@telora/daemon 0.22.169 → 0.22.187

package/dist/security/security-auto-inject.js

@@ -14,17 +14,36 @@
  * Per-batch (memoized across all findings in a scan run by
  * wrapAutoInjectForScanRun):
  *   1. Security remediation focus + tree.
- *   2. Batch entity node representing the codebase's security surface.
- *   3. Batch injection node ("Remediate security findings ...") targeting
- *      the entity node via a reality_tree_edge of kind 'targets'.
- *   4. Batch delivery on the focus, linked to the injection via the
+ *   2. Batch entity node representing the codebase's security surface --
+ *      the CAUSE, a neutral fact about what exists.
+ *   3. Batch undesired-effect node: the security PROBLEM the remediation
+ *      removes, authored from the finding that opened the batch, carrying a
+ *      non-blank frt_statement that states what its absence looks like. A
+ *      `sufficient` edge runs entity -> effect (cause -> effect).
+ *   4. Batch injection node ("Remediate security findings ...") targeting
+ *      the UNDESIRED EFFECT via a reality_tree_edge of kind 'targets'.
+ *   5. Batch delivery on the focus, linked to the injection via the
  *      delivery's injection_id column.
  *
  * Per finding:
- *   5. Issue under the batch delivery (title = "Remediate <ioc>:<id>",
+ *   6. Issue under the batch delivery (title = "Remediate <ioc>:<id>",
  *      description = advisory summary).
- *   6. Sets finding.linked_injection_id to the batch injection.
- *   7. Writes a security_finding_audit row with action='auto_injected'.
+ *   7. Sets finding.linked_injection_id to the batch injection.
+ *   8. Writes a security_finding_audit row with action='auto_injected'.
+ *
+ * WHY THE INJECTION TARGETS THE EFFECT AND NOT THE ENTITY. The arm of the
+ * remediation focus is applied last, by the batch-delivery door, and only when
+ * every node the injection targets STATES the future it covers
+ * (reality_tree_nodes.frt_statement). An entity node states no future -- it is
+ * a fact, not an effect -- so an injection that targets only the entity can
+ * never satisfy that bar, whatever prose is written on it: the arm would be
+ * withheld on every scan batch, forever. The entity REMAINS, as the cause; what
+ * the tree was missing is the effect and its stated future.
+ *
+ * The future statement here is MACHINE-DRAFTED from the finding, so it is
+ * written with frt_statement_drafted = true. A draft is accepted and carried
+ * with its flag, never passed off as authored -- the criteria stamp renders
+ * the flag downstream.
  *
  * No severity gate -- AI attempts every finding. The only short-circuit
  * is `skipped_already_linked` when the finding already carries a
@@ -53,6 +72,40 @@ function buildFindingLabel(finding) {
  *  upsert dedupes on (treeId, statement, type='entity'), so every finding
  *  in the run reuses the same node. */
 const BATCH_ENTITY_LABEL = 'Codebase security surface';
+/**
+ * The batch UNDESIRED EFFECT -- what is wrong, in evidence terms.
+ *
+ * Grounded in the finding that opened the batch (its ioc class, identifier and
+ * severity are the only facts available when the memoized per-batch nodes are
+ * created), and worded so it stays true of the batch as a whole: the finding is
+ * named as the one that opened it, not as the only one in it.
+ */
+export function buildBatchEffectStatement(finding) {
+    return ('Unremediated security findings are open against this codebase ' +
+        `(batch opened by ${finding.iocClass} finding ${finding.identifier}, severity ${finding.severity})`);
+}
+/**
+ * The stated future for that effect -- what its ABSENCE looks like, in terms
+ * the scanner itself re-measures. The re-scan resolution pass flips a finding
+ * to 'resolved' precisely when a later scan of the same ioc class no longer
+ * observes its identifier, so this statement is checkable by the machine that
+ * wrote it rather than being a wish.
+ *
+ * MACHINE-DRAFTED. Written with frt_statement_drafted = true; see
+ * BATCH_EFFECT_FUTURE_IS_DRAFTED.
+ */
+export function buildBatchEffectFutureStatement(finding) {
+    return ('A re-scan of this codebase observes no open security findings from this batch: ' +
+        `${finding.iocClass} finding ${finding.identifier} (severity ${finding.severity}), and every ` +
+        'other finding tracked under this delivery, is remediated and no longer reported by the scanner.');
+}
+/**
+ * The batch future statement is composed by this module from scan data -- no
+ * human wrote it -- so it is recorded as a DRAFT. Downstream (the criteria
+ * stamp) renders the flag, which is what keeps a drafted future from reading as
+ * declared intent.
+ */
+export const BATCH_EFFECT_FUTURE_IS_DRAFTED = true;
 /** Generic batch injection statement. The scan-run timestamp + finding
  *  count are not appended here -- focus name finalization carries that
  *  metadata for the dashboard. */
@@ -65,22 +118,42 @@ const BATCH_DELIVERY_DESCRIPTION = 'Auto-created to hold remediation work for th
 export async function processNewFinding(finding, _options, deps) {
     if (finding.linkedInjectionId)
         return { status: 'skipped_already_linked' };
-    // Steps 1-4 are per-batch: focus, entity, injection, delivery. Each is
-    // memoized by wrapAutoInjectForScanRun so every finding in the scan run
+    // Steps 1-5 are per-batch: focus, entity, effect, injection, delivery. Each
+    // is memoized by wrapAutoInjectForScanRun so every finding in the scan run
     // resolves the same set of identifiers without re-calling the server.
     const focus = await deps.createSecurityRemediationFocus(finding.productId, finding.organizationId);
+    // The CAUSE: a neutral fact about what exists. Stays in the tree.
     const entity = await deps.upsertEntityNode({
         treeId: focus.treeId,
         organizationId: finding.organizationId,
         label: BATCH_ENTITY_LABEL,
         payload: { batch: true },
     });
+    // The EFFECT the remediation removes, and the future its absence describes.
+    // This -- not the entity -- is what the injection targets, because an arm can
+    // only cover an effect that states a future.
+    const effect = await deps.upsertEffectNode({
+        treeId: focus.treeId,
+        organizationId: finding.organizationId,
+        label: buildBatchEffectStatement(finding),
+        frtStatement: buildBatchEffectFutureStatement(finding),
+        frtStatementDrafted: BATCH_EFFECT_FUTURE_IS_DRAFTED,
+        causeNodeId: entity.nodeId,
+        payload: {
+            batch: true,
+            ioc_class: finding.iocClass,
+            severity: finding.severity,
+            identifier: finding.identifier,
+            opened_by_finding_id: finding.id,
+            advisory: buildAdvisorySummary(finding),
+        },
+    });
     const injection = await deps.createInjection({
         treeId: focus.treeId,
         organizationId: finding.organizationId,
         statement: BATCH_INJECTION_STATEMENT,
-        targetNodeId: entity.nodeId,
-        sourcePayload: { batch: true },
+        targetNodeId: effect.nodeId,
+        sourcePayload: { batch: true, target_kind: 'undesired_effect' },
     });
     const delivery = await deps.createDelivery({
         focusId: focus.focusId,
@@ -137,6 +210,23 @@ export function buildDefaultAutoInjectDeps() {
         upsertEntityNode: async (input) => {
             return callApi('daemon_upsert_security_entity_node', input);
         },
+        upsertEffectNode: async (input) => {
+            // Same action as the entity upsert, on purpose: ONE server-side door
+            // owns node de-duplication for the batch tree, and an older deployed
+            // edge function that does not yet read the extra fields degrades to
+            // creating a plain entity -- which the arm door then declines to arm
+            // with `unstated_effect`, exactly today's behaviour and no worse.
+            return callApi('daemon_upsert_security_entity_node', {
+                treeId: input.treeId,
+                organizationId: input.organizationId,
+                label: input.label,
+                payload: input.payload,
+                nodeType: 'undesired_effect',
+                frtStatement: input.frtStatement,
+                frtStatementDrafted: input.frtStatementDrafted,
+                causeNodeId: input.causeNodeId,
+            });
+        },
         createInjection: async (input) => {
             return callApi('daemon_create_security_injection', input);
         },

