agentrinse 0.0.0 → 0.1.0

package/dist/core/apply.js

@@ -1,16 +1,28 @@
+import { randomUUID } from "node:crypto";
 import { agentRinseConfigSchema } from "../config/schema.js";
 import { acquireApplyLock } from "../state/lock.js";
 import { stateLayout } from "../state/layout.js";
+import { ensurePrivateDirectory } from "../state/json-file.js";
 import { createRunJournal } from "../state/run-journal.js";
 import { ArtifactExecutionError, artifactIsolationPath, executeArtifactRemove, } from "./artifact-executor.js";
 import { revalidateArtifactRemove, } from "./artifact-revalidation.js";
 import { sha256 } from "./digest.js";
+import { CommandInterruptedError } from "./interruption.js";
 import { verifyCleanupPlan } from "./plan-verification.js";
 import { isPathInside, resolvePhysicalPath } from "./safety.js";
 export class ApplySafetyError extends Error {
     name = "ApplySafetyError";
 }
+function throwIfInterrupted(signal) {
+    if (signal?.aborted !== true) {
+        return;
+    }
+    throw signal.reason instanceof CommandInterruptedError
+        ? signal.reason
+        : new CommandInterruptedError("apply interrupted");
+}
 export async function applyCleanupPlan(options) {
+    throwIfInterrupted(options.signal);
     const clock = options.dependencies?.clock ?? (() => new Date());
     const config = agentRinseConfigSchema.parse(options.config);
     const plan = verifyCleanupPlan(options.input, config, clock());
@@ -23,16 +35,27 @@ export async function applyCleanupPlan(options) {
             throw new ApplySafetyError(`state directory ${layout.root} must not be inside cleanup target ${action.target.path}`);
         }
     }
-    const lock = await acquireApplyLock(layout.locks, plan.planId);
+    const runId = randomUUID();
+    await ensurePrivateDirectory(layout.root);
+    await ensurePrivateDirectory(layout.locks);
+    await ensurePrivateDirectory(layout.runs);
+    const lock = await acquireApplyLock(layout.locks, {
+        planId: plan.planId,
+        runId,
+        command: "agentrinse apply",
+    });
+    let journal;
     try {
-        const journal = await (options.dependencies?.createJournal ?? createRunJournal)(layout.runs, plan, clock());
-        const runId = journal.snapshot().runId;
+        journal = await (options.dependencies?.createJournal ?? createRunJournal)(layout.runs, plan, clock(), runId);
+        throwIfInterrupted(options.signal);
         for (const action of plan.actions) {
+            throwIfInterrupted(options.signal);
             const startedAt = clock().toISOString();
             await journal.updateAction(action.actionId, {
                 status: "revalidating",
                 startedAt,
             });
+            throwIfInterrupted(options.signal);
             const revalidation = options.dependencies?.revalidate === undefined
                 ? await revalidateArtifactRemove(action, plan.home, config, { now: clock })
                 : await options.dependencies.revalidate(action, plan.home, config);
@@ -42,8 +65,10 @@ export async function applyCleanupPlan(options) {
                     completedAt: clock().toISOString(),
                     diagnostic: revalidation.diagnostic,
                 });
+                throwIfInterrupted(options.signal);
                 continue;
             }
+            throwIfInterrupted(options.signal);
             const authorizationCheckedAt = clock();
             if (authorizationCheckedAt.getTime() >= Date.parse(plan.expiresAt)) {
                 await journal.updateAction(action.actionId, {
@@ -57,6 +82,7 @@ export async function applyCleanupPlan(options) {
                         resourceId: action.resourceId,
                     },
                 });
+                throwIfInterrupted(options.signal);
                 continue;
             }
             const isolationId = `${runId}-${sha256(action.actionId).slice(0, 12)}`;
@@ -65,6 +91,7 @@ export async function applyCleanupPlan(options) {
                 status: "applying",
                 isolationPath,
             });
+            throwIfInterrupted(options.signal);
             let result;
             try {
                 result = await (options.dependencies?.execute ??
@@ -99,6 +126,7 @@ export async function applyCleanupPlan(options) {
                     },
                 });
                 if (executionError?.outcome === "skipped-stale") {
+                    throwIfInterrupted(options.signal);
                     continue;
                 }
                 break;
@@ -109,10 +137,25 @@ export async function applyCleanupPlan(options) {
                 reclaimedBytes: result.reclaimedBytes,
                 isolationPath: result.isolationPath,
             });
+            throwIfInterrupted(options.signal);
         }
         const run = await journal.complete(clock());
+        if (run.status === "completed") {
+            throwIfInterrupted(options.signal);
+        }
         return { plan, run, journalPath: journal.path };
     }
+    catch (error) {
+        if (error instanceof CommandInterruptedError && journal !== undefined) {
+            const run = await journal.interrupt({
+                severity: "warning",
+                code: "COMMAND_INTERRUPTED",
+                message: "Apply was interrupted at a safe checkpoint. Inspect the journal before creating a fresh audit and plan.",
+            }, clock());
+            return { plan, run, journalPath: journal.path };
+        }
+        throw error;
+    }
     finally {
         await lock.release();
     }

