@telora/daemon 0.20.28 → 0.20.32

package/dist/security-scan-engine.d.ts

@@ -87,7 +87,15 @@ export interface SecurityScanDeps {
     /** Stamp last_run_at on the config after a scan completes. */
     updateConfigLastRun: (configId: string) => Promise<void>;
     clearManualRunRequest: (configId: string) => Promise<void>;
-    resolveCwd: (productId: string) => string;
+    /**
+     * Resolve the repo to scan for a product, or null when this daemon does not
+     * manage that product. NULL IS LOAD-BEARING: the caller must skip the scan
+     * entirely rather than substitute a fallback path. Returning some other
+     * repo's path makes `npm audit` (and every path-based scanner) report THAT
+     * repo's findings against this product -- see the fail-closed gate in
+     * runScanForConfig.
+     */
+    resolveCwd: (productId: string) => string | null;
     /**
      * Flush the OSV + GHSA feed caches. Invoked at the start of every
      * manual-triggered scan so a user-clicked "Refresh feeds" pulls fresh

package/dist/security-scan-engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security-scan-engine.d.ts","sourceRoot":"","sources":["../src/security-scan-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,OAAO,EAGL,KAAK,cAAc,EAEpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAGL,KAAK,cAAc,EAEpB,MAAM,iCAAiC,CAAC;AAYzC,MAAM,MAAM,QAAQ,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAC9D,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,aAAa,GAAG,UAAU,GAAG,WAAW,CAAC;AAE9E,sEAAsE;AACtE,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,+CAA+C;AAC/C,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,gDAAgD;AAChD,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,uDAAuD;AACvD,MAAM,WAAW,OAAO;IACtB,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAC7C;AAQD,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAEtD;AAED,wBAAgB,qBAAqB,IAAI,OAAO,EAAE,CAEjD;AAMD,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,aAAa,CAAC;IACtB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,6EAA6E;AAC7E,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,iBAAiB,EAAE,CAAC,IAAI,CAAC,EAAE,qBAAqB,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3E;;;;OAIG;IACH,aAAa,EAAE,CACb,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,YAAY,KAClB,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAClC,8DAA8D;IAC9D,mBAAmB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,qBAAqB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,UAAU,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;IAC1C;;;;OAIG;IACH,eAAe,EAAE,MAAM,IAAI,CAAC;IAC5B,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,cAAc,CAAC;IACrB,sEAAsE;IACtE,WAAW,IAAI,MAAM,GAAG,IAAI,CAAC;CAC9B;AAwBD,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,cAAc,GAAG,SAAS,GAChC,iBAAiB,GAAG,SAAS,CAyB/B;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,UAAU,GAAG,QAAQ,EAC9B,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,IAAI,CAAC,CAyHf;AAaD,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,gBAAgB,EACtB,IAAI,GAAE,qBAA0B,GAC/B,OAAO,CAAC,IAAI,CAAC,CAiBf;AAMD,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,YAAY,GAAG,gBAAgB,CAsCnF"}
+{"version":3,"file":"security-scan-engine.d.ts","sourceRoot":"","sources":["../src/security-scan-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,OAAO,EAGL,KAAK,cAAc,EAEpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAGL,KAAK,cAAc,EAEpB,MAAM,iCAAiC,CAAC;AAYzC,MAAM,MAAM,QAAQ,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAC9D,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,aAAa,GAAG,UAAU,GAAG,WAAW,CAAC;AAE9E,sEAAsE;AACtE,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,+CAA+C;AAC/C,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,gDAAgD;AAChD,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,uDAAuD;AACvD,MAAM,WAAW,OAAO;IACtB,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAC7C;AAQD,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAEtD;AAED,wBAAgB,qBAAqB,IAAI,OAAO,EAAE,CAEjD;AAMD,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,aAAa,CAAC;IACtB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,6EAA6E;AAC7E,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,iBAAiB,EAAE,CAAC,IAAI,CAAC,EAAE,qBAAqB,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3E;;;;OAIG;IACH,aAAa,EAAE,CACb,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,YAAY,KAClB,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAClC,8DAA8D;IAC9D,mBAAmB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,qBAAqB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACjD;;;;OAIG;IACH,eAAe,EAAE,MAAM,IAAI,CAAC;IAC5B,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,cAAc,CAAC;IACrB,sEAAsE;IACtE,WAAW,IAAI,MAAM,GAAG,IAAI,CAAC;CAC9B;AAwBD,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,cAAc,GAAG,SAAS,GAChC,iBAAiB,GAAG,SAAS,CAyB/B;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,UAAU,GAAG,QAAQ,EAC9B,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,IAAI,CAAC,CAwIf;AAaD,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,gBAAgB,EACtB,IAAI,GAAE,qBAA0B,GAC/B,OAAO,CAAC,IAAI,CAAC,CAiBf;AAMD,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,YAAY,GAAG,gBAAgB,CAiDnF"}

package/dist/security-scan-engine.js

@@ -81,6 +81,18 @@ export async function runScanForConfig(config, trigger, deps) {
     if (trigger === 'manual') {
         deps.clearFeedCaches();
     }
+    // Fail-closed product gate. Scan configs exist per product ORG-WIDE, but this
+    // daemon only manages the products it was started with. Scanning a product we
+    // have no checkout for can only produce findings about some OTHER repo, so we
+    // scan nothing rather than scan the wrong tree. Skipping without stamping
+    // last_run_at is deliberate: the config stays due, so the daemon that DOES
+    // manage this product still picks it up on its own tick.
+    const repoPath = deps.resolveCwd(config.productId);
+    if (repoPath === null) {
+        log.debug(`Skipping security scan for product ${config.productId}: not managed by this daemon ` +
+            `(no repo checkout here). Leaving the config due for a daemon that manages it.`);
+        return;
+    }
     // Per-scan-run focus memoization. The server handler always creates a new
     // focus, so without this wrapper each finding in a scan would land in its
     // own focus. The first finding in this run triggers focus creation; every
@@ -97,7 +109,7 @@ export async function runScanForConfig(config, trigger, deps) {
         try {
             const result = await scanner.scan({
                 config,
-                repoPath: deps.resolveCwd(config.productId),
+                repoPath,
             });
             const observed = new Set();
             for (const finding of result.findings) {
@@ -212,8 +224,19 @@ export async function runSecurityScanTick(deps, opts = {}) {
 export function buildDefaultSecurityScanDeps(config) {
     const resolveCwd = (productId) => {
         const product = config.products.find((p) => p.id === productId);
+        // Fail CLOSED. This previously returned config.repoPath -- the daemon's own
+        // primary repo -- for any product this daemon does not manage. A scan config
+        // exists per product org-wide, but config.products holds only the products
+        // THIS daemon was started with, so every unmanaged product was scanned
+        // against the daemon's own tree: `npm audit` passed its Node-project gate
+        // legitimately (the daemon's repo IS a Node project) and reported the
+        // DAEMON's dependency advisories as findings on an unrelated product.
+        // Observed 2026-07-24: @modelcontextprotocol/sdk, @hono/node-server,
+        // fast-uri and dompurify -- all Telora's own deps -- filed against a Quarto
+        // book, a Rust/Godot workspace, and a Python+Vite app, each spawning a
+        // Security Remediation focus whose team found nothing and escalated.
         if (!product)
-            return config.repoPath;
+            return null;
         return configForProduct(config, product).repoPath;
     };
     return {

