audit-tools 0.42.1 → 0.43.0

package/dist/shared/analyzers/acquisitionEngine.js

@@ -2,6 +2,7 @@ import { existsSync, readFileSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import { runTracked } from "../tooling/exec.js";
 import { normalizeGenericExternalResults, normalizeGenericExternalEdges, } from "./normalizeExternal.js";
+import { readParseOutcome, } from "./types.js";
 import { resolveBinary, } from "./binaryAcquisition.js";
 /**
  * F5 — external analyzer acquisition engine.
@@ -94,24 +95,77 @@ function runnerPrefix(runner, spec) {
         case "binary": return [];
     }
 }
+/**
+ * The denial vocabulary. An operator refusal and a tool nobody has decided on are
+ * DIFFERENT causes and must be distinguishable in the persisted status record — a
+ * single conflated string cannot tell an operator that their own decline was the
+ * reason. Every CONSENT-channel reason names "consent"; `setting_skip` deliberately
+ * does not, because it comes from the settings channel (`analyzers.<id> = "skip"`)
+ * and is not a consent decision at all.
+ */
+export const ANALYZER_DENIAL_REASONS = {
+    /** `analyzers.<id> = "skip"` — the settings channel, not the consent record. */
+    setting_skip: "setting=skip",
+    /** A recorded, durable operator refusal. Terminal: no token overrides it. */
+    consent_declined: "consent declined by the operator for this analyzer (recorded decision)",
+    /** No decision recorded and no token presented — nobody has said yes OR no. */
+    consent_not_decided: "consent not recorded for this analyzer (not yet decided; no consent token for this run)",
+    /** A token was presented, but it was issued for a different analyzer. */
+    consent_token_scope: "consent token was not issued for this analyzer (scoped consent covers other tools only)",
+};
+/**
+ * Does this consent input authorize THIS candidate?
+ *
+ * A scoped grant authorizes exactly the tools it names — a grant obtained by offering
+ * tool A cannot admit tool B. The legacy bare string carries no scope, so it can only
+ * be read as run-wide; it is accepted for compatibility with the acquisition entry
+ * point that still issues one, and is deliberately reported distinctly here so the
+ * unscoped case is visible rather than indistinguishable from a scoped grant.
+ */
+function consentTokenAdmits(consentToken, candidateId) {
+    if (consentToken === undefined || consentToken === null)
+        return "absent";
+    if (typeof consentToken === "string") {
+        return consentToken.trim().length > 0 ? "admit" : "absent";
+    }
+    if (typeof consentToken.value !== "string" || consentToken.value.trim().length === 0) {
+        return "absent";
+    }
+    if (!Array.isArray(consentToken.tools))
+        return "out_of_scope";
+    return consentToken.tools.includes(candidateId) ? "admit" : "out_of_scope";
+}
 /**
  * Single subprocess-SPAWN admission chokepoint. Returns the reason a spawn is
- * NOT admitted, or `undefined` when admitted. The DEFAULT set is admitted
- * without a token; EVERY other candidate — including `permanent`/`ephemeral`
- * pre-installed tools — requires EITHER a recorded "granted" decision OR a
- * per-run consent token (CE-005, revised with Item B).
+ * NOT admitted, or `undefined` when admitted.
+ *
+ * ORDER IS THE CONTRACT. A recorded `"declined"` is consulted FIRST — before the
+ * settings channel, before the DEFAULT-set short-circuit, and before any consent
+ * token — so an operator refusal is a veto for EVERY candidate, including a
+ * default-set member, and no token can override it. It also outranks
+ * `setting=skip`: both refuse, but only one of them is the operator's own decision,
+ * and the REASON is what tells them so. Only then: `skip`, then the DEFAULT set
+ * runs unprompted, a recorded `"granted"` admits, and finally a consent token
+ * admits the candidate it was issued for.
  */
 export function admitSpawn(candidate, setting, consentToken, recordedDecision) {
+    // A recorded refusal is terminal and is read BEFORE anything else — including the
+    // settings channel, which would otherwise mask the operator's own decision behind
+    // a reason that names a config value instead of their decline.
+    if (recordedDecision === "declined")
+        return ANALYZER_DENIAL_REASONS.consent_declined;
     if (setting === "skip")
-        return "setting=skip";
+        return ANALYZER_DENIAL_REASONS.setting_skip;
     if (candidate.defaultRun)
         return undefined;
-    // Admission: default set ∨ recorded "granted" ∨ per-run token
     if (recordedDecision === "granted")
         return undefined;
-    if (consentToken && consentToken.trim().length > 0)
+    const tokenVerdict = consentTokenAdmits(consentToken, candidate.id);
+    if (tokenVerdict === "admit")
         return undefined;
-    return "non-default tool requires consent (declined or not yet decided)";
+    if (tokenVerdict === "out_of_scope")
+        return ANALYZER_DENIAL_REASONS.consent_token_scope;
+    return ANALYZER_DENIAL_REASONS.consent_not_decided;
 }
 /**
  * The run-safety gate, written once: capability-probe the runner, then (if the
@@ -260,9 +314,11 @@ export function runExternalAnalyzer(candidate, root, options = {}) {
             /* best-effort */
         }
     }
-    let items;
+    const stderrText = typeof result.stderr === "string" ? result.stderr : "";
+    const stderrSnippet = stderrText.trim().length > 0 ? { stderr_snippet: stderrText.slice(0, 500) } : {};
+    let parsed;
     try {
-        items = candidate.parse(parseInput);
+        parsed = readParseOutcome(candidate.parse(parseInput));
     }
     catch (error) {
         return {
@@ -275,13 +331,21 @@ export function runExternalAnalyzer(candidate, root, options = {}) {
                 exit_code: result.status,
                 error: error instanceof Error ? error.message : String(error),
                 output_snippet: result.stdout.slice(0, 200),
+                ...stderrSnippet,
                 duration_ms: result.duration_ms,
             },
         };
     }
-    // readSource: content-anchored lead provenance (item C). Repo-rooted, degrade
-    // to no-provenance on any read failure — never blocks normalization.
