audit-tools 0.28.0

package/dist/remediate/steps/types.d.ts

@@ -0,0 +1,83 @@
+export declare const REMEDIATION_STEP_CONTRACT_VERSION: "remediate-code-step/v1alpha1";
+export declare const REMEDIATION_DISPATCH_PLAN_CONTRACT_VERSION: "remediate-code-dispatch-plan/v1alpha1";
+export declare const REMEDIATION_WORKER_RESULT_CONTRACT_VERSION: "remediate-code-worker-result/v1alpha1";
+export type RemediationStepKind = "confirm_intent" | "confirm_auto_discovered_input" | "confirm_resume_or_restart" | "locate_input" | "collect_starting_point" | "synthesize_intake" | "collect_intake_clarifications" | "contract_pipeline" | "collect_review_approval" | "collect_clarifications" | "dispatch_implement" | "dispatch_implement_rolling" | "implement_rolling_sequential" | "collect_triage" | "close_run" | "present_report" | "input_conflict" | "unhandled_state" | "zero_documentable_findings";
+import type { StepStatus, DispatchModelHint, AccessDeclaration } from "audit-tools/shared";
+export type { AccessDeclaration };
+export type RemediationStepStatus = StepStatus;
+export interface RemediationStep {
+    contract_version: typeof REMEDIATION_STEP_CONTRACT_VERSION;
+    step_kind: RemediationStepKind;
+    status: RemediationStepStatus;
+    prompt_path: string;
+    run_id: string;
+    repo_root: string;
+    artifacts_dir: string;
+    allowed_commands: string[];
+    stop_condition: string;
+    artifact_paths: Record<string, string>;
+    access?: AccessDeclaration;
+}
+export type DispatchPhase = "document" | "implement";
+export type { DispatchModelTier, DispatchModelHint, } from "audit-tools/shared";
+export interface DispatchPlanItem {
+    task_id: string;
+    finding_id?: string;
+    block_id?: string;
+    prompt_path: string;
+    result_path: string;
+    artifact_paths?: Record<string, string>;
+    model_hint?: DispatchModelHint;
+    access?: AccessDeclaration;
+}
+export interface RemediationDispatchPlan {
+    contract_version: typeof REMEDIATION_DISPATCH_PLAN_CONTRACT_VERSION;
+    phase: DispatchPhase;
+    run_id: string;
+    repo_root: string;
+    artifacts_dir: string;
+    items: DispatchPlanItem[];
+}
+export interface ImplementWorkerItemResult {
+    finding_id: string;
+    status: "resolved" | "blocked";
+    evidence?: string[];
+    failure_reason?: string;
+}
+export interface ImplementWorkerResult {
+    contract_version: typeof REMEDIATION_WORKER_RESULT_CONTRACT_VERSION;
+    phase: "implement";
+    item_results: ImplementWorkerItemResult[];
+    /**
+     * Paths the worker edited outside its declared contract scope. Used by
+     * `mergeImplementResults` to gate amendment claims through the ownership
+     * registry: unowned paths are granted and added to the block's effective scope
+     * for verification; owned/contended paths block the item and emit a seam
+     * conflict event.
+     */
+    amended_files?: string[];
+}
+export declare const REMEDIATION_CLOSING_RESULT_CONTRACT_VERSION: "remediate-code-closing-result/v1alpha1";
+export declare const REMEDIATION_DISPATCH_QUOTA_CONTRACT_VERSION: "remediate-code-dispatch-quota/v1alpha2";
+export type { HostConcurrencyLimitSource, HostConcurrencyLimit } from "audit-tools/shared";
