@vigilbase/cli 0.1.3 → 0.2.0

package/dist/local/cloudflare-checkup/snapshot-file.js

@@ -0,0 +1,186 @@
+/**
+ * Snapshot files (spec §F7).
+ *
+ * Both modes write the bytes to a `wx` 0600 temp file in the same directory
+ * first, so `--out` never holds a partial snapshot. The default mode publishes
+ * it with `link(2)`, which never replaces an existing file (deviation from
+ * §F7's direct `open(path, 'wx')`; on filesystems without hard links it falls
+ * back to that, removing the file if the write fails). `--overwrite` renames
+ * the temp file over the target. `submit` uploads the exact bytes of the file
+ * the user inspected.
+ */
+import { createHash, randomBytes } from 'node:crypto';
+import { link, open, readFile, rename, rm, stat } from 'node:fs/promises';
+import { basename, dirname, join } from 'node:path';
+import { CloudflareCheckupSnapshotV1Schema, SNAPSHOT_LIMITS, SNAPSHOT_SCHEMA_VERSION, expandRuleRuns, snapshotIssueList, snapshotRejectReason, } from './contract.js';
+import { LocalCheckupError } from './errors.js';
+export function sha256Hex(bytes) {
+    return createHash('sha256').update(bytes).digest('hex');
+}
+/** `link(2)` errors from filesystems without hard links (FAT/exFAT, some SMB mounts). */
+const NO_HARD_LINK_CODES = new Set(['EPERM', 'ENOTSUP', 'EOPNOTSUPP', 'ENOSYS']);
+/** Create `path` exclusively (0600), write and fsync; a partially written file is removed. */
+async function writeExclusive(path, bytes) {
+    // no-dd-sa:javascript-node-security/detect-non-literal-fs-filename — the user's --out path; created exclusively, never followed.
+    const handle = await open(path, 'wx', 0o600);
+    try {
+        try {
+            await handle.writeFile(bytes);
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    catch (error) {
+        // This process created the file (`wx`), so removing it cannot touch anyone else's data.
+        await rm(path, { force: true }).catch(() => undefined);
+        throw error;
+    }
+}
+/** Give the complete temp file its final name without ever replacing an existing file. */
+async function publishExclusive(temp, path, bytes) {
+    try {
+        await link(temp, path);
+    }
+    catch (error) {
+        if (!NO_HARD_LINK_CODES.has(error.code ?? ''))
+            throw error;
+        await writeExclusive(path, bytes);
+    }
+}
+/** Write the snapshot; refuses an existing file unless `overwrite` (atomic rename). */
+export async function writeSnapshotFile(path, text, options) {
+    const bytes = Buffer.from(text, 'utf8');
+    if (options.overwrite) {
+        const existing = await stat(path).catch(() => null);
+        if (existing && !existing.isFile())
+            throw new Error('--out must name a regular file.');
+    }
+    const temp = join(dirname(path), `.${basename(path)}.${randomBytes(6).toString('hex')}.tmp`);
+    try {
+        await writeExclusive(temp, bytes);
+        if (options.overwrite)
+            await rename(temp, path);
+        else
+            await publishExclusive(temp, path, bytes);
+    }
+    catch (error) {
+        const code = error.code;
+        if (!options.overwrite && code === 'EEXIST') {
+            throw new LocalCheckupError('OUTPUT_EXISTS', 'The --out file already exists; it was not modified.');
+        }
+        throw new Error(`Could not write the snapshot file (${code ?? 'error'}).`);
+    }
+    finally {
+        // A no-op after rename; drops the temp name after link.
+        await rm(temp, { force: true }).catch(() => undefined);
+    }
+    return { bytes: bytes.byteLength, sha256: sha256Hex(bytes) };
+}
+/** Map a failed contract parse to the CLI error (no values, issue codes only). */
+export function snapshotParseError(issues) {
+    const reason = snapshotRejectReason(issues);
+    const codes = [...new Set(snapshotIssueList(issues).map((issue) => issue.code))].slice(0, 5).join(', ');
+    if (reason === 'secret_like_value') {
+        return new LocalCheckupError('SNAPSHOT_SECRET_LIKE_VALUE', 'The snapshot contains a value that looks like a credential, so it will not be written or uploaded.');
+    }
+    return new LocalCheckupError('SNAPSHOT_INVALID', `The snapshot does not match ${SNAPSHOT_SCHEMA_VERSION} (${codes || 'invalid'}).`);
+}
+/** Read, hash and validate a snapshot file against the vendored contract. */
+export async function loadSnapshotFile(path) {
+    const info = await stat(path).catch(() => null);
+    if (!info || !info.isFile())
+        throw new LocalCheckupError('SNAPSHOT_INVALID', 'The snapshot file does not exist or is not a regular file.');
+    if (info.size > SNAPSHOT_LIMITS.maxBytes) {
+        throw new LocalCheckupError('SNAPSHOT_TOO_LARGE', `The snapshot is larger than the ${SNAPSHOT_LIMITS.maxBytes / 1024 / 1024} MiB contract limit.`);
+    }
+    // no-dd-sa:javascript-node-security/detect-non-literal-fs-filename — the user's own snapshot path.