+    const items = parsed.items;
+    // readSource: content-anchored lead provenance (item C). Paths are normalized to
+    // repo-relative FIRST (an absolute-path emitter would otherwise make `join(root,
+    // path)` name nothing, silently dropping provenance); a read that still fails is
+    // COUNTED onto the status, so a broken read seam is distinguishable from an item
+    // that legitimately carries no anchor.
+    let sourceReadFailures = 0;
+    let normalizerDroppedItems = 0;
     const normalized = normalizeGenericExternalResults(candidate.id, items, {
+        repoRoot: root,
         readSource: (path) => {
             try {
                 return readFileSync(join(root, path), "utf8");
@@ -290,10 +354,77 @@ export function runExternalAnalyzer(candidate, root, options = {}) {
                 return undefined;
             }
         },
+        onDiagnostics: (diagnostics) => {
+            sourceReadFailures = diagnostics.source_read_failures;
+            normalizerDroppedItems = diagnostics.dropped_items;
+        },
     });
     const edges = normalizeGenericExternalEdges(items);
     if (edges.length > 0)
         normalized.graph_edges = edges;
+    // Rows the PARSER could not use plus items the NORMALIZER discarded (missing path
+    // or summary) are the same question to a consumer — "how much did this run fail to
+    // report?" — so they land on one field. Counting only the parser's half left a run
+    // whose every item was dropped at normalization reading as a clean scan.
+    const droppedRows = (parsed.dropped_rows ?? 0) + normalizerDroppedItems;
+    const degradationFields = {
+        exit_code: result.status,
+        ...(droppedRows > 0 ? { dropped_rows: droppedRows } : {}),
+        ...(sourceReadFailures > 0 ? { source_read_failures: sourceReadFailures } : {}),
+        ...stderrSnippet,
+        duration_ms: result.duration_ms,
+    };
+    // AFFIRMATION, never a success-shaped empty. Zero items is only "success" when the
+    // run itself was clean: the tool exited 0, said nothing on stderr it did not also
+    // say on stdout, parsed, and dropped nothing. Every other zero-item outcome names
+    // its cause — the exit code and stderr are in hand right here, which is exactly
+    // why leaving them unconsulted made a broken analyzer read as a clean repo.
+    if (normalized.results.length === 0) {
+        // A NULL exit status means the child never exited on its own — it was killed by a
+        // signal (SIGKILL/OOM). `RunTrackedResult` carries no signal field, so null is the
+        // only trace of it, and it is emphatically not "exited cleanly". Treating it as
+        // clean also made the classification OS-divergent: win32 surfaces the same kill as
+        // a non-zero status, so the identical event would have been failed there and
+        // success on POSIX.
+        const exitMissing = result.status === null || result.status === undefined;
+        const exitedNonZero = exitMissing || result.status !== 0;
+        const stderrOnly = !exitedNonZero && stderrText.trim().length > 0 && parseInput.trim().length === 0;
+        if (exitedNonZero || stderrOnly) {
+            return {
+                results: emptyResults(candidate.id),
+                status: {
+                    tool: candidate.id,
+                    command,
+                    resolved: true,
+                    status: "failed",
+                    error: exitMissing
+                        ? "analyzer terminated without an exit status (killed by a signal) and produced no parsable findings"
+                        : exitedNonZero
+                            ? `analyzer exited ${result.status} with no parsable findings`
+                            : "analyzer produced no output other than stderr",
+                    output_snippet: result.stdout.slice(0, 200),
+                    ...degradationFields,
+                },
+            };
+        }
+        if (parsed.parse_failed || droppedRows > 0) {
+            return {
+                results: emptyResults(candidate.id),
+                status: {
+                    tool: candidate.id,
+                    command,
+                    resolved: true,
+                    status: "parse_error",
+                    error: parsed.note ??
+                        (parsed.parse_failed
+                            ? "analyzer output could not be parsed"
+                            : `analyzer output parsed with ${droppedRows} unusable row(s)`),
+                    output_snippet: parseInput.slice(0, 200),
+                    ...degradationFields,
+                },
+            };
+        }
+    }
     return {
         results: normalized,
         status: {
@@ -301,8 +432,8 @@ export function runExternalAnalyzer(candidate, root, options = {}) {
             command,
             resolved: true,
             status: normalized.results.length > 0 ? "findings" : "success",
-            exit_code: result.status,
-            duration_ms: result.duration_ms,
+            ...(parsed.note !== undefined ? { error: parsed.note } : {}),
+            ...degradationFields,
         },
     };
 }
@@ -361,10 +492,13 @@ export async function resolveBinaryCandidates(candidates, root, options = {}) {
             resolvedBinaries[candidate.id] = resolution.command;
         }
         else {
+            // A supply-chain event gets its OWN status member: "the release asset did not
+            // match the pinned checksums" must never be flattened into the same record as
+            // "this machine is offline", which is all a shared `not_resolved` could say.