package/dist/security-scan-engine.js.map

@@ -1 +1 @@
-{"version":3,"file":"security-scan-engine.js","sourceRoot":"","sources":["../src/security-scan-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,GAGlB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,oBAAoB,EACpB,0BAA0B,GAG3B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExC,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC;AAkD7D,8EAA8E;AAC9E,uEAAuE;AACvE,8EAA8E;AAE9E,MAAM,gBAAgB,GAAyB,IAAI,GAAG,EAAE,CAAC;AAEzD,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,OAAO,CAAC,GAAG,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC;AACxC,CAAC;AAoFD,SAAS,YAAY,CACnB,EAAuC,EACvC,SAAqC;IAErC,IAAI,MAAM,GAA4B,IAAI,CAAC;IAC3C,OAAO,CAAC,KAAa,EAAE,EAAE;QACvB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CACrB,CAAC,MAAM,EAAE,EAAE;gBACT,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC;gBACpB,OAAO,MAAM,CAAC;YAChB,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;gBACN,MAAM,GAAG,IAAI,CAAC;gBACd,MAAM,GAAG,CAAC;YACZ,CAAC,CACF,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,KAAiC;IAEjC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,eAAe,GAAkB,IAAI,CAAC;IAC1C,MAAM,OAAO,GAAG,YAAY,CAC1B,CAAC,KAAoD,EAAE,EAAE,CACvD,KAAK,CAAC,8BAA8B,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC,EAC7E,CAAC,MAAM,EAAE,EAAE;QACT,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC;IACnC,CAAC,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACtD,MAAM,OAAO,GAAmB;QAC9B,GAAG,KAAK;QACR,8BAA8B,EAAE,CAAC,SAAS,EAAE,cAAc,EAAE,EAAE,CAC5D,OAAO,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;QACxC,gBAAgB,EAAE,QAAQ;QAC1B,eAAe,EAAE,WAAW;QAC5B,cAAc,EAAE,UAAU;KAC3B,CAAC;IACF,OAAO;QACL,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,GAAG,EAAE,CAAC,eAAe;KACnC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAkB,EAClB,OAA8B,EAC9B,IAAsB;IAEtB,uEAAuE;IACvE,yEAAyE;IACzE,oEAAoE;IACpE,8CAA8C;IAC9C,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,uEAAuE;IACvE,wCAAwC;IACxC,MAAM,oBAAoB,GAAG,wBAAwB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC3E,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEnG,kEAAkE;IAClE,iEAAiE;IACjE,8CAA8C;IAC9C,MAAM,eAAe,GAAG,IAAI,GAAG,EAAuB,CAAC;IACvD,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;gBAChC,MAAM;gBACN,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC;aAC5C,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;YACnC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CACrC,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,cAAc,EACrB,OAAO,CACR,CAAC;gBACF,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;gBAEjC,4BAA4B;gBAC5B,mCAAmC;gBACnC,iEAAiE;gBACjE,8CAA8C;gBAC9C,MAAM,eAAe,GACnB,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,iBAAiB,KAAK,IAAI,CAAC,CAAC;gBACnF,IAAI,oBAAoB,IAAI,eAAe,EAAE,CAAC;oBAC5C,IAAI,CAAC;wBACH,MAAM,YAAY,GAAwB;4BACxC,EAAE,EAAE,MAAM,CAAC,SAAS;4BACpB,cAAc,EAAE,MAAM,CAAC,cAAc;4BACrC,SAAS,EAAE,MAAM,CAAC,SAAS;4BAC3B,QAAQ,EAAE,OAAO,CAAC,QAAQ;4BAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;4BAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;4BAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;4BACxB,MAAM,EAAE,MAAM,CAAC,MAAM;4BACrB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;yBAC5C,CAAC;wBACF,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,YAAY,EAAE,EAAE,EAAE,oBAAoB,CAAC,IAAI,CAAC,CAAC;wBAC1F,IAAI,YAAY,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;4BACvC,aAAa,EAAE,CAAC;wBAClB,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,GAAG,CAAC,IAAI,CACN,sCAAsC,OAAO,CAAC,UAAU,GAAG,EAC1D,GAAa,CAAC,OAAO,CACvB,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YACD,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CACN,kCAAkC,OAAO,CAAC,QAAQ,UAAU,EAC3D,GAAa,CAAC,OAAO,CACvB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,iEAAiE;IACjE,sDAAsD;IACtD,IAAI,IAAI,CAAC,cAAc,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,YAAY,GAAwB,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CACjF,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CACzD,CAAC;YACF,MAAM,oBAAoB,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAClF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,4BAA4B;IAC5B,IAAI,oBAAoB,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,oBAAoB,CAAC,WAAW,EAAE,CAAC;QACnD,IAAI,OAAO,IAAI,IAAI,CAAC,cAAc,EAAE,oCAAoC,EAAE,CAAC;YACzE,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,cAAc,CAAC,oCAAoC,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;YACzF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CACN,qEAAqE,EACpE,GAAa,CAAC,OAAO,CACvB,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,2DAA2D;AAC3D,8EAA8E;AAE9E,qEAAqE;AACrE,0EAA0E;AAC1E,kEAAkE;AAClE,kEAAkE;AAClE,+CAA+C;AAC/C,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;AAE1C,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAsB,EACtB,OAA8B,EAAE;IAEhC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACnD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,SAAS;QAC9B,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,SAAS;QAC7C,MAAM,OAAO,GAA0B,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;QAC3F,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACnB,+DAA+D;YACzD,kDAAkD;YAClD,GAAG,CAAC,KAAK,CAAC,8DAA8D,EAAE,EAAE,KAAK,EAAE,MAAM,CAAE,GAAa,EAAE,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/H,CAAC;gBAAS,CAAC;YACT,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,iDAAiD;AACjD,8EAA8E;AAE9E,MAAM,UAAU,4BAA4B,CAAC,MAAoB;IAC/D,MAAM,UAAU,GAAG,CAAC,SAAiB,EAAU,EAAE;QAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC,QAAQ,CAAC;QACrC,OAAO,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC;IACpD,CAAC,CAAC;IAEF,OAAO;QACL,iBAAiB,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAChC,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,sCAAsC,EACtC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAC7C,CAAC;YACF,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;QACzB,CAAC;QACD,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,EAAE;YAC1D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAsB,gCAAgC,EAAE;gBAC/E,SAAS;gBACT,cAAc;gBACd,GAAG,OAAO;aACX,CAAC,CAAC;YACH,OAAO,GAAG,CAAC;QACb,CAAC;QACD,mBAAmB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YACtC,MAAM,OAAO,CAAC,oCAAoC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,qBAAqB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YACxC,MAAM,OAAO,CAAC,kCAAkC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,UAAU;QACV,eAAe,EAAE,GAAG,EAAE;YACpB,aAAa,EAAE,CAAC;YAChB,cAAc,EAAE,CAAC;QACnB,CAAC;QACD,QAAQ,EAAE,qBAAqB,EAAE;QACjC,cAAc,EAAE,0BAA0B,EAAE;QAC5C,cAAc,EAAE,0BAA0B,EAAE;KAC7C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"security-scan-engine.js","sourceRoot":"","sources":["../src/security-scan-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