+    const bytes = await readFile(path);
+    if (bytes.byteLength > SNAPSHOT_LIMITS.maxBytes)
+        throw new LocalCheckupError('SNAPSHOT_TOO_LARGE', 'The snapshot is larger than the contract limit.');
+    let raw;
+    try {
+        raw = JSON.parse(bytes.toString('utf8'));
+    }
+    catch {
+        throw new LocalCheckupError('SNAPSHOT_INVALID', 'The snapshot file is not valid JSON.');
+    }
+    const parsed = CloudflareCheckupSnapshotV1Schema.safeParse(raw);
+    if (!parsed.success)
+        throw snapshotParseError(parsed.error.issues);
+    return { path, bytes, sha256: sha256Hex(bytes), snapshot: parsed.data };
+}
+export function countEntries(entries) {
+    const counts = { total: entries.length, ok: 0, httpError: 0, notCollected: 0, collectionFailed: 0 };
+    for (const entry of entries) {
+        const result = entry.result;
+        if (result.ok)
+            counts.ok++;
+        else if (result.reason === 'http_error')
+            counts.httpError++;
+        else if (result.reason === 'not_collected')
+            counts.notCollected++;
+        else
+            counts.collectionFailed++;
+    }
+    return counts;
+}
+export function countEntriesByKind(entries) {
+    const byKind = {};
+    for (const entry of entries) {
+        byKind[entry.kind] ??= { total: 0, ok: 0, httpError: 0, notCollected: 0, collectionFailed: 0 };
+        const counts = byKind[entry.kind];
+        const result = entry.result;
+        counts.total++;
+        if (result.ok)
+            counts.ok++;
+        else if (result.reason === 'http_error')
+            counts.httpError++;
+        else if (result.reason === 'not_collected')
+            counts.notCollected++;
+        else
+            counts.collectionFailed++;
+    }
+    return byKind;
+}
+export function dataCategories(snapshot) {
+    const categories = { memberEmails: 0, accessRuleValues: 0, dnsHostnames: 0, pseudonymizedIps: 0, ruleDescriptions: 0 };
+    const ips = new Set();
+    for (const entry of snapshot.entries) {
+        if (!entry.result.ok)
+            continue;
+        switch (entry.kind) {
+            case 'account_members':
+                categories.memberEmails += entry.result.data.filter((member) => member.email !== undefined).length;
+                break;
+            case 'account_access_rules':
+            case 'zone_access_rules':
+                categories.accessRuleValues += entry.result.data.filter((rule) => rule.configuration?.value !== undefined).length;
+                break;
+            case 'zone_dns_records':
+                for (const record of entry.result.data) {
+                    if (record.name !== undefined)
+                        categories.dnsHostnames++;
+                    ips.add(record.content);
+                }
+                break;
+            default:
+                break;
+        }
+    }
+    categories.pseudonymizedIps = ips.size;
+    for (const runs of Object.values(snapshot.ruleBodies)) {
+        categories.ruleDescriptions += expandRuleRuns(runs).filter((rule) => rule.description !== undefined || rule.ref !== undefined).length;
+    }
+    return categories;
+}
+export function zoneCount(snapshot) {
+    const zones = snapshot.entries.find((entry) => entry.kind === 'zones');
+    return zones && zones.kind === 'zones' ? zones.result.data.length : 0;
+}
+export function accountName(snapshot) {
+    const account = snapshot.entries.find((entry) => entry.kind === 'account');
+    return account && account.kind === 'account' && account.result.ok ? account.result.data.name : null;
+}
+//# sourceMappingURL=snapshot-file.js.map

package/dist/local/cloudflare-checkup/snapshot-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshot-file.js","sourceRoot":"","sources":["../../../src/local/cloudflare-checkup/snapshot-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AACzE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACnD,OAAO,EACL,iCAAiC,EACjC,eAAe,EACf,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,oBAAoB,GAGrB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAE/C,MAAM,UAAU,SAAS,CAAC,KAA0B;IAClD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACzD,CAAC;AAED,yFAAyF;AACzF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAA;AAEhF,8FAA8F;AAC9F,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,KAAa;IACvD,iIAAiI;IACjI,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;IAC5C,IAAI,CAAC;QACH,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;YAC7B,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;QACrB,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;QACtB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,wFAAwF;QACxF,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACtD,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED,0FAA0F;AAC1F,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,IAAY,EAAE,KAAa;IACvE,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAE,KAA+B,CAAC,IAAI,IAAI,EAAE,CAAC;YAAE,MAAM,KAAK,CAAA;QACrF,MAAM,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACnC,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAY,EAAE