package/dist/core/apply.js.map

@@ -1 +1 @@
-{"version":3,"file":"apply.js","sourceRoot":"","sources":["../../src/core/apply.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAyB,MAAM,qBAAqB,CAAC;AAIpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,GAEtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,wBAAwB,GAEzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEhE,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACvB,IAAI,GAAG,kBAAkB,CAAC;CAC7C;AA0BD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAgC;IACrE,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,EAAE,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,iBAAiB,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACjE,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,cAAc,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrE,IACE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC;YAC7C,YAAY,CAAC,cAAc,EAAE,iBAAiB,CAAC,EAC/C,CAAC;YACD,MAAM,IAAI,gBAAgB,CACxB,mBAAmB,MAAM,CAAC,IAAI,sCAAsC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CACzF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAE/D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,aAAa,IAAI,gBAAgB,CAAC,CAC7E,MAAM,CAAC,IAAI,EACX,IAAI,EACJ,KAAK,EAAE,CACR,CAAC;QACF,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC;QAEvC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC;YACxC,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE;gBAC1C,MAAM,EAAE,cAAc;gBACtB,SAAS;aACV,CAAC,CAAC;YAEH,MAAM,YAAY,GAChB,OAAO,CAAC,YAAY,EAAE,UAAU,KAAK,SAAS;gBAC5C,CAAC,CAAC,MAAM,wBAAwB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;gBAC3E,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACvE,IAAI,YAAY,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBACpC,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE;oBAC1C,MAAM,EAAE,eAAe;oBACvB,WAAW,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE;oBAClC,UAAU,EAAE,YAAY,CAAC,UAAU;iBACpC,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,MAAM,sBAAsB,GAAG,KAAK,EAAE,CAAC;YACvC,IAAI,sBAAsB,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnE,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE;oBAC1C,MAAM,EAAE,eAAe;oBACvB,WAAW,EAAE,sBAAsB,CAAC,WAAW,EAAE;oBACjD,UAAU,EAAE;wBACV,QAAQ,EAAE,SAAS;wBACnB,IAAI,EAAE,2BAA2B;wBACjC,OAAO,EAAE,yCAAyC,IAAI,CAAC,SAAS,EAAE;wBAClE,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,UAAU,EAAE,MAAM,CAAC,UAAU;qBAC9B;iBACF,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,MAAM,WAAW,GAAG,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YACvE,MAAM,aAAa,GAAG,qBAAqB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACjE,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE;gBAC1C,MAAM,EAAE,UAAU;gBAClB,aAAa;aACd,CAAC,CAAC;YAEH,IAAI,MAA+B,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,CACb,OAAO,CAAC,YAAY,EAAE,OAAO;oBAC7B,CAAC,CAAC,cAAc,EAAE,mBAAmB,EAAE,EAAE,CACvC,qBAAqB,CAAC,cAAc,EAAE;wBACpC,EAAE,EAAE,GAAG,EAAE,CAAC,mBAAmB;wBAC7B,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU;wBACnC,aAAa,EAAE;4BACb,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;4BACvC,GAAG,EAAE,KAAK;yBACX;qBACF,CAAC,CAAC,CACN,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,cAAc,GAAG,KAAK,YAAY,sBAAsB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;gBACnF,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE;oBAC1C,MAAM,EAAE,cAAc,EAAE,OAAO,IAAI,QAAQ;oBAC3C,WAAW,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE;oBAClC,aAAa,EAAE,cAAc,EAAE,aAAa,IAAI,aAAa;oBAC7D,UAAU,EAAE;wBACV,QAAQ,EAAE,cAAc,EAAE,OAAO,KAAK,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;wBAC3E,IAAI,EACF,cAAc,EAAE,cAAc;4BAC9B,CAAC,cAAc,EAAE,OAAO,KAAK,eAAe;gCAC1C,CAAC,CAAC,2BAA2B;gCAC7B,CAAC,CAAC,cAAc,EAAE,OAAO,KAAK,mBAAmB;oCAC/C,CAAC,CAAC,4BAA4B;oCAC9B,CAAC,CAAC,cAAc,EAAE,OAAO,KAAK,aAAa;wCACzC,CAAC,CAAC,sBAAsB;wCACxB,CAAC,CAAC,uBAAuB,CAAC;wBAClC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;wBAC/D,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,UAAU,EAAE,MAAM,CAAC,UAAU;qBAC9B;iBACF,CAAC,CAAC;gBACH,IAAI,cAAc,EAAE,OAAO,KAAK,eAAe,EAAE,CAAC;oBAChD,SAAS;gBACX,CAAC;gBACD,MAAM;YACR,CAAC;YAED,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE;gBAC1C,MAAM,EAAE,SAAS;gBACjB,WAAW,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE;gBAClC,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,aAAa,EAAE,MAAM,CAAC,aAAa;aACpC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAClD,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACvB,CAAC;AACH,CAAC"}
+{"version":3,"file":"apply.js","sourceRoot":"","sources":["../../src/core/apply.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,sBAAsB,EAAyB,MAAM,qBAAqB,CAAC;AAIpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,GAEtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,wBAAwB,GAEzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEhE,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACvB,IAAI,GAAG,kBAAkB,CAAC;CAC7C;AA2BD,SAAS,kBAAkB,CAAC,MAAoB;IAC9C,IAAI,MAAM,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;QAC7B,OAAO;IACT,CAAC;IACD,MAAM,MAAM,CAAC,MAAM,YAAY,uBAAuB;QACpD,CAAC,CAAC,MAAM,CAAC,MAAM;QACf,CAAC,CAAC,IAAI,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAgC;IACrE,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,EAAE,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,iBAAiB,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACjE,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,cAAc,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrE,IACE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC;YAC7C,YAAY,CAAC,cAAc,EAAE,iBAAiB,CAAC,EAC/C,CAAC;YACD,MAAM,IAAI,gBAAgB,CACxB,mBAAmB,MAAM,CAAC,IAAI,sCAAsC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CACzF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,MAAM,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,sBAAsB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,KAAK,EAAE;QAChD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK;QACL,OAAO,EAAE,kBAAkB;KAC5B,CAAC,CAAC;IAEH,IAAI,OAAiE,CAAC;IACtE,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,aAAa,IAAI,gBAAgB,CAAC,CACvE,MAAM,CAAC,IAAI,EACX,IAAI,EACJ,KAAK,EAAE,EACP,KAAK,CACN,CAAC;QACF,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEnC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC;YACxC,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE;gBAC1C,MAAM,EAAE,cAAc;gBACtB,SAAS;aACV,CAAC,CAAC;YACH,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAEnC,MAAM,YAAY,GAChB,OAAO,CAAC,YAAY,EAAE,UAAU,KAAK,SAAS;gBAC5C,CAAC,CAAC,MAAM,wBAAwB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;gBAC3E,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACvE,IAAI,YAAY,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBACpC,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE;oBAC1C,MAAM,EAAE,eAAe;oBACvB,WAAW,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE;oBAClC,UAAU,EAAE,YAAY,CAAC,UAAU;iBACpC,CAAC,CAAC;gBACH,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBACnC,SAAS;YACX,CAAC;YACD,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAEnC,MAAM,sBAAsB,GAAG,KAAK,EAAE,CAAC;YACvC,IAAI,sBAAsB,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnE,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE;oBAC1C,MAAM,EAAE,eAAe;oBACvB,WAAW,EAAE,sBAAsB,CAAC,WAAW,EAAE;oBACjD,UAAU,EAAE;wBACV,QAAQ,EAAE,SAAS;wBACnB,IAAI,EAAE,2BAA2B;wBACjC,OAAO,EAAE,yCAAyC,IAAI,CAAC,SAAS,EAAE;wBAClE,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,UAAU,EAAE,MAAM,CAAC,UAAU;qBAC9B;iBACF,CAAC,CAAC;gBACH,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBACnC,SAAS;YACX,CAAC;YAED,MAAM,WAAW,GAAG,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YACvE,MAAM,aAAa,GAAG,qBAAqB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACjE,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE;gBAC1C,MAAM,EAAE,UAAU;gBAClB,aAAa;aACd,CAAC,CAAC;YACH,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAEnC,IAAI,MAA+B,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,CACb,OAAO,CAAC,YAAY,EAAE,OAAO;oBAC7B,CAAC,CAAC,cAAc,EAAE,mBAAmB,EAAE,EAAE,CACvC,qBAAqB,CAAC,cAAc,EAAE;wBACpC,EAAE,EAAE,GAAG,EAAE,CAAC,mBAAmB;wBAC7B,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU;wBACnC,aAAa,EAAE;4BACb,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;4BACvC,GAAG,EAAE,KAAK;yBACX;qBACF,CAAC,CAAC,CACN,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,cAAc,GAAG,KAAK,YAAY,sBAAsB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;gBACnF,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE;oBAC1C,MAAM,EAAE,cAAc,EAAE,OAAO,IAAI,QAAQ;oBAC3C,WAAW,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE;oBAClC,aAAa,EAAE,cAAc,EAAE,aAAa,IAAI,aAAa;oBAC7D,UAAU,EAAE;wBACV,QAAQ,EAAE,cAAc,EAAE,OAAO,KAAK,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;wBAC3E,IAAI,EACF,cAAc,EAAE,cAAc;4BAC9B,CAAC,cAAc,EAAE,OAAO,KAAK,eAAe;gCAC1C,CAAC,CAAC,2BAA2B;gCAC7B,CAAC,CAAC,cAAc,EAAE,OAAO,KAAK,mBAAmB;oCAC/C,CAAC,CAAC,4BAA4B;oCAC9B,CAAC,CAAC,cAAc,EAAE,OAAO,KAAK,aAAa;wCACzC,CAAC,CAAC,sBAAsB;wCACxB,CAAC,CAAC,uBAAuB,CAAC;wBAClC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;wBAC/D,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,UAAU,EAAE,MAAM,CAAC,UAAU;qBAC9B;iBACF,CAAC,CAAC;gBACH,IAAI,cAAc,EAAE,OAAO,KAAK,eAAe,EAAE,CAAC;oBAChD,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;oBACnC,SAAS;gBACX,CAAC;gBACD,MAAM;YACR,CAAC;YAED,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE;gBAC1C,MAAM,EAAE,SAAS;gBACjB,WAAW,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE;gBAClC,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,aAAa,EAAE,MAAM,CAAC,aAAa;aACpC,CAAC,CAAC;YACH,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5C,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAC/B,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uBAAuB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACtE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,SAAS,CACjC;gBACE,QAAQ,EAAE,SAAS;gBACnB,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EACL,yGAAyG;aAC5G,EACD,KAAK,EAAE,CACR,CAAC;YACF,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;QAClD,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/core/audit.d.ts

