autoremediator 0.21.2 → 0.22.0

package/dist/remediation/verify/verifier.d.ts

@@ -0,0 +1,12 @@
+import { type CheckFn } from "./checks.js";
+import { type CheckName, type VerificationResult, type VerifyRequest } from "./types.js";
+/**
+ * Judge a project that a change has been made to. Deterministic: no model is consulted, and nothing
+ * the change's author says about it is taken on trust. Checks run cheapest first and stop at the
+ * first failure; the rest are reported as skipped, so a result always lists every check.
+ *
+ * It does not care how the change was made. A plan applied in place, an agent's attempt in a
+ * worktree and a hand edit are judged by the same checks.
+ */
+export declare function verify(request: VerifyRequest, checks?: Partial<Record<CheckName, CheckFn>>): Promise<VerificationResult>;
+//# sourceMappingURL=verifier.d.ts.map

package/dist/remediation/verify/verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../../../src/remediation/verify/verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,OAAO,EAAsB,MAAM,aAAa,CAAC;AACvE,OAAO,EAEL,KAAK,SAAS,EAEd,KAAK,kBAAkB,EACvB,KAAK,aAAa,EACnB,MAAM,YAAY,CAAC;AAEpB;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAC1B,OAAO,EAAE,aAAa,EACtB,MAAM,GAAE,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAU,GACnD,OAAO,CAAC,kBAAkB,CAAC,CA6C7B"}

package/dist/remediation/verify/verifier.js

@@ -0,0 +1,56 @@
+import { CHECKS, createCheckContext } from "./checks.js";
+import { CHECK_NAMES, } from "./types.js";
+/**
+ * Judge a project that a change has been made to. Deterministic: no model is consulted, and nothing
+ * the change's author says about it is taken on trust. Checks run cheapest first and stop at the
+ * first failure; the rest are reported as skipped, so a result always lists every check.
+ *
+ * It does not care how the change was made. A plan applied in place, an agent's attempt in a
+ * worktree and a hand edit are judged by the same checks.
+ */
+export async function verify(request, checks = CHECKS) {
+    const started = Date.now();
+    const wanted = new Set(request.checks ?? CHECK_NAMES);
+    const context = createCheckContext(request);
+    const results = [];
+    let failedCheck;
+    for (const name of CHECK_NAMES) {
+        if (!wanted.has(name))
+            continue;
+        if (failedCheck) {
+            results.push({
+                name,
+                status: "skipped",
+                message: `not run: ${failedCheck} failed`,
+                durationMs: 0,
+            });
+            continue;
+        }
+        const run = checks[name] ?? CHECKS[name];
+        const checkStarted = Date.now();
+        let outcome;
+        try {
+            outcome = await run(context);
+        }
+        catch (error) {
+            // A check that blows up has not shown the change is fine.
+            outcome = {
+                status: "failed",
+                message: "the check could not complete",
+                details: [error instanceof Error ? error.message : String(error)],
+            };
+        }
+        results.push({ name, ...outcome, durationMs: Date.now() - checkStarted });
+        if (outcome.status === "failed")
+            failedCheck = name;
+    }
+    const changedFiles = await context.changedFiles().catch(() => undefined);
+    return {
+        passed: failedCheck === undefined,
+        ...(failedCheck ? { failedCheck } : {}),
+        checks: results,
+        ...(changedFiles ? { changedFiles } : {}),
+        durationMs: Date.now() - started,
+    };
+}
+//# sourceMappingURL=verifier.js.map

package/dist/remediation/verify/verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../../src/remediation/verify/verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAgB,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EACL,WAAW,GAKZ,MAAM,YAAY,CAAC;AAEpB;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,OAAsB,EACtB,MAAM,GAAwC,MAAM;IAEpD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAE5C,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,IAAI,WAAkC,CAAC;IAEvC,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAChC,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI;gBACJ,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,YAAY,WAAW,SAAS;gBACzC,UAAU,EAAE,CAAC;aACd,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0DAA0D;YAC1D,OAAO,GAAG;gBACR,MAAM,EAAE,QAAiB;gBACzB,OAAO,EAAE,8BAA8B;gBACvC,OAAO,EAAE,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;aAClE,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC;QAC1E,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;YAAE,WAAW,GAAG,IAAI,CAAC;IACtD,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACzE,OAAO;QACL,MAAM,EAAE,WAAW,KAAK,SAAS;QACjC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,MAAM,EAAE,OAAO;QACf,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;KACjC,CAAC;AACJ,CAAC"}