+export type { LimitSource, LimitConfidence, ResolvedLimits, BackoffState, WaveBindingCap, DispatchCapacityPoolSummary, } from "audit-tools/shared";
+export type { QuotaUsageSnapshot } from "audit-tools/shared";
+import type { HostConcurrencyLimit, LimitSource, LimitConfidence, ResolvedLimits, BackoffState, QuotaUsageSnapshot, WaveBindingCap, DispatchCapacityPoolSummary } from "audit-tools/shared";
+export interface RemediationDispatchQuota {
+    contract_version: typeof REMEDIATION_DISPATCH_QUOTA_CONTRACT_VERSION | "remediate-code-dispatch-quota/v1alpha1";
+    run_id: string;
+    phase: DispatchPhase;
+    host_concurrency_limit: HostConcurrencyLimit | null;
+    max_concurrent_agents: number;
+    estimated_wave_tokens: number;
+    model: string | null;
+    confidence: LimitConfidence;
+    source: LimitSource;
+    resolved_limits: ResolvedLimits;
+    cooldown_until: string | null;
+    binding_cap?: WaveBindingCap;
+    capacity_pools?: DispatchCapacityPoolSummary[];
+    quota_source_snapshot?: QuotaUsageSnapshot | null;
+    backoff_state?: BackoffState | null;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/remediate/steps/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/remediate/steps/types.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iCAAiC,EAC5C,8BAAuC,CAAC;AAE1C,eAAO,MAAM,0CAA0C,EACrD,uCAAgD,CAAC;AAEnD,eAAO,MAAM,0CAA0C,EACrD,uCAAgD,CAAC;AAEnD,MAAM,MAAM,mBAAmB,GAC3B,gBAAgB,GAChB,+BAA+B,GAC/B,2BAA2B,GAC3B,cAAc,GACd,wBAAwB,GACxB,mBAAmB,GACnB,+BAA+B,GAC/B,mBAAmB,GACnB,yBAAyB,GACzB,wBAAwB,GACxB,oBAAoB,GACpB,4BAA4B,GAC5B,8BAA8B,GAC9B,gBAAgB,GAChB,WAAW,GACX,gBAAgB,GAChB,gBAAgB,GAChB,iBAAiB,GACjB,4BAA4B,CAAC;AAEjC,OAAO,KAAK,EACV,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,oBAAoB,CAAC;AAM5B,YAAY,EAAE,iBAAiB,EAAE,CAAC;AAElC,MAAM,MAAM,qBAAqB,GAAG,UAAU,CAAC;AAE/C,MAAM,WAAW,eAAe;IAC9B,gBAAgB,EAAE,OAAO,iCAAiC,CAAC;IAC3D,SAAS,EAAE,mBAAmB,CAAC;IAC/B,MAAM,EAAE,qBAAqB,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,WAAW,CAAC;AAErD,YAAY,EACV,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACtC,gBAAgB,EAAE,OAAO,0CAA0C,CAAC;IACpE,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,gBAAgB,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,EAAE,OAAO,0CAA0C,CAAC;IACpE,KAAK,EAAE,WAAW,CAAC;IACnB,YAAY,EAAE,yBAAyB,EAAE,CAAC;IAC1C;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,eAAO,MAAM,2CAA2C,EACtD,wCAAiD,CAAC;AAEpD,eAAO,MAAM,2CAA2C,EACtD,wCAAiD,CAAC;AAEpD,YAAY,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC3F,YAAY,EACV,WAAW,EACX,eAAe,EACf,cAAc,EACd,YAAY,EACZ,cAAc,EACd,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,OAAO,KAAK,EACV,oBAAoB,EACpB,WAAW,EACX,eAAe,EACf,cAAc,EACd,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,2BAA2B,EAC5B,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,wBAAwB;IACvC,gBAAgB,EACZ,OAAO,2CAA2C,GAClD,wCAAwC,CAAC;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,aAAa,CAAC;IACrB,sBAAsB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACpD,qBAAqB,EAAE,MAAM,CAAC;IAC9B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,eAAe,CAAC;IAC5B,MAAM,EAAE,WAAW,CAAC;IACpB,eAAe,EAAE,cAAc,CAAC;IAChC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B,cAAc,CAAC,EAAE,2BAA2B,EAAE,CAAC;IAC/C,qBAAqB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAClD,aAAa,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;CACrC"}