@@ -1,12 +1,33 @@
 import type { AgentRinseConfig } from "../config/schema.js";
 import type { AuditAdapter } from "../contracts/adapter.js";
+import type { Diagnostic } from "../contracts/diagnostic.js";
+import type { Finding } from "../contracts/finding.js";
 import { type AuditReport } from "../contracts/report.js";
+import type { ResourceSnapshot } from "../contracts/resource.js";
 export type RunAuditOptions = {
     home: string;
     config: AgentRinseConfig;
     adapters: AuditAdapter[];
     now?: () => Date;
     signal?: AbortSignal;
+    onEvent?: (event: AuditProgressEvent) => void;
+};
+export type AuditProgressEvent = {
+    type: "adapter.probed";
+    timestamp: string;
+    data: AuditReport["probes"][number];
+} | {
+    type: "diagnostic.reported";
+    timestamp: string;
+    data: Diagnostic;
+} | {
+    type: "resource.discovered";
+    timestamp: string;
+    data: ResourceSnapshot;
+} | {
+    type: "finding.completed";
+    timestamp: string;
+    data: Finding;
 };
 export declare function runAudit(options: RunAuditOptions): Promise<AuditReport>;
 //# sourceMappingURL=audit.d.ts.map

package/dist/core/audit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/core/audit.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAgB,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAG7E,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,gBAAgB,CAAC;IACzB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,CAAC;AAEF,wBAAsB,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,CAwC7E"}
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/core/audit.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAgB,MAAM,yBAAyB,CAAC;AAC1E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAGjE,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,gBAAgB,CAAC;IACzB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,IAAI,CAAC;CAC/C,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAC1B;IACE,IAAI,EAAE,gBAAgB,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC;CACrC,GACD;IACE,IAAI,EAAE,qBAAqB,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,UAAU,CAAC;CAClB,GACD;IACE,IAAI,EAAE,qBAAqB,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,gBAAgB,CAAC;CACxB,GACD;IACE,IAAI,EAAE,mBAAmB,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC;CACf,CAAC;AAEN,wBAAsB,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,CAsE7E"}

