@spool-lab/core 0.4.12 → 0.5.0

package/dist/security/scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../src/security/scan.ts"],"names":[],"mappings":"AAaA,OAAO,EAAQ,MAAM,EAAE,MAAM,QAAQ,CAAA;AACrC,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAA;AAC1C,OAAO,KAAK,EAAkB,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAWvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;;;;AAEhD,qBAAa,SAAU,SAAQ,eAA8B;IAC3D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,mBAAmB,GAAG,iBAAiB,GAAG,WAAW,CAAA;CACvE,CAAC;CAAG;AAOL,sEAAsE;AACtE,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,8DAA8D;IAC9D,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAA;IACrB;;0CAEsC;IACtC,SAAS,EAAE,SAAS,cAAc,EAAE,CAAA;IACpC;2BACuB;IACvB,cAAc,EAAE,MAAM,CAAA;IACtB;;;oEAGgE;IAChE,aAAa,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC;+CAC2C;IAC3C,OAAO,EAAE,CAAC,MAAM,EAAE,cAAc,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACxD;;;wCAGoC;IACpC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CACpC;AAED;;2CAE2C;AAC3C,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,eAAe,GACpB,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,CAsFtC"}

package/dist/security/scan.js

@@ -0,0 +1,122 @@
+// Per-session scan pipeline.
+//
+// Effect-shaped so the worker can compose it with Queue / Stream /
+// supervisor primitives. The detection itself runs against
+// `messages.content_text` only — Purge later mutates that field,
+// findings re-detect, and the audit trail stays consistent.
+//
+// Transaction shape: detection runs *outside* the transaction (it
+// can take seconds with ML); only the final apply step is atomic.
+// If the worker dies mid-detection, scan_profile was never updated
+// → restart re-enqueues from scratch. If it dies inside the
+// transaction, SQLite atomicity guarantees no half-applied state.
+import { Data, Effect } from 'effect';
+import { hashValueForRedactExclude } from '@spool-lab/redact';
+import { deleteRefreshableFindings, insertFindings, setSessionScanProfile, updateSessionCounts, getAllowlists, isAllowlisted, } from './repo.js';
+export class ScanError extends Data.TaggedError('ScanError') {
+}
+/** Scan one session end to end. Idempotent: running twice produces
+ *  the same findings (same value_hash + same offsets → same rows
+ *  after the delete-then-insert reset). */
+export function scanSession(sessionId, deps) {
+    return Effect.gen(function* () {
+        // 1. Load messages outside the transaction.
+        const messages = yield* Effect.try({
+            try: () => deps.db.prepare(`SELECT id, content_text
+             FROM messages
+            WHERE session_id = ?
+            ORDER BY seq ASC`).all(sessionId),
+            catch: (cause) => new ScanError({ sessionId, cause, reason: 'db-failed' }),
+        });
+        yield* Effect.annotateCurrentSpan('messageCount', messages.length);
+        if (messages.length === 0) {
+            // Session has no messages yet. Still mark it scanned with the
+            // current profile so we don't loop on it; future sync will
+            // invalidate the profile and re-enqueue.
+            yield* applyEmpty(sessionId, deps);
+            yield* deps.publish({ type: 'session-rescanned', sessionId });
+            return { sessionId, inserted: 0, profile: deps.currentProfile };
+        }
+        // 2. Run providers per message. The flat list is enough — we
+        // dedupe later by (kind, value_hash, start_offset) so producers
+        // can be naive about overlap.
+        const allMatches = [];
+        for (const msg of messages) {
+            for (const provider of deps.providers) {
+                if (!provider.available())
+                    continue;
+                const matches = yield* Effect.tryPromise({
+                    try: () => provider.analyze(msg.content_text),
+                    catch: (cause) => new ScanError({ sessionId, cause, reason: 'provider-failed' }),
+                });
+                for (const m of matches) {
+                    allMatches.push({ ...m, messageId: msg.id });
+                }
+            }
+        }
+        // 3. Dedupe across providers — pick the highest-confidence match
+        // for each (kind, value_hash, start_offset).
+        const merged = mergeMatches(allMatches);
+        // 4. Allowlist join → assign initial state.
+        const allow = yield* Effect.try({
+            try: () => getAllowlists(deps.db, sessionId),
+            catch: (cause) => new ScanError({ sessionId, cause, reason: 'db-failed' }),
+        });
+        const inputs = merged.map((m) => ({
+            sessionId,
+            messageId: m.messageId,
+            kind: m.kind,
+            valueHash: m.valueHash,
+            confidence: m.confidence,
+            provider: m.provider,
+            startOffset: m.start,
+            endOffset: m.end,
+            state: (deps.kindAllowlist?.has(m.kind) || isAllowlisted(allow, m.kind, m.valueHash))
+                ? 'dismissed'
+                : 'active',
+        }));
+        // 5. Apply atomically.
+        yield* Effect.try({
+            try: () => {
+                deps.db.transaction(() => {
+                    deleteRefreshableFindings(deps.db, sessionId, deps.providerNames);
+                    insertFindings(deps.db, inputs);
+                    setSessionScanProfile(deps.db, sessionId, deps.currentProfile, new Date().toISOString());
+                    updateSessionCounts(deps.db, sessionId);
+                })();
+            },
+            catch: (cause) => new ScanError({ sessionId, cause, reason: 'db-failed' }),
+        });
+        yield* deps.publish({ type: 'session-rescanned', sessionId });
+        yield* Effect.annotateCurrentSpan('inserted', inputs.length);
+        return { sessionId, inserted: inputs.length, profile: deps.currentProfile };
+    }).pipe(Effect.withSpan('security.scan.session', { attributes: { sessionId } }));
+}
+function applyEmpty(sessionId, deps) {
+    return Effect.try({
+        try: () => {
+            deps.db.transaction(() => {
+                deleteRefreshableFindings(deps.db, sessionId, deps.providerNames);
+                setSessionScanProfile(deps.db, sessionId, deps.currentProfile, new Date().toISOString());
+                updateSessionCounts(deps.db, sessionId);
+            })();
+        },
+        catch: (cause) => new ScanError({ sessionId, cause, reason: 'db-failed' }),
+    });
+}
+/** Pick the highest-confidence match per (messageId, kind, value_hash,
+ *  start). The same vendor token detected by two providers should
+ *  produce one finding, attributed to whoever was most confident. */
+function mergeMatches(matches) {
+    const byKey = new Map();
+    for (const m of matches) {
+        const hash = hashValueForRedactExclude(m.value);
+        const key = `${m.messageId}|${m.kind}|${hash}|${m.start}`;
+        const existing = byKey.get(key);
+        if (!existing || m.confidence > existing.confidence) {
+            byKey.set(key, { ...m, valueHash: hash });
+        }
+    }
+    return Array.from(byKey.values());
+}
+//# sourceMappingURL=scan.js.map