package/dist/runs/fingerprint.d.ts

@@ -0,0 +1,14 @@
+/** What a plan or a finished run depends on: the manifests, lockfiles and patches, plus the policy. */
+export interface RepoFingerprint {
+    gitHead?: string;
+    /** Uncommitted changes exist anywhere in the work tree. */
+    dirty: boolean;
+    /** Hash over every manifest, lockfile, patch and tsconfig file the tool may change. */
+    filesSha256: string;
+    /** Hash of the policy in force, when there is one. */
+    policySha256?: string;
+}
+export declare function fingerprintRepo(cwd: string, policy?: string): Promise<RepoFingerprint>;
+/** Whether two fingerprints describe the same inputs to remediation (the commit itself may differ). */
+export declare function sameInputs(a: RepoFingerprint, b: RepoFingerprint): boolean;
+//# sourceMappingURL=fingerprint.d.ts.map

package/dist/runs/fingerprint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.d.ts","sourceRoot":"","sources":["../../src/runs/fingerprint.ts"],"names":[],"mappings":"AAOA,uGAAuG;AACvG,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2DAA2D;IAC3D,KAAK,EAAE,OAAO,CAAC;IACf,uFAAuF;IACvF,WAAW,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAwBD,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAsB5F;AAED,uGAAuG;AACvG,wBAAgB,UAAU,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,eAAe,GAAG,OAAO,CAE1E"}

package/dist/runs/fingerprint.js

@@ -0,0 +1,55 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join, relative } from "node:path";
+import { discoverProjectFiles } from "../platform/rollback.js";
+import { safeExeca } from "../platform/safe-exec.js";
+import { sha256 } from "./hash.js";
+async function git(cwd, args) {
+    try {
+        const result = await safeExeca("git", args, { cwd, stdio: "pipe" });
+        return result.stdout.trim();
+    }
+    catch {
+        return undefined;
+    }
+}
+function policyContent(cwd, explicitPolicy) {
+    if (explicitPolicy !== undefined) {
+        const trimmed = explicitPolicy.trim();
+        if (trimmed.startsWith("{") || trimmed.startsWith("---"))
+            return explicitPolicy;
+    }
+    const path = explicitPolicy ?? join(cwd, ".github", "autoremediator.yml");
+    try {
+        return existsSync(path) ? readFileSync(path, "utf8") : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export async function fingerprintRepo(cwd, policy) {
+    const files = discoverProjectFiles(cwd)
+        .map((file) => relative(cwd, file))
+        .toSorted();
+    const lines = files.map((file) => {
+        try {
+            return `${file}\0${sha256(readFileSync(join(cwd, file)))}`;
+        }
+        catch {
+            return `${file}\0unreadable`;
+        }
+    });
+    const head = await git(cwd, ["rev-parse", "HEAD"]);
+    const status = head === undefined ? undefined : await git(cwd, ["status", "--porcelain"]);
+    const policyText = policyContent(cwd, policy);
+    return {
+        ...(head ? { gitHead: head } : {}),
+        dirty: Boolean(status && status.length > 0),
+        filesSha256: sha256(lines.join("\n")),
+        ...(policyText === undefined ? {} : { policySha256: sha256(policyText) }),
+    };
+}
+/** Whether two fingerprints describe the same inputs to remediation (the commit itself may differ). */
+export function sameInputs(a, b) {
+    return a.filesSha256 === b.filesSha256 && a.policySha256 === b.policySha256;
+}
+//# sourceMappingURL=fingerprint.js.map