,IAAY,EAAE,OAA+B;IACjG,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACvC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QACnD,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;IACxF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAC5F,IAAI,CAAC;QACH,MAAM,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACjC,IAAI,OAAO,CAAC,SAAS;YAAE,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;;YAC1C,MAAM,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAA;QAClD,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,IAAI,iBAAiB,CAAC,eAAe,EAAE,qDAAqD,CAAC,CAAA;QACrG,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,IAAI,OAAO,IAAI,CAAC,CAAA;IAC5E,CAAC;YAAS,CAAC;QACT,wDAAwD;QACxD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IACxD,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAA;AAC9D,CAAC;AASD,kFAAkF;AAClF,MAAM,UAAU,kBAAkB,CAAC,MAA+G;IAChJ,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAA;IAC3C,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACvG,IAAI,MAAM,KAAK,mBAAmB,EAAE,CAAC;QACnC,OAAO,IAAI,iBAAiB,CAAC,4BAA4B,EAAE,oGAAoG,CAAC,CAAA;IAClK,CAAC;IACD,OAAO,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,+BAA+B,uBAAuB,KAAK,KAAK,IAAI,SAAS,IAAI,CAAC,CAAA;AACrI,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY;IACjD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IAC/C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,4DAA4D,CAAC,CAAA;IAC1I,IAAI,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,QAAQ,EAAE,CAAC;QACzC,MAAM,IAAI,iBAAiB,CAAC,oBAAoB,EAAE,mCAAmC,eAAe,CAAC,QAAQ,GAAG,IAAI,GAAG,IAAI,sBAAsB,CAAC,CAAA;IACpJ,CAAC;IACD,mGAAmG;IACnG,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAA;IAClC,IAAI,KAAK,CAAC,UAAU,GAAG,eAAe,CAAC,QAAQ;QAAE,MAAM,IAAI,iBAAiB,CAAC,oBAAoB,EAAE,iDAAiD,CAAC,CAAA;IACrJ,IAAI,GAAY,CAAA;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,sCAAsC,CAAC,CAAA;IACzF,CAAC;IACD,MAAM,MAAM,GAAG,iCAAiC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;IAC/D,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAClE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAA;AACzE,CAAC;AAID,MAAM,UAAU,YAAY,CAAC,OAAiC;IAC5D,MAAM,MAAM,GAAgB,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAA;IAChH,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,MAA0C,CAAA;QAC/D,IAAI,MAAM,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,EAAE,CAAA;aACrB,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY;YAAE,MAAM,CAAC,SAAS,EAAE,CAAA;aACtD,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe;YAAE,MAAM,CAAC,YAAY,EAAE,CAAA;;YAC5D,MAAM,CAAC,gBAAgB,EAAE,CAAA;IAChC,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAID,MAAM,UAAU,kBAAkB,CAAC,OAAiC;IAClE,MAAM,MAAM,GAAoB,EAAE,CAAA;IAClC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAA;QAC9F,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAE,CAAA;QAClC,MAAM,MAAM,GAAG,KAAK,CAAC,MAA0C,CAAA;QAC/D,MAAM,CAAC,KAAK,EAAE,CAAA;QACd,IAAI,MAAM,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,EAAE,CAAA;aACrB,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY;YAAE,MAAM,CAAC,SAAS,EAAE,CAAA;aACtD,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe;YAAE,MAAM,CAAC,YAAY,EAAE,CAAA;;YAC5D,MAAM,CAAC,gBAAgB,EAAE,CAAA;IAChC,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAWD,MAAM,UAAU,cAAc,CAAC,QAAqC;IAClE,MAAM,UAAU,GAAmB,EAAE,YAAY,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAA;IACtI,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAA;IAC7B,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;YAAE,SAAQ;QAC9B,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,KAAK,iBAAiB;gBACpB,UAAU,CAAC,YAAY,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,MAAM,CAAA;gBAClG,MAAK;YACP,KAAK,sBAAsB,CAAC;YAC5B,KAAK,mBAAmB;gBACtB,UAAU,CAAC,gBAAgB,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,MAAM,CAAA;gBACjH,MAAK;YACP,KAAK,kBAAkB;gBACrB,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;oBACvC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;wBAAE,UAAU,CAAC,YAAY,EAAE,CAAA;oBACxD,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;gBACzB,CAAC;gBACD,MAAK;YACP;gBACE,MAAK;QACT,CAAC;IACH,CAAC;IACD,UAAU,CAAC,gBAAgB,GAAG,GAAG,CAAC,IAAI,CAAA;IACtC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACtD,UAAU,CAAC,gBAAgB,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,MAAM,CAAA;IACvI,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,QAAqC;IAC7D,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAA;IACtE,OAAO,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;AACvE,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAAqC;IAC/D,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAA;IAC1E,OAAO,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;AACrG,CAAC"}

package/dist/local/cloudflare-checkup/submit-client.d.ts

@@ -0,0 +1,98 @@
+import { type LocalRequestBody, type LocalRequestResponse, type LocalSessionResponse, type LocalVerifyBody, type LocalVerifyResponse } from './contract.js';
+/**
+ * `GET local-session`. The account is chosen in the CLI and bound by the
+ * uploaded snapshot, so `accountId` is `null` until then; runs created before
+ * that change still carry their bound account.