package/dist/security/scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../src/security/scan.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,EAAE;AACF,mEAAmE;AACnE,2DAA2D;AAC3D,iEAAiE;AACjE,4DAA4D;AAC5D,EAAE;AACF,kEAAkE;AAClE,kEAAkE;AAClE,mEAAmE;AACnE,4DAA4D;AAC5D,kEAAkE;AAElE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAGrC,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAA;AAC7D,OAAO,EACL,yBAAyB,EACzB,cAAc,EACd,qBAAqB,EACrB,mBAAmB,EACnB,aAAa,EACb,aAAa,GAEd,MAAM,WAAW,CAAA;AAGlB,MAAM,OAAO,SAAU,SAAQ,IAAI,CAAC,WAAW,CAAC,WAAW,CAIzD;CAAG;AAwCL;;2CAE2C;AAC3C,MAAM,UAAU,WAAW,CACzB,SAAiB,EACjB,IAAqB;IAErB,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzB,4CAA4C;QAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACjC,GAAG,EAAE,GAAG,EAAE,CACR,IAAI,CAAC,EAAE,CAAC,OAAO,CACb;;;6BAGmB,CACpB,CAAC,GAAG,CAAC,SAAS,CAAiB;YAClC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;SAC3E,CAAC,CAAA;QAEF,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;QAElE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,8DAA8D;YAC9D,2DAA2D;YAC3D,yCAAyC;YACzC,KAAK,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;YAClC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAC,CAAA;YAC7D,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,CAAA;QACjE,CAAC;QAED,6DAA6D;QAC7D,gEAAgE;QAChE,8BAA8B;QAC9B,MAAM,UAAU,GAAkD,EAAE,CAAA;QACpE,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACtC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE;oBAAE,SAAQ;gBACnC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAA8B;oBACpE,GAAG,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;oBAC7C,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;iBACjF,CAAC,CAAA;gBACF,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;oBACxB,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAA;gBAC9C,CAAC;YACH,CAAC;QACH,CAAC;QAED,iEAAiE;QACjE,6CAA6C;QAC7C,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,CAAA;QAEvC,4CAA4C;QAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YAC9B,GAAG,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC;YAC5C,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;SAC3E,CAAC,CAAA;QAEF,MAAM,MAAM,GAAmB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChD,SAAS;YACT,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,WAAW,EAAE,CAAC,CAAC,KAAK;YACpB,SAAS,EAAE,CAAC,CAAC,GAAG;YAChB,KAAK,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;gBACnF,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,QAAQ;SACb,CAAC,CAAC,CAAA;QAEH,uBAAuB;QACvB,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YAChB,GAAG,EAAE,GAAG,EAAE;gBACR,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;oBACvB,yBAAyB,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,CAAA;oBACjE,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;oBAC/B,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;oBACxF,mBAAmB,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CAAA;gBACzC,CAAC,CAAC,EAAE,CAAA;YACN,CAAC;YACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;SAC3E,CAAC,CAAA;QAEF,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAC,CAAA;QAC7D,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;QAE5D,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,CAAA;IAC7E,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CACxE,CAAA;AACH,CAAC;AAED,SAAS,UAAU,CAAC,SAAiB,EAAE,IAAqB;IAC1D,OAAO,MAAM,CAAC,GAAG,CAAC;QAChB,GAAG,EAAE,GAAG,EAAE;YACR,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;gBACvB,yBAAyB,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,CAAA;gBACjE,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;gBACxF,mBAAmB,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CAAA;YACzC,CAAC,CAAC,EAAE,CAAA;QACN,CAAC;QACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;KAC3E,CAAC,CAAA;AACJ,CAAC;AAID;;qEAEqE;AACrE,SAAS,YAAY,CACnB,OAA8D;IAE9D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAA;IAC5C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,yBAAyB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;QAC/C,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAA;QACzD,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,UAAU,GAAG,QAAQ,CAAC,UAAU,EAAE,CAAC;YACpD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;AACnC,CAAC"}