,GAGlB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,oBAAoB,EACpB,0BAA0B,GAG3B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExC,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC;AAkD7D,8EAA8E;AAC9E,uEAAuE;AACvE,8EAA8E;AAE9E,MAAM,gBAAgB,GAAyB,IAAI,GAAG,EAAE,CAAC;AAEzD,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,OAAO,CAAC,GAAG,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC;AACxC,CAAC;AA4FD,SAAS,YAAY,CACnB,EAAuC,EACvC,SAAqC;IAErC,IAAI,MAAM,GAA4B,IAAI,CAAC;IAC3C,OAAO,CAAC,KAAa,EAAE,EAAE;QACvB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CACrB,CAAC,MAAM,EAAE,EAAE;gBACT,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC;gBACpB,OAAO,MAAM,CAAC;YAChB,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;gBACN,MAAM,GAAG,IAAI,CAAC;gBACd,MAAM,GAAG,CAAC;YACZ,CAAC,CACF,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,KAAiC;IAEjC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,eAAe,GAAkB,IAAI,CAAC;IAC1C,MAAM,OAAO,GAAG,YAAY,CAC1B,CAAC,KAAoD,EAAE,EAAE,CACvD,KAAK,CAAC,8BAA8B,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC,EAC7E,CAAC,MAAM,EAAE,EAAE;QACT,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC;IACnC,CAAC,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACtD,MAAM,OAAO,GAAmB;QAC9B,GAAG,KAAK;QACR,8BAA8B,EAAE,CAAC,SAAS,EAAE,cAAc,EAAE,EAAE,CAC5D,OAAO,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;QACxC,gBAAgB,EAAE,QAAQ;QAC1B,eAAe,EAAE,WAAW;QAC5B,cAAc,EAAE,UAAU;KAC3B,CAAC;IACF,OAAO;QACL,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,GAAG,EAAE,CAAC,eAAe;KACnC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAkB,EAClB,OAA8B,EAC9B,IAAsB;IAEtB,uEAAuE;IACvE,yEAAyE;IACzE,oEAAoE;IACpE,8CAA8C;IAC9C,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC;IAED,8EAA8E;IAC9E,8EAA8E;IAC9E,8EAA8E;IAC9E,0EAA0E;IAC1E,2EAA2E;IAC3E,yDAAyD;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,GAAG,CAAC,KAAK,CACP,sCAAsC,MAAM,CAAC,SAAS,+BAA+B;YACrF,+EAA+E,CAChF,CAAC;QACF,OAAO;IACT,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,uEAAuE;IACvE,wCAAwC;IACxC,MAAM,oBAAoB,GAAG,wBAAwB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC3E,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEnG,kEAAkE;IAClE,iEAAiE;IACjE,8CAA8C;IAC9C,MAAM,eAAe,GAAG,IAAI,GAAG,EAAuB,CAAC;IACvD,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;gBAChC,MAAM;gBACN,QAAQ;aACT,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;YACnC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CACrC,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,cAAc,EACrB,OAAO,CACR,CAAC;gBACF,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;gBAEjC,4BAA4B;gBAC5B,mCAAmC;gBACnC,iEAAiE;gBACjE,8CAA8C;gBAC9C,MAAM,eAAe,GACnB,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,iBAAiB,KAAK,IAAI,CAAC,CAAC;gBACnF,IAAI,oBAAoB,IAAI,eAAe,EAAE,CAAC;oBAC5C,IAAI,CAAC;wBACH,MAAM,YAAY,GAAwB;4BACxC,EAAE,EAAE,MAAM,CAAC,SAAS;4BACpB,cAAc,EAAE,MAAM,CAAC,cAAc;4BACrC,SAAS,EAAE,MAAM,CAAC,SAAS;4BAC3B,QAAQ,EAAE,OAAO,CAAC,QAAQ;4BAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;4BAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;4BAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;4BACxB,MAAM,EAAE,MAAM,CAAC,MAAM;4BACrB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;yBAC5C,CAAC;wBACF,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,YAAY,EAAE,EAAE,EAAE,oBAAoB,CAAC,IAAI,CAAC,CAAC;wBAC1F,IAAI,YAAY,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;4BACvC,aAAa,EAAE,CAAC;wBAClB,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,GAAG,CAAC,IAAI,CACN,sCAAsC,OAAO,CAAC,UAAU,GAAG,EAC1D,GAAa,CAAC,OAAO,CACvB,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YACD,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CACN,kCAAkC,OAAO,CAAC,QAAQ,UAAU,EAC3D,GAAa,CAAC,OAAO,CACvB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,iEAAiE;IACjE,sDAAsD;IACtD,IAAI,IAAI,CAAC,cAAc,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,YAAY,GAAwB,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CACjF,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CACzD,CAAC;YACF,MAAM,oBAAoB,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAClF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,4BAA4B;IAC5B,IAAI,oBAAoB,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,oBAAoB,CAAC,WAAW,EAAE,CAAC;QACnD,IAAI,OAAO,IAAI,IAAI,CAAC,cAAc,EAAE,oCAAoC,EAAE,CAAC;YACzE,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,cAAc,CAAC,oCAAoC,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;YACzF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CACN,qEAAqE,EACpE,GAAa,CAAC,OAAO,CACvB,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,2DAA2D;AAC3D,8EAA8E;AAE9E,qEAAqE;AACrE,0EAA0E;AAC1E,kEAAkE;AAClE,kEAAkE;AAClE,+CAA+C;AAC/C,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;AAE1C,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAsB,EACtB,OAA8B,EAAE;IAEhC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACnD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,SAAS;QAC9B,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,SAAS;QAC7C,MAAM,OAAO,GAA0B,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;QAC3F,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACnB,+DAA+D;YACzD,kDAAkD;YAClD,GAAG,CAAC,KAAK,CAAC,8DAA8D,EAAE,EAAE,KAAK,EAAE,MAAM,CAAE,GAAa,EAAE,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/H,CAAC;gBAAS,CAAC;YACT,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,iDAAiD;AACjD,8EAA8E;AAE9E,MAAM,UAAU,4BAA4B,CAAC,MAAoB;IAC/D,MAAM,UAAU,GAAG,CAAC,SAAiB,EAAiB,EAAE;QACtD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;QAChE,4EAA4E;QAC5E,6EAA6E;QAC7E,2EAA2E;QAC3E,uEAAuE;QACvE,0EAA0E;QAC1E,sEAAsE;QACtE,sEAAsE;QACtE,qEAAqE;QACrE,4EAA4E;QAC5E,uEAAuE;QACvE,qEAAqE;QACrE,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC;IACpD,CAAC,CAAC;IAEF,OAAO;QACL,iBAAiB,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAChC,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,sCAAsC,EACtC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAC7C,CAAC;YACF,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;QACzB,CAAC;QACD,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,EAAE;YAC1D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAsB,gCAAgC,EAAE;gBAC/E,SAAS;gBACT,cAAc;gBACd,GAAG,OAAO;aACX,CAAC,CAAC;YACH,OAAO,GAAG,CAAC;QACb,CAAC;QACD,mBAAmB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YACtC,MAAM,OAAO,CAAC,oCAAoC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,qBAAqB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YACxC,MAAM,OAAO,CAAC,kCAAkC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,UAAU;QACV,eAAe,EAAE,GAAG,EAAE;YACpB,aAAa,EAAE,CAAC;YAChB,cAAc,EAAE,CAAC;QACnB,CAAC;QACD,QAAQ,EAAE,qBAAqB,EAAE;QACjC,cAAc,EAAE,0BAA0B,EAAE;QAC5C,cAAc,EAAE,0BAA0B,EAAE;KAC7C,CAAC;AACJ,CAAC"}

