agenticreplay 0.1.0 → 0.1.2

package/node_modules/@agenticreplay/core/dist/private-files.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Keep a path to its owner — in the currency the filesystem actually has.
+ *
+ * `chmod(path, 0o600)` on Windows sets the read-only attribute and nothing else. The mode bits are
+ * a POSIX idea; what the file really gets is the ACL it inherits from wherever it was written, and
+ * under a workspace on `C:\` that is:
+ *
+ * ```
+ * NT AUTHORITY\Authenticated Users:(I)(M)   ← any authenticated account may rewrite it
+ * BUILTIN\Users:(I)(RX)                     ← any local account may read it
+ * ```
+ *
+ * For a trace that is bad. For the run CA's private key it is the whole point of the feature
+ * undone: that key signs the certificates the agent has been told to trust for the life of the
+ * run, so whoever reads it can impersonate every intercepted host to that agent, and whoever
+ * writes it can substitute a CA of their own. For `config.json` it is a gateway API key sitting
+ * in a file the machine can read.
+ *
+ * So on Windows the promise is kept with an ACL: everything already on it is taken away — the
+ * inherited entries and the explicit ones alike — and the only trustees left are the owner,
+ * SYSTEM and Administrators. That is the rule OpenSSH for Windows enforces on its
+ * own private keys, and it is the closest the platform comes to 0600 — under which root can still
+ * read the file too.
+ *
+ * Callers keep whatever error policy they had: this throws where `chmod` threw.
+ */
+export declare function restrictToOwner(path: string, mode: 0o600 | 0o700): Promise<void>;
+/** The entry itself, without following a junction; bigint preserves the complete NTFS file ID. */
+export interface PrivatePathIdentity {
+    dev: bigint;
+    ino: bigint;
+}
+export declare function privatePathIdentity(path: string): Promise<PrivatePathIdentity>;
+export declare function assertPrivatePathIdentity(path: string, was: PrivatePathIdentity): Promise<void>;
+/** Never recursively clean up a replacement belonging to somebody else. */
+export declare function removePrivateDirectory(path: string, was: PrivatePathIdentity): Promise<void>;
+//# sourceMappingURL=private-files.d.ts.map

package/node_modules/@agenticreplay/core/dist/private-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-files.d.ts","sourceRoot":"","sources":["../src/private-files.ts"],"names":[],"mappings":"AAUA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,GAAG,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAuDtF;AAED,kGAAkG;AAClG,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAKpF;AAED,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,2EAA2E;AAC3E,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,IAAI,CAAC,CAOf"}

package/node_modules/@agenticreplay/core/dist/private-files.js

@@ -0,0 +1,353 @@
+import { execFile } from 'node:child_process';
+import { randomBytes } from 'node:crypto';
+import { lstatSync, rmSync } from 'node:fs';
+import { chmod, lstat, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { isAbsolute, join } from 'node:path';
+import { promisify } from 'node:util';
+const run = promisify(execFile);
+/**
+ * Keep a path to its owner — in the currency the filesystem actually has.
+ *
+ * `chmod(path, 0o600)` on Windows sets the read-only attribute and nothing else. The mode bits are
+ * a POSIX idea; what the file really gets is the ACL it inherits from wherever it was written, and
+ * under a workspace on `C:\` that is:
+ *
+ * ```
+ * NT AUTHORITY\Authenticated Users:(I)(M)   ← any authenticated account may rewrite it
+ * BUILTIN\Users:(I)(RX)                     ← any local account may read it
+ * ```
+ *
+ * For a trace that is bad. For the run CA's private key it is the whole point of the feature
+ * undone: that key signs the certificates the agent has been told to trust for the life of the
+ * run, so whoever reads it can impersonate every intercepted host to that agent, and whoever
+ * writes it can substitute a CA of their own. For `config.json` it is a gateway API key sitting
+ * in a file the machine can read.
+ *
+ * So on Windows the promise is kept with an ACL: everything already on it is taken away — the
+ * inherited entries and the explicit ones alike — and the only trustees left are the owner,
+ * SYSTEM and Administrators. That is the rule OpenSSH for Windows enforces on its
+ * own private keys, and it is the closest the platform comes to 0600 — under which root can still
+ * read the file too.
+ *
+ * Callers keep whatever error policy they had: this throws where `chmod` threw.
+ */
+export async function restrictToOwner(path, mode) {
+    if (process.platform !== 'win32') {
+        await chmod(path, mode);
+        return;
+    }
+    const icacls = system32('icacls.exe');
+    const inherit = mode === 0o700 ? '(OI)(CI)' : '';
+    const was = await privatePathIdentity(path);
+    // Finish the ownership and descriptor lookups before changing permissions. A lookup failure
+    // leaves the original ACL intact; a verification failure below refuses to use the narrowed path.