package/dist/security/types.d.ts

@@ -0,0 +1,146 @@
+import type { SensitiveKind, Severity } from '@spool-lab/redact';
+/** A finding's lifecycle state.
+ *
+ *   active     — surfaced in Security page and session strip
+ *   dismissed  — user opted to ignore; suppressed from default views
+ *   purged     — raw value rewritten with a mask in
+ *                messages.content_text; row remains as an audit record
+ */
+export type FindingState = 'active' | 'dismissed' | 'purged';
+/** One row of the `findings` table, mapped to camelCase for the
+ *  renderer. The raw sensitive value is NEVER part of this payload —
+ *  consumers that need to render the original text fetch it via
+ *  `getFindingValue(findingId)`, which reads
+ *  `messages.content_text[startOffset..endOffset]` at request time. */
+export interface FindingRow {
+    id: number;
+    sessionId: number;
+    messageId: number | null;
+    kind: SensitiveKind;
+    valueHash: string;
+    confidence: number;
+    provider: string;
+    startOffset: number;
+    endOffset: number;
+    state: FindingState;
+    detectedAt: string;
+    stateChangedAt: string | null;
+}
+/** A session row joined with its denormalised scan counts. Used by
+ *  the Security page list and the Library row badge. */
+export interface SessionWithFindingCounts {
+    id: number;
+    sessionUuid: string;
+    title: string | null;
+    startedAt: string;
+    /** Active findings of any severity. */
+    findingCount: number;
+    /** Active findings whose kind is in `HIGH_SEVERITY_KINDS`. */
+    highCount: number;
+    /** Lifetime count of purged findings on this session. Combined with
+     *  scan_completed_at + a zero findingCount, lets the Library row
+     *  show an "all-resolved" check rather than a stale red badge. */
+    purgedCount: number;
+    scanCompletedAt: string | null;
+    /** Sources name ('claude' / 'codex' / 'gemini'). */
+    source: string;
+    /** Number of non-sidechain messages in the session. */
+    messageCount: number;
+    /** Model identifier as captured at sync time. May be null for
+     *  sessions where the parser couldn't infer it. */
+    model: string | null;
+    /** Working directory captured when the session started; used to
+     *  build the resume-CLI command and the "Copy terminal command"
+     *  menu action. Null when the parser couldn't infer it. */
+    cwd: string | null;
+    /** Human-readable project name, e.g. "spool". Surfaced at the head
+     *  of the session card's meta row so users can locate the session
+     *  in the Library at a glance. */
+    projectDisplayName: string | null;
+}
+/** Row in the Security page's Risk-by-category panel. One per kind
+ *  that has ≥ 1 active finding; categories with zero counts are not
+ *  emitted. */
+export interface RiskByCategoryRow {
+    kind: SensitiveKind;
+    severity: Severity;
+    count: number;
+    /** Distinct sessions containing ≥ 1 active finding of this kind. */
+    sessions: number;
+}
+/** One session in which a given `(kind, valueHash)` secret appears —
+ *  the cross-session "blast radius" of a single leaked value. Counts
+ *  only ACTIVE findings (dismissed/purged occurrences don't expose the
+ *  value through Spool's surfaces). */
+export interface OccurrenceBySession {
+    sessionId: number;
+    sessionUuid: string;
+    sessionTitle: string | null;
+    /** Agent source (claude / codex / gemini / opencode) — drives the
+     *  source badge so each row reads as a session, not loose text. */
+    source: string;
+    /** Project display name, null for the Loose bucket. */
+    project: string | null;
+    /** Active occurrences of this value in this session. */
+    count: number;
+    /** Most recent detected_at across this session's occurrences (ISO). */
+    lastSeen: string;
+}
+/** Scope of a Dismiss action.
+ *   session — add to allowlist_session for this finding's session
+ *   global  — add to allowlist_global; all matching findings across
+ *             every session auto-dismiss on next scan */
+export interface DismissScope {
+    scope: 'session' | 'global';
+    /** Required when scope === 'session'. */
+    sessionId?: number;
+}
+/** Change events emitted on the worker's PubSub stream and forwarded
+ *  to renderers via IPC. Consumers should treat unknown `type` values
+ *  as no-ops (forward-compat). */
+export type FindingsChange = {
+    type: 'inserted';
+    sessionId: number;
+} | {
+    type: 'state-changed';
+    sessionId: number;
+    findingId: number;
+    state: FindingState;
+} | {
+    type: 'session-rescanned';
+    sessionId: number;
+};
+/** Snapshot of the scan worker's transient state. The DB stores
+ *  scan_profile / scan_completed_at; queued and scanning are
+ *  worker-memory only — they reset on restart. */
+export interface ScanStatus {
+    /** Sessions waiting for a slot in the worker queue. */
+    queued: number;
+    /** Session currently being scanned, or null when idle. */
+    scanning: number | null;
+    /** When in backfill mode, sessions still to process; 0 otherwise. */
+    backfillRemaining: number;
+    /** High-water mark for the active scan burst — the total session
+     *  count this burst has set out to scan. Held until the worker
+     *  goes fully idle (queued + scanning + backfillRemaining all 0),
+     *  then resets to 0. Lets the renderer's progress bar survive
+     *  navigation away from + back to the Security page mid-scan
+     *  without "restarting" at the remaining-now count. */
+    backfillTotal: number;
+    /** True for the lifetime of a user-initiated `Rescan all` burst
+     *  (set by `worker.rescanAll()`; cleared automatically when the
+     *  worker goes fully idle). The renderer reads this directly
+     *  instead of tracking the click locally — a renderer-side flag
+     *  would race against any auto sync-driven enqueue that completed
+     *  between the click and the IPC reaching the worker, causing
+     *  the manual ACK banner to be hijacked + cleared by the auto
+     *  burst's idle edge. Tying it to the worker keeps a single
+     *  source of truth. */
+    manualBurstInFlight: boolean;
+    /** Composite identifier for the active provider set, e.g.
+     *  'regex@3' or 'regex@3,pf@1.5b-q4'. Persisted on
+     *  sessions.scan_profile to detect rescan candidates after
+     *  provider configuration changes. */
+    currentProfile: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/security/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/security/types.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAEhE;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,WAAW,GAAG,QAAQ,CAAA;AAE5D;;;;uEAIuE;AACvE,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,IAAI,EAAE,aAAa,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,YAAY,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;CAC9B;AAED;wDACwD;AACxD,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAA;IACV,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,uCAAuC;IACvC,YAAY,EAAE,MAAM,CAAA;IACpB,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAA;IACjB;;sEAEkE;IAClE,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAA;IACd,uDAAuD;IACvD,YAAY,EAAE,MAAM,CAAA;IACpB;uDACmD;IACnD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB;;+DAE2D;IAC3D,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB;;sCAEkC;IAClC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;CAClC;AAED;;eAEe;AACf,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,aAAa,CAAA;IACnB,QAAQ,EAAE,QAAQ,CAAA;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;uCAGuC;AACvC,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B;uEACmE;IACnE,MAAM,EAAE,MAAM,CAAA;IACd,uDAAuD;IACvD,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,wDAAwD;IACxD,KAAK,EAAE,MAAM,CAAA;IACb,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;yDAGyD;AACzD,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,SAAS,GAAG,QAAQ,CAAA;IAC3B,yCAAyC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;kCAEkC;AAClC,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,YAAY,CAAA;CAAE,GACpF;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAA;AAEpD;;kDAEkD;AAClD,MAAM,WAAW,UAAU;IACzB,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAA;IACd,0DAA0D;IAC1D,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,qEAAqE;IACrE,iBAAiB,EAAE,MAAM,CAAA;IACzB;;;;;2DAKuD;IACvD,aAAa,EAAE,MAAM,CAAA;IACrB;;;;;;;;2BAQuB;IACvB,mBAAmB,EAAE,OAAO,CAAA;IAC5B;;;0CAGsC;IACtC,cAAc,EAAE,MAAM,CAAA;CACvB"}

