one today, since
+ * `/save` writes the basename and a Windows filename cannot contain a colon, but that is a fact
+ * about a neighbouring tool rather than about this parse.
+ */
+async function readDescriptor(saved, path) {
+    const lines = (await readFile(saved, 'utf16le'))
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter(Boolean);
+    const descriptor = lines.at(-1) ?? '';
+    // Refused rather than read as "nothing to remove", which is what an unrecognised line would
+    // silently mean: every foreign trustee left in place, and `icacls` still exiting 0.
+    if (!/^[OGDS]:/.test(descriptor) || !descriptor.includes('(')) {
+        throw new Error(`could not read the ACL of ${path}: ${JSON.stringify(descriptor.slice(0, 80))}`);
+    }
+    return descriptor;
+}
+let scratch;
+/**
+ * Somewhere private to write the descriptors this file reads back.
+ *
+ * `mkdtemp` discards its mode on Windows, so a scratch directory under `%TEMP%` takes whatever
+ * that hands down — measured here: two further local accounts, both with inheritable Modify. Every
+ * other temporary directory this feature mints is narrowed the moment it exists, and this one was
+ * not, which matters more rather than less: the file written into it is the *input to both halves
+ * of the only guard this function has* — the descriptor `explicitTrustees` decides the `/remove`
+ * list from, and the descriptor the read-back check compares against what was asked for.
+ * Substituting it hides a foreign trustee from the first and satisfies the second.
+ *
+ * Narrowed directly rather than through `restrictToOwner`, which reads a descriptor, which is read
+ * from here — that would recurse. `execFile` rejects on a non-zero exit, so a narrowing that did
+ * not apply is a throw rather than a descriptor read out of a directory anyone can write.
+ *
+ * One per process, with a random filename per call, so the cost is a single extra `icacls` for the
+ * life of the run rather than two on every path narrowed.
+ */
+async function aclScratch(icacls) {
+    scratch ??= (async () => {
+        const keep = [await currentAccountSid(), SYSTEM, ADMINISTRATORS];
+        const dir = await mkdtemp(join(tmpdir(), 'orca-acl-'));
+        let was;
+        try {
+            was = await privatePathIdentity(dir);
+            const ours = await requireTrustedOwner(dir, keep);
+            await assertPrivatePathIdentity(dir, was);
+            // `mkdtemp` just made this, so it carries no explicit ACE to remove — measured: five, every
+            // one flagged inherited — and it cannot be a link. What it *can* be is swapped, in the gap
+            // between that call and this one, by an account with Modify on `%TEMP%`, which is the ACL
+            // measured here. `icacls` does not follow a reparse point, so the narrowing would land on
+            // the junction while every descriptor this module reads came out of the other directory.
+            // So it is vouched for and re-checked either side, exactly as `ensureRunsDir` does it.
+            await run(icacls, [dir, '/inheritance:r', '/grant:r', ...grantsFor(keep, '(OI)(CI)'), '/q']);
+            await assertPrivatePathIdentity(dir, was);
+            // Keep the directory non-empty between descriptor reads, so an empty-directory removal
+            // cannot replace it after setup. Recheck after this write too. As SECURITY.md explains,
+            // this is not a defense against arbitrary replacement of writable ancestors.
+            await writeFile(join(dir, 'in-use'), String(process.pid), { mode: 0o600, flag: 'wx' });
+            await assertPrivatePathIdentity(dir, was);
+            // And read back what was written, for the reason the sibling gives: `execFile` reports that
+            // icacls exited 0 and nothing more. Read straight rather than through `descriptorOf`, which
+            // writes into this directory and would await the promise it is running inside.
+            const saved = join(dir, 'verify');
+            await run(icacls, [dir, '/save', saved]);
+            const written = await readDescriptor(saved, dir);
+            await rm(saved, { force: true }).catch(() => undefined);
+            if (!asWritten(ours).test(written)) {
+                throw new Error(`the ACL orca wrote to ${dir} is not the one it asked for: ${written}`);
+            }
+            await assertPrivatePathIdentity(dir, was);
+            // Nothing sweeps an `orca-acl-` directory the way `sweepStaleTransports` sweeps the two
+            // named transports, so it takes itself with it rather than accumulating one per run.