+    const keep = [await currentAccountSid(), SYSTEM, ADMINISTRATORS];
+    const ours = await requireTrustedOwner(path, keep);
+    await assertPrivatePathIdentity(path, was);
+    const foreign = (await explicitTrustees(icacls, path)).filter((trustee) => !ours.has(trustee));
+    // One invocation, and every part of it narrows.
+    //
+    // `/inheritance:r` removes only the ACEs carrying the inherited flag, and `/grant:r` replaces
+    // previously granted explicit permissions *for the trustees it names* — so an explicit ACE for
+    // anybody else survives both, keeping its `(OI)(CI)` on a directory and passing itself to
+    // everything written afterwards. Measured: grant BUILTIN\Users explicitly, then restrict, and
+    // `(A;;FA;;;BU)` is still on the DACL. "Replace all child object permissions" turns inherited
+    // ACEs into explicit ones, and so do `robocopy /SEC` and a tree carried between machines, so
+    // this is an ordinary shape rather than an exotic one. Hence naming them for removal.
+    //
+    // `/reset` would be the obvious way to clear them and is the wrong one: it replaces the DACL
+    // with whatever the *parent* hands down, so between it and the grant the path holds the
+    // parent's ACL — and a parent is not something this function gets to assume anything about. On
+    // every Windows command the store root would spend that window readable by whoever the
+    // workspace allowed, and anything created inside it would keep that permanently, since icacls
+    // does not re-propagate to children later. Measured too, on a real store.
+    await run(icacls, [
+        path,
+        '/inheritance:r',
+        ...foreign.flatMap((trustee) => ['/remove', `*${trustee}`]),
+        '/grant:r',
+        ...grantsFor(keep, inherit),
+        '/q',
+    ]);
+    // And then read it back, because everything above rests on having understood a descriptor that
+    // this file's own parser has now been wrong about twice. The check is deliberately not that
+    // parser: it matches the whole descriptor, anchored, against the shape this function writes, so
+    // an ACE of a type nobody anticipated fails it rather than being skipped by it.
+    //
+    // Nothing is escaped into the pattern because nothing needs to be — a trustee here is a SID or
+    // one of SDDL's two-letter abbreviations, and both are `[A-Za-z0-9-]`.
+    const written = await descriptorOf(icacls, path);
+    if (!asWritten(ours).test(written)) {
+        throw new Error(`the ACL agenticreplay wrote to ${path} is not the one it asked for: ${JSON.stringify(written)}`);
+    }
+    await assertPrivatePathIdentity(path, was);
+}
+export async function privatePathIdentity(path) {
+    const entry = await lstat(path, { bigint: true });
+    if (entry.isSymbolicLink())
+        throw new Error(`${path} is a link, refusing to secure its target`);
+    if (entry.ino === 0n)
+        throw new Error(`${path} has no usable file identity`);
+    return { dev: entry.dev, ino: entry.ino };
+}
+export async function assertPrivatePathIdentity(path, was) {
+    const now = await privatePathIdentity(path);
+    if (now.dev !== was.dev || now.ino !== was.ino) {
+        throw new Error(`${path} was replaced while agenticreplay was securing it`);
+    }
+}
+/** Never recursively clean up a replacement belonging to somebody else. */
+export async function removePrivateDirectory(path, was) {
+    try {
+        await assertPrivatePathIdentity(path, was);
+        await rm(path, { recursive: true, force: true });
+    }
+    catch {
+        // A missing or substituted entry is no longer ours to remove.
+    }
+}
+/**
+ * A foreign owner retains WRITE_DAC even after its last ACE is removed. Read the actual owner,
+ * not the DACL's trustees. Windows PowerShell's .NET API works without Get-Acl/module autoload,
+ * elevation, or localized account names. The path is data in the child environment, never code.
+ */
+async function requireTrustedOwner(path, trusted) {
+    const script = `
+$ErrorActionPreference = 'Stop'
+$acl = [System.IO.File]::GetAccessControl($env:AGENTICREPLAY_PRIVATE_PATH, [System.Security.AccessControl.AccessControlSections]::Owner)
+$acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value
+$descriptor = [System.Security.AccessControl.RawSecurityDescriptor]::new('D:(A;;FA;;;' + $env:AGENTICREPLAY_PRIVATE_SID + ')')
+$descriptor.GetSddlForm([System.Security.AccessControl.AccessControlSections]::Access)
+`;
+    const { stdout } = await run(system32('WindowsPowerShell/v1.0/powershell.exe'), [
+        '-NoLogo',
+        '-NoProfile',
+        '-NonInteractive',
+        '-EncodedCommand',
+        Buffer.from(script, 'utf16le').toString('base64'),
+    ], {
+        env: {
+            ...process.env,
+            AGENTICREPLAY_PRIVATE_PATH: path,
+            AGENTICREPLAY_PRIVATE_SID: trusted[0],
+        },
+        windowsHide: true,
+    });
+    const [owner = '', accountDescriptor = ''] = stdout.trim().split(/\r?\n/);
+    if (!trusted.includes(owner)) {
+        throw new Error(`${path} has an untrusted owner (${owner}); refusing to store private data`);
+    }
+    // Windows may serialize the current account as an abbreviation, e.g. LA for the built-in
+    // Administrator. Ask Windows for this SID's spelling; accepting LA for every user would grant
+    // trust to a different account, and guessing from an RID alone would confuse local/domain SIDs.