             unresolvedStatuses.push({
                 tool: candidate.id,
                 resolved: false,
-                status: "not_resolved",
+                status: resolution.reason === "checksum_mismatch" ? "checksum_mismatch" : "not_resolved",
                 error: resolution.note ?? "binary unavailable",
             });
         }

package/dist/shared/analyzers/acquisitionEngine.js.map

@@ -1 +1 @@
-{"version":3,"file":"acquisitionEngine.js","sourceRoot":"","sources":["../../../src/shared/analyzers/acquisitionEngine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAyB,MAAM,oBAAoB,CAAC;AAEvE,OAAO,EACL,+BAA+B,EAC/B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAKhC,OAAO,EACL,aAAa,GAGd,MAAM,wBAAwB,CAAC;AAEhC;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS;IAC5C,aAAa;IACb,oBAAoB;CACrB,CAAC,CAAC;AAqFH,+EAA+E;AAC/E,SAAS,YAAY,CAAC,IAAY,EAAE,OAAiB;IACnD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC,SAAS,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAY;IACvD,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,MAAuB;IAC9C,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC1C,KAAK,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC5C,KAAK,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC9C,iFAAiF;QACjF,KAAK,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAAuB,EAAE,IAAY;IACzD,QAAQ,MAAM,EAAE,CAAC;QACf,qEAAqE;QACrE,KAAK,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACvC,KAAK,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACpD,KAAK,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrC,KAAK,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC/C,4DAA4D;QAC5D,qEAAqE;QACrE,KAAK,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC;AA6BD;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CACxB,SAAoC,EACpC,OAAwB,EACxB,YAAgC,EAChC,gBAAyC;IAEzC,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,cAAc,CAAC;IAC9C,IAAI,SAAS,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAC3C,8DAA8D;IAC9D,IAAI,gBAAgB,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACrD,IAAI,YAAY,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACrE,OAAO,iEAAiE,CAAC;AAC3E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,SAAoC,EACpC,GAAsB,EACtB,IAAY;IAEZ,0EAA0E;IAC1E,mEAAmE;IACnE,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,SAAS,CAAC,EAAE,8BAA8B,EAAE,CAAC;IACpF,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IAC3D,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,WAAW,SAAS,CAAC,MAAM,oBACjC,KAAK,CAAC,KAAK,EAAE,OAAO,IAAI,QAAQ,KAAK,CAAC,MAAM,EAC9C,EAAE;SACH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AACvE,CAAC;AAED,SAAS,UAAU,CACjB,SAAsD,EACtD,EAAU;IAEV,OAAO,SAAS,EAAE,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC;AACnC,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAoC,EACpC,IAAY,EACZ,UAAoC,EAAE;IAEtC,IAAI,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;QACrC,yDAAyD;QACzD,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,MAAM,EAAE;gBACN,IAAI,EAAE,SAAS,CAAC,EAAE;gBAClB,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,SAAS;gBACjB,KAAK,EAAE,uDAAuD;aAC/D;SACF,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IAE5D,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,wBAAwB,EAAE;SACpG,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,MAAM,gBAAgB,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;IACtF,IAAI,MAAM,EAAE,CAAC;QACX,GAAG,CAAC,gCAAgC,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC5D,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE;SAClF,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,iFAAiF;IACjF,iFAAiF;IACjF,gEAAgE;IAChE,IAAI,MAAgB,CAAC;IACrB,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,6BAA6B,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;YACjD,OAAO;gBACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnC,MAAM,EAAE;oBACN,IAAI,EAAE,SAAS,CAAC,EAAE;oBAClB,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,cAAc;oBACtB,KAAK,EAAE,kEAAkE;iBAC1E;aACF,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtB,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,GAAG,CAAC,gCAAgC,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACjE,OAAO;gBACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE;aAC5F,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,MAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,MAAM,EAAE;gBACN,IAAI,EAAE,SAAS,CAAC,EAAE;gBAClB,OAAO;gBACP,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,aAAa;gBACrB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,WAAW,EAAE,CAAC;aACf;SACF,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,MAAM,EAAE;gBACN,IAAI,EAAE,SAAS,CAAC,EAAE;gBAClB,OAAO;gBACP,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,aAAa;gBACrB,SAAS,EAAE,MAAM,CAAC,MAAM;gBACxB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;gBAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;aAChC;SACF,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,gEAAgE;IAChE,IAAI,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/B,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC;YACH,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,GAAG,EAAE,CAAC;QAClB,CAAC;QACD,IAAI,CAAC;YACH,IAAI,UAAU,CAAC,UAAU,CAAC;gBAAE,MAAM,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;IAED,IAAI,KAAqD,CAAC;IAC1D,IAAI,CAAC;QACH,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,MAAM,EAAE;gBACN,IAAI,EAAE,SAAS,CAAC,EAAE;gBAClB,OAAO;gBACP,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,aAAa;gBACrB,SAAS,EAAE,MAAM,CAAC,MAAM;gBACxB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBAC3C,WAAW,EAAE,MAAM,CAAC,WAAW;aAChC;SACF,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,qEAAqE;IACrE,MAAM,UAAU,GAAG,+BAA+B,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE;QACtE,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;YACnB,IAAI,CAAC;gBACH,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,6BAA6B,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,UAAU,CAAC,WAAW,GAAG,KAAK,CAAC;IAErD,OAAO;QACL,OAAO,EAAE,UAAU;QACnB,MAAM,EAAE;YACN,IAAI,EAAE,SAAS,CAAC,EAAE;YAClB,OAAO;YACP,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YAC9D,SAAS,EAAE,MAAM,CAAC,MAAM;YACxB,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,UAAuC;IAEvC,MAAM,QAAQ,GAAgC,EAAE,CAAC;IACjD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAAE,SAAS;QAC/C,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AASD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,UAAuC,EACvC,IAAY,EACZ,UAA2D,EAAE;IAE7D,MAAM,gBAAgB,GAA2B,EAAE,CAAC;IACpD