+ */
+export type LocalSession = LocalSessionResponse['session'];
+/** `POST local-session/request`: the token naming the run that awaits its emailed code. */
+export type PendingVerification = LocalRequestResponse['verification'];
+/** `POST local-session/verify`: the session code for the upload (kept in memory only). */
+export type VerifiedSession = LocalVerifyResponse['session'];
+export declare const GET_TIMEOUT_MS = 30000;
+export declare const POST_TIMEOUT_MS = 120000;
+export declare const MAX_SUBMIT_RESPONSE_BYTES: number;
+export declare const POST_RETRY_DELAYS_MS: readonly [2000, 5000];
+/** A verify that failed on the network or with a 503 is sent once more, after this pause. */
+export declare const VERIFY_RETRY_DELAYS_MS: readonly [2000];
+/**
+ * The submit origin. Only `https://vigilbase.com` and loopback origins are
+ * accepted; there is no `*.vigilbase.com` wildcard (other subdomains are
+ * different services). Environment variables are never consulted.
+ */
+export declare function resolveSubmitOrigin(explicit: string | undefined): string;
+export type LocalClientOptions = {
+    origin: string;
+    cliVersion: string;
+    userAgent: string;
+    /** Overrides every request timeout (`--timeout`). */
+    timeoutMs?: number;
+    sleep?: (ms: number) => Promise<void>;
+    /** Injectable for tests; the global `fetch` (looked up per request) otherwise. */
+    fetch?: typeof fetch;
+};
+export type SubmitClientOptions = LocalClientOptions & {
+    code: string;
+};
+/**
+ * The results page from an upload response, as printable ASCII (`URL.href`
+ * percent-encodes everything else), or undefined when it is not a plain
+ * http(s) URL. The caller decides whether to open it (same origin only).
+ */
+export declare function trustedResultsUrl(raw: string | undefined): string | undefined;
+/** Shared transport: CLI headers, no redirects, bounded responses, CLI-authored network errors. */
+declare abstract class LocalHttpClient {
+    protected readonly options: LocalClientOptions;
+    constructor(options: LocalClientOptions);
+    protected sleep(ms: number): Promise<void>;
+    protected headers(extra?: Record<string, string>): Record<string, string>;
+    protected request(path: string, init: RequestInit, timeoutMs: number): Promise<{
+        response: Response;
+        text: string;
+    }>;
+}
+/**
+ * Email verification without a bearer. A code request is never retried: a
+ * repeated request would send a second email. A verify that failed on the
+ * network (or timed out) or with a 503 is sent once more, after 2 s, with the
+ * same token and code: One counts only wrong codes, and the right code
+ * verified again mints the next session code, as a renewal does. Only when
+ * the lost answer was to a wrong code does the retry cost a second try.
+ */
+export declare class VerificationClient extends LocalHttpClient {
+    private postJson;
+    /** `POST local-session/request`: vigilbase.com emails a 6-digit code and returns the token for it. */
+    requestCode(body: LocalRequestBody): Promise<PendingVerification>;
+    /** `POST local-session/verify`: trades the token and the emailed code for a session code (the next one on every call). */
+    verifyCode(body: LocalVerifyBody): Promise<VerifiedSession>;
+}
+export type UploadResult = {
+    replayed: boolean;
+    snapshotSha256: string;
+    provenance: Record<string, unknown>;
+    report: Record<string, unknown>;
+    /** The results page, when vigilbase.com returned one (see `trustedResultsUrl`). */
+    resultsUrl?: string;
+};
+export declare class SubmitClient extends LocalHttpClient {
+    private readonly code;
+    constructor(options: SubmitClientOptions);
+    private bearer;
+    /** `GET local-session`: the bound account (or null), masked requester, expiry and accepted limits. */
+    getSession(): Promise<LocalSession>;
+    /**
+     * `POST local-session/snapshot` with the exact file bytes. 503 and network
+     * errors are retried twice (after 2 s, then 5 s) with the same bytes, which
+     * the server treats idempotently. Challenges are never retried.
+     */
+    postSnapshot(bytes: Buffer, sha256: string): Promise<UploadResult>;
+}
+/** Refuse a server that requires a newer CLI, or does not accept this schema version. */
+export declare function assertSessionAccepts(session: LocalSession, cliVersion: string, schemaVersion: string): void;
+/**
+ * The masked address as the server masks it (first character, `***`, the
+ * domain); any other text from the server is replaced by `fallback`.