package/dist/staleness-sensor.d.ts

@@ -0,0 +1,153 @@
+/**
+ * Propagation-staleness sensor (focus: "Propagation Staleness Is Invisible").
+ *
+ * The differential instrument this focus is named for: it computes
+ * newest-available MINUS actually-running for a tracked target. Its first (and
+ * directly observable) target is the running daemon vs the Gitea npm registry:
+ *
+ *   running = ~/.telora/daemon.meta.json .version   (this daemon's own build)
+ *   newest  = the warm version cache .latestVersion  (Gitea registry dist-tags.latest,
+ *             kept fresh by startVersionCacheRefreshLoop)
+ *
+ * CLOSING the gap, not reporting it. The daemon-version gap is machine-closable:
+ * the safe-seam auto-update controller (auto-update.ts) already installs a newer
+ * registry version at the next batch-safe idle seam. So when the gap is beyond
+ * threshold this sensor DEFERS to that closer -- it does NOT tell a human "the
+ * daemon is stale, restart it". Telling a human about a gap the machine is
+ * already closing converts machine signal into human chore, and firing on a
+ * healthy daemon that is merely deferring to its next safe seam is exactly the
+ * failure mode this focus exists to remove.
+ *
+ * A human is involved ONLY where the machine genuinely cannot act: auto-update
+ * is disabled for this daemon (installMode=npx, or --no-auto-update /
+ * TELORA_AUTO_UPDATE=0, reflected as autoUpdateEnabled=false in daemon.meta.json).
+ * The operator opted out of automation, so the machine cannot close the gap --
+ * and even then the deliverable is a READY ACTION handed over (the exact
+ * `npm install -g` command + restart), never an inbox item that merely says a
+ * gap exists. That handover auto-resolves once the running version catches up,
+ * and is retired immediately if auto-update is re-enabled (the machine reclaims
+ * closure).
+ *
+ * Every tick leaves a trace (delegated-to-auto-update / handed-over /
+ * back-in-sync / "measured, within threshold" / "UNMEASURED"), so an ABSENT
+ * trace positively means "measured and in sync" -- never "not measured". Wedged
+ * auto-update (enabled but not running) is made visible by the SEPARATE
+ * auto-update decision heartbeat (auto-update.ts): an absent [auto-update] trace
+ * identifies a controller that is not running. That is not re-derived here.
+ *
+ * Pure decision (computeDaemonVersionDifferential / decideStalenessAction) +
+ * injected IO, mirroring ci-sensor-loop.ts, so the loop is unit-testable without
+ * a live registry or DB. Registered in LOOP_REGISTRY under the opt-out guard
+ * TELORA_STALENESS_SENSOR_LOOP.
+ *
+ * The two infra-owned targets observed 2026-07-24 (npmjs mirror serving a stale
+ * version; Opus 5 seed merged-but-maybe-not-applied) are NOT computable from
+ * this repo (no prod DB access; infra alone publishes to npmjs). They are
+ * recorded, with their operator-facing close action, in
+ * docs/runbook-propagation-staleness-targets.md -- the sensor deliberately does
+ * NOT attempt those infra actions.
+ *
+ * @module staleness-sensor
+ */
+import type { DaemonConfig } from './types.js';
+/**
+ * escalation_kind for a stale daemon that the machine CANNOT auto-close (auto-update
+ * disabled). Carries a ready action, not a bare "gap exists" notice.
+ */
+export declare const PROPAGATION_STALE_ESCALATION_KIND = "propagation_stale";
+/** Stable target id for the daemon-vs-registry differential. */
+export declare const DAEMON_VERSION_TARGET = "daemon-version";
+/**
+ * Default patch-version distance that trips the signal. Any minor/major gap
+ * always trips regardless. A 1-2 patch gap is left quiet: auto-update closes it
+ * at the next idle seam, so signaling immediately would be noise. The observed
+ * failure (0.20.21 vs 0.20.28 = 7 patches) is well past this floor.
+ */
+export declare const DEFAULT_STALENESS_PATCH_THRESHOLD = 3;
+/** Component-wise magnitude of how far `running` is behind `newest` (clamped at 0). */
+export interface VersionDistance {
+    major: number;
+    minor: number;
+    patch: number;
+}
+/** The computed newest-vs-running differential for a tracked target. */
+export interface StalenessDifferential {
+    target: string;
+    running: string;
+    newest: string;
+    /** True when `newest` is strictly newer than `running`. */
+    behind: boolean;
+    distance: VersionDistance;
+    /** True when the gap exceeds the declared threshold (any minor/major, or >= patchThreshold patches). */
+    beyondThreshold: boolean;
+}
+/**
+ * Compute the daemon-vs-registry differential. Returns null when it cannot be
+ * MEASURED (either version missing) -- the caller must then emit an explicit
+ * "UNMEASURED" trace rather than staying silent, so silence always means "in
+ * sync", never "not measured".
+ */
+export declare function computeDaemonVersionDifferential(running: string | null, newest: string | null, patchThreshold?: number): StalenessDifferential | null;
+/**
+ * What the sensor should do with the current differential.
+ *  - `delegate`   -- gap is beyond threshold and the machine closes it itself
+ *                    (auto-update enabled): defer to that closer, no human.
+ *  - `hand-over`  -- gap is beyond threshold but the machine cannot act
+ *                    (auto-update disabled): hand a human a ready action.
+ *  - `resolve`    -- an open handover exists but the machine is now closing the
+ *                    gap (back within threshold, OR auto-update re-enabled).
+ *  - `none`       -- nothing to do.
+ */
+export type StalenessAction = 'delegate' | 'hand-over' | 'resolve' | 'none';
+/**
+ * Pure decision. The pivot is `canMachineClose`: when the auto-update controller
+ * owns closing the daemon-version gap, the sensor NEVER hands a human a report --
+ * it defers (and retires any stale handover). A human is handed a ready action
+ * ONLY when the machine genuinely cannot act. A null differential (unmeasurable)
+ * never acts -- it is handled as a trace by the tick.
+ */
+export declare function decideStalenessAction(diff: StalenessDifferential | null, hasOpen: boolean, canMachineClose: boolean): StalenessAction;
+/** Injected IO for the sensor tick. Defaults reach for the real implementations. */
+export interface StalenessSensorDeps {
+    readRunningVersion: () => string | null;
+    readNewestAvailable: () => string | null;
+    patchThreshold: number;
+    /**
+     * True when the auto-update controller can close the daemon-version gap itself.
+     * When true the sensor defers to that closer and never hands a human a report;
+     * when false the operator opted out and the machine genuinely cannot act.
+     */
+    canMachineCloseGap: () => boolean;
+    hasOpenStalenessEscalation: () => Promise<boolean>;
+    /** Hand a human a READY ACTION when (and only when) the machine cannot act. */
+    handOverReadyAction: (params: {
+        organizationId: string;
+        productId: string;
+        diff: StalenessDifferential;
+        readyCommand: string;
+    }) => Promise<void>;
+    resolveStalenessEscalations: () => Promise<number>;
+}
+export interface StalenessSensorTickCounts {
+    /** True when the differential could be computed (both versions known). */
+    measured: boolean;
+    /** True when the daemon is behind the registry at all (any distance). */
+    behind: boolean;
+    /** True when the machine (auto-update) owns closing the measured gap this tick. */
+    delegatedToAutoUpdate: boolean;
+    /** Ready-action handovers filed -- only when the machine genuinely cannot act. */
+    handoversToOperator: number;
+    escalationsResolved: number;
+}
+/**
+ * One propagation-staleness sensor tick. Computes the global daemon-vs-registry
+ * differential once (the running daemon has a single version). When the gap is
+ * beyond threshold the sensor DEFERS to the auto-update controller if that closer
+ * is active, and hands a human a ready action ONLY when it is not. Any handover
+ * is anchored to the first configured product for inbox visibility (the fact is
+ * process-global; all products share one org).
+ *
+ * Every path emits a trace so an absent signal means "measured and in sync".
+ */
+export declare function runStalenessSensorTick(config: DaemonConfig, deps?: StalenessSensorDeps): Promise<StalenessSensorTickCounts>;
+//# sourceMappingURL=staleness-sensor.d.ts.map