+            process.on('exit', () => {
+                try {
+                    const now = lstatSync(dir, { bigint: true });
+                    if (!now.isSymbolicLink() && now.dev === was.dev && now.ino === was.ino) {
+                        rmSync(dir, { recursive: true, force: true });
+                    }
+                }
+                catch {
+                    // Exiting anyway; a directory left in %TEMP% is not worth failing the exit over.
+                }
+            });
+            return dir;
+        }
+        catch (err) {
+            if (was)
+                await removePrivateDirectory(dir, was);
+            scratch = undefined;
+            throw err;
+        }
+    })();
+    return scratch;
+}
+const SYSTEM = 'S-1-5-18';
+const ADMINISTRATORS = 'S-1-5-32-544';
+/**
+ * By SID, never by name: `BUILTIN\Administrators` is localized on a localized Windows, and a grant
+ * naming a principal that does not resolve is a grant that silently matches nothing — which, after
+ * `/inheritance:r` has removed the rest, would leave the file with no usable ACE at all.
+ */
+let sid;
+async function currentAccountSid() {
+    sid ??= readSid().catch((err) => {
+        // Not cached as a rejection: a transient failure here would otherwise be permanent for the
+        // life of the process, and every later write would inherit the ACL we meant to replace.
+        sid = undefined;
+        throw err;
+    });
+    return sid;
+}
+async function readSid() {
+    const { stdout } = await run(system32('whoami.exe'), ['/user', '/fo', 'csv', '/nh']);
+    const found = /S-1-[\d-]+/.exec(stdout)?.[0];
+    if (!found)
+        throw new Error(`could not read this account's SID from: ${stdout.trim()}`);
+    return found;
+}
+/**
+ * Absolute rather than resolved through PATH. This runs in order to secure a private key, and a
+ * lookup that landed on someone else's `icacls.exe` — in the workspace being recorded, say — would
+ * hand that key to exactly the reader the call exists to shut out.
+ *
+ * Which is why there is no fallback. `'C:\Windows'` looks like one and is not: `\W` is not an
+ * escape, so that literal's value is `C:Windows`, and a path beginning with a drive letter and no
+ * separator is *drive-relative* — CreateProcess resolves it against the current directory on C:,
+ * which during a recording is the workspace. `Windows/System32/icacls.exe` is a storable git path,
+ * so the guess reintroduces exactly the hijack it was written against. Spelling it correctly would
+ * still be a guess, and wrong on a machine whose Windows is not on C:.
+ *
+ * `SystemRoot` is set by the OS in every normal process environment. Absent, something is wrong
+ * with how orca was launched, and refusing is the only answer that cannot be silently incorrect.
+ */
+function system32(exe) {
+    const root = process.env['SystemRoot'];
+    // Absolute, not merely present. `SystemRoot=C:Windows` — the same drive-relative shape the
+    // comment above describes — would rebuild the workspace-relative lookup out of the environment
+    // instead of out of a literal, and a wrapper that sets the variable for orca's process is an
+    // ordinary thing to run into. `isAbsolute('C:Windows')` is false and `isAbsolute('C:\Windows')`
+    // is true, so this refuses exactly the values that would resolve against the current directory.