+ */
+export declare function displayRequester(requester: string, fallback?: string): string;
+export {};
+//# sourceMappingURL=submit-client.d.ts.map

package/dist/local/cloudflare-checkup/submit-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"submit-client.d.ts","sourceRoot":"","sources":["../../../src/local/cloudflare-checkup/submit-client.ts"],"names":[],"mappings":"AAgBA,OAAO,EAkBL,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACzB,MAAM,eAAe,CAAA;AAItB;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAA;AAC1D,2FAA2F;AAC3F,MAAM,MAAM,mBAAmB,GAAG,oBAAoB,CAAC,cAAc,CAAC,CAAA;AACtE,0FAA0F;AAC1F,MAAM,MAAM,eAAe,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAA;AAE5D,eAAO,MAAM,cAAc,QAAS,CAAA;AACpC,eAAO,MAAM,eAAe,SAAU,CAAA;AACtC,eAAO,MAAM,yBAAyB,QAAc,CAAA;AACpD,eAAO,MAAM,oBAAoB,uBAA0B,CAAA;AAC3D,6FAA6F;AAC7F,eAAO,MAAM,sBAAsB,iBAAmB,CAAA;AAMtD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAaxE;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC,kFAAkF;IAClF,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG,kBAAkB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AA+HvE;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAU7E;AAED,mGAAmG;AACnG,uBAAe,eAAe;IAChB,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,kBAAkB;gBAA3B,OAAO,EAAE,kBAAkB;IAE1D,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1C,SAAS,CAAC,OAAO,CAAC,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;cAS7D,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CA6B3H;AAED;;;;;;;GAOG;AACH,qBAAa,kBAAmB,SAAQ,eAAe;YACvC,QAAQ;IAUtB,sGAAsG;IAChG,WAAW,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAQvE,0HAA0H;IACpH,UAAU,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;CAalE;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,EAAE,OAAO,CAAA;IACjB,cAAc,EAAE,MAAM,CAAA;IACtB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACnC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/B,mFAAmF;IACnF,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,CAAA;AAED,qBAAa,YAAa,SAAQ,eAAe;IAC/C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAQ;gBAEjB,OAAO,EAAE,mBAAmB;IAOxC,OAAO,CAAC,MAAM;IAId,sGAAsG;IAChG,UAAU,IAAI,OAAO,CAAC,YAAY,CAAC;IAMzC;;;;OAIG;IACG,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;CAsCzE;AAED,yFAAyF;AACzF,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,CAI3G;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,SAAuB,GAAG,MAAM,CAE3F"}

package/dist/local/cloudflare-checkup/submit-client.js

@@ -0,0 +1,349 @@
+import { NetworkError, readBoundedBody } from '../../lib/network.js';
+import { CLI_VERSION_HEADER, LOCAL_REQUEST_PATH, LOCAL_SESSION_PATH, LOCAL_SNAPSHOT_PATH, LOCAL_VERIFY_PATH, LocalErrorResponseSchema, LocalRequestBodySchema, LocalRequestResponseSchema, LocalSessionResponseSchema, LocalSnapshotResponseSchema, LocalVerifyBodySchema, LocalVerifyResponseSchema, PRODUCTION_ORIGIN, SESSION_CODE_REGEX, SNAPSHOT_SHA256_HEADER, compareSemver, } from './contract.js';
+import { LocalCheckupError } from './errors.js';
+import { formatDuration } from './output.js';
+export const GET_TIMEOUT_MS = 30_000;
+export const POST_TIMEOUT_MS = 120_000;
+export const MAX_SUBMIT_RESPONSE_BYTES = 1024 * 1024;
+export const POST_RETRY_DELAYS_MS = [2_000, 5_000];
+/** A verify that failed on the network or with a 503 is sent once more, after this pause. */
+export const VERIFY_RETRY_DELAYS_MS = [2_000];
+function isLoopbackHost(hostname) {
+    return hostname === 'localhost' || hostname === '[::1]' || /^127\.(?:\d{1,3}\.){2}\d{1,3}$/.test(hostname);
+}
+/**
+ * The submit origin. Only `https://vigilbase.com` and loopback origins are
+ * accepted; there is no `*.vigilbase.com` wildcard (other subdomains are
+ * different services). Environment variables are never consulted.
+ */
+export function resolveSubmitOrigin(explicit) {
+    if (explicit === undefined)
+        return PRODUCTION_ORIGIN;
+    let url;
+    try {
+        url = new URL(explicit.trim());
+    }
+    catch {
+        throw new LocalCheckupError('SUBMIT_ORIGIN_UNTRUSTED', '--base-url is not a valid origin.');
+    }
+    const originOnly = !url.username && !url.password && /^\/*$/.test(url.pathname) && !url.search && !url.hash;
+    if (originOnly && url.origin === PRODUCTION_ORIGIN)
+        return PRODUCTION_ORIGIN;
+    if (originOnly && (url.protocol === 'http:' || url.protocol === 'https:') && isLoopbackHost(url.hostname))
+        return url.origin;
+    // Do not echo the value: it may contain credentials.