package/dist/core/audit.js

@@ -19,10 +19,40 @@ export async function runAudit(options) {
         const probe = await adapter.probe(context);
         probes.push(probe);
         diagnostics.push(...probe.diagnostics);
+        options.onEvent?.({
+            type: "adapter.probed",
+            timestamp: clock().toISOString(),
+            data: probe,
+        });
+        for (const diagnostic of probe.diagnostics) {
+            options.onEvent?.({
+                type: "diagnostic.reported",
+                timestamp: clock().toISOString(),
+                data: diagnostic,
+            });
+        }
         const collection = await adapter.collect(context, probe);
         diagnostics.push(...collection.diagnostics);
+        for (const diagnostic of collection.diagnostics) {
+            options.onEvent?.({
+                type: "diagnostic.reported",
+                timestamp: clock().toISOString(),
+                data: diagnostic,
+            });
+        }
         for (const resource of collection.resources) {
-            findings.push(await adapter.classify(context, resource));
+            options.onEvent?.({
+                type: "resource.discovered",
+                timestamp: clock().toISOString(),
+                data: resource,
+            });
+            const finding = await adapter.classify(context, resource);
+            findings.push(finding);
+            options.onEvent?.({
+                type: "finding.completed",
+                timestamp: clock().toISOString(),
+                data: finding,
+            });
         }
     }
     probes.sort((left, right) => left.adapter.localeCompare(right.adapter));

package/dist/core/audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/core/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,OAAO,EAAE,iBAAiB,EAAoB,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAU9C,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAwB;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,OAAO,GAAiB;QAC5B,IAAI;QACJ,GAAG,EAAE,SAAS;QACd,OAAO,EAAE,UAAU,EAAE;QACrB,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;KACpE,CAAC;IACF,MAAM,MAAM,GAAG,EAAE,CAAC;IAClB,MAAM,QAAQ,GAAG,EAAE,CAAC;IACpB,MAAM,WAAW,GAAG,EAAE,CAAC;IAEvB,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACvC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC;QAEvC,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACzD,WAAW,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;QAC5C,KAAK,MAAM,QAAQ,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;YAC5C,QAAQ,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACxE,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAElF,OAAO,iBAAiB,CAAC,KAAK,CAAC;QAC7B,aAAa,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;QAClC,WAAW,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE;QAClC,IAAI;QACJ,MAAM;QACN,QAAQ;QACR,WAAW;KACZ,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/core/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAMzC,OAAO,EAAE,iBAAiB,EAAoB,MAAM,wBAAwB,CAAC;AAE7E,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAiC9C,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAwB;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,OAAO,GAAiB;QAC5B,IAAI;QACJ,GAAG,EAAE,SAAS;QACd,OAAO,EAAE,UAAU,EAAE;QACrB,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;KACpE,CAAC;IACF,MAAM,MAAM,GAAG,EAAE,CAAC;IAClB,MAAM,QAAQ,GAAG,EAAE,CAAC;IACpB,MAAM,WAAW,GAAG,EAAE,CAAC;IAEvB,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACvC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC;QACvC,OAAO,CAAC,OAAO,EAAE,CAAC;YAChB,IAAI,EAAE,gBAAgB;YACtB,SAAS,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE;YAChC,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YAC3C,OAAO,CAAC,OAAO,EAAE,CAAC;gBAChB,IAAI,EAAE,qBAAqB;gBAC3B,SAAS,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE;gBAChC,IAAI,EAAE,UAAU;aACjB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACzD,WAAW,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;QAC5C,KAAK,MAAM,UAAU,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;YAChD,OAAO,CAAC,OAAO,EAAE,CAAC;gBAChB,IAAI,EAAE,qBAAqB;gBAC3B,SAAS,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE;gBAChC,IAAI,EAAE,UAAU;aACjB,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,QAAQ,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;YAC5C,OAAO,CAAC,OAAO,EAAE,CAAC;gBAChB,IAAI,EAAE,qBAAqB;gBAC3B,SAAS,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE;gBAChC,IAAI,EAAE,QAAQ;aACf,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC1D,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,OAAO,CAAC,OAAO,EAAE,CAAC;gBAChB,IAAI,EAAE,mBAAmB;gBACzB,SAAS,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE;gBAChC,IAAI,EAAE,OAAO;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACxE,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAElF,OAAO,iBAAiB,CAAC,KAAK,CAAC;QAC7B,aAAa,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;QAClC,WAAW,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE;QAClC,IAAI;QACJ,MAAM;QACN,QAAQ;QACR,WAAW;KACZ,CAAC,CAAC;AACL,CAAC"}

package/dist/core/duration.d.ts

@@ -0,0 +1,2 @@
+export declare function parseDurationMs(input: string): number;
+//# sourceMappingURL=duration.d.ts.map

package/dist/core/duration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"duration.d.ts","sourceRoot":"","sources":["../../src/core/duration.ts"],"names":[],"mappings":"AAUA,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAYrD"}

package/dist/core/duration.js

@@ -0,0 +1,21 @@
+const DURATION_PATTERN = /^([1-9]\d*)(ms|s|m|h|d)$/;
+const UNIT_MS = {
+    ms: 1,
+    s: 1000,
+    m: 60_000,
+    h: 60 * 60_000,
+    d: 24 * 60 * 60_000,
+};
+export function parseDurationMs(input) {
+    const match = DURATION_PATTERN.exec(input.trim());
+    if (match === null) {
+        throw new Error(`invalid duration ${JSON.stringify(input)}; use a positive value like 30d`);
+    }
+    const amount = Number.parseInt(match[1], 10);
+    const result = amount * UNIT_MS[match[2]];
+    if (!Number.isSafeInteger(result)) {
+        throw new Error(`duration ${JSON.stringify(input)} is too large`);
+    }
+    return result;
+}
+//# sourceMappingURL=duration.js.map

package/dist/core/duration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"duration.js","sourceRoot":"","sources":["../../src/core/duration.ts"],"names":[],"mappings":"AAAA,MAAM,gBAAgB,GAAG,0BAA0B,CAAC;AAEpD,MAAM,OAAO,GAA2B;IACtC,EAAE,EAAE,CAAC;IACL,CAAC,EAAE,IAAI;IACP,CAAC,EAAE,MAAM;IACT,CAAC,EAAE,EAAE,GAAG,MAAM;IACd,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,MAAM;CACpB,CAAC;AAEF,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAClD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAE,CAAE,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/core/interruption.d.ts