package/dist/staleness-sensor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"staleness-sensor.d.ts","sourceRoot":"","sources":["../src/staleness-sensor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAa/C;;;GAGG;AACH,eAAO,MAAM,iCAAiC,sBAAsB,CAAC;AAErE,gEAAgE;AAChE,eAAO,MAAM,qBAAqB,mBAAmB,CAAC;AAEtD;;;;;GAKG;AACH,eAAO,MAAM,iCAAiC,IAAI,CAAC;AAEnD,uFAAuF;AACvF,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wEAAwE;AACxE,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,eAAe,CAAC;IAC1B,wGAAwG;IACxG,eAAe,EAAE,OAAO,CAAC;CAC1B;AAcD;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,MAAM,GAAG,IAAI,EACtB,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,cAAc,GAAE,MAA0C,GACzD,qBAAqB,GAAG,IAAI,CAO9B;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;AAE5E;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,qBAAqB,GAAG,IAAI,EAClC,OAAO,EAAE,OAAO,EAChB,eAAe,EAAE,OAAO,GACvB,eAAe,CAcjB;AAgHD,oFAAoF;AACpF,MAAM,WAAW,mBAAmB;IAClC,kBAAkB,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IACxC,mBAAmB,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IACzC,cAAc,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,kBAAkB,EAAE,MAAM,OAAO,CAAC;IAClC,0BAA0B,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,+EAA+E;IAC/E,mBAAmB,EAAE,CAAC,MAAM,EAAE;QAC5B,cAAc,EAAE,MAAM,CAAC;QACvB,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,qBAAqB,CAAC;QAC5B,YAAY,EAAE,MAAM,CAAC;KACtB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpB,2BAA2B,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CACpD;AAYD,MAAM,WAAW,yBAAyB;IACxC,0EAA0E;IAC1E,QAAQ,EAAE,OAAO,CAAC;IAClB,yEAAyE;IACzE,MAAM,EAAE,OAAO,CAAC;IAChB,mFAAmF;IACnF,qBAAqB,EAAE,OAAO,CAAC;IAC/B,kFAAkF;IAClF,mBAAmB,EAAE,MAAM,CAAC;IAC5B,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,YAAY,EACpB,IAAI,GAAE,mBAAiC,GACtC,OAAO,CAAC,yBAAyB,CAAC,CAyFpC"}