+    throw new LocalCheckupError('SUBMIT_ORIGIN_UNTRUSTED', 'Local checkups submit only to https://vigilbase.com or a loopback origin.');
+}
+const REASON_CODES = {
+    session_invalid: 'SESSION_INVALID',
+    session_expired: 'SESSION_EXPIRED',
+    session_used: 'SESSION_USED',
+    session_busy: 'SESSION_BUSY',
+    session_not_ready: 'SESSION_INVALID',
+    run_closed: 'SESSION_CLOSED',
+    browser_origin: 'SUBMIT_FAILED',
+    malformed_json: 'SUBMIT_FAILED',
+    digest_mismatch: 'SUBMIT_FAILED',
+    unsupported_media_type: 'SUBMIT_FAILED',
+    length_required: 'SUBMIT_FAILED',
+    snapshot_too_large: 'SNAPSHOT_TOO_LARGE',
+    snapshot_invalid: 'SNAPSHOT_INVALID',
+    snapshot_incomplete: 'SNAPSHOT_INVALID',
+    account_mismatch: 'ACCOUNT_MISMATCH',
+    snapshot_stale: 'SNAPSHOT_STALE',
+    collector_unsupported: 'CLI_UPGRADE_REQUIRED',
+    secret_like_value: 'SNAPSHOT_SECRET_LIKE_VALUE',
+    evaluation_failed: 'SUBMIT_FAILED',
+    rate_limited: 'VIGILBASE_RATE_LIMITED',
+    local_mode_disabled: 'LOCAL_MODE_DISABLED',
+    storage_unavailable: 'SUBMIT_FAILED',
+    request_invalid: 'SUBMIT_FAILED',
+    email_invalid: 'EMAIL_INVALID',
+    code_invalid: 'EMAIL_CODE_INVALID',
+    verification_invalid: 'VERIFICATION_INVALID',
+    verification_expired: 'VERIFICATION_EXPIRED',
+};
+const REASON_MESSAGES = {
+    session_invalid: 'The checkup session is not valid (revoked or for another checkup).',
+    session_expired: 'The checkup session has expired.',
+    session_used: 'This checkup already has results from a different snapshot.',
+    session_busy: 'A different snapshot is already being processed for this checkup.',
+    session_not_ready: 'This checkup is not ready for an upload yet; its email is not verified.',
+    run_closed: 'This checkup was cancelled or has expired.',
+    browser_origin: 'vigilbase.com refused the request as a browser request.',
+    malformed_json: 'vigilbase.com could not read the uploaded file as JSON.',
+    digest_mismatch: 'The upload was corrupted in transit (SHA-256 mismatch).',
+    unsupported_media_type: 'vigilbase.com rejected the upload content type.',
+    length_required: 'vigilbase.com required a Content-Length for the upload.',
+    snapshot_too_large: 'The snapshot is larger than vigilbase.com accepts.',
+    snapshot_invalid: 'vigilbase.com rejected the snapshot as invalid.',
+    snapshot_incomplete: 'vigilbase.com rejected the snapshot as incomplete (missing or extra reads).',
+    account_mismatch: 'The snapshot is for a different Cloudflare account than this checkup.',
+    snapshot_stale: 'The snapshot is older than 24 hours (or dated in the future).',
+    collector_unsupported: 'vigilbase.com no longer accepts snapshots from this CLI or cf version.',
+    secret_like_value: 'vigilbase.com found a value that looks like a credential in the snapshot.',
+    evaluation_failed: 'vigilbase.com could not evaluate the snapshot; the checkup is unchanged.',
+    rate_limited: 'vigilbase.com rate-limited the upload.',
+    local_mode_disabled: 'Local checkups are currently disabled on vigilbase.com.',
+    storage_unavailable: 'vigilbase.com storage is temporarily unavailable.',
+    request_invalid: 'vigilbase.com could not read the verification request.',
+    email_invalid: 'vigilbase.com accepts work email addresses only (not personal or disposable ones).',
+    code_invalid: 'That code is not correct.',
+    verification_invalid: 'The email verification is not valid.',
+    verification_expired: 'The email verification has expired (the code timed out, was tried too often, or the checkup closed).',
+};
+const RATE_LIMITED_MESSAGES = {
+    verification: 'vigilbase.com rate-limited verification codes for now.',
+    session: REASON_MESSAGES.rate_limited,
+};
+function retryAfter(response, body) {
+    if (body?.retryAfterSec !== undefined)
+        return body.retryAfterSec;
+    const header = response.headers.get('retry-after');
+    if (header && /^\d{1,6}$/.test(header.trim()))
+        return Number(header.trim());
+    return undefined;
+}
+function isChallenge(response) {
+    if ((response.headers.get('cf-mitigated') ?? '').toLowerCase().includes('challenge'))
+        return true;
+    const type = (response.headers.get('content-type') ?? '').toLowerCase();
+    return (response.status === 403 || response.status === 503) && type.includes('text/html');
+}
+/** Map a non-2xx response to a CLI error; never echoes server text. */
+function responseError(response, text, endpoint) {
+    if (isChallenge(response)) {
+        return new LocalCheckupError('VIGILBASE_CHALLENGED', 'vigilbase.com answered with a bot or WAF challenge instead of the API.', { status: response.status });
+    }
+    let body = null;
+    try {
+        const parsed = LocalErrorResponseSchema.safeParse(JSON.parse(text));
+        if (parsed.success)
+            body = parsed.data;
+    }
+    catch {
+        body = null;
+    }
+    const status = response.status;
+    const after = retryAfter(response, body);
+    const timing = after !== undefined ? { retryAfterSec: after } : {};
+    const reason = body?.reason;
+    if (status === 429 || reason === 'rate_limited') {
+        const wait = after !== undefined ? ` Try again in ${formatDuration(after)}.` : '';
+        return new LocalCheckupError('VIGILBASE_RATE_LIMITED', `${RATE_LIMITED_MESSAGES[endpoint]}${wait}`, { status, ...timing });
+    }
+    if (reason)
+        return new LocalCheckupError(REASON_CODES[reason], REASON_MESSAGES[reason], { status, ...timing });
+    const fallback = status === 401 ? (endpoint === 'verification' ? 'VERIFICATION_INVALID' : 'SESSION_INVALID')
+        : status === 410 ? (endpoint === 'verification' ? 'VERIFICATION_EXPIRED' : 'SESSION_CLOSED')
+            : status === 413 ? 'SNAPSHOT_TOO_LARGE' : 'SUBMIT_FAILED';
+    return new LocalCheckupError(fallback, `vigilbase.com rejected the request (HTTP ${status}).`, { status });
+}
+/** No answer (a network error or a timeout), or vigilbase.com storage briefly unavailable (503); never a challenge or the kill switch. */
+function isTransientFailure(error) {
+    return error instanceof LocalCheckupError && error.code === 'SUBMIT_FAILED' && (error.status === 0 || error.status === 503);
+}
+/** A successful JSON body validated against `schema`, or SUBMIT_FAILED naming what was expected. */
+function parseSuccess(schema, response, text, what) {
+    let parsed;
+    try {
+        parsed = schema.safeParse(JSON.parse(text));
+    }
+    catch {
+        parsed = null;
+    }
+    if (!parsed?.success)
+        throw new LocalCheckupError('SUBMIT_FAILED', `vigilbase.com returned an unexpected ${what} response.`, { status: response.status });
+    return parsed.data;
+}
+/**
+ * The results page from an upload response, as printable ASCII (`URL.href`
+ * percent-encodes everything else), or undefined when it is not a plain
+ * http(s) URL. The caller decides whether to open it (same origin only).