package/dist/security/types.js

@@ -0,0 +1,10 @@
+// Shared types for the Security Scan subsystem.
+//
+// These are the cross-boundary payloads — worker → IPC → renderer.
+// They live in one module so:
+//   1. The worker (main process), IPC adapters, and renderer hooks
+//      can import a single source of truth.
+//   2. Promoting them to `Schema.Struct` later (for a Scope-B Effect
+//      RPC migration) is a local refactor, not a consumer rewrite.
+export {};
+//# sourceMappingURL=types.js.map

package/dist/security/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/security/types.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,EAAE;AACF,mEAAmE;AACnE,8BAA8B;AAC9B,mEAAmE;AACnE,4CAA4C;AAC5C,qEAAqE;AACrE,mEAAmE"}

package/dist/security/worker.d.ts

@@ -0,0 +1,69 @@
+import { Effect, Fiber, Stream, Scope } from 'effect';
+import type Database from 'better-sqlite3';
+import type { RedactProvider } from '@spool-lab/redact';
+import type { FindingsChange, ScanStatus } from './types.js';
+export interface WorkerConfig {
+    db: Database.Database;
+    providers: readonly RedactProvider[];
+    /** Profile string for `providers`. The worker rejects mismatched
+     *  pairs (you can't claim profile = 'regex@3,pf@1.5b' with only
+     *  regexProvider in `providers`).
+     *
+     *  Pass either a static string (test fixtures) or a thunk (prod —
+     *  lets the profile track pref changes like `kindAllowlist` so
+     *  toggling a kind triggers backfill via `listSessionsNeedingScan`
+     *  on the next call). The worker resolves the thunk on every read
+     *  rather than caching, so a pref save → SET_PREFS handler can
+     *  invalidate sessions and immediately see them as stale. */
+    currentProfile: string | (() => string);
+    /** Names of providers active in this profile. */
+    providerNames: readonly string[];
+    /** Live accessor for the kind-level allowlist. Read on every scan
+     *  (cheap — a Set lookup per match), so changing the preference
+     *  takes effect on the next rescan without restarting the worker. */
+    getKindAllowlist?: () => ReadonlySet<string>;
+}
+export interface ScanWorker {
+    /** Drop a session at the back of the queue. */
+    enqueue: (sessionId: number) => Effect.Effect<void>;
+    /** Set every session's profile to NULL and enqueue them — used by
+     *  "Rescan all" and by provider-set changes. */
+    rescanAll: () => Effect.Effect<number>;
+    /** Enqueue every session whose scan_profile != currentProfile.
+     *  Called on boot AND on every profile-affecting pref change
+     *  (kindAllowlist toggle, PF on/off, etc.).
+     *
+     *  Treated as a fresh burst: any leftover items still in the queue
+     *  from the previous burst are discarded (they were enqueued against
+     *  an outdated profile; the current `listSessionsNeedingScan` call
+     *  is the authoritative new work set). `backfillTotal` resets to the
+     *  new stale-set size instead of sticky-maxing with the old burst's
+     *  value, so the renderer's progress bar reflects the new work
+     *  rather than the union of the two.
+     *
+     *  Pass `userInitiated: true` when the caller is a SET_PREFS / PF
+     *  toggle handler so the renderer's busy→idle edge surfaces a
+     *  "Scan complete" result banner the same way it does for the
+     *  Rescan-all button. */
+    backfill: (opts?: {
+        userInitiated?: boolean;
+    }) => Effect.Effect<number>;
+    /** Stream of finding change events. Translator in main process
+     *  subscribes and forwards over IPC. */
+    changes: Stream.Stream<FindingsChange>;
+    /** Stream of status updates — emitted on every queued / scanning /
+     *  backfillRemaining mutation. Lets the UI replace polling with a
+     *  push subscription. */
+    statusChanges: Stream.Stream<ScanStatus>;
+    /** Current snapshot. UI uses this for the first read; subsequent
+     *  updates land via `statusChanges`. */
+    getStatus: Effect.Effect<ScanStatus>;
+}
+/** Build a worker as a Scoped effect: when the scope closes, the
+ *  draining fiber is interrupted cleanly and the PubSub shuts down. */
+export declare function makeScanWorker(config: WorkerConfig): Effect.Effect<ScanWorker, never, Scope.Scope>;
+/** Helper for tests / callers that want a complete drain promise
+ *  (e.g. wait for the queue to empty after a backfill). */
+export declare function waitForIdle(worker: ScanWorker): Effect.Effect<void>;
+export { Fiber };
+//# sourceMappingURL=worker.d.ts.map