@@ -0,0 +1,5 @@
+export declare class CommandInterruptedError extends Error {
+    readonly name = "CommandInterruptedError";
+    readonly exitCode = 130;
+}
+//# sourceMappingURL=interruption.d.ts.map

package/dist/core/interruption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interruption.d.ts","sourceRoot":"","sources":["../../src/core/interruption.ts"],"names":[],"mappings":"AAAA,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,SAAkB,IAAI,6BAA6B;IACnD,QAAQ,CAAC,QAAQ,OAAO;CACzB"}

package/dist/core/interruption.js

@@ -0,0 +1,5 @@
+export class CommandInterruptedError extends Error {
+    name = "CommandInterruptedError";
+    exitCode = 130;
+}
+//# sourceMappingURL=interruption.js.map

package/dist/core/interruption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interruption.js","sourceRoot":"","sources":["../../src/core/interruption.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAC9B,IAAI,GAAG,yBAAyB,CAAC;IAC1C,QAAQ,GAAG,GAAG,CAAC;CACzB"}

package/dist/core/process-identity.d.ts

@@ -0,0 +1,24 @@
+type RunProcessCommand = (file: string, args: string[], options: {
+    encoding: "utf8";
+    env: NodeJS.ProcessEnv;
+}) => Promise<{
+    stdout: string;
+    stderr: string;
+}>;
+export type ProcessIdentityDependencies = {
+    runProcessCommand?: RunProcessCommand;
+    readProcessStat?: (pid: number) => Promise<string>;
+    probeProcess?: (pid: number) => "alive" | "dead" | "unknown";
+};
+export type ProcessIdentityInspection = {
+    status: "alive";
+    identity: string;
+} | {
+    status: "dead";
+} | {
+    status: "unknown";
+    reason: string;
+};
+export declare function inspectProcessIdentity(pid: number, platform?: NodeJS.Platform, dependencies?: ProcessIdentityDependencies): Promise<ProcessIdentityInspection>;
+export {};
+//# sourceMappingURL=process-identity.d.ts.map

package/dist/core/process-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-identity.d.ts","sourceRoot":"","sources":["../../src/core/process-identity.ts"],"names":[],"mappings":"AAMA,KAAK,iBAAiB,GAAG,CACvB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,KAClD,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEjD,MAAM,MAAM,2BAA2B,GAAG;IACxC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;CAC9D,CAAC;AAEF,MAAM,MAAM,yBAAyB,GACjC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAClB;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AA6F1C,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,MAAM,EACX,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAC5C,YAAY,GAAE,2BAAgC,GAC7C,OAAO,CAAC,yBAAyB,CAAC,CAkBpC"}

package/dist/core/process-identity.js

@@ -0,0 +1,104 @@
+import { execFile } from "node:child_process";
+import { readFile } from "node:fs/promises";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+function errorCode(error) {
+    return error instanceof Error && "code" in error
+        ? String(error.code)
+        : undefined;
+}
+function probePid(pid) {
+    try {
+        process.kill(pid, 0);
+        return "alive";
+    }
+    catch (error) {
+        const code = errorCode(error);
+        return code === "ESRCH" ? "dead" : code === "EPERM" ? "alive" : "unknown";
+    }
+}
+function parseLinuxStartTime(stat) {
+    const commandEnd = stat.lastIndexOf(")");
+    if (commandEnd === -1) {
+        return undefined;
+    }
+    const fieldsAfterCommand = stat
+        .slice(commandEnd + 1)
+        .trim()
+        .split(/\s+/u);
+    return fieldsAfterCommand[19];
+}
+async function inspectLinuxProcess(pid, dependencies) {
+    try {
+        const stat = dependencies.readProcessStat === undefined
+            ? await readFile(`/proc/${pid}/stat`, "utf8")
+            : await dependencies.readProcessStat(pid);
+        const startTime = parseLinuxStartTime(stat);
+        return startTime === undefined
+            ? { status: "unknown", reason: `could not parse /proc/${pid}/stat` }
+            : { status: "alive", identity: `linux-proc-start:${startTime}` };
+    }
+    catch (error) {
+        const code = errorCode(error);
+        if (code === "ENOENT" || code === "ESRCH") {
+            const status = (dependencies.probeProcess ?? probePid)(pid);
+            if (status === "dead") {
+                return { status: "dead" };
+            }
+        }
+        return {
+            status: "unknown",
+            reason: `could not inspect /proc/${pid}/stat${code === undefined ? "" : ` (${code})`}`,
+        };
+    }
+}
+async function inspectMacProcess(pid, dependencies) {
+    try {
+        const runProcessCommand = dependencies.runProcessCommand ?? execFileAsync;
+        const { stdout } = await runProcessCommand("ps", ["-p", String(pid), "-o", "lstart="], {
+            encoding: "utf8",
+            env: {
+                ...process.env,
+                LANG: "C",
+                LC_ALL: "C",
+                TZ: "UTC",
+            },
+        });
+        const startTime = stdout.trim().replace(/\s+/gu, " ");
+        if (startTime.length === 0) {
+            return probePid(pid) === "dead"
+                ? { status: "dead" }
+                : { status: "unknown", reason: `ps returned no start identity for PID ${pid}` };
+        }
+        return { status: "alive", identity: `darwin-ps-start:${startTime}` };
+    }
+    catch {
+        const pidStatus = probePid(pid);
+        if (pidStatus === "dead") {
+            return { status: "dead" };
+        }
+        return {
+            status: "unknown",
+            reason: `could not inspect process start identity for PID ${pid}`,
+        };
+    }
+}
+export async function inspectProcessIdentity(pid, platform = process.platform, dependencies = {}) {
+    if (!Number.isSafeInteger(pid) || pid <= 0) {
+        return { status: "unknown", reason: `invalid process ID ${pid}` };
+    }
+    if (platform === "linux") {
+        return inspectLinuxProcess(pid, dependencies);
+    }
+    if (platform === "darwin") {
+        return inspectMacProcess(pid, dependencies);
+    }
+    const status = probePid(pid);
+    return status === "dead"
+        ? { status: "dead" }
+        : {
+            status: "unknown",
+            reason: `process start identity is unsupported on ${platform}`,
+        };
+}
+//# sourceMappingURL=process-identity.js.map