+ */
+export function trustedResultsUrl(raw) {
+    if (raw === undefined)
+        return undefined;
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return undefined;
+    }
+    if ((url.protocol !== 'https:' && url.protocol !== 'http:') || url.username || url.password)
+        return undefined;
+    return /^[\x21-\x7e]{1,2048}$/.test(url.href) ? url.href : undefined;
+}
+/** Shared transport: CLI headers, no redirects, bounded responses, CLI-authored network errors. */
+class LocalHttpClient {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    sleep(ms) {
+        return this.options.sleep ? this.options.sleep(ms) : new Promise((resolve) => setTimeout(resolve, ms));
+    }
+    headers(extra = {}) {
+        return {
+            Accept: 'application/json',
+            'User-Agent': this.options.userAgent,
+            [CLI_VERSION_HEADER]: this.options.cliVersion,
+            ...extra,
+        };
+    }
+    async request(path, init, timeoutMs) {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), timeoutMs);
+        const url = `${this.options.origin}${path}`;
+        const send = this.options.fetch ?? fetch;
+        try {
+            // Never follow redirects: credentials and bodies must reach only the checked origin.
+            // 'manual' surfaces the 3xx (Node returns its real status; browsers an
+            // opaque redirect) so it fails fast instead of looking like a network error.
+            const response = await send(url, { ...init, signal: controller.signal, redirect: 'manual' });
+            if (response.type === 'opaqueredirect' || (response.status >= 300 && response.status < 400)) {
+                await response.body?.cancel().catch(() => undefined);
+                throw new LocalCheckupError('SUBMIT_FAILED', `${this.options.origin} redirected the request (HTTP ${response.status || '3xx'}); the redirect was not followed and nothing was processed.`, { status: response.status || 302 });
+            }
+            return { response, text: await readBoundedBody(response, controller.signal, MAX_SUBMIT_RESPONSE_BYTES) };
+        }
+        catch (error) {
+            if (error instanceof LocalCheckupError)
+                throw error;
+            if (error instanceof NetworkError && error.code === 'RESPONSE_TOO_LARGE') {
+                throw new LocalCheckupError('SUBMIT_FAILED', 'vigilbase.com returned an unexpectedly large response.');
+            }
+            throw new LocalCheckupError('SUBMIT_FAILED', controller.signal.aborted
+                ? `The request to ${this.options.origin} timed out after ${timeoutMs}ms.`
+                : `Could not connect to ${this.options.origin}. Check your connection, VPN or proxy.`, { status: 0 });
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+}
+/**
+ * Email verification without a bearer. A code request is never retried: a
+ * repeated request would send a second email. A verify that failed on the
+ * network (or timed out) or with a 503 is sent once more, after 2 s, with the
+ * same token and code: One counts only wrong codes, and the right code
+ * verified again mints the next session code, as a renewal does. Only when
+ * the lost answer was to a wrong code does the retry cost a second try.
+ */
+export class VerificationClient extends LocalHttpClient {
+    async postJson(path, body) {
+        const result = await this.request(path, {
+            method: 'POST',
+            headers: this.headers({ 'Content-Type': 'application/json' }),
+            body: JSON.stringify(body),
+        }, this.options.timeoutMs ?? GET_TIMEOUT_MS);
+        if (!result.response.ok || isChallenge(result.response))
+            throw responseError(result.response, result.text, 'verification');
+        return result;
+    }
+    /** `POST local-session/request`: vigilbase.com emails a 6-digit code and returns the token for it. */
+    async requestCode(body) {
+        // The address is never echoed, even when it does not fit the contract.