package/dist/security/worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../../src/security/worker.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAsB,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AACzE,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAA;AAC1C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAGvD,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5D,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAA;IACrB,SAAS,EAAE,SAAS,cAAc,EAAE,CAAA;IACpC;;;;;;;;;iEAS6D;IAC7D,cAAc,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAA;IACvC,iDAAiD;IACjD,aAAa,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC;;yEAEqE;IACrE,gBAAgB,CAAC,EAAE,MAAM,WAAW,CAAC,MAAM,CAAC,CAAA;CAC7C;AAQD,MAAM,WAAW,UAAU;IACzB,+CAA+C;IAC/C,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACnD;oDACgD;IAChD,SAAS,EAAE,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACtC;;;;;;;;;;;;;;;6BAeyB;IACzB,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACvE;4CACwC;IACxC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;IACtC;;6BAEyB;IACzB,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACxC;4CACwC;IACxC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;CACrC;AAED;uEACuE;AACvE,wBAAgB,cAAc,CAC5B,MAAM,EAAE,YAAY,GACnB,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAoO/C;AAED;2DAC2D;AAC3D,wBAAgB,WAAW,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAQnE;AAGD,OAAO,EAAE,KAAK,EAAE,CAAA"}

package/dist/security/worker.js

@@ -0,0 +1,228 @@
+// Scan worker — the long-lived coordinator that drains a session
+// queue, runs `scanSession` per item, and publishes change events.
+//
+// Implementation: Effect Scope A. Inside this module is Effect-shaped
+// (Queue, Stream, PubSub, Ref, Scope). The boundary — IPC handlers
+// in `packages/app/src/main/ipc/security.ts` — wraps `runFiber` /
+// `runPromise` so renderers see plain Promise-shaped channels.
+//
+// Single-fiber by design (`concurrency: 1` on the queue stream).
+// Better-sqlite3 is synchronous, so multiple parallel fibers compete
+// for the DB lock and gain nothing. Backfill UX surfaces "session N
+// of M" progress for the user.
+import { Effect, Fiber, PubSub, Queue, Ref, Stream } from 'effect';
+import { scanSession } from './scan.js';
+import { listSessionsNeedingScan } from './repo.js';
+function resolveProfile(config) {
+    return typeof config.currentProfile === 'function'
+        ? config.currentProfile()
+        : config.currentProfile;
+}
+/** Build a worker as a Scoped effect: when the scope closes, the
+ *  draining fiber is interrupted cleanly and the PubSub shuts down. */
+export function makeScanWorker(config) {
+    return Effect.gen(function* () {
+        const queue = yield* Queue.unbounded();
+        const events = yield* PubSub.unbounded();
+        const statusEvents = yield* PubSub.unbounded();
+        const statusRef = yield* Ref.make({
+            queued: 0,
+            scanning: null,
+            backfillRemaining: 0,
+            backfillTotal: 0,
+            manualBurstInFlight: false,
+            currentProfile: resolveProfile(config),
+        });
+        const publish = (c) => PubSub.publish(events, c).pipe(Effect.asVoid);
+        // Update statusRef AND publish the new snapshot so subscribers get
+        // a push event for every mutation. One helper at the seam avoids
+        // forgetting to publish from a future Ref.update site.
+        //
+        // `backfillTotal` is derived here so individual mutation sites
+        // (enqueue / rescanAll / backfill / scanOne) don't have to
+        // remember to bump it. The renderer's progress bar reads
+        // `backfillRemaining + (scanning ? 1 : 0)` as the active count;
+        // we track the high-water mark of that quantity since the last
+        // full-idle state, and reset to 0 once everything drains. Survives
+        // navigation: a user who switches tabs mid-burst and comes back
+        // gets the true original total via `getStatus`, not the
+        // remaining-at-remount-time approximation.
+        const updateStatus = (f) => Ref.update(statusRef, (prev) => {
+            const after = f(prev);
+            // High-water mark of *backfillRemaining alone*. Including the
+            // scanning slot (br + 1 when scanning != null) bumped the
+            // total by one every time a scanOne started, and dropped it
+            // again when scanning went back to null between sessions —
+            // turning the renderer's `(total - remaining)/total` into a
+            // non-monotonic value that visibly rewound the progress bar
+            // on every cross-session tick. backfillRemaining itself is
+            // strictly monotonic (only decrements at scanOne end), so
+            // anchoring the total to it makes the progress bar strictly
+            // forward.
+            const fullyIdle = after.backfillRemaining === 0 &&
+                after.queued === 0 &&
+                after.scanning === null;
+            const backfillTotal = fullyIdle
+                ? 0
+                : Math.max(prev.backfillTotal, after.backfillRemaining);
+            // `manualBurstInFlight` rides along with the burst. The
+            // worker.rescanAll() mutation flips it on; this wrapper
+            // flips it off the instant the worker drains, so the
+            // renderer's "your manual scan finished" detection never
+            // sees a stale truth across burst boundaries.
+            const manualBurstInFlight = fullyIdle ? false : after.manualBurstInFlight;
+            return { ...after, backfillTotal, manualBurstInFlight };
+        }).pipe(Effect.zipRight(Ref.get(statusRef)), Effect.flatMap((s) => PubSub.publish(statusEvents, s)), Effect.asVoid);
+        // Burst-reset variant for backfill() (and any future caller that
+        // means "start a fresh burst, discard whatever the previous one
+        // had queued"). Two differences from updateStatus:
+        //
+        //   1. The `Math.max(prev.backfillTotal, after.backfillRemaining)`
+        //      sticky guard is BYPASSED — the caller is declaring a brand-
+        //      new burst, so its new `backfillRemaining` becomes the
+        //      authoritative `backfillTotal`. Without this, a toggle-pref
+        //      mid-scan would leave the renderer showing the OLD burst's
+        //      total while the new burst's much smaller stale set drives
+        //      the remaining count → progress bar visually pinned at
+        //      ~100% for as long as the queue takes to drain.
+        //
+        //   2. The Effect Queue is drained synchronously. Items left in
+        //      it were enqueued against the previous profile and were
+        //      already accounted for in the OLD burst's
+        //      backfillRemaining. With the new totals in force they'd
+        //      keep `nowBusy = queued > 0` true (banner-stuck-at-100%