package/dist/core/process-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-identity.js","sourceRoot":"","sources":["../../src/core/process-identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAmB1C,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK;QAC9C,CAAC,CAAC,MAAM,CAAE,KAA+B,CAAC,IAAI,CAAC;QAC/C,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,kBAAkB,GAAG,IAAI;SAC5B,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC;SACrB,IAAI,EAAE;SACN,KAAK,CAAC,MAAM,CAAC,CAAC;IACjB,OAAO,kBAAkB,CAAC,EAAE,CAAC,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,GAAW,EACX,YAAyC;IAEzC,IAAI,CAAC;QACH,MAAM,IAAI,GACR,YAAY,CAAC,eAAe,KAAK,SAAS;YACxC,CAAC,CAAC,MAAM,QAAQ,CAAC,SAAS,GAAG,OAAO,EAAE,MAAM,CAAC;YAC7C,CAAC,CAAC,MAAM,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC5C,OAAO,SAAS,KAAK,SAAS;YAC5B,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,yBAAyB,GAAG,OAAO,EAAE;YACpE,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,oBAAoB,SAAS,EAAE,EAAE,CAAC;IACrE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,CAAC,YAAY,CAAC,YAAY,IAAI,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC;YAC5D,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,2BAA2B,GAAG,QAAQ,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,EAAE;SACvF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,GAAW,EACX,YAAyC;IAEzC,IAAI,CAAC;QACH,MAAM,iBAAiB,GACrB,YAAY,CAAC,iBAAiB,IAAK,aAAmC,CAAC;QACzE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE;YACrF,QAAQ,EAAE,MAAM;YAChB,GAAG,EAAE;gBACH,GAAG,OAAO,CAAC,GAAG;gBACd,IAAI,EAAE,GAAG;gBACT,MAAM,EAAE,GAAG;gBACX,EAAE,EAAE,KAAK;aACV;SACF,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACtD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,QAAQ,CAAC,GAAG,CAAC,KAAK,MAAM;gBAC7B,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE;gBACpB,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,yCAAyC,GAAG,EAAE,EAAE,CAAC;QACpF,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,mBAAmB,SAAS,EAAE,EAAE,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;YACzB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC5B,CAAC;QACD,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,oDAAoD,GAAG,EAAE;SAClE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAW,EACX,QAAQ,GAAoB,OAAO,CAAC,QAAQ,EAC5C,YAAY,GAAgC,EAAE;IAE9C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,sBAAsB,GAAG,EAAE,EAAE,CAAC;IACpE,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,mBAAmB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,iBAAiB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,MAAM,KAAK,MAAM;QACtB,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE;QACpB,CAAC,CAAC;YACE,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,4CAA4C,QAAQ,EAAE;SAC/D,CAAC;AACR,CAAC"}

package/dist/core/redaction.d.ts

@@ -0,0 +1,4 @@
+import type { AuditReport } from "../contracts/report.js";
+export declare function redactAuditValue<T>(value: T, home: string, salt: string): T;
+export declare function redactAuditReport(report: AuditReport, salt: string): AuditReport;
+//# sourceMappingURL=redaction.d.ts.map

package/dist/core/redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../../src/core/redaction.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAiG1D,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,CAM3E;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAEhF"}

package/dist/core/redaction.js

@@ -0,0 +1,91 @@
+import { posix, win32 } from "node:path";
+import { sha256 } from "./digest.js";
+const IDENTIFIER_KEYS = new Set([
+    "Command",
+    "Image",
+    "Names",
+    "Repository",
+    "actionId",
+    "auditId",
+    "branch",
+    "canonicalKey",
+    "displayName",
+    "evidenceRef",
+    "externalId",
+    "findingId",
+    "head",
+    "id",
+    "resourceId",
+]);
+const PATH_KEYS = new Set([
+    "home",
+    "isolationPath",
+    "mountBoundaryPaths",
+    "path",
+    "projectRoot",
+    "root",
+]);
+const HOST_KEYS = new Set(["host", "hostname"]);
+function token(kind, value, salt) {
+    return `${kind}:${sha256(`${salt}\0${value}`).slice(0, 16)}`;
+}
+function redactPath(value, home, salt) {
+    if (value === home) {
+        return "$HOME";
+    }
+    if (value.startsWith(`${home}${posix.sep}`) || value.startsWith(`${home}${win32.sep}`)) {
+        return `$HOME/<${token("path", value, salt)}>`;
+    }
+    return posix.isAbsolute(value) || win32.isAbsolute(value)
+        ? `$PATH/<${token("path", value, salt)}>`
+        : value;
+}
+function replacePathMatch(matched, context) {
+    const suffix = matched.match(/[),.;:]+$/u)?.[0] ?? "";
+    const path = suffix === "" ? matched : matched.slice(0, -suffix.length);
+    return `${redactPath(path, context.home, context.salt)}${suffix}`;
+}
+function redactText(value, context) {
+    let output = value;
+    output = output.replace(/\\\\[\s\S]*/gu, (matched) => replacePathMatch(matched, context));
+    output = output.replace(/(?<!\\)\\(?!\\)[\s\S]*/gu, (matched) => replacePathMatch(matched, context));
+    output = output.replace(/(?<![$\w>])\/[\s\S]*/gu, (matched) => replacePathMatch(matched, context));
+    return output.replace(/\b[A-Za-z]:\\[\s\S]*/gu, (matched) => replacePathMatch(matched, context));
+}
+function redactValue(value, context, key) {
+    if (typeof value === "string") {
+        if (key !== undefined && IDENTIFIER_KEYS.has(key)) {
+            return token("id", value, context.salt);
+        }
+        if (key !== undefined && PATH_KEYS.has(key)) {
+            return redactPath(value, context.home, context.salt);
+        }
+        return redactText(value, context);
+    }
+    if (Array.isArray(value)) {
+        return value.map((item) => redactValue(item, context, key));
+    }
+    if (typeof value !== "object" || value === null) {
+        return value;
+    }
+    const output = {};
+    for (const [childKey, childValue] of Object.entries(value)) {
+        if (HOST_KEYS.has(childKey)) {
+            continue;
+        }
+        output[childKey] =
+            childKey === "candidateActions" ? [] : redactValue(childValue, context, childKey);
+    }
+    return output;
+}
+export function redactAuditValue(value, home, salt) {
+    const context = {
+        home,
+        salt,
+    };
+    return redactValue(value, context);
+}
+export function redactAuditReport(report, salt) {
+    return redactAuditValue(report, report.home, salt);
+}
+//# sourceMappingURL=redaction.js.map