package/dist/security/security-auto-inject.js.map

@@ -1 +1 @@
-{"version":3,"file":"security-auto-inject.js","sourceRoot":"","sources":["../../src/security/security-auto-inject.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,wEAAwE;AACxE,8DAA8D;AAC9D,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAiG/C,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E,SAAS,oBAAoB,CAAC,OAA4B;IACxD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAkC,CAAC;IAC3D,MAAM,UAAU,GAAG;QACjB,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QACxD,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;QAC5D,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;KACzE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,oBAAoB,OAAO,CAAC,UAAU,EAAE,CAAC;IACvE,OAAO,GAAG,IAAI,KAAK,OAAO,CAAC,QAAQ,cAAc,OAAO,CAAC,QAAQ,GAAG,CAAC;AACvE,CAAC;AAED,SAAS,iBAAiB,CAAC,OAA4B;IACrD,OAAO,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;AACrD,CAAC;AAED;;uCAEuC;AACvC,MAAM,kBAAkB,GAAG,2BAA2B,CAAC;AAEvD;;kCAEkC;AAClC,MAAM,yBAAyB,GAAG,gDAAgD,CAAC;AAEnF,SAAS,sBAAsB;IAC7B,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,OAAO,wBAAwB,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC;AAC7E,CAAC;AAED,MAAM,0BAA0B,GAC9B,8IAA8I,CAAC;AAgBjJ,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAA4B,EAC5B,QAA2B,EAC3B,IAAoB;IAEpB,IAAI,OAAO,CAAC,iBAAiB;QAAE,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IAE3E,uEAAuE;IACvE,wEAAwE;IACxE,sEAAsE;IACtE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,8BAA8B,CACrD,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,cAAc,CACvB,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC;QACzC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,KAAK,EAAE,kBAAkB;QACzB,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;KACzB,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC;QAC3C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,SAAS,EAAE,yBAAyB;QACpC,YAAY,EAAE,MAAM,CAAC,MAAM;QAC3B,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;KAC/B,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC;QACzC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,IAAI,EAAE,sBAAsB,EAAE;QAC9B,WAAW,EAAE,0BAA0B;QACvC,eAAe,EAAE,SAAS,CAAC,MAAM;KAClC,CAAC,CAAC;IAEH,oEAAoE;IACpE,0BAA0B;IAC1B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC;QAC7C,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,KAAK,EAAE,aAAa,iBAAiB,CAAC,OAAO,CAAC,EAAE;QAChD,WAAW,EAAE,oBAAoB,CAAC,OAAO,CAAC;QAC1C,SAAS,EAAE,MAAM;KAClB,CAAC,CAAC;IAEH,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAErD,MAAM,IAAI,CAAC,UAAU,CAAC;QACpB,SAAS,EAAE,OAAO,CAAC,EAAE;QACrB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,MAAM,EAAE,eAAe;QACvB,MAAM,EAAE,kBAAkB;QAC1B,OAAO,EAAE;YACP,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,WAAW,EAAE,QAAQ,CAAC,UAAU;YAChC,iBAAiB,EAAE,SAAS,CAAC,MAAM;YACnC,QAAQ,EAAE,KAAK,CAAC,OAAO;SACxB;KACF,CAAC,CAAC;IAEH,OAAO;QACL,MAAM,EAAE,UAAU;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,eAAe,EAAE,SAAS,CAAC,MAAM;QACjC,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,kDAAkD;AAClD,8EAA8E;AAE9E,MAAM,UAAU,0BAA0B;IACxC,OAAO;QACL,8BAA8B,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE;YAClE,OAAO,OAAO,CACZ,0CAA0C,EAC1C,EAAE,SAAS,EAAE,cAAc,EAAE,CAC9B,CAAC;QACJ,CAAC;QACD,oCAAoC,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE;YACpE,MAAM,OAAO,CAAC,iDAAiD,EAAE;gBAC/D,OAAO;gBACP,YAAY;aACb,CAAC,CAAC;QACL,CAAC;QACD,gBAAgB,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAChC,OAAO,OAAO,CAAqB,oCAAoC,EAAE,KAAK,CAAC,CAAC;QAClF,CAAC;QACD,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAC/B,OAAO,OAAO,CAAqB,kCAAkC,EAAE,KAAK,CAAC,CAAC;QAChF,CAAC;QACD,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAC9B,OAAO,OAAO,CAAyB,iCAAiC,EAAE,KAAK,CAAC,CAAC;QACnF,CAAC;QACD,qBAAqB,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YACrC,MAAM,GAAG,GAAG,MAAM,OAAO,CAA4B,cAAc,EAAE;gBACnE,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,MAAM;oBACpC,MAAM,EAAE,OAAO;iBAChB;aACF,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACnC,CAAC;QACD,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE;YAChD,MAAM,OAAO,CAAC,kCAAkC,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAC1B,sEAAsE;YACtE,sEAAsE;YACtE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;YAClC,MAAM,OAAO,CAAC,qCAAqC,EAAE;gBACnD,GAAG,IAAI;gBACP,WAAW,EAAE,MAAM;aACpB,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"security-auto-inject.js","sourceRoot":"","sources":["../../src/security/security-auto-inject.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,wEAAwE;AACxE,8DAA8D;AAC9D,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAuH/C,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E,SAAS,oBAAoB,CAAC,OAA4B;IACxD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAkC,CAAC;IAC3D,MAAM,UAAU,GAAG;QACjB,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QACxD,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;QAC5D,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;KACzE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,oBAAoB,OAAO,CAAC,UAAU,EAAE,CAAC;IACvE,OAAO,GAAG,IAAI,KAAK,OAAO,CAAC,QAAQ,cAAc,OAAO,CAAC,QAAQ,GAAG,CAAC;AACvE,CAAC;AAED,SAAS,iBAAiB,CAAC,OAA4B;IACrD,OAAO,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;AACrD,CAAC;AAED;;uCAEuC;AACvC,MAAM,kBAAkB,GAAG,2BAA2B,CAAC;AAEvD;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAA4B;IACpE,OAAO,CACL,gEAAgE;QAChE,oBAAoB,OAAO,CAAC,QAAQ,YAAY,OAAO,CAAC,UAAU,cAAc,OAAO,CAAC,QAAQ,GAAG,CACpG,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,+BAA+B,CAAC,OAA4B;IAC1E,OAAO,CACL,iFAAiF;QACjF,GAAG,OAAO,CAAC,QAAQ,YAAY,OAAO,CAAC,UAAU,cAAc,OAAO,CAAC,QAAQ,eAAe;QAC9F,iGAAiG,CAClG,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,CAAC;AAEnD;;kCAEkC;AAClC,MAAM,yBAAyB,GAAG,gDAAgD,CAAC;AAEnF,SAAS,sBAAsB;IAC7B,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,OAAO,wBAAwB,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC;AAC7E,CAAC;AAED,MAAM,0BAA0B,GAC9B,8IAA8I,CAAC;AAgBjJ,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAA4B,EAC5B,QAA2B,EAC3B,IAAoB;IAEpB,IAAI,OAAO,CAAC,iBAAiB;QAAE,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IAE3E,4EAA4E;IAC5E,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,8BAA8B,CACrD,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,cAAc,CACvB,CAAC;IAEF,kEAAkE;IAClE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC;QACzC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,KAAK,EAAE,kBAAkB;QACzB,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;KACzB,CAAC,CAAC;IAEH,4EAA4E;IAC5E,8EAA8E;IAC9E,6CAA6C;IAC7C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC;QACzC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,KAAK,EAAE,yBAAyB,CAAC,OAAO,CAAC;QACzC,YAAY,EAAE,+BAA+B,CAAC,OAAO,CAAC;QACtD,mBAAmB,EAAE,8BAA8B;QACnD,WAAW,EAAE,MAAM,CAAC,MAAM;QAC1B,OAAO,EAAE;YACP,KAAK,EAAE,IAAI;YACX,SAAS,EAAE,OAAO,CAAC,QAAQ;YAC3B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,oBAAoB,EAAE,OAAO,CAAC,EAAE;YAChC,QAAQ,EAAE,oBAAoB,CAAC,OAAO,CAAC;SACxC;KACF,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC;QAC3C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,SAAS,EAAE,yBAAyB;QACpC,YAAY,EAAE,MAAM,CAAC,MAAM;QAC3B,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,kBAAkB,EAAE;KAChE,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC;QACzC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,IAAI,EAAE,sBAAsB,EAAE;QAC9B,WAAW,EAAE,0BAA0B;QACvC,eAAe,EAAE,SAAS,CAAC,MAAM;KAClC,CAAC,CAAC;IAEH,oEAAoE;IACpE,0BAA0B;IAC1B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC;QAC7C,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,KAAK,EAAE,aAAa,iBAAiB,CAAC,OAAO,CAAC,EAAE;QAChD,WAAW,EAAE,oBAAoB,CAAC,OAAO,CAAC;QAC1C,SAAS,EAAE,MAAM;KAClB,CAAC,CAAC;IAEH,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAErD,MAAM,IAAI,CAAC,UAAU,CAAC;QACpB,SAAS,EAAE,OAAO,CAAC,EAAE;QACrB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,MAAM,EAAE,eAAe;QACvB,MAAM,EAAE,kBAAkB;QAC1B,OAAO,EAAE;YACP,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,WAAW,EAAE,QAAQ,CAAC,UAAU;YAChC,iBAAiB,EAAE,SAAS,CAAC,MAAM;YACnC,QAAQ,EAAE,KAAK,CAAC,OAAO;SACxB;KACF,CAAC,CAAC;IAEH,OAAO;QACL,MAAM,EAAE,UAAU;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,eAAe,EAAE,SAAS,CAAC,MAAM;QACjC,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,kDAAkD;AAClD,8EAA8E;AAE9E,MAAM,UAAU,0BAA0B;IACxC,OAAO;QACL,8BAA8B,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE;YAClE,OAAO,OAAO,CACZ,0CAA0C,EAC1C,EAAE,SAAS,EAAE,cAAc,EAAE,CAC9B,CAAC;QACJ,CAAC;QACD,oCAAoC,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE;YACpE,MAAM,OAAO,CAAC,iDAAiD,EAAE;gBAC/D,OAAO;gBACP,YAAY;aACb,CAAC,CAAC;QACL,CAAC;QACD,gBAAgB,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAChC,OAAO,OAAO,CAAqB,oCAAoC,EAAE,KAAK,CAAC,CAAC;QAClF,CAAC;QACD,gBAAgB,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAChC,qEAAqE;YACrE,qEAAqE;YACrE,oEAAoE;YACpE,qEAAqE;YACrE,kEAAkE;YAClE,OAAO,OAAO,CAAqB,oCAAoC,EAAE;gBACvE,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,QAAQ,EAAE,kBAAkB;gBAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;gBAC9C,WAAW,EAAE,KAAK,CAAC,WAAW;aAC/B,CAAC,CAAC;QACL,CAAC;QACD,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAC/B,OAAO,OAAO,CAAqB,kCAAkC,EAAE,KAAK,CAAC,CAAC;QAChF,CAAC;QACD,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAC9B,OAAO,OAAO,CAAyB,iCAAiC,EAAE,KAAK,CAAC,CAAC;QACnF,CAAC;QACD,qBAAqB,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YACrC,MAAM,GAAG,GAAG,MAAM,OAAO,CAA4B,cAAc,EAAE;gBACnE,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,MAAM;oBACpC,MAAM,EAAE,OAAO;iBAChB;aACF,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACnC,CAAC;QACD,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE;YAChD,MAAM,OAAO,CAAC,kCAAkC,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAC1B,sEAAsE;YACtE,sEAAsE;YACtE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;YAClC,MAAM,OAAO,CAAC,qCAAqC,EAAE;gBACnD,GAAG,IAAI;gBACP,WAAW,EAAE,MAAM;aACpB,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/security/security-scan-engine.d.ts