+    const spelling = /^D:\(A;;FA;;;([A-Z]{2}|S-1-[\d-]+)\)$/.exec(accountDescriptor)?.[1];
+    if (!spelling)
+        throw new Error(`could not read the SDDL spelling of ${trusted[0]}`);
+    return new Set([...trusted, 'SY', 'BA', spelling]);
+}
+/**
+ * The grants a narrowing asks for, and the shape its result has to come back in.
+ *
+ * Shared by `restrictToOwner` and `aclScratch` because they are the same job and drifted apart
+ * once already: the second was written with `/inheritance:r` and `/grant:r` and neither the
+ * read-back nor the reasoning eighty lines above about why exiting 0 is not an answer.
+ *
+ * Nothing is escaped into the pattern because nothing needs to be — a trustee here is a SID or one
+ * of SDDL's two-letter abbreviations, and both are `[A-Za-z0-9-]`.
+ */
+function grantsFor(trustees, inherit) {
+    return trustees.map((sid) => `*${sid}:${inherit}(F)`);
+}
+function asWritten(trustees) {
+    return new RegExp('^D:[A-Z]*P[A-Z]*(?:\\(A;[A-Z]*;[^;]*;;;(?:' + [...trustees].join('|') + ')\\))+$');
+}
+/**
+ * Who a path grants or denies *explicitly*, in whatever spelling icacls itself uses.
+ *
+ * Explicit only, because the inherited ones are already `/inheritance:r`'s job — and naming one of
+ * those alongside it fails the whole invocation. A directory under `%TEMP%` here carries inherited
+ * ACEs for accounts that no longer exist, and `/remove` on such a SID after inheritance has been
+ * stripped cannot map it to a name: `icacls … /inheritance:r /remove *<orphan>` exits 1332 and
+ * applies nothing. Removing only what `/inheritance:r` will leave behind avoids that by being the
+ * more accurate thing to ask for.
+ *
+ * As SDDL, via `/save`, because the names `icacls <path>` prints are localized. Returned verbatim
+ * rather than expanded to SIDs: `/remove` accepts `*BU` as readily as `*S-1-5-32-545`, and a
+ * lookup table of well-known abbreviations would silently pass through any entry it had missed —
+ * which for this function means a trustee that keeps its access.
+ */
+async function explicitTrustees(icacls, path) {
+    const descriptor = await descriptorOf(icacls, path);
+    // (type;flags;rights;object_guid;inherit_object_guid;trustee[;condition]) — `ID` in the flags
+    // marks it inherited. The type is read as a field rather than as one character: `XA`/`XD` are
+    // conditional ACEs, `OA`/`OD` object ones, `AU`/`AL` audits, and a single-character type class
+    // matched none of them. The trustee stops at `;` as well as `)`, because a conditional ACE
+    // carries its expression after the trustee.
+    const aces = [...descriptor.matchAll(/\(([^;]*);([^;]*);[^;]*;[^;]*;[^;]*;([^;)]+)/g)];
+    return [...new Set(aces.filter((ace) => !ace[2].includes('ID')).map((ace) => ace[3]))];
+}
+/** The path's security descriptor, as SDDL. */
+async function descriptorOf(icacls, path) {
+    const saved = join(await aclScratch(icacls), randomBytes(8).toString('hex'));
+    try {
+        await run(icacls, [path, '/save', saved]);
+        return await readDescriptor(saved, path);
+    }
+    finally {
+        await rm(saved, { force: true }).catch(() => undefined);
+    }
+}
+/**
+ * The descriptor out of what `icacls /save` wrote.
+ *
+ * UTF-16LE, and the descriptor is the last line: two lines for an ordinary path — the entry's
+ * name, then its descriptor — and one for a path with no name to give, such as a drive root.
+ *
+ * By position rather than by scanning for a `D:` prefix. A name line cannot carry one today, since
+ * `/save` writes the basename and a Windows filename cannot contain a colon, but that is a fact
+ * about a neighbouring tool rather than about this parse.
+ */
+async function readDescriptor(saved, path) {
+    const lines = (await readFile(saved, 'utf16le'))
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter(Boolean);
+    const descriptor = lines.at(-1) ?? '';
+    // Refused rather than read as "nothing to remove", which is what an unrecognised line would
+    // silently mean: every foreign trustee left in place, and `icacls` still exiting 0.
+    if (!/^[OGDS]:/.test(descriptor) || !descriptor.includes('(')) {
+        throw new Error(`could not read the ACL of ${path}: ${JSON.stringify(descriptor.slice(0, 80))}`);
+    }
+    return descriptor;
+}
+let scratch;
+/**
+ * Somewhere private to write the descriptors this file reads back.