package/dist/runs/fingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../../src/runs/fingerprint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAE3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAanC,KAAK,UAAU,GAAG,CAAC,GAAW,EAAE,IAAc;IAC5C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACpE,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,cAAuB;IACzD,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,cAAc,CAAC;IAClF,CAAC;IACD,MAAM,IAAI,GAAG,cAAc,IAAI,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC1E,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,MAAe;IAChE,MAAM,KAAK,GAAG,oBAAoB,CAAC,GAAG,CAAC;SACpC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;SAClC,QAAQ,EAAE,CAAC;IACd,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC/B,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,KAAK,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,IAAI,cAAc,CAAC;QAC/B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;IAC1F,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAE9C,OAAO;QACL,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClC,KAAK,EAAE,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QAC3C,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,UAAU,CAAC,CAAkB,EAAE,CAAkB;IAC/D,OAAO,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,YAAY,CAAC;AAC9E,CAAC"}

package/dist/runs/hash.d.ts

@@ -0,0 +1,4 @@
+/** JSON with object keys sorted at every level, so equal values always serialise identically. */
+export declare function canonicalJson(value: unknown): string;
+export declare function sha256(data: string | Uint8Array): string;
+//# sourceMappingURL=hash.d.ts.map

package/dist/runs/hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.d.ts","sourceRoot":"","sources":["../../src/runs/hash.ts"],"names":[],"mappings":"AAEA,iGAAiG;AACjG,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAUpD;AAED,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAExD"}

package/dist/runs/hash.js

@@ -0,0 +1,18 @@
+import { createHash } from "node:crypto";
+/** JSON with object keys sorted at every level, so equal values always serialise identically. */
+export function canonicalJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map((entry) => canonicalJson(entry)).join(",")}]`;
+    if (value !== null && typeof value === "object") {
+        const entries = Object.entries(value)
+            .filter(([, entry]) => entry !== undefined)
+            .toSorted(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
+            .map(([key, entry]) => `${JSON.stringify(key)}:${canonicalJson(entry)}`);
+        return `{${entries.join(",")}}`;
+    }
+    return JSON.stringify(value) ?? "null";
+}
+export function sha256(data) {
+    return createHash("sha256").update(data).digest("hex");
+}
+//# sourceMappingURL=hash.js.map

package/dist/runs/hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.js","sourceRoot":"","sources":["../../src/runs/hash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,iGAAiG;AACjG,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7F,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;aAC7D,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;aAC1C,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aACpD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3E,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,IAAyB;IAC9C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC"}

package/dist/runs/ids.d.ts

@@ -0,0 +1,6 @@
+export declare function newRunId(): string;
+export declare const isRunId: (value: unknown) => value is string;
+export declare const isPlanId: (value: unknown) => value is string;
+export declare function newAttemptId(): string;
+export declare const isAttemptId: (value: unknown) => value is string;
+//# sourceMappingURL=ids.d.ts.map

package/dist/runs/ids.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ids.d.ts","sourceRoot":"","sources":["../../src/runs/ids.ts"],"names":[],"mappings":"AAOA,wBAAgB,QAAQ,IAAI,MAAM,CAEjC;AAED,eAAO,MAAM,OAAO,UAAW,OAAO,KAAG,KAAK,IAAI,MACD,CAAC;AAElD,eAAO,MAAM,QAAQ,UAAW,OAAO,KAAG,KAAK,IAAI,MACD,CAAC;AAEnD,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED,eAAO,MAAM,WAAW,UAAW,OAAO,KAAG,KAAK,IAAI,MACD,CAAC"}

package/dist/runs/ids.js

@@ -0,0 +1,15 @@
+import { randomInt } from "node:crypto";
+const ALPHABET = "0123456789abcdefghijklmnopqrstuvwxyz";
+const RUN_ID = /^run_[0-9a-z]{20}$/;
+const PLAN_ID = /^plan_[0-9a-f]{16}$/;
+const ATTEMPT_ID = /^attempt_[0-9a-z]{12}$/;
+export function newRunId() {
+    return `run_${Array.from({ length: 20 }, () => ALPHABET[randomInt(ALPHABET.length)]).join("")}`;
+}
+export const isRunId = (value) => typeof value === "string" && RUN_ID.test(value);
+export const isPlanId = (value) => typeof value === "string" && PLAN_ID.test(value);
+export function newAttemptId() {
+    return `attempt_${Array.from({ length: 12 }, () => ALPHABET[randomInt(ALPHABET.length)]).join("")}`;
+}
+export const isAttemptId = (value) => typeof value === "string" && ATTEMPT_ID.test(value);
+//# sourceMappingURL=ids.js.map