@@ -99,10 +99,10 @@ export interface SecurityScanDeps {
 }
 /**
  * Memoize the per-batch identifiers within one scan-run: focus (+ tree),
- * entity node, injection node, and delivery. The server handlers always
- * create new rows; without this wrapper, every finding in the scan would
- * land in its own focus + delivery, producing N noisy copies of what is
- * conceptually one remediation batch. Returns undefined when no
+ * entity node, undesired-effect node, injection node, and delivery. The
+ * server handlers always create new rows; without this wrapper, every finding
+ * in the scan would land in its own focus + delivery, producing N noisy copies
+ * of what is conceptually one remediation batch. Returns undefined when no
  * auto-inject is configured.
  *
  * Failure semantics: if a memoized call throws, that slot's cached promise

package/dist/security/security-scan-engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security-scan-engine.d.ts","sourceRoot":"","sources":["../../src/security/security-scan-engine.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAGL,KAAK,cAAc,EAEpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAGL,KAAK,cAAc,EAEpB,MAAM,iCAAiC,CAAC;AAYzC,MAAM,MAAM,QAAQ,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAC9D,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,aAAa,GAAG,UAAU,GAAG,WAAW,CAAC;AAE9E,sEAAsE;AACtE,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,+CAA+C;AAC/C,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,gDAAgD;AAChD,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,uDAAuD;AACvD,MAAM,WAAW,OAAO;IACtB,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAC7C;AAQD,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAEtD;AAED,wBAAgB,qBAAqB,IAAI,OAAO,EAAE,CAEjD;AAMD,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,aAAa,CAAC;IACtB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,6EAA6E;AAC7E,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,iBAAiB,EAAE,CAAC,IAAI,CAAC,EAAE,qBAAqB,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3E;;;;OAIG;IACH,aAAa,EAAE,CACb,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,YAAY,KAClB,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAClC,8DAA8D;IAC9D,mBAAmB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,qBAAqB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACjD;;;;OAIG;IACH,eAAe,EAAE,MAAM,IAAI,CAAC;IAC5B,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,cAAc,CAAC;IACrB,sEAAsE;IACtE,WAAW,IAAI,MAAM,GAAG,IAAI,CAAC;CAC9B;AAwBD,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,cAAc,GAAG,SAAS,GAChC,iBAAiB,GAAG,SAAS,CAyB/B;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,UAAU,GAAG,QAAQ,EAC9B,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,IAAI,CAAC,CAwIf;AAaD,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,gBAAgB,EACtB,IAAI,GAAE,qBAA0B,GAC/B,OAAO,CAAC,IAAI,CAAC,CAiBf;AAMD,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,YAAY,GAAG,gBAAgB,CAiDnF"}
+{"version":3,"file":"security-scan-engine.d.ts","sourceRoot":"","sources":["../../src/security/security-scan-engine.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAGL,KAAK,cAAc,EAEpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAGL,KAAK,cAAc,EAEpB,MAAM,iCAAiC,CAAC;AAYzC,MAAM,MAAM,QAAQ,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAC9D,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,aAAa,GAAG,UAAU,GAAG,WAAW,CAAC;AAE9E,sEAAsE;AACtE,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,+CAA+C;AAC/C,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,gDAAgD;AAChD,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,uDAAuD;AACvD,MAAM,WAAW,OAAO;IACtB,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAC7C;AAQD,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAEtD;AAED,wBAAgB,qBAAqB,IAAI,OAAO,EAAE,CAEjD;AAMD,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,aAAa,CAAC;IACtB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,6EAA6E;AAC7E,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,iBAAiB,EAAE,CAAC,IAAI,CAAC,EAAE,qBAAqB,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3E;;;;OAIG;IACH,aAAa,EAAE,CACb,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,YAAY,KAClB,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAClC,8DAA8D;IAC9D,mBAAmB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,qBAAqB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACjD;;;;OAIG;IACH,eAAe,EAAE,MAAM,IAAI,CAAC;IAC5B,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,cAAc,CAAC;IACrB,sEAAsE;IACtE,WAAW,IAAI,MAAM,GAAG,IAAI,CAAC;CAC9B;AAwBD,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,cAAc,GAAG,SAAS,GAChC,iBAAiB,GAAG,SAAS,CA+B/B;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,UAAU,GAAG,QAAQ,EAC9B,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,IAAI,CAAC,CAwIf;AAaD,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,gBAAgB,EACtB,IAAI,GAAE,qBAA0B,GAC/B,OAAO,CAAC,IAAI,CAAC,CAiBf;AAMD,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,YAAY,GAAG,gBAAgB,CAiDnF"}

