@tradejs/cli 2.0.15 → 2.0.17

package/dist/lib/runtimeEvidenceArtifacts.js

@@ -0,0 +1,255 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/lib/runtimeEvidenceArtifacts.ts
+var runtimeEvidenceArtifacts_exports = {};
+__export(runtimeEvidenceArtifacts_exports, {
+  RUNTIME_EVIDENCE_COMPLETE_FILE: () => RUNTIME_EVIDENCE_COMPLETE_FILE,
+  RUNTIME_EVIDENCE_MANIFEST_FILE: () => RUNTIME_EVIDENCE_MANIFEST_FILE,
+  RUNTIME_EVIDENCE_PAYLOAD_FILE: () => RUNTIME_EVIDENCE_PAYLOAD_FILE,
+  discoverRuntimeEvidenceBundles: () => discoverRuntimeEvidenceBundles,
+  publishRuntimeEvidenceBundle: () => publishRuntimeEvidenceBundle,
+  verifyRuntimeEvidenceBundle: () => verifyRuntimeEvidenceBundle
+});
+module.exports = __toCommonJS(runtimeEvidenceArtifacts_exports);
+var import_node_crypto = require("crypto");
+var import_promises = __toESM(require("fs/promises"));
+var import_node_path = __toESM(require("path"));
+var RUNTIME_EVIDENCE_MANIFEST_FILE = "manifest.json";
+var RUNTIME_EVIDENCE_PAYLOAD_FILE = "runtime-evidence.json";
+var RUNTIME_EVIDENCE_COMPLETE_FILE = ".complete";
+var asRecord = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;
+var sha256 = (value) => (0, import_node_crypto.createHash)("sha256").update(value).digest("hex");
+var isExistingDestinationError = (error) => {
+  const code = error.code;
+  return code === "EEXIST" || code === "ENOTEMPTY";
+};
+var safeSegment = (value, fallback) => {
+  const normalized = value.trim().replace(/[^a-zA-Z0-9._-]+/g, "-");
+  return normalized && normalized !== "." && normalized !== ".." ? normalized : fallback;
+};
+var compactTimestamp = (timestamp) => new Date(timestamp).toISOString().replace(/[-:]/g, "").replace(/\.000Z$/, "Z");
+var dateParts = (timestamp) => {
+  const date = new Date(timestamp);
+  return [
+    String(date.getUTCFullYear()),
+    String(date.getUTCMonth() + 1).padStart(2, "0"),
+    String(date.getUTCDate()).padStart(2, "0")
+  ];
+};
+var assertFiniteTimestamp = (value, label) => {
+  if (typeof value !== "number" || !Number.isFinite(value)) {
+    throw new Error(`Invalid runtime evidence ${label}`);
+  }
+  return value;
+};
+var parseManifest = (value) => {
+  const manifest = asRecord(value);
+  const window = asRecord(manifest?.window);
+  const payload = asRecord(manifest?.payload);
+  const counts = asRecord(manifest?.counts);
+  if (manifest?.schemaVersion !== 1 || manifest.reportType !== "runtime-evidence" || typeof manifest.artifactId !== "string" || typeof manifest.deploymentId !== "string" || typeof manifest.userName !== "string" || typeof manifest.createdAt !== "number" || payload?.file !== RUNTIME_EVIDENCE_PAYLOAD_FILE || typeof payload.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(payload.sha256) || typeof payload.bytes !== "number" || !Array.isArray(manifest.lineageKeys)) {
+    throw new Error("Invalid runtime evidence manifest");
+  }
+  return {
+    schemaVersion: 1,
+    artifactId: manifest.artifactId,
+    reportType: "runtime-evidence",
+    deploymentId: manifest.deploymentId,
+    userName: manifest.userName,
+    createdAt: manifest.createdAt,
+    window: {
+      startTime: assertFiniteTimestamp(window?.startTime, "window.startTime"),
+      endTime: assertFiniteTimestamp(window?.endTime, "window.endTime")
+    },
+    payload: {
+      file: RUNTIME_EVIDENCE_PAYLOAD_FILE,
+      sha256: payload.sha256,
+      bytes: payload.bytes
+    },
+    counts: Object.fromEntries(
+      Object.entries(counts ?? {}).filter(
+        (entry) => typeof entry[1] === "number" && Number.isFinite(entry[1])
+      )
+    ),
+    lineageKeys: manifest.lineageKeys.filter(
+      (value2) => typeof value2 === "string" && value2.length > 0
+    )
+  };
+};
+var publishRuntimeEvidenceBundle = async ({
+  publishRoot,
+  deploymentId,
+  userName,