package/dist/staleness-sensor.js

@@ -0,0 +1,308 @@
+/**
+ * Propagation-staleness sensor (focus: "Propagation Staleness Is Invisible").
+ *
+ * The differential instrument this focus is named for: it computes
+ * newest-available MINUS actually-running for a tracked target. Its first (and
+ * directly observable) target is the running daemon vs the Gitea npm registry:
+ *
+ *   running = ~/.telora/daemon.meta.json .version   (this daemon's own build)
+ *   newest  = the warm version cache .latestVersion  (Gitea registry dist-tags.latest,
+ *             kept fresh by startVersionCacheRefreshLoop)
+ *
+ * CLOSING the gap, not reporting it. The daemon-version gap is machine-closable:
+ * the safe-seam auto-update controller (auto-update.ts) already installs a newer
+ * registry version at the next batch-safe idle seam. So when the gap is beyond
+ * threshold this sensor DEFERS to that closer -- it does NOT tell a human "the
+ * daemon is stale, restart it". Telling a human about a gap the machine is
+ * already closing converts machine signal into human chore, and firing on a
+ * healthy daemon that is merely deferring to its next safe seam is exactly the
+ * failure mode this focus exists to remove.
+ *
+ * A human is involved ONLY where the machine genuinely cannot act: auto-update
+ * is disabled for this daemon (installMode=npx, or --no-auto-update /
+ * TELORA_AUTO_UPDATE=0, reflected as autoUpdateEnabled=false in daemon.meta.json).
+ * The operator opted out of automation, so the machine cannot close the gap --
+ * and even then the deliverable is a READY ACTION handed over (the exact
+ * `npm install -g` command + restart), never an inbox item that merely says a
+ * gap exists. That handover auto-resolves once the running version catches up,
+ * and is retired immediately if auto-update is re-enabled (the machine reclaims
+ * closure).
+ *
+ * Every tick leaves a trace (delegated-to-auto-update / handed-over /
+ * back-in-sync / "measured, within threshold" / "UNMEASURED"), so an ABSENT
+ * trace positively means "measured and in sync" -- never "not measured". Wedged
+ * auto-update (enabled but not running) is made visible by the SEPARATE
+ * auto-update decision heartbeat (auto-update.ts): an absent [auto-update] trace
+ * identifies a controller that is not running. That is not re-derived here.
+ *
+ * Pure decision (computeDaemonVersionDifferential / decideStalenessAction) +
+ * injected IO, mirroring ci-sensor-loop.ts, so the loop is unit-testable without
+ * a live registry or DB. Registered in LOOP_REGISTRY under the opt-out guard
+ * TELORA_STALENESS_SENSOR_LOOP.
+ *
+ * The two infra-owned targets observed 2026-07-24 (npmjs mirror serving a stale
+ * version; Opus 5 seed merged-but-maybe-not-applied) are NOT computable from
+ * this repo (no prod DB access; infra alone publishes to npmjs). They are
+ * recorded, with their operator-facing close action, in
+ * docs/runbook-propagation-staleness-targets.md -- the sensor deliberately does
+ * NOT attempt those infra actions.
+ *
+ * @module staleness-sensor
+ */
+import { configForProduct } from './config.js';
+import { readFreshVersionCache } from './staleness.js';
+import { readDaemonMeta } from './daemon-process.js';
+import { isNewerVersion, parseVersionCore } from './version-check.js';
+import { createEscalation, markEscalationResolved } from './queries/issues.js';
+import { callApi } from './queries/shared.js';
+import { ESCALATION_REASONS, ESCALATION_DISPOSITIONS } from '@telora/daemon-core';
+import { createLogger } from './log.js';
+const log = createLogger({ module: 'staleness-sensor' });
+/**
+ * escalation_kind for a stale daemon that the machine CANNOT auto-close (auto-update
+ * disabled). Carries a ready action, not a bare "gap exists" notice.
+ */
+export const PROPAGATION_STALE_ESCALATION_KIND = 'propagation_stale';
+/** Stable target id for the daemon-vs-registry differential. */
+export const DAEMON_VERSION_TARGET = 'daemon-version';
+/**
+ * Default patch-version distance that trips the signal. Any minor/major gap
+ * always trips regardless. A 1-2 patch gap is left quiet: auto-update closes it
+ * at the next idle seam, so signaling immediately would be noise. The observed
+ * failure (0.20.21 vs 0.20.28 = 7 patches) is well past this floor.
+ */
+export const DEFAULT_STALENESS_PATCH_THRESHOLD = 3;
+/** Component-wise (newest - running), clamped at 0 per component. */
+function versionDistance(running, newest) {
+    const r = parseVersionCore(running);
+    const n = parseVersionCore(newest);
+    if (!r || !n)
+        return { major: 0, minor: 0, patch: 0 };
+    return {
+        major: Math.max(0, n[0] - r[0]),
+        minor: Math.max(0, n[1] - r[1]),
+        patch: Math.max(0, n[2] - r[2]),
+    };
+}
+/**
+ * Compute the daemon-vs-registry differential. Returns null when it cannot be
+ * MEASURED (either version missing) -- the caller must then emit an explicit
+ * "UNMEASURED" trace rather than staying silent, so silence always means "in
+ * sync", never "not measured".
+ */
+export function computeDaemonVersionDifferential(running, newest, patchThreshold = DEFAULT_STALENESS_PATCH_THRESHOLD) {
+    if (!running || !newest)
+        return null;
+    const behind = isNewerVersion(newest, running);
+    const distance = versionDistance(running, newest);
+    const beyondThreshold = behind && (distance.major > 0 || distance.minor > 0 || distance.patch >= patchThreshold);
+    return { target: DAEMON_VERSION_TARGET, running, newest, behind, distance, beyondThreshold };
+}
+/**
+ * Pure decision. The pivot is `canMachineClose`: when the auto-update controller
+ * owns closing the daemon-version gap, the sensor NEVER hands a human a report --
+ * it defers (and retires any stale handover). A human is handed a ready action
+ * ONLY when the machine genuinely cannot act. A null differential (unmeasurable)
+ * never acts -- it is handled as a trace by the tick.
+ */
+export function decideStalenessAction(diff, hasOpen, canMachineClose) {
+    if (!diff)
+        return 'none';
+    if (diff.beyondThreshold) {
+        if (canMachineClose) {
+            // Auto-update closes this at the next safe seam. Defer to it. If a stale
+            // handover from a prior disabled period is still open, retire it -- the
+            // machine has reclaimed closure.
+            return hasOpen ? 'resolve' : 'delegate';
+        }
+        // Machine cannot act (auto-update off / npx). Hand over a ready action once.
+        return hasOpen ? 'none' : 'hand-over';
+    }
+    // Within threshold / in sync: retire any open handover, else stay quiet.
+    return hasOpen ? 'resolve' : 'none';
+}
+function formatDistance(d) {
+    return `${d.major}.${d.minor}.${d.patch}`;
+}
+/** The exact operator command that closes the gap when the machine cannot. */
+function readyUpdateCommand(newest) {
+    return `npm install -g @telora/daemon@${newest}   # then restart the daemon`;
+}
+/**
+ * Whether the auto-update controller can close the daemon-version gap itself.
+ * Mirrors auto-update.ts's own disable conditions: npx-cache installs never
+ * update, and --no-auto-update / TELORA_AUTO_UPDATE=0 (surfaced as
+ * autoUpdateEnabled=false in daemon.meta.json) opt the operator out.
+ *
+ * Defaults to true (the closer is opt-out and runs by default) when meta is
+ * absent or the field is unstamped, so an unknown state never manufactures a
+ * spurious human handover.
+ */
+function defaultCanMachineCloseGap() {
+    const meta = readDaemonMeta();
+    if (!meta)
+        return true;
+    if (meta.installMode === 'npx')
+        return false;
+    return meta.autoUpdateEnabled !== false;
+}
+const OPEN_STATUSES = new Set(['pending', 'in_review']);