+        const checked = LocalRequestBodySchema.safeParse(body);
+        if (!checked.success)
+            throw new LocalCheckupError('EMAIL_INVALID', 'That is not an email address vigilbase.com can send a code to.');
+        const { response, text } = await this.postJson(LOCAL_REQUEST_PATH, checked.data);
+        return parseSuccess(LocalRequestResponseSchema, response, text, 'verification').verification;
+    }
+    /** `POST local-session/verify`: trades the token and the emailed code for a session code (the next one on every call). */
+    async verifyCode(body) {
+        const checked = LocalVerifyBodySchema.safeParse(body);
+        if (!checked.success)
+            throw new LocalCheckupError('EMAIL_CODE_INVALID', 'The code must be the 6 digits from the email.');
+        for (let attempt = 0;; attempt++) {
+            try {
+                const { response, text } = await this.postJson(LOCAL_VERIFY_PATH, checked.data);
+                return parseSuccess(LocalVerifyResponseSchema, response, text, 'verification').session;
+            }
+            catch (error) {
+                if (attempt >= VERIFY_RETRY_DELAYS_MS.length || !isTransientFailure(error))
+                    throw error;
+                await this.sleep(VERIFY_RETRY_DELAYS_MS[attempt]);
+            }
+        }
+    }
+}
+export class SubmitClient extends LocalHttpClient {
+    code;
+    constructor(options) {
+        const { code, ...rest } = options;
+        super(rest);
+        if (!SESSION_CODE_REGEX.test(code))
+            throw new LocalCheckupError('SESSION_INVALID', 'vigilbase.com returned a malformed checkup session.');
+        this.code = code;
+    }
+    bearer(extra = {}) {
+        return this.headers({ Authorization: `Bearer ${this.code}`, ...extra });
+    }
+    /** `GET local-session`: the bound account (or null), masked requester, expiry and accepted limits. */
+    async getSession() {
+        const { response, text } = await this.request(LOCAL_SESSION_PATH, { method: 'GET', headers: this.bearer() }, this.options.timeoutMs ?? GET_TIMEOUT_MS);
+        if (!response.ok || isChallenge(response))
+            throw responseError(response, text, 'session');
+        return parseSuccess(LocalSessionResponseSchema, response, text, 'session').session;
+    }
+    /**
+     * `POST local-session/snapshot` with the exact file bytes. 503 and network
+     * errors are retried twice (after 2 s, then 5 s) with the same bytes, which
+     * the server treats idempotently. Challenges are never retried.
+     */
+    async postSnapshot(bytes, sha256) {
+        for (let attempt = 0;; attempt++) {
+            let result;
+            try {
+                result = await this.request(LOCAL_SNAPSHOT_PATH, {
+                    method: 'POST',
+                    headers: this.bearer({ 'Content-Type': 'application/json', [SNAPSHOT_SHA256_HEADER]: sha256 }),
+                    body: new Uint8Array(bytes),
+                }, this.options.timeoutMs ?? POST_TIMEOUT_MS);
+            }
+            catch (error) {
+                if (error instanceof LocalCheckupError && error.status === 0 && attempt < POST_RETRY_DELAYS_MS.length) {
+                    await this.sleep(POST_RETRY_DELAYS_MS[attempt]);
+                    continue;
+                }
+                throw error;
+            }
+            const { response, text } = result;
+            if (response.ok && !isChallenge(response)) {
+                const parsed = parseSuccess(LocalSnapshotResponseSchema, response, text, 'upload');
+                if (parsed.snapshotSha256 !== sha256) {
+                    throw new LocalCheckupError('SUBMIT_FAILED', 'vigilbase.com acknowledged a different snapshot digest than the file uploaded.');
+                }
+                const report = { ...parsed.report };
+                // The report carries no run ID or share link; the results page arrives only as `resultsUrl`.
+                delete report.toolRunId;
+                delete report.shareableUrl;
+                delete report.shareUrl;
+                const resultsUrl = trustedResultsUrl(parsed.resultsUrl);
+                return { replayed: parsed.replayed, snapshotSha256: parsed.snapshotSha256, provenance: parsed.provenance, report, ...(resultsUrl ? { resultsUrl } : {}) };
+            }
+            const error = responseError(response, text, 'session');
+            if (response.status === 503 && error.code !== 'VIGILBASE_CHALLENGED' && error.code !== 'LOCAL_MODE_DISABLED' && attempt < POST_RETRY_DELAYS_MS.length) {
+                await this.sleep(POST_RETRY_DELAYS_MS[attempt]);
+                continue;
+            }
+            throw error;
+        }
+    }
+}
+/** Refuse a server that requires a newer CLI, or does not accept this schema version. */
+export function assertSessionAccepts(session, cliVersion, schemaVersion) {
+    if (!session.accepts.schemaVersions.includes(schemaVersion) || compareSemver(cliVersion, session.minCliVersion) < 0) {
+        throw new LocalCheckupError('CLI_UPGRADE_REQUIRED', `vigilbase.com requires @vigilbase/cli ${session.minCliVersion.slice(0, 40)} or newer for this snapshot.`);
+    }
+}
+/**
+ * The masked address as the server masks it (first character, `***`, the
+ * domain); any other text from the server is replaced by `fallback`.
+ */
+export function displayRequester(requester, fallback = 'your email address') {
+    return /^[^\s@\p{Cc}\p{Cf}]{1,4}\*{3}@[A-Za-z0-9.-]{1,253}$/u.test(requester) ? requester : fallback;
+}
+//# sourceMappingURL=submit-client.js.map