package/dist/security/security-scan-engine.js

@@ -63,12 +63,18 @@ export function wrapAutoInjectForScanRun(inner) {
         resolvedFocusId = result.focusId;
     });
     const entityFn = makeMemoSlot(inner.upsertEntityNode);
+    // The effect node needs its OWN slot. It is a second node upsert in the same
+    // batch, so sharing the entity slot would hand the caller back the entity id
+    // and the injection would target the entity again -- the exact defect the
+    // effect node exists to remove.
+    const effectFn = makeMemoSlot(inner.upsertEffectNode);
     const injectionFn = makeMemoSlot(inner.createInjection);
     const deliveryFn = makeMemoSlot(inner.createDelivery);
     const wrapped = {
         ...inner,
         createSecurityRemediationFocus: (productId, organizationId) => focusFn({ productId, organizationId }),
         upsertEntityNode: entityFn,
+        upsertEffectNode: effectFn,
         createInjection: injectionFn,
         createDelivery: deliveryFn,
     };

package/dist/security/security-scan-engine.js.map

@@ -1 +1 @@
-{"version":3,"file":"security-scan-engine.js","sourceRoot":"","sources":["../../src/security/security-scan-engine.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,yGAAyG;AACzG,6GAA6G;AAC7G,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAE/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,GAGlB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,oBAAoB,EACpB,0BAA0B,GAG3B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC;AAkD7D,8EAA8E;AAC9E,uEAAuE;AACvE,8EAA8E;AAE9E,MAAM,gBAAgB,GAAyB,IAAI,GAAG,EAAE,CAAC;AAEzD,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,OAAO,CAAC,GAAG,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC;AACxC,CAAC;AA4FD,SAAS,YAAY,CACnB,EAAuC,EACvC,SAAqC;IAErC,IAAI,MAAM,GAA4B,IAAI,CAAC;IAC3C,OAAO,CAAC,KAAa,EAAE,EAAE;QACvB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CACrB,CAAC,MAAM,EAAE,EAAE;gBACT,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC;gBACpB,OAAO,MAAM,CAAC;YAChB,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;gBACN,MAAM,GAAG,IAAI,CAAC;gBACd,MAAM,GAAG,CAAC;YACZ,CAAC,CACF,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,KAAiC;IAEjC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,eAAe,GAAkB,IAAI,CAAC;IAC1C,MAAM,OAAO,GAAG,YAAY,CAC1B,CAAC,KAAoD,EAAE,EAAE,CACvD,KAAK,CAAC,8BAA8B,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC,EAC7E,CAAC,MAAM,EAAE,EAAE;QACT,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC;IACnC,CAAC,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACtD,MAAM,OAAO,GAAmB;QAC9B,GAAG,KAAK;QACR,8BAA8B,EAAE,CAAC,SAAS,EAAE,cAAc,EAAE,EAAE,CAC5D,OAAO,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;QACxC,gBAAgB,EAAE,QAAQ;QAC1B,eAAe,EAAE,WAAW;QAC5B,cAAc,EAAE,UAAU;KAC3B,CAAC;IACF,OAAO;QACL,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,GAAG,EAAE,CAAC,eAAe;KACnC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAkB,EAClB,OAA8B,EAC9B,IAAsB;IAEtB,uEAAuE;IACvE,yEAAyE;IACzE,oEAAoE;IACpE,8CAA8C;IAC9C,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC;IAED,8EAA8E;IAC9E,8EAA8E;IAC9E,8EAA8E;IAC9E,0EAA0E;IAC1E,2EAA2E;IAC3E,yDAAyD;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,GAAG,CAAC,KAAK,CACP,sCAAsC,MAAM,CAAC,SAAS,+BAA+B;YACrF,+EAA+E,CAChF,CAAC;QACF,OAAO;IACT,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,uEAAuE;IACvE,wCAAwC;IACxC,MAAM,oBAAoB,GAAG,wBAAwB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC3E,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEnG,kEAAkE;IAClE,iEAAiE;IACjE,8CAA8C;IAC9C,MAAM,eAAe,GAAG,IAAI,GAAG,EAAuB,CAAC;IACvD,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;gBAChC,MAAM;gBACN,QAAQ;aACT,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;YACnC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CACrC,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,cAAc,EACrB,OAAO,CACR,CAAC;gBACF,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;gBAEjC,4BAA4B;gBAC5B,mCAAmC;gBACnC,iEAAiE;gBACjE,8CAA8C;gBAC9C,MAAM,eAAe,GACnB,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,iBAAiB,KAAK,IAAI,CAAC,CAAC;gBACnF,IAAI,oBAAoB,IAAI,eAAe,EAAE,CAAC;oBAC5C,IAAI,CAAC;wBACH,MAAM,YAAY,GAAwB;4BACxC,EAAE,EAAE,MAAM,CAAC,SAAS;4BACpB,cAAc,EAAE,MAAM,CAAC,cAAc;4BACrC,SAAS,EAAE,MAAM,CAAC,SAAS;4BAC3B,QAAQ,EAAE,OAAO,CAAC,QAAQ;4BAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;4BAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;4BAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;4BACxB,MAAM,EAAE,MAAM,CAAC,MAAM;4BACrB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;yBAC5C,CAAC;wBACF,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,YAAY,EAAE,EAAE,EAAE,oBAAoB,CAAC,IAAI,CAAC,CAAC;wBAC1F,IAAI,YAAY,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;4BACvC,aAAa,EAAE,CAAC;wBAClB,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,GAAG,CAAC,IAAI,CACN,sCAAsC,OAAO,CAAC,UAAU,GAAG,EAC1D,GAAa,CAAC,OAAO,CACvB,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YACD,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CACN,kCAAkC,OAAO,CAAC,QAAQ,UAAU,EAC3D,GAAa,CAAC,OAAO,CACvB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,iEAAiE;IACjE,sDAAsD;IACtD,IAAI,IAAI,CAAC,cAAc,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,YAAY,GAAwB,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CACjF,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CACzD,CAAC;YACF,MAAM,oBAAoB,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAClF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,4BAA4B;IAC5B,IAAI,oBAAoB,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,oBAAoB,CAAC,WAAW,EAAE,CAAC;QACnD,IAAI,OAAO,IAAI,IAAI,CAAC,cAAc,EAAE,oCAAoC,EAAE,CAAC;YACzE,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,cAAc,CAAC,oCAAoC,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;YACzF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CACN,qEAAqE,EACpE,GAAa,CAAC,OAAO,CACvB,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,2DAA2D;AAC3D,8EAA8E;AAE9E,qEAAqE;AACrE,0EAA0E;AAC1E,kEAAkE;AAClE,kEAAkE;AAClE,+CAA+C;AAC/C,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;AAE1C,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAsB,EACtB,OAA8B,EAAE;IAEhC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACnD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,SAAS;QAC9B,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,SAAS;QAC7C,MAAM,OAAO,GAA0B,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;QAC3F,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACnB,+DAA+D;YACzD,kDAAkD;YAClD,GAAG,CAAC,KAAK,CAAC,8DAA8D,EAAE,EAAE,KAAK,EAAE,MAAM,CAAE,GAAa,EAAE,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/H,CAAC;gBAAS,CAAC;YACT,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,iDAAiD;AACjD,8EAA8E;AAE9E,MAAM,UAAU,4BAA4B,CAAC,MAAoB;IAC/D,MAAM,UAAU,GAAG,CAAC,SAAiB,EAAiB,EAAE;QACtD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;QAChE,4EAA4E;QAC5E,6EAA6E;QAC7E,2EAA2E;QAC3E,uEAAuE;QACvE,0EAA0E;QAC1E,sEAAsE;QACtE,sEAAsE;QACtE,qEAAqE;QACrE,4EAA4E;QAC5E,uEAAuE;QACvE,qEAAqE;QACrE,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC;IACpD,CAAC,CAAC;IAEF,OAAO;QACL,iBAAiB,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAChC,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,sCAAsC,EACtC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAC7C,CAAC;YACF,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;QACzB,CAAC;QACD,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,EAAE;YAC1D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAsB,gCAAgC,EAAE;gBAC/E,SAAS;gBACT,cAAc;gBACd,GAAG,OAAO;aACX,CAAC,CAAC;YACH,OAAO,GAAG,CAAC;QACb,CAAC;QACD,mBAAmB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YACtC,MAAM,OAAO,CAAC,oCAAoC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,qBAAqB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YACxC,MAAM,OAAO,CAAC,kCAAkC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,UAAU;QACV,eAAe,EAAE,GAAG,EAAE;YACpB,aAAa,EAAE,CAAC;YAChB,cAAc,EAAE,CAAC;QACnB,CAAC;QACD,QAAQ,EAAE,qBAAqB,EAAE;QACjC,cAAc,EAAE,0BAA0B,EAAE;QAC5C,cAAc,EAAE,0BAA0B,EAAE;KAC7C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"security-scan-engine.js","sourceRoot":"","sources":["../../src/security/security-scan-engine.