+ *
+ * `mkdtemp` discards its mode on Windows, so a scratch directory under `%TEMP%` takes whatever
+ * that hands down — measured here: two further local accounts, both with inheritable Modify. Every
+ * other temporary directory this feature mints is narrowed the moment it exists, and this one was
+ * not, which matters more rather than less: the file written into it is the *input to both halves
+ * of the only guard this function has* — the descriptor `explicitTrustees` decides the `/remove`
+ * list from, and the descriptor the read-back check compares against what was asked for.
+ * Substituting it hides a foreign trustee from the first and satisfies the second.
+ *
+ * Narrowed directly rather than through `restrictToOwner`, which reads a descriptor, which is read
+ * from here — that would recurse. `execFile` rejects on a non-zero exit, so a narrowing that did
+ * not apply is a throw rather than a descriptor read out of a directory anyone can write.
+ *
+ * One per process, with a random filename per call, so the cost is a single extra `icacls` for the
+ * life of the run rather than two on every path narrowed.
+ */
+async function aclScratch(icacls) {
+    scratch ??= (async () => {
+        const keep = [await currentAccountSid(), SYSTEM, ADMINISTRATORS];
+        const dir = await mkdtemp(join(tmpdir(), 'agenticreplay-acl-'));
+        let was;
+        try {
+            was = await privatePathIdentity(dir);
+            const ours = await requireTrustedOwner(dir, keep);
+            await assertPrivatePathIdentity(dir, was);
+            // `mkdtemp` just made this, so it carries no explicit ACE to remove — measured: five, every
+            // one flagged inherited — and it cannot be a link. What it *can* be is swapped, in the gap
+            // between that call and this one, by an account with Modify on `%TEMP%`, which is the ACL
+            // measured here. `icacls` does not follow a reparse point, so the narrowing would land on
+            // the junction while every descriptor this module reads came out of the other directory.
+            // So it is vouched for and re-checked either side, exactly as `ensureRunsDir` does it.
+            await run(icacls, [dir, '/inheritance:r', '/grant:r', ...grantsFor(keep, '(OI)(CI)'), '/q']);
+            await assertPrivatePathIdentity(dir, was);
+            // Keep the directory non-empty between descriptor reads, so an empty-directory removal
+            // cannot replace it after setup. Recheck after this write too. As SECURITY.md explains,
+            // this is not a defense against arbitrary replacement of writable ancestors.
+            await writeFile(join(dir, 'in-use'), String(process.pid), { mode: 0o600, flag: 'wx' });
+            await assertPrivatePathIdentity(dir, was);
+            // And read back what was written, for the reason the sibling gives: `execFile` reports that
+            // icacls exited 0 and nothing more. Read straight rather than through `descriptorOf`, which
+            // writes into this directory and would await the promise it is running inside.
+            const saved = join(dir, 'verify');
+            await run(icacls, [dir, '/save', saved]);
+            const written = await readDescriptor(saved, dir);
+            await rm(saved, { force: true }).catch(() => undefined);
+            if (!asWritten(ours).test(written)) {
+                throw new Error(`the ACL agenticreplay wrote to ${dir} is not the one it asked for: ${written}`);
+            }
+            await assertPrivatePathIdentity(dir, was);
+            // Nothing sweeps an `agenticreplay-acl-` directory the way `sweepStaleTransports` sweeps the two
+            // named transports, so it takes itself with it rather than accumulating one per run.
+            process.on('exit', () => {
+                try {
+                    const now = lstatSync(dir, { bigint: true });
+                    if (!now.isSymbolicLink() && now.dev === was.dev && now.ino === was.ino) {
+                        rmSync(dir, { recursive: true, force: true });
+                    }
+                }
+                catch {
+                    // Exiting anyway; a directory left in %TEMP% is not worth failing the exit over.
+                }
+            });
+            return dir;
+        }
+        catch (err) {
+            if (was)
+                await removePrivateDirectory(dir, was);
+            scratch = undefined;
+            throw err;
+        }
+    })();
+    return scratch;
+}
+const SYSTEM = 'S-1-5-18';
+const ADMINISTRATORS = 'S-1-5-32-544';
+/**
+ * By SID, never by name: `BUILTIN\Administrators` is localized on a localized Windows, and a grant
+ * naming a principal that does not resolve is a grant that silently matches nothing — which, after
+ * `/inheritance:r` has removed the rest, would leave the file with no usable ACE at all.
+ */
+let sid;
+async function currentAccountSid() {
+    sid ??= readSid().catch((err) => {
+        // Not cached as a rejection: a transient failure here would otherwise be permanent for the
+        // life of the process, and every later write would inherit the ACL we meant to replace.