+    if (root === undefined || root === '' || !isAbsolute(root)) {
+        throw new Error(`cannot locate ${exe}: SystemRoot is ${root === undefined || root === '' ? 'not set' : `not an absolute path (${JSON.stringify(root)})`}, ` +
+            'so there is no trustworthy path to it. orca will not fall back to a guess here — this ' +
+            'call is what keeps a private key private.');
+    }
+    return join(root, 'System32', exe);
+}
+//# sourceMappingURL=private-files.js.map

package/dist/private-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-files.js","sourceRoot":"","sources":["../src/private-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEhC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,IAAmB;IACrE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACxB,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAE5C,4FAA4F;IAC5F,iGAAiG;IACjG,MAAM,IAAI,GAAG,CAAC,MAAM,iBAAiB,EAAE,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,yBAAyB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,CAAC,MAAM,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAE/F,gDAAgD;IAChD,EAAE;IACF,8FAA8F;IAC9F,+FAA+F;IAC/F,0FAA0F;IAC1F,8FAA8F;IAC9F,8FAA8F;IAC9F,6FAA6F;IAC7F,sFAAsF;IACtF,EAAE;IACF,6FAA6F;IAC7F,wFAAwF;IACxF,+FAA+F;IAC/F,uFAAuF;IACvF,8FAA8F;IAC9F,0EAA0E;IAC1E,MAAM,GAAG,CAAC,MAAM,EAAE;QAChB,IAAI;QACJ,gBAAgB;QAChB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC;QAC3D,UAAU;QACV,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC;QAC3B,IAAI;KACL,CAAC,CAAC;IAEH,+FAA+F;IAC/F,4FAA4F;IAC5F,gGAAgG;IAChG,gFAAgF;IAChF,EAAE;IACF,+FAA+F;IAC/F,uEAAuE;IACvE,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACjD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,iCAAiC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CACxF,CAAC;IACJ,CAAC;IACD,MAAM,yBAAyB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAY;IACpD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,2CAA2C,CAAC,CAAC;IAChG,IAAI,KAAK,CAAC,GAAG,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,8BAA8B,CAAC,CAAC;IAC7E,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAAY,EACZ,GAAwB;IAExB,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,0CAA0C,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAY,EACZ,GAAwB;IAExB,IAAI,CAAC;QACH,MAAM,yBAAyB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3C,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;IAChE,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,mBAAmB,CAAC,IAAY,EAAE,OAA0B;IACzE,MAAM,MAAM,GAAG;;;;;;CAMhB,CAAC;IACA,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAC1B,QAAQ,CAAC,uCAAuC,CAAC,EACjD;QACE,SAAS;QACT,YAAY;QACZ,iBAAiB;QACjB,iBAAiB;QACjB,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;KAClD,EACD;QACE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE;QAC9E,WAAW,EAAE,IAAI;KAClB,CACF,CAAC;IACF,MAAM,CAAC,KAAK,GAAG,EAAE,EAAE,iBAAiB,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1E,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,4BAA4B,KAAK,mCAAmC,CAAC,CAAC;IAC/F,CAAC;IACD,yFAAyF;IACzF,8FAA8F;IAC9F,gGAAgG;IAChG,MAAM,QAAQ,GAAG,uCAAuC,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACtF,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACpF,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,SAAS,CAAC,QAA2B,EAAE,OAAe;IAC7D,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,IAAI,OAAO,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,SAAS,CAAC,QAA0B;IAC3C,OAAO,IAAI,MAAM,CACf,4CAA4C,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,SAAS,CACnF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,gBAAgB,CAAC,MAAc,EAAE,IAAY;IAC1D,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACpD,8FAA8F;IAC9F,8FAA8F;IAC9F,+FAA+F;IAC/F,2FAA2F;IAC3F,4CAA4C;IAC5C,MAAM,IAAI,GAAG,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,+CAA+C,CAAC,CAAC,CAAC;IACvF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,+CAA+C;AAC/C,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,IAAY;IACtD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QAC1C,OAAO,MAAM,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,cAAc,CAAC,KAAa,EAAE,IAAY;IACvD,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;SAC7C,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,UAAU,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,4FAA4F;IAC5F,oFAAoF;IACpF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CACb,6BAA6B,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAChF,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,IAAI,OAAoC,CAAC;AAEzC;;;;;;;;;;;;;;;;;GAiBG;AACH,KAAK,UAAU,UAAU,CAAC,MAAc;IACtC,OAAO,KAAK,CAAC,KAAK,IAAI,EAAE;QACtB,MAAM,IAAI,GAAG,CAAC,MAAM,iBAAiB,EAAE,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;QACjE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;QACvD,IAAI,GAAoC,CAAC;QACzC,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACrC,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAClD,MAAM,yBAAyB