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,yGAAyG;AACzG,6GAA6G;AAC7G,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAE/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,GAGlB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,oBAAoB,EACpB,0BAA0B,GAG3B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC;AAkD7D,8EAA8E;AAC9E,uEAAuE;AACvE,8EAA8E;AAE9E,MAAM,gBAAgB,GAAyB,IAAI,GAAG,EAAE,CAAC;AAEzD,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,OAAO,CAAC,GAAG,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC;AACxC,CAAC;AA4FD,SAAS,YAAY,CACnB,EAAuC,EACvC,SAAqC;IAErC,IAAI,MAAM,GAA4B,IAAI,CAAC;IAC3C,OAAO,CAAC,KAAa,EAAE,EAAE;QACvB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CACrB,CAAC,MAAM,EAAE,EAAE;gBACT,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC;gBACpB,OAAO,MAAM,CAAC;YAChB,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;gBACN,MAAM,GAAG,IAAI,CAAC;gBACd,MAAM,GAAG,CAAC;YACZ,CAAC,CACF,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,KAAiC;IAEjC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,eAAe,GAAkB,IAAI,CAAC;IAC1C,MAAM,OAAO,GAAG,YAAY,CAC1B,CAAC,KAAoD,EAAE,EAAE,CACvD,KAAK,CAAC,8BAA8B,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC,EAC7E,CAAC,MAAM,EAAE,EAAE;QACT,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC;IACnC,CAAC,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACtD,6EAA6E;IAC7E,6EAA6E;IAC7E,0EAA0E;IAC1E,gCAAgC;IAChC,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACtD,MAAM,OAAO,GAAmB;QAC9B,GAAG,KAAK;QACR,8BAA8B,EAAE,CAAC,SAAS,EAAE,cAAc,EAAE,EAAE,CAC5D,OAAO,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;QACxC,gBAAgB,EAAE,QAAQ;QAC1B,gBAAgB,EAAE,QAAQ;QAC1B,eAAe,EAAE,WAAW;QAC5B,cAAc,EAAE,UAAU;KAC3B,CAAC;IACF,OAAO;QACL,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,GAAG,EAAE,CAAC,eAAe;KACnC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAkB,EAClB,OAA8B,EAC9B,IAAsB;IAEtB,uEAAuE;IACvE,yEAAyE;IACzE,oEAAoE;IACpE,8CAA8C;IAC9C,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC;IAED,8EAA8E;IAC9E,8EAA8E;IAC9E,8EAA8E;IAC9E,0EAA0E;IAC1E,2EAA2E;IAC3E,yDAAyD;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,GAAG,CAAC,KAAK,CACP,sCAAsC,MAAM,CAAC,SAAS,+BAA+B;YACrF,+EAA+E,CAChF,CAAC;QACF,OAAO;IACT,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,uEAAuE;IACvE,wCAAwC;IACxC,MAAM,oBAAoB,GAAG,wBAAwB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC3E,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEnG,kEAAkE;IAClE,iEAAiE;IACjE,8CAA8C;IAC9C,MAAM,eAAe,GAAG,IAAI,GAAG,EAAuB,CAAC;IACvD,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;gBAChC,MAAM;gBACN,QAAQ;aACT,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;YACnC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CACrC,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,cAAc,EACrB,OAAO,CACR,CAAC;gBACF,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;gBAEjC,4BAA4B;gBAC5B,mCAAmC;gBACnC,iEAAiE;gBACjE,8CAA8C;gBAC9C,MAAM,eAAe,GACnB,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,iBAAiB,KAAK,IAAI,CAAC,CAAC;gBACnF,IAAI,oBAAoB,IAAI,eAAe,EAAE,CAAC;oBAC5C,IAAI,CAAC;wBACH,MAAM,YAAY,GAAwB;4BACxC,EAAE,EAAE,MAAM,CAAC,SAAS;4BACpB,cAAc,EAAE,MAAM,CAAC,cAAc;4BACrC,SAAS,EAAE,MAAM,CAAC,SAAS;4BAC3B,QAAQ,EAAE,OAAO,CAAC,QAAQ;4BAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;4BAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;4BAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;4BACxB,MAAM,EAAE,MAAM,CAAC,MAAM;4BACrB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;yBAC5C,CAAC;wBACF,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,YAAY,EAAE,EAAE,EAAE,oBAAoB,CAAC,IAAI,CAAC,CAAC;wBAC1F,IAAI,YAAY,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;4BACvC,aAAa,EAAE,CAAC;wBAClB,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,GAAG,CAAC,IAAI,CACN,sCAAsC,OAAO,CAAC,UAAU,GAAG,EAC1D,GAAa,CAAC,OAAO,CACvB,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YACD,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CACN,kCAAkC,OAAO,CAAC,QAAQ,UAAU,EAC3D,GAAa,CAAC,OAAO,CACvB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,iEAAiE;IACjE,sDAAsD;IACtD,IAAI,IAAI,CAAC,cAAc,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,YAAY,GAAwB,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CACjF,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CACzD,CAAC;YACF,MAAM,oBAAoB,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAClF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,4BAA4B;IAC5B,IAAI,oBAAoB,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,oBAAoB,CAAC,WAAW,EAAE,CAAC;QACnD,IAAI,OAAO,IAAI,IAAI,CAAC,cAAc,EAAE,oCAAoC,EAAE,CAAC;YACzE,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,cAAc,CAAC,oCAAoC,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;YACzF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CACN,qEAAqE,EACpE,GAAa,CAAC,OAAO,CACvB,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,2DAA2D;AAC3D,8EAA8E;AAE9E,qEAAqE;AACrE,0EAA0E;AAC1E,kEAAkE;AAClE,kEAAkE;AAClE,+CAA+C;AAC/C,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;AAE1C,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAsB,EACtB,OAA8B,EAAE;IAEhC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACnD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,SAAS;QAC9B,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,SAAS;QAC7C,MAAM,OAAO,GAA0B,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;QAC3F,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACnB,+DAA+D;YACzD,kDAAkD;YAClD,GAAG,CAAC,KAAK,CAAC,8DAA8D,EAAE,EAAE,KAAK,EAAE,MAAM,CAAE,GAAa,EAAE,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/H,CAAC;gBAAS,CAAC;YACT,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,iDAAiD;AACjD,8EAA8E;AAE9E,MAAM,UAAU,4BAA4B,CAAC,MAAoB;IAC/D,MAAM,UAAU,GAAG,CAAC,SAAiB,EAAiB,EAAE;QACtD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;QAChE,4EAA4E;QAC5E,6EAA6E;QAC7E,2EAA2E;QAC3E,uEAAuE;QACvE,0EAA0E;QAC1E,sEAAsE;QACtE,sEAAsE;QACtE,qEAAqE;QACrE,4EAA4E;QAC5E,uEAAuE;QACvE,qEAAqE;QACrE,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC;IACpD,CAAC,CAAC;IAEF,OAAO;QACL,iBAAiB,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAChC,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,sCAAsC,EACtC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAC7C,CAAC;YACF,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;QACzB,CAAC;QACD,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,EAAE;YAC1D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAsB,gCAAgC,EAAE;gBAC/E,SAAS;gBACT,cAAc;gBACd,GAAG,OAAO;aACX,CAAC,CAAC;YACH,OAAO,GAAG,CAAC;QACb,CAAC;QACD,mBAAmB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YACtC,MAAM,OAAO,CAAC,oCAAoC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,qBAAqB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YACxC,MAAM,OAAO,CAAC,kCAAkC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,UAAU;QACV,eAAe,EAAE,GAAG,EAAE;YACpB,aAAa,EAAE,CAAC;YAChB,cAAc,EAAE,CAAC;QACnB,CAAC;QACD,QAAQ,EAAE,qBAAqB,EAAE;QACjC,cAAc,EAAE,0BAA0B,EAAE;QAC5C,cAAc,EAAE,0BAA0B,EAAE;KAC7C,CAAC;AACJ,CAAC"}