package/dist/runs/ids.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ids.js","sourceRoot":"","sources":["../../src/runs/ids.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,QAAQ,GAAG,sCAAsC,CAAC;AACxD,MAAM,MAAM,GAAG,oBAAoB,CAAC;AACpC,MAAM,OAAO,GAAG,qBAAqB,CAAC;AACtC,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAE5C,MAAM,UAAU,QAAQ;IACtB,OAAO,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AAClG,CAAC;AAED,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,KAAc,EAAmB,EAAE,CACzD,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAElD,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAmB,EAAE,CAC1D,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAEnD,MAAM,UAAU,YAAY;IAC1B,OAAO,WAAW,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AACtG,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAc,EAAmB,EAAE,CAC7D,OAAO,KAAK,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC"}

package/dist/runs/ledger.d.ts

@@ -0,0 +1,26 @@
+export interface StepEvent {
+    seq: number;
+    at: string;
+    type: string;
+    data: Record<string, unknown>;
+    /** Hash of the previous event (zeros for the first). */
+    prevHash: string;
+    /** Hash over `prevHash` and this event's content: editing or removing any line breaks the chain. */
+    hash: string;
+}
+export type LedgerCheck = {
+    ok: true;
+} | {
+    ok: false;
+    seq: number;
+    reason: string;
+};
+/** Append-only, hash-chained record of what a run did (`steps.jsonl`). */
+export declare class Ledger {
+    readonly file: string;
+    constructor(file: string);
+    read(): StepEvent[];
+    append(type: string, data?: Record<string, unknown>): StepEvent;
+    verify(): LedgerCheck;
+}
+//# sourceMappingURL=ledger.d.ts.map

package/dist/runs/ledger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger.d.ts","sourceRoot":"","sources":["../../src/runs/ledger.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,wDAAwD;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,oGAAoG;IACpG,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,WAAW,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAUpF,0EAA0E;AAC1E,qBAAa,MAAM;IACjB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,YAAY,IAAI,EAAE,MAAM,EAEvB;IAED,IAAI,IAAI,SAAS,EAAE,CAMlB;IAED,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,SAAS,CASlE;IAED,MAAM,IAAI,WAAW,CA2BpB;CACF"}

package/dist/runs/ledger.js

@@ -0,0 +1,61 @@
+import { appendFileSync, existsSync, readFileSync } from "node:fs";
+import { canonicalJson, sha256 } from "./hash.js";
+const GENESIS = "0".repeat(64);
+function hashEvent(prevHash, event) {
+    return sha256(prevHash + canonicalJson({ seq: event.seq, at: event.at, type: event.type, data: event.data }));
+}
+/** Append-only, hash-chained record of what a run did (`steps.jsonl`). */
+export class Ledger {
+    file;
+    constructor(file) {
+        this.file = file;
+    }
+    read() {
+        if (!existsSync(this.file))
+            return [];
+        return readFileSync(this.file, "utf8")
+            .split("\n")
+            .filter((line) => line.trim().length > 0)
+            .map((line) => JSON.parse(line));
+    }
+    append(type, data = {}) {
+        // Always continue from what is on disk: other holders of this file (one per code path that
+        // asked the store for the ledger) may have appended since.
+        const tail = this.read().at(-1);
+        const last = tail ? { seq: tail.seq, hash: tail.hash } : { seq: 0, hash: GENESIS };
+        const base = { seq: last.seq + 1, at: new Date().toISOString(), type, data };
+        const event = { ...base, prevHash: last.hash, hash: hashEvent(last.hash, base) };
+        appendFileSync(this.file, `${JSON.stringify(event)}\n`, "utf8");
+        return event;
+    }
+    verify() {
+        let prevHash = GENESIS;
+        let expectedSeq = 1;
+        let events;
+        try {
+            events = this.read();
+        }
+        catch {
+            return { ok: false, seq: expectedSeq, reason: "unreadable line" };
+        }
+        for (const event of events) {
+            if (event.seq !== expectedSeq) {
+                return {
+                    ok: false,
+                    seq: expectedSeq,
+                    reason: `expected event ${expectedSeq}, found ${event.seq}`,
+                };
+            }
+            if (event.prevHash !== prevHash) {
+                return { ok: false, seq: event.seq, reason: "chain broken: previous hash does not match" };
+            }
+            if (event.hash !== hashEvent(prevHash, event)) {
+                return { ok: false, seq: event.seq, reason: "event content does not match its hash" };
+            }
+            prevHash = event.hash;
+            expectedSeq += 1;
+        }
+        return { ok: true };
+    }
+}
+//# sourceMappingURL=ledger.js.map