,MAAM,kBAAkB,GAAiC,EAAE,CAAC;IAC5D,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,MAAM;YAAE,SAAS;QACjE,IAAI,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAAE,SAAS;QAC/C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,kBAAkB,CAAC,IAAI,CAAC;gBACtB,IAAI,EAAE,SAAS,CAAC,EAAE;gBAClB,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,SAAS;gBACjB,KAAK,EAAE,wBAAwB;aAChC,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;QAC5D,MAAM,gBAAgB,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;QACtF,IAAI,MAAM,EAAE,CAAC;YACX,kBAAkB,CAAC,IAAI,CAAC;gBACtB,IAAI,EAAE,SAAS,CAAC,EAAE;gBAClB,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,SAAS;gBACjB,KAAK,EAAE,MAAM;aACd,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClE,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACvB,gBAAgB,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC;QACtD,CAAC;aAAM,CAAC;YACN,kBAAkB,CAAC,IAAI,CAAC;gBACtB,IAAI,EAAE,SAAS,CAAC,EAAE;gBAClB,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,cAAc;gBACtB,KAAK,EAAE,UAAU,CAAC,IAAI,IAAI,oBAAoB;aAC/C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,CAAC;AAClD,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAuC,EACvC,IAAY,EACZ,UAAoC,EAAE;IAEtC,MAAM,UAAU,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;IACzD,MAAM,OAAO,GAA8B,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAAiC,EAAE,CAAC;IAClD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,mBAAmB,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9D,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;YAC9E,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"acquisitionEngine.js","sourceRoot":"","sources":["../../../src/shared/analyzers/acquisitionEngine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAyB,MAAM,oBAAoB,CAAC;AAEvE,OAAO,EACL,+BAA+B,EAC/B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,gBAAgB,GAKjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,aAAa,GAGd,MAAM,wBAAwB,CAAC;AAEhC;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS;IAC5C,aAAa;IACb,oBAAoB;CACrB,CAAC,CAAC;AA4EH,+EAA+E;AAC/E,SAAS,YAAY,CAAC,IAAY,EAAE,OAAiB;IACnD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC,SAAS,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAY;IACvD,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,MAAuB;IAC9C,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC1C,KAAK,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC5C,KAAK,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC9C,iFAAiF;QACjF,KAAK,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAAuB,EAAE,IAAY;IACzD,QAAQ,MAAM,EAAE,CAAC;QACf,qEAAqE;QACrE,KAAK,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACvC,KAAK,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACpD,KAAK,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrC,KAAK,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC/C,4DAA4D;QAC5D,qEAAqE;QACrE,KAAK,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC;AAiED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,gFAAgF;IAChF,YAAY,EAAE,cAAc;IAC5B,6EAA6E;IAC7E,gBAAgB,EACd,wEAAwE;IAC1E,+EAA+E;IAC/E,mBAAmB,EACjB,yFAAyF;IAC3F,yEAAyE;IACzE,mBAAmB,EACjB,yFAAyF;CACnF,CAAC;AAEX;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CACzB,YAAmD,EACnD,WAAmB;IAEnB,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IACzE,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACrC,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC7D,CAAC;IACD,IAAI,OAAO,YAAY,CAAC,KAAK,KAAK,QAAQ,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrF,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC;QAAE,OAAO,cAAc,CAAC;IAC9D,OAAO,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,UAAU,CACxB,SAAoC,EACpC,OAAwB,EACxB,YAAmD,EACnD,gBAA0C;IAE1C,kFAAkF;IAClF,kFAAkF;IAClF,+DAA+D;IAC/D,IAAI,gBAAgB,KAAK,UAAU;QAAE,OAAO,uBAAuB,CAAC,gBAAgB,CAAC;IACrF,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,uBAAuB,CAAC,YAAY,CAAC;IACpE,IAAI,SAAS,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAC3C,IAAI,gBAAgB,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACrD,MAAM,YAAY,GAAG,kBAAkB,CAAC,YAAY,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IACpE,IAAI,YAAY,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,YAAY,KAAK,cAAc;QAAE,OAAO,uBAAuB,CAAC,mBAAmB,CAAC;IACxF,OAAO,uBAAuB,CAAC,mBAAmB,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,SAAoC,EACpC,GAAsB,EACtB,IAAY;IAEZ,0EAA0E;IAC1E,mEAAmE;IACnE,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,SAAS,CAAC,EAAE,8BAA8B,EAAE,CAAC;IACpF,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IAC3D,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,WAAW,SAAS,CAAC,MAAM,oBACjC,KAAK,CAAC,KAAK,EAAE,OAAO,IAAI,QAAQ,KAAK,CAAC,MAAM,EAC9C,EAAE;SACH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AACvE,CAAC;AAED,SAAS,UAAU,CACjB,SAAsD,EACtD,EAAU;IAEV,OAAO,SAAS,EAAE,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC;AACnC,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAoC,EACpC,IAAY,EACZ,UAAoC,EAAE;IAEtC,IAAI,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;QACrC,yDAAyD;QACzD,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,MAAM,EAAE;gBACN,IAAI,EAAE,SAAS,CAAC,EAAE;gBAClB,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,SAAS;gBACjB,KAAK,EAAE,uDAAuD;aAC/D;SACF,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IAE5D,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,wBAAwB,EAAE;SACpG,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,MAAM,gBAAgB,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;IACtF,IAAI,MAAM,EAAE,CAAC;QACX,GAAG,CAAC,gCAAgC,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC5D,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE;SAClF,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,iFAAiF;IACjF,iFAAiF;IACjF,gEAAgE;IAChE,IAAI,MAAgB,CAAC;IACrB,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,6BAA6B,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;YACjD,OAAO;gBACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnC,MAAM,EAAE;oBACN,IAAI,EAAE,SAAS,CAAC,EAAE;oBAClB,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,cAAc;oBACtB,KAAK,EAAE,kEAAkE;iBAC1E;aACF,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtB,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,GAAG,CAAC,gCAAgC,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACjE,OAAO;gBACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE;aAC5F,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,MAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,MAAM,EAAE;gBACN,IAAI,EAAE,SAAS,CAAC,EAAE