package/dist/remediate/steps/types.js

@@ -0,0 +1,6 @@
+export const REMEDIATION_STEP_CONTRACT_VERSION = "remediate-code-step/v1alpha1";
+export const REMEDIATION_DISPATCH_PLAN_CONTRACT_VERSION = "remediate-code-dispatch-plan/v1alpha1";
+export const REMEDIATION_WORKER_RESULT_CONTRACT_VERSION = "remediate-code-worker-result/v1alpha1";
+export const REMEDIATION_CLOSING_RESULT_CONTRACT_VERSION = "remediate-code-closing-result/v1alpha1";
+export const REMEDIATION_DISPATCH_QUOTA_CONTRACT_VERSION = "remediate-code-dispatch-quota/v1alpha2";
+//# sourceMappingURL=types.js.map

package/dist/remediate/steps/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/remediate/steps/types.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iCAAiC,GAC5C,8BAAuC,CAAC;AAE1C,MAAM,CAAC,MAAM,0CAA0C,GACrD,uCAAgD,CAAC;AAEnD,MAAM,CAAC,MAAM,0CAA0C,GACrD,uCAAgD,CAAC;AAmGnD,MAAM,CAAC,MAAM,2CAA2C,GACtD,wCAAiD,CAAC;AAEpD,MAAM,CAAC,MAAM,2CAA2C,GACtD,wCAAiD,CAAC"}

package/dist/remediate/types/options.d.ts

@@ -0,0 +1,6 @@
+export interface OrchestratorOptions {
+    root: string;
+    artifactsDir: string;
+    input?: string;
+}
+//# sourceMappingURL=options.d.ts.map

package/dist/remediate/types/options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../../../src/remediate/types/options.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB"}

package/dist/remediate/types/options.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=options.js.map

package/dist/remediate/types/options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../../../src/remediate/types/options.ts"],"names":[],"mappings":""}

package/dist/remediate/types/workerSession.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Worker tasks serialize directly to task.json, so their persisted field names
+ * intentionally stay snake_case for consistency across providers and bridges.
+ */
+export interface WorkerTask {
+    contract_version: "remediation-worker/v1alpha1";
+    run_id: string;
+    repo_root: string;
+    artifacts_dir: string;
+    obligation_id: string | null;
+    preferred_executor: string;
+    result_path: string;
+    audit_results_path?: string;
+    pending_audit_tasks_path?: string;
+    runtime_updates_path?: string;
+    external_analyzer_results_path?: string;
+    /**
+     * Subprocess timeout in milliseconds. Must be > 0; values ≤ 0 cause immediate kills.
+     * Recommended range: 30_000–600_000 (30 s – 10 min). Omit to inherit the provider default.
+     */
+    timeout_ms?: number;
+    /**
+     * Maximum number of retry attempts after a failed step. Must be ≥ 0.
+     * Recommended maximum: 5. Omit to use the provider default (typically 0 = no retries).
+     */
+    max_retries?: number;
+    /**
+     * Command and arguments for the LocalSubprocessProvider to launch directly.
+     * When present, LocalSubprocessProvider uses worker_command[0] as the executable
+     * and worker_command.slice(1) as its arguments instead of throwing.
+     */
+    worker_command?: string[];
+}
+export { resolveWorkerTaskTimeoutMs } from "audit-tools/shared";
+export declare function resolveWorkerTaskMaxRetries(task: Pick<WorkerTask, "max_retries">, fallbackRetries: number): number;
+//# sourceMappingURL=workerSession.d.ts.map

package/dist/remediate/types/workerSession.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workerSession.d.ts","sourceRoot":"","sources":["../../../src/remediate/types/workerSession.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,gBAAgB,EAAE,6BAA6B,CAAC;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,8BAA8B,CAAC,EAAE,MAAM,CAAC;IACxC;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAKD,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAEhE,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,EACrC,eAAe,EAAE,MAAM,GACtB,MAAM,CASR"}

package/dist/remediate/types/workerSession.js

@@ -0,0 +1,13 @@
+// Timeout resolution now lives in `audit-tools/shared` so both orchestrators
+// honor per-task `timeout_ms` identically. Re-exported here to preserve the
+// existing local import surface.
+export { resolveWorkerTaskTimeoutMs } from "audit-tools/shared";
+export function resolveWorkerTaskMaxRetries(task, fallbackRetries) {
+    if (typeof task.max_retries === "number" &&
+        Number.isFinite(task.max_retries) &&
+        task.max_retries >= 0) {
+        return Math.floor(task.max_retries);
+    }
+    return fallbackRetries;
+}
+//# sourceMappingURL=workerSession.js.map