+  startTime,
+  endTime,
+  artifact,
+  counts,
+  lineageKeys
+}) => {
+  const payload = `${JSON.stringify(artifact, null, 2)}
+`;
+  const payloadSha256 = sha256(payload);
+  const safeDeploymentId = safeSegment(deploymentId, "default");
+  const artifactId = [
+    compactTimestamp(startTime),
+    compactTimestamp(endTime),
+    payloadSha256.slice(0, 16)
+  ].join("_");
+  const createdAt = Date.now();
+  const manifest = {
+    schemaVersion: 1,
+    artifactId,
+    reportType: "runtime-evidence",
+    deploymentId: safeDeploymentId,
+    userName,
+    createdAt,
+    window: { startTime, endTime },
+    payload: {
+      file: RUNTIME_EVIDENCE_PAYLOAD_FILE,
+      sha256: payloadSha256,
+      bytes: Buffer.byteLength(payload)
+    },
+    counts,
+    lineageKeys: [...new Set(lineageKeys)].sort()
+  };
+  const incomingRoot = import_node_path.default.join(publishRoot, "incoming");
+  const readyRoot = import_node_path.default.join(
+    publishRoot,
+    "ready",
+    safeDeploymentId,
+    ...dateParts(endTime)
+  );
+  const bundleDir = import_node_path.default.join(readyRoot, artifactId);
+  const temporaryDir = import_node_path.default.join(
+    incomingRoot,
+    `${artifactId}.tmp-${(0, import_node_crypto.randomUUID)()}`
+  );
+  await import_promises.default.mkdir(temporaryDir, { recursive: true });
+  try {
+    await Promise.all([
+      import_promises.default.writeFile(
+        import_node_path.default.join(temporaryDir, RUNTIME_EVIDENCE_PAYLOAD_FILE),
+        payload,
+        "utf8"
+      ),
+      import_promises.default.writeFile(
+        import_node_path.default.join(temporaryDir, RUNTIME_EVIDENCE_MANIFEST_FILE),
+        `${JSON.stringify(manifest, null, 2)}
+`,
+        "utf8"
+      )
+    ]);
+    await import_promises.default.writeFile(
+      import_node_path.default.join(temporaryDir, RUNTIME_EVIDENCE_COMPLETE_FILE),
+      `${artifactId}
+`,
+      "utf8"
+    );
+    await import_promises.default.mkdir(readyRoot, { recursive: true });
+    try {
+      await import_promises.default.rename(temporaryDir, bundleDir);
+    } catch (error) {
+      if (!isExistingDestinationError(error)) {
+        throw error;
+      }
+      await import_promises.default.rm(temporaryDir, { recursive: true, force: true });
+    }
+  } catch (error) {
+    await import_promises.default.rm(temporaryDir, { recursive: true, force: true });
+    throw error;
+  }
+  return verifyRuntimeEvidenceBundle(bundleDir);
+};
+var verifyRuntimeEvidenceBundle = async (bundleDir) => {
+  const manifestPath = import_node_path.default.join(bundleDir, RUNTIME_EVIDENCE_MANIFEST_FILE);
+  const payloadPath = import_node_path.default.join(bundleDir, RUNTIME_EVIDENCE_PAYLOAD_FILE);
+  const completePath = import_node_path.default.join(bundleDir, RUNTIME_EVIDENCE_COMPLETE_FILE);
+  const [manifestText, payload, completeText] = await Promise.all([
+    import_promises.default.readFile(manifestPath, "utf8"),
+    import_promises.default.readFile(payloadPath),
+    import_promises.default.readFile(completePath, "utf8")
+  ]);
+  const manifest = parseManifest(JSON.parse(manifestText));
+  if (completeText.trim() !== manifest.artifactId) {
+    throw new Error(`Invalid completion marker in ${bundleDir}`);
+  }
+  if (payload.byteLength !== manifest.payload.bytes) {
+    throw new Error(`Runtime evidence size mismatch in ${bundleDir}`);
+  }
+  if (sha256(payload) !== manifest.payload.sha256) {
+    throw new Error(`Runtime evidence checksum mismatch in ${bundleDir}`);
+  }
+  const artifact = asRecord(JSON.parse(payload.toString("utf8")));
+  const artifactWindow = asRecord(artifact?.window);
+  if (artifact?.reportType !== "runtime-evidence" || artifactWindow?.startTime !== manifest.window.startTime || artifactWindow.endTime !== manifest.window.endTime) {