package/dist/session/session-lineage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-lineage.d.ts","sourceRoot":"","sources":["../../src/session/session-lineage.ts"],"names":[],"mappings":"AAaA;;;;;;;;;;;;;;GAcG;AAEH,oDAAoD;AACpD,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEnD,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,iBAAiB,CAAC;CAC/B;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,QAAQ,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,UAAU,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,GAAG,SAAS,CAAC;IAChG,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CACtC,GAAG,WAAW,CAKd;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,iBAAiB,CAAC;CAC/B,GAAG,MAAM,GAAG,IAAI,CAGhB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,SAAS,EAC9C,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAChB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAExB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,+EAA+E;IAC/E,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,8DAA8D;IAC9D,cAAc,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,aAAa,EAAE,OAAO,CAAC;CACxB,GAAG,OAAO,CAKV"}
+{"version":3,"file":"session-lineage.d.ts","sourceRoot":"","sources":["../../src/session/session-lineage.ts"],"names":[],"mappings":"AAeA;;;;;;;;;;;;;;GAcG;AAEH,oDAAoD;AACpD,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEnD,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,iBAAiB,CAAC;CAC/B;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,QAAQ,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,UAAU,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,GAAG,SAAS,CAAC;IAChG,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CACtC,GAAG,WAAW,CAKd;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,iBAAiB,CAAC;CAC/B,GAAG,MAAM,GAAG,IAAI,CAGhB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,SAAS,EAC9C,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAChB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAExB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,+EAA+E;IAC/E,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,8DAA8D;IAC9D,cAAc,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,aAAa,EAAE,OAAO,CAAC;CACxB,GAAG,OAAO,CAKV"}

package/dist/session/session-lineage.js

@@ -4,6 +4,8 @@
 //   packages/daemon/src/integration/approved-head-gate-failure-respawn-regression.test.ts,
 //   packages/daemon/src/integration/review-rework-resume-verdict.test.ts,
 //   packages/daemon/src/integration/verification-rework-resume-verdict.test.ts,
+//   packages/daemon/src/prompt/prompt-contradictions.test.ts,
+//   packages/daemon/src/prompt/remediation-framing-per-pass.test.ts,
 //   packages/daemon/src/session/session-lineage.test.ts,
 //   packages/daemon/src/session/session-pass-close.test.ts,
 //   packages/daemon/src/session/session-pass-write-path.test.ts,

package/dist/session/session-lineage.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-lineage.js","sourceRoot":"","sources":["../../src/session/session-lineage.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,wFAAwF;AACxF,uEAAuE;AACvE,2FAA2F;AAC3F,0EAA0E;AAC1E,gFAAgF;AAChF,yDAAyD;AACzD,4DAA4D;AAC5D,iEAAiE;AACjE,mEAAmE;AACnE,qEAAqE;AACrE,gBAAgB;AA2BhB;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,OAAe;IAC7D,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,OAAO,EAAE,CAAC;AACpE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAGlC;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,OAAO;WACjC,CAAC,IAAI,CAAC,SAAS,KAAK,WAAW,IAAI,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC3F,MAAM,UAAU,GAAsB,IAAI,CAAC,QAAQ,EAAE,UAAU,IAAI,QAAQ,CAAC;IAC5E,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAAC,IAK/B;IACC,IAAI,IAAI,CAAC,UAAU,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC;AAC/E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAA8C,EAC9C,QAAgB,EAChB,OAAe,EACf,SAAiB;IAEjB,OAAO,EAAE,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,eAAe,CAAC,IAO/B;IACC,IAAI,IAAI,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC,kBAAkB,KAAK,IAAI,CAAC,cAAc,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC,aAAa,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"session-lineage.js","sourceRoot":"","sources":["../../src/session/session-lineage.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,wFAAwF;AACxF,uEAAuE;AACvE,2FAA2F;AAC3F,0EAA0E;AAC1E,gFAAgF;AAChF,8DAA8D;AAC9D,qEAAqE;AACrE,yDAAyD;AACzD,4DAA4D;AAC5D,iEAAiE;AACjE,mEAAmE;AACnE,qEAAqE;AACrE,gBAAgB;AA2BhB;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,OAAe;IAC7D,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,OAAO,EAAE,CAAC;AACpE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAGlC;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,OAAO;WACjC,CAAC,IAAI,CAAC,SAAS,KAAK,WAAW,IAAI,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC3F,MAAM,UAAU,GAAsB,IAAI,CAAC,QAAQ,EAAE,UAAU,IAAI,QAAQ,CAAC;IAC5E,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAAC,IAK/B;IACC,IAAI,IAAI,CAAC,UAAU,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC;AAC/E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAA8C,EAC9C,QAAgB,EAChB,OAAe,EACf,SAAiB;IAEjB,OAAO,EAAE,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,eAAe,CAAC,IAO/B;IACC,IAAI,IAAI,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC,kBAAkB,KAAK,IAAI,CAAC,cAAc,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC,aAAa,CAAC;AAC5B,CAAC"}

package/dist/shell/constants.d.ts

@@ -6,6 +6,11 @@
  * Used to determine whether a delivery still has outstanding work.
  * 'In Review' is intentionally excluded: it signals dev-complete and
  * waiting for review-agent confirmation, not unresolved work.
+ *
+ * TWIN: supabase/functions/product-api/handlers/delivery-review-finding-gate.ts
+ * OPEN_FINDING_STATUSES is the edge-runtime copy of this set (the refusal of a
+ * delivery create while review-filed findings are open) and MUST agree with
+ * it; Deno cannot import this package. Change both or neither.
  */
 export declare const OPEN_ISSUE_STATUSES: Set<string>;
 /**