+        //      problem) and waste regex-only scans on sessions whose
+        //      profile already matches the current one.
+        const resetBurst = (f) => Effect.gen(function* () {
+            yield* Queue.takeAll(queue);
+            yield* Ref.update(statusRef, (prev) => {
+                const after = f(prev);
+                const fullyIdle = after.backfillRemaining === 0 &&
+                    after.queued === 0 &&
+                    after.scanning === null;
+                const backfillTotal = fullyIdle ? 0 : after.backfillRemaining;
+                const manualBurstInFlight = fullyIdle ? false : after.manualBurstInFlight;
+                return { ...after, backfillTotal, manualBurstInFlight };
+            });
+            const snap = yield* Ref.get(statusRef);
+            yield* PubSub.publish(statusEvents, snap);
+        });
+        const scanOne = (sessionId) => Effect.gen(function* () {
+            yield* updateStatus((s) => ({
+                ...s,
+                scanning: sessionId,
+                queued: Math.max(0, s.queued - 1),
+            }));
+            const result = yield* scanSession(sessionId, {
+                db: config.db,
+                providers: config.providers,
+                currentProfile: resolveProfile(config),
+                providerNames: config.providerNames,
+                publish,
+                ...(config.getKindAllowlist ? { kindAllowlist: config.getKindAllowlist() } : {}),
+            }).pipe(Effect.catchAll((err) => Effect.logError(`scanSession failed for ${sessionId}: ${err.reason}`, err).pipe(Effect.as(null))));
+            yield* updateStatus((s) => ({
+                ...s,
+                scanning: null,
+                backfillRemaining: Math.max(0, s.backfillRemaining - 1),
+            }));
+            return result;
+        });
+        // The drain fiber runs for the worker's lifetime; Scope.addFinalizer
+        // interrupts it when the runtime tears down.
+        //
+        // Throttle: yield 50ms between scans. better-sqlite3 is synchronous
+        // so the DB lock is held for the full scanOne duration (~50-100ms
+        // per session). Without a yield, a backfill of N sessions becomes
+        // ~N*scanTime of uninterrupted lock contention — foreground reads
+        // (listSessions, FTS search) get queued behind every scan. The
+        // sleep gives the event loop a window to flush foreground IPC
+        // handlers before grabbing the next session. Doubles backfill
+        // duration but keeps the app responsive.
+        const drain = Stream.fromQueue(queue).pipe(Stream.mapEffect((sessionId) => scanOne(sessionId).pipe(Effect.tap(() => Effect.sleep('50 millis'))), { concurrency: 1 }), Stream.runDrain);
+        yield* Effect.forkScoped(drain);
+        const enqueue = (sessionId) => Effect.gen(function* () {
+            yield* Queue.offer(queue, sessionId);
+            yield* updateStatus((s) => ({ ...s, queued: s.queued + 1 }));
+        });
+        const rescanAll = () => Effect.gen(function* () {
+            // SELECT and UPDATE share one transaction so a concurrent sync
+            // that inserts a new session can't slip between them — the
+            // new row would otherwise miss the profile NULL pass AND be
+            // omitted from `all`, leaving it silently skipped by the
+            // drain fiber even though the user pressed "Rescan all". With
+            // a transaction the worker either sees every session present
+            // at the moment of the click, or sees the post-insert state
+            // (in which case the new session participates).
+            const all = yield* Effect.sync(() => config.db.transaction(() => {
+                const rows = config.db
+                    .prepare('SELECT id FROM sessions ORDER BY started_at DESC')
+                    .all();
+                config.db.prepare('UPDATE sessions SET scan_profile = NULL').run();
+                return rows;
+            })());
+            yield* updateStatus((s) => ({
+                ...s,
+                backfillRemaining: all.length,
+                // Flag this as a user-initiated burst — the renderer
+                // hangs its result-banner ACK off this field instead of
+                // a click-local flag.
+                manualBurstInFlight: true,
+            }));
+            for (const r of all) {
+                yield* enqueue(r.id);
+            }
+            yield* Effect.annotateCurrentSpan('enqueued', all.length);
+            return all.length;
+        }).pipe(Effect.withSpan('security.worker.rescan_all'));
+        const backfill = (opts) => Effect.gen(function* () {
+            // Re-resolve the profile each call so a SET_PREFS handler that
+            // changed kindAllowlist sees the updated hash before invoking
+            // backfill.
+            const profile = resolveProfile(config);
+            const stale = yield* Effect.sync(() => listSessionsNeedingScan(config.db, profile));
+            // Fresh burst: drain any leftover queue items (they belong to
+            // a previous profile snapshot — see `resetBurst` notes), reset
+            // queued/backfillRemaining/backfillTotal to this burst's stale
+            // count, and stamp the user-initiated flag if applicable. The
+            // wrapper bypasses the sticky-max guard so the renderer's
+            // progress bar tracks the new burst, not the old.
+            yield* resetBurst((s) => ({
+                ...s,
+                currentProfile: profile,
+                queued: 0,
+                backfillRemaining: stale.length,
+                manualBurstInFlight: opts?.userInitiated === true,
+            }));
+            for (const id of stale) {
+                yield* enqueue(id);
+            }
+            yield* Effect.annotateCurrentSpan('enqueued', stale.length);
+            yield* Effect.annotateCurrentSpan('userInitiated', opts?.userInitiated === true);
+            return stale.length;
+        }).pipe(Effect.withSpan('security.worker.backfill'));
+        return {
+            enqueue,
+            rescanAll,
+            backfill,
+            changes: Stream.fromPubSub(events),
+            statusChanges: Stream.fromPubSub(statusEvents),
+            getStatus: Ref.get(statusRef),
+        };
+    });
+}
+/** Helper for tests / callers that want a complete drain promise
+ *  (e.g. wait for the queue to empty after a backfill). */
+export function waitForIdle(worker) {
+    return Effect.gen(function* () {
+        while (true) {
+            const s = yield* worker.getStatus;
+            if (s.queued === 0 && s.scanning === null && s.backfillRemaining === 0)
+                return;
+            yield* Effect.sleep('25 millis');
+        }
+    });
+}
+// Re-export Fiber for callers that want to manage runtime lifecycle.
+export { Fiber };
+//# sourceMappingURL=worker.js.map