+    throw new Error(`Runtime evidence payload mismatch in ${bundleDir}`);
+  }
+  return {
+    bundleDir,
+    manifestPath,
+    payloadPath,
+    manifest,
+    artifact
+  };
+};
+var discoverRuntimeEvidenceBundles = async (rootDir) => {
+  const bundles = [];
+  const visit = async (directory, depth) => {
+    if (depth > 8) return;
+    let entries;
+    try {
+      entries = await import_promises.default.readdir(directory, { withFileTypes: true });
+    } catch (error) {
+      if (error.code === "ENOENT") return;
+      throw error;
+    }
+    const names = new Set(entries.map((entry) => entry.name));
+    if (names.has(RUNTIME_EVIDENCE_MANIFEST_FILE) && names.has(RUNTIME_EVIDENCE_PAYLOAD_FILE) && names.has(RUNTIME_EVIDENCE_COMPLETE_FILE)) {
+      bundles.push(directory);
+      return;
+    }
+    await Promise.all(
+      entries.filter(
+        (entry) => entry.isDirectory() && !entry.name.startsWith(".") && !entry.name.includes(".tmp-")
+      ).map((entry) => visit(import_node_path.default.join(directory, entry.name), depth + 1))
+    );
+  };
+  await visit(rootDir, 0);
+  return bundles.sort();
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  RUNTIME_EVIDENCE_COMPLETE_FILE,
+  RUNTIME_EVIDENCE_MANIFEST_FILE,
+  RUNTIME_EVIDENCE_PAYLOAD_FILE,
+  discoverRuntimeEvidenceBundles,
+  publishRuntimeEvidenceBundle,
+  verifyRuntimeEvidenceBundle
+});

package/dist/lib/runtimeEvidenceSync.js

@@ -0,0 +1,308 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/lib/runtimeEvidenceSync.ts
+var runtimeEvidenceSync_exports = {};
+__export(runtimeEvidenceSync_exports, {
+  buildRuntimeEvidenceRsyncArgs: () => buildRuntimeEvidenceRsyncArgs,
+  listPendingRuntimeEvidenceBundles: () => listPendingRuntimeEvidenceBundles,
+  markRuntimeEvidenceBundleProcessed: () => markRuntimeEvidenceBundleProcessed,
+  syncRuntimeEvidenceBundles: () => syncRuntimeEvidenceBundles
+});
+module.exports = __toCommonJS(runtimeEvidenceSync_exports);
+var import_node_child_process = require("child_process");
+var import_promises2 = __toESM(require("fs/promises"));
+var import_node_path2 = __toESM(require("path"));
+var import_node_util = require("util");
+
+// src/lib/runtimeEvidenceArtifacts.ts
+var import_node_crypto = require("crypto");
+var import_promises = __toESM(require("fs/promises"));
+var import_node_path = __toESM(require("path"));
+var RUNTIME_EVIDENCE_MANIFEST_FILE = "manifest.json";
+var RUNTIME_EVIDENCE_PAYLOAD_FILE = "runtime-evidence.json";
+var RUNTIME_EVIDENCE_COMPLETE_FILE = ".complete";
+var asRecord = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;
+var sha256 = (value) => (0, import_node_crypto.createHash)("sha256").update(value).digest("hex");
+var assertFiniteTimestamp = (value, label) => {
+  if (typeof value !== "number" || !Number.isFinite(value)) {
+    throw new Error(`Invalid runtime evidence ${label}`);
+  }
+  return value;
+};
+var parseManifest = (value) => {
+  const manifest = asRecord(value);
+  const window = asRecord(manifest?.window);
+  const payload = asRecord(manifest?.payload);
+  const counts = asRecord(manifest?.counts);
+  if (manifest?.schemaVersion !== 1 || manifest.reportType !== "runtime-evidence" || typeof manifest.artifactId !== "string" || typeof manifest.deploymentId !== "string" || typeof manifest.userName !== "string" || typeof manifest.createdAt !== "number" || payload?.file !== RUNTIME_EVIDENCE_PAYLOAD_FILE || typeof payload.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(payload.sha256) || typeof payload.bytes !== "number" || !Array.isArray(manifest.lineageKeys)) {
+    throw new Error("Invalid runtime evidence manifest");
+  }
+  return {
+    schemaVersion: 1,
+    artifactId: manifest.artifactId,
+    reportType: "runtime-evidence",
+    deploymentId: manifest.deploymentId,