package/dist/remediate/types/workerSession.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workerSession.js","sourceRoot":"","sources":["../../../src/remediate/types/workerSession.ts"],"names":[],"mappings":"AAkCA,6EAA6E;AAC7E,4EAA4E;AAC5E,iCAAiC;AACjC,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAEhE,MAAM,UAAU,2BAA2B,CACzC,IAAqC,EACrC,eAAuB;IAEvB,IACE,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;QACpC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC;QACjC,IAAI,CAAC,WAAW,IAAI,CAAC,EACrB,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/remediate/utils/commands.d.ts

@@ -0,0 +1,17 @@
+import { spawnSync, type SpawnSyncOptions } from "node:child_process";
+import { quoteForCmd, platformCommand, type RunTrackedOptions, type RunTrackedResult } from "audit-tools/shared";
+type SpawnResult = ReturnType<typeof spawnSync>;
+export { quoteForCmd, platformCommand };
+/**
+ * Run a command synchronously by argv. Delegates to the shared `runTracked`,
+ * which applies the single Windows `.cmd`/`.bat` wrapping implementation and
+ * never uses `shell: true`.
+ */
+export declare function runCommand(command: string, args: string[], options?: RunTrackedOptions): RunTrackedResult;
+/**
+ * Run a stored command *string* (e.g. a configured `test_command`) through the
+ * platform shell. argv-based callers should use `runCommand`/`runTracked`;
+ * this exists only for opaque single-string commands that need shell parsing.
+ */
+export declare function runShellCommand(command: string, options?: SpawnSyncOptions): SpawnResult;
+//# sourceMappingURL=commands.d.ts.map

package/dist/remediate/utils/commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../../src/remediate/utils/commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAEL,WAAW,EACX,eAAe,EACf,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAE5B,KAAK,WAAW,GAAG,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC;AAKhD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;AAExC;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE,iBAAsB,GAC9B,gBAAgB,CAElB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,gBAAqB,GAC7B,WAAW,CAKb"}

package/dist/remediate/utils/commands.js

@@ -0,0 +1,26 @@
+import { spawnSync } from "node:child_process";
+import { runTracked, quoteForCmd, platformCommand, } from "audit-tools/shared";
+// The Windows wrapping/quoting logic now lives in `audit-tools/shared`
+// (tooling/exec.ts) so the auditor and remediator share one implementation.
+// These re-exports preserve the import surface callers (and tests) rely on.
+export { quoteForCmd, platformCommand };
+/**
+ * Run a command synchronously by argv. Delegates to the shared `runTracked`,
+ * which applies the single Windows `.cmd`/`.bat` wrapping implementation and
+ * never uses `shell: true`.
+ */
+export function runCommand(command, args, options = {}) {
+    return runTracked([command, ...args], options);
+}
+/**
+ * Run a stored command *string* (e.g. a configured `test_command`) through the
+ * platform shell. argv-based callers should use `runCommand`/`runTracked`;
+ * this exists only for opaque single-string commands that need shell parsing.
+ */
+export function runShellCommand(command, options = {}) {
+    return spawnSync(command, {
+        ...options,
+        shell: true,
+    });
+}
+//# sourceMappingURL=commands.js.map

package/dist/remediate/utils/commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../../src/remediate/utils/commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAyB,MAAM,oBAAoB,CAAC;AACtE,OAAO,EACL,UAAU,EACV,WAAW,EACX,eAAe,GAGhB,MAAM,oBAAoB,CAAC;AAI5B,uEAAuE;AACvE,4EAA4E;AAC5E,4EAA4E;AAC5E,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;AAExC;;;;GAIG;AACH,MAAM,UAAU,UAAU,CACxB,OAAe,EACf,IAAc,EACd,UAA6B,EAAE;IAE/B,OAAO,UAAU,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAe,EACf,UAA4B,EAAE;IAE9B,OAAO,SAAS,CAAC,OAAO,EAAE;QACxB,GAAG,OAAO;QACV,KAAK,EAAE,IAAI;KACZ,CAAC,CAAC;AACL,CAAC"}