;gBAClB,OAAO;gBACP,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,aAAa;gBACrB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,WAAW,EAAE,CAAC;aACf;SACF,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,MAAM,EAAE;gBACN,IAAI,EAAE,SAAS,CAAC,EAAE;gBAClB,OAAO;gBACP,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,aAAa;gBACrB,SAAS,EAAE,MAAM,CAAC,MAAM;gBACxB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;gBAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;aAChC;SACF,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,gEAAgE;IAChE,IAAI,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/B,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC;YACH,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,GAAG,EAAE,CAAC;QAClB,CAAC;QACD,IAAI,CAAC;YACH,IAAI,UAAU,CAAC,UAAU,CAAC;gBAAE,MAAM,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,MAAM,aAAa,GACjB,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAEnF,IAAI,MAA2C,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,MAAM,EAAE;gBACN,IAAI,EAAE,SAAS,CAAC,EAAE;gBAClB,OAAO;gBACP,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,aAAa;gBACrB,SAAS,EAAE,MAAM,CAAC,MAAM;gBACxB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBAC3C,GAAG,aAAa;gBAChB,WAAW,EAAE,MAAM,CAAC,WAAW;aAChC;SACF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAiC,MAAM,CAAC,KAAK,CAAC;IAEzD,iFAAiF;IACjF,iFAAiF;IACjF,iFAAiF;IACjF,iFAAiF;IACjF,uCAAuC;IACvC,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,IAAI,sBAAsB,GAAG,CAAC,CAAC;IAC/B,MAAM,UAAU,GAAG,+BAA+B,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE;QACtE,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;YACnB,IAAI,CAAC;gBACH,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QACD,aAAa,EAAE,CAAC,WAAW,EAAE,EAAE;YAC7B,kBAAkB,GAAG,WAAW,CAAC,oBAAoB,CAAC;YACtD,sBAAsB,GAAG,WAAW,CAAC,aAAa,CAAC;QACrD,CAAC;KACF,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,6BAA6B,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,UAAU,CAAC,WAAW,GAAG,KAAK,CAAC;IAErD,kFAAkF;IAClF,mFAAmF;IACnF,mFAAmF;IACnF,yEAAyE;IACzE,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,sBAAsB,CAAC;IACxE,MAAM,iBAAiB,GAAG;QACxB,SAAS,EAAE,MAAM,CAAC,MAAM;QACxB,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,kBAAkB,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,aAAa;QAChB,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC;IAEF,mFAAmF;IACnF,kFAAkF;IAClF,kFAAkF;IAClF,gFAAgF;IAChF,4EAA4E;IAC5E,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,kFAAkF;QAClF,mFAAmF;QACnF,gFAAgF;QAChF,mFAAmF;QACnF,6EAA6E;QAC7E,oBAAoB;QACpB,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC;QAC1E,MAAM,aAAa,GAAG,WAAW,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;QACzD,MAAM,UAAU,GACd,CAAC,aAAa,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC;QACnF,IAAI,aAAa,IAAI,UAAU,EAAE,CAAC;YAChC,OAAO;gBACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnC,MAAM,EAAE;oBACN,IAAI,EAAE,SAAS,CAAC,EAAE;oBAClB,OAAO;oBACP,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,QAAQ;oBAChB,KAAK,EAAE,WAAW;wBAChB,CAAC,CAAC,mGAAmG;wBACrG,CAAC,CAAC,aAAa;4BACb,CAAC,CAAC,mBAAmB,MAAM,CAAC,MAAM,4BAA4B;4BAC9D,CAAC,CAAC,+CAA+C;oBACrD,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBAC3C,GAAG,iBAAiB;iBACrB;aACF,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,YAAY,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;YAC3C,OAAO;gBACL,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnC,MAAM,EAAE;oBACN,IAAI,EAAE,SAAS,CAAC,EAAE;oBAClB,OAAO;oBACP,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,aAAa;oBACrB,KAAK,EACH,MAAM,CAAC,IAAI;wBACX,CAAC,MAAM,CAAC,YAAY;4BAClB,CAAC,CAAC,qCAAqC;4BACvC,CAAC,CAAC,+BAA+B,WAAW,kBAAkB,CAAC;oBACnE,cAAc,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACxC,GAAG,iBAAiB;iBACrB;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,UAAU;QACnB,MAAM,EAAE;YACN,IAAI,EAAE,SAAS,CAAC,EAAE;YAClB,OAAO;YACP,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YAC9D,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,GAAG,iBAAiB;SACrB;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,UAAuC;IAEvC,MAAM,QAAQ,GAAgC,EAAE,CAAC;IACjD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAAE,SAAS;QAC/C,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AASD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,UAAuC,EACvC,IAAY,EACZ,UAA2D,EAAE;IAE7D,MAAM,gBAAgB,GAA2B,EAAE,CAAC;IACpD,MAAM,kBAAkB,GAAiC,EAAE,CAAC;IAC5D,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,MAAM;YAAE,SAAS;QACjE,IAAI,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAAE,SAAS;QAC/C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,kBAAkB,CAAC,IAAI,CAAC;gBACtB,IAAI,EAAE,SAAS,CAAC,EAAE;gBAClB,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,SAAS;gBACjB,KAAK,EAAE,wBAAwB;aAChC,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;QAC5D,MAAM,gBAAgB,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;QACtF,IAAI,MAAM,EAAE,CAAC;YACX,kBAAkB,CAAC,IAAI,CAAC;gBACtB,IAAI,EAAE,SAAS,CAAC,EAAE;gBAClB,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,SAAS;gBACjB,KAAK,EAAE,MAAM;aACd,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClE,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACvB,gBAAgB,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC;QACtD,CAAC;aAAM,CAAC;YACN,8EAA8E;YAC9E,8EAA8E;YAC9E,6EAA6E;YAC7E,kBAAkB,CAAC,IAAI,CAAC;gBACtB,IAAI,EAAE,SAAS,CAAC,EAAE;gBAClB,QAAQ,EAAE,KAAK;gBACf,MAAM,EACJ,UAAU,CAAC,MAAM,KAAK,mBAAmB,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,cAAc;gBAClF,KAAK,EAAE,UAAU,CAAC,IAAI,IAAI,oBAAoB;aAC/C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,CAAC;AAClD,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAuC,EACvC,IAAY,EACZ,UAAoC,EAAE;IAEtC,MAAM,UAAU,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;IACzD,MAAM,OAAO,GAA8B,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAAiC,EAAE,CAAC;IAClD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,mBAAmB,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9D,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;YAC9E,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC"}

package/dist/shared/analyzers/binaryAcquisition.d.ts

@@ -15,7 +15,24 @@ import { type RunTrackedResult } from "../tooling/exec.js";
  * is SHA256-verified against the official release checksums BEFORE it is extracted
  * or executed; the fetcher is injected so the engine is testable without network
  * and an absent network degrades cleanly. A checksum mismatch is fatal-to-this-tool
- * (returns `unavailable`), never executed.