+    userName: manifest.userName,
+    createdAt: manifest.createdAt,
+    window: {
+      startTime: assertFiniteTimestamp(window?.startTime, "window.startTime"),
+      endTime: assertFiniteTimestamp(window?.endTime, "window.endTime")
+    },
+    payload: {
+      file: RUNTIME_EVIDENCE_PAYLOAD_FILE,
+      sha256: payload.sha256,
+      bytes: payload.bytes
+    },
+    counts: Object.fromEntries(
+      Object.entries(counts ?? {}).filter(
+        (entry) => typeof entry[1] === "number" && Number.isFinite(entry[1])
+      )
+    ),
+    lineageKeys: manifest.lineageKeys.filter(
+      (value2) => typeof value2 === "string" && value2.length > 0
+    )
+  };
+};
+var verifyRuntimeEvidenceBundle = async (bundleDir) => {
+  const manifestPath = import_node_path.default.join(bundleDir, RUNTIME_EVIDENCE_MANIFEST_FILE);
+  const payloadPath = import_node_path.default.join(bundleDir, RUNTIME_EVIDENCE_PAYLOAD_FILE);
+  const completePath = import_node_path.default.join(bundleDir, RUNTIME_EVIDENCE_COMPLETE_FILE);
+  const [manifestText, payload, completeText] = await Promise.all([
+    import_promises.default.readFile(manifestPath, "utf8"),
+    import_promises.default.readFile(payloadPath),
+    import_promises.default.readFile(completePath, "utf8")
+  ]);
+  const manifest = parseManifest(JSON.parse(manifestText));
+  if (completeText.trim() !== manifest.artifactId) {
+    throw new Error(`Invalid completion marker in ${bundleDir}`);
+  }
+  if (payload.byteLength !== manifest.payload.bytes) {
+    throw new Error(`Runtime evidence size mismatch in ${bundleDir}`);
+  }
+  if (sha256(payload) !== manifest.payload.sha256) {
+    throw new Error(`Runtime evidence checksum mismatch in ${bundleDir}`);
+  }
+  const artifact = asRecord(JSON.parse(payload.toString("utf8")));
+  const artifactWindow = asRecord(artifact?.window);
+  if (artifact?.reportType !== "runtime-evidence" || artifactWindow?.startTime !== manifest.window.startTime || artifactWindow.endTime !== manifest.window.endTime) {
+    throw new Error(`Runtime evidence payload mismatch in ${bundleDir}`);
+  }
+  return {
+    bundleDir,
+    manifestPath,
+    payloadPath,
+    manifest,
+    artifact
+  };
+};
+var discoverRuntimeEvidenceBundles = async (rootDir) => {
+  const bundles = [];
+  const visit = async (directory, depth) => {
+    if (depth > 8) return;
+    let entries;
+    try {
+      entries = await import_promises.default.readdir(directory, { withFileTypes: true });
+    } catch (error) {
+      if (error.code === "ENOENT") return;
+      throw error;
+    }
+    const names = new Set(entries.map((entry) => entry.name));
+    if (names.has(RUNTIME_EVIDENCE_MANIFEST_FILE) && names.has(RUNTIME_EVIDENCE_PAYLOAD_FILE) && names.has(RUNTIME_EVIDENCE_COMPLETE_FILE)) {
+      bundles.push(directory);
+      return;
+    }
+    await Promise.all(
+      entries.filter(
+        (entry) => entry.isDirectory() && !entry.name.startsWith(".") && !entry.name.includes(".tmp-")
+      ).map((entry) => visit(import_node_path.default.join(directory, entry.name), depth + 1))
+    );
+  };
+  await visit(rootDir, 0);
+  return bundles.sort();
+};
+
+// src/lib/runtimeEvidenceSync.ts
+var execFileAsync = (0, import_node_util.promisify)(import_node_child_process.execFile);
+var isExistingDestinationError = (error) => {
+  const code = error.code;
+  return code === "EEXIST" || code === "ENOTEMPTY";
+};
+var safeSegment = (value, fallback) => {
+  const normalized = value.trim().replace(/[^a-zA-Z0-9._-]+/g, "-");
+  return normalized && normalized !== "." && normalized !== ".." ? normalized : fallback;
+};
+var withTrailingSlash = (value) => value.endsWith("/") ? value : `${value}/`;
+var dateParts = (timestamp) => {
+  const date = new Date(timestamp);
+  return [
+    String(date.getUTCFullYear()),