package/dist/remediate/utils/fileIntegrity.d.ts

@@ -0,0 +1,27 @@
+import type { Finding } from "../state/types.js";
+export declare function hashFileSync(absolutePath: string): string | undefined;
+export declare function hashFile(absolutePath: string): Promise<string | undefined>;
+export declare function resolveAffectedPath(root: string, affectedPath: string): string;
+export declare function hashAffectedPathSync(root: string, affectedPath: string): string | undefined;
+export declare function hashAffectedPath(root: string, affectedPath: string): Promise<string | undefined>;
+export interface AffectedFileIntegrityResult {
+    changed: string[];
+    missing: string[];
+    /**
+     * Files that exist on disk but could not be read (a real I/O error such as
+     * EACCES/EISDIR). Kept distinct from `missing` so a genuine read failure is
+     * not silently reclassified as an absent file. Mirrors the audit-code
+     * `FileIntegrityResult.io_errors` channel.
+     */
+    io_errors: string[];
+    is_clean: boolean;
+}
+export declare function checkAffectedFileIntegrity(root: string, findings: Finding[]): Promise<AffectedFileIntegrityResult>;
+export declare function snapshotAffectedFileHashes(root: string, findings: Finding[]): void;
+/**
+ * Force-update every affected file's stored hash to its current content. Use
+ * after the implement phase legitimately rewrites files, so a later integrity
+ * check does not flag the run's own edits as a stale plan.
+ */
+export declare function resnapshotAffectedFileHashes(root: string, findings: Finding[]): void;
+//# sourceMappingURL=fileIntegrity.d.ts.map

package/dist/remediate/utils/fileIntegrity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileIntegrity.d.ts","sourceRoot":"","sources":["../../../src/remediate/utils/fileIntegrity.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAuBjD,wBAAgB,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CASrE;AAED,wBAAsB,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAShF;AAwDD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,GACnB,MAAM,GAAG,SAAS,CAYpB;AAED,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAY7B;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;;;;OAKG;IACH,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,OAAO,EAAE,GAClB,OAAO,CAAC,2BAA2B,CAAC,CA8CtC;AAED,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,OAAO,EAAE,GAClB,IAAI,CAON;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,OAAO,EAAE,GAClB,IAAI,CAMN"}