package/dist/shell/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/shell/constants.ts"],"names":[],"mappings":"AAOA;;GAEG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,aAA+C,CAAC;AAEhF;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,aAA6C,CAAC;AAElF,0FAA0F;AAC1F,eAAO,MAAM,kBAAkB,EAAG,eAAwB,CAAC;AAE3D,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,CAAC,SAAS;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAElF;AAED,4CAA4C;AAC5C,wBAAgB,mBAAmB,CAAC,CAAC,SAAS;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAErF;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EAChG,MAAM,EAAE,CAAC,EAAE,GACV,MAAM,EAAE,CAIV"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/shell/constants.ts"],"names":[],"mappings":"AAOA;;GAEG;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,aAA+C,CAAC;AAEhF;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,aAA6C,CAAC;AAElF,0FAA0F;AAC1F,eAAO,MAAM,kBAAkB,EAAG,eAAwB,CAAC;AAE3D,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,CAAC,SAAS;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAElF;AAED,4CAA4C;AAC5C,wBAAgB,mBAAmB,CAAC,CAAC,SAAS;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAErF;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EAChG,MAAM,EAAE,CAAC,EAAE,GACV,MAAM,EAAE,CAIV"}

package/dist/shell/constants.js

@@ -12,6 +12,11 @@
  * Used to determine whether a delivery still has outstanding work.
  * 'In Review' is intentionally excluded: it signals dev-complete and
  * waiting for review-agent confirmation, not unresolved work.
+ *
+ * TWIN: supabase/functions/product-api/handlers/delivery-review-finding-gate.ts
+ * OPEN_FINDING_STATUSES is the edge-runtime copy of this set (the refusal of a
+ * delivery create while review-filed findings are open) and MUST agree with
+ * it; Deno cannot import this package. Change both or neither.
  */
 export const OPEN_ISSUE_STATUSES = new Set(['To Do', 'In Progress', 'Blocked']);
 /**

package/dist/shell/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/shell/constants.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,iFAAiF;AACjF,uDAAuD;AACvD,0EAA0E;AAC1E,2DAA2D;AAC3D,gBAAgB;AAEhB;;GAEG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;AAEhF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;AAElF,0FAA0F;AAC1F,MAAM,CAAC,MAAM,kBAAkB,GAAG,eAAwB,CAAC;AAE3D,kFAAkF;AAClF,MAAM,UAAU,gBAAgB,CAAkC,MAAW;IAC3E,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,kBAAkB,CAAC,CAAC;AAChE,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,mBAAmB,CAAkC,MAAW;IAC9E,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,kBAAkB,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAW;IAEX,OAAO,gBAAgB,CAAC,MAAM,CAAC;SAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC;SAChE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACpB,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/shell/constants.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,iFAAiF;AACjF,uDAAuD;AACvD,0EAA0E;AAC1E,2DAA2D;AAC3D,gBAAgB;AAEhB;;GAEG;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;AAEhF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;AAElF,0FAA0F;AAC1F,MAAM,CAAC,MAAM,kBAAkB,GAAG,eAAwB,CAAC;AAE3D,kFAAkF;AAClF,MAAM,UAAU,gBAAgB,CAAkC,MAAW;IAC3E,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,kBAAkB,CAAC,CAAC;AAChE,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,mBAAmB,CAAkC,MAAW;IAC9E,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,kBAAkB,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAW;IAEX,OAAO,gBAAgB,CAAC,MAAM,CAAC;SAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC;SAChE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACpB,CAAC"}

package/dist/shell/daemon-instance.d.ts

@@ -1,56 +1,32 @@
-import type { AgentSession } from '../types/index.js';
-/** The parts of a parsed instance id. */
-export interface DaemonInstance {
-    hostname: string;
-    pid: number;
-    /** Kernel start time of the daemon pid; null when the platform cannot supply one. */
-    startIdentity: string | null;
-}
-/**
- * This daemon instance's id. Stamped onto every session it creates, and the
- * identity its own crash recovery compares against.
- */
-export declare function daemonInstanceId(): string;
-/** Reset the memo. Test seam only -- a daemon's identity never changes in life. */
-export declare function resetDaemonInstanceIdCache(): void;
-/**
- * Parse an instance id, or null when it is absent or malformed. A row written
- * by a daemon predating this column parses to null and is treated as
- * unattributable -- never as "gone".
- */
-export declare function parseDaemonInstanceId(id: string | null | undefined): DaemonInstance | null;
 /**
- * What a session row's owning instance is doing now.
- *
- * - `self`        -- this daemon owns it. Never reap: the team is ours and live.
- * - `peer_alive`  -- another daemon instance on this host is still running. Its
- *                    sessions are its business; reaping them is the defect.
- * - `gone`        -- the owning instance is not running. Its teams stopped with
- *                    it, so its rows are safe to close.
- * - `unknown`     -- no id, a malformed id, or an id from another host whose pid
- *                    we cannot probe. FAILS SAFE: not reaped.
- */
-export type InstanceLiveness = 'self' | 'peer_alive' | 'gone' | 'unknown';
-/** Probes `classifyOwningInstance` reaches, injectable for tests. */
-export interface InstanceProbeDeps {
-    selfId: string;
-    selfHostname: string;
-    isProcessAlive: (pid: number) => boolean;
-    readStartIdentity: (pid: number) => string | null;
-}
-/** Real probes against this host. */
-export declare function defaultInstanceProbes(): InstanceProbeDeps;
-/**
- * Classify the instance that owns a session row.
- *
- * Every branch that is not `gone` leaves the row alone, because only `gone` is
- * positive evidence that the team the row represents has stopped. Recovery
- * would rather leave a stale row than falsify a live one: a stale `running` row
- * is visible and self-correcting on the next sweep, whereas a live session
- * marked `failed` silently tells every reader -- including "is this worktree
- * being written?" -- that a running team is not there.
+ * Daemon INSTANCE ownership of a session row -- the SESSION half.
+ *
+ * The instance-IDENTITY half (`daemonInstanceId`, `parseDaemonInstanceId`,
+ * `classifyOwningInstance` and friends) lives in shell/instance-liveness.ts and
+ * is re-exported here unchanged, so every existing importer of this module is
+ * unaffected. The split exists because THIS module imports
+ * shell/worker-pidfile.ts, so the pidfile could not ask the identity question
+ * back; see that module's header for the whole reason.
+ *
+ * What is left here is the question recovery actually has to answer before it
+ * writes `failed`: has the team this row represents actually stopped? An
+ * instance id answers "is the daemon that wrote this row still running?", and a
+ * row whose owner is alive, or whose owner cannot be determined, is left alone.
+ *
+ * A dead owner is NOT on its own proof that the row's team stopped. Team leads
+ * are spawned DETACHED, so they survive a hard-killed daemon; the boot reap
+ * that ends them (`reapAndClearWorkerPidfile`, unified-shell) is explicitly
+ * best-effort -- a missing or malformed pidfile yields no entries and a failed
+ * kill is swallowed. So the destructive pass needs a SECOND proof, about the
+ * session's own process: `classifySessionProcess`. Both must agree before a row
+ * is closed.
+ *
+ * @module shell/daemon-instance
  */
-export declare function classifyOwningInstance(instanceId: string | null | undefined, deps: InstanceProbeDeps): InstanceLiveness;
+import type { AgentSession } from '../types/index.js';
+import { type InstanceProbeDeps } from './instance-liveness.js';
+export { daemonInstanceId, resetDaemonInstanceIdCache, parseDaemonInstanceId, defaultInstanceProbes, classifyOwningInstance, isReservationInFlight, } from './instance-liveness.js';
+export type { DaemonInstance, InstanceLiveness, InstanceProbeDeps, } from './instance-liveness.js';
 /**
  * What the SESSION's own process is doing -- the second proof, about the team
  * rather than the daemon that spawned it.
@@ -62,9 +38,13 @@ export declare function classifyOwningInstance(instanceId: string | null | undef
  *                            lead for this session, so none was ever spawned.
  * - `unprovable`          -- nothing can be shown: the record could not be read,
  *                            or it names a process whose identity cannot be
- *                            verified (a reservation, a pid with no recorded or
- *                            no readable start identity). An anonymous live pid
- *                            is NOT an alive team.
+ *                            verified (a reservation still in flight, a pid with
+ *                            no recorded or no readable start identity). An
+ *                            anonymous live pid is NOT an alive team.
+ *
+ * A RESERVATION used to land in `unprovable` unconditionally, and permanently:
+ * see `classifyRecordedProcess` for why one whose reserving instance is provably
+ * gone now answers `stopped` instead.
  */
 export type SessionProcessLiveness = 'alive' | 'stopped' | 'no_process_recorded' | 'unprovable';
 /** Process probes for the session-liveness check, injectable for tests. */
@@ -76,11 +56,28 @@ export interface SessionProcessProbes {
      * The host's durable lead records by session id, or null when they cannot be
      * read. Null is UNKNOWN, never "nothing is running".
      */
-    leadRecordsBySession: () => Map<string, {
-        pid: number;
-        startIdentity?: string;
-        pending?: true;
-    }> | null;
+    leadRecordsBySession: () => Map<string, RecordedProcess> | null;
+    /**
+     * Is a reservation's reserving daemon instance still running? The ONE
+     * definition lives in shell/instance-liveness.ts
+     * (`isReservationInFlight`); this is the seam a test injects, and the
+     * default binds to it. Absent/empty `reservedBy` is in flight -- see there
+     * for the direction-of-failure argument.
+     */
+    reservationInFlight: (reservedBy: string | undefined) => boolean;
+}
+/**
+ * The shape `classifyRecordedProcess` reads out of the lead record: a
+ * `WorkerPidEntry`, narrowed to the fields the verdict depends on.
+ * `readLeadRecordsBySession` already hands back whole entries, so `reservedBy`
+ * arrives with no read change -- it simply had no reader.
+ */
+export interface RecordedProcess {
+    pid: number;
+    startIdentity?: string;
+    pending?: true;
+    /** The daemon instance that made a reservation. Only meaningful with `pending`. */
+    reservedBy?: string;
 }
 /**
  * Real probes against this host. The lead-record read is memoized PER PROBE
@@ -102,13 +99,26 @@ export declare function defaultSessionProcessProbes(): SessionProcessProbes;
  * in between -- no recorded identity, an unreadable live identity, a pid we
  * cannot probe -- is `indeterminate`, and each caller applies its OWN safe
  * direction to it rather than inheriting one that only suits recovery.
+ *
+ * A RESERVATION is the fourth case, and it is a JUDGEMENT rather than a shrug.
+ * The retention passes (`reapAndClearWorkerPidfile`,
+ * `clearWorkerPidfileIfAllGone`) run only at boot, hard stop and shutdown; in
+ * between, a LIVE daemon's sweeps read the record through here. While this
+ * branch answered `indeterminate` unconditionally, a reservation stranded by a
+ * hard kill between `reserveLeadRecord` and the pid write made its session
+ * undecidable FOREVER: session-health skipped the row `unprovable_process`,
+ * abandoned-merge recovery refused to restore its worktree, and the worktree
+ * write signal answered `provable: false`. Nothing could ever improve that read,
+ * because the instance that would have resolved the reservation no longer
+ * exists. So the reservation is judged by its `reservedBy`: in flight ->
+ * `indeterminate` exactly as before; provably gone -> `gone`. The full argument
+ * for why `gone` is sound HERE while this module refuses that inference
+ * everywhere else -- in short, a pid-0 row is already unnameable by every kill
+ * path, so retiring it forfeits no capability -- is at
+ * `isReservationInFlight` (shell/instance-liveness.ts).
  */
 export type RecordedProcessState = 'alive' | 'gone' | 'indeterminate';
-export declare function classifyRecordedProcess(record: {
-    pid: number;
-    startIdentity?: string;
-    pending?: true;
-}, probes: SessionProcessProbes): RecordedProcessState;
+export declare function classifyRecordedProcess(record: RecordedProcess, probes: SessionProcessProbes): RecordedProcessState;
 /**
  * Classify the session's own process, from the host's DURABLE LEAD RECORD rather
  * than from the session row's pid.