+function isOpenPropagationStale(e) {
+    if (e.status && !OPEN_STATUSES.has(e.status))
+        return false;
+    return e.escalationKind === PROPAGATION_STALE_ESCALATION_KIND;
+}
+async function defaultHasOpenStalenessEscalation() {
+    const result = await callApi('escalation_list', {
+        fields: { statuses: ['pending', 'in_review'] },
+        limit: 500,
+    });
+    return (result.escalations ?? []).some(isOpenPropagationStale);
+}
+async function defaultResolveStalenessEscalations() {
+    const result = await callApi('escalation_list', {
+        fields: { statuses: ['pending', 'in_review'] },
+        limit: 500,
+    });
+    const open = (result.escalations ?? []).filter(isOpenPropagationStale);
+    let resolved = 0;
+    for (const e of open) {
+        try {
+            await markEscalationResolved(e.id, 'Auto-resolved by the daemon: the machine is closing the daemon-version gap ' +
+                '(back in sync, or auto-update re-enabled) -- no operator action needed.');
+            resolved++;
+        }
+        catch (err) {
+            log.warn(`Failed to resolve propagation_stale escalation ${e.id}: ${err.message}`);
+        }
+    }
+    return resolved;
+}
+/**
+ * Hand a human a READY ACTION (not a gap report) for a stale daemon the machine
+ * cannot auto-close. The description leads with the exact command to run; the
+ * escalation exists to carry the action, not to announce that a gap exists.
+ */
+async function defaultHandOverReadyAction(params) {
+    const { diff, readyCommand } = params;
+    await createEscalation({
+        organizationId: params.organizationId,
+        issueId: null,
+        reasonType: ESCALATION_REASONS.ERROR_ENCOUNTERED,
+        disposition: ESCALATION_DISPOSITIONS.NEEDS_OPERATOR,
+        productId: params.productId,
+        escalationKind: PROPAGATION_STALE_ESCALATION_KIND,
+        description: `Ready action -- update this daemon:\n\n    ${readyCommand}\n\n` +
+            `Auto-update is disabled on this daemon (running from an npx cache, or ` +
+            `--no-auto-update / TELORA_AUTO_UPDATE=0), so the machine cannot close the ` +
+            `daemon-version gap itself: running v${diff.running} while the Gitea registry ` +
+            `serves v${diff.newest} (behind by ${formatDistance(diff.distance)}). Running the ` +
+            `command above closes it. This resolves automatically once the running version ` +
+            `catches up, or if auto-update is re-enabled.`,
+        metadata: {
+            target: diff.target,
+            running_version: diff.running,
+            newest_version: diff.newest,
+            distance: diff.distance,
+            ready_command: readyCommand,
+            reason: 'auto_update_disabled',
+            product_id: params.productId,
+        },
+    });
+}
+const defaultDeps = {
+    readRunningVersion: () => readDaemonMeta()?.version ?? null,
+    readNewestAvailable: () => readFreshVersionCache()?.latestVersion ?? null,
+    patchThreshold: DEFAULT_STALENESS_PATCH_THRESHOLD,
+    canMachineCloseGap: defaultCanMachineCloseGap,
+    hasOpenStalenessEscalation: defaultHasOpenStalenessEscalation,
+    handOverReadyAction: defaultHandOverReadyAction,
+    resolveStalenessEscalations: defaultResolveStalenessEscalations,
+};
+/**
+ * One propagation-staleness sensor tick. Computes the global daemon-vs-registry
+ * differential once (the running daemon has a single version). When the gap is
+ * beyond threshold the sensor DEFERS to the auto-update controller if that closer
+ * is active, and hands a human a ready action ONLY when it is not. Any handover
+ * is anchored to the first configured product for inbox visibility (the fact is
+ * process-global; all products share one org).
+ *
+ * Every path emits a trace so an absent signal means "measured and in sync".
+ */
+export async function runStalenessSensorTick(config, deps = defaultDeps) {
+    const counts = {
+        measured: false,
+        behind: false,
+        delegatedToAutoUpdate: false,
+        handoversToOperator: 0,
+        escalationsResolved: 0,
+    };
+    try {
+        const running = deps.readRunningVersion();
+        const newest = deps.readNewestAvailable();
+        const diff = computeDaemonVersionDifferential(running, newest, deps.patchThreshold);
+        if (!diff) {
+            // Not measurable this tick -- must NOT be silent (silence means in-sync).
+            log.warn(`[staleness] daemon-version differential UNMEASURED ` +
+                `(running=${running ?? 'unknown'}, newest=${newest ?? 'unknown'}); ` +
+                `cannot compute the propagation gap -- the version cache may not be warm yet.`);
+            return counts;
+        }
+        counts.measured = true;
+        counts.behind = diff.behind;
+        const anchor = config.products[0];
+        if (!anchor) {
+            log.info(`[staleness] measured: running v${diff.running} vs newest v${diff.newest} ` +
+                `(${diff.behind ? `behind ${formatDistance(diff.distance)}` : 'in sync'}); ` +
+                `no product configured to anchor a handover.`);
+            return counts;
+        }
+        const pc = configForProduct(config, anchor);
+        const canMachineClose = deps.canMachineCloseGap();
+        const hasOpen = await deps.hasOpenStalenessEscalation();
+        const action = decideStalenessAction(diff, hasOpen, canMachineClose);
+        if (diff.beyondThreshold && canMachineClose) {
+            counts.delegatedToAutoUpdate = true;
+        }
+        if (action === 'hand-over') {
+            const readyCommand = readyUpdateCommand(diff.newest);
+            await deps.handOverReadyAction({
+                organizationId: pc.organizationId,
+                productId: pc.productId,
+                diff,
+                readyCommand,
+            });
+            counts.handoversToOperator++;
+            log.warn(`[staleness] daemon behind registry (running v${diff.running} < newest v${diff.newest}, ` +
+                `behind ${formatDistance(diff.distance)}) and auto-update is DISABLED -- the machine ` +
+                `cannot close it. Handed over ready action: ${readyCommand}`);
+        }
+        else if (action === 'delegate') {
+            log.info(`[staleness] daemon behind registry (running v${diff.running} < newest v${diff.newest}, ` +
+                `behind ${formatDistance(diff.distance)}); auto-update owns closure at the next safe ` +
+                `seam -- deferring, no operator action.`);
+        }
+        else if (action === 'resolve') {
+            counts.escalationsResolved += await deps.resolveStalenessEscalations();
+            log.info(diff.beyondThreshold
+                ? `[staleness] auto-update re-enabled while behind (v${diff.running}); the machine now ` +
+                    `owns closure -- retired the operator handover.`
+                : `[staleness] daemon back in sync with registry (v${diff.running}); ` +
+                    `retired the operator handover.`);
+        }
+        else {
+            // Positive in-sync (or within-threshold) trace: silence must never mean
+            // "not measured". This is the heartbeat that makes an absent signal
+            // diagnostic.
+            log.info(`[staleness] measured: running v${diff.running} vs newest v${diff.newest} -- ` +
+                (diff.behind
+                    ? `behind by ${formatDistance(diff.distance)} (within threshold).`
+                    : 'in sync.'));
+        }
+    }
+    catch (err) {
+        log.warn(`[staleness] tick failed: ${err.message}`);
+    }
+    return counts;
+}
+//# sourceMappingURL=staleness-sensor.js.map