+        sid = undefined;
+        throw err;
+    });
+    return sid;
+}
+async function readSid() {
+    const { stdout } = await run(system32('whoami.exe'), ['/user', '/fo', 'csv', '/nh']);
+    const found = /S-1-[\d-]+/.exec(stdout)?.[0];
+    if (!found)
+        throw new Error(`could not read this account's SID from: ${stdout.trim()}`);
+    return found;
+}
+/**
+ * Absolute rather than resolved through PATH. This runs in order to secure a private key, and a
+ * lookup that landed on someone else's `icacls.exe` — in the workspace being recorded, say — would
+ * hand that key to exactly the reader the call exists to shut out.
+ *
+ * Which is why there is no fallback. `'C:\Windows'` looks like one and is not: `\W` is not an
+ * escape, so that literal's value is `C:Windows`, and a path beginning with a drive letter and no
+ * separator is *drive-relative* — CreateProcess resolves it against the current directory on C:,
+ * which during a recording is the workspace. `Windows/System32/icacls.exe` is a storable git path,
+ * so the guess reintroduces exactly the hijack it was written against. Spelling it correctly would
+ * still be a guess, and wrong on a machine whose Windows is not on C:.
+ *
+ * `SystemRoot` is set by the OS in every normal process environment. Absent, something is wrong
+ * with how agenticreplay was launched, and refusing is the only answer that cannot be silently incorrect.
+ */
+function system32(exe) {
+    const root = process.env['SystemRoot'];
+    // Absolute, not merely present. `SystemRoot=C:Windows` — the same drive-relative shape the
+    // comment above describes — would rebuild the workspace-relative lookup out of the environment
+    // instead of out of a literal, and a wrapper that sets the variable for agenticreplay's process is an
+    // ordinary thing to run into. `isAbsolute('C:Windows')` is false and `isAbsolute('C:\Windows')`
+    // is true, so this refuses exactly the values that would resolve against the current directory.
+    if (root === undefined || root === '' || !isAbsolute(root)) {
+        throw new Error(`cannot locate ${exe}: SystemRoot is ${root === undefined || root === '' ? 'not set' : `not an absolute path (${JSON.stringify(root)})`}, ` +
+            'so there is no trustworthy path to it. agenticreplay will not fall back to a guess here — this ' +
+            'call is what keeps a private key private.');
+    }
+    return join(root, 'System32', exe);
+}
+//# sourceMappingURL=private-files.js.map

package/node_modules/@agenticreplay/core/dist/private-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-files.js","sourceRoot":"","sources":["../src/private-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEhC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,IAAmB;IACrE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACxB,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAE5C,4FAA4F;IAC5F,iGAAiG;IACjG,MAAM,IAAI,GAAG,CAAC,MAAM,iBAAiB,EAAE,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,yBAAyB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,CAAC,MAAM,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAE/F,gDAAgD;IAChD,EAAE;IACF,8FAA8F;IAC9F,+FAA+F;IAC/F,0FAA0F;IAC1F,8FAA8F;IAC9F,8FAA8F;IAC9F,6FAA6F;IAC7F,sFAAsF;IACtF,EAAE;IACF,6FAA6F;IAC7F,wFAAwF;IACxF,+FAA+F;IAC/F,uFAAuF;IACvF,8FAA8F;IAC9F,0EAA0E;IAC1E,MAAM,GAAG,CAAC,MAAM,EAAE;QAChB,IAAI;QACJ,gBAAgB;QAChB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC;QAC3D,UAAU;QACV,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC;QAC3B,IAAI;KACL,CAAC,CAAC;IAEH,+FAA+F;IAC/F,4FAA4F;IAC5F,gGAAgG;IAChG,gFAAgF;IAChF,EAAE;IACF,+FAA+F;IAC/F,uEAAuE;IACvE,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACjD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,kCAAkC,IAAI,iCAAiC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CACjG,CAAC;IACJ,CAAC;IACD,MAAM,yBAAyB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAY;IACpD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,2CAA2C,CAAC,CAAC;IAChG,IAAI,KAAK,CAAC,GAAG,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,8BAA8B,CAAC,CAAC;IAC7E,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAAY,EACZ,GAAwB;IAExB,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,mDAAmD,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAY,EACZ,GAAwB;IAExB,IAAI,CAAC;QACH,MAAM,yBAAyB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3C,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;IAChE,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,mBAAmB,CAAC,IAAY,EAAE,OAA0B;IACzE,MAAM,MAAM,GAAG;;;;;;CAMhB,CAAC;IACA,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAC1B,QAAQ,CAAC,uCAAuC,CAAC,EACjD;QACE,SAAS;QACT,YAAY;QACZ,iBAAiB;QACjB,iBAAiB;QACjB,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;KAClD,EACD;QACE,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,0BAA0B,EAAE,IAAI;YAChC,yBAAyB,EAAE,OAAO,CAAC,CAAC,CAAC;SACtC;QACD,WAAW,EAAE,IAAI;KAClB,CACF,CAAC;IACF,MAAM,CAAC,KAAK,GAAG,EAAE,EAAE,iBAAiB,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1E,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,4BAA4B,KAAK,mCAAmC,CAAC,CAAC;IAC/F,CAAC;IACD,yFAAyF;IACzF,8FAA8