package/dist/shell/daemon-instance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"daemon-instance.d.ts","sourceRoot":"","sources":["../../src/shell/daemon-instance.ts"],"names":[],"mappings":"AAyCA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAQtD,yCAAyC;AACzC,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,qFAAqF;IACrF,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAQD;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAMzC;AAED,mFAAmF;AACnF,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,cAAc,GAAG,IAAI,CAY1F;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,YAAY,GAAG,MAAM,GAAG,SAAS,CAAC;AAE1E,qEAAqE;AACrE,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACzC,iBAAiB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACnD;AAED,qCAAqC;AACrC,wBAAgB,qBAAqB,IAAI,iBAAiB,CAOzD;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACrC,IAAI,EAAE,iBAAiB,GACtB,gBAAgB,CAsBlB;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,SAAS,GAAG,qBAAqB,GAAG,YAAY,CAAC;AAEhG,2EAA2E;AAC3E,MAAM,WAAW,oBAAoB;IACnC,cAAc,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACzC,mBAAmB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/C,iBAAiB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAClD;;;OAGG;IACH,oBAAoB,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,IAAI,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;CACzG;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,IAAI,oBAAoB,CAWlE;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,MAAM,GAAG,eAAe,CAAC;AAEtE,wBAAgB,uBAAuB,CACrC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,IAAI,CAAA;CAAE,EAC/D,MAAM,EAAE,oBAAoB,GAC3B,oBAAoB,CAiBtB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,oBAAoB,GAC3B,sBAAsB,CAUxB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,SAAS,YAAY,EAAE,EACjC,MAAM,EAAE,iBAAiB,EACzB,aAAa,GAAE,oBAAoD,GAClE;IAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;CAAE,CAqC7D;AAED,gFAAgF;AAChF,MAAM,WAAW,mBAAmB;IAClC,cAAc,CAAC,EAAE,MAAM,iBAAiB,CAAC;IACzC,oBAAoB,CAAC,EAAE,MAAM,oBAAoB,CAAC;CACnD;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,SAAS,YAAY,EAAE,EACjC,WAAW,GAAE,mBAAwB,GACpC,YAAY,EAAE,CAUhB"}
+{"version":3,"file":"daemon-instance.d.ts","sourceRoot":"","sources":["../../src/shell/daemon-instance.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAKtD,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,wBAAwB,CAAC;AAIhC,OAAO,EACL,gBAAgB,EAChB,0BAA0B,EAC1B,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,cAAc,EACd,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAIhC;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,SAAS,GAAG,qBAAqB,GAAG,YAAY,CAAC;AAEhG,2EAA2E;AAC3E,MAAM,WAAW,oBAAoB;IACnC,cAAc,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACzC,mBAAmB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/C,iBAAiB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAClD;;;OAGG;IACH,oBAAoB,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,IAAI,CAAC;IAChE;;;;;;OAMG;IACH,mBAAmB,EAAE,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC;CAClE;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,IAAI,CAAC;IACf,mFAAmF;IACnF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,IAAI,oBAAoB,CAclE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,MAAM,GAAG,eAAe,CAAC;AAEtE,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,eAAe,EACvB,MAAM,EAAE,oBAAoB,GAC3B,oBAAoB,CAuBtB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,oBAAoB,GAC3B,sBAAsB,CAUxB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,SAAS,YAAY,EAAE,EACjC,MAAM,EAAE,iBAAiB,EACzB,aAAa,GAAE,oBAAoD,GAClE;IAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;CAAE,CAqC7D;AAED,gFAAgF;AAChF,MAAM,WAAW,mBAAmB;IAClC,cAAc,CAAC,EAAE,MAAM,iBAAiB,CAAC;IACzC,oBAAoB,CAAC,EAAE,MAAM,oBAAoB,CAAC;CACnD;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,SAAS,YAAY,EAAE,EACjC,WAAW,GAAE,mBAAwB,GACpC,YAAY,EAAE,CAUhB"}