+    String(date.getUTCMonth() + 1).padStart(2, "0"),
+    String(date.getUTCDate()).padStart(2, "0")
+  ];
+};
+var buildRuntimeEvidenceRsyncArgs = ({
+  source,
+  destination
+}) => [
+  "--recursive",
+  "--times",
+  "--partial",
+  "--partial-dir=.rsync-partial",
+  "--prune-empty-dirs",
+  withTrailingSlash(source),
+  withTrailingSlash(destination)
+];
+var receiptPath = (receiptsRoot, artifactId) => import_node_path2.default.join(receiptsRoot, `${safeSegment(artifactId, "artifact")}.json`);
+var listPendingRuntimeEvidenceBundles = async ({
+  evidenceRoot,
+  deploymentId
+}) => {
+  const safeDeploymentId = safeSegment(deploymentId, "production");
+  const artifactsRoot = import_node_path2.default.join(evidenceRoot, "artifacts", safeDeploymentId);
+  const receiptsRoot = import_node_path2.default.join(evidenceRoot, "receipts", safeDeploymentId);
+  const bundles = await discoverRuntimeEvidenceBundles(artifactsRoot);
+  const pending = [];
+  for (const bundleDir of bundles) {
+    const verified = await verifyRuntimeEvidenceBundle(bundleDir);
+    if (verified.manifest.deploymentId !== safeDeploymentId) continue;
+    try {
+      await import_promises2.default.access(receiptPath(receiptsRoot, verified.manifest.artifactId));
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+      pending.push(verified);
+    }
+  }
+  return pending.sort(
+    (left, right) => left.manifest.window.startTime - right.manifest.window.startTime || left.manifest.createdAt - right.manifest.createdAt
+  );
+};
+var markRuntimeEvidenceBundleProcessed = async ({
+  evidenceRoot,
+  deploymentId,
+  bundleDir,
+  scorecardPath
+}) => {
+  const safeDeploymentId = safeSegment(deploymentId, "production");
+  const verified = await verifyRuntimeEvidenceBundle(bundleDir);
+  if (verified.manifest.deploymentId !== safeDeploymentId) {
+    throw new Error(
+      `Artifact deployment mismatch: expected ${safeDeploymentId}, received ${verified.manifest.deploymentId}`
+    );
+  }
+  const receiptsRoot = import_node_path2.default.join(evidenceRoot, "receipts", safeDeploymentId);
+  const finalPath = receiptPath(receiptsRoot, verified.manifest.artifactId);
+  const temporaryPath = `${finalPath}.tmp-${process.pid}`;
+  const receipt = {
+    schemaVersion: 1,
+    artifactId: verified.manifest.artifactId,
+    payloadSha256: verified.manifest.payload.sha256,
+    processedAt: Date.now(),
+    scorecardPath: scorecardPath ?? null
+  };
+  await import_promises2.default.mkdir(receiptsRoot, { recursive: true });
+  await import_promises2.default.writeFile(
+    temporaryPath,
+    `${JSON.stringify(receipt, null, 2)}
+`,
+    "utf8"
+  );
+  await import_promises2.default.rename(temporaryPath, finalPath);
+  return finalPath;
+};
+var syncRuntimeEvidenceBundles = async ({
+  source,
+  evidenceRoot,
+  deploymentId,
+  runRsync = async (args) => {
+    const result = await execFileAsync("rsync", args, {
+      maxBuffer: 10 * 1024 * 1024
+    });
+    return { stdout: result.stdout, stderr: result.stderr };
+  }
+}) => {
+  const safeDeploymentId = safeSegment(deploymentId, "production");
+  const inboxRoot = import_node_path2.default.join(evidenceRoot, "inbox", safeDeploymentId);
+  const artifactsRoot = import_node_path2.default.join(evidenceRoot, "artifacts", safeDeploymentId);
+  await Promise.all([
+    import_promises2.default.mkdir(inboxRoot, { recursive: true }),
+    import_promises2.default.mkdir(artifactsRoot, { recursive: true })
+  ]);
+  const rsyncArgs = buildRuntimeEvidenceRsyncArgs({
+    source,
+    destination: inboxRoot
+  });
+  const transfer = await runRsync(rsyncArgs);
+  const discovered = await discoverRuntimeEvidenceBundles(inboxRoot);
+  const received = [];
+  for (const bundleDir of discovered) {