package/dist/remediate/utils/fileIntegrity.js

@@ -0,0 +1,201 @@
+import { hashContent } from "audit-tools/shared";
+import { readFile, readdir, stat } from "node:fs/promises";
+import { join, isAbsolute, relative, sep } from "node:path";
+import { existsSync, readFileSync, readdirSync, statSync, } from "node:fs";
+/**
+ * On a non-ENOENT read failure, surface a structured stderr line before
+ * swallowing the error, so a genuine I/O problem leaves a trace rather than
+ * disappearing into an `undefined` return. ENOENT is silent here — an absent
+ * file is the caller's `missing` concern, not an error.
+ */
+function reportHashIoError(absolutePath, err) {
+    const code = err.code;
+    if (code === "ENOENT")
+        return;
+    process.stderr.write(JSON.stringify({
+        level: "warn",
+        event: "file_integrity_io_error",
+        path: absolutePath,
+        code: code ?? null,
+        message: String(err),
+        ts: new Date().toISOString(),
+    }) + "\n");
+}
+export function hashFileSync(absolutePath) {
+    if (!existsSync(absolutePath))
+        return undefined;
+    try {
+        const content = readFileSync(absolutePath);
+        return hashContent(content);
+    }
+    catch (err) {
+        reportHashIoError(absolutePath, err);
+        return undefined;
+    }
+}
+export async function hashFile(absolutePath) {
+    if (!existsSync(absolutePath))
+        return undefined;
+    try {
+        const content = await readFile(absolutePath);
+        return hashContent(content);
+    }
+    catch (err) {
+        reportHashIoError(absolutePath, err);
+        return undefined;
+    }
+}
+function toDisplayRelativePath(root, absolutePath) {
+    return relative(root, absolutePath).split(sep).join("/");
+}
+function sortDirents(a, b) {
+    return a.name.localeCompare(b.name);
+}
+// Directory digest: build a canonical "directory\n" + (relpath \0 file-hash \0)
+// manifest string from a depth-first, name-sorted walk, then hash it once via
+// the shared primitive. Per-file content hashes also route through hashContent —
+// no inline createHash remains.
+function hashDirectorySync(root, absolutePath) {
+    const parts = ["directory\n"];
+    const visit = (dir) => {
+        const entries = readdirSync(dir, { withFileTypes: true }).sort(sortDirents);
+        for (const entry of entries) {
+            const child = join(dir, entry.name);
+            if (entry.isDirectory()) {
+                visit(child);
+                continue;
+            }
+            if (!entry.isFile())
+                continue;
+            const content = readFileSync(child);
+            parts.push(toDisplayRelativePath(root, child), "\0", hashContent(content), "\0");
+        }
+    };
+    visit(absolutePath);
+    return hashContent(parts.join(""));
+}
+async function hashDirectory(root, absolutePath) {
+    const parts = ["directory\n"];
+    const visit = async (dir) => {
+        const entries = (await readdir(dir, { withFileTypes: true })).sort(sortDirents);
+        for (const entry of entries) {
+            const child = join(dir, entry.name);
+            if (entry.isDirectory()) {
+                await visit(child);
+                continue;
+            }
+            if (!entry.isFile())
+                continue;
+            const content = await readFile(child);
+            parts.push(toDisplayRelativePath(root, child), "\0", hashContent(content), "\0");
+        }
+    };
+    await visit(absolutePath);
+    return hashContent(parts.join(""));
+}
+export function resolveAffectedPath(root, affectedPath) {
+    return isAbsolute(affectedPath) ? affectedPath : join(root, affectedPath);
+}
+export function hashAffectedPathSync(root, affectedPath) {
+    const absolutePath = resolveAffectedPath(root, affectedPath);
+    if (!existsSync(absolutePath))
+        return undefined;
+    try {
+        const pathStat = statSync(absolutePath);
+        if (pathStat.isDirectory())
+            return hashDirectorySync(root, absolutePath);
+        if (pathStat.isFile())
+            return hashFileSync(absolutePath);
+        return undefined;
+    }
+    catch (err) {
+        reportHashIoError(absolutePath, err);
+        return undefined;
+    }
+}
+export async function hashAffectedPath(root, affectedPath) {
+    const absolutePath = resolveAffectedPath(root, affectedPath);
+    if (!existsSync(absolutePath))
+        return undefined;
+    try {
+        const pathStat = await stat(absolutePath);
+        if (pathStat.isDirectory())
+            return await hashDirectory(root, absolutePath);
+        if (pathStat.isFile())
+            return await hashFile(absolutePath);
+        return undefined;
+    }
+    catch (err) {
+        reportHashIoError(absolutePath, err);
+        return undefined;
+    }
+}
+export async function checkAffectedFileIntegrity(root, findings) {
+    const changed = [];
+    const missing = [];
+    const ioErrors = [];
+    const checked = new Set();
+    for (const finding of findings) {
+        for (const af of finding.affected_files) {
+            if (!af.hash_at_plan_time || checked.has(af.path))
+                continue;
+            checked.add(af.path);
+            const absolute = resolveAffectedPath(root, af.path);
+            // Distinguish an absent file (missing) from a file that exists but cannot
+            // be read (io_errors): a non-ENOENT failure is a real I/O error, not a
+            // missing file, so it must not be folded into `missing`.
+            if (!existsSync(absolute)) {
+                missing.push(af.path);
+                continue;
+            }
+            try {
+                const currentHash = await hashAffectedPath(root, af.path);
+                if (!currentHash) {
+                    ioErrors.push(af.path);
+                    continue;
+                }
+                if (currentHash !== af.hash_at_plan_time) {
+                    changed.push(af.path);
+                }
+            }
+            catch (err) {
+                const code = err.code;
+                if (code === "ENOENT") {
+                    missing.push(af.path);
+                }
+                else {
+                    reportHashIoError(absolute, err);
+                    ioErrors.push(af.path);
+                }
+            }
+        }
+    }
+    return {
+        changed,
+        missing,
+        io_errors: ioErrors,
+        is_clean: changed.length === 0 && missing.length === 0 && ioErrors.length === 0,
+    };
+}
+export function snapshotAffectedFileHashes(root, findings) {
+    for (const finding of findings) {
+        for (const af of finding.affected_files) {
+            if (af.hash_at_plan_time)
+                continue;
+            af.hash_at_plan_time = hashAffectedPathSync(root, af.path);
+        }
+    }
+}
+/**
+ * Force-update every affected file's stored hash to its current content. Use
+ * after the implement phase legitimately rewrites files, so a later integrity
+ * check does not flag the run's own edits as a stale plan.
+ */
+export function resnapshotAffectedFileHashes(root, findings) {
+    for (const finding of findings) {
+        for (const af of finding.affected_files) {
+            af.hash_at_plan_time = hashAffectedPathSync(root, af.path);
+        }
+    }
+}
+//# sourceMappingURL=fileIntegrity.js.map