+ * (returns `unavailable` with reason `checksum_mismatch`), never executed.
+ *
+ * The cache branch is held to the SAME bar as the download branch, on EVERY
+ * resolution, in two layers that only work together:
+ *  - LOCATION. The default cache root is per-user (`<homedir>/.audit-tools/bincache`,
+ *    created 0o700 where modes are honoured), never the shared temp dir. The path is
+ *    fully derivable from public pinned constants, so "a file exists there" is only
+ *    meaningful when the directory is not writable by other local processes.
+ *  - INTEGRITY. Each successful download records the executable's digest in a cache
+ *    manifest beside it, and a cache hit is only a hit when the bytes still hash to
+ *    that recorded digest. Anything else — no manifest, an unreadable manifest, a
+ *    digest mismatch, or a version dir left behind by a failed extraction — is PURGED
+ *    and re-acquired rather than executed.
+ *
+ * The manifest alone is NOT provenance: anyone who can write the cache dir can write a
+ * self-consistent binary+manifest pair. It detects drift and partial writes; the
+ * location layer is what makes writing the pair privileged in the first place. A
+ * caller passing its own `cacheDir` owns that directory's permissions.
  */
 /** Injected network fetch: returns the URL's bytes, or `null` when unavailable. */
 export interface BinaryFetcher {
@@ -57,15 +74,23 @@ export interface BinarySpec {
 export interface BinaryResolveOptions {
     fetch?: BinaryFetcher;
     run?: BinaryCommandRunner;
-    /** Root cache dir for downloaded binaries; default `<tmpdir>/audit-tools-bincache`. */
+    /** Root cache dir for downloaded binaries; default `<homedir>/.audit-tools/bincache`. */
     cacheDir?: string;
     platform?: NodeJS.Platform;
     arch?: string;
 }
+/**
+ * WHY a binary could not be resolved, as a machine-readable member rather than a
+ * free-text note. `checksum_mismatch` is a supply-chain event and must never be
+ * indistinguishable from `offline` in the persisted record.
+ */
+export type BinaryUnavailableReason = "offline" | "no_asset_for_platform" | "download_failed" | "download_empty" | "no_checksum_for_asset" | "checksum_mismatch" | "extract_failed" | "not_found_in_archive" | "write_failed";
 export interface BinaryResolution {
     status: "path" | "cached" | "downloaded" | "unavailable";
     /** Resolved executable (PATH name or absolute cached path); null when unavailable. */
     command: string | null;
+    /** Discriminated cause when `status === "unavailable"`. */
+    reason?: BinaryUnavailableReason;
     note?: string;
 }
 /** Parse a `<sha256>␠␠<asset>` checksums file for one asset's expected digest. */

package/dist/shared/analyzers/binaryAcquisition.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"binaryAcquisition.d.ts","sourceRoot":"","sources":["../../../src/shared/analyzers/binaryAcquisition.ts"],"names":[],"mappings":"AAYA,OAAO,EAAc,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEvE;;;;;;;;;;;;;;;;;GAiBG;AAEH,mFAAmF;AACnF,MAAM,WAAW,aAAa;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;CAC3C;AAED,0FAA0F;AAC1F,MAAM,WAAW,mBAAmB;IAClC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAAC;CACjD;AAED,0EAA0E;AAC1E,MAAM,WAAW,UAAU;IACzB,sEAAsE;IACtE,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACjE;;;;;;OAMG;IACH,cAAc,EAAE,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC;IACzD,gFAAgF;IAChF,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IAC9C;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,GAAG,CAAC,EAAE,mBAAmB,CAAC;IAC1B,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,YAAY,GAAG,aAAa,CAAC;IACzD,sFAAsF;IACtF,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAUD,kFAAkF;AAClF,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,IAAI,CAMf;AAMD;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,UAAU,EAChB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,gBAAgB,CAAC,CAiI3B"}
+{"version":3,"file":"binaryAcquisition.d.ts","sourceRoot":"","sources":["../../../src/shared/analyzers/binaryAcquisition.ts"],"names":[],"mappings":"AAcA,OAAO,EAAc,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,mFAAmF;AACnF,MAAM,WAAW,aAAa;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;CAC3C;AAED,0FAA0F;AAC1F,MAAM,WAAW,mBAAmB;IAClC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAAC;CACjD;AAED,0EAA0E;AAC1E,MAAM,WAAW,UAAU;IACzB,sEAAsE;IACtE,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACjE;;;;;;OAMG;IACH,cAAc,EAAE,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC;IACzD,gFAAgF;IAChF,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IAC9C;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,GAAG,CAAC,EAAE,mBAAmB,CAAC;IAC1B,yFAAyF;IACzF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAC/B,SAAS,GACT,uBAAuB,GACvB,iBAAiB,GACjB,gBAAgB,GAChB,uBAAuB,GACvB,mBAAmB,GACnB,gBAAgB,GAChB,sBAAsB,GACtB,cAAc,CAAC;AAEnB,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,YAAY,GAAG,aAAa,CAAC;IACzD,sFAAsF;IACtF,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,uBAAuB,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AA+ID,kFAAkF;AAClF,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,IAAI,CAMf;AAMD;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,UAAU,EAChB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,gBAAgB,CAAC,CAiJ3B"}

package/dist/shared/analyzers/binaryAcquisition.js

@@ -1,14 +1,122 @@
 import { createHash } from "node:crypto";
-import { chmodSync, existsSync, mkdirSync, readdirSync, rmSync, statSync, writeFileSync, } from "node:fs";
-import { join } from "node:path";
-import { tmpdir } from "node:os";
+import { chmodSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { isAbsolute, join, relative } from "node:path";
+import { homedir } from "node:os";
+import { AUDIT_TOOLS_DIRNAME } from "../io/auditToolsPaths.js";
 import { runTracked } from "../tooling/exec.js";
+/**
+ * Per-USER cache root, deliberately NOT the system temp dir. Defaults to
+ * `~/.audit-tools/bincache`; `AUDIT_TOOLS_BINARY_CACHE` overrides it so a run can be
+ * pinned to an isolated cache — the same override shape as
+ * {@link analyzerCacheRoot}'s `AUDIT_TOOLS_ANALYZER_CACHE`, and what lets a test
+ * exercise the DEFAULT path without ever writing to the real home directory.