package/dist/runs/ledger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger.js","sourceRoot":"","sources":["../../src/runs/ledger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEnE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAelD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAE/B,SAAS,SAAS,CAAC,QAAgB,EAAE,KAA2C;IAC9E,OAAO,MAAM,CACX,QAAQ,GAAG,aAAa,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAC/F,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,MAAM,OAAO,MAAM;IACR,IAAI,CAAS;IAEtB,YAAY,IAAY;QACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,IAAI;QACF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC;QACtC,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;aACnC,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;aACxC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAc,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,CAAC,IAAY,EAAE,IAAI,GAA4B,EAAE;QACrD,2FAA2F;QAC3F,2DAA2D;QAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACnF,MAAM,IAAI,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC7E,MAAM,KAAK,GAAc,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QAC5F,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM;QACJ,IAAI,QAAQ,GAAG,OAAO,CAAC;QACvB,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,IAAI,MAAmB,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QACpE,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,KAAK,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;gBAC9B,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,GAAG,EAAE,WAAW;oBAChB,MAAM,EAAE,kBAAkB,WAAW,WAAW,KAAK,CAAC,GAAG,EAAE;iBAC5D,CAAC;YACJ,CAAC;YACD,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC;YAC7F,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;YACxF,CAAC;YACD,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC;YACtB,WAAW,IAAI,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;CACF"}

package/dist/runs/plan.d.ts

@@ -0,0 +1,67 @@
+import type { RemediationConstraints, RemediationReport } from "../platform/types.js";
+import type { RepoFingerprint } from "./fingerprint.js";
+/** The options a plan needs to be applied exactly as it was previewed. */
+export interface PlanOptions {
+    packageManager?: string;
+    policy?: string;
+    runTests?: boolean;
+    typecheck?: boolean;
+    patchesDir?: string;
+    proofOfFix?: boolean;
+    requireProofOfFix?: boolean;
+    reproductionTest?: string;
+    breakingChangeRefactor?: boolean;
+    /** The plan was made with remediation memory ignored, so applying it does not consult memory either. */
+    ignoreMemory?: boolean;
+    constraints?: RemediationConstraints;
+}
+/** One change a plan will make. */
+export interface PlanItem {
+    itemId: string;
+    cveId: string;
+    packageName: string;
+    fromVersion: string;
+    toVersion: string;
+    strategy: "version-bump" | "override";
+    dependencyScope?: "direct" | "transitive";
+    /** The change goes back to an older version (an incident rollback), pinned exactly. Review it as such. */
+    rollback?: true;
+    /** What the pipeline's disposition policy said when previewing; shown to whoever reviews the plan. */
+    disposition?: string;
+    dispositionReason?: string;
+}
+/** A finding the plan cannot act on by itself, with why. */
+export interface PlanSkip {
+    cveId: string;
+    packageName: string;
+    fromVersion: string;
+    strategy: string;
+    reason: string;
+    unresolvedReason?: string;
+}
+export interface RemediationPlan {
+    schemaVersion: "1";
+    planId: string;
+    runId: string;
+    createdAt: string;
+    cwd: string;
+    cveIds: string[];
+    base: RepoFingerprint;
+    options: PlanOptions;
+    items: PlanItem[];
+    skipped: PlanSkip[];
+}
+/**
+ * Turn a preview report into a plan. Version bumps and overrides carry the exact target version the
+ * preview chose, so applying them does not depend on re-deciding anything. A model-generated patch
+ * cannot be replayed from a preview and is listed as skipped with the reason.
+ */
+export declare function buildPlan(input: {
+    runId: string;
+    cwd: string;
+    report: RemediationReport;
+    base: RepoFingerprint;
+    options: PlanOptions;
+    createdAt?: string;
+}): RemediationPlan;
+//# sourceMappingURL=plan.d.ts.map