F;IAC9F,gGAAgG;IAChG,MAAM,QAAQ,GAAG,uCAAuC,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACtF,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACpF,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,SAAS,CAAC,QAA2B,EAAE,OAAe;IAC7D,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,IAAI,OAAO,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,SAAS,CAAC,QAA0B;IAC3C,OAAO,IAAI,MAAM,CACf,4CAA4C,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,SAAS,CACnF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,gBAAgB,CAAC,MAAc,EAAE,IAAY;IAC1D,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACpD,8FAA8F;IAC9F,8FAA8F;IAC9F,+FAA+F;IAC/F,2FAA2F;IAC3F,4CAA4C;IAC5C,MAAM,IAAI,GAAG,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,+CAA+C,CAAC,CAAC,CAAC;IACvF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,+CAA+C;AAC/C,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,IAAY;IACtD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QAC1C,OAAO,MAAM,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,cAAc,CAAC,KAAa,EAAE,IAAY;IACvD,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;SAC7C,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,UAAU,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,4FAA4F;IAC5F,oFAAoF;IACpF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CACb,6BAA6B,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAChF,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,IAAI,OAAoC,CAAC;AAEzC;;;;;;;;;;;;;;;;;GAiBG;AACH,KAAK,UAAU,UAAU,CAAC,MAAc;IACtC,OAAO,KAAK,CAAC,KAAK,IAAI,EAAE;QACtB,MAAM,IAAI,GAAG,CAAC,MAAM,iBAAiB,EAAE,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;QACjE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;QAChE,IAAI,GAAoC,CAAC;QACzC,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACrC,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAClD,MAAM,yBAAyB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAE1C,4FAA4F;YAC5F,2FAA2F;YAC3F,0FAA0F;YAC1F,0FAA0F;YAC1F,yFAAyF;YACzF,uFAAuF;YACvF,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;YAC7F,MAAM,yBAAyB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAE1C,uFAAuF;YACvF,wFAAwF;YACxF,6EAA6E;YAC7E,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACvF,MAAM,yBAAyB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAE1C,4FAA4F;YAC5F,4FAA4F;YAC5F,+EAA+E;YAC/E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAClC,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;YACzC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACjD,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACxD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CACb,kCAAkC,GAAG,iCAAiC,OAAO,EAAE,CAChF,CAAC;YACJ,CAAC;YACD,MAAM,yBAAyB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAE1C,iGAAiG;YACjG,qFAAqF;YACrF,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;gBACtB,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC7C,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,GAAG,CAAC,GAAG,KAAK,GAAI,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,GAAI,CAAC,GAAG,EAAE,CAAC;wBAC1E,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;oBAChD,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,iFAAiF;gBACnF,CAAC;YACH,CAAC,CAAC,CAAC;YACH,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG;gBAAE,MAAM,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAChD,OAAO,GAAG,SAAS,CAAC;YACpB,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,MAAM,GAAG,UAAU,CAAC;AAC1B,MAAM,cAAc,GAAG,cAAc,CAAC;AAEtC;;;;GAIG;AACH,IAAI,GAAgC,CAAC;AAErC,KAAK,UAAU,iBAAiB;IAC9B,GAAG,KAAK,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QACvC,2FAA2F;QAC3F,wFAAwF;QACxF,GAAG,GAAG,SAAS,CAAC;QAChB,MAAM,GAAG,CAAC;IACZ,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,OAAO;IACpB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IACrF,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACxF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACvC,2FAA2F;IAC3F,+FAA+F;IAC/F,sGAAsG;IACtG,gGAAgG;IAChG,gGAAgG;IAChG,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,iBAAiB,GAAG,mBAAmB,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI;YACzI,iGAAiG;YACjG,2CAA2C,CAC9C,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;AACrC,CAAC"}

package/node_modules/@agenticreplay/core/dist/reader.d.ts

@@ -0,0 +1,45 @@
+import type { BlobRef, Manifest, TraceEvent } from '@agenticreplay/schema';
+/** A line the reader could not use. Reported, never repaired (spec §6). */
+export interface ReadProblem {
+    /** 1-based line number in events.jsonl; 0 for a problem with the file itself. */
+    line: number;
+    reason: string;
+}
+export interface IntegrityResult {
+    /** True only for a sealed run whose events file still hashes to the digest it was sealed with. */
+    ok: boolean;
+    /**
+     * Why `ok` is what it is. `unsealed` is not `mismatch`, and collapsing the two is how a run whose
+     * recorder was killed gets reported as tampered: nothing changed under it, there was simply never
+     * a digest to check it against. Callers that only care whether the bytes are trustworthy read
+     * `ok`; callers that tell a person what happened have to tell those two apart.