+ *
+ * The digest manifest beside a cached binary proves the bytes match what the manifest
+ * says — but an attacker who can write the cache dir writes BOTH, so a self-consistent
+ * pair inside a world-writable location proves nothing. The manifest only has meaning
+ * when the directory it lives in is not attacker-writable, which is what moving the
+ * default root under the user's home buys. `cacheDir` remains overridable per call for
+ * a caller that has its own private location.
+ *
+ * Consequence, deliberate: caches warmed under the old `<tmpdir>/audit-tools-bincache`
+ * are simply never consulted again — the first resolution under the new root
+ * re-downloads, or degrades to `unavailable` offline.
+ */
 function defaultCacheDir() {
-    return join(tmpdir(), "audit-tools-bincache");
+    const override = process.env.AUDIT_TOOLS_BINARY_CACHE;
+    if (override && override.trim().length > 0)
+        return override;
+    return join(homedir(), AUDIT_TOOLS_DIRNAME, "bincache");
+}
+/**
+ * Create the cache root restricted to its owner where the platform honours modes.
+ * On win32 the mode is ignored (ACLs govern), and the per-user home root is the
+ * protection there.
+ *
+ * ⚠ The mode applies AT CREATION ONLY. An existing directory keeps whatever mode it
+ * already has — `mkdirSync` does not chmod one it did not create — so a root that was
+ * created loosely by something else is not repaired here.
+ */
+function ensureCacheRoot(cacheDir) {
+    try {
+        mkdirSync(cacheDir, { recursive: true, mode: 0o700 });
+    }
+    catch {
+        /* a later mkdir of the version dir surfaces any real failure */
+    }
 }
 function exeName(binaryName, platform) {
     return platform === "win32" ? `${binaryName}.exe` : binaryName;
 }
+/** `unavailable` with its cause carried in BOTH forms — machine member + human note. */
+function unavailable(reason, note) {
+    return { status: "unavailable", command: null, reason, note };
+}
+/**
+ * Cache manifest filename. Written beside the cached executable at download time and
+ * the ONLY evidence that these bytes came from a checksum-verified acquisition.
+ */
+const CACHE_MANIFEST_FILENAME = ".audit-tools-binary.json";
+/** Remove a cache version dir wholesale; best-effort, never throws. */
+function purgeVersionDir(versionDir) {
+    try {
+        rmSync(versionDir, { recursive: true, force: true });
+    }
+    catch {
+        /* best-effort — a later resolution re-verifies regardless */
+    }
+}
+function writeCacheManifest(versionDir, spec, executablePath) {
+    try {
+        const manifest = {
+            binaryName: spec.binaryName,
+            version: spec.version,
+            executable_relative_path: relative(versionDir, executablePath).replace(/\\/g, "/"),
+            executable_sha256: sha256(readFileSync(executablePath)),
+        };
+        writeFileSync(join(versionDir, CACHE_MANIFEST_FILENAME), `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
+    }
+    catch {
+        /* An unwritable manifest simply means the next resolution re-downloads. */
+    }
+}
+/**
+ * The cached executable's path — but ONLY when its bytes still hash to the digest
+ * recorded when it was acquired. A missing, unreadable, or mismatched manifest, an
+ * escaping relative path, or drifted bytes all return null and the caller purges:
+ * filename existence is never sufficient to execute.
+ */
+function verifiedCachedExecutable(versionDir, spec) {
+    let manifest;
+    try {
+        manifest = JSON.parse(readFileSync(join(versionDir, CACHE_MANIFEST_FILENAME), "utf8"));
+    }
+    catch {
+        return null;
+    }
+    if (!manifest ||
+        manifest.binaryName !== spec.binaryName ||
+        manifest.version !== spec.version ||
+        typeof manifest.executable_relative_path !== "string" ||
+        manifest.executable_relative_path.length === 0 ||
+        typeof manifest.executable_sha256 !== "string" ||
+        manifest.executable_sha256.length !== 64) {
+        return null;
+    }
+    const executablePath = join(versionDir, manifest.executable_relative_path);
+    const containment = relative(versionDir, executablePath);
+    if (containment.startsWith("..") || isAbsolute(containment))
+        return null;
+    try {
+        if (sha256(readFileSync(executablePath)) !== manifest.executable_sha256.toLowerCase()) {
+            return null;
+        }
+    }
+    catch {
+        return null;
+    }
+    return executablePath;
+}
 /** Parse a `<sha256>␠␠<asset>` checksums file for one asset's expected digest. */
 export function expectedSha256For(checksumsText, assetName) {
     for (const line of checksumsText.split(/\r?\n/)) {
@@ -31,29 +139,34 @@ export async function resolveBinary(spec, options = {}) {
     const arch = options.arch ?? process.arch;
     const run = options.run ?? ((argv, cwd) => runTracked(argv, { cwd }));
     const cacheDir = options.cacheDir ?? defaultCacheDir();
-    // 1. PATH — already installed.
+    // 1. PATH — already installed. Nothing below this point runs, so a tool the machine
+    // already has must not cause a cache directory to be created as a side effect.
     const probe = run(spec.versionProbeArgs, process.cwd());
     if (!probe.error && probe.status === 0) {
         return { status: "path", command: spec.binaryName };
     }
-    // 2. cache — a previously-downloaded pinned binary.