package/dist/runs/plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.d.ts","sourceRoot":"","sources":["../../src/runs/plan.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACtF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAGxD,0EAA0E;AAC1E,MAAM,WAAW,WAAW;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,wGAAwG;IACxG,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,sBAAsB,CAAC;CACtC;AAED,mCAAmC;AACnC,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,cAAc,GAAG,UAAU,CAAC;IACtC,eAAe,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;IAC1C,0GAA0G;IAC1G,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,sGAAsG;IACtG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,4DAA4D;AAC5D,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,GAAG,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,IAAI,EAAE,eAAe,CAAC;IACtB,OAAO,EAAE,WAAW,CAAC;IACrB,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,OAAO,EAAE,QAAQ,EAAE,CAAC;CACrB;AAQD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,iBAAiB,CAAC;IAC1B,IAAI,EAAE,eAAe,CAAC;IACtB,OAAO,EAAE,WAAW,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,eAAe,CAqDlB"}

package/dist/runs/plan.js

@@ -0,0 +1,68 @@
+import semver from "semver";
+import { canonicalJson, sha256 } from "./hash.js";
+const isRollback = (from, to) => semver.valid(from) !== null && semver.valid(to) !== null && semver.lt(to, from);
+const itemIdOf = (item) => `item_${sha256(canonicalJson([item.cveId, item.packageName, item.fromVersion, item.toVersion, item.strategy])).slice(0, 12)}`;
+/**
+ * Turn a preview report into a plan. Version bumps and overrides carry the exact target version the
+ * preview chose, so applying them does not depend on re-deciding anything. A model-generated patch
+ * cannot be replayed from a preview and is listed as skipped with the reason.
+ */
+export function buildPlan(input) {
+    const { report } = input;
+    const items = [];
+    const skipped = [];
+    for (const result of report.results) {
+        const replayable = (result.strategy === "version-bump" || result.strategy === "override") &&
+            result.toVersion !== undefined &&
+            result.unresolvedReason === undefined;
+        if (replayable) {
+            const draft = {
+                cveId: report.cveId,
+                packageName: result.packageName,
+                fromVersion: result.fromVersion,
+                toVersion: result.toVersion,
+                strategy: result.strategy,
+                ...(result.dependencyScope ? { dependencyScope: result.dependencyScope } : {}),
+                ...(isRollback(result.fromVersion, result.toVersion) ? { rollback: true } : {}),
+                ...(result.disposition ? { disposition: result.disposition } : {}),
+                ...(result.dispositionReason ? { dispositionReason: result.dispositionReason } : {}),
+            };
+            items.push({ itemId: itemIdOf(draft), ...draft });
+            continue;
+        }
+        skipped.push({
+            cveId: report.cveId,
+            packageName: result.packageName,
+            fromVersion: result.fromVersion,
+            strategy: result.strategy,
+            reason: describeSkip(result),
+            ...(result.unresolvedReason ? { unresolvedReason: result.unresolvedReason } : {}),
+        });
+    }
+    const content = {
+        cveIds: [report.cveId],
+        base: input.base,
+        options: input.options,
+        items,
+        skipped,
+    };
+    return {
+        schemaVersion: "1",
+        planId: `plan_${sha256(canonicalJson(content)).slice(0, 16)}`,
+        runId: input.runId,
+        createdAt: input.createdAt ?? new Date().toISOString(),
+        cwd: input.cwd,
+        ...content,
+    };
+}
+function describeSkip(result) {
+    if (result.suppressedBy) {
+        const source = result.suppressedBy.source === "maintainer-vex" ? " by maintainer VEX" : "";
+        return `suppressed${source} (${result.suppressedBy.justification})`;
+    }
+    if (result.strategy === "patch-file") {
+        return "needs a generated patch, which is produced when applied and cannot be previewed exactly";
+    }
+    return result.message;
+}
+//# sourceMappingURL=plan.js.map