package/dist/remediate/utils/fileIntegrity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileIntegrity.js","sourceRoot":"","sources":["../../../src/remediate/utils/fileIntegrity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EACL,UAAU,EACV,YAAY,EACZ,WAAW,EACX,QAAQ,GAET,MAAM,SAAS,CAAC;AAGjB;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,YAAoB,EAAE,GAAY;IAC3D,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;IACjD,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO;IAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;QACb,KAAK,EAAE,MAAM;QACb,KAAK,EAAE,yBAAyB;QAChC,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,IAAI,IAAI,IAAI;QAClB,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC;QACpB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAC7B,CAAC,GAAG,IAAI,CACV,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,YAAoB;IAC/C,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,SAAS,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QAC3C,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,iBAAiB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QACrC,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,YAAoB;IACjD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,SAAS,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC7C,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,iBAAiB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QACrC,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY,EAAE,YAAoB;IAC/D,OAAO,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACvC,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,gFAAgF;AAChF,8EAA8E;AAC9E,iFAAiF;AACjF,gCAAgC;AAChC,SAAS,iBAAiB,CAAC,IAAY,EAAE,YAAoB;IAC3D,MAAM,KAAK,GAAa,CAAC,aAAa,CAAC,CAAC;IAExC,MAAM,KAAK,GAAG,CAAC,GAAW,EAAQ,EAAE;QAClC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5E,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,KAAK,CAAC,KAAK,CAAC,CAAC;gBACb,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;gBAAE,SAAS;YAC9B,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;YACpC,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;QACnF,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,CAAC,YAAY,CAAC,CAAC;IACpB,OAAO,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,YAAoB;IAC7D,MAAM,KAAK,GAAa,CAAC,aAAa,CAAC,CAAC;IAExC,MAAM,KAAK,GAAG,KAAK,EAAE,GAAW,EAAiB,EAAE;QACjD,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAChF,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;gBACnB,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;gBAAE,SAAS;YAC9B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;QACnF,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC;IAC1B,OAAO,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,YAAoB;IACpE,OAAO,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,YAAoB;IAEpB,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC7D,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,SAAS,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;QACxC,IAAI,QAAQ,CAAC,WAAW,EAAE;YAAE,OAAO,iBAAiB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QACzE,IAAI,QAAQ,CAAC,MAAM,EAAE;YAAE,OAAO,YAAY,CAAC,YAAY,CAAC,CAAC;QACzD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,iBAAiB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QACrC,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAY,EACZ,YAAoB;IAEpB,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC7D,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,SAAS,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC;QAC1C,IAAI,QAAQ,CAAC,WAAW,EAAE;YAAE,OAAO,MAAM,aAAa,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAC3E,IAAI,QAAQ,CAAC,MAAM,EAAE;YAAE,OAAO,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC3D,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,iBAAiB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QACrC,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAeD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,IAAY,EACZ,QAAmB;IAEnB,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,MAAM,EAAE,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YACxC,IAAI,CAAC,EAAE,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC5D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YACrB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;YACpD,0EAA0E;YAC1E,uEAAuE;YACvE,yDAAyD;YACzD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1B,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;gBACtB,SAAS;YACX,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;gBAC1D,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;oBACvB,SAAS;gBACX,CAAC;gBACD,IAAI,WAAW,KAAK,EAAE,CAAC,iBAAiB,EAAE,CAAC;oBACzC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;gBACxB,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;gBACjD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACtB,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;gBACxB,CAAC;qBAAM,CAAC;oBACN,iBAAiB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;oBACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO;QACP,OAAO;QACP,SAAS,EAAE,QAAQ;QACnB,QAAQ,EACN,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;KACxE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,IAAY,EACZ,QAAmB;IAEnB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,MAAM,EAAE,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YACxC,IAAI,EAAE,CAAC,iBAAiB;gBAAE,SAAS;YACnC,EAAE,CAAC,iBAAiB,GAAG,oBAAoB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAC1C,IAAY,EACZ,QAAmB;IAEnB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,MAAM,EAAE,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YACxC,EAAE,CAAC,iBAAiB,GAAG,oBAAoB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/remediate/utils/hostAssets.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Strip YAML frontmatter from a text file, returning only the body.
+ * Single-sourced here; postinstall.mjs imports from the compiled output.
+ */
+export declare function splitFrontmatter(text: string): {
+    body: string;
+};
+/**
+ * Write a generated file, creating parent directories as needed.
+ * Returns "installed" on first write, "updated" on subsequent writes.
+ */
+export declare function writeGeneratedFile(path: string, content: Buffer): string;
+/**
+ * Coerce an unknown value to a plain object (non-array).
+ * Returns {} for primitives, arrays, and null.
+ */
+export declare function objectValue(value: unknown): Record<string, unknown>;
+//# sourceMappingURL=hostAssets.d.ts.map