+     */
+    state: 'verified' | 'unsealed' | 'mismatch';
+    /** Absent when the run was never sealed, so there is nothing to check against. */
+    expected?: string;
+    actual?: string;
+}
+/**
+ * Reader for one recorded run.
+ *
+ * Two tolerances are mandated by spec §2 and both are deliberate: a run that crashed mid-write
+ * leaves a partial final line, and a trace written by a newer AgenticReplay may carry event types this
+ * build has never heard of. Neither may take down the whole trace — but neither is hidden either,
+ * so anything skipped shows up in {@link problems}.
+ */
+export declare class TraceReader {
+    #private;
+    private constructor();
+    static open(runDir: string): Promise<TraceReader>;
+    get runDir(): string;
+    manifest(): Manifest;
+    /** Lines skipped by the most recent read pass. */
+    problems(): ReadProblem[];
+    events(): Promise<TraceEvent[]>;
+    stream(): AsyncIterableIterator<TraceEvent>;
+    blob(ref: BlobRef | string): Promise<Uint8Array>;
+    /** The event's payload, reading it back from its blob when it was spilled (spec §2.2). */
+    resolvePayload(event: TraceEvent): Promise<unknown>;
+    verifyIntegrity(): Promise<IntegrityResult>;
+}
+//# sourceMappingURL=reader.d.ts.map

package/node_modules/@agenticreplay/core/dist/reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reader.d.ts","sourceRoot":"","sources":["../src/reader.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAI3E,2EAA2E;AAC3E,MAAM,WAAW,WAAW;IAC1B,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,kGAAkG;IAClG,EAAE,EAAE,OAAO,CAAC;IACZ;;;;;OAKG;IACH,KAAK,EAAE,UAAU,GAAG,UAAU,GAAG,UAAU,CAAC;IAC5C,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAID;;;;;;;GAOG;AACH,qBAAa,WAAW;;IAOtB,OAAO;WAOM,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAkBvD,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,QAAQ,IAAI,QAAQ;IAIpB,kDAAkD;IAClD,QAAQ,IAAI,WAAW,EAAE;IAInB,MAAM,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAM9B,MAAM,IAAI,qBAAqB,CAAC,UAAU,CAAC;IAiC5C,IAAI,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAItD,0FAA0F;IACpF,cAAc,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC;IAYnD,eAAe,IAAI,OAAO,CAAC,eAAe,CAAC;CAiClD"}

package/node_modules/@agenticreplay/core/dist/reader.js

@@ -0,0 +1,152 @@
+import { createReadStream } from 'node:fs';
+import { readFile, stat } from 'node:fs/promises';
+import { join } from 'node:path';
+import { createInterface } from 'node:readline';
+import { EVENT_TYPES, assertManifest, isBlobRef, validateEvent } from '@agenticreplay/schema';
+import { BlobStore, sha256File } from './blobs.js';
+const KNOWN_TYPES = new Set(EVENT_TYPES);
+/**
+ * Reader for one recorded run.
+ *
+ * Two tolerances are mandated by spec §2 and both are deliberate: a run that crashed mid-write
+ * leaves a partial final line, and a trace written by a newer AgenticReplay may carry event types this
+ * build has never heard of. Neither may take down the whole trace — but neither is hidden either,
+ * so anything skipped shows up in {@link problems}.
+ */
+export class TraceReader {
+    #runDir;
+    #eventsPath;
+    #manifest;
+    #blobs;
+    #problems = [];
+    constructor(runDir, manifest) {
+        this.#runDir = runDir;
+        this.#eventsPath = join(runDir, 'events.jsonl');
+        this.#manifest = manifest;
+        this.#blobs = new BlobStore(join(runDir, 'blobs'));
+    }
+    static async open(runDir) {
+        const path = join(runDir, 'manifest.json');
+        let raw;
+        try {
+            raw = await readFile(path, 'utf8');
+        }
+        catch {
+            throw new Error(`not an agenticreplay run: cannot read ${path}`);
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            throw new Error(`invalid manifest: ${path} is not JSON`);
+        }
+        assertManifest(parsed);
+        return new TraceReader(runDir, parsed);
+    }
+    get runDir() {
+        return this.#runDir;
+    }
+    manifest() {
+        return this.#manifest;
+    }
+    /** Lines skipped by the most recent read pass. */
+    problems() {
+        return [...this.#problems];
+    }
+    async events() {
+        const out = [];
+        for await (const e of this.stream())
+            out.push(e);
+        return out;
+    }
+    async *stream() {
+        this.#problems = [];
+        if (!(await stat(this.#eventsPath).catch(() => null))) {
+            this.#problems.push({ line: 0, reason: `${this.#eventsPath} is missing` });
+            return;
+        }
+        const rl = createInterface({
+            input: createReadStream(this.#eventsPath),
+            crlfDelay: Number.POSITIVE_INFINITY,
+        });
+        // One line is held back so the last one can be told apart from the rest: only the last may
+        // legitimately be half-written.