package/dist/runs/plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.js","sourceRoot":"","sources":["../../src/runs/plan.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAI5B,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAyDlD,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,EAAU,EAAW,EAAE,CACvD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;AAElF,MAAM,QAAQ,GAAG,CAAC,IAA8B,EAAU,EAAE,CAC1D,QAAQ,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AAEhI;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,KAOzB;IACC,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACzB,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAe,EAAE,CAAC;IAE/B,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpC,MAAM,UAAU,GACd,CAAC,MAAM,CAAC,QAAQ,KAAK,cAAc,IAAI,MAAM,CAAC,QAAQ,KAAK,UAAU,CAAC;YACtE,MAAM,CAAC,SAAS,KAAK,SAAS;YAC9B,MAAM,CAAC,gBAAgB,KAAK,SAAS,CAAC;QAExC,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,KAAK,GAAG;gBACZ,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,SAAS,EAAE,MAAM,CAAC,SAAU;gBAC5B,QAAQ,EAAE,MAAM,CAAC,QAAuC;gBACxD,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9E,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,SAAU,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzF,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrF,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;YAClD,SAAS;QACX,CAAC;QAED,OAAO,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC;YAC5B,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG;QACd,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;QACtB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK;QACL,OAAO;KACR,CAAC;IAEF,OAAO;QACL,aAAa,EAAE,GAAG;QAClB,MAAM,EAAE,QAAQ,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;QAC7D,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACtD,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG,OAAO;KACX,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,MAA4C;IAChE,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,OAAO,aAAa,MAAM,KAAK,MAAM,CAAC,YAAY,CAAC,aAAa,GAAG,CAAC;IACtE,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QACrC,OAAO,yFAAyF,CAAC;IACnG,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC;AACxB,CAAC"}