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAE1C,4FAA4F;YAC5F,2FAA2F;YAC3F,0FAA0F;YAC1F,0FAA0F;YAC1F,yFAAyF;YACzF,uFAAuF;YACvF,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;YAC7F,MAAM,yBAAyB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAE1C,uFAAuF;YACvF,wFAAwF;YACxF,6EAA6E;YAC7E,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACvF,MAAM,yBAAyB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAE1C,4FAA4F;YAC5F,4FAA4F;YAC5F,+EAA+E;YAC/E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAClC,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;YACzC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACjD,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACxD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,iCAAiC,OAAO,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,MAAM,yBAAyB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAE1C,wFAAwF;YACxF,qFAAqF;YACrF,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;gBACtB,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC7C,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,GAAG,CAAC,GAAG,KAAK,GAAI,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,GAAI,CAAC,GAAG,EAAE,CAAC;wBAC1E,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;oBAChD,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,iFAAiF;gBACnF,CAAC;YACH,CAAC,CAAC,CAAC;YACH,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG;gBAAE,MAAM,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAChD,OAAO,GAAG,SAAS,CAAC;YACpB,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,MAAM,GAAG,UAAU,CAAC;AAC1B,MAAM,cAAc,GAAG,cAAc,CAAC;AAEtC;;;;GAIG;AACH,IAAI,GAAgC,CAAC;AAErC,KAAK,UAAU,iBAAiB;IAC9B,GAAG,KAAK,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QACvC,2FAA2F;QAC3F,wFAAwF;QACxF,GAAG,GAAG,SAAS,CAAC;QAChB,MAAM,GAAG,CAAC;IACZ,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,OAAO;IACpB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IACrF,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACxF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACvC,2FAA2F;IAC3F,+FAA+F;IAC/F,6FAA6F;IAC7F,gGAAgG;IAChG,gGAAgG;IAChG,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,iBAAiB,GAAG,mBAAmB,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI;YACzI,wFAAwF;YACxF,2CAA2C,CAC9C,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;AACrC,CAAC"}

package/dist/writer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"writer.d.ts","sourceRoot":"","sources":["../src/writer.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,KAAK,EACL,WAAW,EACX,SAAS,EACT,QAAQ,EACR,OAAO,EACP,UAAU,EACX,MAAM,oBAAoB,CAAC;AAc5B,MAAM,WAAW,eAAe;IAC9B,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,WAAW,CAAC;IACrB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,2EAA2E;AAC3E,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,KAAK,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,IAAI,CAAC;CACnB;AAED;;;;;;;GAOG;AACH,qBAAa,WAAW;;IAgBtB,OAAO;WAgBM,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC;IAqCjF;;;;;;;OAOG;IACH,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,IAAI;IAInC,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,IAAI,KAAK,IAAI,MAAM,CAElB;IAED,qFAAqF;IACrF,IAAI,GAAG,IAAI,MAAM,CAEhB;IAEK,MAAM,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;IAmB5C,KAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;CAuElD"}
+{"version":3,"file":"writer.d.ts","sourceRoot":"","sources":["../src/writer.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,KAAK,EACL,WAAW,EACX,SAAS,EACT,QAAQ,EACR,OAAO,EACP,UAAU,EACX,MAAM,oBAAoB,CAAC;AAc5B,MAAM,WAAW,eAAe;IAC9B,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,WAAW,CAAC;IACrB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,2EAA2E;AAC3E,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,KAAK,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,IAAI,CAAC;CACnB;AAED;;;;;;;GAOG;AACH,qBAAa,WAAW;;IAmBtB,OAAO;WAgBM,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC;IAqCjF;;;;;;;OAOG;IACH,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,IAAI;IAInC,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,IAAI,KAAK,IAAI,MAAM,CAElB;IAED,qFAAqF;IACrF,IAAI,GAAG,IAAI,MAAM,CAEhB;IAEK,MAAM,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;IAsD5C,KAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;CA0ElD"}

package/dist/writer.js

@@ -26,6 +26,9 @@ export class TraceWriter {
     #started = process.hrtime.bigint();
     #startedAtMs = Date.now();
     #seq = 0;
+    /** Whether run.start reached disk, so run.end can tell an open run from an unopened one. */
+    #opened = false;
+    #closedEvent = false;
     #turn = 0;
     #git;
     #tail = Promise.resolve();
@@ -95,6 +98,37 @@ export class TraceWriter {
     async append(init) {
         if (this.#sealed)
             throw new Error(`run ${this.#runId} is closed`);
+        // SPEC §2.3: `run.start` AND `run.end` BRACKET THE RUN, EXACTLY ONE OF EACH.