package/dist/staleness-sensor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"staleness-sensor.js","sourceRoot":"","sources":["../src/staleness-sensor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAClF,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExC,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;AAGzD;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,mBAAmB,CAAC;AAErE,gEAAgE;AAChE,MAAM,CAAC,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC;AAqBnD,qEAAqE;AACrE,SAAS,eAAe,CAAC,OAAe,EAAE,MAAc;IACtD,MAAM,CAAC,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,CAAC,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACtD,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;KAChC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gCAAgC,CAC9C,OAAsB,EACtB,MAAqB,EACrB,iBAAyB,iCAAiC;IAE1D,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,eAAe,GACnB,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,IAAI,QAAQ,CAAC,KAAK,GAAG,CAAC,IAAI,QAAQ,CAAC,KAAK,IAAI,cAAc,CAAC,CAAC;IAC3F,OAAO,EAAE,MAAM,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;AAC/F,CAAC;AAcD;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAkC,EAClC,OAAgB,EAChB,eAAwB;IAExB,IAAI,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC;IACzB,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,IAAI,eAAe,EAAE,CAAC;YACpB,yEAAyE;YACzE,wEAAwE;YACxE,iCAAiC;YACjC,OAAO,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;QAC1C,CAAC;QACD,6EAA6E;QAC7E,OAAO,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC;IACxC,CAAC;IACD,yEAAyE;IACzE,OAAO,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;AACtC,CAAC;AAED,SAAS,cAAc,CAAC,CAAkB;IACxC,OAAO,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,SAAS,kBAAkB,CAAC,MAAc;IACxC,OAAO,iCAAiC,MAAM,8BAA8B,CAAC;AAC/E,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,yBAAyB;IAChC,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,IAAI,CAAC,iBAAiB,KAAK,KAAK,CAAC;AAC1C,CAAC;AAUD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;AAExD,SAAS,sBAAsB,CAAC,CAAyB;IACvD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,OAAO,CAAC,CAAC,cAAc,KAAK,iCAAiC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,iCAAiC;IAC9C,MAAM,MAAM,GAAG,MAAM,OAAO,CAA4C,iBAAiB,EAAE;QACzF,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE;QAC9C,KAAK,EAAE,GAAG;KACX,CAAC,CAAC;IACH,OAAO,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,kCAAkC;IAC/C,MAAM,MAAM,GAAG,MAAM,OAAO,CAA4C,iBAAiB,EAAE;QACzF,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE;QAC9C,KAAK,EAAE,GAAG;KACX,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;IACvE,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,sBAAsB,CAC1B,CAAC,CAAC,EAAE,EACJ,6EAA6E;gBAC3E,yEAAyE,CAC5E,CAAC;YACF,QAAQ,EAAE,CAAC;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC,EAAE,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,0BAA0B,CAAC,MAKzC;IACC,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;IACtC,MAAM,gBAAgB,CAAC;QACrB,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,kBAAkB,CAAC,iBAAiB;QAChD,WAAW,EAAE,uBAAuB,CAAC,cAAc;QACnD,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,cAAc,EAAE,iCAAiC;QACjD,WAAW,EACT,8CAA8C,YAAY,MAAM;YAChE,wEAAwE;YACxE,4EAA4E;YAC5E,uCAAuC,IAAI,CAAC,OAAO,4BAA4B;YAC/E,WAAW,IAAI,CAAC,MAAM,eAAe,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB;YACnF,gFAAgF;YAChF,8CAA8C;QAChD,QAAQ,EAAE;YACR,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,eAAe,EAAE,IAAI,CAAC,OAAO;YAC7B,cAAc,EAAE,IAAI,CAAC,MAAM;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,aAAa,EAAE,YAAY;YAC3B,MAAM,EAAE,sBAAsB;YAC9B,UAAU,EAAE,MAAM,CAAC,SAAS;SAC7B;KACF,CAAC,CAAC;AACL,CAAC;AAwBD,MAAM,WAAW,GAAwB;IACvC,kBAAkB,EAAE,GAAG,EAAE,CAAC,cAAc,EAAE,EAAE,OAAO,IAAI,IAAI;IAC3D,mBAAmB,EAAE,GAAG,EAAE,CAAC,qBAAqB,EAAE,EAAE,aAAa,IAAI,IAAI;IACzE,cAAc,EAAE,iCAAiC;IACjD,kBAAkB,EAAE,yBAAyB;IAC7C,0BAA0B,EAAE,iCAAiC;IAC7D,mBAAmB,EAAE,0BAA0B;IAC/C,2BAA2B,EAAE,kCAAkC;CAChE,CAAC;AAcF;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAoB,EACpB,OAA4B,WAAW;IAEvC,MAAM,MAAM,GAA8B;QACxC,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,KAAK;QACb,qBAAqB,EAAE,KAAK;QAC5B,mBAAmB,EAAE,CAAC;QACtB,mBAAmB,EAAE,CAAC;KACvB,CAAC;IACF,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,gCAAgC,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAEpF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,0EAA0E;YAC1E,GAAG,CAAC,IAAI,CACN,qDAAqD;gBACnD,YAAY,OAAO,IAAI,SAAS,YAAY,MAAM,IAAI,SAAS,KAAK;gBACpE,8EAA8E,CACjF,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAE5B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,IAAI,CACN,kCAAkC,IAAI,CAAC,OAAO,eAAe,IAAI,CAAC,MAAM,GAAG;gBACzE,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK;gBAC5E,6CAA6C,CAChD,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,EAAE,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAE5C,MAAM,eAAe,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;QAErE,IAAI,IAAI,CAAC,eAAe,IAAI,eAAe,EAAE,CAAC;YAC5C,MAAM,CAAC,qBAAqB,GAAG,IAAI,CAAC;QACtC,CAAC;QAED,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YAC3B,MAAM,YAAY,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrD,MAAM,IAAI,CAAC,mBAAmB,CAAC;gBAC7B,cAAc,EAAE,EAAE,CAAC,cAAc;gBACjC,SAAS,EAAE,EAAE,CAAC,SAAS;gBACvB,IAAI;gBACJ,YAAY;aACb,CAAC,CAAC;YACH,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAC7B,GAAG,CAAC,IAAI,CACN,gDAAgD,IAAI,CAAC,OAAO,cAAc,IAAI,CAAC,MAAM,IAAI;gBACvF,UAAU,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,+CAA+C;gBACtF,8CAA8C,YAAY,EAAE,CAC/D,CAAC;QACJ,CAAC;aAAM,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,GAAG,CAAC,IAAI,CACN,gDAAgD,IAAI,CAAC,OAAO,cAAc,IAAI,CAAC,MAAM,IAAI;gBACvF,UAAU,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,+CAA+C;gBACtF,wCAAwC,CAC3C,CAAC;QACJ,CAAC;aAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,CAAC,mBAAmB,IAAI,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;YACvE,GAAG,CAAC,IAAI,CACN,IAAI,CAAC,eAAe;gBAClB,CAAC,CAAC,qDAAqD,IAAI,CAAC,OAAO,qBAAqB;oBACtF,gDAAgD;gBAClD,CAAC,CAAC,mDAAmD,IAAI,CAAC,OAAO,KAAK;oBACpE,gCAAgC,CACrC,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,wEAAwE;YACxE,oEAAoE;YACpE,cAAc;YACd,GAAG,CAAC,IAAI,CACN,kCAAkC,IAAI,CAAC,OAAO,eAAe,IAAI,CAAC,MAAM,MAAM;gBAC5E,CAAC,IAAI,CAAC,MAAM;oBACV,CAAC,CAAC,aAAa,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB;oBAClE,CAAC,CAAC,UAAU,CAAC,CAClB,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,4BAA6B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/unified-shell.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"unified-shell.d.ts","sourceRoot":"","sources":["../src/unified-shell.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAMH,OAAO,EACL,KAAK,aAAa,EAMnB,MAAM,qBAAqB,CAAC;AAyC7B,YAAY,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAmFtE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAkBlE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CA8BtE;AAMD;;;;;;;;;;;GAWG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,aAAa,EACrB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,CA2BlB;AAMD;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqchF"}
+{"version":3,"file":"unified-shell.d.ts","sourceRoot":"","sources":["../src/unified-shell.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAMH,OAAO,EACL,KAAK,aAAa,EAMnB,MAAM,qBAAqB,CAAC;AAyC7B,YAAY,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAmFtE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAkBlE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CA8BtE;AAMD;;;;;;;;;;;GAWG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,aAAa,EACrB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,CA2BlB;AAMD;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAidhF"}

package/dist/unified-shell.js

@@ -658,6 +658,17 @@ export async function runUnifiedDaemon(opts) {
             },
         });
     }
+    else {
+        // Auto-update is off. Emit a distinguishable trace naming which short-circuit
+        // fired, so "disabled by config/flag" is never confused with a controller
+        // that silently never ran (the invisibility this focus closes). The npx-cache
+        // short-circuit logs its own line from inside startAutoUpdateLoop.
+        const reason = opts.noAutoUpdate
+            ? 'the --no-auto-update flag'
+            : 'TELORA_AUTO_UPDATE=0 / config autoUpdate.enabled=false';
+        log.info(`[auto-update] Disabled by ${reason}; not sampling for updates ` +
+            '(version staleness is still tracked via the session-state staleness warning).');
+    }
     // -- 13. Keep process alive -----------------------------------------------
     await new Promise(() => { });
 }