+    const verified = await verifyRuntimeEvidenceBundle(bundleDir);
+    if (verified.manifest.deploymentId !== safeDeploymentId) {
+      throw new Error(
+        `Artifact deployment mismatch: expected ${safeDeploymentId}, received ${verified.manifest.deploymentId}`
+      );
+    }
+    const destinationDir = import_node_path2.default.join(
+      artifactsRoot,
+      ...dateParts(verified.manifest.window.endTime),
+      safeSegment(verified.manifest.artifactId, "artifact")
+    );
+    await import_promises2.default.mkdir(import_node_path2.default.dirname(destinationDir), { recursive: true });
+    try {
+      await import_promises2.default.rename(bundleDir, destinationDir);
+    } catch (error) {
+      if (!isExistingDestinationError(error)) throw error;
+      const existing = await verifyRuntimeEvidenceBundle(destinationDir);
+      if (existing.manifest.payload.sha256 !== verified.manifest.payload.sha256) {
+        throw new Error(
+          `Conflicting runtime evidence artifact ${verified.manifest.artifactId}`
+        );
+      }
+      await import_promises2.default.rm(bundleDir, { recursive: true, force: true });
+    }
+    received.push(await verifyRuntimeEvidenceBundle(destinationDir));
+  }
+  return {
+    rsyncArgs,
+    stdout: String(transfer.stdout ?? ""),
+    stderr: String(transfer.stderr ?? ""),
+    received,
+    pending: await listPendingRuntimeEvidenceBundles({
+      evidenceRoot,
+      deploymentId: safeDeploymentId
+    })
+  };
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  buildRuntimeEvidenceRsyncArgs,
+  listPendingRuntimeEvidenceBundles,
+  markRuntimeEvidenceBundleProcessed,
+  syncRuntimeEvidenceBundles
+});

package/dist/lib/runtimeRedis.js

@@ -24,6 +24,7 @@ __export(runtimeRedis_exports, {
   isRuntimeStrategyEnabled: () => isRuntimeStrategyEnabled,
   isRuntimeTradeRecord: () => isRuntimeTradeRecord,
   loadRuntimeActiveTradeOrderIds: () => loadRuntimeActiveTradeOrderIds,
+  loadRuntimeClosedTrades: () => loadRuntimeClosedTrades,
   loadRuntimeStrategyConfigs: () => loadRuntimeStrategyConfigs,
   loadRuntimeStrategyNames: () => loadRuntimeStrategyNames,
   loadRuntimeTrades: () => loadRuntimeTrades,
@@ -132,6 +133,29 @@ var loadRuntimeTrades = async (userName, {
   const trades = await Promise.all(keys.map((key) => (0, import_redis.getData)(key, null)));
   return trades.filter(isRuntimeTradeRecord).filter(filterByWindow).sort((left, right) => left.entryTimestamp - right.entryTimestamp);
 };
+var loadRuntimeClosedTrades = async (userName, {
+  startTime,
+  endTime
+}) => {
+  const dayKeys = (0, import_time.getRuntimeStorageDayKeys)(startTime, endTime);
+  const trades = (await Promise.all(
+    dayKeys.map(
+      (dayKey) => (0, import_redis.getHashJsonValues)(
+        import_redis.redisKeys.runtimeClosedTradeBucket(userName, dayKey)
+      )
+    )
+  )).flat();
+  const deduped = /* @__PURE__ */ new Map();
+  for (const trade of trades) {
+    if (!isRuntimeTradeRecord(trade) || trade.status !== "closed" || !Number.isFinite(trade.exitTimestamp) || trade.exitTimestamp < startTime || trade.exitTimestamp >= endTime) {
+      continue;
+    }
+    deduped.set(trade.orderId, trade);
+  }
+  return [...deduped.values()].sort(
+    (left, right) => left.exitTimestamp - right.exitTimestamp
+  );
+};
 var loadRuntimeActiveTradeOrderIds = async (userName) => {
   const keys = await (0, import_redis.getKeys)(import_redis.redisKeys.runtimeActiveTrades(userName));
   const refs = await Promise.all(keys.map((key) => (0, import_redis.getData)(key, null)));
@@ -159,6 +183,7 @@ var loadStrategyResultSymbols = async ({
   isRuntimeStrategyEnabled,
   isRuntimeTradeRecord,
   loadRuntimeActiveTradeOrderIds,
+  loadRuntimeClosedTrades,
   loadRuntimeStrategyConfigs,
   loadRuntimeStrategyNames,
   loadRuntimeTrades,