+        //
+        // Nothing enforced that here, and three commands got it wrong in three different ways —
+        // `record --mcp-config` put a note at seq 0, `attach` wrote neither event, and a fork opened
+        // on `fork`. All three produced traces that look fine to `orca show`, `orca replay` and the
+        // viewer, and that no gateway will take:
+        //
+        //   invalid trace: run.start at seq 1, must be seq 0
+        //   invalid trace: 0 run.start and 1 run.end events (exactly one of each)
+        //
+        // The cost of finding out late is the whole recording: the user learns at `orca push`, after
+        // the agent session is over, that there is nothing to push. Refusing the write is the only
+        // point where the mistake is still cheap — it fails in the developer's own test run, at the
+        // line that wrote the wrong event, rather than in someone else's terminal a week later.
+        // Only the three a fragment cannot reach innocently. "seq 0 must BE run.start" would be the
+        // stronger rule and is wrong here: this writer is also how fixtures and conformance vectors
+        // are built, and a deliberate fragment is allowed to hold a few events and no bracket at all.
+        // These three are violations however the trace is meant to be used.
+        if (init.type === 'run.start' && this.#seq !== 0) {
+            throw new Error(`run.start belongs at seq 0 (spec §2.3); run ${this.#runId} tried to write it at seq ` +
+                `${this.#seq}, behind ${this.#opened ? 'a run.start that is already there' : 'events that were written first'}. ` +
+                'Append it before any capture layer can write.');
+        }
+        if (init.type === 'run.end' && !this.#opened) {
+            throw new Error(`run ${this.#runId} has no run.start to close: the spec brackets a run with exactly one ` +
+                'of each (spec §2.3), and a gateway refuses the push — "0 run.start and 1 run.end ' +
+                'events". Append run.start as the run opens.');
+        }
+        if (init.type === 'run.end' && this.#closedEvent) {
+            throw new Error(`run ${this.#runId} already has a run.end; the spec allows exactly one`);
+        }
         // Clocks are read at call time so they describe the event, not the queue drain; seq is
         // assigned inside the queue so a rejected event leaves no hole in the dense order.
         const when = init.occurredAt ?? new Date();
@@ -175,6 +209,11 @@ export class TraceWriter {
             out.redacted = [...new Set(removed)];
         assertEvent(out);
         await this.#handle.write(`${JSON.stringify(out)}\n`);
+        // Set after the write, not before it: a bracket that failed to reach disk is not one.
+        if (out.type === 'run.start')
+            this.#opened = true;
+        if (out.type === 'run.end')
+            this.#closedEvent = true;
         this.#seq = seq + 1;
         return out;
     }

package/dist/writer.js.map

@@ -1 +1 @@
-{"version":3,"file":"writer.js","sourceRoot":"","sources":["../src/writer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AASjC,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,cAAc,EACd,WAAW,EACX,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,wBAAwB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAEpE,MAAM,SAAS,GAAG,KAAK,CAAC;AACxB,MAAM,QAAQ,GAAG,KAAK,CAAC;AAwCvB;;;;;;;GAOG;AACH,MAAM,OAAO,WAAW;IACb,OAAO,CAAS;IAChB,MAAM,CAAS;IACf,WAAW,CAAS;IACpB,MAAM,CAAY;IAClB,SAAS,CAAW;IACpB,OAAO,CAAa;IACpB,KAAK,CAAW;IAChB,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;IACnC,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACnC,IAAI,GAAG,CAAC,CAAC;IACT,KAAK,GAAG,CAAC,CAAC;IACV,IAAI,CAAkB;IACtB,KAAK,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAC5C,OAAO,CAAuB;IAE9B,YACE,KAAa,EACb,MAAc,EACd,IAAc,EACd,QAAkB,EAClB,MAAkB;QAElB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,IAAqB;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACpC,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAEzD,+FAA+F;QAC/F,gGAAgG;QAChG,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAC3B,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAC3E,CAAC;QACF,MAAM,IAAI,GAAa;YACrB,cAAc,EAAE,cAAc;YAC9B,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,YAAY,EAAE,IAAI,CAAC,WAAW;YAC9B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,eAAe,EAAE,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC;YAChD,QAAQ,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE;YACjE,4FAA4F;YAC5F,sFAAsF;YACtF,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YACvE,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