package/dist/runs/run-store.d.ts

@@ -0,0 +1,83 @@
+import type { RemediationReport } from "../platform/types.js";
+import type { RepoFingerprint } from "./fingerprint.js";
+import { Ledger } from "./ledger.js";
+import type { RemediationPlan } from "./plan.js";
+export type RunStatus = "planned" | "applying" | "applied" | "partial" | "failed" | "rolled-back";
+export interface RunRecord {
+    schemaVersion: 1;
+    runId: string;
+    status: RunStatus;
+    cwd: string;
+    cveIds: string[];
+    source?: string;
+    createdAt: string;
+    updatedAt: string;
+    planId?: string;
+    /** An agent repaired project source in this run, so a verification must allow source edits. */
+    allowSourceEdits?: boolean;
+    /** Inputs the plan was made against. */
+    base: RepoFingerprint;
+    /** Inputs as the last completed step left them; a rollback is only safe while they still match. */
+    after?: RepoFingerprint;
+    error?: string;
+}
+export type AttemptStatus = "open" | "abandoned" | "verified" | "rejected" | "failed" | "promoted" | "promotion-failed";
+/** One try, by an agent, at making an upgrade work. */
+export interface AttemptRecord {
+    attemptId: string;
+    itemId: string;
+    agentId: string;
+    status: AttemptStatus;
+    /** What happened, in a sentence: the agent's summary, or why it was rejected. */
+    reason: string;
+    /** Times the verifier's findings were handed back to the agent. */
+    rounds: number;
+    changedFiles: string[];
+    /** An open attempt's checkout: where a host agent edits. Gone once the attempt is closed. */
+    worktreePath?: string;
+    inputTokens?: number;
+    outputTokens?: number;
+    startedAt: string;
+    endedAt: string;
+}
+export interface RunInit {
+    cwd: string;
+    cveIds: string[];
+    source?: string;
+    planId?: string;
+    base: RepoFingerprint;
+    status?: RunStatus;
+}
+/** Run records live in `<project>/.autoremediator/runs/<runId>/`. */
+export declare class RunStore {
+    readonly cwd: string;
+    readonly root: string;
+    constructor(cwd: string);
+    /** Directory of a run; the id is validated, so it can never point outside `root`. */
+    runDir(runId: string): string;
+    create(init: RunInit): RunRecord;
+    exists(runId: string): boolean;
+    load(runId: string): RunRecord;
+    update(runId: string, patch: Partial<Omit<RunRecord, "runId" | "schemaVersion">>): RunRecord;
+    /** Newest first. Unreadable run directories are skipped rather than failing the listing. */
+    list(): RunRecord[];
+    ledger(runId: string): Ledger;
+    hasFile(runId: string, name: string): boolean;
+    /** The run's plan, when it has one. */
+    readPlan(runId: string): RemediationPlan | undefined;
+    /** The preview report a plan was made from, when the run has one. */
+    readReport(runId: string): RemediationReport | undefined;
+    /** Directory of one attempt; both ids are validated. */
+    attemptDir(runId: string, attemptId: string): string;
+    /** An attempt's record and the files that explain it (`diff.patch`, `transcript.jsonl`, ...). */
+    writeAttempt(runId: string, record: AttemptRecord, files?: Record<string, string>): void;
+    listAttempts(runId: string): AttemptRecord[];
+    /** Write atomically (temp file, then rename), so readers never see a half-written file. */
+    writeJson(runId: string, name: string, value: unknown): void;
+    /**
+     * Take the run's apply lock. The lock records the owning process; one whose process has died is
+     * taken over, so a crashed apply can be resumed.
+     */
+    acquireApplyLock(runId: string): () => void;
+}
+//# sourceMappingURL=run-store.d.ts.map

package/dist/runs/run-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-store.d.ts","sourceRoot":"","sources":["../../src/runs/run-store.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEjD,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,aAAa,CAAC;AAElG,MAAM,WAAW,SAAS;IACxB,aAAa,EAAE,CAAC,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,SAAS,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,wCAAwC;IACxC,IAAI,EAAE,eAAe,CAAC;IACtB,mGAAmG;IACnG,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,aAAa,GACrB,MAAM,GACN,WAAW,GACX,UAAU,GACV,UAAU,GACV,QAAQ,GACR,UAAU,GACV,kBAAkB,CAAC;AAEvB,uDAAuD;AACvD,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,aAAa,CAAC;IACtB,iFAAiF;IACjF,MAAM,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,6FAA6F;IAC7F,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,OAAO;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,eAAe,CAAC;IACtB,MAAM,CAAC,EAAE,SAAS,CAAC;CACpB;AAED,qEAAqE;AACrE,qBAAa,QAAQ;IACnB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,YAAY,GAAG,EAAE,MAAM,EAGtB;IAED,qFAAqF;IACrF,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAG5B;IAED,MAAM,CAAC,IAAI,EAAE,OAAO,GAAG,SAAS,CAkB/B;IAED,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE7B;IAED,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAG7B;IAED,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,GAAG,eAAe,CAAC,CAAC,GAAG,SAAS,CAQ3F;IAED,4FAA4F;IAC5F,IAAI,IAAI,SAAS,EAAE,CAYlB;IAED,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE5B;IAED,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAE5C;IAED,uCAAuC;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAKnD;IAED,qEAAqE;IACrE,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAKvD;IAED,wDAAwD;IACxD,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAInD;IAED,iGAAiG;IACjG,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,IAAI,CAM3F;IAED,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,EAAE,CAe3C;IAED,2FAA2F;IAC3F,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAK3D;IAED;;;OAGG;IACH,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,IAAI,CAc1C;CACF"}