+    // 2. cache — a previously-downloaded pinned binary, RE-VERIFIED on every
+    // resolution. The cache path is derivable from public pinned constants, so a
+    // file at the expected name is a claim, not a proof: it is executed only when its
+    // bytes still match the digest recorded at acquisition. Anything else — including
+    // a version dir a failed extraction left behind — is purged and re-acquired.
     const versionDir = join(cacheDir, `${spec.binaryName}-${spec.version}`);
-    const cachedPath = join(versionDir, exeName(spec.binaryName, platform));
-    if (existsSync(cachedPath)) {
-        return { status: "cached", command: cachedPath };
+    if (existsSync(versionDir)) {
+        const verified = verifiedCachedExecutable(versionDir, spec);
+        if (verified)
+            return { status: "cached", command: verified };
+        // Unverifiable bytes, or a dir a failed extraction left behind: purge so nothing
+        // half-written or pre-planted can become a later "cache hit".
+        purgeVersionDir(versionDir);
     }
     // 3. download — pinned release asset, SHA256-verified, then extracted.
     const fetch = options.fetch;
     if (!fetch) {
-        return { status: "unavailable", command: null, note: "no fetcher configured (offline)" };
+        return unavailable("offline", "no fetcher configured (offline)");
     }
     const assetName = spec.assetFor(platform, arch);
     if (!assetName) {
-        return {
-            status: "unavailable",
-            command: null,
-            note: `no release asset for ${platform}/${arch}`,
-        };
+        return unavailable("no_asset_for_platform", `no release asset for ${platform}/${arch}`);
     }
     let assetBytes;
     let checksumsBytes;
@@ -65,27 +178,25 @@ export async function resolveBinary(spec, options = {}) {
         assetBytes = await fetch(spec.releaseUrlForAsset(assetName));
     }
     catch (error) {
-        return {
-            status: "unavailable",
-            command: null,
-            note: `download failed: ${error instanceof Error ? error.message : String(error)}`,
-        };
+        return unavailable("download_failed", `download failed: ${error instanceof Error ? error.message : String(error)}`);
     }
     if (!checksumsBytes || !assetBytes) {
-        return { status: "unavailable", command: null, note: "download returned no bytes" };
+        return unavailable("download_empty", "download returned no bytes");
     }
     const expected = expectedSha256For(Buffer.from(checksumsBytes).toString("utf8"), assetName);
     if (!expected) {
-        return { status: "unavailable", command: null, note: `no checksum for ${assetName}` };
+        return unavailable("no_checksum_for_asset", `no checksum for ${assetName}`);
     }
     const actual = sha256(assetBytes);
     if (actual !== expected) {
-        return {
-            status: "unavailable",
-            command: null,
-            note: `checksum mismatch for ${assetName} (expected ${expected}, got ${actual})`,
-        };
+        return unavailable("checksum_mismatch", `checksum mismatch for ${assetName} (expected ${expected}, got ${actual})`);
     }
+    // Only here — past the PATH probe, past a cache miss, past verification — is
+    // anything about to be WRITTEN. Creating the root any earlier would grow an empty
+    // cache directory on every resolution that never caches anything: a tool already on
+    // PATH, an offline degrade, an unsupported platform. Read paths only ever ask
+    // whether the directory exists.
+    ensureCacheRoot(cacheDir);
     // Non-archived asset (e.g. osv-scanner): the verified bytes ARE the
     // executable — write directly to the cached path, no `tar` involved.
     if (spec.archived === false) {
@@ -101,14 +212,12 @@ export async function resolveBinary(spec, options = {}) {
                     /* best-effort */
                 }
             }
+            writeCacheManifest(versionDir, spec, resolved);
             return { status: "downloaded", command: resolved };
         }
         catch (error) {
-            return {
-                status: "unavailable",
-                command: null,
-                note: `write error: ${error instanceof Error ? error.message : String(error)}`,
-            };
+            purgeVersionDir(versionDir);
+            return unavailable("write_failed", `write error: ${error instanceof Error ? error.message : String(error)}`);
         }
     }
     // Verified — write the archive and extract it with the system `tar` (bsdtar
@@ -120,24 +229,20 @@ export async function resolveBinary(spec, options = {}) {
         const extract = run(["tar", "-xf", archivePath, "-C", versionDir], versionDir);
         rmSync(archivePath, { force: true });
         if (extract.error || extract.status !== 0) {
-            return {
-                status: "unavailable",
-                command: null,
-                note: `extract failed: ${extract.error?.message ?? `tar exit ${extract.status}`}`,
-            };
+            // Whatever tar managed to write before failing must NOT survive as a cache hit.
+            purgeVersionDir(versionDir);
+            return unavailable("extract_failed", `extract failed: ${extract.error?.message ?? `tar exit ${extract.status}`}`);
         }
     }
     catch (error) {
-        return {
-            status: "unavailable",
-            command: null,
-            note: `extract error: ${error instanceof Error ? error.message : String(error)}`,
-        };
+        purgeVersionDir(versionDir);
+        return unavailable("extract_failed", `extract error: ${error instanceof Error ? error.message : String(error)}`);
     }
     // Locate the executable (archives may nest it); chmod +x on POSIX.
     const resolved = findExecutable(versionDir, exeName(spec.binaryName, platform));
     if (!resolved) {
-        return { status: "unavailable", command: null, note: "binary not found in archive" };
+        purgeVersionDir(versionDir);
+        return unavailable("not_found_in_archive", "binary not found in archive");
     }
     if (platform !== "win32") {
         try {
@@ -147,6 +252,7 @@ export async function resolveBinary(spec, options = {}) {
             /* best-effort */
         }
     }
+    writeCacheManifest(versionDir, spec, resolved);
     return { status: "downloaded", command: resolved };
 }
 /** Shallow-then-recursive search for `name` under `dir`. */