YACvE,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;SACxE,CAAC;QACF,cAAc,CAAC,IAAI,CAAC,CAAC;QACrB,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YACnF,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QACxE,OAAO,IAAI,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,IAAqB;QAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,qFAAqF;IACrF,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAe;QAC1B,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,MAAM,YAAY,CAAC,CAAC;QAClE,uFAAuF;QACvF,mFAAmF;QACnF,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC;QAC3C,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC9B,+FAA+F;QAC/F,gGAAgG;QAChG,yDAAyD;QACzD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU;YAC7B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC;YAC1D,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC;QACrC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAC5E,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAAiB;QAC3B,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC;QACtC,MAAM,IAAI,CAAC,KAAK,CAAC;QACjB,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAE3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAa;YACzB,GAAG,IAAI,CAAC,KAAK;YACb,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAClC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;YACpC,SAAS,EAAE;gBACT,cAAc,EAAE,wBAAwB;gBACxC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE;aACzC;YACD,SAAS,EAAE,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE;YACnF,4FAA4F;YAC5F,qFAAqF;YACrF,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;SAC9F,CAAC;QACF,IAAI,QAAQ,KAAK,SAAS;YAAE,QAAQ,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1D,cAAc,CAAC,QAAQ,CAAC,CAAC;QAEzB,MAAM,UAAU,GAAG;YACjB,cAAc,EAAE,wBAAwB;YACxC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE;SAClC,CAAC;QACF,MAAM,SAAS,CACb,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,EACrC,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAC1C;YACE,IAAI,EAAE,SAAS;SAChB,CACF,CAAC;QACF,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YAC7F,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC;QACxB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,OAAe,EAAE,IAAY,EAAE,IAAe;QACrE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC3B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,oBAAoB,EAAE,CAAC;gBACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,SAAS,GAAG,UAAU,CAAC,CAAC;gBAC3E,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;gBACxD,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAe,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QACzF,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1D,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACvD,IAAI,OAAO,KAAK,SAAS;YAAE,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;QAEnD,8FAA8F;QAC9F,qFAAqF;QACrF,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,SAAS,GAAG,EAAE,CAAC,CAAC;QACpF,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAe,CAAC;QACrD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAE7D,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC;QACpB,OAAO,GAAG,CAAC;IACb,CAAC;CACF"}
+{"version":3,"file":"writer.js","sourceRoot":"","sources":["../src/writer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AASjC,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,cAAc,EACd,WAAW,EACX,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,wBAAwB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAEpE,MAAM,SAAS,GAAG,KAAK,CAAC;AACxB,MAAM,QAAQ,GAAG,KAAK,CAAC;AAwCvB;;;;;;;GAOG;AACH,MAAM,OAAO,WAAW;IACb,OAAO,CAAS;IAChB,MAAM,CAAS;IACf,WAAW,CAAS;IACpB,MAAM,CAAY;IAClB,SAAS,CAAW;IACpB,OAAO,CAAa;IACpB,KAAK,CAAW;IAChB,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;IACnC,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACnC,IAAI,GAAG,CAAC,CAAC;IACT,4FAA4F;IAC5F,OAAO,GAAG,KAAK,CAAC;IAChB,YAAY,GAAG,KAAK,CAAC;IACrB,KAAK,GAAG,CAAC,CAAC;IACV,IAAI,CAAkB;IACtB,KAAK,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAC5C,OAAO,CAAuB;IAE9B,YACE,KAAa,EACb,MAAc,EACd,IAAc,EACd,QAAkB,EAClB,MAAkB;QAElB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,IAAqB;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACpC,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAEzD,+FAA+F;QAC/F,gGAAgG;QAChG,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAC3B,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAC3E,CAAC;QACF,MAAM,IAAI,GAAa;YACrB,cAAc,EAAE,cAAc;YAC9B,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,YAAY,EAAE,IAAI,CAAC,WAAW;YAC9B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,eAAe,EAAE,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC;YAChD,QAAQ,