package/dist/core/redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../../src/core/redaction.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAGzC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,SAAS;IACT,OAAO;IACP,OAAO;IACP,YAAY;IACZ,UAAU;IACV,SAAS;IACT,QAAQ;IACR,cAAc;IACd,aAAa;IACb,aAAa;IACb,YAAY;IACZ,WAAW;IACX,MAAM;IACN,IAAI;IACJ,YAAY;CACb,CAAC,CAAC;AACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,MAAM;IACN,eAAe;IACf,oBAAoB;IACpB,MAAM;IACN,aAAa;IACb,MAAM;CACP,CAAC,CAAC;AACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAOhD,SAAS,KAAK,CAAC,IAAY,EAAE,KAAa,EAAE,IAAY;IACtD,OAAO,GAAG,IAAI,IAAI,MAAM,CAAC,GAAG,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,UAAU,CAAC,KAAa,EAAE,IAAY,EAAE,IAAY;IAC3D,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QACvF,OAAO,UAAU,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QACvD,CAAC,CAAC,UAAU,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG;QACzC,CAAC,CAAC,KAAK,CAAC;AACZ,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe,EAAE,OAAyB;IAClE,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACtD,MAAM,IAAI,GAAG,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxE,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,UAAU,CAAC,KAAa,EAAE,OAAyB;IAC1D,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1F,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,0BAA0B,EAAE,CAAC,OAAO,EAAE,EAAE,CAC9D,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CACnC,CAAC;IACF,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,wBAAwB,EAAE,CAAC,OAAO,EAAE,EAAE,CAC5D,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CACnC,CAAC;IACF,OAAO,MAAM,CAAC,OAAO,CAAC,wBAAwB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AACnG,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,OAAyB,EAAE,GAAY;IAC1E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,GAAG,KAAK,SAAS,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClD,OAAO,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,GAAG,KAAK,SAAS,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5C,OAAO,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3D,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,MAAM,CAAC,QAAQ,CAAC;YACd,QAAQ,KAAK,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAI,KAAQ,EAAE,IAAY,EAAE,IAAY;IACtE,MAAM,OAAO,GAAqB;QAChC,IAAI;QACJ,IAAI;KACL,CAAC;IACF,OAAO,WAAW,CAAC,KAAK,EAAE,OAAO,CAAM,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAmB,EAAE,IAAY;IACjE,OAAO,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrD,CAAC"}

package/dist/core/safety.d.ts

@@ -1,7 +1,15 @@
 export declare class UnsafeAuditRootError extends Error {
     readonly name = "UnsafeAuditRootError";
 }
+export declare class UnsafeDestructiveFixtureError extends Error {
+    readonly name = "UnsafeDestructiveFixtureError";
+}
 export declare function isPathInside(root: string, candidate: string): boolean;
 export declare function resolvePhysicalPath(candidate: string): Promise<string>;
 export declare function assertAuditRoot(candidate: string, realHome?: string): Promise<string>;
+export declare function assertDestructiveFixtureRoot(candidate: string, options?: {
+    temporaryRoot?: string;
+    realHome?: string;
+    repositoryRoot?: string;
+}): Promise<string>;
 //# sourceMappingURL=safety.d.ts.map

package/dist/core/safety.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"safety.d.ts","sourceRoot":"","sources":["../../src/core/safety.ts"],"names":[],"mappings":"AAIA,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,SAAkB,IAAI,0BAA0B;CACjD;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAGrE;AAED,wBAAsB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA0B5E;AAED,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,SAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAmB9F"}
+{"version":3,"file":"safety.d.ts","sourceRoot":"","sources":["../../src/core/safety.ts"],"names":[],"mappings":"AAIA,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,SAAkB,IAAI,0BAA0B;CACjD;AAED,qBAAa,6BAA8B,SAAQ,KAAK;IACtD,SAAkB,IAAI,mCAAmC;CAC1D;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAGrE;AAED,wBAAsB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA0B5E;AAED,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,SAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAmB9F;AAED,wBAAsB,4BAA4B,CAChD,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE;IACP,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;CACpB,GACL,OAAO,CAAC,MAAM,CAAC,CAiCjB"}