package/dist/security/worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.js","sourceRoot":"","sources":["../../src/security/worker.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,mEAAmE;AACnE,EAAE;AACF,sEAAsE;AACtE,mEAAmE;AACnE,kEAAkE;AAClE,+DAA+D;AAC/D,EAAE;AACF,iEAAiE;AACjE,qEAAqE;AACrE,oEAAoE;AACpE,+BAA+B;AAE/B,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAS,MAAM,QAAQ,CAAA;AAGzE,OAAO,EAAE,WAAW,EAAmB,MAAM,WAAW,CAAA;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAA;AAyBnD,SAAS,cAAc,CAAC,MAAoB;IAC1C,OAAO,OAAO,MAAM,CAAC,cAAc,KAAK,UAAU;QAChD,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE;QACzB,CAAC,CAAC,MAAM,CAAC,cAAc,CAAA;AAC3B,CAAC;AAqCD;uEACuE;AACvE,MAAM,UAAU,cAAc,CAC5B,MAAoB;IAEpB,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,SAAS,EAAU,CAAA;QAC9C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,EAAkB,CAAA;QACxD,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,EAAc,CAAA;QAC1D,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAa;YAC5C,MAAM,EAAE,CAAC;YACT,QAAQ,EAAE,IAAI;YACd,iBAAiB,EAAE,CAAC;YACpB,aAAa,EAAE,CAAC;YAChB,mBAAmB,EAAE,KAAK;YAC1B,cAAc,EAAE,cAAc,CAAC,MAAM,CAAC;SACvC,CAAC,CAAA;QAEF,MAAM,OAAO,GAAG,CAAC,CAAiB,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAEpF,mEAAmE;QACnE,iEAAiE;QACjE,uDAAuD;QACvD,EAAE;QACF,+DAA+D;QAC/D,2DAA2D;QAC3D,yDAAyD;QACzD,gEAAgE;QAChE,+DAA+D;QAC/D,mEAAmE;QACnE,gEAAgE;QAChE,wDAAwD;QACxD,2CAA2C;QAC3C,MAAM,YAAY,GAAG,CAAC,CAAgC,EAAE,EAAE,CACxD,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,CAAA;YACrB,8DAA8D;YAC9D,0DAA0D;YAC1D,4DAA4D;YAC5D,2DAA2D;YAC3D,4DAA4D;YAC5D,4DAA4D;YAC5D,2DAA2D;YAC3D,0DAA0D;YAC1D,4DAA4D;YAC5D,WAAW;YACX,MAAM,SAAS,GACb,KAAK,CAAC,iBAAiB,KAAK,CAAC;gBAC7B,KAAK,CAAC,MAAM,KAAK,CAAC;gBAClB,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAA;YACzB,MAAM,aAAa,GAAG,SAAS;gBAC7B,CAAC,CAAC,CAAC;gBACH,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAA;YACzD,wDAAwD;YACxD,wDAAwD;YACxD,qDAAqD;YACrD,yDAAyD;YACzD,8CAA8C;YAC9C,MAAM,mBAAmB,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAA;YACzE,OAAO,EAAE,GAAG,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,CAAA;QACzD,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EACnC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EACtD,MAAM,CAAC,MAAM,CACd,CAAA;QAEH,iEAAiE;QACjE,gEAAgE;QAChE,mDAAmD;QACnD,EAAE;QACF,mEAAmE;QACnE,mEAAmE;QACnE,6DAA6D;QAC7D,kEAAkE;QAClE,iEAAiE;QACjE,iEAAiE;QACjE,6DAA6D;QAC7D,sDAAsD;QACtD,EAAE;QACF,gEAAgE;QAChE,8DAA8D;QAC9D,gDAAgD;QAChD,8DAA8D;QAC9D,8DAA8D;QAC9D,6DAA6D;QAC7D,gDAAgD;QAChD,MAAM,UAAU,GAAG,CAAC,CAAgC,EAAE,EAAE,CACtD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,KAAK,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YAC3B,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE;gBACpC,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,CAAA;gBACrB,MAAM,SAAS,GACb,KAAK,CAAC,iBAAiB,KAAK,CAAC;oBAC7B,KAAK,CAAC,MAAM,KAAK,CAAC;oBAClB,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAA;gBACzB,MAAM,aAAa,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAA;gBAC7D,MAAM,mBAAmB,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAA;gBACzE,OAAO,EAAE,GAAG,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,CAAA;YACzD,CAAC,CAAC,CAAA;YACF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;YACtC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAA;QAC3C,CAAC,CAAC,CAAA;QAEJ,MAAM,OAAO,GAAG,CAAC,SAAiB,EAAE,EAAE,CACpC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1B,GAAG,CAAC;gBACJ,QAAQ,EAAE,SAAS;gBACnB,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;aAClC,CAAC,CAAC,CAAA;YACH,MAAM,MAAM,GAAsB,KAAK,CAAC,CAAC,WAAW,CAAC,SAAS,EAAE;gBAC9D,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,cAAc,EAAE,cAAc,CAAC,MAAM,CAAC;gBACtC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,OAAO;gBACP,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjF,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,EAAE,EAAE,CACtB,MAAM,CAAC,QAAQ,CAAC,0BAA0B,SAAS,KAAK,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC,IAAI,CAC7E,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAChB,CACF,CACF,CAAA;YACD,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1B,GAAG,CAAC;gBACJ,QAAQ,EAAE,IAAI;gBACd,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,iBAAiB,GAAG,CAAC,CAAC;aACxD,CAAC,CAAC,CAAA;YACH,OAAO,MAAM,CAAA;QACf,CAAC,CAAC,CAAA;QAEJ,qEAAqE;QACrE,6CAA6C;QAC7C,EAAE;QACF,oEAAoE;QACpE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,+DAA+D;QAC/D,8DAA8D;QAC9D,8DAA8D;QAC9D,yCAAyC;QACzC,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,CACxC,MAAM,CAAC,SAAS,CACd,CAAC,SAAiB,EAAE,EAAE,CACpB,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EACtE,EAAE,WAAW,EAAE,CAAC,EAAE,CACnB,EACD,MAAM,CAAC,QAAQ,CAChB,CAAA;QACD,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QAE/B,MAAM,OAAO,GAAG,CAAC,SAAiB,EAAE,EAAE,CACpC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;YACpC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;QAC9D,CAAC,CAAC,CAAA;QAEJ,MAAM,SAAS,GAAG,GAAG,EAAE,CACrB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,+DAA+D;YAC/D,2DAA2D;YAC3D,4DAA4D;YAC5D,yDAAyD;YACzD,8DAA8D;YAC9D,6DAA6D;YAC7D,4DAA4D;YAC5D,gDAAgD;YAChD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAClC,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;gBACzB,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE;qBACnB,OAAO,CAAC,kDAAkD,CAAC;qBAC3D,GAAG,EAA2B,CAAA;gBACjC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,GAAG,EAAE,CAAA;gBAClE,OAAO,IAAI,CAAA;YACb,CAAC,CAAC,EAAE,CACL,CAAA;YACD,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1B,GAAG,CAAC;gBACJ,iBAAiB,EAAE,GAAG,CAAC,MAAM;gBAC7B,qDAAqD;gBACrD,wDAAwD;gBACxD,sBAAsB;gBACtB,mBAAmB,EAAE,IAAI;aAC1B,CAAC,CAAC,CAAA;YACH,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;gBACpB,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;YACtB,CAAC;YACD,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;YACzD,OAAO,GAAG,CAAC,MAAM,CAAA;QACnB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC,CAAA;QAExD,MAAM,QAAQ,GAAG,CAAC,IAAkC,EAAE,EAAE,CACtD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,+DAA+D;YAC/D,8DAA8D;YAC9D,YAAY;YACZ,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;YACtC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CACpC,uBAAuB,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAC5C,CAAA;YACD,8DAA8D;YAC9D,+DAA+D;YAC/D,+DAA+D;YAC/D,8DAA8D;YAC9D,0DAA0D;YAC1D,kDAAkD;YAClD,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACxB,GAAG,CAAC;gBACJ,cAAc,EAAE,OAAO;gBACvB,MAAM,EAAE,CAAC;gBACT,iBAAiB,EAAE,KAAK,CAAC,MAAM;gBAC/B,mBAAmB,EAAE,IAAI,EAAE,aAAa,KAAK,IAAI;aAClD,CAAC,CAAC,CAAA;YACH,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;gBACvB,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;YACpB,CAAC;YACD,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;YAC3D,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,eAAe,EAAE,IAAI,EAAE,aAAa,KAAK,IAAI,CAAC,CAAA;YAChF,OAAO,KAAK,CAAC,MAAM,CAAA;QACrB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC,CAAA;QAEtD,OAAO;YACL,OAAO;YACP,SAAS;YACT,QAAQ;YACR,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;YAClC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC;YAC9C,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC;SACT,CAAA;IACxB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;2DAC2D;AAC3D,MAAM,UAAU,WAAW,CAAC,MAAkB;IAC5C,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzB,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CAAA;YACjC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,CAAC,iBAAiB,KAAK,CAAC;gBAAE,OAAM;YAC9E,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;QAClC,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,qEAAqE;AACrE,OAAO,EAAE,KAAK,EAAE,CAAA"}