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE;YACjE,4FAA4F;YAC5F,sFAAsF;YACtF,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YACvE,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YACvE,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;SACxE,CAAC;QACF,cAAc,CAAC,IAAI,CAAC,CAAC;QACrB,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YACnF,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QACxE,OAAO,IAAI,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,IAAqB;QAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,qFAAqF;IACrF,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAe;QAC1B,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,MAAM,YAAY,CAAC,CAAC;QAClE,6EAA6E;QAC7E,EAAE;QACF,wFAAwF;QACxF,6FAA6F;QAC7F,4FAA4F;QAC5F,yCAAyC;QACzC,EAAE;QACF,qDAAqD;QACrD,0EAA0E;QAC1E,EAAE;QACF,6FAA6F;QAC7F,2FAA2F;QAC3F,4FAA4F;QAC5F,wFAAwF;QACxF,4FAA4F;QAC5F,4FAA4F;QAC5F,8FAA8F;QAC9F,oEAAoE;QACpE,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CACb,+CAA+C,IAAI,CAAC,MAAM,4BAA4B;gBACpF,GAAG,IAAI,CAAC,IAAI,YAAY,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,gCAAgC,IAAI;gBACjH,+CAA+C,CAClD,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CACb,OAAO,IAAI,CAAC,MAAM,uEAAuE;gBACvF,mFAAmF;gBACnF,6CAA6C,CAChD,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,MAAM,qDAAqD,CAAC,CAAC;QAC3F,CAAC;QACD,uFAAuF;QACvF,mFAAmF;QACnF,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC;QAC3C,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC9B,+FAA+F;QAC/F,gGAAgG;QAChG,yDAAyD;QACzD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU;YAC7B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC;YAC1D,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC;QACrC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAC5E,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAAiB;QAC3B,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC;QACtC,MAAM,IAAI,CAAC,KAAK,CAAC;QACjB,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAE3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAa;YACzB,GAAG,IAAI,CAAC,KAAK;YACb,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAClC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;YACpC,SAAS,EAAE;gBACT,cAAc,EAAE,wBAAwB;gBACxC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE;aACzC;YACD,SAAS,EAAE,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE;YACnF,4FAA4F;YAC5F,qFAAqF;YACrF,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;SAC9F,CAAC;QACF,IAAI,QAAQ,KAAK,SAAS;YAAE,QAAQ,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1D,cAAc,CAAC,QAAQ,CAAC,CAAC;QAEzB,MAAM,UAAU,GAAG;YACjB,cAAc,EAAE,wBAAwB;YACxC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE;SAClC,CAAC;QACF,MAAM,SAAS,CACb,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,EACrC,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAC1C;YACE,IAAI,EAAE,SAAS;SAChB,CACF,CAAC;QACF,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YAC7F,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC;QACxB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,OAAe,EAAE,IAAY,EAAE,IAAe;QACrE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC3B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,oBAAoB,EAAE,CAAC;gBACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,SAAS,GAAG,UAAU,CAAC,CAAC;gBAC3E,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;gBACxD,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAe,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QACzF,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1D,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACvD,IAAI,OAAO,KAAK,SAAS;YAAE,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;QAEnD,8FAA8F;QAC9F,qFAAqF;QACrF,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,SAAS,GAAG,EAAE,CAAC,CAAC;QACpF,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAe,CAAC;QACrD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAE7D,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrD,sFAAsF;QACtF,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW;YAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QAClD,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACrD,IAAI,CAAC,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC;QACpB,OAAO,GAAG,CAAC;IACb,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orcareplay/core",
-  "version": "0.3.1-main.g2d7bd68",
+  "version": "0.4.0",
   "type": "module",
   "license": "Apache-2.0",
   "repository": {
@@ -17,7 +17,7 @@
     "dist"
   ],
   "dependencies": {
-    "@orcareplay/plugin-api": "0.3.1-main.g2d7bd68",
-    "@orcareplay/schema": "0.3.1-main.g2d7bd68"
+    "@orcareplay/plugin-api": "0.4.0",
+    "@orcareplay/schema": "0.4.0"
   }
 }