package/dist/remediate/utils/hostAssets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hostAssets.d.ts","sourceRoot":"","sources":["../../../src/remediate/utils/hostAssets.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAI/D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAKxE;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAInE"}

package/dist/remediate/utils/hostAssets.js

@@ -0,0 +1,31 @@
+import { mkdirSync, existsSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+/**
+ * Strip YAML frontmatter from a text file, returning only the body.
+ * Single-sourced here; postinstall.mjs imports from the compiled output.
+ */
+export function splitFrontmatter(text) {
+    const normalized = text.replace(/\r\n/g, "\n");
+    const match = normalized.match(/^---\n[\s\S]*?\n---\n?/u);
+    return { body: match ? normalized.slice(match[0].length) : normalized };
+}
+/**
+ * Write a generated file, creating parent directories as needed.
+ * Returns "installed" on first write, "updated" on subsequent writes.
+ */
+export function writeGeneratedFile(path, content) {
+    const action = existsSync(path) ? "updated" : "installed";
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, content);
+    return action;
+}
+/**
+ * Coerce an unknown value to a plain object (non-array).
+ * Returns {} for primitives, arrays, and null.
+ */
+export function objectValue(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : {};
+}
+//# sourceMappingURL=hostAssets.js.map

package/dist/remediate/utils/hostAssets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hostAssets.js","sourceRoot":"","sources":["../../../src/remediate/utils/hostAssets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC1D,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;AAC1E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,OAAe;IAC9D,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;IAC1D,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAChE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,EAAE,CAAC;AACT,CAAC"}

package/dist/remediate/validation/artifacts.d.ts

@@ -0,0 +1,9 @@
+import { type ValidationIssue } from "audit-tools/shared";
+export interface ArtifactValidationResult {
+    status: "ok" | "error";
+    issue_count: number;
+    issues: string[];
+}
+export declare function validateImplementWorkerResult(value: unknown, path: string): ValidationIssue[];
+export declare function validateArtifacts(artifactsDir: string, root?: string): Promise<ArtifactValidationResult>;
+//# sourceMappingURL=artifacts.d.ts.map

package/dist/remediate/validation/artifacts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifacts.d.ts","sourceRoot":"","sources":["../../../src/remediate/validation/artifacts.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,KAAK,eAAe,EAIrB,MAAM,oBAAoB,CAAC;AAgB5B,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAiJD,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,MAAM,GACX,eAAe,EAAE,CA8BnB;AAsED,wBAAsB,iBAAiB,CACrC,YAAY,EAAE,MAAM,EACpB,IAAI,SAAM,GACT,OAAO,CAAC,wBAAwB,CAAC,CAmHnC"}