+        let held;
+        let n = 0;
+        try {
+            for await (const raw of rl) {
+                n += 1;
+                if (raw.trim().length === 0)
+                    continue;
+                if (held) {
+                    const e = this.#parse(held, false);
+                    if (e)
+                        yield e;
+                }
+                held = { line: n, text: raw };
+            }
+            if (held) {
+                const e = this.#parse(held, true);
+                if (e)
+                    yield e;
+            }
+        }
+        finally {
+            rl.close();
+        }
+    }
+    async blob(ref) {
+        return this.#blobs.get(ref);
+    }
+    /** The event's payload, reading it back from its blob when it was spilled (spec §2.2). */
+    async resolvePayload(event) {
+        const payload = event.payload;
+        if (!isBlobRef(payload))
+            return payload;
+        const text = new TextDecoder().decode(await this.blob(payload));
+        if (payload.media_type !== undefined && !payload.media_type.includes('json'))
+            return text;
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            throw new Error(`blob ${payload.$blob} is not JSON; read it with blob() instead`);
+        }
+    }
+    async verifyIntegrity() {
+        const expected = this.#manifest.integrity?.events_sha256;
+        const actual = await sha256File(this.#eventsPath);
+        if (expected === undefined)
+            return { ok: false, state: 'unsealed', actual };
+        return expected === actual
+            ? { ok: true, state: 'verified', expected, actual }
+            : { ok: false, state: 'mismatch', expected, actual };
+    }
+    #parse(held, isLast) {
+        let value;
+        try {
+            value = JSON.parse(held.text);
+        }
+        catch {
+            const reason = isLast ? 'truncated final line' : 'malformed JSON';
+            this.#problems.push({ line: held.line, reason });
+            return undefined;
+        }
+        const type = value.type;
+        if (typeof type !== 'string' || !KNOWN_TYPES.has(type)) {
+            this.#problems.push({
+                line: held.line,
+                reason: `unknown event type ${JSON.stringify(type)}`,
+            });
+            return undefined;
+        }
+        const result = validateEvent(value);
+        if (!result.valid) {
+            this.#problems.push({ line: held.line, reason: result.errors.join('; ') });
+            return undefined;
+        }
+        return value;
+    }
+}
+//# sourceMappingURL=reader.js.map

package/node_modules/@agenticreplay/core/dist/reader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reader.js","sourceRoot":"","sources":["../src/reader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC9F,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAwBnD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS,WAAW,CAAC,CAAC;AAEjD;;;;;;;GAOG;AACH,MAAM,OAAO,WAAW;IACb,OAAO,CAAS;IAChB,WAAW,CAAS;IACpB,SAAS,CAAW;IACpB,MAAM,CAAY;IAC3B,SAAS,GAAkB,EAAE,CAAC;IAE9B,YAAoB,MAAc,EAAE,QAAkB;QACpD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QAChD,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAc;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QAC3C,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,cAAc,CAAC,CAAC;QAC3D,CAAC;QACD,cAAc,CAAC,MAAM,CAAC,CAAC;QACvB,OAAO,IAAI,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,kDAAkD;IAClD,QAAQ;QACN,OAAO,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,GAAG,GAAiB,EAAE,CAAC;QAC7B,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,CAAC,MAAM;QACX,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACtD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,aAAa,EAAE,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QACD,MAAM,EAAE,GAAG,eAAe,CAAC;YACzB,KAAK,EAAE,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC;YACzC,SAAS,EAAE,MAAM,CAAC,iBAAiB;SACpC,CAAC,CAAC;QACH,2FAA2F;QAC3F,gCAAgC;QAChC,IAAI,IAAgD,CAAC;QACrD,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,EAAE,CAAC;gBAC3B,CAAC,IAAI,CAAC,CAAC;gBACP,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS;gBACtC,IAAI,IAAI,EAAE,CAAC;oBACT,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;oBACnC,IAAI,CAAC;wBAAE,MAAM,CAAC,CAAC;gBACjB,CAAC;gBACD,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;YAChC,CAAC;YACD,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBAClC,IAAI,CAAC;oBAAE,MAAM,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAqB;QAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,0FAA0F;IAC1F,KAAK,CAAC,cAAc,CAAC,KAAiB;QACpC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAAE,OAAO,OAAO,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAChE,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1F,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,QAAQ,OAAO,CAAC,KAAK,2CAA2C,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,aAAa,CAAC;QACzD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QAC5E,OAAO,QAAQ,KAAK,MAAM;YACxB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE;YACnD,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,CAAC,IAAoC,EAAE,MAAe;QAC1D,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,gBAAgB,CAAC;YAClE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YACjD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAC;QAChD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACvD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAClB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM,EAAE,sBAAsB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;aACrD,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3E,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,KAAmB,CAAC;IAC7B,CAAC;CACF"}