package/dist/sync/source-paths.d.ts

@@ -2,4 +2,5 @@ import type { SessionSource } from '../types.js';
 export declare function getSessionRoots(source: SessionSource): string[];
 export declare function detectSessionSource(filePath: string, sourceRoots?: Record<SessionSource, string[]>): SessionSource | undefined;
 export declare function getSessionWatchPatterns(source: SessionSource, roots?: string[]): string[];
+export declare function isSessionFileForSource(source: SessionSource, filePath: string, root: string): boolean;
 //# sourceMappingURL=source-paths.d.ts.map

package/dist/sync/source-paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"source-paths.d.ts","sourceRoot":"","sources":["../../src/sync/source-paths.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAuBhD,wBAAgB,eAAe,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,EAAE,CA4B/D;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,WAAW,GAAE,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,CAI1C,GACA,aAAa,GAAG,SAAS,CAO3B;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,aAAa,EACrB,KAAK,WAA0B,GAC9B,MAAM,EAAE,CAGV"}
+{"version":3,"file":"source-paths.d.ts","sourceRoot":"","sources":["../../src/sync/source-paths.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAyBhD,wBAAgB,eAAe,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,EAAE,CAgC/D;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,WAAW,GAAE,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,CAK1C,GACA,aAAa,GAAG,SAAS,CAO3B;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,aAAa,EACrB,KAAK,WAA0B,GAC9B,MAAM,EAAE,CAOV;AAiED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAoBrG"}