package/dist/core/safety.js

@@ -1,9 +1,12 @@
-import { homedir } from "node:os";
+import { homedir, tmpdir } from "node:os";
 import { realpath } from "node:fs/promises";
 import { basename, dirname, isAbsolute, parse, relative, resolve } from "node:path";
 export class UnsafeAuditRootError extends Error {
     name = "UnsafeAuditRootError";
 }
+export class UnsafeDestructiveFixtureError extends Error {
+    name = "UnsafeDestructiveFixtureError";
+}
 export function isPathInside(root, candidate) {
     const result = relative(resolve(root), resolve(candidate));
     return result === "" || (!result.startsWith("..") && !isAbsolute(result));
@@ -47,4 +50,29 @@ export async function assertAuditRoot(candidate, realHome = homedir()) {
     }
     return resolvedCandidate;
 }
+export async function assertDestructiveFixtureRoot(candidate, options = {}) {
+    const [resolvedCandidate, resolvedTemporaryRoot, resolvedHome, resolvedRepository] = await Promise.all([
+        realpath(resolve(candidate)),
+        realpath(resolve(options.temporaryRoot ?? tmpdir())),
+        realpath(resolve(options.realHome ?? homedir())),
+        realpath(resolve(options.repositoryRoot ?? process.cwd())),
+    ]);
+    if (resolvedCandidate === parse(resolvedCandidate).root) {
+        throw new UnsafeDestructiveFixtureError("destructive fixture cannot use the filesystem root");
+    }
+    if (resolvedCandidate === resolvedTemporaryRoot) {
+        throw new UnsafeDestructiveFixtureError("destructive fixture cannot use the temporary root");
+    }
+    if (!isPathInside(resolvedTemporaryRoot, resolvedCandidate)) {
+        throw new UnsafeDestructiveFixtureError("destructive fixture must be inside the selected temporary root");
+    }
+    if (resolvedCandidate === resolvedHome) {
+        throw new UnsafeDestructiveFixtureError("destructive fixture cannot use the real home");
+    }
+    if (isPathInside(resolvedCandidate, resolvedRepository) ||
+        isPathInside(resolvedRepository, resolvedCandidate)) {
+        throw new UnsafeDestructiveFixtureError("destructive fixture cannot overlap the repository checkout");
+    }
+    return resolvedCandidate;
+}
 //# sourceMappingURL=safety.js.map

package/dist/core/safety.js.map

@@ -1 +1 @@
-{"version":3,"file":"safety.js","sourceRoot":"","sources":["../../src/core/safety.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpF,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC3B,IAAI,GAAG,sBAAsB,CAAC;CACjD;AAED,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,SAAiB;IAC1D,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3D,OAAO,MAAM,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,SAAiB;IACzD,IAAI,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;YACxC,OAAO,OAAO,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IACE,CAAC,CACC,KAAK,YAAY,KAAK;gBACtB,MAAM,IAAI,KAAK;gBACd,KAA+B,CAAC,IAAI,KAAK,QAAQ,CACnD,EACD,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,MAAM,KAAK,CAAC;YACd,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAC/B,MAAM,GAAG,MAAM,CAAC;QAClB,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,SAAiB,EAAE,QAAQ,GAAG,OAAO,EAAE;IAC3E,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,CAAC,qCAAqC,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,CAAC,iBAAiB,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC1D,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5B,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;KAC5B,CAAC,CAAC;IAEH,IAAI,iBAAiB,KAAK,KAAK,CAAC,iBAAiB,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,MAAM,IAAI,oBAAoB,CAAC,qCAAqC,CAAC,CAAC;IACxE,CAAC;IAED,IAAI,iBAAiB,KAAK,YAAY,IAAI,YAAY,CAAC,iBAAiB,EAAE,YAAY,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,oBAAoB,CAAC,wDAAwD,CAAC,CAAC;IAC3F,CAAC;IAED,OAAO,iBAAiB,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"safety.js","sourceRoot":"","sources":["../../src/core/safety.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpF,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC3B,IAAI,GAAG,sBAAsB,CAAC;CACjD;AAED,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACpC,IAAI,GAAG,+BAA+B,CAAC;CAC1D;AAED,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,SAAiB;IAC1D,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3D,OAAO,MAAM,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,SAAiB;IACzD,IAAI,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;YACxC,OAAO,OAAO,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IACE,CAAC,CACC,KAAK,YAAY,KAAK;gBACtB,MAAM,IAAI,KAAK;gBACd,KAA+B,CAAC,IAAI,KAAK,QAAQ,CACnD,EACD,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,MAAM,KAAK,CAAC;YACd,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAC/B,MAAM,GAAG,MAAM,CAAC;QAClB,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,SAAiB,EAAE,QAAQ,GAAG,OAAO,EAAE;IAC3E,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,CAAC,qCAAqC,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,CAAC,iBAAiB,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC1D,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5B,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;KAC5B,CAAC,CAAC;IAEH,IAAI,iBAAiB,KAAK,KAAK,CAAC,iBAAiB,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,MAAM,IAAI,oBAAoB,CAAC,qCAAqC,CAAC,CAAC;IACxE,CAAC;IAED,IAAI,iBAAiB,KAAK,YAAY,IAAI,YAAY,CAAC,iBAAiB,EAAE,YAAY,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,oBAAoB,CAAC,wDAAwD,CAAC,CAAC;IAC3F,CAAC;IAED,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,SAAiB,EACjB,OAAO,GAIH,EAAE;IAEN,MAAM,CAAC,iBAAiB,EAAE,qBAAqB,EAAE,YAAY,EAAE,kBAAkB,CAAC,GAChF,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5B,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,IAAI,MAAM,EAAE,CAAC,CAAC;QACpD,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,EAAE,CAAC,CAAC;QAChD,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;KAC3D,CAAC,CAAC;IAEL,IAAI,iBAAiB,KAAK,KAAK,CAAC,iBAAiB,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,MAAM,IAAI,6BAA6B,CAAC,oDAAoD,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,iBAAiB,KAAK,qBAAqB,EAAE,CAAC;QAChD,MAAM,IAAI,6BAA6B,CAAC,mDAAmD,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,iBAAiB,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,6BAA6B,CACrC,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,IAAI,iBAAiB,KAAK,YAAY,EAAE,CAAC;QACvC,MAAM,IAAI,6BAA6B,CAAC,8CAA8C,CAAC,CAAC;IAC1F,CAAC;IACD,IACE,YAAY,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;QACnD,YAAY,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,EACnD,CAAC;QACD,MAAM,IAAI,6BAA6B,CACrC,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,OAAO,iBAAiB,CAAC;AAC3B,CAAC"}